@stacksjs/ts-cloud 0.11.7 → 0.12.1

package/dist/chunk-y6e86wjs.js

@@ -0,0 +1,445 @@
+import{Vh as Zz,Wh as U1}from"./chunk-gearw6rk.js";import{Xh as Jz}from"./chunk-r2pbqcnz.js";import{Zh as zz}from"./chunk-wte9mh18.js";import{rl as m2}from"./chunk-q0wffgw5.js";import{yl as u2}from"./chunk-wcrj06cg.js";import{$l as C0,Fn as H$,In as fz,Jn as s1,Vl as z2,Wl as J2,Zl as y2,_l as P2,bm as D$,cm as n2,dm as K4,em as m0,lm as P}from"./chunk-6xcbfs2r.js";import{Et as V6}from"./chunk-rr1yaj55.js";import{readFileSync as Qz}from"node:fs";import{join as f6}from"node:path";function l9($={}){let z=new Set;for(let J of Object.values($)){if(!J.domain)continue;if(J.redirect||J.deploy==="server"||J.start)z.add(J.domain)}return z}function r$($){return $.replace(/\.$/,"").toLowerCase()}function B4($,z,J){let Z=r$($.name),Q=r$(z),W=r$(J),Y=W===Q?"@":W.endsWith(`.${Q}`)?W.slice(0,-(Q.length+1)):W;return Z===W||Z===Y||Y==="@"&&(Z===""||Z===Q)}async function U4($,z,J,Z,Q="A"){let W=await $.listRecords(z);if(!W.success)return[`could not list ${Q} records: ${W.message||"unknown provider error"}`];let Y=W.records.filter((G)=>G.type===Q&&B4(G,z,J)),q=Y.findIndex((G)=>G.content===Z);if(Y.length<=1||q===-1)return[];let j=[];for(let[G,K]of Y.entries()){if(G===q)continue;let V=await $.deleteRecord(z,K);if(!V.success)j.push(`could not remove stale ${K.name} ${Q} ${K.content}: ${V.message||"unknown provider error"}`)}return j}function K0($){if(!$)return;let z=$.trim();if(!z)return;if(!z.includes("/"))return z;let[J]=z.split("/");if(!J.endsWith("::"))return J||void 0;return`${J}1`}var C4=new Set(["mail","smtp","imap","mx"]);function x4($){return!C4.has($.split(".")[0]??"")}async function p9($){let{provider:z,zone:J,fqdn:Z,ipv4:Q,ipv6:W,ttl:Y=600}=$,q={published:[],warnings:[]},j=[{type:"A",content:Q}];if(W&&x4(Z))j.push({type:"AAAA",content:W});for(let{type:G,content:K}of j){let V=await z.upsertRecord(J,{name:Z,type:G,content:K,ttl:Y});if(V?.success===!1){q.warnings.push(`${Z} → ${K} failed: ${V.error||V.message||"unknown error"}`);continue}if(q.warnings.push(...(await U4(z,J,Z,K,G)).map((H)=>`${Z} cleanup: ${H}`)),await L4(z,J,Z,K,G))q.published.push({fqdn:Z,type:G,content:K});else q.warnings.push(`${Z} → ${K} reported success at ${z.name} but no matching ${G} record exists — create it manually: ${G} ${Z} → ${K}`)}return q}async function L4($,z,J,Z,Q){try{if(typeof $?.listRecords!=="function")return!0;let W=await $.listRecords(z);if(!W?.success||!Array.isArray(W.records))return!0;return W.records.some((Y)=>{let q=typeof Y?.name==="string"?Y.name.replace(/\.$/,""):"";return Y?.type===Q&&q===J&&Y?.content===Z})}catch{return!0}}function D4($){return $.length>4000?`…
+${$.slice(-4000)}`:$}function K$($,z){let J=$.filter((Y)=>Y.status!=="Success");if(J.length===0)return z;let Z=J.slice(0,3).map((Y)=>{let q=(Y.error||Y.output||"").trim(),j=`${Y.instanceId}: ${Y.status}`;return q?`${j}
+${D4(q)}`:j}),Q=J.length-Z.length,W=Q>0?[`(+${Q} more instance${Q===1?"":"s"} failed)`]:[];return[z,...Z,...W].join(`
+`)}function w4($){let z=2166136261,J=16777619;for(let Z=0;Z<$.length;Z++){let Q=$.charCodeAt(Z);z=Math.imul(z^Q,16777619)>>>0,J=Math.imul(J+Q,2246822507)>>>0}return`${z.toString(36)}${J.toString(36)}`.padEnd(12,"0").slice(0,12)}function A4($,z,J={}){let Z=J.mode??"testing",Q=J.maxAge??604800,W=J.mx?.length?J.mx:[$.hostname],Y=`${["version: STSv1",`mode: ${Z}`,...W.map((j)=>`mx: ${j}`),`max_age: ${Q}`].join(`\r
+`)}\r
+`,q=w4(Y);return{host:`mta-sts.${z}`,body:Y,id:q,txt:`v=STSv1; id=${q}`}}var R4=8461;function n9($,z=R4){return[`const policy = ${JSON.stringify($.body)}`,"Bun.serve({",`  port: ${z},`,"  hostname: '127.0.0.1',","  fetch(req) {","    const { pathname } = new URL(req.url)","    if (pathname !== '/.well-known/mta-sts.txt') return new Response('Not Found', { status: 404 })","    return new Response(policy, { headers: { 'content-type': 'text/plain; charset=utf-8' } })","  },","})"].join(`
+`)}var o0={php:"php.net",nginx:"nginx.org",composer:"getcomposer.org",mysql:"mysql.com",mariadb:"mariadb.com/server",postgres:"postgresql.org",vitess:"vitess.io",etcd:"etcd.io",redis:"redis.io",memcached:"memcached.org",meilisearch:"meilisearch.com",mail:"github.com/mail-os/mail",git:"git-scm.com",certbot:"certbot.eff.org",bun:"bun.sh",node:"nodejs.org",deno:"deno.land"};var d="/opt/pantry";function V$($){return`'${$.split("'").join("'\\''")}'`}function O$($={}){return["export DEBIAN_FRONTEND=noninteractive","export PANTRY_SERVICE_SCOPE=system","export PANTRY_INSTALL_DIR=/usr/local/bin",$.version?`export PANTRY_VERSION=${V$($.version)}`:'export PANTRY_VERSION="${PANTRY_VERSION:-latest}"',"command -v curl >/dev/null 2>&1 || (apt-get update -y && apt-get install -y curl ca-certificates)","command -v unzip >/dev/null 2>&1 || (apt-get update -y && apt-get install -y unzip)",'OS=$(uname -s | tr \'[:upper:]\' \'[:lower:]\'); ARCH=$(uname -m); case "$ARCH" in x86_64|amd64) ARCH=x64 ;; arm64|aarch64) ARCH=arm64 ;; esac; ZIP="pantry-${OS}-${ARCH}.zip"; if [ "${PANTRY_VERSION:-latest}" = latest ]; then REL=\'latest/download\'; else REL="download/v${PANTRY_VERSION}"; fi; TMP=$(mktemp -d); curl -fsSL -o "${TMP}/${ZIP}" "https://github.com/pantry-pm/pantry/releases/${REL}/${ZIP}"; unzip -o "${TMP}/${ZIP}" -d /usr/local/bin; chmod +x /usr/local/bin/pantry; rm -rf "${TMP}"','export PATH="/usr/local/bin:$PATH"',"mkdir -p /opt/pantry"]}function Y0(){return'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true'}function z0($){if($.length===0)return[];return[`(cd /opt/pantry && pantry install ${[...new Set($)].map(V$).join(" ")})`]}function M$($){return[...new Set($)].flatMap((z)=>[`(cd /opt/pantry && pantry start ${V$(z)})`,`(cd /opt/pantry && pantry enable ${V$(z)})`])}var o="/etc/mail",Z0="mail-server",a$="mail",n$=`${d}/pantry/.bin`;function J0($){return`'${String($).split("'").join("'\\''")}'`}function w0($){return`"${$.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`}function N4($){return[$.version?`${o0.mail}@${$.version}`:o0.mail]}function i$($,z){return`${o}/dkim/${z}.${$.dkim.selector}.pem`}function E4($){let z=["# Generated by ts-cloud. Edits are overwritten on the next deploy —","# change `services.mail` in the cloud config instead.","","[server]",`host = ${w0($.bindAddress)}`,`port = ${$.ports.smtp}`,`hostname = ${w0($.hostname)}`];if($.domains.length>0)z.push(`local_domains = ${w0($.domains.join(", "))}`);if($.mode==="catcher")z.push("catch_all = true");if(z.push(`max_message_size = ${$.maxMessageSize}`,"","[tls]",`enabled = ${$.tls.enabled}`),$.tls.certPath)z.push(`cert_path = ${w0($.tls.certPath)}`);if($.tls.keyPath)z.push(`key_path = ${w0($.tls.keyPath)}`);if(z.push("","[auth]",`enabled = ${$.mode==="server"}`,"","[antispam]",`dnsbl = ${$.spam.dnsbl}`,`greylist = ${$.spam.greylist}`,`spam_filter = ${$.spam.enabled}`,`junk_score = ${$.spam.junkScore}`,`reject_score = ${$.spam.rejectScore}`,"","[dkim]",`rotation_enabled = ${$.dkim.enabled&&$.dkim.rotate}`,`rotation_interval_days = ${$.dkim.rotateIntervalDays}`,"","[acme]",`enabled = ${$.tls.acme}`),$.tls.acmeEmail)z.push(`email = ${w0($.tls.acmeEmail)}`);if(z.push("","[webhook]",`enabled = ${!!$.webhookUrl}`),$.webhookUrl)z.push(`url = ${w0($.webhookUrl)}`);return z.push(""),z.join(`
+`)}function k4($){let z=["# Generated by ts-cloud. See /etc/mail/config.toml for the rest.",`SMTP_DB_PATH=${$.storagePath}/mail.db`,`SMTP_DELIVERY_METHOD=${$.delivery==="ses"?"ses":"direct"}`];if($.delivery==="ses")z.push(`SMTP_SES_REGION=${$.sesRegion}`);if($.ports.submission)z.push(`SUBMISSION_PORT=${$.ports.submission}`);if($.ports.submissions)z.push(`SMTPS_PORT=${$.ports.submissions}`);if($.ports.imap)z.push("IMAP_ENABLED=1",`IMAP_PORT=${$.ports.imap}`);if($.webmail.enabled)z.push("SMTP_ENABLE_WEBMAIL=true",`SMTP_WEBMAIL_PORT=${$.webmail.port}`,`SMTP_WEBMAIL_SECURE_COOKIES=${$.tls.enabled}`);if($.tls.requireForAuth)z.push("SMTP_REQUIRE_TLS_FOR_AUTH=true");if($.dkim.enabled&&$.domains.length>0){let[J,...Z]=$.domains;if(z.push(`DKIM_DOMAIN=${J}`,`DKIM_SELECTOR=${$.dkim.selector}`,`DKIM_PRIVATE_KEY_PATH=${i$($,J)}`),Z.length>0){let Q=Z.map((W)=>`${W}:${$.dkim.selector}:${i$($,W)}`);z.push(`DKIM_EXTRA_KEYS=${Q.join(",")}`)}}return z.push(""),z.join(`
+`)}function _4($){let z=[$.ports.smtp,$.ports.submission,$.ports.submissions,$.ports.imap,$.ports.imaps].some((J)=>typeof J==="number"&&J<1024);return["[Unit]","Description=Mail server (SMTP/IMAP + webmail)","After=network-online.target","Wants=network-online.target","","[Service]","Type=simple",`User=${Z0}`,`Group=${Z0}`,`WorkingDirectory=${$.storagePath}`,`EnvironmentFile=${o}/mail.env`,`Environment="PATH=${n$}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"`,`ExecStart=${n$}/mail serve --config ${o}/config.toml`,"Restart=always","RestartSec=5","LimitNOFILE=65536",...z?["AmbientCapabilities=CAP_NET_BIND_SERVICE","CapabilityBoundingSet=CAP_NET_BIND_SERVICE"]:[],"NoNewPrivileges=true","PrivateTmp=true","ProtectSystem=strict","ProtectHome=true","ProtectKernelTunables=true","ProtectKernelModules=true","ProtectControlGroups=true",`ReadWritePaths=${$.storagePath} ${o}`,"","[Install]","WantedBy=multi-user.target",""].join(`
+`)}function T4($){if(!$.dkim.enabled||$.domains.length===0)return[];let z=[`mkdir -p ${o}/dkim`];for(let J of $.domains){let Z=i$($,J);z.push(`if [ ! -f ${J0(Z)} ]; then openssl genrsa -out ${J0(Z)} 2048; fi`,`chmod 0600 ${J0(Z)}`,`echo "DKIM ${$.dkim.selector}._domainkey.${J} IN TXT v=DKIM1; k=rsa; p=$(openssl rsa -in ${J0(Z)} -pubout -outform PEM 2>/dev/null | grep -v '^-----' | tr -d '\\n')"`)}return z.push(`chown -R ${Z0}:${Z0} ${o}/dkim`),z}function y4($){if($.accounts.length===0)return[];let z=(J)=>`runuser -u ${Z0} -- env SMTP_DB_PATH=${J0(`${$.storagePath}/mail.db`)} ${n$}/mail user:local ${J} || true`;return $.accounts.flatMap((J)=>[z(`create ${J0(J.address)} ${J0(J.password)} ${J0(J.address)}`),z(`change-password ${J0(J.address)} ${J0(J.password)}`)])}function M2($){if(!$.enabled)return[];return[...z0(N4($)),`id -u ${Z0} >/dev/null 2>&1 || useradd --system --no-create-home --shell /usr/sbin/nologin ${Z0}`,`mkdir -p ${$.storagePath} ${o}`,`chown -R ${Z0}:${Z0} ${$.storagePath}`,`cat > ${o}/config.toml <<'TS_CLOUD_MAIL_CONF_EOF'`,E4($),"TS_CLOUD_MAIL_CONF_EOF",`cat > ${o}/mail.env <<'TS_CLOUD_MAIL_ENV_EOF'`,k4($),"TS_CLOUD_MAIL_ENV_EOF",`chmod 0640 ${o}/mail.env`,`chown root:${Z0} ${o}/mail.env`,...T4($),`cat > /etc/systemd/system/${a$}.service <<'TS_CLOUD_MAIL_UNIT_EOF'`,_4($),"TS_CLOUD_MAIL_UNIT_EOF","systemctl daemon-reload",`systemctl enable ${a$}`,`systemctl restart ${a$}`,...y4($)]}var a=`${d}/pantry/.bin`,s$=15306,o$=15991,F$=15999,F2=16101,B$=2379,q0="/var/lib/vitess",e$=100;function P4($){return $===!0||typeof $==="object"&&$!==null}function I4($){return typeof $==="object"&&$!==null?$:{}}function y($){return`'${String($).split("'").join("'\\''")}'`}function S4($){let J=[$.version?`vitess.io@${$.version}`:"vitess.io"];if($.mode!=="combo"&&!$.etcdEndpoint)J.push("etcd.io");return J.push("mysql.com@8.0.43"),J}var c="vitess",f4=`${a}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`,x2="/usr/local/lib/vitess",$1=new Map;function t$($){return`${x2}/${$}.sh`}function P0($,z){return $1.set($,b4(z)),`/bin/sh ${t$($)}`}function B2(){let $=[`mkdir -p ${x2}`];for(let[z,J]of $1)$.push(`cat > ${t$(z)} <<'TS_CLOUD_VITESS_LAUNCHER_EOF'`,J,"TS_CLOUD_VITESS_LAUNCHER_EOF",`chmod 0755 ${t$(z)}`);return $}function b4($){return["#!/bin/sh","set -e",`cd ${d}`,`PANTRY_ENV="$(pantry env 2>/dev/null | grep -E '^(export [A-Za-z_]|[A-Za-z_][A-Za-z0-9_]*=)' || true)"`,'if [ -n "$PANTRY_ENV" ]; then eval "$PANTRY_ENV"; fi',`VT_MYSQL_ROOT="$(dirname "$(dirname "$(readlink -f ${a}/mysqld 2>/dev/null)")")"`,`VTROOT="$(dirname "$(dirname "$(readlink -f ${a}/mysqlctld 2>/dev/null)")")"`,"export VT_MYSQL_ROOT VTROOT",'LD_LIBRARY_PATH="$VT_MYSQL_ROOT/lib:$VTROOT/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"',"export LD_LIBRARY_PATH",`exec ${$.join(" ")}`].join(`
+`)}function I0($){let z=["[Unit]",`Description=${$.description}`,`After=network.target${$.after?.length?` ${$.after.join(" ")}`:""}`];if($.requires?.length)z.push(`Requires=${$.requires.join(" ")}`);return z.push("","[Service]","Type=simple",`User=${c}`,`Group=${c}`,`Environment="PATH=${f4}"`,`Environment="VTDATAROOT=${q0}"`,...Object.entries($.environment??{}).map(([J,Z])=>`Environment="${J}=${Z}"`),...($.execStartPre??[]).map((J)=>`ExecStartPre=${J}`),`ExecStart=${$.execStart}`,"Restart=always","RestartSec=5","LimitNOFILE=65535","","[Install]","WantedBy=multi-user.target"),z.join(`
+`)}function U2($,z){return[`cat > /etc/systemd/system/${$}.service <<'TS_CLOUD_VITESS_UNIT_EOF'`,z,"TS_CLOUD_VITESS_UNIT_EOF"]}function h4($){let z=$.cell??"zone1",J=$.vtgatePort??s$,Q=`${(($.keyspaces?.length)?$.keyspaces:[{name:"app"}]).map((W)=>{let Y=(W.sharded?["-80","80-"]:["0"]).map((q)=>`shards:{name:"${q}"}`).join(" ");return`keyspaces:{name:"${W.name}" ${Y}}`}).join(" ")} cells:"${z}"`;return I0({description:"Vitess (vtcombo, single-process development stack)",execStart:P0("vtcombo",[`${a}/vtcombo`,`--cell ${z}`,`--proto-topo ${y(Q)}`,`--mysql-server-port ${J}`,"--mysql-server-bind-address 127.0.0.1","--mysql-auth-server-impl none","--start-mysql",`--port ${o$}`,`--grpc-port ${F$}`])})}function v4(){return I0({description:"etcd (Vitess topology store)",execStart:P0("etcd",[`${a}/etcd`,`--data-dir ${q0}/etcd`,`--listen-client-urls http://127.0.0.1:${B$}`,`--advertise-client-urls http://127.0.0.1:${B$}`]),execStartPre:[`+/bin/mkdir -p ${q0}/etcd`,`+/bin/chown ${c}:${c} ${q0}/etcd`]})}function z1($){return["--topo-implementation etcd2",`--topo-global-server-address ${$.etcdEndpoint??`http://127.0.0.1:${B$}`}`,"--topo-global-root /vitess/global"]}function u4($){let z=!$.etcdEndpoint;return I0({description:"Vitess vtctld (control plane)",after:z?["vitess-etcd.service"]:[],requires:z?["vitess-etcd.service"]:[],execStart:P0("vtctld",[`${a}/vtctld`,...z1($),`--cell ${$.cell??"zone1"}`,"--service-map grpc-vtctl,grpc-vtctld",`--grpc-port ${F$}`,`--port ${F$+1}`])})}function m4($,z,J){let Z=$.cell??"zone1";return I0({description:`Vitess vttablet (${z}/${J})`,after:["vitess-vtctld.service","vitess-mysqlctld.service"],requires:["vitess-mysqlctld.service"],execStart:P0("vttablet",[`${a}/vttablet`,...z1($),`--tablet-path ${Z}-${String(e$).padStart(10,"0")}`,`--init-keyspace ${z}`,`--init-shard ${J}`,"--init-tablet-type replica",`--service-map ${y("grpc-queryservice,grpc-tabletmanager,grpc-updatestream")}`,`--port ${F2}`,`--grpc-port ${F2+1}`,`--db-port ${$.mysqlPort??3306}`,`--mycnf-mysql-port ${$.mysqlPort??3306}`])})}function g4($){return I0({description:"Vitess mysqlctld (managed mysqld)",execStart:P0("mysqlctld",[`${a}/mysqlctld`,`--tablet-uid ${e$}`,`--mysql-port ${$.mysqlPort??3306}`,'--init-db-sql-file "$VTROOT/config/init_db.sql"',"--wait-time 2m"]),execStartPre:[`+/bin/mkdir -p ${q0}`,`+/bin/chown ${c}:${c} ${q0}`]})}var L2="/etc/vitess/auth.json",t0="/var/lib/vitess/vtgate-auth.sha256";function d4($){let z=$.username??"vitess",J=$.password??"";return["mkdir -p /etc/vitess",'VTESS_AUTH_TMP="$(mktemp)"',`cat > "$VTESS_AUTH_TMP" <<'TS_CLOUD_VITESS_AUTH_EOF'`,JSON.stringify({[z]:[{Password:J,UserData:z}]}),"TS_CLOUD_VITESS_AUTH_EOF",`VTESS_VTGATE_AUTH_SHA="$(sha256sum "$VTESS_AUTH_TMP" | awk '{print $1}')"`,"VTESS_VTGATE_AUTH_CHANGED=1",`if [ -f ${t0} ] && [ "$(cat ${t0})" = "$VTESS_VTGATE_AUTH_SHA" ]; then VTESS_VTGATE_AUTH_CHANGED=0; fi`,`install -o ${c} -g ${c} -m 0600 "$VTESS_AUTH_TMP" ${L2}`,'rm -f "$VTESS_AUTH_TMP"']}function c4($){let z=$.cell??"zone1";return I0({description:"Vitess vtgate (query router)",after:["vitess-vtctld.service"],execStart:P0("vtgate",[`${a}/vtgate`,...z1($),`--cell ${z}`,`--cells-to-watch ${z}`,"--tablet-types-to-wait PRIMARY,REPLICA",`--service-map ${y("grpc-vtgateservice")}`,`--mysql-server-port ${$.vtgatePort??s$}`,`--mysql-server-bind-address ${$.bindAddress??"127.0.0.1"}`,"--mysql-auth-server-impl static",`--mysql-auth-server-static-file ${L2}`,`--port ${o$}`,`--grpc-port ${o$+1}`])})}function l4($){let z=$.cell??"zone1",J=$.etcdEndpoint??`http://127.0.0.1:${B$}`,Z=`${a}/vtctldclient --server 127.0.0.1:${F$}`,Q=[`for i in $(seq 1 30); do ${Z} GetCellInfoNames >/dev/null 2>&1 && break; sleep 2; done`,`if ! ${Z} GetCellInfoNames 2>/dev/null | grep -qx ${y(z)}; then`,`  ${Z} AddCellInfo --root ${y(`/vitess/${z}`)} --server-address ${y(J)} ${y(z)}`,"fi"];for(let W of $.keyspaces??[]){let Y=W.sharded?" --sharded":"";Q.push(`if ! ${Z} GetKeyspace ${y(W.name)} >/dev/null 2>&1; then`,`  ${Z} CreateKeyspace${Y} ${y(W.name)}`,"fi");let q=`${z}-${String(e$).padStart(10,"0")}`;for(let j of W.sharded?["-80","80-"]:["0"]){let G=`${W.name}/${j}`;Q.push("for i in $(seq 1 90); do",`  if ${Z} GetShard ${y(G)} 2>/dev/null | grep -q '"is_primary_serving": *true'; then break; fi`,`  ${Z} PlannedReparentShard ${y(G)} --new-primary ${y(q)} >/dev/null 2>&1 && break`,`  ${Z} InitShardPrimary --force ${y(G)} ${y(q)} >/dev/null 2>&1 && break`,"  sleep 2","done",`if ! ${Z} GetShard ${y(G)} 2>/dev/null | grep -q '"is_primary_serving": *true'; then`,`  echo "no primary could be elected for ${G}" >&2; exit 1`,"fi")}Q.push(`${Z} RebuildKeyspaceGraph ${y(W.name)} >/dev/null`)}return Q}function C2($){let z=$.vtgatePort??s$;return["for i in $(seq 1 60); do",`  if (cd ${d} && eval "$(pantry env 2>/dev/null)"; MYSQL_PWD=${y($.password??"")} ${a}/mysql -h 127.0.0.1 -P ${z} -u ${y($.username??"vitess")} --connect-timeout=2 -e 'SHOW KEYSPACES') >/dev/null 2>&1; then`,`    echo "vtgate is serving on ${z}"; exit 0`,"  fi","  sleep 2","done",`echo "vtgate did not become ready on port ${z}" >&2`,"exit 1"]}function D2($){if(!P4($))return[];let z=I4($),J=z.mode==="combo";$1.clear();let Z=[...z0(S4(z)),`VT_MYSQL_LIB="$(dirname "$(dirname "$(readlink -f ${a}/mysqld)")")/lib"`,'if [ -d "$VT_MYSQL_LIB" ]; then',`  printf '%s\\n' "$VT_MYSQL_LIB" > /etc/ld.so.conf.d/vitess-mysql.conf`,"  ldconfig","else",'  echo "mysqld library directory not found under $VT_MYSQL_LIB" >&2; exit 1',"fi",`id -u ${c} >/dev/null 2>&1 || useradd --system --home-dir ${q0} --shell /usr/sbin/nologin ${c}`,`mkdir -p ${q0}`,`chown -R ${c}:${c} ${q0}`];if(J)return Z.push(...U2("vitess-vtcombo",h4(z)),...B2(),"systemctl daemon-reload","systemctl enable --now vitess-vtcombo.service",...C2(z)),Z;Z.push(...d4(z));let Q=[];if(!z.etcdEndpoint)Q.push(["vitess-etcd",v4()]);Q.push(["vitess-vtctld",u4(z)],["vitess-mysqlctld",g4(z)],["vitess-vtgate",c4(z)]);for(let W of z.keyspaces??[])for(let Y of W.sharded?["-80","80-"]:["0"])Q.push([`vitess-vttablet-${W.name}-${Y.replace(/-/g,"x")}`,m4(z,W.name,Y)]);for(let[W,Y]of Q)Z.push(...U2(W,Y));Z.push(...B2()),Z.push("systemctl daemon-reload");for(let[W]of Q)Z.push(`systemctl enable --now ${W}.service`);return Z.push(`if [ "$VTESS_VTGATE_AUTH_CHANGED" = 1 ]; then systemctl restart vitess-vtgate.service; printf '%s\\n' "$VTESS_VTGATE_AUTH_SHA" > ${t0}; chown ${c}:${c} ${t0}; chmod 0600 ${t0}; fi`,...l4(z),...C2(z)),Z}var p4=new Set(["singlestore","vitess"]);function w2($){if($?.engine&&p4.has($.engine))return!1;return!$?.host||$.host==="127.0.0.1"||$.host==="localhost"}function J1($,z="psql"){let J=$?.port??5432;if(w2($))return`${z} -p ${J} -U postgres`;let Z=$?.username||"postgres";return`${$?.password?`PGPASSWORD='${$.password.replace(/'/g,"'\\''")}' `:""}${z} -h ${$.host} -p ${J} -U ${Z} -w`}function j0($){return $===!0||typeof $==="object"&&$!=null}function r4($){let z=[],J=[];if(j0($.mysql))z.push(typeof $.mysql==="object"&&$.mysql.version?`mysql.com@${$.mysql.version}`:"mysql.com@8.0.43"),J.push("mysql");else if(j0($.mariadb))z.push(o0.mariadb),J.push("mariadb");if(j0($.postgres))z.push("postgresql.org"),J.push("postgres");if(j0($.redis))z.push("redis.io"),J.push("redis");if(j0($.memcached))z.push("memcached.org"),J.push("memcached");if(j0($.meilisearch))z.push("meilisearch.com"),J.push("meilisearch");return{packages:z,services:J}}function U$($={},z={}){let J=r4($),Z=D2($.vitess),Q=z.mail?M2(z.mail):[];if(J.packages.length===0)return[...Z,...Q];return[...z0(J.packages),...M$(J.services),...Z,...Q]}function S0($,z={}){if(!$?.name)return[];if(!w2($))return[];let J=$.name,Z=$.username||J,Q=$.password||"",W=j0(z.postgres)||$.engine==="postgres",Y=j0(z.mariadb)||$.engine==="mariadb",q=j0(z.mysql)||$.engine==="mysql";if(W&&!q&&!Y){let X=(M)=>`"${M.replace(/"/g,'""')}"`,O=(M)=>`'${M.replace(/'/g,"''")}'`,C=(M,x)=>["DO $$ BEGIN",`  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = ${O(M)}) THEN`,`    CREATE ROLE ${X(M)} LOGIN PASSWORD ${O(x)};`,"  ELSE",`    ALTER ROLE ${X(M)} LOGIN PASSWORD ${O(x)};`,"  END IF;","END $$;"],U=(M)=>{let x=M.databases&&M.databases.length>0?M.databases:[J],A=[];for(let L of x)if(M.access==="readonly")A.push(`GRANT CONNECT ON DATABASE ${X(L)} TO ${X(M.username)};`,`\\connect ${X(L)}`,`GRANT USAGE ON SCHEMA public TO ${X(M.username)};`,`GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${X(M.username)};`,`ALTER DEFAULT PRIVILEGES FOR ROLE ${X(Z)} IN SCHEMA public GRANT SELECT ON TABLES TO ${X(M.username)};`,"\\connect postgres");else A.push(`GRANT ALL PRIVILEGES ON DATABASE ${X(L)} TO ${X(M.username)};`);return A},F=$.users||[],B=$.port??5432;return[Y0(),`for i in $(seq 1 30); do pg_isready -p ${B} -q && break; sleep 2; done`,`${J1($)} <<'TS_CLOUD_PG_EOF'`,...C(Z,Q),`SELECT 'CREATE DATABASE ${X(J)} OWNER ${X(Z)}' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = ${O(J)})\\gexec`,...F.flatMap((M)=>[...C(M.username,M.password),...U(M)]),"TS_CLOUD_PG_EOF"]}let j=Y?"/var/lib/pantry/mariadb/mariadbd.sock":"/var/lib/pantry/mysql/mysqld.sock",G=(X)=>X.replace(/`/g,"``"),K=(X)=>X.replace(/\\/g,"\\\\").replace(/'/g,"\\'"),V=(X)=>{let O=X.databases&&X.databases.length>0?X.databases:[J],C=X.access==="readonly"?"SELECT":"ALL PRIVILEGES",U=[`CREATE USER IF NOT EXISTS '${K(X.username)}'@'%' IDENTIFIED BY '${K(X.password)}';`,`CREATE USER IF NOT EXISTS '${K(X.username)}'@'localhost' IDENTIFIED BY '${K(X.password)}';`,`ALTER USER '${K(X.username)}'@'%' IDENTIFIED BY '${K(X.password)}';`,`ALTER USER '${K(X.username)}'@'localhost' IDENTIFIED BY '${K(X.password)}';`];for(let F of O)U.push(`GRANT ${C} ON \`${G(F)}\`.* TO '${K(X.username)}'@'%';`,`GRANT ${C} ON \`${G(F)}\`.* TO '${K(X.username)}'@'localhost';`);return U},H=$.users||[];return[Y0(),`for i in $(seq 1 30); do mysqladmin --socket=${j} -u root ping 2>/dev/null | grep -q alive && break; sleep 2; done`,`mysql --socket=${j} -u root <<'TS_CLOUD_SQL_EOF'`,`CREATE DATABASE IF NOT EXISTS \`${G(J)}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`,...V({username:Z,password:Q}),...H.flatMap(V),"FLUSH PRIVILEGES;","TS_CLOUD_SQL_EOF"]}function A2($){if(!$?.name)return{};let z=$.engine==="singlestore",J=$.engine==="vitess",Z=$.engine==="postgres"?"pgsql":z?"singlestore":J?"vitess":"mysql",Q=$.port??($.engine==="postgres"?5432:J?15306:3306),W={DB_CONNECTION:Z,DB_HOST:$.host||"127.0.0.1",DB_PORT:String(Q),DB_DATABASE:$.name};if($.username)W.DB_USERNAME=$.username;if($.password)W.DB_PASSWORD=$.password;if((z||J)&&$.ssl!==!1)W.DB_SSL="true";return W}var Q1="/var/backups/ts-cloud",a4="/etc/ts-cloud/backups.config.ts",R2="/etc/cron.d/ts-cloud-backups",Z1="/usr/local/bin/ts-cloud-backup.sh";function n4($){if(!$.name)return null;let z=$.host||"127.0.0.1",J=$.engine==="postgres",Z=J?"postgresql":"mysql",Q=$.port??(J?5432:3306),W=(Y)=>Y.replace(/\\/g,"\\\\").replace(/'/g,"\\'");return["  {",`    type: '${Z}',`,`    name: '${W($.name)}',`,"    connection: {",`      hostname: '${W(z)}',`,`      port: ${Q},`,`      database: '${W($.name)}',`,`      username: '${W($.username||$.name)}',`,`      password: '${W($.password||"")}',`,"      ssl: false,","    },","    includeSchema: true,","    includeData: true,","  },"].join(`
+`)}function i4($,z){let J=$?n4($):null,Z=z.bucket?["  destinations: [","    {","      type: 's3',",`      bucket: '${z.bucket}',`,"      prefix: 'db-backups',",...z.endpoint?[`      endpoint: '${z.endpoint}',`]:[],"      optional: false,","    },","  ],"]:[];return["import type { BackupConfig } from 'ts-backups'","","const config: BackupConfig = {","  verbose: true,",`  outputPath: '${Q1}',`,"  retention: {",`    count: ${z.retentionCount??5},`,`    maxAge: ${z.retentionDays??30},`,"  },","  databases: [",...J?[J]:[],"  ],",...Z,"}","","export default config",""].join(`
+`)}function C$($){let{database:z,backups:J}=$;if(!J.enabled)return[];let Z=J.schedule||"0 2 * * *",Q=i4(z,J);return["export DEBIAN_FRONTEND=noninteractive",`mkdir -p /etc/ts-cloud ${Q1}`,"command -v bun >/dev/null 2>&1 || (curl -fsSL https://bun.sh/install | bash && ln -sf /root/.bun/bin/bun /usr/local/bin/bun)","bun add -g ts-backups || true",`cat > ${a4} <<'TS_CLOUD_BACKUP_CFG_EOF'`,Q.replace(/\n$/,""),"TS_CLOUD_BACKUP_CFG_EOF",`cat > ${Z1} <<'TS_CLOUD_BACKUP_RUN_EOF'`,"#!/bin/bash","set -uo pipefail",'export PATH="/root/.bun/bin:/usr/local/bin:$PATH"','notify() { [ -x /usr/local/bin/ts-cloud-notify ] && /usr/local/bin/ts-cloud-notify "$1" || true; }',"cd /etc/ts-cloud",'if ! ts-backups backup --config /etc/ts-cloud/backups.config.ts; then notify "❌ ts-cloud backup failed"; exit 1; fi',"TS_CLOUD_BACKUP_RUN_EOF",`chmod +x ${Z1}`,`cat > ${R2} <<'TS_CLOUD_BACKUP_CRON_EOF'`,`${Z} root ${Z1} >> /var/log/ts-cloud-backup.log 2>&1`,"TS_CLOUD_BACKUP_CRON_EOF",`chmod 644 ${R2}`]}function o4($){return $==="mariadb"?"/var/lib/pantry/mariadb/mariadbd.sock":"/var/lib/pantry/mysql/mysqld.sock"}function q5($,z={}){if(!$?.name)return[];let J=$.name,Z=$.engine==="postgres",Q=z.from?`TS_CLOUD_DUMP="${z.from}"`:`TS_CLOUD_DUMP="$(find ${Q1} -type f -name '*${J}*.sql' -o -type f -name '*${J}*.sql.gz' 2>/dev/null | xargs -r ls -1t 2>/dev/null | head -1)"`,W=Z?`${J1($)} -d "${J}"`:`mysql --socket=${o4($.engine)} -u root "${J}"`;return["set -uo pipefail",'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true',Q,'[ -n "$TS_CLOUD_DUMP" ] && [ -f "$TS_CLOUD_DUMP" ] || { echo "no backup dump found to restore" >&2; exit 1; }','echo "[ts-cloud] restoring '+J+' from $TS_CLOUD_DUMP"',`case "$TS_CLOUD_DUMP" in *.gz) gunzip -c "$TS_CLOUD_DUMP" ;; *) cat "$TS_CLOUD_DUMP" ;; esac | ${W}`,'echo "restore complete"']}function t4($){return`/etc/ts-cloud/${$}-upgrade.env`}function s4($){return`${$}-upgrade`}function N2($){if(!$||$.length===0)return[];let z=["mkdir -p /etc/ts-cloud"],J=[];for(let Z of $){if(Z.enabled===!1)continue;if(!Z.service||!Z.binary)continue;let{service:Q,binary:W,command:Y="upgrade",channel:q="stable",schedule:j="daily",randomizedDelay:G="4h",args:K=[]}=Z,V=s4(Q),H=t4(Q),X=[`--path ${W}`,`--service ${Q}`,...q==="canary"?["--canary"]:[],...K].join(" ");z.push(`if [ ! -f ${H} ]; then`,`  cat > ${H} <<'TS_CLOUD_APPUPD_ENV_EOF'`,"# Set to false to pause automatic updates without disabling the timer.","ENABLED=true","# Extra flags appended to the update command.","ARGS=","TS_CLOUD_APPUPD_ENV_EOF","fi",`chmod 644 ${H}`,`cat > /etc/systemd/system/${V}.service <<'TS_CLOUD_APPUPD_SVC_EOF'`,"[Unit]",`Description=Check for and install ${Q} updates`,"After=network-online.target","Wants=network-online.target","","[Service]","Type=oneshot",`EnvironmentFile=-${H}`,`ExecStart=/bin/sh -c 'if [ "\${ENABLED:-true}" != "true" ]; then echo "auto-update disabled via ${H}"; exit 0; fi; exec ${W} ${Y} ${X} $ARGS'`,"TS_CLOUD_APPUPD_SVC_EOF",`cat > /etc/systemd/system/${V}.timer <<'TS_CLOUD_APPUPD_TMR_EOF'`,"[Unit]",`Description=Scheduled ${Q} update check`,"","[Timer]",`OnCalendar=${j}`,`RandomizedDelaySec=${G}`,"Persistent=true","","[Install]","WantedBy=timers.target","TS_CLOUD_APPUPD_TMR_EOF"),J.push(`systemctl enable --now ${V}.timer`)}if(J.length===0)return[];return[...z,"systemctl daemon-reload",...J]}function V0($=!0){if(!$)return[];return["export DEBIAN_FRONTEND=noninteractive","dpkg-query -W -f='${Status}' unattended-upgrades 2>/dev/null | grep -q 'ok installed' || apt-get install -y unattended-upgrades","cat > /etc/apt/apt.conf.d/20auto-upgrades <<'TS_CLOUD_AUTOUPD_EOF'",'APT::Periodic::Update-Package-Lists "1";','APT::Periodic::Unattended-Upgrade "1";','APT::Periodic::Download-Upgradeable-Packages "1";','APT::Periodic::AutocleanInterval "7";',"TS_CLOUD_AUTOUPD_EOF","systemctl enable --now unattended-upgrades 2>/dev/null || true"]}var E2=[["nginx",80],["https",443],["phpFpm",9074],["mysql",3306],["postgres",5432],["redis",6379],["meilisearch",7700],["typesense",8108],["smtp",25]];function e4($=!0){let z=typeof $==="object"?$:{},J=typeof $==="boolean"?$:$.enabled!==!1,Z=Number(z.alerts?.bandwidthTb??0);return{enabled:J,cpuLoadPerCore:z.alerts?.cpuLoadPerCore??2,memPercent:z.alerts?.memPercent??90,diskPercent:z.alerts?.diskPercent??90,bandwidthTb:Number.isFinite(Z)&&Z>0?Z:0,bandwidthPercent:z.alerts?.bandwidthPercent??80}}function O0($=!0){let{enabled:z,cpuLoadPerCore:J,memPercent:Z,diskPercent:Q,bandwidthTb:W,bandwidthPercent:Y}=e4($);if(!z)return[];let q=Math.round(W*1000000000000),j=E2.map(([K,V])=>`SVC_${K.toUpperCase()}=$(probe ${V})`),G=E2.map(([K])=>`"${K}":"$SVC_${K.toUpperCase()}"`).join(",");return["if ! command -v sadf >/dev/null 2>&1; then export DEBIAN_FRONTEND=noninteractive; apt-get update -qq; apt-get install -y -qq sysstat; fi","systemctl enable --now sysstat.service 2>/dev/null || true","mkdir -p /var/lib/ts-cloud","cat > /usr/local/bin/ts-cloud-metrics.sh <<'TS_CLOUD_METRICS_EOF'","#!/bin/bash","set -uo pipefail","LOAD=$(cut -d' ' -f1 /proc/loadavg)","CPUS=$(nproc)",`read MEM_TOTAL MEM_USED SWAP_TOTAL SWAP_USED <<EOF
