@stacksjs/ts-cloud 0.12.10 → 0.12.11

package/dist/{chunk-jphewtbx.js → chunk-ze5x2bpm.js}

@@ -1,2 +1,2 @@
-import{wi as s}from"./chunk-a368cs92.js";class a{client;region;constructor(e="us-east-1",r){this.region=e,this.client=new s(void 0,{profile:r})}async createRepository(e){let r={repositoryName:e.repositoryName};if(e.imageTagMutability)r.imageTagMutability=e.imageTagMutability;if(e.imageScanningConfiguration)r.imageScanningConfiguration=e.imageScanningConfiguration;if(e.encryptionConfiguration)r.encryptionConfiguration=e.encryptionConfiguration;if(e.tags&&e.tags.length>0)r.tags=e.tags;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.CreateRepository","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{repository:t.repository?this.parseRepository(t.repository):void 0}}async describeRepositories(e){let r={};if(e?.repositoryNames&&e.repositoryNames.length>0)r.repositoryNames=e.repositoryNames;if(e?.registryId)r.registryId=e.registryId;if(e?.maxResults)r.maxResults=e.maxResults;if(e?.nextToken)r.nextToken=e.nextToken;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.DescribeRepositories","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{repositories:t.repositories?.map((i)=>this.parseRepository(i)),nextToken:t.nextToken}}async getAuthorizationToken(e){let r={};if(e&&e.length>0)r.registryIds=e;return{authorizationData:(await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.GetAuthorizationToken","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})).authorizationData?.map((i)=>({authorizationToken:i.authorizationToken,expiresAt:i.expiresAt,proxyEndpoint:i.proxyEndpoint}))}}async deleteRepository(e){let r={repositoryName:e.repositoryName};if(e.registryId)r.registryId=e.registryId;if(e.force!==void 0)r.force=e.force;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.DeleteRepository","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{repository:t.repository?this.parseRepository(t.repository):void 0}}async describeImages(e){let r={repositoryName:e.repositoryName};if(e.registryId)r.registryId=e.registryId;if(e.imageIds&&e.imageIds.length>0)r.imageIds=e.imageIds;if(e.filter)r.filter=e.filter;if(e.maxResults)r.maxResults=e.maxResults;if(e.nextToken)r.nextToken=e.nextToken;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.DescribeImages","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{imageDetails:t.imageDetails?.map((i)=>this.parseImageDetail(i)),nextToken:t.nextToken}}async batchDeleteImage(e){let r={repositoryName:e.repositoryName,imageIds:e.imageIds};if(e.registryId)r.registryId=e.registryId;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.BatchDeleteImage","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{imageIds:t.imageIds,failures:t.failures}}async putLifecyclePolicy(e){let r={repositoryName:e.repositoryName,lifecyclePolicyText:e.lifecyclePolicyText};if(e.registryId)r.registryId=e.registryId;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.PutLifecyclePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{registryId:t.registryId,repositoryName:t.repositoryName,lifecyclePolicyText:t.lifecyclePolicyText}}async getLifecyclePolicy(e){let r={repositoryName:e.repositoryName};if(e.registryId)r.registryId=e.registryId;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.GetLifecyclePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{registryId:t.registryId,repositoryName:t.repositoryName,lifecyclePolicyText:t.lifecyclePolicyText,lastEvaluatedAt:t.lastEvaluatedAt}}async setRepositoryPolicy(e){let r={repositoryName:e.repositoryName,policyText:e.policyText};if(e.registryId)r.registryId=e.registryId;if(e.force!==void 0)r.force=e.force;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.SetRepositoryPolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{registryId:t.registryId,repositoryName:t.repositoryName,policyText:t.policyText}}async getRepositoryPolicy(e){let r={repositoryName:e.repositoryName};if(e.registryId)r.registryId=e.registryId;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.GetRepositoryPolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{registryId:t.registryId,repositoryName:t.repositoryName,policyText:t.policyText}}async tagResource(e){let r={resourceArn:e.resourceArn,tags:e.tags};await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.TagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async listTagsForResource(e){let r={resourceArn:e};return{tags:(await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.ListTagsForResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})).tags}}createLifecyclePolicyText(e){return JSON.stringify({rules:e.map((r)=>({rulePriority:r.rulePriority,description:r.description,selection:r.selection,action:r.action}))})}async getDockerLoginCommand(){let e=await this.getAuthorizationToken();if(!e.authorizationData?.