+$(free -m | awk '/^Mem:/{total=$2; used=$3} /^Swap:/{print total, used, $2, $3}')
+EOF`,`DISK_PCT=$(df -P / | awk 'NR==2{gsub("%","",$5); print $5}')`,"UPTIME_SEC=$(cut -d' ' -f1 /proc/uptime | cut -d. -f1)",`RX_BYTES=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{rx+=$3} END{print rx+0}' /proc/net/dev)`,`TX_BYTES=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{tx+=$11} END{print tx+0}' /proc/net/dev)`,"NOW_EPOCH=$(date -u +%s); TODAY=$(date -u +%Y-%m-%d); MONTH=$(date -u +%Y-%m)","if [ -r /var/lib/ts-cloud/bandwidth-state ]; then . /var/lib/ts-cloud/bandwidth-state; fi","PREV_EPOCH=${PREV_EPOCH:-0}; PREV_RX=${PREV_RX:-0}; PREV_TX=${PREV_TX:-0}","DAY_KEY=${DAY_KEY:-$TODAY}; MONTH_KEY=${MONTH_KEY:-$MONTH}","DAY_RX=${DAY_RX:-0}; DAY_TX=${DAY_TX:-0}; MONTH_RX=${MONTH_RX:-0}; MONTH_TX=${MONTH_TX:-0}","ELAPSED=$(( NOW_EPOCH - PREV_EPOCH ))",'if [ "$PREV_EPOCH" -le 0 ] || [ "$ELAPSED" -le 0 ] || [ "$RX_BYTES" -lt "$PREV_RX" ] || [ "$TX_BYTES" -lt "$PREV_TX" ]; then',"  DELTA_RX=0; DELTA_TX=0; ELAPSED=0","else","  DELTA_RX=$(( RX_BYTES - PREV_RX )); DELTA_TX=$(( TX_BYTES - PREV_TX ))","fi",'if [ "$DAY_KEY" != "$TODAY" ]; then DAY_KEY=$TODAY; DAY_RX=0; DAY_TX=0; fi','if [ "$MONTH_KEY" != "$MONTH" ]; then MONTH_KEY=$MONTH; MONTH_RX=0; MONTH_TX=0; fi',"DAY_RX=$(( DAY_RX + DELTA_RX )); DAY_TX=$(( DAY_TX + DELTA_TX ))","MONTH_RX=$(( MONTH_RX + DELTA_RX )); MONTH_TX=$(( MONTH_TX + DELTA_TX ))",'if [ "$ELAPSED" -gt 0 ]; then RX_RATE=$(( DELTA_RX / ELAPSED )); TX_RATE=$(( DELTA_TX / ELAPSED )); else RX_RATE=0; TX_RATE=0; fi',"cat > /var/lib/ts-cloud/bandwidth-state.tmp <<BWSTATE","PREV_EPOCH=$NOW_EPOCH","PREV_RX=$RX_BYTES","PREV_TX=$TX_BYTES","RX_RATE=$RX_RATE","TX_RATE=$TX_RATE","DAY_KEY=$DAY_KEY","DAY_RX=$DAY_RX","DAY_TX=$DAY_TX","MONTH_KEY=$MONTH_KEY","MONTH_RX=$MONTH_RX","MONTH_TX=$MONTH_TX","BWSTATE","mv -f /var/lib/ts-cloud/bandwidth-state.tmp /var/lib/ts-cloud/bandwidth-state","probe(){ (exec 3<>/dev/tcp/127.0.0.1/$1) 2>/dev/null && echo up || echo down; }",...j,"LOAD=${LOAD:-0}; CPUS=${CPUS:-1}; MEM_TOTAL=${MEM_TOTAL:-0}; MEM_USED=${MEM_USED:-0}","SWAP_TOTAL=${SWAP_TOTAL:-0}; SWAP_USED=${SWAP_USED:-0}; DISK_PCT=${DISK_PCT:-0}","UPTIME_SEC=${UPTIME_SEC:-0}; RX_BYTES=${RX_BYTES:-0}; TX_BYTES=${TX_BYTES:-0}","MEM_PCT=$(( MEM_TOTAL > 0 ? MEM_USED * 100 / MEM_TOTAL : 0 ))","cat > /var/lib/ts-cloud/metrics.json.tmp <<JSON",`{"load":$LOAD,"cpus":$CPUS,"memTotalMb":$MEM_TOTAL,"memUsedMb":$MEM_USED,"memUsedPct":$MEM_PCT,"swapTotalMb":$SWAP_TOTAL,"swapUsedMb":$SWAP_USED,"diskUsedPct":$DISK_PCT,"uptimeSec":$UPTIME_SEC,"network":{"rxBytes":$RX_BYTES,"txBytes":$TX_BYTES,"rxBytesPerSec":$RX_RATE,"txBytesPerSec":$TX_RATE,"dayKey":"$DAY_KEY","rxBytesToday":$DAY_RX,"txBytesToday":$DAY_TX,"monthKey":"$MONTH_KEY","rxBytesMonth":$MONTH_RX,"txBytesMonth":$MONTH_TX,"budgetBytes":${q}},"services":{`+G+"}}","JSON","mv -f /var/lib/ts-cloud/metrics.json.tmp /var/lib/ts-cloud/metrics.json",'ALERTS=""',`if awk -v l="$LOAD" -v c="$CPUS" -v t=${J} 'BEGIN{exit !(c>0 && l/c > t)}'; then ALERTS="$ALERTS load=$LOAD/${J}xCPU"; fi`,`if [ "\${MEM_PCT:-0}" -ge ${Z} ]; then ALERTS="$ALERTS mem=\${MEM_PCT}%"; fi`,`if [ "\${DISK_PCT:-0}" -ge ${Q} ]; then ALERTS="$ALERTS disk=\${DISK_PCT}%"; fi`,"PREV=$(cat /var/lib/ts-cloud/alert-state 2>/dev/null || echo ok)",'if [ -n "$ALERTS" ]; then','  if [ "$PREV" != alert ] && [ -x /usr/local/bin/ts-cloud-notify ]; then /usr/local/bin/ts-cloud-notify "⚠️ $(hostname): resource alert —$ALERTS" || true; fi',"  echo alert > /var/lib/ts-cloud/alert-state","else",'  if [ "$PREV" = alert ] && [ -x /usr/local/bin/ts-cloud-notify ]; then /usr/local/bin/ts-cloud-notify "✅ $(hostname): resource usage back to normal" || true; fi',"  echo ok > /var/lib/ts-cloud/alert-state","fi",...q>0?["BW_TOTAL=$(( MONTH_RX + MONTH_TX ))",`BW_PCT=$(( BW_TOTAL * 100 / ${q} ))`,"BW_PREV=$(cat /var/lib/ts-cloud/bandwidth-alert-state 2>/dev/null || echo ok)",`if [ "$BW_PCT" -ge ${Y} ]; then`,`  if [ "$BW_PREV" != alert ] && [ -x /usr/local/bin/ts-cloud-notify ]; then /usr/local/bin/ts-cloud-notify "⚠️ $(hostname): bandwidth at \${BW_PCT}% of the ${W} TB monthly allowance ($MONTH_KEY)" || true; fi`,"  echo alert > /var/lib/ts-cloud/bandwidth-alert-state","else",'  if [ "$BW_PREV" = alert ] && [ -x /usr/local/bin/ts-cloud-notify ]; then /usr/local/bin/ts-cloud-notify "✅ $(hostname): bandwidth back under the monthly allowance (${BW_PCT}%)" || true; fi',"  echo ok > /var/lib/ts-cloud/bandwidth-alert-state","fi"]:[],"TS_CLOUD_METRICS_EOF","chmod +x /usr/local/bin/ts-cloud-metrics.sh","cat > /etc/systemd/system/ts-cloud-metrics.service <<'TS_CLOUD_METRICS_SVC_EOF'","[Unit]","Description=ts-cloud metrics collector","","[Service]","Type=oneshot","ExecStart=/usr/local/bin/ts-cloud-metrics.sh","TS_CLOUD_METRICS_SVC_EOF","cat > /etc/systemd/system/ts-cloud-metrics.timer <<'TS_CLOUD_METRICS_TMR_EOF'","[Unit]","Description=Run ts-cloud metrics collector every minute","","[Timer]","OnCalendar=*-*-* *:*:00","AccuracySec=1s","RandomizedDelaySec=5s","Persistent=true","","[Install]","WantedBy=timers.target","TS_CLOUD_METRICS_TMR_EOF","systemctl daemon-reload","systemctl enable --now ts-cloud-metrics.timer","systemctl start ts-cloud-metrics.service"]}var $6={"opcache.enable":"1","opcache.enable_cli":"1","opcache.memory_consumption":"256","opcache.interned_strings_buffer":"16","opcache.max_accelerated_files":"20000","opcache.validate_timestamps":"0","opcache.revalidate_freq":"0","opcache.save_comments":"1","opcache.fast_shutdown":"1",realpath_cache_size:"4096K",realpath_cache_ttl:"600"},z6="127.0.0.1:9074";function k2($){return z6}function J6($={}){let z=$.versions?.length?$.versions:["8.3"];return $.default&&z.includes($.default)?$.default:z[0]}function Z6($={}){return{...$.optimizeForProduction===!1?{}:{...$6},...$.ini||{}}}function Q6($={}){let z=Z6($),J=Object.keys(z);if(J.length===0)return[];let Z=J.map((W)=>`${W}=${z[W]}`),Q="ts-cloud-managed";return[Y0(),"TS_CLOUD_SCAN_DIR=$(php -i 2>/dev/null | awk -F' => ' '/^Scan this dir for additional .ini files/{print $2}' | head -1)",`TS_CLOUD_LOADED_INI=$(php -r 'echo php_ini_loaded_file() ?: "";' 2>/dev/null)`,'if [ -n "$TS_CLOUD_SCAN_DIR" ] && [ "$TS_CLOUD_SCAN_DIR" != "(none)" ]; then','  mkdir -p "$TS_CLOUD_SCAN_DIR"','  TS_CLOUD_PHP_INI="$TS_CLOUD_SCAN_DIR/zz-ts-cloud.ini"',`  cat > "$TS_CLOUD_PHP_INI" <<'TS_CLOUD_PHPINI_EOF'`,`; ${Q} — production PHP tuning`,...Z,"TS_CLOUD_PHPINI_EOF","else",'  if [ -z "$TS_CLOUD_LOADED_INI" ]; then',"    TS_CLOUD_INI_DIR=$(php -i 2>/dev/null | awk -F' => ' '/^Configuration File \\(php.ini\\) Path/{print $2}' | head -1)",'    TS_CLOUD_LOADED_INI="$TS_CLOUD_INI_DIR/php.ini"','    mkdir -p "$TS_CLOUD_INI_DIR"','    touch "$TS_CLOUD_LOADED_INI"',"  fi",`  sed -i '/; ${Q} BEGIN/,/; ${Q} END/d' "$TS_CLOUD_LOADED_INI"`,`  cat >> "$TS_CLOUD_LOADED_INI" <<'TS_CLOUD_PHPINI_EOF'`,`; ${Q} BEGIN`,...Z,`; ${Q} END`,"TS_CLOUD_PHPINI_EOF","fi",`(cd ${d} && pantry restart php-fpm) 2>/dev/null || true`]}function x$($={}){let z=J6($),J=$.installNginx!==!1,Z=$.installComposer!==!1,Q=[`php.net@${z}`];if(Z)Q.push("getcomposer.org");if(J)Q.push("nginx.org");return[...z0(Q),...M$(["php-fpm"]),...Q6($)]}function W1($,z){if(!$)return[];let J=[];if($.template&&z?.[$.template])J.push(...z[$.template]);if($.serverSnippet)J.push(...$.serverSnippet);return J}function W6($){if(!$)return"";let z=typeof $==="object"?$:{},Z=[`max-age=${z.maxAge??31536000}`];if(z.includeSubDomains??!0)Z.push("includeSubDomains");if(z.preload)Z.push("preload");return`    add_header Strict-Transport-Security "${Z.join("; ")}" always;`}function Y6($){if(!$||!$.allow?.length&&!$.deny?.length)return[];let z=[];for(let J of $.deny||[])z.push(`    deny ${J};`);if($.allow?.length){for(let J of $.allow)z.push(`    allow ${J};`);z.push("    deny all;")}return z}function _2($){return`/etc/nginx/.htpasswd-${$}`}var q6=new Set(["laravel","php","statamic","wordpress"]);function j6($){return q6.has($)}function G6($){return $==="laravel"||$==="statamic"?"public":""}function H6($,z){let J=$.replace(/\/+$/,""),Z=z.replace(/^\/+|\/+$/g,"");return Z?`${J}/${Z}`:J}function X6($){let z=$.type??"laravel",J=$.webDirectory??G6(z),Z=H6($.appDir,J),Q=j6(z),W=$.phpVersion??"8.3",Y=[`    root ${Z};`,"",'    add_header X-Frame-Options "SAMEORIGIN";','    add_header X-Content-Type-Options "nosniff";'],q=W6($.hsts);if(q)Y.push(q);for(let j of Y6($.security))Y.push(j);if(Y.push("",`    index ${Q?"index.php index.html":"index.html index.htm"};`,"","    charset utf-8;",""),$.clientMaxBodySize)Y.push(`    client_max_body_size ${$.clientMaxBodySize};`,"");if($.auth)Y.push(`    auth_basic "${$.auth.realm||"Restricted"}";`,`    auth_basic_user_file ${_2($.siteName)};`,"");for(let[j,G]of Object.entries($.redirects||{}))Y.push(`    location = ${j} { return 301 ${G}; }`);if(Object.keys($.redirects||{}).length>0)Y.push("");if(Q){if(Y.push("    location / {","        try_files $uri $uri/ /index.php?$query_string;","    }","","    location = /favicon.ico { access_log off; log_not_found off; }","    location = /robots.txt  { access_log off; log_not_found off; }","","    error_page 404 /index.php;","","    location ~ \\.php$ {",`        fastcgi_pass ${$.fastcgiPass??k2(W)};`,"        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;","        include fastcgi_params;","    }","","    location ~ /\\.(?!well-known).* {","        deny all;","    }"),z==="wordpress")Y.push("","    location = /xmlrpc.php { deny all; }","    location ~* /(?:wp-config\\.php|readme\\.html|license\\.txt)$ { deny all; }","    location ~* /wp-content/uploads/.*\\.php$ { deny all; }")}else if(z==="spa")Y.push("    location / {","        try_files $uri $uri/ /index.html;","    }");else Y.push("    location / {","        try_files $uri $uri/ =404;","    }");if($.serverSnippet&&$.serverSnippet.length>0){Y.push("");for(let j of $.serverSnippet)Y.push(j?`    ${j}`:"")}return Y}function K6($){let z=[$.domain,...$.aliases||[]].filter(Boolean);for(let W of z)if(!/^(?=.{1,253}$)(?:\*\.)?[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/i.test(W.trim()))throw Error(`Refusing to build a vhost: '${W}' is not a valid hostname.`);if(!z.length)throw Error("Refusing to build a vhost: no server_name (domain) was given.");let J=z.join(" "),Z=X6($);if($.ssl){let W=["server {","    listen 80;","    listen [::]:80;",`    server_name ${J};`,"    return 301 https://$host$request_uri;","}"],Y=["server {","    listen 443 ssl;","    listen [::]:443 ssl;",`    server_name ${J};`,`    ssl_certificate ${$.ssl.certPath};`,`    ssl_certificate_key ${$.ssl.keyPath};`,...$.tlsProtocols?.length?[`    ssl_protocols ${$.tlsProtocols.join(" ")};`]:[],"",...Z,"}"];return`${[...W,"",...Y].join(`
+`)}
+`}return`${["server {","    listen 80;","    listen [::]:80;",`    server_name ${J};`,...Z,"}"].join(`
+`)}
+`}function Y1($){let z=`/etc/nginx/sites-available/${$.siteName}`,J=`/etc/nginx/sites-enabled/${$.siteName}`,Z=K6($),Q=[...q1()];if($.auth){let W=_2($.siteName),Y=(G)=>G.split("'").join("'\\''"),q=Y($.auth.password),j=Y($.auth.username);Q.push(`TS_CLOUD_HTPASS=$(openssl passwd -apr1 '${q}')`,`printf '%s:%s\\n' '${j}' "$TS_CLOUD_HTPASS" > ${W}`,`chmod 640 ${W}`,`chown root:www-data ${W} 2>/dev/null || true`)}return Q.push(`cat > ${z} <<'TS_CLOUD_NGINX_EOF'`,Z.replace(/\n$/,""),"TS_CLOUD_NGINX_EOF",`ln -sf ${z} ${J}`,"rm -f /etc/nginx/sites-enabled/default",`${M0} -t`,"systemctl reload ts-cloud-nginx 2>/dev/null || systemctl restart ts-cloud-nginx 2>/dev/null || true"),Q}var M0="/usr/local/bin/ts-cloud-nginx";function q1($="/opt/pantry"){return[...O$(),...z0(["nginx.org"]),"mkdir -p /etc/nginx/sites-available /etc/nginx/sites-enabled /var/log/nginx /var/lib/nginx/body /var/lib/nginx/proxy /var/lib/nginx/fastcgi /var/lib/nginx/uwsgi /var/lib/nginx/scgi","getent passwd www-data >/dev/null || useradd --system --no-create-home --shell /usr/sbin/nologin www-data","chown -R www-data:www-data /var/lib/nginx /var/log/nginx",`cat > ${M0} <<'TS_CLOUD_NGINXBIN_EOF'`,"#!/bin/sh",`eval "$(cd ${$} && pantry env 2>/dev/null)"`,"NGINX_BIN=/opt/pantry/pantry/.bin/nginx",'if [ ! -x "$NGINX_BIN" ]; then NGINX_BIN=$(command -v nginx || true); fi','if [ -z "$NGINX_BIN" ]; then echo "nginx binary not found; run pantry install nginx.org or install nginx explicitly" >&2; exit 1; fi','exec "$NGINX_BIN" -c /etc/nginx/nginx.conf "$@"',"TS_CLOUD_NGINXBIN_EOF",`chmod +x ${M0}`,"cat > /etc/nginx/fastcgi_params <<'TS_CLOUD_FCGI_EOF'","fastcgi_param  QUERY_STRING       $query_string;","fastcgi_param  REQUEST_METHOD     $request_method;","fastcgi_param  CONTENT_TYPE       $content_type;","fastcgi_param  CONTENT_LENGTH     $content_length;","fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;","fastcgi_param  REQUEST_URI        $request_uri;","fastcgi_param  DOCUMENT_URI       $document_uri;","fastcgi_param  DOCUMENT_ROOT      $document_root;","fastcgi_param  SERVER_PROTOCOL    $server_protocol;","fastcgi_param  REQUEST_SCHEME     $scheme;","fastcgi_param  HTTPS              $https if_not_empty;","fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;","fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;","fastcgi_param  REMOTE_ADDR        $remote_addr;","fastcgi_param  REMOTE_PORT        $remote_port;","fastcgi_param  SERVER_ADDR        $server_addr;","fastcgi_param  SERVER_PORT        $server_port;","fastcgi_param  SERVER_NAME        $server_name;","fastcgi_param  REDIRECT_STATUS    200;","TS_CLOUD_FCGI_EOF","cat > /etc/nginx/nginx.conf <<'TS_CLOUD_NGINXCONF_EOF'","user www-data;","worker_processes auto;","pid /run/nginx.pid;","error_log /var/log/nginx/error.log;","events { worker_connections 1024; }","http {","    default_type application/octet-stream;","    types {","        text/html html htm;","        text/css css;","        application/javascript js;","        application/json json;","        image/svg+xml svg;","        image/png png;","        image/jpeg jpg jpeg;","        image/gif gif;","        image/x-icon ico;","        image/webp webp;","        font/woff2 woff2;","        font/woff woff;","        text/plain txt;","    }","    access_log /var/log/nginx/access.log;","    sendfile on;","    tcp_nopush on;","    keepalive_timeout 65;","    server_tokens off;","    client_max_body_size 100m;","    client_body_temp_path /var/lib/nginx/body;","    proxy_temp_path /var/lib/nginx/proxy;","    fastcgi_temp_path /var/lib/nginx/fastcgi;","    uwsgi_temp_path /var/lib/nginx/uwsgi;","    scgi_temp_path /var/lib/nginx/scgi;","    server {","        listen 80 default_server;","        listen [::]:80 default_server;","        server_name _;","        return 444;","    }","    include /etc/nginx/sites-enabled/*;","}","TS_CLOUD_NGINXCONF_EOF","cat > /etc/systemd/system/ts-cloud-nginx.service <<'TS_CLOUD_NGINXUNIT_EOF'","[Unit]","Description=ts-cloud nginx (pantry)","After=network.target","","[Service]","Type=simple",`ExecStartPre=${M0} -t`,`ExecStart=${M0} -g 'daemon off;'`,`ExecReload=${M0} -s reload`,"Restart=always","RestartSec=3","","[Install]","WantedBy=multi-user.target","TS_CLOUD_NGINXUNIT_EOF","systemctl daemon-reload","systemctl enable ts-cloud-nginx","ls /etc/nginx/sites-enabled/* >/dev/null 2>&1 && systemctl restart ts-cloud-nginx || true"]}function s0($,z){return!$.events||$.events.includes(z)}async function j1($,z,J,Z={}){if(!$)return[];let Q=Z.fetchImpl??globalThis.fetch,W=[],Y=[],q=(j,G)=>Q(j,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(G)}).catch(()=>{return});if($.slack?.webhookUrl&&s0($,z))W.push("slack"),Y.push(q($.slack.webhookUrl,{text:J}));if($.discord?.webhookUrl&&s0($,z))W.push("discord"),Y.push(q($.discord.webhookUrl,{content:J}));if($.telegram?.botToken&&$.telegram.chatId&&s0($,z)){W.push("telegram");let j=`https://api.telegram.org/bot${$.telegram.botToken}/sendMessage`;Y.push(q(j,{chat_id:$.telegram.chatId,text:J}))}if($.webhook?.url&&s0($,z))if(W.push("webhook"),($.webhook.method||"POST")==="GET"){let j=$.webhook.url.includes("?")?"&":"?",G=`${$.webhook.url}${j}event=${encodeURIComponent(z)}&message=${encodeURIComponent(J)}`;Y.push(Q(G,{method:"GET"}).catch(()=>{return}))}else Y.push(q($.webhook.url,{event:z,message:J}));if($.email?.to&&s0($,z))W.push("email"),Y.push(O6($.email,z,J));return await Promise.all(Y),W}async function O6($,z,J){try{await(await import("./chunk-qvbwsaay.js")).email.send({to:$.to,from:$.from,subject:`[ts-cloud] ${z}`,text:J})}catch{}}function T2($,z){return z??$}function f0($){if(!$)return[];let z=[];if($.slack?.webhookUrl)z.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"text\\":\\"$MSG\\"}" ${$.slack.webhookUrl} || true`);if($.discord?.webhookUrl)z.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"content\\":\\"$MSG\\"}" ${$.discord.webhookUrl} || true`);if($.telegram?.botToken&&$.telegram.chatId)z.push(`curl -fsS -X POST "https://api.telegram.org/bot${$.telegram.botToken}/sendMessage" --data-urlencode "chat_id=${$.telegram.chatId}" --data-urlencode "text=$MSG" || true`);if($.webhook?.url)z.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"message\\":\\"$MSG\\"}" ${$.webhook.url} || true`);if(z.length===0)return[];return["cat > /usr/local/bin/ts-cloud-notify <<'TS_CLOUD_NOTIFY_EOF'","#!/bin/bash",'MSG="$1"',...z,"TS_CLOUD_NOTIFY_EOF","chmod +x /usr/local/bin/ts-cloud-notify"]}function G1($,z){return`/var/www/${$}-${z}`}var M6=new Set(["laravel","php","statamic","wordpress"]);function e0($){return $.type!=null&&M6.has($.type)}function H1($){let z=$.proxyTo;if(z==null)return[];return(Array.isArray(z)?z:[z]).map((Z)=>String(Z).trim()).filter((Z)=>Z.length>0)}function F6($){return H1($).length>0}function I2($){if($.deploy)return $.deploy;if(e0($))return"server";if($.start)return"server";return"bucket"}function Q0($){if($.redirect)return"redirect";if(F6($))return"proxy";if(e0($))return"server-php";if(I2($)==="bucket")return"bucket";return $.start?"server-app":"server-static"}function B6($){return $.infrastructure?.compute!=null||Boolean($.cloud?.attachTo?.trim())}function C5($,z={}){let J=[],Z=[],Q=$.sites||{},W=B6($),Y=P2($);if(Y)J.push(Y);let q=new Map;for(let[j,G]of Object.entries(Q)){if(!G)continue;let K=I2(G),V=Q0(G);if(V==="redirect"){if(!G.domain)J.push(`Site '${j}' is a redirect site but has no \`domain\` to redirect from.`);if(!(typeof G.redirect==="string"?G.redirect:G.redirect?.to))J.push(`Site '${j}' is a redirect site but has no redirect target (\`redirect\` / \`redirect.to\`).`);if(!W)J.push(`Site '${j}' is a redirect site but no \`infrastructure.compute\` is configured to host the gateway that serves the redirect.`);let X=[];if(G.start)X.push("start");if(G.root)X.push("root");if(G.proxyTo)X.push("proxyTo");if(X.length>0)Z.push(`Site '${j}' is a redirect site but also sets ${X.join(", ")}. These are ignored.`);continue}if(V==="proxy"){if(!G.domain)J.push(`Site '${j}' is a proxy site but has no \`domain\` to route from.`);if(!W)J.push(`Site '${j}' is a proxy site but no \`infrastructure.compute\` is configured to host the gateway that forwards it.`);let H=[];if(G.start)H.push("start");if(G.root)H.push("root");if(typeof G.port==="number")H.push("port");if(G.build)H.push("build");if(G.preStart&&G.preStart.length>0)H.push("preStart");if(H.length>0)Z.push(`Site '${j}' sets \`proxyTo\`, so ts-cloud ships and supervises nothing for it. ${H.join(", ")} ${H.length===1?"is":"are"} ignored — remove ${H.length===1?"it":"them"}, or drop \`proxyTo\` to let ts-cloud own the service.`);continue}if(K==="server"&&!G.start&&!G.root){J.push(`Site '${j}' sets deploy:'server' but declares neither \`start\` (dynamic app) nor \`root\` (static site to serve). Add one.`);continue}if(V==="server-php"){if(!W)J.push(`Site '${j}' is a PHP site (type:'${G.type}') but no \`infrastructure.compute\` is configured. Add a server (infrastructure.compute) with PHP provisioning.`);if(!G.repository?.url)J.push(`Site '${j}' is a PHP site (type:'${G.type}') but has no \`repository.url\` to clone. PHP sites deploy via git.`)}else if(V==="server-app"){if(!W)J.push(`Site '${j}' deploys to a server (deploy:'server'${G.deploy?"":" inferred from `start`"}) but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`);if(typeof G.port==="number"){let H=z.occupiedPorts?.get(G.port);if(H)J.push(`Site '${j}' wants port ${G.port}, which project '${H}' already serves on this box. Attached projects share one port namespace. Give '${j}' a free port, or let the attach allocate one.`);let X=q.get(G.port);if(X)J.push(`Sites '${X}' and '${j}' both use port ${G.port}. Server apps sharing a box must use distinct ports.`);else q.set(G.port,j)}}else if(V==="server-static"){if(!G.root)J.push(`Site '${j}' is a server static site (deploy:'server', no \`start\`) but has no \`root\` directory to serve.`);if(!W)J.push(`Site '${j}' deploys to a server (deploy:'server') but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`)}else{if(!G.root)J.push(`Site '${j}' deploys to a bucket but has no \`root\` directory to upload.`);let H=[];if(G.start)H.push("start");if(typeof G.port==="number")H.push("port");if(G.preStart&&G.preStart.length>0)H.push("preStart");if(H.length>0)Z.push(`Site '${j}' deploys to a bucket but sets server-only field(s): ${H.join(", ")}. These are ignored. Set deploy:'server' to use them.`)}}return{errors:J,warnings:Z}}function x5($){let z=Q0($);return z!=="bucket"&&z!=="redirect"&&z!=="proxy"}function L5($){return Q0($)==="bucket"}function D5($,z){if(y2($)==="serverless")return!0;let J=Object.entries($.sites??{}).filter(([,Q])=>Q!=null),Z=z?J.filter(([Q])=>Q===z):J;if(Z.length===0)return!0;return!Z.every(([,Q])=>{let W=Q0(Q);return W==="redirect"||W==="proxy"})}var V1="/etc/rpx/certs";function O1($){return $.split(".").length===2}function U6($,z={}){let J=new Set;for(let Z of Object.values($)){if(!Z?.domain)continue;if(Q0(Z)==="bucket")continue;J.add(Z.domain)}if(z.autoWww!==!1)for(let Z of[...J]){if(!O1(Z))continue;J.add(`www.${Z}`)}return[...J]}var C6=["1.1.1.1","8.8.8.8"],x6="/var/www/acme-challenge";function L6($){if(typeof $==="string")return{to:$};let z={to:$.to};if($.status!=null)z.status=$.status;if($.preservePath!=null)z.preservePath=$.preservePath;return z}function D6($){let z=$.auth;if(!z||z.enabled===!1||!z.password)return;return{username:z.username||"admin",password:z.password,...z.realm?{realm:z.realm}:{}}}function S2($){if(!$||$==="/")return;let z=`/${$}`.replace(/\/+/g,"/").replace(/\/+$/,"");if(!z.startsWith("/"))z=`/${z}`;return z===""||z==="/"?void 0:z}function X1($,z){let Z=(z?`${$}${z}`:$).replace(/[^a-zA-Z0-9._-]+/g,"-").replace(/^-+|-+$/g,"").slice(0,128);return Z.length>0?Z:"rpx"}function w6($,z){if(!z||z.length===0)return`localhost:${$}`;return z.map((J)=>`${J.privateIp??J.publicIp}:${$}`)}function f2($,z,J){let Z=(z.wwwRoot??"/var/www").replace(/\/+$/,""),Q=z.slug??"app",W=z.proxy.certsDir??V1,Y=z.proxy.loadBalancer,q=[],j=new Set;for(let[H,X]of Object.entries($)){if(!X||!X.domain)continue;let O=Q0(X);if(O==="bucket")continue;let C=S2(X.path),U=X1(X.domain,C),F=D6(X);if(O==="redirect"){q.push({to:X.domain,path:C,redirect:L6(X.redirect),id:U,...F?{auth:F}:{}}),j.add(X.domain);continue}if(O==="proxy"){let B=H1(X);if(B.length===0)continue;let M=B.length===1?B[0]:B;q.push({to:X.domain,path:C,from:M,id:U,...F?{auth:F}:{},...Array.isArray(M)&&Y?{loadBalancer:Y}:{}}),j.add(X.domain);continue}if(O==="server-app"){if(typeof X.port!=="number")continue;let B=w6(X.port,J);q.push({to:X.domain,path:C,from:B,id:U,...F?{auth:F}:{},...Array.isArray(B)&&Y?{loadBalancer:Y}:{}})}else q.push({to:X.domain,path:C,static:{dir:`${Z}/${Q}-${H}/current`,spa:X.spa??!1,pathRewriteStyle:X.pathRewriteStyle??"directory"},cleanUrls:X.pathRewriteStyle!=="flat",...F?{auth:F}:{},id:U});j.add(X.domain)}if(z.proxy.autoWww!==!1)for(let H of[...j]){if(!O1(H))continue;let X=`www.${H}`;if(j.has(X))continue;q.push({to:X,redirect:{to:`https://${H}`},id:X1(X)}),j.add(X)}q.sort((H,X)=>{if(H.to!==X.to)return H.to.localeCompare(X.to);return(X.path?.length??0)-(H.path?.length??0)});let G={proxies:q,productionCerts:{certsDir:W,certsDirServerNames:[...j]},https:!0,hostsManagement:!1,cleanup:{hosts:!1,certs:!1}};if(z.proxy.onDemandTls&&j.size>0)G.onDemandTls={enabled:!0,allowedSuffixes:[...j],email:z.proxy.onDemandTlsEmail,certsDir:W,staging:z.proxy.onDemandTlsStaging??!1};if(z.proxy.onDemandTls)G.acmeChallengeWebroot=z.proxy.acmeWebroot??x6;let K=z.proxy.cdn,V=K?.frontedHosts?.length?K.frontedHosts:[...j];if(K?.secret&&V.length>0)G.originGuard={header:K.secretHeader??"X-Origin-Verify",value:K.secret,hosts:V};return G}function B0($,z){return f2($,z)}function h0($,z,J){return f2($,J,z)}function A6($){return`// Generated by ts-cloud — rpx reverse-proxy gateway.
+// Routes are derived from the \`sites\` model on every \`buddy deploy\`.
+import { startProxies } from '@stacksjs/rpx'
+
+const config = ${JSON.stringify($,null,2)} as const
+
+// Verbose is the hard default for ts-cloud-installed gateways (RPX_VERBOSE=false
+// opts out) — without it rpx's TLS/routing diagnostics never reach the journal.
+await startProxies({ verbose: process.env.RPX_VERBOSE !== 'false', ...config } as any)
+`}function t($){return $?.webServer==="rpx"||$?.proxy?.engine==="rpx"}var z$="/etc/rpx",l="/opt/rpx-gateway",K1="/etc/rpx/gateway.ts",$$="/etc/rpx/gateway",F0="rpx-gateway.service",A0="/etc/rpx/sites.d";function R6($=A0,z=V1){return`// Generated by ts-cloud — rpx gateway assembler.
+// Merges every app's fragment in ${$} so independent deploys compose
+// without clobbering each other. Each deploy writes only its own <slug>.json.
+import { startProxies } from '@stacksjs/rpx'
+import { readdirSync, readFileSync } from 'node:fs'
+
+const dir = ${JSON.stringify($)}
+const proxies = []
+const seen = new Set()
+const owners = new Map()
+const suffixes = new Set()
+const guardHosts = new Set()
+let email
+let certsDir = ${JSON.stringify(z)}
+let acmeChallengeWebroot
+let guard
+let anyProduction = false
+let files = []
+try { files = readdirSync(dir).filter(n => n.endsWith('.json')).sort() } catch {}
+for (const f of files) {
+  let frag
+  // Fragments are written atomically (temp + rename by ts-cloud), so a parse
+  // failure here means a genuinely corrupt fragment, not a mid-write read. Log
+  // it LOUD — a silent skip drops that app's whole host from the routing table,
+  // which then answers 404 until someone notices. We still continue so one bad
+  // fragment can't take every other app down, but the drop is now visible.
+  try { frag = JSON.parse(readFileSync(dir + '/' + f, 'utf8')) }
+  catch (err) { console.error('[rpx-assembler] SKIPPING malformed fragment ' + f + ' — its host(s) will 404 until fixed: ' + err); continue }
+  for (const p of frag.proxies ?? []) {
+    const key = p.id || (p.to + (p.path ?? ''))
+    if (seen.has(key)) {
+      console.warn('[rpx-assembler] duplicate route ' + key + ' in ' + f + ' ignored; first declared by ' + owners.get(key))
+      continue
+    }
+    seen.add(key)
+    owners.set(key, f)
+    proxies.push(p)
+  }
+  for (const s of frag.onDemandTls?.allowedSuffixes ?? []) suffixes.add(s)
+  email ??= frag.onDemandTls?.email
+  // One gateway, one ACME directory: production wins any disagreement between
+  // co-tenants, and a fragment predating the flag counts as production. A
+  // staging cert chains to an untrusted root, so defaulting the other way
+  // breaks every client of every tenant that wanted a real cert.
+  if (frag.onDemandTls && frag.onDemandTls.staging !== true) anyProduction = true
+  if (frag.productionCerts?.certsDir) certsDir = frag.productionCerts.certsDir
+  acmeChallengeWebroot ??= frag.acmeChallengeWebroot
+  if (frag.originGuard) {
+    // One gateway means one origin-guard secret (rpx takes a single
+    // header/value). A tenant whose secret disagrees with the adopted one must
+    // NOT have its hosts guarded: its CDN would send a different value, the
+    // gateway would reject every request, and a working host would go dark.
+    // Unguarded is weaker but serving, and the mismatch is logged.
+    guard ??= { header: frag.originGuard.header, value: frag.originGuard.value }
+    if (frag.originGuard.header === guard.header && frag.originGuard.value === guard.value) {
+      for (const h of frag.originGuard.hosts ?? []) guardHosts.add(h)
+    }
+    else {
+      console.warn('[rpx-assembler] origin-guard secret in ' + f + ' differs from the one already in force; its hosts stay unguarded rather than rejecting all traffic')
+    }
+  }
+}
+const config = {
+  proxies,
+  productionCerts: {
+    certsDir,
+    // A shared host's cert directory also contains mail and retired-site PEMs.
+    // Keep those files on disk for their owners, but do not turn them into live
+    // OpenSSL SNI contexts when no current route can select them.
+    certsDirServerNames: [...new Set(proxies.map(p => p.to).filter(Boolean))],
+  },
+  https: true,
+  hostsManagement: false,
+  cleanup: { hosts: false, certs: false },
+  // Verbose is the hard default for ts-cloud-installed gateways: without it,
+  // rpx's TLS/routing diagnostics (tlsx on-demand 'refused issuance',
+  // 'issuance failed', 'adopted existing on-disk cert') never reach the systemd
+  // journal and a production TLS failure looks like "nothing happens". Silence
+  // it by setting RPX_VERBOSE=false on the systemd unit.
+  verbose: process.env.RPX_VERBOSE !== 'false',
+  ...(suffixes.size > 0 ? { onDemandTls: { enabled: true, allowedSuffixes: [...suffixes], email, certsDir, staging: !anyProduction } } : {}),
+  ...(acmeChallengeWebroot ? { acmeChallengeWebroot } : {}),
+  ...(guard ? { originGuard: { header: guard.header, value: guard.value, hosts: [...guardHosts] } } : {}),
+}
+
+await startProxies(config)
+`}function b0($,z,J,Z="0644"){return[`__tsc_tmp="$(mktemp "${$}.XXXXXX")"`,`cat > "$__tsc_tmp" <<'${J}'`,z,J,`mv -f "$__tsc_tmp" ${$}`,`chmod ${Z} ${$}`]}function N6($){return`'${$.replaceAll("'","'\\''")}'`}function b2($,z,J,Z){if(!Z.preserveManagementDashboardRoutes)return b0($,z,J,"0600");let Q=`
+const { readFileSync, writeFileSync } = require('node:fs')
+const currentPath = process.env.TS_CLOUD_RPX_CURRENT_FRAGMENT
+const candidatePath = process.env.TS_CLOUD_RPX_CANDIDATE_FRAGMENT
+const isDashboard = route => /^(?:dashboard|cloud)\\./i.test(String(route?.to || ''))
+const current = JSON.parse(readFileSync(currentPath, 'utf8'))
+const candidate = JSON.parse(readFileSync(candidatePath, 'utf8'))
+const retained = Array.isArray(current.proxies) ? current.proxies.filter(isDashboard) : []
+const next = Array.isArray(candidate.proxies) ? candidate.proxies.filter(route => !isDashboard(route)) : []
+candidate.proxies = [...next, ...retained]
+writeFileSync(candidatePath, JSON.stringify(candidate, null, 2) + '\\n', { mode: 0o600 })
+`.trim();return[`__tsc_fragment_candidate="$(mktemp "${$}.candidate.XXXXXX")"`,`cat > "$__tsc_fragment_candidate" <<'${J}'`,z,J,'chmod 0600 "$__tsc_fragment_candidate"',`if [ -f ${$} ]; then TS_CLOUD_RPX_CURRENT_FRAGMENT=${$} TS_CLOUD_RPX_CANDIDATE_FRAGMENT="$__tsc_fragment_candidate" ${Z.bunBin} -e ${N6(Q)}; fi`,`mv -f "$__tsc_fragment_candidate" ${$}`,`chmod 0600 ${$}`]}function M1($){return`rpx-cert-renew-${($||"app").replace(/[^a-z0-9._-]+/gi,"-")}.service`}function F1($){let z=new Set;for(let J of $.proxies){let Z=J.to;if(!Z||Z.startsWith("*")||Z.includes(":")||!Z.includes("."))continue;z.add(Z)}return[...z]}function E6($){let{config:z,proxy:J}=$,Z=z.acmeChallengeWebroot,Q=F1(z);if(!J.onDemandTls||!Z||Q.length===0)return[];let W=$.bunBin??"/usr/local/bin/bun",Y=J.version??"latest",q=z.productionCerts.certsDir,j=J.onDemandTlsEmail??`webmaster@${Q[0]}`,G=`${W} ${l}/node_modules/@stacksjs/tlsx/dist/bin/cli.js`,K=Q.join(","),V=Q.join(" "),H=($.slug||"app").replace(/[^a-z0-9._-]+/gi,"-"),X=`${z$}/renew-certs-${H}.sh`,O=M1(H),C=`rpx-cert-renew-${H}.timer`,U=["#!/bin/sh","# Generated by ts-cloud — issue/renew rpx gateway TLS certs via tlsx http-01.","# The running gateway serves the challenge from $WEBROOT on :80, so this needs","# no downtime and no DNS credentials. Reloads the gateway only if a cert changed.","set -u",`CERTS='${q}'`,`WEBROOT='${Z}'`,`EMAIL='${j}'`,`TLSX="${G}"`,`BUN='${W}'`,`DOMAINS='${K}'`,"DNS_ATTEMPTS='24'","DNS_DELAY_SECONDS='5'",`DNS_RESOLVERS='${C6.join(" ")}'`,"dns_resolves() {",'  d="$1"',"  for ns in $DNS_RESOLVERS; do",`    if $BUN --eval "const{Resolver}=require('node:dns');const r=new Resolver();r.setServers([process.argv[1]]);r.resolve4(process.argv[2],e=>process.exit(e?1:0))" "$ns" "$d" >/dev/null 2>&1; then`,"      return 0","    fi","  done",'  getent ahosts "$d" >/dev/null 2>&1',"}","wait_for_dns() {",'  d="$1"',"  attempt=1",'  while ! dns_resolves "$d"; do','    if [ "$attempt" -ge "$DNS_ATTEMPTS" ]; then','      echo "DNS for $d did not become resolvable after $DNS_ATTEMPTS attempts" >&2',"      return 1","    fi",'    echo "Waiting for public DNS before ACME: $d (attempt $attempt/$DNS_ATTEMPTS)"','    sleep "$DNS_DELAY_SECONDS"',"    attempt=$((attempt + 1))","  done","}",'before=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)',`for d in ${V}; do`,'  if [ ! -s "$CERTS/$d.crt" ]; then','    if wait_for_dns "$d"; then','      $TLSX acme:issue -d "$d" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --prod --email "$EMAIL" || echo "issue $d failed (non-fatal)"',"    else",'      echo "issue $d skipped until DNS resolves (non-fatal)"',"    fi","    # rpx reloads its SNI set when a PEM appears. Complete that reload","    # before the next hostname starts http-01, or :80 can disappear in","    # the middle of the following challenge on a multi-domain deploy.",`    [ -s "$CERTS/$d.crt" ] && systemctl restart ${F0}`,"  fi","done",'$TLSX acme:renew --domains "$DOMAINS" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --days 30 --prod --email "$EMAIL" || echo "renew: some domains failed (non-fatal)"','rm -f "$CERTS"/*.chain.crt','after=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)',`[ "$before" = "$after" ] || systemctl restart ${F0}`].join(`
+`),F=["[Unit]",`Description=Issue/renew rpx gateway TLS certs for ${H} (tlsx http-01)`,`After=network-online.target ${F0}`,"Wants=network-online.target","","[Service]","Type=oneshot",`ExecStart=${X}`].join(`
+`),B=["[Unit]",`Description=Daily rpx gateway TLS cert issuance/renewal for ${H}`,"","[Timer]","OnCalendar=*-*-* 03:30:00","RandomizedDelaySec=1h","Persistent=true","","[Install]","WantedBy=timers.target"].join(`
+`);return[`mkdir -p ${Z}`,`(cd ${l} && ${W} add @stacksjs/tlsx@${Y}) || true`,...b0(X,U,"TS_CLOUD_RENEW_EOF"),`chmod +x ${X}`,...b0(`/etc/systemd/system/${O}`,F,"TS_CLOUD_RENEW_SVC_EOF"),...b0(`/etc/systemd/system/${C}`,B,"TS_CLOUD_RENEW_TIMER_EOF"),"systemctl daemon-reload",`systemctl enable --now ${C} || true`,`${X} || true`]}function U0($){let{config:z,proxy:J}=$,Z=$.bunBin??"/usr/local/bin/bun",Q=J.version??"latest",W=z.productionCerts.certsDir,Y=($.slug||"app").replace(/[^a-z0-9._-]+/gi,"-"),q=JSON.stringify({slug:Y,...z},null,2),j=R6(A0,W),K=[`Environment=RPX_UPSTREAM_TIMEOUT=${J.upstreamTimeout??60}`];if(typeof J.maxUpstreamConns==="number")K.push(`Environment=RPX_MAX_UPSTREAM_CONNS=${J.maxUpstreamConns}`);let V=J.memoryHigh??"512M",H=J.memoryMax??"768M";return["set -euo pipefail",`mkdir -p ${z$} ${A0} ${W} ${l}`,`rm -rf ${l}.next ${l}.prev`,`mkdir -p ${l}.next`,`(cd ${l}.next && ${Z} add @stacksjs/rpx@${Q})`,`mv ${l} ${l}.prev`,`mv ${l}.next ${l}`,`rm -rf ${l}.prev`,`ln -sfn ${l}/node_modules ${z$}/node_modules`,...b2(`${A0}/${Y}.json`,q,"TS_CLOUD_RPX_FRAGMENT_EOF",{bunBin:Z,preserveManagementDashboardRoutes:$.preserveManagementDashboardRoutes}),...b0(K1,j,"TS_CLOUD_RPX_EOF"),`${Z} build --production --compile --outfile ${$$}.next ${K1}`,`chmod 0755 ${$$}.next`,`mv -f ${$$}.next ${$$}`,...b0(`/etc/systemd/system/${F0}`,["[Unit]","Description=rpx reverse-proxy gateway (managed by ts-cloud)","After=network.target network-online.target","Wants=network-online.target","","[Service]","Type=simple",`ExecStart=${$$}`,`WorkingDirectory=${l}`,"Environment=BUN_INSTALL=/root/.bun","Environment=APP_ENV=production","Environment=NODE_ENV=production",...K,"MemoryAccounting=true",`MemoryHigh=${V}`,`MemoryMax=${H}`,"CPUWeight=500","IOWeight=500","OOMPolicy=stop","Restart=always","RestartSec=5","StartLimitIntervalSec=120","StartLimitBurst=5",`ExecStartPre=/bin/sh -c 'for p in 80 443; do fuser -k -n tcp "$p" 2>/dev/null || true; done; sleep 1'`,"LimitNOFILE=1048576","AmbientCapabilities=CAP_NET_BIND_SERVICE","","[Install]","WantedBy=multi-user.target"].join(`
+`),"TS_CLOUD_RPX_UNIT_EOF"),"systemctl daemon-reload","systemctl disable --now bun-gateway.service 2>/dev/null || true","systemctl disable --now bun-gateway-renew.timer bun-gateway-renew.service 2>/dev/null || true","rm -f /etc/systemd/system/bun-gateway-renew.timer /etc/systemd/system/bun-gateway-renew.service","systemctl disable --now ts-cloud-nginx.service 2>/dev/null || true",`for timer in /etc/systemd/system/rpx-cert-renew-*.timer; do [ -e "$timer" ] || continue; unit="$(basename "$timer")"; tenant="\${unit#rpx-cert-renew-}"; tenant="\${tenant%.timer}"; [ -f "${A0}/$tenant.json" ] && continue; systemctl disable --now "$unit" 2>/dev/null || true; rm -f "$timer" "/etc/systemd/system/rpx-cert-renew-$tenant.service" "${z$}/renew-certs-$tenant.sh"; done`,`systemctl enable ${F0}`,`systemctl restart ${F0}`,...E6($)]}function J$($){let z=($.slug||"app").replace(/[^a-z0-9._-]+/gi,"-"),J=JSON.stringify({slug:z,...$.config},null,2);return["set -euo pipefail",`mkdir -p ${A0}`,...b2(`${A0}/${z}.json`,J,"TS_CLOUD_RPX_FRAGMENT_EOF",{bunBin:"/usr/local/bin/bun",preserveManagementDashboardRoutes:$.preserveManagementDashboardRoutes}),`systemctl restart ${F0}`]}function v0($=[],z={}){let J=z.path??"/root/.ssh/authorized_keys",Q=[`mkdir -p ${J.replace(/\/[^/]*$/,"")}`,`touch ${J}`,`sed -i '/^${h2("# >>> ts-cloud managed keys >>>")}$/,/^${h2("# <<< ts-cloud managed keys <<<")}$/d' ${J}`];if($.length>0){let W=["# >>> ts-cloud managed keys >>>",...$.map((Y)=>`${Y.publicKey.trim()} ${Y.name}`),"# <<< ts-cloud managed keys <<<"].join(`
+`);Q.push(`cat >> ${J} <<'TS_CLOUD_KEYS_EOF'`,W,"TS_CLOUD_KEYS_EOF",`chmod 600 ${J}`)}return Q}function h2($){return $.replace(/[.*[\]\\/^$]/g,"\\$&")}function g2($,z){let J=`/tmp/ts-cloud-${$}.sh`,Z=`TS_CLOUD_${$.toUpperCase().replace(/[^A-Z0-9]/g,"_")}_EOF`;return[`cat > ${J} <<'${Z}'`,z.replace(/\n$/,""),Z,`chmod +x ${J}`,`bash ${J} || echo "ts-cloud: ${$} setup did not complete; continuing" >&2`,`rm -f ${J}`]}function d2($,z){if($===!1)return;if($===!0||$===void 0)return z;return $}var v2={enabled:!0,ports:[80,443]},k6={mode:"detection",paranoiaLevel:1};function _6($=!0,z=[]){let J=d2($,v2);if(!J||J.enabled===!1)return[];let Z=[...new Set([...J.ports??v2.ports??[],...z])].sort((Q,W)=>Q-W);return g2("ddos",u2({...J,ports:Z}))}function T6($=!0){let z=d2($,k6);if(!z||z.mode==="off")return[];return g2("waf",m2(z))}function c2($={},z=[]){return[..._6($.ddos,z),...T6($.waf)]}function y6($){return`${$}-sftp`}function l2($){return $.port??2222}function P6($){let z=$.sftp.storage;if(z?.type==="efs"&&z.path)return z.path;return`/var/sftp/${$.slug}`}function u0($){return`'${$.split("'").join("'\\''")}'`}function p2($,z){if(z==="aws")return;let J=$.storage;if(J?.type==="s3"||!J&&!!$.bucket)throw Error(`sftp: bucket-backed storage is only available on the aws provider (Transfer Family). On ${z}, use storage: { type: 'efs' } to serve a directory on the server.`);for(let[Q,W]of Object.entries($.users))if(!W.sshPublicKeys?.length)throw Error(`sftp: user ${Q} needs at least one SSH public key`)}function r2($){let{slug:z,sftp:J}=$,Z=y6(z),Q=P6($),W=l2(J),Y="/etc/ts-sftp/host_key",q="/etc/ts-sftp/users",j=J.serviceUser??"ts-sftp",G=[`# --- ts-sftp (${Z}) ---`,`id -u ${j} >/dev/null 2>&1 || useradd --system --home-dir ${u0(Q)} --shell /usr/sbin/nologin ${j}`,'export HOME="${HOME:-/root}"','command -v bun >/dev/null 2>&1 || (curl -fsSL https://bun.sh/install | bash && ln -sf "$HOME/.bun/bin/bun" /usr/local/bin/bun)',`mkdir -p ${u0(Q)} /etc/ts-sftp /etc/ts-sftp/users /opt/ts-sftp`,"chmod 750 /etc/ts-sftp",`cd /opt/ts-sftp && [ -f package.json ] || printf '{"name":"ts-sftp-host","private":true}' > package.json`,`cd /opt/ts-sftp && bun add ts-sftp@${J.version??"latest"} --no-save --production || bun add ts-sftp@${J.version??"latest"}`,`[ -f /etc/ts-sftp/host_key ] || bun /opt/ts-sftp/node_modules/ts-sftp/dist/bin/cli.js keygen --out /etc/ts-sftp/host_key --comment ${u0(`${z}-sftp`)}`,"chmod 600 /etc/ts-sftp/host_key",'BUN_REAL=$(readlink -f "$(command -v bun)")','case "$BUN_REAL" in /root/*) install -m 0755 "$BUN_REAL" /usr/local/bin/ts-sftp-bun; BUN_BIN=/usr/local/bin/ts-sftp-bun;; *) BUN_BIN="$BUN_REAL";; esac'],K=[];for(let[V,H]of Object.entries(J.users)){let X=(H.homeDirectory??V).replace(/^\/+|\/+$/g,"");if(!X||X.split("/").includes(".."))throw Error(`sftp: invalid homeDirectory for user ${V}`);let O=`/etc/ts-sftp/users/${V}.pub`;G.push(`mkdir -p ${u0(`${Q}/${X}`)}`,`printf '%s\\n' ${u0(H.sshPublicKeys.join(`
+`))} > ${O}`,`chmod 644 ${O}`),K.push(`--user ${V}:${O}`)}return G.push(`chown -R ${j}:${j} ${u0(Q)} /etc/ts-sftp`,`cat > /etc/systemd/system/${Z}.service <<TSCLOUD_SFTP_UNIT`,"[Unit]","Description=ts-sftp file transfer server","After=network.target","","[Service]",`User=${j}`,`ExecStart=$BUN_BIN /opt/ts-sftp/node_modules/ts-sftp/dist/bin/cli.js serve --root ${Q} --host-key /etc/ts-sftp/host_key --port ${W}${J.readOnly?" --read-only":""} ${K.join(" ")}`,"Restart=always","RestartSec=2","NoNewPrivileges=true","PrivateTmp=true","ProtectSystem=strict",`ReadWritePaths=${Q}`,"","[Install]","WantedBy=multi-user.target","TSCLOUD_SFTP_UNIT","systemctl daemon-reload",`systemctl enable ${Z}.service`,`systemctl restart ${Z}.service`),G}function a2($){return $?[l2($)]:[]}var I6=[80,443];function L$($={}){if($.enabled===!1)return[];let z=[...new Set([...I6,...$.allowedPorts||[]])].filter((Z)=>Number.isInteger(Z)&&Z>=1&&Z<=65535).sort((Z,Q)=>Z-Q),J=["export DEBIAN_FRONTEND=noninteractive","command -v ufw >/dev/null 2>&1 || apt-get install -y ufw","ufw --force reset","ufw default deny incoming","ufw default allow outgoing","ufw allow OpenSSH"];for(let Z of z)J.push(`ufw allow ${Z}/tcp`);return J.push("ufw --force enable"),J}function Z$($,z){let J=$.infrastructure?.compute??{},Z=J.runtime==="php"||!!J.php,Q=D$($,{environment:z?.environment}),W=Z||!!J.managedServices,Y=W?O$():[],q=!t(J),j=Z?[...Y,...x$({versions:J.php?.versions,default:J.php?.default,extensions:J.php?.extensions,installNginx:q,optimizeForProduction:J.php?.optimizeForProduction,ini:J.php?.ini}),...q?q1():[]]:void 0,G=[],K=C0($);if(!Z&&W)G.push(...Y);if(G.push(...f0($.notifications)),J.managedServices)G.push(...U$(J.managedServices,{mail:Q.enabled?Q:void 0}),...S0(K,J.managedServices));let V=$.infrastructure?.sftp;if(V)p2(V,m0($)),G.push(...r2({slug:$.project.slug,sftp:V}));let H=J.firewall??(Z?{enabled:!0}:{enabled:!1}),X=n2(Q);if(G.push(...L$(X.length>0?{...H,allowedPorts:[...H.allowedPorts??[],...X]}:H)),G.push(...c2({ddos:J.ddos,waf:J.waf},[...J.firewall?.allowedPorts??[],...X])),G.push(...V0(J.autoUpdates??Z)),G.push(...N2(J.appUpdates)),G.push(...O0(J.monitoring??Z)),G.push(...v0(J.sshKeys)),J.backups?.enabled)G.push(...C$({database:K,backups:J.backups}));return{runtime:J.runtime||"bun",runtimeVersion:J.runtimeVersion||"latest",phpBox:Z,phpProvision:j,servicesProvision:G.length>0?G:void 0}}function s($={}){let{runtime:z="bun",runtimeVersion:J="latest",systemPackages:Z=[],database:Q,phpProvision:W,servicesProvision:Y,caddyfile:q,rpxProvision:j,baked:G=!1,swapGb:K=2}=$,V=new Set(Z);if(Q==="sqlite")V.add("sqlite3");else if(Q==="mysql")V.add("mysql-client");else if(Q==="postgres")V.add("postgresql-client");let H=`#!/bin/bash
+set -euo pipefail
+`,X=Math.floor(K);if(X>0)H+=`
+# Swap: a swapless box under memory pressure lets the kernel OOM killer choose
+# victims box-wide (the gateway, a tenant app, postgres). A modest swapfile
+# with low swappiness gives the kernel headroom without hurting responsiveness.
+if ! swapon --show=NAME --noheadings 2>/dev/null | grep -qx '/swapfile'; then
+  if [ ! -f /swapfile ]; then
+    fallocate -l ${X}G /swapfile || dd if=/dev/zero of=/swapfile bs=1M count=${X*1024} status=none
+    chmod 600 /swapfile
+    mkswap /swapfile >/dev/null
+  fi
+  swapon /swapfile
+fi
+grep -qE '^/swapfile\\s' /etc/fstab || echo '/swapfile none swap sw 0 0' >> /etc/fstab
+echo 'vm.swappiness=10' > /etc/sysctl.d/99-ts-cloud-swap.conf
+sysctl -w vm.swappiness=10 >/dev/null
+`;if(!G){if(H+=`
+export DEBIAN_FRONTEND=noninteractive
+apt-get update -y
+apt-get upgrade -y
+apt-get install -y curl tar gzip unzip git ca-certificates
+`,V.size>0)H+=`
+apt-get install -y ${[...V].join(" ")}
+`;if(W&&W.length>0)H+=`
+${W.join(`
+`)}
+`;if(Y&&Y.length>0)H+=`
+${Y.join(`
+`)}
+`;if(z==="bun")H+=`
+# cloud-init runs this with \`set -u\` and NO $HOME set. bun's install.sh
+# dereferences $HOME even when BUN_INSTALL is set, so without this the install
+# aborts with "HOME: unbound variable" and /usr/local/bin/bun never appears —
+# breaking a from-scratch provision (adopting an existing box masked it).
+export HOME="\${HOME:-/root}"
+export BUN_INSTALL="/root/.bun"
+# bun.sh's installer references $HOME internally and runs under this
+# script's \`set -u\` (inherited by the piped bash) — cloud-init's runcmd
+# environment doesn't export HOME by default, so without this the
+# installer dies with "HOME: unbound variable" partway through (after
+# the binary is already downloaded, so it looks like a partial success)
+# and \`set -e\` aborts everything after it: the bun symlink, /var/www +
+# /var/ts-cloud dirs, and the whole rpx gateway install/systemd setup
+# never run. Confirmed against a real Hetzner box (stacksjs/status#1
+# Phase 9 e2e deploy) — cloud-init reported success with none of that
+# actually done.