[0])throw Error("Failed to get authorization token");let r=e.authorizationData[0],t=r.authorizationToken||"",i=r.proxyEndpoint||"";return`echo "${Buffer.from(t,"base64").toString("utf8").split(":")[1]}" | docker login --username AWS --password-stdin ${i}`}getRegistryUri(e){return`${e}.dkr.ecr.${this.region}.amazonaws.com`}parseRepository(e){return{repositoryArn:e.repositoryArn,registryId:e.registryId,repositoryName:e.repositoryName,repositoryUri:e.repositoryUri,createdAt:e.createdAt,imageTagMutability:e.imageTagMutability,imageScanningConfiguration:e.imageScanningConfiguration,encryptionConfiguration:e.encryptionConfiguration}}parseImageDetail(e){return{registryId:e.registryId,repositoryName:e.repositoryName,imageDigest:e.imageDigest,imageTags:e.imageTags,imageSizeInBytes:e.imageSizeInBytes,imagePushedAt:e.imagePushedAt,imageScanStatus:e.imageScanStatus,imageScanFindingsSummary:e.imageScanFindingsSummary}}}
+import{tj as s}from"./chunk-ac87ds1k.js";class a{client;region;constructor(e="us-east-1",r){this.region=e,this.client=new s(void 0,{profile:r})}async createRepository(e){let r={repositoryName:e.repositoryName};if(e.imageTagMutability)r.imageTagMutability=e.imageTagMutability;if(e.imageScanningConfiguration)r.imageScanningConfiguration=e.imageScanningConfiguration;if(e.encryptionConfiguration)r.encryptionConfiguration=e.encryptionConfiguration;if(e.tags&&e.tags.length>0)r.tags=e.tags;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.CreateRepository","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{repository:t.repository?this.parseRepository(t.repository):void 0}}async describeRepositories(e){let r={};if(e?.repositoryNames&&e.repositoryNames.length>0)r.repositoryNames=e.repositoryNames;if(e?.registryId)r.registryId=e.registryId;if(e?.maxResults)r.maxResults=e.maxResults;if(e?.nextToken)r.nextToken=e.nextToken;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.DescribeRepositories","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{repositories:t.repositories?.map((i)=>this.parseRepository(i)),nextToken:t.nextToken}}async getAuthorizationToken(e){let r={};if(e&&e.length>0)r.registryIds=e;return{authorizationData:(await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.GetAuthorizationToken","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})).authorizationData?.map((i)=>({authorizationToken:i.authorizationToken,expiresAt:i.expiresAt,proxyEndpoint:i.proxyEndpoint}))}}async deleteRepository(e){let r={repositoryName:e.repositoryName};if(e.registryId)r.registryId=e.registryId;if(e.force!==void 0)r.force=e.force;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.DeleteRepository","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{repository:t.repository?this.parseRepository(t.repository):void 0}}async describeImages(e){let r={repositoryName:e.repositoryName};if(e.registryId)r.registryId=e.registryId;if(e.imageIds&&e.imageIds.length>0)r.imageIds=e.imageIds;if(e.filter)r.filter=e.filter;if(e.maxResults)r.maxResults=e.maxResults;if(e.nextToken)r.nextToken=e.nextToken;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.DescribeImages","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{imageDetails:t.imageDetails?.map((i)=>this.parseImageDetail(i)),nextToken:t.nextToken}}async batchDeleteImage(e){let r={repositoryName:e.repositoryName,imageIds:e.imageIds};if(e.registryId)r.registryId=e.registryId;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.BatchDeleteImage","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{imageIds:t.imageIds,failures:t.failures}}async putLifecyclePolicy(e){let r={repositoryName:e.repositoryName,lifecyclePolicyText:e.lifecyclePolicyText};if(e.registryId)r.registryId=e.registryId;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.PutLifecyclePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{registryId:t.registryId,repositoryName:t.repositoryName,lifecyclePolicyText:t.lifecyclePolicyText}}async getLifecyclePolicy(e){let r={repositoryName:e.repositoryName};if(e.registryId)r.registryId=e.registryId;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.GetLifecyclePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{registryId:t.registryId,repositoryName:t.repositoryName,lifecyclePolicyText:t.lifecyclePolicyText,lastEvaluatedAt:t.lastEvaluatedAt}}async setRepositoryPolicy(e){let r={repositoryName:e.repositoryName,policyText:e.policyText};if(e.registryId)r.registryId=e.registryId;if(e.force!