+export HOME="\${HOME:-/root}"
+curl -fsSL https://bun.sh/install | bash${J==="latest"?"":` -s "bun-v${J}"`}
+ln -sf /root/.bun/bin/bun /usr/local/bin/bun
+echo 'export BUN_INSTALL="/root/.bun"' > /etc/profile.d/bun.sh
+echo 'export PATH="$BUN_INSTALL/bin:$PATH"' >> /etc/profile.d/bun.sh
+`;else if(z==="node"){let O=J==="latest"||!J?"20":J.split(".")[0];H+=`
+curl -fsSL https://deb.nodesource.com/setup_${O}.x | bash -
+apt-get install -y nodejs
+ln -sf /usr/bin/node /usr/local/bin/node
+ln -sf /usr/bin/npm /usr/local/bin/npm
+`}else if(z==="deno")H+=`
+curl -fsSL https://deno.land/install.sh | sh
+ln -sf /root/.deno/bin/deno /usr/local/bin/deno
+`}if(H+=`
+mkdir -p /var/www /var/ts-cloud/staging /var/ts-cloud/releases
+`,q)H+=`
+ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
+curl -fsSL "https://caddyserver.com/api/download?os=linux&arch=\${ARCH}" -o /usr/local/bin/caddy
+chmod +x /usr/local/bin/caddy
+
+getent group caddy >/dev/null || groupadd --system caddy
+getent passwd caddy >/dev/null || useradd --system --gid caddy \\
+  --create-home --home-dir /var/lib/caddy \\
+  --shell /usr/sbin/nologin --comment "Caddy web server" caddy
+
+mkdir -p /etc/caddy /var/lib/caddy /var/log/caddy
+chown -R caddy:caddy /var/lib/caddy /var/log/caddy
+
+cat > /etc/systemd/system/caddy.service <<'CADDY_UNIT_EOF'
+[Unit]
+Description=Caddy
+Documentation=https://caddyserver.com/docs/
+After=network.target network-online.target
+Requires=network-online.target
+
+[Service]
+Type=notify
+User=caddy
+Group=caddy
+ExecStart=/usr/local/bin/caddy run --environ --config /etc/caddy/Caddyfile
+ExecReload=/usr/local/bin/caddy reload --config /etc/caddy/Caddyfile --force
+TimeoutStopSec=5s
+LimitNOFILE=1048576
+PrivateTmp=true
+ProtectSystem=full
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+
+[Install]
+WantedBy=multi-user.target
+CADDY_UNIT_EOF
+
+cat > /etc/caddy/Caddyfile <<'CADDY_CONFIG_EOF'
+${q}
+CADDY_CONFIG_EOF
+
+systemctl daemon-reload
+systemctl enable caddy
+systemctl start caddy
+`;if(j&&j.length>0){let O=j[0]==="set -euo pipefail"?j.slice(1):j;H+=`
+${O.join(`
+`)}
+`}return H+=`
+echo "ts-cloud bootstrap complete — instance is ready for site deploys"
+`,H}var i2="/aws/service/canonical/ubuntu/server/24.04/stable/current/amd64/hvm/ebs-gp3/ami-id";function o2($){let z=[{port:22,protocol:"tcp",cidr:"0.0.0.0/0"},{port:80,protocol:"tcp",cidr:"0.0.0.0/0"},{port:443,protocol:"tcp",cidr:"0.0.0.0/0"}],J=new Set;for(let Z of Object.values($.sites||{}))if(Z&&typeof Z.port==="number"&&![22,80,443].includes(Z.port))J.add(Z.port);for(let Z of J)z.push({port:Z,protocol:"tcp",cidr:"0.0.0.0/0"});return z}function t2($){let z=$.infrastructure?.compute??{},J=Z$($),Z=z.proxy?.engine==="rpx"?U0({proxy:z.proxy,config:B0($.sites??{},{proxy:z.proxy,slug:$.project.slug}),slug:$.project.slug,bunBin:z.runtime==="node"||z.runtime==="deno"?void 0:"/usr/local/bin/bun"}):void 0;return s({runtime:J.runtime,runtimeVersion:J.runtimeVersion,systemPackages:z.systemPackages,database:$.infrastructure?.database,phpProvision:J.phpProvision,servicesProvision:J.servicesProvision,rpxProvision:Z,baked:z.bakedImage===!0,swapGb:z.swapGb})}function s2($){return Buffer.from($,"utf8").toString("base64")}function e2($){return $.infrastructure?.compute?.image??null}function w$($,z){return`${$}-${z}-app-sg`}function B1($,z,J="app"){return[{Key:"Project",Value:$},{Key:"Environment",Value:z},{Key:"Role",Value:J},{Key:"ManagedBy",Value:"ts-cloud"}]}function S6($,z,J){if(!$?.length)return!1;let Z=(Q)=>$.find((W)=>W.Key===Q)?.Value;return Z("Project")===z&&Z("Environment")===J}function $z($,z){let J=w$(z.slug,z.environment);return $.find((Z)=>{if(Z.GroupName!==J)return!1;if(z.vpcId&&Z.VpcId&&Z.VpcId!==z.vpcId)return!1;if(!!Z.Tags?.some((W)=>W.Key==="Project"))return S6(Z.Tags,z.slug,z.environment);return!!z.vpcId&&Z.VpcId===z.vpcId})}function b6($){try{let z=Qz(f6(process.cwd(),"storage/cloud/state",`${$}.json`),"utf8"),J=JSON.parse(z);return typeof J.instanceId==="string"&&J.instanceId.length>0?J.instanceId:null}catch{return null}}class A${name="aws";usesCloudFormation=!0;region;ec2Client;cfnClient;constructor($={}){this.region=$.region||"us-east-1",this.ec2Client=$.ec2Client??((z)=>new Zz(z)),this.cfnClient=$.cfnClient??((z)=>new Jz(z))}resolveRegion($){return $.project.region||this.region}async provisionComputeInfrastructure($){let{config:z,environment:J}=$,Z=this.resolveRegion(z),Q=z.project.slug,W=z.infrastructure?.compute;if(!W)throw Error("infrastructure.compute is required to provision AWS compute");let Y=this.ec2Client(Z),q=await this.findComputeTargets({slug:Q,environment:J,role:"app",region:Z});if(q.length>0){let D=q[0];return{appInstanceId:D.id,appPublicIp:D.publicIp,appPublicIpv6:D.publicIpv6,sshUser:"ubuntu",deployStoragePath:"/var/ts-cloud/staging"}}let j=e2(z);if(!j){if(j=(await new U1(Z).getParameter({Name:i2})).Parameter?.Value??null,!j)throw Error("Could not resolve the Ubuntu 24.04 AMI from SSM")}let G=await Y.describeVpcs(),K=(G.Vpcs||[]).find((D)=>D.IsDefault)||(G.Vpcs||[])[0];if(!K?.VpcId)throw Error("No VPC found to launch the instance into");let V=(await Y.describeSubnets({Filters:[{Name:"vpc-id",Values:[K.VpcId]}]})).Subnets||[],H=V.find((D)=>D.MapPublicIpOnLaunch)||V[0],X=H?.SubnetId;if(!H?.MapPublicIpOnLaunch)console.warn("ts-cloud: no public subnet found; the instance may not get a public IP (deploys/SSL need one).");let O=w$(Q,J),U=(await Y.describeSecurityGroups({Filters:[{Name:"group-name",Values:[O]},{Name:"vpc-id",Values:[K.VpcId]}]})).SecurityGroups?.[0]?.GroupId;if(!U)U=(await Y.createSecurityGroup({GroupName:O,Description:`ts-cloud ${Q}/${J} app`,VpcId:K.VpcId,TagSpecifications:[{ResourceType:"security-group",Tags:B1(Q,J)}]})).GroupId;let F=o2(z);await Y.authorizeSecurityGroupIngress({GroupId:U,IpPermissions:F.map((D)=>({IpProtocol:D.protocol,FromPort:D.port,ToPort:D.port,IpRanges:[{CidrIp:D.cidr}]}))}).catch((D)=>{if(!/InvalidPermission\.Duplicate/.test(D instanceof Error?D.message:""))throw D});let B=s2(t2(z)),M=W.server?.instanceType||"t3.small",A=(await Y.runInstances({ImageId:j,InstanceType:M,MinCount:1,MaxCount:1,SecurityGroupIds:U?[U]:void 0,SubnetId:X,UserData:B,IamInstanceProfile:W.server?.iamInstanceProfile?{Name:W.server.iamInstanceProfile}:void 0,TagSpecifications:[{ResourceType:"instance",Tags:[{Key:"Name",Value:`${Q}-${J}-app`},...B1(Q,J)]}]})).Instances?.[0]?.InstanceId;if(!A)throw Error("RunInstances did not return an instance id");let L=await Y.waitForInstanceState(A,"running");if(!L)throw Error(`Instance ${A} did not reach 'running' before timeout`);return{appInstanceId:A,appPublicIp:L.PublicIpAddress,appPublicIpv6:K0(L.Ipv6Address),sshUser:"ubuntu",deployStoragePath:"/var/ts-cloud/staging"}}async destroyCompute($){let{config:z,environment:J}=$,Z=z.project.slug,Q=this.resolveRegion(z),W=this.ec2Client(Q),Y=[],j=(await this.findComputeTargets({slug:Z,environment:J,role:"app",region:Q})).map((O)=>O.id),G;if(j.length>0)G=(await W.describeInstances({InstanceIds:j}).catch(()=>({Reservations:[]}))).Reservations?.flatMap((C)=>C.Instances??[]).find((C)=>C.VpcId)?.VpcId;if(j.length>0)await W.terminateInstances(j),Y.push(...j.map((O)=>`instance ${O}`)),await Promise.all(j.map((O)=>W.waitForInstanceState(O,"terminated").catch(()=>{return})));let K=w$(Z,J),V=[{Name:"group-name",Values:[K]}];if(G)V.push({Name:"vpc-id",Values:[G]});let H=await W.describeSecurityGroups({Filters:V}).catch(()=>({SecurityGroups:[]})),X=$z(H.SecurityGroups??[],{slug:Z,environment:J,vpcId:G});if(X?.GroupId)for(let O=0;O<10;O++)try{await W.deleteSecurityGroup(X.GroupId),Y.push(`security group ${K}`);break}catch{await new Promise((C)=>setTimeout(C,3000))}return{destroyed:Y}}async getComputeOutputs($){let z=this.resolveRegion($.config),J=P($.config,$.environment),Z=this.cfnClient(z);try{let Q=await Z.getStackOutputs(J);return{deployBucketName:Q.deployBucketName,appInstanceId:Q.appInstanceId,appPublicIp:Q.appPublicIp,sshUser:"ec2-user"}}catch(Q){if(!/does not exist|ValidationError/i.test(Q instanceof Error?Q.message:""))throw Q;let Y=(await this.findComputeTargets({slug:$.config.project.slug,environment:$.environment,role:"app",region:z}))[0];return{appInstanceId:Y?.id,appPublicIp:Y?.publicIp,appPublicIpv6:Y?.publicIpv6,sshUser:"ubuntu",deployStoragePath:"/var/ts-cloud/staging"}}}async uploadRelease($){let z=this.resolveRegion($.config),Z=(await this.getComputeOutputs({config:$.config,environment:$.environment})).deployBucketName;if(!Z)throw Error("No deployBucketName in stack outputs. Re-deploy infrastructure to add the staging bucket.");return await new zz(z).putObject({bucket:Z,key:$.remoteKey,body:Qz($.localPath),contentType:"application/gzip"}),{artifactRef:`s3://${Z}/${$.remoteKey}`}}async findComputeTargets($){let z=$.region??this.region,J=this.ec2Client(z),Z=[{Name:"tag:Project",Values:[$.slug]},{Name:"tag:Environment",Values:[$.environment]},{Name:"tag:Role",Values:[$.role||"app"]},{Name:"instance-state-name",Values:["running","pending"]}],Q=await J.describeInstances({Filters:Z}),W=this.reservationsToTargets(Q.Reservations);if(W.length>0||($.role||"app")!=="app")return W;let Y=$.stackName??`${$.slug}-${$.environment}`,q=b6(Y);if(!q)try{q=(await this.cfnClient(z).getStackOutputs(Y)).appInstanceId??null}catch{q=null}if(!q)return[];try{let j=await J.describeInstances({InstanceIds:[q],Filters:[{Name:"instance-state-name",Values:["running","pending"]}]});return this.reservationsToTargets(j.Reservations)}catch{return[]}}reservationsToTargets($){let z=[];for(let J of $||[])for(let Z of J.Instances||[]){if(!Z.InstanceId)continue;let Q=Z.Tags?.find((W)=>W.Key==="Name")?.Value;z.push({id:Z.InstanceId,name:Q,publicIp:Z.PublicIpAddress,publicIpv6:K0(Z.Ipv6Address),privateIp:Z.PrivateIpAddress,status:Z.State?.Name})}return z}bashWrap($){return["bash <<'TS_CLOUD_BASH_EOF'",$.join(`
+`),"TS_CLOUD_BASH_EOF"]}async runRemoteDeploy($){let z=this.region,J=new U1(z);if($.targets.length>0){let Q=await J.sendCommand({InstanceIds:$.targets.map((W)=>W.id),DocumentName:"AWS-RunShellScript",Parameters:{commands:this.bashWrap($.commands)},TimeoutSeconds:$.timeoutSeconds||600,Comment:$.comment});if(!Q.CommandId)return{success:!1,instanceCount:0,perInstance:[],error:"Failed to send SSM command"};return this.pollSsmCommand(J,Q.CommandId,$.targets.length,(($.timeoutSeconds||600)+30)*1000)}if(!$.tags||Object.keys($.tags).length===0)return{success:!1,instanceCount:0,perInstance:[],error:"No targets or tags provided for AWS deploy"};let Z=await J.sendCommandByTags({tags:$.tags,commands:this.bashWrap($.commands),timeoutSeconds:$.timeoutSeconds||600,comment:$.comment});return{success:Z.success,instanceCount:Z.instanceCount,perInstance:Z.perInstance.map((Q)=>({instanceId:Q.instanceId,status:Q.status,output:Q.output,error:Q.error})),error:Z.error}}async pollSsmCommand($,z,J,Z=600000){let W=Date.now(),Y=new Set(["Success","Failed","Cancelled","TimedOut"]),q=[];while(Date.now()-W<Z){await new Promise((K)=>setTimeout(K,3000));try{if(q=await $.listCommandInvocations({CommandId:z,Details:!0}),q.length>=J&&q.every((V)=>Y.has(V.Status||"")))break}catch{}}let j=q.map((K)=>({instanceId:K.InstanceId,status:K.Status||"Unknown",output:K.StandardOutputContent,error:K.StandardErrorContent})),G=j.length>0&&j.every((K)=>K.status==="Success");return{success:G,instanceCount:j.length,perInstance:j,error:G?void 0:K$(j,"One or more SSM command invocations failed")}}}import{execFileSync as n6,execSync as Kz}from"node:child_process";import{createHash as i6,randomUUID as Vz}from"node:crypto";import{createReadStream as o6,existsSync as t6,readFileSync as s6}from"node:fs";function Wz($={}){let z=Math.max(1,$.appServers??$.instances??1),J=!!$.servicesServer||z>1,Z=z>1||!!$.server?.loadBalancer;return{appServers:z,loadBalancer:Z,dedicatedServices:J,servicesOnApp:!J}}function Yz($,z){let J={REDIS_HOST:$,MEILISEARCH_HOST:`http://${$}:7700`};if(z?.name){if(J.DB_CONNECTION=z.engine==="postgres"?"pgsql":"mysql",J.DB_HOST=$,J.DB_PORT=String(z.port??(z.engine==="postgres"?5432:3306)),J.DB_DATABASE=z.name,z.username)J.DB_USERNAME=z.username;if(z.password)J.DB_PASSWORD=z.password}return J}function C1($){let z=$.infrastructure?.compute??{},J=C0($);return[...U$(z.managedServices??{mysql:!0,redis:!0},{bindPrivate:!0}),...S0(J,z.managedServices??{mysql:!0}),...V0(!0),...O0(!0),...v0(z.sshKeys),...f0($.notifications),...z.backups?.enabled?[...C$({database:J,backups:z.backups})]:[]]}import{homedir as h6}from"node:os";import{join as v6}from"node:path";var R$={location:"fsn1",image:"ubuntu-24.04",sshUser:"root",sshPrivateKeyPath:"~/.ssh/id_ed25519"};function qz($){return $.startsWith("~/")?v6(h6(),$.slice(2)):$}function g0(...$){for(let z of $){let J=process.env[z]?.trim();if(J)return J}return}function d0(...$){for(let z of $){let J=z?.trim();if(J)return J}return}function Q$($,z){return d0($,z?.hetzner?.apiToken,g0("HCLOUD_TOKEN","HETZNER_API_TOKEN"))}function u6($,z){return d0(z,$?.hetzner?.location,g0("HCLOUD_LOCATION","HETZNER_LOCATION"))??R$.location}function W$($,z){let J=$?.infrastructure?.compute;return d0(z,J?.image,$?.hetzner?.image,g0("HCLOUD_IMAGE","HETZNER_IMAGE"))??R$.image}function m6($,z){return d0(z,$?.hetzner?.sshUser,g0("HCLOUD_SSH_USER","HETZNER_SSH_USER"))??R$.sshUser}function jz($,z){return qz(d0(z,$?.hetzner?.sshPrivateKeyPath,g0("HCLOUD_SSH_KEY","HETZNER_SSH_KEY"))??R$.sshPrivateKeyPath)}function g6($,z,J){let Z=d0(z,$?.hetzner?.sshPublicKeyPath,g0("HCLOUD_SSH_PUBLIC_KEY","HETZNER_SSH_PUBLIC_KEY"));if(Z)return qz(Z);return`${J??jz($)}.pub`}function Gz($,z={}){let J=jz($,z.sshPrivateKeyPath);return{apiToken:Q$(z.apiToken,$),location:u6($,z.location),image:W$($,z.image),sshUser:m6($,z.sshUser),sshPrivateKeyPath:J,sshPublicKeyPath:g6($,z.sshPublicKeyPath,J)}}var d6="https://api.hetzner.cloud/v1";class N$ extends Error{status;code;details;constructor($,z,J,Z){super($);this.status=z;this.code=J;this.details=Z;this.name="HetznerApiError"}}class E$ extends Error{action;constructor($,z){super($);this.action=z;this.name="HetznerActionError"}}class k${name="hetzner";apiToken;baseUrl;fetchImpl;constructor($){this.apiToken=$.apiToken,this.baseUrl=$.baseUrl??d6,this.fetchImpl=$.fetchImpl??fetch}async request($,z,J){let Z=await this.fetchImpl(`${this.baseUrl}${z}`,{method:$,headers:{Authorization:`Bearer ${this.apiToken}`,"Content-Type":"application/json"},body:J===void 0?void 0:JSON.stringify(J)}),Q=await Z.text(),W;try{W=Q?JSON.parse(Q):{}}catch{if(!Z.ok){let Y=Q.trim().slice(0,200)||Z.statusText||"Hetzner API error";throw Error(`Hetzner API ${$} ${z} (${Z.status}): ${Y}`)}throw Error(`Hetzner API ${$} ${z}: unexpected non-JSON response`)}if(!Z.ok){let Y=W.error?.message||Z.statusText||"Hetzner API error",q=W.error?.code?` [${W.error.code}]`:"";throw new N$(`Hetzner API ${$} ${z} (${Z.status})${q}: ${Y}`,Z.status,W.error?.code,W.error?.details)}return W}async requestAll($,z){let J=[],Z=1;for(;;){let Q=$.includes("?")?"&":"?",W=await this.request("GET",`${$}${Q}per_page=50&page=${Z}`);J.push(...W[z]??[]);let Y=W.meta?.pagination?.next_page;if(!Y)return J;Z=Y}}async listServers(){return this.requestAll("/servers","servers")}async getServer($){return(await this.request("GET",`/servers/${$}`)).server}async getServerMetrics($,z){let J=new URLSearchParams({type:z.types.join(","),start:z.start.toISOString(),end:z.end.toISOString(),step:String(Math.max(60,Math.floor(z.step??60)))});return(await this.request("GET",`/servers/${$}/metrics?${J}`)).metrics}async listServerTypes($){let z=$?`?name=${encodeURIComponent($)}`:"";return this.requestAll(`/server_types${z}`,"server_types")}async getServerType($){return(await this.listServerTypes($)).find((z)=>z.name===$)??null}async createServer($){let z=await this.request("POST","/servers",{name:$.name,server_type:$.serverType,image:$.image,location:$.location,datacenter:$.datacenter,ssh_keys:$.sshKeys,user_data:$.userData,labels:$.labels,firewalls:$.firewalls,networks:$.networks,start_after_create:!0});return{server:z.server,action:z.action}}async listNetworks(){return this.requestAll("/networks","networks")}async createNetwork($){let z=$.ipRange??"10.0.0.0/16";return(await this.request("POST","/networks",{name:$.name,ip_range:z,subnets:[{type:"cloud",ip_range:z,network_zone:"eu-central"}],labels:$.labels})).network}async deleteNetwork($){await this.request("DELETE",`/networks/${$}`)}async listLoadBalancers(){return this.requestAll("/load_balancers","load_balancers")}async createLoadBalancer($){return(await this.request("POST","/load_balancers",{name:$.name,load_balancer_type:$.type??"lb11",location:$.location,network_zone:$.network?void 0:$.networkZone??"eu-central",network:$.network,labels:$.labels,targets:[{type:"label_selector",label_selector:{selector:$.labelSelector},use_private_ip:!!$.network}],services:$.services.map((J)=>({protocol:J.protocol??"tcp",listen_port:J.listenPort,destination_port:J.destinationPort,health_check:{protocol:"http",port:80,interval:15,timeout:10,retries:3,http:{path:"/",status_codes:["2??","3??"]}}}))})).load_balancer}async deleteLoadBalancer($){await this.request("DELETE",`/load_balancers/${$}`)}async deleteServer($){return(await this.request("DELETE",`/servers/${$}`)).action}async listFirewalls(){return this.requestAll("/firewalls","firewalls")}async createFirewall($){let z=await this.request("POST","/firewalls",{name:$.name,rules:$.rules,labels:$.labels,apply_to:$.applyTo});return{firewall:z.firewall,actions:z.actions}}async setFirewallRules($,z){return(await this.request("POST",`/firewalls/${$}/actions/set_rules`,{rules:z})).actions??[]}async deleteFirewall($){await this.request("DELETE",`/firewalls/${$}`)}async applyFirewallToResources($,z){return(await this.request("POST",`/firewalls/${$}/actions/apply_to_resources`,{apply_to:z})).actions}async listSshKeys(){return this.requestAll("/ssh_keys","ssh_keys")}async createSshKey($){return(await this.request("POST","/ssh_keys",{name:$.name,public_key:$.publicKey,labels:$.labels})).ssh_key}async deleteSshKey($){await this.request("DELETE",`/ssh_keys/${$}`)}async getAction($){return(await this.request("GET",`/actions/${$}`)).action}async shutdownServer($){return(await this.request("POST",`/servers/${$}/actions/shutdown`,{})).action}async powerOnServer($){return(await this.request("POST",`/servers/${$}/actions/poweron`,{})).action}async changeServerType($,z,J){return(await this.request("POST",`/servers/${$}/actions/change_type`,{server_type:z,upgrade_disk:J})).action}async powerOffServer($){return(await this.request("POST",`/servers/${$}/actions/poweroff`,{})).action}async stopServer($,z){if((await this.getServer($)).status==="off")return;await this.shutdownServer($);let Z=z?.gracefulWaitMs??120000,Q=z?.pollIntervalMs??3000,W=Date.now();while(Date.now()-W<Z){if((await this.getServer($)).status==="off")return;await new Promise((q)=>setTimeout(q,Q))}let Y=await this.powerOffServer($);await this.waitForAction(Y.id),await this.waitForServerStatus($,"off")}async renameServer($,z){return(await this.request("PUT",`/servers/${$}`,{name:z})).server}async listImages($){let z=$?.type?`?type=${encodeURIComponent($.type)}`:"";return this.requestAll(`/images${z}`,"images")}async getImage($){return(await this.request("GET",`/images/${$}`)).image}async createImage($,z){return this.request("POST",`/servers/${$}/actions/create_image`,{description:z.description,type:z.type??"snapshot",labels:z.labels})}async deleteImage($){await this.request("DELETE",`/images/${$}`)}async rebuildServer($,z){return(await this.request("POST",`/servers/${$}/actions/rebuild`,{image:z})).action}async listPrimaryIps(){return this.requestAll("/primary_ips","primary_ips")}async unassignPrimaryIp($){return(await this.request("POST",`/primary_ips/${$}/actions/unassign`,{})).action}async assignPrimaryIp($,z){return(await this.request("POST",`/primary_ips/${$}/actions/assign`,{assignee_id:z,assignee_type:"server"})).action}async waitForAction($,z){let J=z?.pollIntervalMs??2000,Z=z?.maxWaitMs??300000,Q=Date.now();while(Date.now()-Q<Z){let W=await this.getAction($);if(W.status==="success")return W;if(W.status==="error")throw new E$(W.error?.message||"Hetzner action failed",W);await new Promise((Y)=>setTimeout(Y,J))}throw Error(`Timed out waiting for Hetzner action ${$}`)}async waitForServerRunning($,z){let J=z?.pollIntervalMs??3000,Z=z?.maxWaitMs??600000,Q=Date.now();while(Date.now()-Q<Z){let W=await this.getServer($);if(W.status==="running")return W;await new Promise((Y)=>setTimeout(Y,J))}throw Error(`Timed out waiting for server ${$} to reach running state`)}async waitForServerStatus($,z,J){let Z=J?.pollIntervalMs??3000,Q=J?.maxWaitMs??600000,W=Date.now();while(Date.now()-W<Q){let Y=await this.getServer($);if(Y.status===z)return Y;await new Promise((q)=>setTimeout(q,Z))}throw Error(`Timed out waiting for server ${$} to reach ${z} state`)}}function c6($,z){let J=Q$($,z);if(!J)throw Error("Hetzner API token required. Set hetzner.apiToken in cloud.config.ts or HCLOUD_TOKEN / HETZNER_API_TOKEN.");return J}function R0($){let[z,J]=$.trim().split(/\s+/);return J?`${z} ${J}`:z}function x0($){return`#cloud-config
+write_files:
+  - path: /var/lib/cloud/ts-cloud-bootstrap.sh
+    permissions: '0755'
+    owner: root:root
+    content: |
+${$.split(`
+`).map((Z)=>`      ${Z}`).join(`
+`)}
+runcmd:
+  - [ bash, /var/lib/cloud/ts-cloud-bootstrap.sh ]
+`}function _$($){let z=new Set([80,443,...$.sitePorts,...$.allowedPorts??[]]);if($.allowSsh)z.add(22);return[...z].map((J)=>{return{direction:"in",protocol:"tcp",port:String(J),source_ips:["0.0.0.0/0","::/0"],description:`ts-cloud port ${J}`}})}var x1={micro:"cpx11",small:"cx23",medium:"cx33",large:"cx43",xlarge:"cx53","2xlarge":"ccx33"};function N0($){if(!$)return x1.micro;if($ in x1)return x1[$];return $}var I="ts-cloud";function S($,z,J="app"){return{[`${I}/project`]:$,[`${I}/environment`]:z,[`${I}/role`]:J,[`${I}/managed-by`]:"ts-cloud"}}function p($,z,J,Z="app"){return L1($,z,J)&&$[`${I}/role`]===Z}function L1($,z,J){if(!$)return!1;return $[`${I}/project`]===z&&$[`${I}/environment`]===J}import{mkdir as l6,readFile as p6,rename as r6,writeFile as a6}from"node:fs/promises";import{join as Hz}from"node:path";var E0="storage/cloud/state";function Xz($){return Hz(process.cwd(),E0,`${$}.json`)}async function k0($){try{let z=await p6(Xz($),"utf8");return JSON.parse(z)}catch{return null}}async function _0($,z){let J=Xz($);await l6(Hz(process.cwd(),E0),{recursive:!0});let Z=`${J}.${process.pid}.tmp`;await a6(Z,`${JSON.stringify(z,null,2)}
+`,"utf8"),await r6(Z,J)}var D1=268435456,e6=8000;function e($){return`'${$.replace(/'/g,`'"'"'`)}'`}async function $8($){let z=i6("sha256");for await(let J of o6($))z.update(J);return z.digest("hex")}function Oz($){return(Buffer.isBuffer($)?$.toString("utf8"):typeof $==="string"?$:"").replace(/(^|\n)(\s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_]*=).*$/gm,"$1$2[redacted]").replace(/encrypted:[A-Za-z0-9+/=]+/g,"encrypted:[redacted]").trim().slice(-e6)}function Mz($){let z=$,J=typeof z?.status==="number"?` (exit ${z.status})`:"",Z=z?.signal?` (signal ${z.signal})`:"",Q=[Oz(z?.stderr),Oz(z?.stdout)].filter(Boolean).join(`
+`);return`Remote SSH command failed${J}${Z}${Q?`
+${Q}`:""}`}class L0{name="hetzner";usesCloudFormation=!1;client;sshPrivateKeyPath;sshPublicKeyPath;sshUser;location;stateOnly;waitForBoot;bootWait;constructor($={}){let z=Q$($.apiToken);if(this.stateOnly=!$.client&&!z&&$.allowStateOnly===!0,!$.client&&!z&&!this.stateOnly)throw Error("Hetzner API token required. Set hetzner.apiToken in cloud.config.ts or HCLOUD_TOKEN / HETZNER_API_TOKEN.");this.client=$.client??new k$({apiToken:z??""});let J=Gz(void 0,{sshPrivateKeyPath:$.sshPrivateKeyPath,sshPublicKeyPath:$.sshPublicKeyPath,sshUser:$.sshUser,location:$.location});this.sshPrivateKeyPath=J.sshPrivateKeyPath,this.sshPublicKeyPath=J.sshPublicKeyPath,this.sshUser=J.sshUser,this.location=J.location,this.waitForBoot=$.waitForBoot??!0,this.bootWait={sshIntervalMs:$.bootWait?.sshIntervalMs??5000,sshTimeoutMs:$.bootWait?.sshTimeoutMs??300000,cloudInitIntervalMs:$.bootWait?.cloudInitIntervalMs??5000,cloudInitTimeoutMs:$.bootWait?.cloudInitTimeoutMs??600000}}async provisionComputeInfrastructure($){let{config:z,environment:J}=$,Z=z.project.slug,Q=z.infrastructure?.compute;if(!Q)throw Error("infrastructure.compute is required to provision Hetzner compute");if(z.cloud?.attachTo)return this.attachToComputeInfrastructure(z.cloud.attachTo,z,J);let W=P(z,J),Y=`${Z}-${J}-app`,q=Q.runtime==="php"||!!Q.php,j=Wz(Q);if(j.dedicatedServices||j.appServers>1)return q?this.provisionFleet($,j):this.provisionBunFleet($,j);let G=S(Z,J,"app"),K=z.sites||{},V=t(Q)?[]:this.collectUpstreamPorts(K),H=`${Z}-${J}-app-fw`,{firewall:X}=await this.ensureFirewall(H,G,_$({allowSsh:Q.allowSsh!==!1,sitePorts:V,allowedPorts:[...Q.firewall?.allowedPorts??[],...a2(z.infrastructure?.sftp)]})),O=await this.ensureSshKey(Z,J,G),C=await k0(W);if(C?.serverId){let T=await this.tryGetServer(C.serverId);if(T&&T.status!=="off")return this.outputsFromState(C,T)}let U=await this.findExistingServer(Z,J,Y);if(U&&U.status!=="off"){let T={provider:"hetzner",stackName:W,serverId:U.id,serverName:U.name,publicIp:U.public_net.ipv4?.ip,publicIpv6:K0(U.public_net.ipv6?.ip),deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser};return await _0(W,T),this.outputsFromState(T,U)}let F=Q.proxy?.engine==="rpx"?U0({proxy:Q.proxy,config:B0(K,{proxy:Q.proxy,slug:z.project.slug}),slug:z.project.slug,bunBin:Q.runtime==="node"||Q.runtime==="deno"?void 0:"/usr/local/bin/bun"}):void 0,B=Z$(z,{environment:J}),M=Q.bakedImage===!0,x=s({runtime:B.runtime,runtimeVersion:B.runtimeVersion,systemPackages:Q.systemPackages,database:z.infrastructure?.database,phpProvision:B.phpProvision,servicesProvision:B.servicesProvision,rpxProvision:F,baked:M,swapGb:Q.swapGb}),A=x0(x),L=N0(Q.size),D=W$(z),{server:N,action:r}=await this.client.createServer({name:Y,serverType:L,image:D,location:z.hetzner?.location||this.location,userData:A,labels:G,sshKeys:O?[O]:void 0,firewalls:[{firewall:X.id}]});await this.client.waitForAction(r.id);let _=await this.client.waitForServerRunning(N.id),h={provider:"hetzner",stackName:W,serverId:_.id,serverName:_.name,firewallId:X.id,publicIp:_.public_net.ipv4?.ip,publicIpv6:K0(_.public_net.ipv6?.ip),deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser};await _0(W,h);let v=_.public_net.ipv4?.ip;if(v&&this.waitForBoot)await this.waitForSshReady(v),await this.waitForCloudInit(v);return this.outputsFromState(h,_)}async provisionFleet($,z){let{config:J,environment:Z}=$,Q=J.project.slug,W=J.infrastructure.compute,Y=P(J,Z),q=N0(W.size),j=W$(J),G=J.hetzner?.location||this.location,K=W.bakedImage===!0,V=await k0(Y);if(V?.loadBalancerId){let f=(await this.client.listLoadBalancers().catch(()=>[])).find((w)=>w.id===V.loadBalancerId);if(f)return{appPublicIp:f.public_net?.ipv4?.ip,loadBalancerIp:f.public_net?.ipv4?.ip,servicesPrivateIp:V.servicesPrivateIp,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser}}let H=await this.ensureSshKey(Q,Z,S(Q,Z,"app")),X=`${Q}-${Z}-net`,C=(await this.client.listNetworks().catch(()=>[])).find((R)=>R.name===X)??await this.client.createNetwork({name:X,labels:S(Q,Z,"app")}),{firewall:U}=await this.ensureFirewall(`${Q}-${Z}-app-fw`,S(Q,Z,"app"),_$({allowSsh:!0,sitePorts:[],allowedPorts:W.firewall?.allowedPorts})),{firewall:F}=await this.ensureFirewall(`${Q}-${Z}-services-fw`,S(Q,Z,"services"),[{direction:"in",protocol:"tcp",port:"22",source_ips:["0.0.0.0/0","::/0"]},{direction:"in",protocol:"tcp",port:"3306",source_ips:[C.ip_range]},{direction:"in",protocol:"tcp",port:"5432",source_ips:[C.ip_range]},{direction:"in",protocol:"tcp",port:"6379",source_ips:[C.ip_range]},{direction:"in",protocol:"tcp",port:"7700",source_ips:[C.ip_range]}]),B=C1(J),M=x0(s({runtime:"php",servicesProvision:B,baked:K,swapGb:W.swapGb})),x=await this.client.listServers().catch(()=>[]),A=[],L=x.find((R)=>p(R.labels,Q,Z,"services"));if(!L){let{server:R,action:f}=await this.client.createServer({name:`${Q}-${Z}-services`,serverType:N0(typeof W.servicesServer==="object"?W.servicesServer.size:W.size),image:j,location:G,userData:M,labels:S(Q,Z,"services"),sshKeys:H?[H]:void 0,firewalls:[{firewall:F.id}],networks:[C.id]});await this.client.waitForAction(f.id),L=await this.client.waitForServerRunning(R.id),A.push(R.id)}let D=L.id,N=L.private_net?.[0]?.ip??(await this.client.getServer(D)).private_net?.[0]?.ip,r=[...V0(!0),...O0(!0),...v0(W.sshKeys),...f0(J.notifications)],_=x$({versions:W.php?.versions,default:W.php?.default,extensions:W.php?.extensions,installNginx:!t(W),optimizeForProduction:W.php?.optimizeForProduction,ini:W.php?.ini}),h=x0(s({runtime:"php",phpProvision:_,servicesProvision:r,baked:K,swapGb:W.swapGb})),v=x.filter((R)=>p(R.labels,Q,Z,"app")),T=v.map((R)=>R.id);if(v.length>z.appServers)for(let R of v.slice(z.appServers))await this.client.deleteServer(R.id).catch(()=>{}),T.splice(T.indexOf(R.id),1);for(let R=v.length;R<z.appServers;R++){let{server:f,action:w}=await this.client.createServer({name:`${Q}-${Z}-app-${R+1}`,serverType:q,image:j,location:G,userData:h,labels:S(Q,Z,"app"),sshKeys:H?[H]:void 0,firewalls:[{firewall:U.id}],networks:[C.id]});await this.client.waitForAction(w.id),T.push(f.id),A.push(f.id)}if(this.waitForBoot&&A.length>0)await Promise.all(A.map(async(R)=>{let w=(await this.client.waitForServerRunning(R)).public_net.ipv4?.ip;if(w)await this.waitForSshReady(w),await this.waitForCloudInit(w)}));let g=`${Q}-${Z}-lb`,E,W0;if(z.loadBalancer){let f=(await this.client.listLoadBalancers().catch(()=>[])).find((w)=>w.name===g)??await this.client.createLoadBalancer({name:g,location:G,network:C.id,labels:S(Q,Z,"lb"),labelSelector:`ts-cloud/project=${Q},ts-cloud/environment=${Z},ts-cloud/role=app`,services:[{listenPort:80,destinationPort:80},{listenPort:443,destinationPort:443}]});W0=f.id,E=f.public_net?.ipv4?.ip}let u=E??(await this.client.getServer(T[0]).catch(()=>{return}))?.public_net.ipv4?.ip,$0={provider:"hetzner",stackName:Y,networkId:C.id,loadBalancerId:W0,servicesServerId:D,servicesPrivateIp:N,publicIp:u,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser};return await _0(Y,$0),{appPublicIp:u,loadBalancerIp:E,servicesPrivateIp:N,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser}}async provisionBunFleet($,z){let{config:J,environment:Z}=$,Q=J.project.slug,W=J.infrastructure.compute,Y=P(J,Z),q=N0(W.size),j=W$(J),G=J.hetzner?.location||this.location,K=W.bakedImage===!0,V=J.sites||{},H=await k0(Y);if(H?.lbServerId){let w=await this.tryGetServer(H.lbServerId);if(w&&w.status!=="off"){let k=W.proxy?.engine==="rpx"?W.proxy:{engine:"rpx"},b=await this.findComputeTargets({slug:Q,environment:Z,role:"app",stackName:Y});return this.refreshLbRoutes(w,V,b.map((i)=>({privateIp:i.privateIp,publicIp:i.publicIp})),k,Q),{appPublicIp:w.public_net.ipv4?.ip??H.publicIp,loadBalancerIp:w.public_net.ipv4?.ip??H.publicIp,servicesPrivateIp:H.servicesPrivateIp,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser}}}let X=await this.ensureSshKey(Q,Z,S(Q,Z,"app")),O=`${Q}-${Z}-net`,U=(await this.client.listNetworks().catch(()=>[])).find((w)=>w.name===O)??await this.client.createNetwork({name:O,labels:S(Q,Z,"app")}),F=this.collectUpstreamPorts(V),{firewall:B}=await this.ensureFirewall(`${Q}-${Z}-app-fw`,S(Q,Z,"app"),[{direction:"in",protocol:"tcp",port:"22",source_ips:["0.0.0.0/0","::/0"]},...F.map((w)=>({direction:"in",protocol:"tcp",port:String(w),source_ips:[U.ip_range],description:`ts-cloud port ${w} (private, LB-only)`}))]),{firewall:M}=await this.ensureFirewall(`${Q}-${Z}-lb-fw`,S(Q,Z,"lb"),_$({allowSsh:!0,sitePorts:[],allowedPorts:W.firewall?.allowedPorts})),x=await this.client.listServers().catch(()=>[]),A=[],L,D,N=!!W.servicesServer||!!W.managedServices,r=z.dedicatedServices&&N;if(r){let{firewall:w}=await this.ensureFirewall(`${Q}-${Z}-services-fw`,S(Q,Z,"services"),[{direction:"in",protocol:"tcp",port:"22",source_ips:["0.0.0.0/0","::/0"]},{direction:"in",protocol:"tcp",port:"3306",source_ips:[U.ip_range]},{direction:"in",protocol:"tcp",port:"5432",source_ips:[U.ip_range]},{direction:"in",protocol:"tcp",port:"6379",source_ips:[U.ip_range]},{direction:"in",protocol:"tcp",port:"7700",source_ips:[U.ip_range]}]),k=C1(J),b=x0(s({runtime:"bun",servicesProvision:k,baked:K,swapGb:W.swapGb})),i=x.find((X0)=>p(X0.labels,Q,Z,"services"));if(!i){let{server:X0,action:n0}=await this.client.createServer({name:`${Q}-${Z}-services`,serverType:N0(typeof W.servicesServer==="object"?W.servicesServer.size:W.size),image:j,location:G,userData:b,labels:S(Q,Z,"services"),sshKeys:X?[X]:void 0,firewalls:[{firewall:w.id}],networks:[U.id]});await this.client.waitForAction(n0.id),i=await this.client.waitForServerRunning(X0.id),A.push(X0.id)}L=i.id,D=i.private_net?.[0]?.ip??(await this.client.getServer(L)).private_net?.[0]?.ip}let _=r?{...W,managedServices:void 0,backups:void 0}:W,h=Z$({...J,infrastructure:{...J.infrastructure,compute:_}},{environment:Z}),v=x0(s({runtime:h.runtime,runtimeVersion:h.runtimeVersion,systemPackages:W.systemPackages,database:J.infrastructure?.database,servicesProvision:h.servicesProvision,baked:K,swapGb:W.swapGb})),T=x.filter((w)=>p(w.labels,Q,Z,"app")),g=T.map((w)=>w.id);if(T.length>z.appServers)for(let w of T.slice(z.appServers))await this.client.deleteServer(w.id).catch(()=>{}),g.splice(g.indexOf(w.id),1);for(let w=T.length;w<z.appServers;w++){let{server:k,action:b}=await this.client.createServer({name:`${Q}-${Z}-app-${w+1}`,serverType:q,image:j,location:G,userData:v,labels:S(Q,Z,"app"),sshKeys:X?[X]:void 0,firewalls:[{firewall:B.id}],networks:[U.id]});await this.client.waitForAction(b.id),g.push(k.id),A.push(k.id)}if(this.waitForBoot&&A.length>0)await Promise.all(A.map(async(w)=>{let b=(await this.client.waitForServerRunning(w)).public_net.ipv4?.ip;if(b)await this.waitForSshReady(b),await this.waitForCloudInit(b)}));let E=[];for(let w of g){let k=x.find((b)=>b.id===w);if(!k||!k.private_net?.[0]?.ip)k=await this.client.getServer(w).catch(()=>k);E.push({privateIp:k?.private_net?.[0]?.ip,publicIp:k?.public_net.ipv4?.ip})}let W0=`${Q}-${Z}-lb`,u,$0;if(z.loadBalancer){let w=x.find((b)=>p(b.labels,Q,Z,"lb")),k=W.proxy?.engine==="rpx"?W.proxy:{engine:"rpx"};if(!w){let b=U0({proxy:k,config:h0(V,E,{proxy:k,slug:Q}),slug:Q,bunBin:h.runtime==="node"||h.runtime==="deno"?void 0:"/usr/local/bin/bun"}),i=x0(s({runtime:"bun",rpxProvision:b,baked:!1})),X0=typeof W.loadBalancer==="object"?W.loadBalancer.size:void 0,{server:n0,action:p$}=await this.client.createServer({name:W0,serverType:N0(X0??"micro"),image:j,location:G,userData:i,labels:S(Q,Z,"lb"),sshKeys:X?[X]:void 0,firewalls:[{firewall:M.id}],networks:[U.id]});if(await this.client.waitForAction(p$.id),w=await this.client.waitForServerRunning(n0.id),this.waitForBoot){let i0=w.public_net.ipv4?.ip;if(i0)await this.waitForSshReady(i0),await this.waitForCloudInit(i0)}}else this.refreshLbRoutes(w,V,E,k,Q);u=w.id,$0=w.public_net.ipv4?.ip}let R=$0??(await this.client.getServer(g[0]).catch(()=>{return}))?.public_net.ipv4?.ip,f={provider:"hetzner",stackName:Y,networkId:U.id,lbServerId:u,appServerIds:g,servicesServerId:L,servicesPrivateIp:D,publicIp:R,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser};return await _0(Y,f),{appPublicIp:R,loadBalancerIp:$0,servicesPrivateIp:D,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser}}async destroyCompute($){let{config:z,environment:J}=$,Z=z.project.slug,Q=P(z,J),W=await k0(Q),Y=[],q=`${Z}-${J}-lb`,G=(await this.client.listLoadBalancers().catch(()=>[])).find((B)=>B.name===q);if(G)try{await this.client.deleteLoadBalancer(G.id),Y.push(`load balancer ${q}`)}catch{}let K=await this.client.listServers().catch(()=>[]),V=new Set;for(let B of K)if(p(B.labels,Z,J,"app")||p(B.labels,Z,J,"services")||p(B.labels,Z,J,"lb"))V.add(B.id);if(W?.serverId)V.add(W.serverId);if(W?.servicesServerId)V.add(W.servicesServerId);if(W?.lbServerId)V.add(W.lbServerId);for(let B of W?.appServerIds??[])V.add(B);for(let B of V)try{await this.client.deleteServer(B),Y.push(`server ${B}`)}catch{}let H=await this.client.listFirewalls().catch(()=>[]);for(let B of[`${Z}-${J}-app-fw`,`${Z}-${J}-services-fw`,`${Z}-${J}-lb-fw`]){let M=H.find((x)=>x.name===B);if(!M)continue;for(let x=0;x<12;x++)try{await this.client.deleteFirewall(M.id),Y.push(`firewall ${B}`);break}catch{await this.sleep(3000)}}let X=`${Z}-${J}-net`,C=(await this.client.listNetworks().catch(()=>[])).find((B)=>B.name===X);if(C)for(let B=0;B<12;B++)try{await this.client.deleteNetwork(C.id),Y.push(`network ${X}`);break}catch{await this.sleep(3000)}let F=(await this.client.listSshKeys().catch(()=>[])).filter((B)=>L1(B.labels,Z,J));for(let B of F)try{await this.client.deleteSshKey(B.id),Y.push(`ssh key ${B.name}`)}catch{}return await _0(Q,{provider:"hetzner",stackName:Q}).catch(()=>{}),{destroyed:Y}}async getComputeOutputs($){let z=P($.config,$.environment),J=await k0(z);if(J?.serverId){let W=await this.tryGetServer(J.serverId);if(W)return this.outputsFromState(J,W)}if(J?.lbServerId){let Y=(await this.tryGetServer(J.lbServerId))?.public_net.ipv4?.ip??J.publicIp;return{...this.outputsFromState(J),appPublicIp:Y,loadBalancerIp:Y}}if(J?.loadBalancerId||J?.servicesPrivateIp)return this.outputsFromState(J);let Q=(await this.findComputeTargets({slug:$.config.project.slug,environment:$.environment,role:"app",stackName:P($.config,$.environment)}))[0];return{deployStoragePath:"/var/ts-cloud/staging",appInstanceId:Q?.id,appPublicIp:Q?.publicIp,sshUser:this.sshUser}}async uploadRelease($){let z=$.targets?.length?$.targets:await this.findComputeTargets({slug:$.config.project.slug,environment:$.environment,role:"app",stackName:P($.config,$.environment)});if(z.length===0)throw Error("No Hetzner compute targets found for release upload");let Q=`/var/ts-cloud/staging/${`${$.remoteKey.replace(/^releases\//,"").replace(/\.tar\.gz$/,"").replace(/\//g,"-")}-${Vz()}.tar.gz`}`,W=await $8($.localPath),Y="/var/ts-cloud/artifacts",q=`${Y}/${W}.tar.gz`;for(let j of z){if(!j.publicIp)throw Error(`Target ${j.id} has no public IP for SCP upload`);let G=["set -euo pipefail",`mkdir -p ${e(Y)} /var/ts-cloud/staging`,`test -s ${e(q)}`,`cp -- ${e(q)} ${e(Q)}`].join(`
+`);try{this.sshExec(j.publicIp,G);continue}catch{}let K=`${Y}/.${W}-${Vz()}.tmp`;this.scpToHost(j.publicIp,$.localPath,K),this.sshExec(j.publicIp,["set -euo pipefail",`chmod 600 ${e(K)}`,`mv -f -- ${e(K)} ${e(q)}`,`cp -- ${e(q)} ${e(Q)}`,`find ${e(Y)} -type f -name '*.tar.gz' -mtime +7 -delete 2>/dev/null || true`].join(`
+`))}return{artifactRef:Q}}async findComputeTargets($){let z=$.role||"app",J=(W)=>({id:String(W.id),name:W.name,publicIp:W.public_net.ipv4?.ip,publicIpv6:K0(W.public_net.ipv6?.ip),privateIp:W.private_net?.[0]?.ip,status:W.status});if(z==="app"||z==="lb"||z==="services"){let W=await k0($.stackName??`${$.slug}-${$.environment}`),Y=[...new Set(z==="app"?[W?.serverId,...W?.appServerIds??[]]:z==="lb"?[W?.lbServerId]:[W?.servicesServerId])].filter((G)=>typeof G==="number");if(this.stateOnly){if(Y.length>0&&W?.publicIp)return Y.map((G)=>({id:String(G),name:G===W.serverId?W.serverName:void 0,publicIp:W.publicIp,publicIpv6:W.publicIpv6,status:"running"}));if(z!=="app")return[];throw Error(`Hetzner API token required because '${$.stackName??`${$.slug}-${$.environment}`}' has no complete local compute state pin.`)}let q=await this.client.listServers();if(Y.length>0){let G=[];for(let K of Y){let V=q.find((H)=>H.id===K)??await this.tryGetServer(K);if(K===W?.serverId&&W.serverName&&V?.name!==W.serverName)continue;if(V&&V.status!=="off")G.push(V)}if(G.length>0)return G.map(J)}let j=q.filter((G)=>p(G.labels,$.slug,$.environment,z));if(j.length>0)return j.map(J);if(z==="app"){let G=q.filter((K)=>K.status!=="off"&&K.labels?.[`${I}/managed-by`]==="ts-cloud"&&K.labels?.[`${I}/environment`]===$.environment&&K.labels?.[`${I}/role`]==="app");if(G.length===1)return G.map(J)}return[]}if(this.stateOnly)throw Error(`Hetzner API token required to discover '${z}' compute targets.`);let Q=(await this.client.listServers()).filter((W)=>p(W.labels,$.slug,$.environment,z));if(Q.length>0)return Q.map(J);return[]}async attachToComputeInfrastructure($,z,J){let Z=await this.client.listServers(),Q=(H)=>Z.filter((X)=>X.status!=="off"&&p(X.labels,$,J,H)),W=Q("app");if(W.length===0)throw Error(`Cannot attach '${z.project.slug}' to '${$}': no running Hetzner app server is labeled for ${$}/${J}. Deploy the owner project first.`);let Y=Q("lb")[0],q=Q("services")[0],j=W[0],G=Y??j,K=P(z,J),V={provider:"hetzner",stackName:K,serverId:j.id,serverName:j.name,appServerIds:W.map((H)=>H.id),lbServerId:Y?.id,servicesServerId:q?.id,servicesPrivateIp:q?.private_net?.[0]?.ip,publicIp:G.public_net.ipv4?.ip,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser};return await _0(K,V),this.outputsFromState(V)}async listReachableResources(){return(await this.client.listServers()).map((z)=>({name:z.name,labels:z.labels}))}async runRemoteDeploy($){if($.targets.length===0)return{success:!1,instanceCount:0,perInstance:[],error:"No targets provided"};let z=$.commands.join(`
+`),J=[];for(let Q of $.targets){if(!Q.publicIp){J.push({instanceId:Q.id,status:"Failed",error:"Missing public IP"});continue}try{let W=this.sshExec(Q.publicIp,z);J.push({instanceId:Q.id,status:"Success",output:W})}catch(W){J.push({instanceId:Q.id,status:"Failed",error:W.message})}}let Z=J.every((Q)=>Q.status==="Success");return{success:Z,instanceCount:$.targets.length,perInstance:J,error:Z?void 0:K$(J,"One or more SSH deploy commands failed")}}async ensureSshKey($,z,J){if(!t6(this.sshPublicKeyPath))throw Error(`SSH public key not found at ${this.sshPublicKeyPath}. ts-cloud deploys to Hetzner over SSH and needs a public key to authorize on the server. Generate one (\`ssh-keygen -t ed25519\`) or set hetzner.sshPrivateKeyPath / HCLOUD_SSH_PUBLIC_KEY.`);let Z=s6(this.sshPublicKeyPath,"utf8").trim(),Q=R0(Z),Y=(await this.client.listSshKeys()).find((j)=>R0(j.public_key)===Q);if(Y)return Y.id;return(await this.client.createSshKey({name:`${$}-${z}-deploy`,publicKey:Z,labels:J})).id}async tryGetServer($){try{return await this.client.getServer($)}catch{return null}}refreshLbRoutes($,z,J,Z,Q){let W=$.public_net.ipv4?.ip;if(!W){console.warn(`[ts-cloud] LB server '${$.name}' has no public IP — skipping the rpx route refresh; its routes may be stale.`);return}let Y=J.filter((j)=>j.privateIp||j.publicIp);if(Y.length===0){console.warn(`[ts-cloud] No routable app boxes found for LB '${$.name}' — leaving its current rpx routes untouched.`);return}let q=h0(z,Y,{proxy:Z,slug:Q});this.sshExec(W,J$({config:q,slug:Q}).join(`
+`))}async findExistingServer($,z,J){let Z=await this.client.listServers(),Q=Z.find((Y)=>p(Y.labels,$,z,"app")||Y.name===J);if(Q)return Q;let W=Z.filter((Y)=>Y.status!=="off"&&Y.labels?.[`${I}/managed-by`]==="ts-cloud"&&Y.labels?.[`${I}/environment`]===z&&Y.labels?.[`${I}/role`]==="app");if(W.length===1){let Y=W[0],q=Y.labels?.[`${I}/project`]??"unknown";return console.warn(`[ts-cloud] No server named '${J}' found; adopting existing ts-cloud app server '${Y.name}' (project label '${q}') for project '${$}' — `+"updating it in place instead of provisioning a new server."),Y}return}async ensureFirewall($,z,J){let Q=(await this.client.listFirewalls()).find((Y)=>Y.name===$);if(Q)return await this.client.setFirewallRules(Q.id,J),{firewall:Q};let{firewall:W}=await this.client.createFirewall({name:$,labels:z,rules:J});return{firewall:W}}collectUpstreamPorts($){let z=new Set;for(let J of Object.values($))if(typeof J.port==="number")z.add(J.port);return[...z].filter((J)=>![80,443].includes(J))}async sleep($){await new Promise((z)=>setTimeout(z,$))}async waitForSshReady($){let{sshIntervalMs:z,sshTimeoutMs:J}=this.bootWait,Z=Date.now(),Q;while(Date.now()-Z<J)try{Kz(`ssh ${this.sshBaseArgs($,["-o","ConnectTimeout=5"]).map(e).join(" ")} true`,{stdio:"pipe",maxBuffer:D1});return}catch(W){Q=W,await this.sleep(z)}throw Error(`Timed out waiting for SSH on ${$} after ${J}ms: ${Q?.message??"unknown error"}`)}async waitForCloudInit($){let{cloudInitIntervalMs:z,cloudInitTimeoutMs:J}=this.bootWait,Z=Date.now();while(Date.now()-Z<J){try{let Q=this.sshExec($,"if command -v cloud-init >/dev/null 2>&1; then cloud-init status --long 2>/dev/null || true; else echo 'status: done'; fi");if(/status:\s*error/.test(Q))throw Error(`cloud-init reported an error on ${$}:
+${Q}`);if(/status:\s*(?:done|degraded)/.test(Q))return}catch(Q){if(Q instanceof Error&&/cloud-init reported an error/.test(Q.message))throw Q}await this.sleep(z)}throw Error(`Timed out waiting for cloud-init to finish on ${$} after ${J}ms`)}outputsFromState($,z){return{deployStoragePath:$.deployStoragePath||"/var/ts-cloud/staging",appInstanceId:$.serverId?String($.serverId):void 0,appPublicIp:z?.public_net.ipv4?.ip||$.publicIp,appPublicIpv6:K0(z?.public_net.ipv6?.ip)||$.publicIpv6,sshUser:$.sshUser||this.sshUser,servicesPrivateIp:$.servicesPrivateIp}}static SSH_HOST_KEY_OPTS=["-o","StrictHostKeyChecking=no","-o","UserKnownHostsFile=/dev/null","-o","LogLevel=ERROR"];static SSH_KEEPALIVE_OPTS=["-o","ConnectTimeout=30","-o","ServerAliveInterval=15","-o","ServerAliveCountMax=4"];sshBaseArgs($,z=[]){return["-i",this.sshPrivateKeyPath,...L0.SSH_HOST_KEY_OPTS,...L0.SSH_KEEPALIVE_OPTS,"-o","BatchMode=yes",...z,`${this.sshUser}@${$}`]}scpToHost($,z,J){let Z=["scp","-i",this.sshPrivateKeyPath,...L0.SSH_HOST_KEY_OPTS,...L0.SSH_KEEPALIVE_OPTS,"-o","BatchMode=yes",z,`${this.sshUser}@${$}:${J}`].map((W)=>`"${W.replace(/"/g,"\\\"")}"`).join(" "),Q=3;for(let W=1;W<=3;W++)try{Kz(Z,{stdio:"pipe",maxBuffer:D1});return}catch(Y){if(W===3)throw Error(Mz(Y))}}sshExec($,z){try{return n6("ssh",[...this.sshBaseArgs($),"bash -s"],{encoding:"utf8",input:z,stdio:["pipe","pipe","pipe"],maxBuffer:D1})}catch(J){throw Error(Mz(J))}}}class T${name="hetzner";usesCloudFormation=!1;async getComputeOutputs(){return{appPublicIp:"127.0.0.1",sshUser:"root"}}async uploadRelease($){return{artifactRef:$.localPath}}async findComputeTargets($){if(($.role||"app")!=="app")return[];return[{id:"localhost",name:"localhost",publicIp:"127.0.0.1",status:"running"}]}async runRemoteDeploy($){let z=$.commands.join(`
+`);try{let J=Bun.spawn(["bash","-c",z],{stdout:"pipe",stderr:"pipe",env:process.env}),[Z,Q,W]=await Promise.all([new Response(J.stdout).text(),new Response(J.stderr).text(),J.exited]);return{success:W===0,instanceCount:1,perInstance:[{instanceId:"localhost",status:W===0?"Success":"Failed",output:Z,error:Q}]}}catch(J){return{success:!1,instanceCount:1,perInstance:[{instanceId:"localhost",status:"Failed",error:J?.message??String(J)}],error:J?.message??String(J)}}}}function w1(){let $=process.env.TS_CLOUD_DASHBOARD_BOX;return $!=null&&$!==""&&$!=="0"&&$.toLowerCase()!=="false"}function z8($){if(w1())return new T$;switch($.provider??m0($.config)){case"aws":return new A$({region:$.config.project.region});case"hetzner":return new L0({apiToken:$.config.hetzner?.apiToken,allowStateOnly:Boolean($.config.cloud?.attachTo),sshPrivateKeyPath:$.config.hetzner?.sshPrivateKeyPath,sshPublicKeyPath:$.config.hetzner?.sshPublicKeyPath,sshUser:$.config.hetzner?.sshUser,location:$.config.hetzner?.location});default:throw Error(`Unknown cloud provider: ${$.provider??m0($.config)}`)}}class Fz{drivers=new Map;getDriver($,z){let J=z??m0($),Z=`${J}:${$.project.slug}:${$.project.region||"default"}`,Q=this.drivers.get(Z);if(Q)return Q;let W=z8({config:$,provider:J});return this.drivers.set(Z,W),W}}var QZ=new Fz;function J8($){return $.location?.name??$.datacenter?.location.name??"unknown"}function c0($){return typeof $==="number"&&Number.isFinite($)?$:0}function Z8($,z){if($.architecture&&z.architecture&&$.architecture!==z.architecture)throw Error(`Cannot resize ${$.name} (${$.architecture}) to ${z.name} (${z.architecture}) in place.`);let J=[];if(c0(z.cores)<c0($.cores))J.push("CPU");if(c0(z.memory)<c0($.memory))J.push("memory");if(c0(z.disk)<c0($.disk))J.push("disk");if(J.length>0)throw Error(`Refusing an in-place downgrade from ${$.name} to ${z.name}: ${J.join(", ")} would shrink.`)}async function Bz($,z,J,Z=!0){let[Q,W]=await Promise.all([$.getServer(z),$.getServerType(J)]);if(!W)throw Error(`Hetzner server type ${J} was not found.`);let Y=Q.server_type,q=Y.name===W.name;if(!q)Z8(Y,W);let j=J8(Q),G=W.locations?.find((K)=>K.name===j);return{serverId:z,serverName:Q.name,location:j,currentType:Y,targetType:W,capacityAvailable:G?.available!==!1,alreadyComplete:q,upgradeDisk:Z}}function Uz($){if($ instanceof N$&&$.code==="resource_unavailable")return!0;if($ instanceof E$){if($.action.error?.code==="resource_unavailable")return!0;if(/no fitting vhost|placement|free resources/i.test($.action.error?.message??""))return!0}return/resource_unavailable|no fitting vhost|error during placement|free resources/i.test($ instanceof Error?$.message:String($))}async function G0($,z,J){await $?.onPhase?.(z,J)}async function A1($,z,J){await $.waitForAction(z.id,{pollIntervalMs:J.actionPollIntervalMs,maxWaitMs:J.actionTimeoutMs})}var y$=async({client:$,hooks:z,actionPollIntervalMs:J,actionTimeoutMs:Z,serverPollIntervalMs:Q,serverTimeoutMs:W},Y,q,j)=>{let G=await $.getServer(Y.serverId);if(G.status!=="running"){await G0(z,j?"recovering":"powering-on",{serverId:Y.serverId});let V=await $.powerOnServer(Y.serverId);await A1($,V,{actionPollIntervalMs:J,actionTimeoutMs:Z}),G=await $.waitForServerRunning(Y.serverId,{pollIntervalMs:Q,maxWaitMs:W})}await G0(z,"verifying",{serverId:Y.serverId,recovered:j});let K=await z?.afterBoot?.(G,Y.targetType,q,{recovered:j});return{server:G,verification:K}};async function Q8($){let{client:z,hooks:J}=$,Z=$.upgradeDisk??!0;await G0(J,"planning",{serverId:$.serverId,targetType:$.targetType});let Q=await Bz(z,$.serverId,$.targetType,Z),W=await z.getServer(Q.serverId);if(Q.alreadyComplete){let j=await y$($,Q,$.manifest,!1);return await G0(J,"complete",{alreadyComplete:!0}),{status:"already-complete",plan:Q,verification:j.verification}}if(!Q.capacityAvailable&&!$.attemptUnavailable)return await G0(J,"waiting-capacity",{location:Q.location,targetType:Q.targetType.name}),{status:"waiting-capacity",plan:Q};let Y=$.manifest;if(W.status==="off"&&!$.resumeFromOff){let j=await y$($,Q,void 0,!0);return{status:"recovered",plan:Q,server:j.server,verification:j.verification,retryable:!0,error:"Server was already off without a resumable resize checkpoint; powered it back on."}}if(W.status==="running"){await G0(J,"preflight",{serverId:Q.serverId}),Y=await J?.preflight?.(W,Q.targetType),await G0(J,"shutting-down",{serverId:Q.serverId});let j=await z.shutdownServer(Q.serverId);await A1(z,j,$),W=await z.waitForServerStatus(Q.serverId,"off",{pollIntervalMs:$.serverPollIntervalMs,maxWaitMs:$.serverTimeoutMs})}try{await G0(J,"resizing",{serverId:Q.serverId,from:Q.currentType.name,to:Q.targetType.name,upgradeDisk:Z});let j=await z.changeServerType(Q.serverId,Q.targetType.name,Z);await A1(z,j,$)}catch(j){let G=await y$($,Q,Y,!0);return{status:"recovered",plan:Q,server:G.server,manifest:Y,verification:G.verification,retryable:Uz(j),error:j instanceof Error?j.message:String(j)}}let q=await y$($,Q,Y,!1);if(q.verification&&!q.verification.ok)throw Error(`Resize completed but verification failed: ${(q.verification.failures??[]).join("; ")}`);return await G0(J,"complete",{serverId:Q.serverId,targetType:Q.targetType.name}),{status:"completed",plan:Q,server:q.server,manifest:Y,verification:q.verification}}function R1($={}){let z=[];if($.identityFile)z.push("-i",$.identityFile);return z.push("-o","StrictHostKeyChecking=no","-o","UserKnownHostsFile=/dev/null","-o","LogLevel=ERROR","-o",`ConnectTimeout=${$.connectTimeoutSec??10}`),z}async function P$($,z,J={}){let Z=Bun.spawn(["ssh",...R1(J),`${J.user??"root"}@${$}`,z],{stdout:"pipe",stderr:"pipe"}),[Q,W]=await Promise.all([new Response(Z.stdout).text(),new Response(Z.stderr).text()]);return{code:await Z.exited,stdout:Q,stderr:W}}async function H0($,z,J={}){let Z=await P$($,z,J);if(Z.code!==0)throw Error(`ssh \`${z}\` on ${$} failed (${Z.code}): ${Z.stderr.trim()||Z.stdout.trim()}`);return Z.stdout}async function W8($,z,J,Z={}){let Q=Bun.spawn(["scp",...R1(Z),...z,`${Z.user??"root"}@${$}:${J}`],{stdout:"pipe",stderr:"pipe"}),W=await Q.exited;if(W!==0){let Y=await new Response(Q.stderr).text();throw Error(`scp to ${$}:${J} failed (${W}): ${Y.trim()}`)}}async function N1($,z={}){let J=z.timeoutMs??180000,Z=z.pollIntervalMs??5000,Q=Date.now();while(Date.now()-Q<J){let W=await P$($,"echo ready",z);if(W.code===0&&W.stdout.includes("ready"))return;await new Promise((Y)=>setTimeout(Y,Z))}throw Error(`SSH not ready on ${$} after ${J}ms`)}async function Y8($,z={}){let J=z.timeoutMs??300000,Z=z.pollIntervalMs??5000,Q=Date.now();while(Date.now()-Q<J){let W=await P$($,"cloud-init status 2>/dev/null || echo unknown",z);if(W.stdout.includes("status: done"))return;if(W.stdout.includes("status: error"))throw Error(`cloud-init reported an error on ${$}; check /var/log/cloud-init-output.log`);await new Promise((Y)=>setTimeout(Y,Z))}throw Error(`cloud-init did not finish on ${$} after ${J}ms`)}var q8=String.raw`
+const { readdir, readFile, readlink, stat } = await import('node:fs/promises')
+
+const text = (command) => {
+  const result = Bun.spawnSync(['bash', '-lc', command], { stdout: 'pipe', stderr: 'pipe' })
+  return result.exitCode === 0 ? result.stdout.toString().trim() : ''
+}
+const lines = (command) => text(command).split('\n').map(value => value.trim()).filter(Boolean).sort()
+const number = (value) => Number.parseInt(value || '0', 10) || 0
+
+const root = text('findmnt -n -o SOURCE,FSTYPE /').split(/\s+/)
+const rootSource = root[0] || ''
+const rootFsType = root[1] || ''
+const rootParent = text('lsblk -n -o PKNAME ' + rootSource + ' | head -1')
+const rootDiskBytes = number(text('lsblk -b -n -o SIZE /dev/' + rootParent + ' | head -1'))
+const rootFilesystemBytes = number(text("df -B1 --output=size / | tail -1"))
+const memoryBytes = number(text("awk '/MemTotal/{print $2 * 1024}' /proc/meminfo"))
+const allRunningServices = lines("systemctl list-units --type=service --state=running --no-legend --plain | awk '{print $1}'")
+const runningServices = allRunningServices.filter((unit) => {
+  if (/^(containerd|docker|localtunnel|mail|mysql|mariadb|meilisearch|postgresql|redis|rpx-gateway)\b/.test(unit)) return true
+  const source = text('systemctl cat ' + unit + ' 2>/dev/null')
+  return /\/var\/www|\/usr\/local\/bin\/rpx|\/opt\/ts-cloud/.test(source)
+})
+const failedUnits = lines("systemctl --failed --type=service --no-legend --plain | awk '{print $1}'")
+const releaseLinks = []
+for (const path of lines("find /var/www -mindepth 2 -maxdepth 2 -type l -name current -print 2>/dev/null")) {
+  try {
+    releaseLinks.push(path + '=' + await readlink(path))
+  } catch {}
+}
+releaseLinks.sort()
+
+const routeFragments = []
+const routeIds = []
+const routeDomains = new Set()
+for (const path of lines("find /etc/rpx/sites.d -maxdepth 1 -type f -name '*.json' -print 2>/dev/null")) {
+  try {
+    const source = await readFile(path, 'utf8')
+    const digest = new Bun.CryptoHasher('sha256').update(source).digest('hex')
+    routeFragments.push(path + '=' + digest)
+    const value = JSON.parse(source)
+    for (const route of value.proxies || []) {
+      if (typeof route.to === 'string' && route.to) {
+        routeDomains.add(route.to)
+        routeIds.push(path + ':' + (route.id || route.to) + ':' + (route.path || '/'))
+      }
+    }
+  } catch {}
+}
+routeFragments.sort()
+routeIds.sort()
+
+const persistentData = []
+for (const path of ['/var/lib/postgresql', '/var/lib/mysql', '/var/lib/redis', '/var/lib/docker', '/var/mail', '/var/vmail']) {
+  try {
+    const value = await stat(path)
+    if (value.isDirectory()) {
+      const bytes = number(text('du -sx --block-size=1 ' + path + " 2>/dev/null | awk '{print $1}'"))
+      persistentData.push(path + '=' + bytes)
+    }
+  } catch {}
+}
+
+const dataCatalog = []
+for (const database of lines("command -v psql >/dev/null && sudo -u postgres psql -Atqc 'select datname from pg_database where datistemplate = false order by datname' 2>/dev/null || true")) {
+  dataCatalog.push('postgres:' + database)
+}
+for (const database of lines("command -v mysql >/dev/null && mysql -NBe 'show databases' 2>/dev/null || true")) {
+  dataCatalog.push('mysql:' + database)
+}
+for (const volume of lines("command -v docker >/dev/null && docker volume ls --format '{{.Name}}' 2>/dev/null || true")) {
+  dataCatalog.push('docker-volume:' + volume)
+}
+
+console.log(JSON.stringify({
+  capturedAt: new Date().toISOString(),
+  hostname: text('hostname'),
+  cpuCores: number(text('nproc')),
+  memoryBytes,
+  rootSource,
+  rootFsType,
+  rootDiskBytes,
+  rootFilesystemBytes,
+  failedUnits,
+  runningServices,
+  releaseLinks,
+  routeFragments,
+  routeIds,
+  routeDomains: [...routeDomains].sort(),
+  persistentData: persistentData.sort(),
+  dataCatalog: dataCatalog.sort(),
+}))
+`;function j8($){return`printf %s ${Buffer.from($).toString("base64")} | base64 -d | bun -`}async function G8($){let z=await H0($.host,j8(q8),$);return JSON.parse(z)}async function H8($,z){let J="";for(let Z=1;Z<=3;Z++){let Q=Bun.spawn(["curl","--location","--silent","--show-error","--output","/dev/null","--max-time",String(Math.max(1,Math.ceil(z/1000))),"--write-out","%{http_code}",`https://${$}/`],{stdout:"pipe",stderr:"pipe"}),[W,Y,q]=await Promise.all([new Response(Q.stdout).text(),new Response(Q.stderr).text(),Q.exited]),j=Number.parseInt(W.trim(),10);if(q===0&&j>0)return{domain:$,ok:j<500,status:j};if(J=Y.trim()||`curl exited ${q}`,Z<3)await Bun.sleep(500*Z)}return{domain:$,ok:!1,error:J}}async function X8($,z){let J=[],Z=0,Q=Array.from({length:Math.min(4,$.length)},async()=>{for(;;){let W=Z++,Y=$[W];if(!Y)return;J[W]=await H8(Y,z)}});return await Promise.all(Q),J}async function E1($){let z=await G8($),J=await X8(z.routeDomains,$.routeTimeoutMs??15000);return{...z,routeProbes:J}}async function K8($){let z=await E1($),J=z.routeProbes.filter((Z)=>!Z.ok);if(z.failedUnits.length>0)throw Error(`Preflight found failed services: ${z.failedUnits.join(", ")}`);if(J.length>0)throw Error(`Preflight found unhealthy routes: ${J.map((Z)=>Z.domain).join(", ")}`);return await H0($.host,String.raw`systemctl list-units --type=service --state=running --no-legend --plain | awk '{print $1}' | while read -r unit; do if systemctl cat "$unit" 2>/dev/null | grep -Eq '/var/www|/usr/local/bin/rpx|/opt/ts-cloud'; then systemctl enable "$unit" >/dev/null 2>&1 || true; fi; done; systemctl daemon-reload; sync`,$),z}function l0($,z){let J=new Set(z);return $.filter((Z)=>!J.has(Z))}function V8($){return Math.floor(($.memory??0)*1024*1024*1024)}async function O8($){await H0($.host,String.raw`set -e
+root_source="$(findmnt -n -o SOURCE /)"
+root_fs="$(findmnt -n -o FSTYPE /)"
+parent="$(lsblk -n -o PKNAME "$root_source" | head -1)"
+partition="$(lsblk -n -o PARTN "$root_source" | head -1)"
+if [ -n "$parent" ] && [ -n "$partition" ]; then
+  growpart "/dev/$parent" "$partition" || true
+fi
+case "$root_fs" in
+  ext2|ext3|ext4) resize2fs "$root_source" ;;
+  xfs) xfs_growfs / ;;
+  *) echo "Unsupported root filesystem: $root_fs" >&2; exit 1 ;;
+esac`,$)}async function M8($,z){let J=Buffer.from(z.join(`
+`)).toString("base64");await H0($.host,`printf %s ${J} | base64 -d | while read -r unit; do [ -z "$unit" ] || systemctl is-active --quiet "$unit" || systemctl start "$unit"; done`,$)}async function F8($,z,J,Z={recovered:!1}){if(await N1($.host,{...$,timeoutMs:$.sshTimeoutMs??600000}),!Z.recovered)await O8($);if(J)await M8($,J.runningServices);let Q=await E1($),W=[],Y=J?l0(J.runningServices,Q.runningServices):[],q=J?l0(J.releaseLinks,Q.releaseLinks):[],j=J?l0(J.routeFragments,Q.routeFragments):[],G=J?l0(J.routeIds,Q.routeIds):[],K=J?.persistentData.map((x)=>x.split("=")[0])??[],V=Q.persistentData.map((x)=>x.split("=")[0]),H=l0(K,V),X=J?l0(J.dataCatalog,Q.dataCatalog):[],O=Q.routeProbes.filter((x)=>!x.ok),C=Z.recovered&&J?J.cpuCores:z.cores??0,U=Z.recovered&&J?J.memoryBytes:V8(z),F=Q.cpuCores>=C,B=Q.memoryBytes>=U*0.9,M=Z.recovered||Q.rootDiskBytes>=(z.disk??0)*1e9*0.95;if(Q.failedUnits.length>0)W.push(`Failed services: ${Q.failedUnits.join(", ")}`);if(Y.length>0)W.push(`Services did not return: ${Y.join(", ")}`);if(q.length>0)W.push(`Release links changed: ${q.join(", ")}`);if(j.length>0)W.push(`Route manifests changed: ${j.join(", ")}`);if(G.length>0)W.push(`Routes disappeared: ${G.join(", ")}`);if(H.length>0)W.push(`Persistent data paths disappeared: ${H.join(", ")}`);if(X.length>0)W.push(`Databases or volumes disappeared: ${X.join(", ")}`);if(O.length>0)W.push(`Unhealthy routes: ${O.map((x)=>x.domain).join(", ")}`);if(!F)W.push(`Expected at least ${C} CPU cores, found ${Q.cpuCores}`);if(!B)W.push(`Expected at least ${U} bytes of RAM`);if(!M)W.push(`Expected approximately ${z.disk??0} GB root disk`);return{ok:W.length===0,checks:{cpuCores:Q.cpuCores,memoryBytes:Q.memoryBytes,rootDiskBytes:Q.rootDiskBytes,rootFilesystemBytes:Q.rootFilesystemBytes,runningServices:Q.runningServices.length,releaseLinks:Q.releaseLinks.length,routeFragments:Q.routeFragments.length,routes:Q.routeIds.length,healthyRoutes:Q.routeProbes.filter((x)=>x.ok).length,persistentDataPaths:Q.persistentData.length,databasesAndVolumes:Q.dataCatalog.length,failedUnits:Q.failedUnits.length},failures:W}}function Cz($){return $.infrastructure?.compute??{}}function xz($){let z=Cz($),J=z.monitoring;return{firewallPorts:[...new Set([22,80,443,...z.firewall?.allowedPorts??[]])].filter((Q)=>Number.isInteger(Q)&&Q>=1&&Q<=65535).sort((Q,W)=>Q-W),monitoring:J!==!1&&(typeof J!=="object"||J.enabled!==!1),autoUpdates:z.autoUpdates!==!1,swapGb:Math.max(0,Math.floor(z.swapGb??2)),sshPasswordAuthentication:!1,journalMaxUse:"256M",journalRetention:"14day"}}function B8($){return["install -d -m 0755 /etc/ssh/sshd_config.d /etc/systemd/journald.conf.d /etc/sysctl.d /etc/fail2ban/jail.d","cat > /etc/ssh/sshd_config.d/99-ts-cloud-hardening.conf <<'TS_CLOUD_SSH_EOF'","# Managed by ts-cloud host optimization.","PasswordAuthentication no","KbdInteractiveAuthentication no","PermitRootLogin prohibit-password","MaxAuthTries 4","LoginGraceTime 30","TS_CLOUD_SSH_EOF","sshd -t","systemctl reload ssh","cat > /etc/systemd/journald.conf.d/99-ts-cloud-retention.conf <<'TS_CLOUD_JOURNAL_EOF'","[Journal]",`SystemMaxUse=${$.journalMaxUse}`,`MaxRetentionSec=${$.journalRetention}`,"Compress=yes","TS_CLOUD_JOURNAL_EOF","systemctl restart systemd-journald","journalctl --vacuum-size=256M --vacuum-time=14d >/dev/null","cat > /etc/sysctl.d/99-ts-cloud-production.conf <<'TS_CLOUD_SYSCTL_EOF'","# Managed by ts-cloud host optimization.","vm.swappiness=10","vm.dirty_background_ratio=5","vm.dirty_ratio=15","net.core.somaxconn=4096","net.ipv4.tcp_max_syn_backlog=4096","net.ipv4.tcp_fin_timeout=30","net.ipv4.tcp_keepalive_time=300","net.ipv4.tcp_keepalive_intvl=30","net.ipv4.tcp_keepalive_probes=5","fs.inotify.max_user_watches=524288","TS_CLOUD_SYSCTL_EOF","sysctl --system >/dev/null","export DEBIAN_FRONTEND=noninteractive","command -v fail2ban-client >/dev/null 2>&1 || apt-get install -y fail2ban","cat > /etc/fail2ban/jail.d/99-ts-cloud-sshd.conf <<'TS_CLOUD_FAIL2BAN_EOF'","[sshd]","enabled = true","backend = systemd","bantime = 1h","findtime = 10m","maxretry = 5","TS_CLOUD_FAIL2BAN_EOF","systemctl enable --now fail2ban","systemctl restart fail2ban"]}function U8($){if($===0)return[];return["if ! swapon --show=NAME --noheadings 2>/dev/null | grep -qx '/swapfile'; then",`  if [ ! -f /swapfile ]; then fallocate -l ${$}G /swapfile || dd if=/dev/zero of=/swapfile bs=1M count=${$*1024} status=none; fi`,"  chmod 600 /swapfile","  mkswap /swapfile >/dev/null","  swapon /swapfile","fi","grep -qE '^/swapfile\\s' /etc/fstab || echo '/swapfile none swap sw 0 0' >> /etc/fstab"]}function Lz($){let z=Cz($),J=xz($),Z=z.monitoring??!0,Q=z.firewall??{enabled:!0};return["set -euo pipefail",...t(z)?["systemctl disable --now nginx.service bun-gateway.service ts-cloud-nginx.service 2>/dev/null || true","systemctl reset-failed nginx.service bun-gateway.service ts-cloud-nginx.service 2>/dev/null || true"]:[],...U8(J.swapGb),...V0(J.autoUpdates),...O0(Z),...B8(J),...L$(Q),"systemctl daemon-reload","systemctl reset-failed"]}var C8=String.raw`
+const text = (command) => {
+  const result = Bun.spawnSync(['bash', '-lc', command], { stdout: 'pipe', stderr: 'pipe' })
+  return result.stdout.toString().trim()
+}
+const lines = command => text(command).split('\n').map(value => value.trim()).filter(Boolean)
+const number = value => Number.parseInt(value || '0', 10) || 0
+const ssh = Object.fromEntries(lines("sshd -T 2>/dev/null | grep -E '^(passwordauthentication|permitrootlogin) '").map(line => line.split(/\s+/, 2)))
+const firewallPorts = lines("ufw status 2>/dev/null | awk '/ALLOW/{print $1}'")
+  .flatMap(value => value.startsWith('OpenSSH') ? [22] : (value.match(/^\d+/) ? [number(value)] : []))
+const publicTcpPorts = lines("ss -lntH | awk '{print $4}'")
+  .filter(address => !address.startsWith('127.') && !address.startsWith('[::1]'))
+  .flatMap(address => {
+    const match = address.match(/:(\d+)$/)
+    return match ? [number(match[1])] : []
+  })
+const metricsMtime = number(text("stat -c %Y /var/lib/ts-cloud/metrics.json 2>/dev/null"))
+console.log(JSON.stringify({
+  firewallActive: text("ufw status 2>/dev/null | head -1").includes('active'),
+  firewallPorts: [...new Set(firewallPorts)].sort((a, b) => a - b),
+  passwordAuthentication: ssh.passwordauthentication !== 'no',
+  rootPasswordLogin: ssh.permitrootlogin === 'yes',
+  fail2banActive: text('systemctl is-active fail2ban 2>/dev/null') === 'active',
+  unattendedUpgradesActive: text('systemctl is-active unattended-upgrades 2>/dev/null') === 'active',
+  metricsTimerActive: text('systemctl is-active ts-cloud-metrics.timer 2>/dev/null') === 'active',
+  metricsSnapshotFresh: metricsMtime > 0 && Math.floor(Date.now() / 1000) - metricsMtime < 180,
+  swapBytes: number(text("free -b | awk '/^Swap:/{print $2}'")),
+  journalBytes: number(text("journalctl --disk-usage 2>/dev/null | grep -Eo '[0-9.]+[KMG]' | tail -1 | numfmt --from=iec 2>/dev/null")),
+  failedUnits: lines("systemctl --failed --type=service --no-legend --plain | awk '{print $1}'"),
+  publicTcpPorts: [...new Set(publicTcpPorts)].sort((a, b) => a - b),
+}))
+`;function x8($){return`printf %s ${Buffer.from($).toString("base64")} | base64 -d | bun -`}async function L8($,z){let J=Lz($).join(`
+`),Z=`printf %s ${Buffer.from(J).toString("base64")} | base64 -d | bash`;await H0(z.host,Z,z)}async function D8($){let z=await H0($.host,x8(C8),$);return JSON.parse(z)}function w8($,z){let J=[],Z=new Set(z.firewallPorts),Q=$.firewallPorts.filter((Y)=>!Z.has(Y)),W=z.firewallPorts.filter((Y)=>!$.firewallPorts.includes(Y));if(!z.firewallActive)J.push("UFW is not active");if(Q.length>0)J.push(`UFW is missing ports: ${Q.join(", ")}`);if(W.length>0)J.push(`UFW has unexpected ports: ${W.join(", ")}`);if(z.passwordAuthentication)J.push("SSH password authentication remains enabled");if(z.rootPasswordLogin)J.push("SSH root password login remains enabled");if(!z.fail2banActive)J.push("fail2ban is not active");if($.autoUpdates&&!z.unattendedUpgradesActive)J.push("unattended upgrades are not active");if($.monitoring&&!z.metricsTimerActive)J.push("metrics timer is not active");if($.monitoring&&!z.metricsSnapshotFresh)J.push("metrics snapshot is stale");if($.swapGb>0&&z.swapBytes<$.swapGb*1073741824*0.9)J.push("configured swap is missing");if(z.failedUnits.length>0)J.push(`failed services: ${z.failedUnits.join(", ")}`);return J}import{mkdir as I$,readFile as A8,rename as Dz,rmdir as R8,stat as N8,unlink as E8,writeFile as wz}from"node:fs/promises";import{join as p0}from"node:path";function k1($){return p0(process.cwd(),E0,`${$}-resize.json`)}function Az($){return p0(process.cwd(),E0,`${$}-resize.lock`)}async function k8($){try{return JSON.parse(await A8(k1($),"utf8"))}catch{return null}}async function _8($){let z=k1($.stackName);await I$(p0(process.cwd(),E0),{recursive:!0});let J=`${z}.${process.pid}.tmp`;await wz(J,`${JSON.stringify($,null,2)}
+`,"utf8"),await Dz(J,z)}async function T8($,z=1800000){let J=Az($);await I$(p0(process.cwd(),E0),{recursive:!0});try{await I$(J)}catch(Z){if(Date.now()-(await N8(J)).mtimeMs<=z)throw Error(`Another resize process holds ${J}.`);await Dz(J,`${J}.stale-${Date.now()}`),await I$(J)}return await wz(p0(J,"owner.json"),`${JSON.stringify({pid:process.pid,acquiredAt:new Date().toISOString()},null,2)}
+`,"utf8"),async()=>{await E8(p0(J,"owner.json")).catch(()=>{}),await R8(J).catch(()=>{})}}async function _1($,z){let J=R0(z.publicKey),Z=(await $.listSshKeys()).find((W)=>R0(W.public_key)===J);if(Z)return{id:Z.id,name:Z.name,created:!1};let Q=await $.createSshKey({name:z.name,publicKey:z.publicKey.trim(),labels:z.labels});return{id:Q.id,name:Q.name,created:!0}}async function T1($,z){let J=(await $.listFirewalls()).find((Q)=>Q.name===z.name);if(J)return await $.setFirewallRules(J.id,z.rules),{id:J.id,name:J.name,created:!1};let{firewall:Z}=await $.createFirewall({name:z.name,rules:z.rules,labels:z.labels});return{id:Z.id,name:Z.name,created:!0}}async function y1($,z){let{waitForRunning:J=!0,...Z}=z,Q=(await $.listServers()).find((Y)=>Y.name===z.name),W=!Q;if(!Q)Q=(await $.createServer(Z)).server;if(J)Q=await $.waitForServerRunning(Q.id);return{server:Q,created:W}}function P1($){let z=$.public_net.ipv4?.ip;if(!z)throw Error(`Hetzner server "${$.name}" (#${$.id}) has no public IPv4`);return z}var I1="/aws/service/canonical/ubuntu/server/24.04/stable/current/amd64/hvm/ebs-gp3/ami-id";function S1($){let z=$.sshPublicKey.trim(),J=["#cloud-config","disable_root: false","ssh_authorized_keys:",`  - ${z}`];if($.bootstrapScript){let Q=$.bootstrapScript.split(`
+`).map((W)=>`      ${W}`).join(`
+`);J.push("write_files:","  - path: /var/lib/cloud/box-bootstrap.sh","    permissions: '0755'","    owner: root:root","    content: |",Q)}if(J.push("runcmd:",`  - mkdir -p /root/.ssh && grep -qF "${z}" /root/.ssh/authorized_keys 2>/dev/null || echo "${z}" >> /root/.ssh/authorized_keys`),$.bootstrapScript)J.push("  - [ bash, /var/lib/cloud/box-bootstrap.sh ]");return`${J.join(`
+`)}
+`}function y8($=[]){let z=[{direction:"in",protocol:"tcp",port:"22",source_ips:["0.0.0.0/0","::/0"],description:"SSH"}];for(let J of $)z.push({direction:"in",protocol:J.protocol,...J.protocol==="icmp"?{}:{port:String(J.port)},source_ips:["0.0.0.0/0","::/0"]});return z}class f1{client;provider="hetzner";constructor($){this.client=$}async ensureBox($){let z=await _1(this.client,{name:`${$.name}-key`,publicKey:$.sshPublicKey}),J=await T1(this.client,{name:`${$.name}-fw`,rules:y8($.ports)}),{server:Z,created:Q}=await y1(this.client,{name:$.name,serverType:$.size,image:$.image??"ubuntu-24.04",location:$.location,sshKeys:[z.id],firewalls:[{firewall:J.id}],userData:S1($),labels:$.labels});return{provider:"hetzner",id:String(Z.id),name:Z.name,publicIp:P1(Z),created:Q}}async destroyBox($){let z=[],J=(await this.client.listServers()).find((Q)=>Q.name===$);if(J){let Q=await this.client.deleteServer(J.id);await this.client.waitForAction(Q.id).catch(()=>{}),z.push(`server ${$} (#${J.id})`)}let Z=(await this.client.listFirewalls()).find((Q)=>Q.name===`${$}-fw`);if(Z)for(let Q=0;Q<10;Q++)try{await this.client.deleteFirewall(Z.id),z.push(`firewall ${$}-fw (#${Z.id})`);break}catch{if(Q===9)break;await new Promise((W)=>setTimeout(W,3000))}return{destroyed:z}}}function P8($=[]){let z=[{IpProtocol:"tcp",FromPort:22,ToPort:22,IpRanges:[{CidrIp:"0.0.0.0/0",Description:"SSH"}]}];for(let J of $)z.push(J.protocol==="icmp"?{IpProtocol:"icmp",FromPort:-1,ToPort:-1,IpRanges:[{CidrIp:"0.0.0.0/0"}]}:{IpProtocol:J.protocol,FromPort:J.port,ToPort:J.port,IpRanges:[{CidrIp:"0.0.0.0/0"}]});return z}class b1{provider="aws";ec2;ssm;constructor($){this.ec2=$.ec2,this.ssm=$.ssm}async findInstance($,z){return(await this.ec2.describeInstances({Filters:[{Name:"tag:Name",Values:[$]},{Name:"instance-state-name",Values:z}]})).Reservations?.flatMap((Z)=>Z.Instances??[])[0]}async waitForPublicIp($,z=300000){let J=Date.now();while(Date.now()-J<z){let Z=await this.ec2.getInstance($);if(Z?.State?.Name==="running"&&Z.PublicIpAddress)return Z;await new Promise((Q)=>setTimeout(Q,5000))}throw Error(`EC2 instance ${$} did not reach running with a public IP within ${z}ms`)}async ensureSecurityGroup($){let z=`${$.name}-sg`,Z=(await this.ec2.describeSecurityGroups({Filters:[{Name:"group-name",Values:[z]}]})).SecurityGroups?.[0]?.GroupId;if(Z)return Z;let Q=await this.ec2.createSecurityGroup({GroupName:z,Description:`box ${$.name} (managed by ts-cloud box-provision)`});if(!Q.GroupId)throw Error(`could not create security group ${z}`);return await this.ec2.authorizeSecurityGroupIngress({GroupId:Q.GroupId,IpPermissions:P8($.ports)}),Q.GroupId}async resolveImage($){if($.image?.startsWith("ami-"))return $.image;let J=(await this.ssm.getParameter({Name:I1})).Parameter?.Value;if(!J)throw Error(`could not resolve the Ubuntu 24.04 AMI via SSM (${I1})`);return J}async ensureBox($){let z=await this.findInstance($.name,["pending","running"]);if(z?.InstanceId){let j=await this.waitForPublicIp(z.InstanceId);return{provider:"aws",id:j.InstanceId,name:$.name,publicIp:j.PublicIpAddress,created:!1}}let[J,Z]=await Promise.all([this.ensureSecurityGroup($),this.resolveImage($)]),Q=[{Key:"Name",Value:$.name},...Object.entries($.labels??{}).map(([j,G])=>({Key:j,Value:G}))],Y=(await this.ec2.runInstances({ImageId:Z,InstanceType:$.size,MinCount:1,MaxCount:1,SecurityGroupIds:[J],UserData:Buffer.from(S1($),"utf8").toString("base64"),TagSpecifications:[{ResourceType:"instance",Tags:Q}]})).Instances?.[0]?.InstanceId;if(!Y)throw Error(`RunInstances returned no instance for box ${$.name}`);let q=await this.waitForPublicIp(Y);return{provider:"aws",id:Y,name:$.name,publicIp:q.PublicIpAddress,created:!0}}async destroyBox($){let z=[],J=await this.findInstance($,["pending","running","stopping","stopped"]);if(J?.InstanceId){await this.ec2.terminateInstances([J.InstanceId]),z.push(`instance ${$} (${J.InstanceId})`);let W=Date.now();while(Date.now()-W<300000){let Y=await this.ec2.getInstance(J.InstanceId);if(!Y||Y.State?.Name==="terminated")break;await new Promise((q)=>setTimeout(q,5000))}}let Q=(await this.ec2.describeSecurityGroups({Filters:[{Name:"group-name",Values:[`${$}-sg`]}]})).SecurityGroups?.[0]?.GroupId;if(Q)for(let W=0;W<10;W++)try{await this.ec2.deleteSecurityGroup(Q),z.push(`security group ${$}-sg (${Q})`);break}catch{if(W===9)break;await new Promise((Y)=>setTimeout(Y,3000))}return{destroyed:z}}}function I8($){if($.provider==="hetzner"){if(!$.hetzner)throw Error('createBoxProvisioner: options.hetzner (a HetznerClient) is required for provider "hetzner"');return new f1($.hetzner)}if(!$.aws)throw Error('createBoxProvisioner: options.aws ({ ec2, ssm }) is required for provider "aws"');return new b1($.aws)}function S$($){return Object.entries($).map(([z,J])=>`${z}=${S8(String(J))}`).join(`
+`)}function S8($){return`"${$.replace(/\\/g,"\\\\").replace(/"/g,"\\\"").replace(/\n/g,"\\n").replace(/\r/g,"\\r").replace(/\t/g,"\\t")}"`}var f$=["storage",".env"],Y$=4;function T0($){return`${$.replace(/\/+$/,"")}/.ts-cloud`}function f8($){return`${T0($)}/deploy-history.log`}function b8($,z){return`${T0($)}/deploys/${z}.log`}function Nz($){return`${T0($)}/shared-paths`}function q$($,z){let J=$.replace(/\/+$/,"");return{base:J,releases:`${J}/releases`,shared:`${J}/shared`,current:`${J}/current`,release:`${J}/releases/${z}`}}function Ez($){let z=$.split("/").pop()||$;if(z===".env"||z.startsWith(".env."))return!0;return/\.[a-z0-9]+$/i.test(z)}function h1($){return typeof $==="string"?$:$.path}function kz($){let z=new Map;for(let J of $)z.set(h1(J),J);return[...z.values()]}function _z($,z){if(typeof z==="string")return{path:z,target:`${$.shared}/${z}`,seed:!0};return{path:z.path,target:z.target??`${$.shared}/${z.path}`,seed:z.seed!==!1}}function h8($){return["ts_cloud_adopt_shared() {",'  TS_CLOUD_SP="$1"','  TS_CLOUD_DST="$2"',`  TS_CLOUD_SRC="${$.current}/$TS_CLOUD_SP"`,'  if [ -e "$TS_CLOUD_DST" ]; then return 0; fi','  if [ -L "$TS_CLOUD_SRC" ] || [ ! -e "$TS_CLOUD_SRC" ]; then return 0; fi','  mkdir -p "$(dirname "$TS_CLOUD_DST")"','  cp -a "$TS_CLOUD_SRC" "$TS_CLOUD_DST"',"  for TS_CLOUD_SIDECAR in -wal -shm; do",'    if [ -f "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" ]; then cp -a "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" "$TS_CLOUD_DST$TS_CLOUD_SIDECAR"; fi',"  done",'  echo "[ts-cloud] adopted $TS_CLOUD_SP from the live release into shared/ — it now survives deploys"',"  return 0","}"]}function j$($,z=f$){let J=[`mkdir -p ${$.releases} ${$.shared}`,...h8($)],Z=z.map((W)=>_z($,W));for(let{path:W,target:Y,seed:q}of Z){if(!q)continue;if(J.push(`ts_cloud_adopt_shared '${W}' '${Y}'`),Ez(W))J.push(`mkdir -p "$(dirname ${Y})"`,`touch ${Y}`);else if(W==="storage")J.push(`mkdir -p ${Y}/app/public`,`mkdir -p ${Y}/framework/cache/data`,`mkdir -p ${Y}/framework/sessions`,`mkdir -p ${Y}/framework/testing`,`mkdir -p ${Y}/framework/views`,`mkdir -p ${Y}/logs`);else J.push(`mkdir -p ${Y}`)}let Q=Nz($.base);return J.push(`mkdir -p ${T0($.base)}`,`cat > ${Q} <<'TS_CLOUD_SHARED_PATHS_EOF'`,...Z.map((W)=>`${W.path}	${W.target}`),"TS_CLOUD_SHARED_PATHS_EOF"),J}function v1($,z=900){let J=`${T0($.base)}/deploy.lock`;return[`mkdir -p "$(dirname ${J})"`,`exec 9>${J}`,`flock -w ${z} 9 || { echo "[ts-cloud] another deploy of this site has held the lock for ${z}s — refusing to race it" >&2; exit 1; }`]}function u1($){let z=`${$.release}.incoming`;return[`rm -rf ${z}`,`mkdir -p ${z}`,...v8($),'if [ "$TS_CLOUD_IS_LIVE" = "yes" ]; then',`  TS_CLOUD_STAGED=${z}`,"else",`  rm -rf ${$.release}`,`  mkdir -p ${$.release}`,`  rmdir ${z}`,`  TS_CLOUD_STAGED=${$.release}`,"fi"]}function m1($){let z=`TS_CLOUD_TRAP_LIVE="$(readlink -f ${$.current} 2>/dev/null || true)"`,J=`TS_CLOUD_TRAP_TARGET="$(readlink -f ${$.release} 2>/dev/null || echo ${$.release})"`;return`trap '${`if [ $? -ne 0 ]; then ${z}; ${J}; [ "$TS_CLOUD_TRAP_LIVE" = "$TS_CLOUD_TRAP_TARGET" ] || rm -rf ${$.release}; fi`}' EXIT`}function v8($){return[`TS_CLOUD_LIVE_PATH="$(readlink -f ${$.current} 2>/dev/null || true)"`,`TS_CLOUD_RELEASE_PATH="$(readlink -f ${$.release} 2>/dev/null || echo ${$.release})"`,'if [ -n "$TS_CLOUD_LIVE_PATH" ] && [ "$TS_CLOUD_LIVE_PATH" = "$TS_CLOUD_RELEASE_PATH" ]; then TS_CLOUD_IS_LIVE=yes; else TS_CLOUD_IS_LIVE=no; fi']}function g1($){let z=`${$.release}.incoming`;return[`if [ "$TS_CLOUD_STAGED" = "${z}" ]; then`,`  rm -rf ${$.release}.previous`,`  mv ${$.release} ${$.release}.previous`,`  mv ${z} ${$.release}`,`  rm -rf ${$.release}.previous`,"fi"]}function u8($,z){return[`if [ -f ${$} ] && [ ! -L ${$} ] && [ -s ${$} ] && [ ! -s ${z} ]; then`,`  cp -a ${$} ${z}`,`  echo "[ts-cloud] seeded shared/ from the release's own copy of the file"`,"fi"]}function b$($,z=f$){let J=[];for(let Z of z){let{path:Q,target:W,seed:Y}=_z($,Z),q=`${$.release}/${Q}`,j=[`rm -rf ${q}`,`mkdir -p "$(dirname ${q})"`,`ln -sfn ${W} ${q}`];if(Y){if(Q!==".env"&&Ez(Q))J.push(...u8(q,W));J.push(...j);continue}J.push(`if [ -e ${W} ]; then`,...j.map((G)=>`  ${G}`),"fi")}return J}function Rz($,z){let J=Nz($.base);return[`if [ -f ${J} ]; then`,'  while IFS="\t" read -r TS_CLOUD_SP TS_CLOUD_TGT; do','    [ -n "$TS_CLOUD_SP" ] || continue',`    [ -n "$TS_CLOUD_TGT" ] || TS_CLOUD_TGT="${$.shared}/$TS_CLOUD_SP"`,'    [ -e "$TS_CLOUD_TGT" ] || continue',`    rm -rf ${z}/"$TS_CLOUD_SP"`,`    mkdir -p "$(dirname ${z}/"$TS_CLOUD_SP")"`,`    ln -sfn "$TS_CLOUD_TGT" ${z}/"$TS_CLOUD_SP"`,`  done < ${J}`,"fi"]}function r0($){return[`ln -sfn ${$.release} ${$.current}.tmp`,`mv -Tf ${$.current}.tmp ${$.current}`]}function NZ($,z={}){let J=z.to?[`[ -d ${$.releases}/${z.to} ] || { echo "rollback target ${$.releases}/${z.to} not found" >&2; exit 1; }`,...Rz($,`${$.releases}/${z.to}`),`ln -sfn ${$.releases}/${z.to} ${$.current}.tmp`,`mv -Tf ${$.current}.tmp ${$.current}`]:[`TS_CLOUD_CURRENT=$(readlink -f ${$.current} 2>/dev/null || true)`,`TS_CLOUD_PREV=$(ls -1dt ${$.releases}/*/ 2>/dev/null | sed 's#/$##' | while read -r r; do [ "$(readlink -f "$r")" != "$TS_CLOUD_CURRENT" ] && { echo "$r"; break; }; done)`,'[ -n "$TS_CLOUD_PREV" ] || { echo "no previous release to roll back to" >&2; exit 1; }',...Rz($,'"$TS_CLOUD_PREV"'),`ln -sfn "$TS_CLOUD_PREV" ${$.current}.tmp`,`mv -Tf ${$.current}.tmp ${$.current}`,'echo "rolled back to $TS_CLOUD_PREV"'];if(!z.unitBase)return J;let Z=z.unitBase;return[...J,`TS_CLOUD_RB_ID=$(basename "$(readlink -f ${$.current})")`,`if [ -f /etc/systemd/system/${Z}@.service ]; then systemctl start "${Z}@\${TS_CLOUD_RB_ID}.service"; sleep 2; systemctl is-active --quiet "${Z}@\${TS_CLOUD_RB_ID}.service" || { echo "rolled-back release failed to start" >&2; exit 1; }; systemctl enable "${Z}@\${TS_CLOUD_RB_ID}.service" 2>/dev/null || true; systemctl list-units --plain --no-legend --type=service "${Z}@*.service" 2>/dev/null | awk '{print $1}' | { grep -v "^${Z}@\${TS_CLOUD_RB_ID}.service$" || true; } | while read -r TS_CLOUD_U; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done; elif [ -f /etc/systemd/system/${Z}.service ]; then systemctl restart ${Z}.service; fi`]}function a0($,z=4){let J=Math.max(1,z);return[`TS_CLOUD_CURRENT=$(readlink -f ${$.current} 2>/dev/null || true)`,`ls -1dt ${$.releases}/*/ 2>/dev/null | sed 's#/$##' | tail -n +${J+1} | while read -r TS_CLOUD_OLD; do`,'  [ "$(readlink -f "$TS_CLOUD_OLD")" = "$TS_CLOUD_CURRENT" ] || rm -rf "$TS_CLOUD_OLD"',"done"]}function m8($){return`${T0($)}/owner`}function d1($,z){let J=m8($);return[`if [ -f "${J}" ]; then`,`  TS_CLOUD_OWNER=$(cat "${J}")`,`  if [ "$TS_CLOUD_OWNER" != "${z}" ]; then`,`    echo "[ts-cloud] REFUSING deploy: ${$} belongs to project '$TS_CLOUD_OWNER', not '${z}'. Another project on this box derives the same site key — give one of them a distinct site name/domain, or remove ${J} to transfer ownership." >&2`,"    exit 1","  fi","else",`  mkdir -p "$(dirname "${J}")"`,`  printf '%s\\n' "${z}" > "${J}"`,"fi"]}function h$($,z){let J=T0($),Z=b8($,z.releaseId),Q=f8($),W=Math.max(1,z.keepLogs??20),Y=z.commit||"",q=z.branch||"";return[`mkdir -p ${J}/deploys`,`exec > >(tee -a ${Z}) 2>&1`,`echo "[ts-cloud] deploy ${z.releaseId} commit=${Y} branch=${q} starting $(date -u +%Y-%m-%dT%H:%M:%SZ)"`,"ts_cloud_record_deploy() {","  TS_CLOUD_RC=$?",'  if [ "$TS_CLOUD_RC" -eq 0 ]; then TS_CLOUD_ST=success; else TS_CLOUD_ST=failed; fi',`  printf '%s\\t%s\\t%s\\t%s\\trc=%s\\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "${z.releaseId}" "${Y}" "$TS_CLOUD_ST" "$TS_CLOUD_RC" >> ${Q}`,"}","trap ts_cloud_record_deploy EXIT",`ls -1t ${J}/deploys/*.log 2>/dev/null | tail -n +${W+1} | while read -r TS_CLOUD_OLDLOG; do rm -f "$TS_CLOUD_OLDLOG"; done`]}var g8=new Set(["sqlite","sqlite3"]),d8=new Set([":memory:","memory"]);function c8($){let z=$?.DB_CONNECTION?.trim().toLowerCase();return z!=null&&g8.has(z)}function l8($){let z=$.trim().replace(/^\.\//,"");if(z===""||z.startsWith("/")||z.startsWith("~"))return;if(z.split("/").includes(".."))return;return z.replace(/\/+$/,"")}function c1($,z=[]){if(!c8($))return{};let J=$?.DB_DATABASE?.trim();if(J&&d8.has(J.toLowerCase()))return{};if(!J)return{warning:"DB_CONNECTION is sqlite but DB_DATABASE names no file, so ts-cloud cannot tell where the database lives. If it is written inside the release directory, the next deploy discards it. Set DB_DATABASE, or list the file in the site's `sharedPaths`."};let Z=l8(J);if(!Z)return{};if(z.some((Q)=>h1(Q)===Z))return{};return{path:Z}}function v$($,z=[]){let{path:J}=c1($,z);return J?[J]:[]}function l1($,z){let J=z==="bun"?"/usr/local/bin/bun":z==="deno"?"/usr/local/bin/deno":"/usr/local/bin/node",Z=$.replace(/^(bun|node|deno)\s+/,"");return`${J} ${Z}`}function Tz($){let{unitBase:z,unitPattern:J,port:Z}=$,Q=$.path&&$.path.startsWith("/")?$.path:"/",W=Math.max(10,$.intervalSeconds??60),Y=Math.max(1,$.failuresBeforeRestart??3),q=`/usr/local/sbin/${z}-liveness`,G=J.includes("@*")?`TS_CLOUD_UNIT=$(systemctl list-units --plain --no-legend --type=service '${J}' 2>/dev/null | awk '{print $1}' | head -1)`:`TS_CLOUD_UNIT=${J}`;return[`cat > ${q} <<'TS_CLOUD_LIVENESS_EOF'`,"#!/bin/sh","set -eu",`exec 9>/run/${z}-liveness.lock`,"flock -n 9 || exit 0",G,'[ -n "$TS_CLOUD_UNIT" ] || exit 0','systemctl is-active --quiet "$TS_CLOUD_UNIT" || exit 0',`if curl -s -o /dev/null --max-time 5 "http://127.0.0.1:${Z}${Q}"; then`,`  rm -f /run/${z}-liveness.fail`,"  exit 0","fi",`TS_CLOUD_FAILS=$(cat /run/${z}-liveness.fail 2>/dev/null || echo 0)`,"TS_CLOUD_FAILS=$((TS_CLOUD_FAILS + 1))",`echo "$TS_CLOUD_FAILS" > /run/${z}-liveness.fail`,`[ "$TS_CLOUD_FAILS" -ge ${Y} ] || exit 0`,`logger -t ${z}-liveness "no HTTP response on 127.0.0.1:${Z}${Q} after $TS_CLOUD_FAILS checks; restarting $TS_CLOUD_UNIT"`,'systemctl restart "$TS_CLOUD_UNIT"',`rm -f /run/${z}-liveness.fail`,"TS_CLOUD_LIVENESS_EOF",`chmod +x ${q}`,`cat > /etc/systemd/system/${z}-liveness.service <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=Liveness check for ${z} (managed by ts-cloud)`,"","[Service]","Type=oneshot",`ExecStart=${q}`,"TS_CLOUD_UNIT_EOF",`cat > /etc/systemd/system/${z}-liveness.timer <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=Run the ${z} liveness check every ${W}s`,"","[Timer]",`OnUnitActiveSec=${W}s`,`OnBootSec=${W}s`,"Persistent=true","","[Install]","WantedBy=timers.target","TS_CLOUD_UNIT_EOF","systemctl daemon-reload",`systemctl enable --now ${z}-liveness.timer >/dev/null 2>&1 || true`]}function p1($){let{siteName:z,slug:J,artifactFetch:Z,releaseId:Q,execStart:W,envEntries:Y,port:q,keepReleases:j=Y$,preStartCommands:G=[],healthCheckPath:K,healthGateSeconds:V=5,liveness:H,memoryHigh:X="2G",memoryMax:O,cpuWeight:C,ioWeight:U,tasksMax:F,stopTimeout:B}=$,M=[...C!=null?[`CPUWeight=${C}`]:[],...U!=null?[`IOWeight=${U}`]:[],...F!=null?[`TasksMax=${F}`]:[],...B?[`TimeoutStopSec=${B}`]:[]],x=$.zeroDowntime??q!=null,A=$.appDir??`/var/www/${z}`,L=q$(A,Q),D=`${J}-${z}`,N=`${D}.service`,r=G$(J,z,Q),_=$.sharedPaths??[],h=kz([".env",..._,...v$(Y,_)]),v=S$(Y),T=G.length>0?[`cd ${L.release}`,...G]:[],g=["set -euo pipefail",...v1(L),m1(L),...Z,...j$(L,h),...u1(L),`tar xzf ${r} -C "$TS_CLOUD_STAGED"`,`rm -f ${r}`,`cat > ${L.shared}/.env <<'TS_CLOUD_ENV_EOF'`,v,"TS_CLOUD_ENV_EOF",`chmod 600 ${L.shared}/.env`,...g1(L),`find ${L.release} -maxdepth 1 \\( -type f -o -type l \\) -name '.env*' ! -name '.env.example' ! -name '*.example' -delete`,`sed -i -E '/^[[:space:]]*(PORT|PORT_BACKEND|PORT_ADMIN|PORT_FRONTEND)[[:space:]]*=/d' ${L.shared}/.env 2>/dev/null || true`,...b$(L,h),...T];if(x&&q!=null){let E=`${D}@${Q}.service`,W0=K?K.startsWith("/")?K:`/${K}`:null,u=`{ echo "[ts-cloud] release ${Q} failed its health gate — previous release keeps serving" >&2; journalctl -u ${E} -n 50 --no-pager >&2 || true; systemctl stop ${E} 2>/dev/null || true; exit 1; }`;return[...g,`cat > /etc/systemd/system/${D}@.service <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=${z} release %i (managed by ts-cloud)`,"After=network.target","","[Service]","Type=simple",`WorkingDirectory=${L.releases}/%i`,`ExecStart=${W}`,"Restart=always","RestartSec=5","MemoryAccounting=true",...X?[`MemoryHigh=${X}`]:[],...O?[`MemoryMax=${O}`]:[],...M,`EnvironmentFile=${L.releases}/%i/.env`,`Environment=PORT=${q}`,"","[Install]","WantedBy=multi-user.target","TS_CLOUD_UNIT_EOF","systemctl daemon-reload",`TS_CLOUD_OLD_UNITS=$(systemctl list-units --plain --no-legend --type=service "${D}@*.service" 2>/dev/null | awk '{print $1}' | grep -v "^${E}$" || true)`,`if [ -f /etc/systemd/system/${N} ] && systemctl is-active --quiet ${N}; then echo "[ts-cloud] retiring pre-zero-downtime unit ${N} (one-time restart cutover)"; systemctl stop ${N}; fi`,`systemctl restart ${E}`,`TS_CLOUD_GATE_OK=1; for TS_CLOUD_I in $(seq 1 ${Math.max(1,V)}); do sleep 1; systemctl is-active --quiet ${E} || { TS_CLOUD_GATE_OK=0; break; }; done`,`if [ "$TS_CLOUD_GATE_OK" -ne 1 ]; then echo "[ts-cloud] release ${Q} could not overlap the previous release (no SO_REUSEPORT?) — retiring old instances and retrying" >&2; for TS_CLOUD_RU in \${TS_CLOUD_OLD_UNITS}; do systemctl stop "$TS_CLOUD_RU" 2>/dev/null || true; done; systemctl restart ${E}; for TS_CLOUD_I in $(seq 1 ${Math.max(1,V)}); do sleep 1; systemctl is-active --quiet ${E} || ${u}; done; fi`,...W0?[`curl -sf -o /dev/null --max-time 10 "http://127.0.0.1:${q}${W0}" || ${u}`]:[],...r0(L),`systemctl enable ${E} 2>/dev/null || true`,'for TS_CLOUD_U in ${TS_CLOUD_OLD_UNITS}; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done',`TS_CLOUD_LISTENING=0; for TS_CLOUD_I in $(seq 1 ${Math.max(1,V)}); do if ss -ltnH "sport = :${q}" 2>/dev/null | grep -q .; then TS_CLOUD_LISTENING=1; break; fi; sleep 1; done`,`if [ "$TS_CLOUD_LISTENING" -ne 1 ]; then echo "[ts-cloud] nothing is listening on ${q} after retiring the previous release — restarting ${E} on the now-free port" >&2; systemctl restart ${E}; for TS_CLOUD_I in $(seq 1 ${Math.max(1,V)}); do if ss -ltnH "sport = :${q}" 2>/dev/null | grep -q .; then TS_CLOUD_LISTENING=1; break; fi; sleep 1; done; fi`,`if [ "$TS_CLOUD_LISTENING" -ne 1 ]; then echo "[ts-cloud] ${E} is active but never bound ${q}" >&2; journalctl -u ${E} -n 50 --no-pager >&2 || true; exit 1; fi`,`systemctl list-unit-files --plain --no-legend "${D}@*.service" 2>/dev/null | awk '{print $1}' | { grep -v -e "^${E}$" -e "^${D}@\\.service$" || true; } | while read -r TS_CLOUD_U; do systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done`,`if [ -f /etc/systemd/system/${N} ]; then systemctl disable ${N} 2>/dev/null || true; rm -f /etc/systemd/system/${N}; systemctl daemon-reload; fi`,...a0(L,j),...H===!1?[]:Tz({unitBase:D,unitPattern:`${D}@*.service`,port:q,path:H?.path??K,intervalSeconds:H?.intervalSeconds,failuresBeforeRestart:H?.failuresBeforeRestart})]}return[...g,`cat > /etc/systemd/system/${N} <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=${z} (managed by ts-cloud)`,"After=network.target","","[Service]","Type=simple",`WorkingDirectory=${L.current}`,`ExecStart=${W}`,"Restart=always","RestartSec=5","MemoryAccounting=true",...X?[`MemoryHigh=${X}`]:[],...O?[`MemoryMax=${O}`]:[],...M,`EnvironmentFile=${L.current}/.env`,...q?[`Environment=PORT=${q}`]:[],"","[Install]","WantedBy=multi-user.target","TS_CLOUD_UNIT_EOF","systemctl daemon-reload",`systemctl enable ${N}`,...r0(L),`systemctl restart ${N}`,`systemctl is-active ${N}`,...a0(L,j),...H===!1||!q?[]:Tz({unitBase:D,unitPattern:N,port:q,path:H?.path??K,intervalSeconds:H?.intervalSeconds,failuresBeforeRestart:H?.failuresBeforeRestart})]}function r1($){let{siteName:z,artifactFetch:J,releaseId:Z,keepReleases:Q=Y$,preStartCommands:W=[]}=$,Y=$.appDir??`/var/www/${z}`,q=q$(Y,Z),j=G$($.slug,z,Z),G=W.length>0?[`cd ${q.release}`,...W]:[];return["set -euo pipefail",...v1(q),m1(q),...J,...j$(q,[]),...u1(q),`tar xzf ${j} -C "$TS_CLOUD_STAGED"`,...g1(q),`rm -f ${j}`,...G,...r0(q),...a0(q,Q)]}function G$($,z,J){return`/tmp/${[$,z,J].filter(Boolean).join("-")}-release.tar.gz`}function a1($,z,J,Z){return[`aws s3 cp "s3://${$}/${z}" ${Z} --region ${J}`]}function n1($,z){return[`mv "${$}" ${z}`]}function i1(){return['echo "[ts-cloud] host cleanup (disk before): $(df -h / | tail -1)"',"find /var/ts-cloud/staging -xdev -maxdepth 1 -type f -mmin +60 -delete 2>/dev/null || true",'find /tmp -xdev -maxdepth 1 -type f -name "*-release.tar.gz" -mmin +60 -delete 2>/dev/null || true',"find /root/.bun/install/cache -xdev -type f -mtime +7 -delete 2>/dev/null || true","find /root/.bun/install/cache -xdev -depth -type d -empty -delete 2>/dev/null || true","journalctl --vacuum-time=14d --vacuum-size=512M >/dev/null 2>&1 || true",'if command -v docker >/dev/null 2>&1; then docker image prune --all --force --filter "until=168h" >/dev/null 2>&1 || true; fi','if command -v podman >/dev/null 2>&1; then podman image prune --all --force --filter "until=168h" >/dev/null 2>&1 || true; fi',"if command -v apt-get >/dev/null 2>&1; then apt-get clean >/dev/null 2>&1 || true; fi",'echo "[ts-cloud] host cleanup (disk after): $(df -h / | tail -1)"']}import{copyFileSync as _9}from"node:fs";import{tmpdir as T9}from"node:os";import{join as y9}from"node:path";var p8=`${I}/project`;function yz($,z){let J=z.ownerSlug.trim(),Z=z.selfSlug?.trim(),Q={total:$.length,owner:[],self:[],others:new Map,unmanaged:[]};for(let W of $){let Y=W.labels?.[p8]?.trim();if(!Y){Q.unmanaged.push(W.name);continue}if(Y===J){Q.owner.push(W.name);continue}if(Z&&Y===Z){Q.self.push(W.name);continue}let q=Q.others.get(Y);if(q)q.push(W.name);else Q.others.set(Y,[W.name])}return Q}function o1($){let z=$.unmanaged.length;for(let J of $.others.values())z+=J.length;return z}function Pz($,z){let J=o1($),Z=[];if(Z.push(`Attaching to '${z.ownerSlug}' shares one provider project, so this deploy's credential can write to all ${$.total} server(s) it can see.`),J===0)return Z.push("Nothing outside the two projects being joined is reachable with it."),Z;Z.push(`${J} of them belong to neither project:`);for(let Q of[...$.others.keys()].sort())Z.push(`  ${Q}: ${[...$.others.get(Q)].sort().join(", ")}`);if($.unmanaged.length>0)Z.push(`  not managed by ts-cloud: ${[...$.unmanaged].sort().join(", ")}`);return Z.push("A compromised CI run or a mistargeted teardown in this project now reaches those. Keep the app in its own provider project instead if that is not acceptable, which rules out attaching."),Z}import{execSync as Sz}from"node:child_process";import{randomBytes as a8}from"node:crypto";import{chmodSync as n8,copyFileSync as i8,existsSync as y0,mkdirSync as bz,readFileSync as hz,statSync as o8,writeFileSync as e1}from"node:fs";import{tmpdir as t8}from"node:os";import{basename as s8,dirname as Z2,isAbsolute as vz,join as m,resolve as e8}from"node:path";import{fileURLToPath as uz}from"node:url";function t1($){if(!$||typeof $!=="object")return $;return Object.fromEntries(Object.keys($).map((z)=>[z,""]))}function r8($){let z=JSON.parse(JSON.stringify($??{}));if(z.hetzner)delete z.hetzner.apiToken;delete z.aws,delete z.stateDir;for(let J of Object.values(z.sites??{})){if(J?.env)J.env=t1(J.env);if(J?.environment)J.environment=t1(J.environment)}for(let J of Object.values(z.environments??{}))if(J?.variables)J.variables=t1(J.variables);for(let J of Object.values(z.infrastructure?.databases??{}))if(J?.password)J.password="";if(z.infrastructure?.appDatabase?.password)z.infrastructure.appDatabase.password="";if(z.infrastructure?.compute?.database?.password)z.infrastructure.compute.database.password="";if(z.infrastructure?.compute?.managedServices?.vitess?.password)z.infrastructure.compute.managedServices.vitess.password="";return z}function Iz($){let z=r8($);return["// Generated by ts-cloud for the management dashboard — do not edit.","//","// This is the project's resolved cloud config, inlined so it needs no","// imports on the box. Credentials are deliberately absent.",`export default ${JSON.stringify(z,null,2)}`,""].join(`
+`)}var $9="dashboard";function mz(){return z2("dashboard-credentials.json")}function z9(){return a8(24).toString("base64url")}function J9($,z,J){let Z=process.env.TS_CLOUD_UI_PASSWORD?.trim();if(Z)return{password:Z,source:"env"};if($2(process.env.TS_CLOUD_UI_PUBLIC))return{password:void 0,source:"public"};let Q=mz(),W=J2($,"dashboard-credentials.json");try{if(y0(W)){let q=JSON.parse(hz(W,"utf8"));if(q?.password)return{password:q.password,source:"generated"}}}catch{}let Y=z9();try{bz(Z2(W),{recursive:!0}),e1(W,`${JSON.stringify({username:z,password:Y,generatedAt:new Date().toISOString()},null,2)}
+`),n8(W,384),J.info(`Management dashboard: generated a password for '${z}' and saved it to ${Q} (read it there — it is not printed). Set TS_CLOUD_UI_PASSWORD to pin your own, or TS_CLOUD_UI_PUBLIC=1 to serve without auth.`)}catch(q){J.warn(`Management dashboard: could not persist the generated password (${q?.message??q}). Using it for this deploy only — pass: ${Y}
+This password is now in your deploy log. Set TS_CLOUD_UI_PASSWORD to a value of your own and redeploy once ${Q} is writable.`)}return{password:Y,source:"generated"}}var gz={info:()=>{},warn:()=>{}};function $2($){return $!=null&&$!==""&&$!=="0"&&$.toLowerCase()!=="false"}function Z9(){return z2("dashboard-release")}function dz(){let $=Z2(uz(import.meta.url));for(let z of[m($,"..","..","package.json"),m($,"..","package.json")])try{let J=JSON.parse(hz(z,"utf8"));if(J.name==="@stacksjs/ts-cloud"&&J.version)return`^${J.version}`}catch{}return"latest"}function Q9(){return process.env.TS_CLOUD_UI_VERSION?.trim()||dz()}function W9($,z,J){if(!$?.project?.slug)return J.warn("Management dashboard: the cloud config has no project slug — skipping the live dashboard."),null;let Z=J2(z,"dashboard-release");try{bz(Z,{recursive:!0}),e1(m(Z,"cloud.config.ts"),Iz($));let Q=Q9();if(Q.startsWith("file:")){let Y=Q.slice(5),q=vz(Y)?Y:e8(z,Y);if(!y0(q)||!o8(q).isFile())Q=dz(),J.warn(`Management dashboard: TS_CLOUD_UI_VERSION points to a missing package file (${q}); using the deploying ts-cloud version ${Q} instead.`);else{let j=s8(q),G=m(Z,j);if(q!==G)i8(q,G);Q=`file:./${j}`}}let W={name:"ts-cloud-dashboard",private:!0,type:"module",dependencies:{"@stacksjs/ts-cloud":Q}};return e1(m(Z,"package.json"),`${JSON.stringify(W,null,2)}
+`),Z9()}catch(Q){return J.warn(`Management dashboard: could not stage the live release (${Q?.message??Q}) — skipping.`),null}}function Y9($){if(y0(m($,"packages","ui","pages"))||y0(m($,"packages","ui","package.json")))return{uiRoot:"packages/ui/dist",build:"cd packages/ui && bun install && bun run build"};let z=Z2(uz(import.meta.url)),J=[m(z,"ui"),m(z,"..","ui"),m(z,"..","..","ui"),m(z,"..","dist","ui")];for(let Z of J)if(y0(m(Z,"index.html"))||y0(m(Z,"serverless.html")))return{uiRoot:Z,build:!1};return null}function Q2($,z={}){let J=z.logger??gz,Z=z.cwd??process.cwd();if($2(process.env.TS_CLOUD_UI_DISABLE))return J.info("Management dashboard: skipped (TS_CLOUD_UI_DISABLE set)."),$;if($.cloud?.attachTo)return J.info(`Management dashboard: ${$.project.slug} is attached to ${$.cloud.attachTo}; the server owner's dashboard monitors every attached project.`),$;if(H$($))return $;let Q=$.environments&&Object.keys($.environments)[0],W=process.env.TS_CLOUD_UI_DOMAIN?.trim()||void 0,Y=Number(process.env.TS_CLOUD_UI_PORT)||void 0,q={...$.sites??{}};if(!$2(process.env.TS_CLOUD_UI_STATIC)){let X=W9($,Z,J);if(!X)return $;let O=s1($,Q??"production",{uiRoot:X,build:!1,domain:W,port:Y,live:!0});if(O.length===0)return J.info("Management dashboard: no domain resolved (set TS_CLOUD_UI_DOMAIN or configure a site domain) — skipping."),$;for(let{name:C,site:U}of O)q[C]=U,J.info(`Management dashboard → https://${U.domain} (sign in with your ts-cloud account; the first deploy prints an admin password once)`);return $.sites=q,$}let j=Y9(Z);if(!j)return J.info("Management dashboard: UI not found (no local ui/ or packaged dist/ui) — skipping auto-deploy."),$;let G=process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin",K=J9(Z,G,J),V=s1($,Q??"production",{uiRoot:j.uiRoot,build:j.build,domain:W,username:G,password:K.password,realm:process.env.TS_CLOUD_UI_REALM?.trim()||void 0,live:!1,port:Y});if(V.length===0)return J.info("Management dashboard: no domain resolved (set TS_CLOUD_UI_DOMAIN or configure a site domain) — skipping."),$;let H=K.source==="public"?"NO AUTH — TS_CLOUD_UI_PUBLIC is set (dashboard is publicly reachable)":K.source==="env"?"htpasswd-protected (TS_CLOUD_UI_PASSWORD)":`htpasswd-protected (auto-generated — see ${mz()})`;J.warn("Management dashboard: static mode — one shared password, and no per-site collaborators. Unset TS_CLOUD_UI_STATIC for the live dashboard.");for(let{name:X,site:O}of V)q[X]=O,J.info(`Management dashboard → https://${O.domain} (${H})`);return $.sites=q,$}function W2($){return Object.keys($.sites??{}).filter(fz)}function cz($,z){if(!$?.root)return null;let J=z.cwd??process.cwd(),Z=z.logger??gz;try{if(typeof $.build==="string"&&$.build.trim())Z.info(`Management dashboard: building UI (${$.build})`),Sz($.build,{cwd:J,stdio:"inherit"});let Q=vz($.root)?$.root:m(J,$.root);if(!y0(Q))return Z.warn(`Management dashboard: build output not found at ${Q} — skipping dashboard artifact.`),null;let W=m(t8(),`${z.slug}-${z.siteName??$9}-${z.sha}.tar.gz`);return Sz(`tar czf "${W}" -C "${Q}" .`,{stdio:"inherit"}),W}catch(Q){return Z.warn(`Management dashboard: failed to build artifact — ${Q?.message??Q}. Skipping dashboard deploy.`),null}}var q9=new Set(["laravel","php","statamic","wordpress"]);function rz($){if($.framework)return $.framework;if($.type&&q9.has($.type))return"laravel";return"stacks"}var lz=`eval "$(cd ${d} && pantry env 2>/dev/null)"`,pz="/usr/local/bin/bun",j9="storage/framework/core/buddy/src/cli.ts",G9="node_modules/@stacksjs/ts-cloud/dist/bin/stacks-scheduler.js",az={id:"stacks",wrapExec:($)=>$,execEnv:{PATH:"/usr/local/bin:/usr/bin:/bin",BUN_INSTALL:"/root/.bun",APP_ENV:"production",NODE_ENV:"production"},schedulerMode:"daemon",schedulerCommand:()=>`${pz} ${G9}`,queueWorkerCommand:($,{current:z})=>{let J=[`--queue=${$.queue||"default"}`,`--sleep=${$.sleep??3}`,`--tries=${$.tries??3}`,`--timeout=${$.timeout??60}`];return`${pz} ${z}/${j9} queue:work ${J.join(" ")}`}},H9={id:"laravel",wrapExec:($)=>`/bin/sh -lc '${lz}; exec ${$}'`,schedulerMode:"cron",schedulerCommand:({current:$})=>`cd ${$} && ${lz} && php artisan schedule:run`,queueWorkerCommand:($,{current:z})=>{let J=`${z}/artisan`;if($.horizon)return`php ${J} horizon`;let Z=[$.connection||"default",`--queue=${$.queue||"default"}`,`--sleep=${$.sleep??3}`,`--tries=${$.tries??3}`,`--timeout=${$.timeout??60}`,`--memory=${$.memory??128}`];if($.maxJobs)Z.push(`--max-jobs=${$.maxJobs}`);if($.maxTime)Z.push(`--max-time=${$.maxTime}`);return`php ${J} queue:work ${Z.join(" ")}`}},X9={stacks:az,laravel:H9};function nz($){return X9[$]??az}function iz($){return $.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function K9($){return`'${$.split("'").join("'\\''")}'`}function oz($){return $.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"unnamed"}function V9($,z,J){return`${$}-${z}-queue-${J}`}function O9($,z,J,Z){return`${$}-${z}-daemon-${J.name?oz(J.name):oz(J.command).slice(0,32)||String(Z)}`}function Y2($){let z=["[Unit]",`Description=${$.description}`,"After=network.target","","[Service]","Type=simple",`WorkingDirectory=${$.workingDir}`,...Object.entries($.environment??{}).map(([J,Z])=>`Environment="${J}=${Z}"`),`ExecStart=${$.execStart}`,`Restart=${$.restart||"always"}`,"RestartSec=5","MemoryAccounting=true",`MemoryHigh=${$.memoryHigh??"2G"}`,...$.memoryMax?[`MemoryMax=${$.memoryMax}`]:[]];if($.user)z.push(`User=${$.user}`);if(typeof $.stopWaitSecs==="number")z.push(`TimeoutStopSec=${$.stopWaitSecs}`);return z.push("","[Install]","WantedBy=multi-user.target"),`${z.join(`
+`)}
+`}function q2($,z){return[`cat > /etc/systemd/system/${$}.service <<'TS_CLOUD_UNIT_EOF'`,z.replace(/\n$/,""),"TS_CLOUD_UNIT_EOF"]}function M9($,z){return`/etc/cron.d/${$}-${z}-scheduler`}function j2($){let{slug:z,siteName:J,site:Z}=$,W=`${$.appBase??`/var/www/${J}`}/current`,Y=nz(rz(Z)),q={current:W},j=[],G=[];(Z.queues||[]).forEach((F,B)=>{let M=Math.max(1,F.processes??1);for(let x=0;x<M;x++){let A=V9(z,J,G.length);G.push(A),j.push(...q2(A,Y2({description:`${J} queue worker ${B}.${x} (managed by ts-cloud)`,workingDir:W,execStart:Y.wrapExec(Y.queueWorkerCommand(F,q)),environment:Y.execEnv,stopWaitSecs:F.stopWaitSecs??90})))}}),(Z.daemons||[]).forEach((F,B)=>{let M=Math.max(1,F.processes??1);for(let x=0;x<M;x++){let A=`${O9(z,J,F,B)}-${x}`;G.push(A),j.push(...q2(A,Y2({description:`${J} daemon ${F.name||F.command} (managed by ts-cloud)`,workingDir:F.directory||W,execStart:Y.wrapExec(F.command),environment:Y.execEnv,restart:F.restart,user:F.user})))}});let H=Z.scheduler,X=H===!0||typeof H==="object"&&H!==null,O=`${z}-${J}-scheduler`;if(X&&Y.schedulerMode==="daemon")G.push(O),j.push(...q2(O,Y2({description:`${J} scheduler (managed by ts-cloud)`,workingDir:W,execStart:Y.wrapExec(Y.schedulerCommand(q)),environment:Y.execEnv})));let C=G.map((F)=>`${F}.service`).join(" ");j.push("systemctl daemon-reload",`TS_CLOUD_DESIRED="${C}"`,`for unit in $(ls /etc/systemd/system/ 2>/dev/null | grep -E '^${iz(z)}-${iz(J)}-((queue|daemon)-.*|scheduler)\\.service$' || true); do`,'  case " $TS_CLOUD_DESIRED " in','    *" $unit "*) ;;','    *) systemctl stop "$unit" 2>/dev/null || true; systemctl disable "$unit" 2>/dev/null || true; rm -f "/etc/systemd/system/$unit" ;;',"  esac","done","systemctl daemon-reload");for(let F of G)j.push(`systemctl enable ${F}.service`,`systemctl restart ${F}.service`);let U=M9(z,J);if(X&&Y.schedulerMode==="cron"){let F=typeof H==="object"&&H!==null?H:void 0,B=`${Y.schedulerCommand(q)} >> /dev/null 2>&1`;if(F?.heartbeatUrl){let x=F.heartbeatMethod||"GET",A=x==="GET"?"":`-X ${x} `;B+=` && curl -fsS -m 10 ${A}${K9(F.heartbeatUrl)} >/dev/null 2>&1`}let M=`* * * * * root ${B}
+`.replace(/%/g,"\\%");j.push(`cat > ${U} <<'TS_CLOUD_CRON_EOF'`,M.replace(/\n$/,""),"TS_CLOUD_CRON_EOF",`chmod 644 ${U}`)}else j.push(`rm -f ${U}`);return j}function G2($){return!!($.queues?.length||$.daemons?.length||$.scheduler)}function H2($){if($.ssl?.provider)return $.ssl.provider;return $.domain?"letsencrypt":"none"}var tz={cloudflare:{pkg:"python3-certbot-dns-cloudflare",plugin:"dns-cloudflare"},route53:{pkg:"python3-certbot-dns-route53",plugin:"dns-route53"},digitalocean:{pkg:"python3-certbot-dns-digitalocean",plugin:"dns-digitalocean"},google:{pkg:"python3-certbot-dns-google",plugin:"dns-google"}};function sz($){return`/etc/letsencrypt/ts-cloud-${$}.ini`}function F9($){let z=$?tz[$.provider]:void 0,J=["certbot","python3-certbot-nginx",...z?[z.pkg]:[]].join(" ");return["export DEBIAN_FRONTEND=noninteractive",z?`apt-get update -y && apt-get install -y ${J}`:`command -v certbot >/dev/null 2>&1 || { apt-get update -y && apt-get install -y ${J}; }`,"mkdir -p /etc/letsencrypt/renewal-hooks/deploy","cat > /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh <<'TS_CLOUD_HOOK_EOF'","#!/bin/sh","systemctl reload ts-cloud-nginx 2>/dev/null || systemctl reload nginx 2>/dev/null || true","TS_CLOUD_HOOK_EOF","chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh","systemctl enable certbot.timer 2>/dev/null || true","systemctl start certbot.timer 2>/dev/null || true"]}function B9($){if(!$.credentials||Object.keys($.credentials).length===0)return[];let z=sz($.provider),J=Object.entries($.credentials).map(([Z,Q])=>`${Z} = ${Q}`).join(`
+`);return[`cat > ${z} <<'TS_CLOUD_DNSCREDS_EOF'`,J,"TS_CLOUD_DNSCREDS_EOF",`chmod 600 ${z}`]}function U9($){let z=$.dns,J=$.wildcard?[`*.${$.domain}`,$.domain]:[$.domain,...$.aliases||[]].filter(Boolean),Z=["certbot","--non-interactive","--agree-tos","--keep-until-expiring"];if(z){let Q=tz[z.provider].plugin;if(Z.push(`--${Q}`),z.provider!=="route53"&&z.credentials)Z.push(`--${Q}-credentials ${sz(z.provider)}`);if(typeof z.propagationSeconds==="number"&&z.provider!=="route53")Z.push(`--${Q}-propagation-seconds ${z.propagationSeconds}`);Z.push("certonly")}else Z.push("--nginx",`--nginx-ctl ${M0}`,$.redirect===!1?"--no-redirect":"--redirect");if($.email)Z.push(`-m ${$.email}`);else Z.push("--register-unsafely-without-email");for(let Q of J)Z.push(`-d ${Q}`);return[Z.join(" ")]}function X2($){if(H2($)!=="letsencrypt"||!$.domain)return[];let z=$.ssl,J=z?.dns,Z=z?.wildcard===!0;if(Z&&!J)return[];return[...F9(J),...J?B9(J):[],...U9({domain:$.domain,aliases:$.aliases,email:z?.email,wildcard:Z,dns:J})]}function ez($){let{repository:z,releaseDir:J,commit:Z}=$,Q=z.branch||"main",W=z.url,Y=[`rm -rf ${J}`,`mkdir -p ${J}`];if(z.strategy==="tag")if(z.tag)Y.push(`git clone -q --depth 1 --branch ${n(z.tag)} ${n(W)} ${J}`),Y.push(`printf '%s' ${n(z.tag)} > ${J}/.ts-cloud-tag`);else{let q=z.tagPattern||"v*";Y.push(`TS_CLOUD_TAG="$(git ls-remote --tags --refs --sort=-v:refname ${n(W)} ${n(`refs/tags/${q}`)} | head -n1 | sed 's#.*refs/tags/##')"`,`test -n "$TS_CLOUD_TAG" || { echo "no tags matching" ${n(q)} "found in" ${n(W)} >&2; exit 1; }`,`git clone -q --depth 1 --branch "$TS_CLOUD_TAG" ${n(W)} ${J}`,`printf '%s' "$TS_CLOUD_TAG" > ${J}/.ts-cloud-tag`)}else if(Z)Y.push(`git -C ${J} init -q`,`git -C ${J} remote add origin ${n(W)}`,`git -C ${J} fetch -q --depth 1 origin ${n(Z)}`,`git -C ${J} checkout -q FETCH_HEAD`);else Y.push(`git clone -q --depth 1 --branch ${n(Q)} ${n(W)} ${J}`);return Y.push(`git -C ${J} rev-parse HEAD > ${J}/.ts-cloud-sha`),Y}function n($){return`'${$.split("'").join("'\\''")}'`}var u$="$CREATE_RELEASE",m$="$ACTIVATE_RELEASE",J4="$RESTART_QUEUES",$4="composer install --no-interaction --prefer-dist --optimize-autoloader --no-dev",C9=["php artisan migrate --force","php artisan config:cache","php artisan route:cache","php artisan view:cache","php artisan event:cache","php artisan storage:link"];function x9($){switch($){case"laravel":case"statamic":return[u$,$4,...C9,m$,J4];case"php":case"wordpress":return[u$,`${$4} || true`,m$];case"static":case"spa":return[u$,m$]}}function L9($,z){return $.replace(/^php\s+/,`${z} `).replace(/(\s)php\s+artisan\s+/g,`$1${z} artisan `)}function D9($,z){let J=S$(z);return[`cat > ${$} <<'TS_CLOUD_ENV_EOF'`,J,"TS_CLOUD_ENV_EOF",`chmod 600 ${$}`]}function z4($,z,J){return[`cat > ${$} <<'${J}'`,z.replace(/\n$/,""),J,`chmod 600 ${$}`]}function w9($,z){if(!z)return[];let J=[];if(z.composerAuth){let Z=typeof z.composerAuth==="string"?z.composerAuth:JSON.stringify(z.composerAuth,null,2);J.push(...z4(`${$}/auth.json`,Z,"TS_CLOUD_AUTHJSON_EOF"))}if(z.npmrc)J.push(...z4(`${$}/.npmrc`,z.npmrc,"TS_CLOUD_NPMRC_EOF"));return J}function Z4($){let z=$.healthCheck?.path;if(!z||!$.domain)return[];let Z=`http://127.0.0.1${z.startsWith("/")?z:`/${z}`}`;return[`echo "[ts-cloud] health check ${Z} (Host: ${$.domain})"`,"TS_CLOUD_HC_OK=0",`for i in $(seq 1 10); do TS_CLOUD_HC=$(curl -s -o /dev/null -w "%{http_code}" -H "Host: ${$.domain}" -m 10 "${Z}" 2>/dev/null || echo 000); case "$TS_CLOUD_HC" in 2*|3*) TS_CLOUD_HC_OK=1; break ;; esac; sleep 3; done`,'[ "$TS_CLOUD_HC_OK" = 1 ] && echo "health check passed ($TS_CLOUD_HC)" || { echo "health check FAILED (last=$TS_CLOUD_HC)" >&2; exit 1; }']}function Q4($){let{siteName:z,site:J,releaseId:Z,commit:Q}=$;if(!J.repository?.url)throw Error(`Site '${z}' is a PHP/git site but has no repository.url to clone`);let W=$.appBase??`/var/www/${z}`,Y="php",q=q$(W,Z),j=J.sharedPaths??f$,G=[...j,...v$(J.env,j)],K=J.keepReleases??Y$,V=J.deployScript?.length?J.deployScript:x9(J.type??"laravel"),H=["set -euo pipefail",'export HOME="${HOME:-/root}"','export COMPOSER_HOME="${COMPOSER_HOME:-/root/.composer}"',"export COMPOSER_ALLOW_SUPERUSER=1",Y0()];if(H.push(...h$(W,{releaseId:Z,commit:Q,branch:J.repository.branch,keepLogs:K})),H.push(...j$(q,G)),J.env&&Object.keys(J.env).length>0)H.push(...D9(`${q.shared}/.env`,J.env));for(let X of V){let O=X.trim();if(O===u$)H.push(...ez({repository:J.repository,releaseDir:q.release,commit:Q})),H.push(...b$(q,G)),H.push(`cd ${q.release}`),H.push(...w9(q.release,J.credentials)),H.push(`chown -R www-data:www-data ${q.shared}/storage 2>/dev/null || true`,`[ -d ${q.release}/bootstrap/cache ] && chown -R www-data:www-data ${q.release}/bootstrap/cache 2>/dev/null || true`,`chmod -R ug+rwX ${q.shared}/storage 2>/dev/null || true`);else if(O===m$)H.push(...r0(q)),H.push(...a0(q,K)),H.push(`(cd ${d} && pantry restart php-fpm) 2>/dev/null || true`);else if(O===J4)H.push(`${Y} artisan queue:restart || true`);else H.push(L9(X,Y))}return H}var g$={mysql:{port:3306,binaries:["mysqld","mysql"]},mariadb:{port:3306,binaries:["mariadbd","mariadb","mysqld"]},postgres:{port:5432,binaries:["postgres","psql"]},redis:{port:6379,binaries:["redis-server","redis-cli"]},memcached:{port:11211,binaries:["memcached"]},meilisearch:{port:7700,binaries:["meilisearch"]},vitess:{port:15306,binaries:["vtgate"]}},X$="ts-cloud-service:";function A9($){return $===!0||typeof $==="object"&&$!=null}function W4($){if(!$)return[];return Object.keys(g$).filter((z)=>A9($[z]))}function Y4($){if($.length===0)return[];return[Y0(),"ts_cloud_port_open() {",'  if command -v ss >/dev/null 2>&1; then ss -ltn 2>/dev/null | grep -qE "[:.]$1[[:space:]]" && return 0; fi','  if command -v netstat >/dev/null 2>&1; then netstat -ltn 2>/dev/null | grep -qE "[:.]$1[[:space:]]" && return 0; fi',"  (exec 3<>/dev/tcp/127.0.0.1/$1) 2>/dev/null && { exec 3<&- 3>&-; return 0; }","  return 1","}","ts_cloud_probe() {",'  TS_CLOUD_SVC="$1"; TS_CLOUD_PORT="$2"; shift 2','  for TS_CLOUD_BIN in "$@"; do',`    if command -v "$TS_CLOUD_BIN" >/dev/null 2>&1; then echo "${X$}$TS_CLOUD_SVC:present"; return 0; fi`,"  done",`  if ts_cloud_port_open "$TS_CLOUD_PORT"; then echo "${X$}$TS_CLOUD_SVC:present"; return 0; fi`,`  echo "${X$}$TS_CLOUD_SVC:missing"`,"  return 0","}",...$.filter((z)=>g$[z]).map((z)=>`ts_cloud_probe ${z} ${g$[z].port} ${g$[z].binaries.join(" ")}`),"exit 0"]}function q4($,z){if(!$)return[];let J=new Map;for(let Z of $.split(`
+`)){let Q=Z.indexOf(X$);if(Q===-1)continue;let[W,Y]=Z.slice(Q+X$.length).trim().split(":");if(W)J.set(W,Y)}return z.filter((Z)=>J.get(Z)==="missing")}function j4($,z,J){let Z=J?` on ${J}`:"",Q=$.map((Y)=>`managedServices.${Y}`).join(", "),W=$.length===1?`no ${$[0]}`:`none of ${$.join(", ")}`;return`This project declares ${Q}, but '${z}' has ${W}${Z}. Attach mode does not provision services on the owner's box, so nothing will install ${$.length===1?"it":"them"}. Point the app at an external service, or ask the owner of '${z}' to add ${$.length===1?"it":"them"} to their own config and re-provision.`}var G4="/var/lib/pantry/php-fpm/pool.d",R9=9100,N9=400;function d$($){return($.toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/^_+|_+$/g,"")||"site").slice(0,28)}function H4($){return`web_${d$($)}`}function E9($){let z=d$($),J=0;for(let Z=0;Z<z.length;Z++)J=J*31+z.charCodeAt(Z)>>>0;return R9+J%N9}function K2($){return`127.0.0.1:${E9($)}`}function k9($){let z=d$($.siteName),J=H4($.siteName),Z=$.maxChildren??10;return[`; ts-cloud-managed pool for ${$.siteName} (site isolation)`,`[${z}]`,`user = ${J}`,`group = ${J}`,`listen = ${K2($.siteName)}`,"pm = dynamic",`pm.max_children = ${Z}`,"pm.start_servers = 2","pm.min_spare_servers = 1","pm.max_spare_servers = 3","pm.max_requests = 500","catch_workers_output = yes",`php_admin_value[open_basedir] = ${$.appBase}:/tmp`,""].join(`
+`)}function X4($){let z=H4($.siteName),J=d$($.siteName),Z=`${G4}/${J}.conf`;return[`getent group ${z} >/dev/null || groupadd --system ${z}`,`id -u ${z} >/dev/null 2>&1 || useradd --system --no-create-home --shell /usr/sbin/nologin -g ${z} ${z}`,`usermod -aG ${z} www-data 2>/dev/null || true`,`chown -R ${z}:${z} ${$.appBase} || true`,`chmod -R g+rX ${$.appBase} || true`,`chmod 600 ${$.appBase}/shared/.env 2>/dev/null || true`,`mkdir -p ${G4}`,`cat > ${Z} <<'TS_CLOUD_FPMPOOL_EOF'`,k9($).replace(/\n$/,""),"TS_CLOUD_FPMPOOL_EOF",`(cd ${d} && pantry restart php-fpm) 2>/dev/null || true`]}var l$={info:()=>{},warn:()=>{},error:()=>{},step:()=>{},success:()=>{}};function P9($){return`'${$.replace(/'/g,`'"'"'`)}'`}async function V4($,z,J=l$){let{config:Z,environment:Q,siteName:W,site:Y,slug:q,sha:j,runtime:G,localTarballPath:K}=z,V=`releases/${W}/${j}.tar.gz`,H=P(Z,Q),X=await $.getComputeOutputs({config:Z,environment:Q}),O=await $.findComputeTargets({slug:q,environment:Q,role:"app",stackName:H});if(O.length===0)return{success:!1,error:$.name==="aws"?`Stack '${H}' has no EC2 instances tagged Project=${q} Environment=${Q} Role=app, and storage/cloud/state/${H}.json pins no live instance. For a shared box, record its instanceId there.`:`No Hetzner servers labeled ts-cloud/project=${q} ts-cloud/environment=${Q} ts-cloud/role=app, and storage/cloud/state/${H}.json pins no live server. For a shared box, record its serverId there.`};let C=X.servicesPrivateIp?Yz(X.servicesPrivateIp,C0(Z)):A2(C0(Z)),U=K4(D$(Z,{environment:Q})),F=Z.infrastructure?.compute,B=t(F)?{HOST:"127.0.0.1"}:{},M=Q==="production"?{APP_ENV:"production",NODE_ENV:"production"}:{},x={...C,...U,...B,...Y.env||{},...M},A=c1(x,Y.sharedPaths??[]);if(A.warning)J.warn(`Site '${W}': ${A.warning}`);else if(A.path)J.info(`Site '${W}': sharing '${A.path}' so the SQLite database survives deploys.`);if(e0(Y)){let $0=Y.phpVersion??F?.php?.default??F?.php?.versions?.[0],R=G1(q,W),f=Object.keys(C).length>0?{...Y,env:x}:Y,w=Q4({siteName:W,site:f,releaseId:j,appBase:R,defaultPhpVersion:$0}),k=!t(F),i=H2(Y)==="custom"&&Y.ssl?.certPath&&Y.ssl?.keyPath?{certPath:Y.ssl.certPath,keyPath:Y.ssl.keyPath}:void 0,X0=Y.isolation?X4({siteName:W,appBase:R}):[],n0=k?Y1({siteName:W,domain:Y.domain||W,aliases:Y.aliases,type:Y.type,appDir:`${R}/current`,webDirectory:Y.webDirectory,phpVersion:$0,fastcgiPass:Y.isolation?K2(W):void 0,redirects:Y.redirects,ssl:i,auth:Y.auth&&Y.auth.enabled!==!1&&Y.auth.password?{username:Y.auth.username||"admin",password:Y.auth.password,realm:Y.auth.realm}:void 0,serverSnippet:W1(Y.nginx,F?.nginxTemplates),clientMaxBodySize:Y.nginx?.clientMaxBodySize,hsts:Y.ssl?.hsts,tlsProtocols:Y.ssl?.tlsProtocols,security:Y.security}):[],p$=k?X2(Y):[],i0=G2(Y)?j2({slug:q,siteName:W,site:Y,phpVersion:$0,appBase:R}):[],M4=k?Z4(Y):[];J.step(`Deploying PHP site '${W}' to ${O.length} target(s)...`);let D0=await $.runRemoteDeploy({targets:O,commands:[...d1(R,q),...w,...X0,...n0,...p$,...i0,...M4],comment:`ts-cloud deploy ${q}/${W}@${j}`,tags:{Project:q,Environment:Q,Role:"app"}}),O2=T2(Z.notifications,Y.notifications);if(!D0.success)return await j1(O2,"deploy-failed",`❌ Deploy of ${q}/${W}@${j} failed: ${D0.error||"unknown error"}`),{success:!1,error:D0.error||"Remote PHP deploy failed",instanceCount:D0.instanceCount,perInstance:D0.perInstance};let F4=Y.domain?` → https://${Y.domain}`:"";return await j1(O2,"deploy",`✅ Deployed ${q}/${W}@${j}${F4}`),{success:!0,instanceCount:D0.instanceCount,perInstance:D0.perInstance}}if(!K)return{success:!1,error:`Site '${W}' requires a release tarball but none was provided`};let L=await $.uploadRelease({config:Z,environment:Q,localPath:K,remoteKey:V,targets:O}),D=G$(q,W,j),N=$.name==="aws"?a1(X.deployBucketName,V,Z.project.region||"us-east-1",D):n1(L.artifactRef,D),r=Q0(Y),_=G1(q,W),h=r==="server-static"?r1({siteName:W,slug:q,appDir:_,artifactFetch:N,releaseId:j,preStartCommands:Y.preStart}):p1({siteName:W,slug:q,appDir:_,artifactFetch:N,releaseId:j,execStart:l1(Y.start,G),envEntries:x,port:Y.port,preStartCommands:Y.preStart,sharedPaths:Y.sharedPaths,zeroDowntime:Y.zeroDowntime!==!1,healthCheckPath:Y.healthCheck?.path,memoryHigh:Y.memoryHigh,memoryMax:Y.memoryMax,cpuWeight:Y.cpuWeight,ioWeight:Y.ioWeight,tasksMax:Y.tasksMax,stopTimeout:Y.stopTimeout}),v=r==="server-static"&&!t(F)&&!!Y.domain,T=v?Y1({siteName:W,domain:Y.domain,aliases:Y.aliases,type:Y.type==="spa"?"spa":"static",appDir:`${_}/current`,webDirectory:"",redirects:Y.redirects,auth:Y.auth&&Y.auth.enabled!==!1&&Y.auth.password?{username:Y.auth.username||"admin",password:Y.auth.password,realm:Y.auth.realm}:void 0,serverSnippet:W1(Y.nginx,F?.nginxTemplates),clientMaxBodySize:Y.nginx?.clientMaxBodySize,hsts:Y.ssl?.hsts,tlsProtocols:Y.ssl?.tlsProtocols,security:Y.security}):[],g=v?X2(Y):[],E=G2(Y)?j2({slug:q,siteName:W,site:Y,appBase:_}):[],W0=[...h$(_,{releaseId:j,commit:j,branch:Y.repository?.branch??"main"}),...d1(_,q),...h,...T,...g,...E,...i1()];J.step(`Deploying to ${O.length} target(s)...`);let u=await $.runRemoteDeploy({targets:O,commands:W0,comment:`ts-cloud deploy ${q}/${W}@${j}`,tags:{Project:q,Environment:Q,Role:"app"}});if(!u.success)return{success:!1,error:u.error||"Remote deploy failed",instanceCount:u.instanceCount,perInstance:u.perInstance};return{success:!0,instanceCount:u.instanceCount,perInstance:u.perInstance}}function c$($){return`'${$.replaceAll("'","'\\''")}'`}function I9($,z,J=!1,Z=[]){let Q=`${$}-dashboard-`,W=z.map((q)=>`${$}-${q}.service`),Y=J?[`export TS_CLOUD_DASHBOARD_KEEP_DOMAINS=${c$(JSON.stringify(Z))}`,"rm -f /run/ts-cloud-dashboard-routes-changed",`/usr/local/bin/bun --bun -e ${c$(`
+          const { chmodSync, existsSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync } = require('node:fs')
+          const { basename, join } = require('node:path')
+          const root = '/etc/rpx/sites.d'
+          const keep = new Set(JSON.parse(process.env.TS_CLOUD_DASHBOARD_KEEP_DOMAINS || '[]'))
+          let changed = false
+          for (const name of existsSync(root) ? readdirSync(root) : []) {
+            if (!name.endsWith('.json')) continue
+            const file = join(root, name)
+            let config
+            try { config = JSON.parse(readFileSync(file, 'utf8')) } catch { continue }
+            if (!Array.isArray(config.proxies)) continue
+            const project = basename(name, '.json')
+            const proxies = config.proxies.filter((route) => {
+              const domain = typeof route?.to === 'string' ? route.to.toLowerCase() : ''
+              if (!/^(?:dashboard|cloud)\\./.test(domain) || keep.has(domain)) return true
+              const siteName = domain.replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '')
+              return !existsSync('/var/www/' + project + '-' + siteName)
+            })
+            if (proxies.length === config.proxies.length) continue
+            const temporary = file + '.tmp-' + process.pid
+            const mode = statSync(file).mode & 0o777
+            writeFileSync(temporary, JSON.stringify({ ...config, proxies }, null, 2) + '\\n', { mode })
+            chmodSync(temporary, mode)
+            renameSync(temporary, file)
+            changed = true
+          }
+          if (changed) writeFileSync('/run/ts-cloud-dashboard-routes-changed', '')
+        `)}`,"if [ -e /run/ts-cloud-dashboard-routes-changed ]; then","  systemctl restart rpx-gateway.service","  rm -f /run/ts-cloud-dashboard-routes-changed","fi"]:[];return["set -euo pipefail",`TS_CLOUD_DASHBOARD_PREFIX=${c$(Q)}`,`TS_CLOUD_DASHBOARD_SERVER_OWNER=${J?"1":"0"}`,`TS_CLOUD_DASHBOARD_DESIRED=${c$(` ${W.join(" ")} `)}`,"for TS_CLOUD_UNIT_FILE in /etc/systemd/system/*.service; do",'  [ -e "$TS_CLOUD_UNIT_FILE" ] || continue','  TS_CLOUD_UNIT=$(basename "$TS_CLOUD_UNIT_FILE")','  case "$TS_CLOUD_UNIT" in',"    *-dashboard-*.service)",'      if [ "$TS_CLOUD_DASHBOARD_SERVER_OWNER" != 1 ]; then','        case "$TS_CLOUD_UNIT" in "$TS_CLOUD_DASHBOARD_PREFIX"*.service) ;; *) continue ;; esac',"      fi",'      case "$TS_CLOUD_DASHBOARD_DESIRED" in','        *" $TS_CLOUD_UNIT "*) ;;',"        *)",'          systemctl disable --now "$TS_CLOUD_UNIT" 2>/dev/null || true','          rm -f "$TS_CLOUD_UNIT_FILE"',"          ;;","      esac","      ;;","  esac","done","systemctl daemon-reload","systemctl reset-failed",...Y]}async function S9($,z,J,Z){let{config:Q,environment:W}=z,Y=Q.project.slug,q=P(Q,W),j=await $.findComputeTargets({slug:Y,environment:W,role:"app",stackName:q});if(j.length===0)return!0;let G=await $.runRemoteDeploy({targets:j,commands:I9(Y,J,!Q.cloud?.attachTo,J.map((K)=>Q.sites?.[K]?.domain).filter((K)=>typeof K==="string")),comment:`ts-cloud reconcile management dashboard ${Y}`,tags:{Project:Y,Environment:W,Role:"app"}});if(!G.success)return Z.error(`Management dashboard reconciliation failed: ${G.error||"unknown error"}`),!1;return!0}async function f9($,z,J){let{config:Z}=z,Q=Z.cloud?.attachTo;if(!Q||!$.listReachableResources)return;let W;try{W=await $.listReachableResources()}catch(j){J.warn(`Could not determine this credential's reach: ${j instanceof Error?j.message:String(j)}`);return}let Y=yz(W,{ownerSlug:Q,selfSlug:Z.project.slug}),q=o1(Y)>0;for(let j of Pz(Y,{ownerSlug:Q,selfSlug:Z.project.slug}))if(q)J.warn(j);else J.info(j)}async function b9($,z,J){let{config:Z,environment:Q}=z,W=Z.cloud?.attachTo;if(!W)return!0;let Y=W4(Z.infrastructure?.compute?.managedServices);if(Y.length===0)return!0;let q=Z.project.slug,j=P(Z,Q),G=await $.findComputeTargets({slug:q,environment:Q,role:"app",stackName:j});if(G.length===0)return!0;let K=await $.runRemoteDeploy({targets:G,commands:Y4(Y),comment:`ts-cloud preflight managed services ${q}`,tags:{Project:q,Environment:Q,Role:"app"}});if(!K.success)return J.warn(`Could not check '${W}' for the declared services: ${K.error||"unknown error"}`),!0;let V=new Set;for(let H of K.perInstance)for(let X of q4(H.output,Y))V.add(X);if(V.size===0)return!0;return J.error(j4([...V],W,G[0]?.publicIp)),!1}async function h9($,z,J){let{config:Z,environment:Q}=z;if(!Z.cloud?.attachTo)return!0;let W=Z.infrastructure?.compute,Y=C0(Z),q=S0(Y,W?.managedServices??{});if(q.length===0)return!0;let j=Z.project.slug,G=P(Z,Q),K=await $.findComputeTargets({slug:j,environment:Q,role:"app",stackName:G});if(K.length===0)return!0;J.step(`Ensuring database '${Y?.name}' + role exist on the shared box...`);let V=await $.runRemoteDeploy({targets:K,commands:q,comment:`ts-cloud ensure database ${j}/${Y?.name}`,tags:{Project:j,Environment:Q,Role:"app"}});if(!V.success)return J.error(`Ensuring database '${Y?.name}' failed: ${V.error||"unknown error"}`),!1;return J.success(`Database '${Y?.name}' is ready on ${V.instanceCount} target(s)`),!0}async function v9($){let{config:z,environment:J,driver:Z,sha:Q,runtime:W,tarballForSite:Y,logger:q=l$}=$,j=z.project.slug,G=$.cwd??process.cwd(),K=$.managementDashboard!==!1,V=H$(z);if(K)Q2(z,{cwd:G,logger:{info:q.info,warn:q.warn}});let H=!K||V?[]:W2(z);if(K&&$.rpxConfig&&$.rpxConfig!==z&&!H$($.rpxConfig))Q2($.rpxConfig,{cwd:G,logger:{info:()=>{},warn:()=>{}}});if(K&&!await S9(Z,$,W2(z),q))return!1;let X=null,O=new Map;if(H.length>0)if(X=cz(z.sites?.[H[0]],{cwd:G,slug:j,sha:Q,siteName:H[0],logger:{info:q.info,warn:q.warn}}),!X){q.warn("Management dashboard: no artifact available — skipping dashboard site(s) for this deploy.");for(let M of H)if(z.sites)delete z.sites[M]}else for(let M of H){if(M===H[0]){O.set(M,X);continue}try{let x=y9(T9(),`${j}-${M}-${Q}.tar.gz`);_9(X,x),O.set(M,x)}catch{O.set(M,X)}}let C=z.sites||{},U=Object.entries(C).filter(([M,x])=>{if(!x)return!1;let A=Q0(x);if(A==="bucket")return q.warn(`Site '${M}' targets a bucket — skipping (handled by the static-site path, not compute).`),!1;if(A==="redirect")return!1;if(A==="proxy")return!1;return!0});if(U.length===0)return V2($);if(await f9(Z,$,q),!await b9(Z,$,q))return!1;if(!await h9(Z,$,q))return!1;let F=(M)=>O.get(M)??Y(M);for(let[M,x]of U){q.step(`Deploying site: ${M}`);let A=e0(x)?void 0:F(M),L=await V4(Z,{config:z,environment:J,siteName:M,site:x,slug:j,sha:Q,runtime:W,localTarballPath:A},q);if(!L.success){if(q.error(`Deploy of '${M}' failed: ${L.error||"unknown error"}`),L.perInstance)for(let D of L.perInstance)q.error(`  ${D.instanceId}: ${D.status}${D.error?` — ${D.error}`:""}`);return!1}if(q.success(`Deployed ${j}/${M}@${Q} to ${L.instanceCount} target(s)`),L.perInstance)for(let D of L.perInstance)q.info(`  ✓ ${D.instanceId}: ${D.status}`)}if(!await V2($))return!1;return!0}async function V2($){let{config:z,environment:J,driver:Z,logger:Q=l$}=$,W=$.rpxConfig??z,Y=W.infrastructure?.compute?.proxy??z.infrastructure?.compute?.proxy;if(Y?.engine!=="rpx")return!0;let q=W.sites||{},j=z.project.slug,G=P(z,J),K=await Z.findComputeTargets({slug:j,environment:J,role:"lb",stackName:G});if(K.length>0){let U=(await Z.findComputeTargets({slug:j,environment:J,role:"app",stackName:G})).map((M)=>({privateIp:M.privateIp,publicIp:M.publicIp})),F=h0(q,U,{proxy:Y,slug:j});if(F.proxies.length===0)return Q.warn("rpx gateway: no server sites with a domain to route — skipping gateway reload."),!0;Q.step(`Reloading the load balancer's rpx gateway with ${F.proxies.length} route(s)...`);let B=await Z.runRemoteDeploy({targets:K,commands:J$({config:F,slug:j,preserveManagementDashboardRoutes:$.managementDashboard===!1}),comment:`ts-cloud rpx gateway reload ${j}`,tags:{Project:j,Environment:J,Role:"lb"}});if(!B.success)return Q.error(`rpx gateway reload failed: ${B.error||"unknown error"}`),!1;return Q.success(`rpx gateway reloaded on ${B.instanceCount} load balancer(s)`),!0}let V=B0(q,{proxy:Y,slug:j});if(V.proxies.length===0)return Q.warn("rpx gateway: no server sites with a domain to route — skipping gateway reload."),!0;let H=await Z.findComputeTargets({slug:j,environment:J,role:"app",stackName:G});if(H.length===0)return Q.warn("rpx gateway: no compute targets found — skipping gateway reload."),!0;Q.step(`Reloading rpx gateway with ${V.proxies.length} route(s)...`);let X=U0({proxy:Y,config:V,slug:j,preserveManagementDashboardRoutes:$.managementDashboard===!1}),O=await Z.runRemoteDeploy({targets:H,commands:X,comment:`ts-cloud rpx gateway reload ${j}`,tags:{Project:j,Environment:J,Role:"app"}});if(!O.success)return Q.error(`rpx gateway reload failed: ${O.error||"unknown error"}`),!1;return Q.success(`rpx gateway reloaded on ${O.instanceCount} target(s)`),!0}async function u9($){let{config:z,environment:J,driver:Z,logger:Q=l$}=$,W=$.rpxConfig??z,Y=W.infrastructure?.compute?.proxy??z.infrastructure?.compute?.proxy;if(Y?.engine!=="rpx"||!Y.onDemandTls)return!0;let q=B0(W.sites||{},{proxy:Y,slug:z.project.slug});if(q.proxies.length===0)return!0;let j=F1(q);if(j.length===0)return!0;let G=z.project.slug,K=P(z,J),V="lb",H=await Z.findComputeTargets({slug:G,environment:J,role:V,stackName:K});if(H.length===0)V="app",H=await Z.findComputeTargets({slug:G,environment:J,role:V,stackName:K});if(H.length===0)return Q.warn("rpx TLS: no gateway targets found - skipping certificate issuance."),!0;Q.step("Issuing rpx TLS certificates after DNS reconciliation...");let X=j.map((C)=>`test -s ${P9(`${q.productionCerts.certsDir}/${C}.crt`)}`).join(" && "),O=await Z.runRemoteDeploy({targets:H,commands:[`systemctl start ${M1(G)}`,X],comment:`ts-cloud rpx TLS issuance ${G}`,tags:{Project:G,Environment:J,Role:V}});if(!O.success)return Q.error(`rpx TLS issuance failed: ${O.error||"unknown error"}`),!1;return Q.success(`rpx TLS certificates reconciled on ${O.instanceCount} gateway target(s)`),!0}var m9="658327ea-f89d-4fab-a63d-7e88639e58f6",g9="4135ea2d-6df8-44a3-9df3-4b5a84be39ad",d9="216adef6-5c7f-47e4-b989-5492eafa07d3";function O4($,z){let J={TargetOriginId:"origin",ViewerProtocolPolicy:"redirect-to-https",Compress:!0,CachePolicyId:z==="dynamic"?"4135ea2d-6df8-44a3-9df3-4b5a84be39ad":"658327ea-f89d-4fab-a63d-7e88639e58f6",OriginRequestPolicyId:"216adef6-5c7f-47e4-b989-5492eafa07d3",SmoothStreaming:!1,FieldLevelEncryptionId:"",TrustedSigners:{Enabled:!1,Quantity:0},TrustedKeyGroups:{Enabled:!1,Quantity:0},LambdaFunctionAssociations:{Quantity:0},FunctionAssociations:{Quantity:0},AllowedMethods:z==="dynamic"?{Quantity:7,Items:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:{Quantity:2,Items:["GET","HEAD"]}}:{Quantity:3,Items:["GET","HEAD","OPTIONS"],CachedMethods:{Quantity:2,Items:["GET","HEAD"]}}};if($!==null)J.PathPattern=$;return J}function c9($){let z=$.aliases;if(z.length===0)throw Error("buildCloudFrontOriginConfig: at least one alias is required");if(z.includes($.originDomain))throw Error(`buildCloudFrontOriginConfig: originDomain ${$.originDomain} must not be one of the aliases (it would loop)`);if($.originShield&&!$.originShieldRegion)throw Error("buildCloudFrontOriginConfig: originShieldRegion is required when originShield is enabled");let J=$.originSecretHeader??"X-Origin-Verify",Z=$.originSecret?{Quantity:1,Items:[{HeaderName:J,HeaderValue:$.originSecret}]}:{Quantity:0},Q=[...$.behaviors??[]].sort((W,Y)=>Y.pathPattern.length-W.pathPattern.length);return{CallerReference:$.callerReference??$.originDomain,Comment:$.comment??`Origin-fronted distribution for ${z[0]} → ${$.originDomain}`,Enabled:!0,Aliases:{Quantity:z.length,Items:z},DefaultRootObject:"",Origins:{Quantity:1,Items:[{Id:"origin",DomainName:$.originDomain,OriginPath:"",CustomHeaders:Z,CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:"https-only",OriginSslProtocols:{Quantity:1,Items:["TLSv1.2"]},OriginReadTimeout:30,OriginKeepaliveTimeout:5},ConnectionAttempts:3,ConnectionTimeout:10,OriginShield:$.originShield?{Enabled:!0,OriginShieldRegion:$.originShieldRegion}:{Enabled:!1},OriginAccessControlId:""}]},OriginGroups:{Quantity:0},DefaultCacheBehavior:O4(null,"static"),CacheBehaviors:{Quantity:Q.length,Items:Q.map((W)=>O4(W.pathPattern,W.kind))},ViewerCertificate:{CloudFrontDefaultCertificate:!1,ACMCertificateArn:$.viewerCertificateArn,Certificate:$.viewerCertificateArn,CertificateSource:"acm",SSLSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"},PriceClass:$.priceClass??"PriceClass_All",HttpVersion:"http2and3",IsIPV6Enabled:!0,Restrictions:{GeoRestriction:{RestrictionType:"none",Quantity:0}},Logging:{Enabled:!1,IncludeCookies:!1,Bucket:"",Prefix:""},WebACLId:"",CustomErrorResponses:{Quantity:0}}}export{l9 as Uf,U4 as Vf,K0 as Wf,C4 as Xf,x4 as Yf,p9 as Zf,L4 as _f,A4 as $f,R4 as ag,n9 as bg,d as cg,O$ as dg,D2 as eg,J1 as fg,Z1 as gg,q5 as hg,N2 as ig,G1 as jg,e0 as kg,H1 as lg,F6 as mg,I2 as ng,Q0 as og,B6 as pg,C5 as qg,x5 as rg,L5 as sg,D5 as tg,V1 as ug,O1 as vg,U6 as wg,S2 as xg,X1 as yg,B0 as zg,h0 as Ag,A6 as Bg,z$ as Cg,K1 as Dg,F0 as Eg,U0 as Fg,J$ as Gg,s as Hg,A$ as Ig,u6 as Jg,k$ as Kg,c6 as Lg,R0 as Mg,x0 as Ng,L0 as Og,T$ as Pg,w1 as Qg,z8 as Rg,Fz as Sg,QZ as Tg,Bz as Ug,Uz as Vg,Q8 as Wg,R1 as Xg,P$ as Yg,H0 as Zg,W8 as _g,N1 as $g,Y8 as ah,E1 as bh,K8 as ch,F8 as dh,xz as eh,Lz as fh,L8 as gh,D8 as hh,w8 as ih,k1 as jh,Az as kh,k8 as lh,_8 as mh,T8 as nh,_1 as oh,T1 as ph,y1 as qh,P1 as rh,I1 as sh,S1 as th,f1 as uh,b1 as vh,I8 as wh,q$ as xh,NZ as yh,l1 as zh,p1 as Ah,r1 as Bh,G$ as Ch,a1 as Dh,n1 as Eh,i1 as Fh,$9 as Gh,mz as Hh,J9 as Ih,Y9 as Jh,Q2 as Kh,cz as Lh,rz as Mh,V4 as Nh,v9 as Oh,V2 as Ph,u9 as Qh,m9 as Rh,g9 as Sh,d9 as Th,c9 as Uh};