==void 0)r.force=e.force;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.SetRepositoryPolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{registryId:t.registryId,repositoryName:t.repositoryName,policyText:t.policyText}}async getRepositoryPolicy(e){let r={repositoryName:e.repositoryName};if(e.registryId)r.registryId=e.registryId;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.GetRepositoryPolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{registryId:t.registryId,repositoryName:t.repositoryName,policyText:t.policyText}}async tagResource(e){let r={resourceArn:e.resourceArn,tags:e.tags};await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.TagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async listTagsForResource(e){let r={resourceArn:e};return{tags:(await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.ListTagsForResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})).tags}}createLifecyclePolicyText(e){return JSON.stringify({rules:e.map((r)=>({rulePriority:r.rulePriority,description:r.description,selection:r.selection,action:r.action}))})}async getDockerLoginCommand(){let e=await this.getAuthorizationToken();if(!e.authorizationData?.[0])throw Error("Failed to get authorization token");let r=e.authorizationData[0],t=r.authorizationToken||"",i=r.proxyEndpoint||"";return`echo "${Buffer.from(t,"base64").toString("utf8").split(":")[1]}" | docker login --username AWS --password-stdin ${i}`}getRegistryUri(e){return`${e}.dkr.ecr.${this.region}.amazonaws.com`}parseRepository(e){return{repositoryArn:e.repositoryArn,registryId:e.registryId,repositoryName:e.repositoryName,repositoryUri:e.repositoryUri,createdAt:e.createdAt,imageTagMutability:e.imageTagMutability,imageScanningConfiguration:e.imageScanningConfiguration,encryptionConfiguration:e.encryptionConfiguration}}parseImageDetail(e){return{registryId:e.registryId,repositoryName:e.repositoryName,imageDigest:e.imageDigest,imageTags:e.imageTags,imageSizeInBytes:e.imageSizeInBytes,imagePushedAt:e.imagePushedAt,imageScanStatus:e.imageScanStatus,imageScanFindingsSummary:e.imageScanFindingsSummary}}}
 export{a as Vf};

package/dist/{chunk-jxrs1219.js → chunk-zh0apedk.js}

@@ -1,4 +1,4 @@
-import{Uf as U}from"./chunk-7j100g7w.js";import{eg as Z,jg as _,ng as K,rg as L,sg as Y}from"./chunk-rg7d67xk.js";import{tg as M}from"./chunk-982rye5b.js";import{si as W}from"./chunk-c8cadhgc.js";import{ui as B}from"./chunk-70v77sqv.js";import{Qu as j}from"./chunk-0hw5wjjg.js";function J(t){let{bucketName:s,domain:l,aliases:e,certificateArn:m,defaultRootObject:i="index.html",errorDocument:r="404.html",passthroughUrls:a=!1,singlePageApp:d=!1,dynamicApp:b=!1,computeOriginDomain:k,computeOriginPort:R=3008,computeOriginId:P="app-compute",retainOnStackDelete:x=!1}=t,A=x?{DeletionPolicy:"Retain",UpdateReplacePolicy:"Retain"}:{},y=b&&!!k,T=y?["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"]:["GET","HEAD"],F=y?["GET","HEAD"]:["GET","HEAD"],N={},O={};N.S3Bucket={Type:"AWS::S3::Bucket",...A,Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},O.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},O.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},N.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",...A,Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}};let D;if(a&&y)D="InstallRootRedirectFunction",N[D]={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-install-root-redirect"},AutoPublish:!0,FunctionConfig:{Comment:"Redirect curl pantry.dev | bash (GET /) to /install.sh on S3",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
+import{Uf as U}from"./chunk-n1fyryha.js";import{eg as Z,jg as _,ng as K,rg as L,sg as Y}from"./chunk-j06r5rwv.js";import{tg as M}from"./chunk-2ybcnrte.js";import{pj as W}from"./chunk-ess6vxfj.js";import{rj as B}from"./chunk-j1g67djb.js";import{Ov as j}from"./chunk-zjyz926j.js";function J(t){let{bucketName:s,domain:l,aliases:e,certificateArn:m,defaultRootObject:i="index.html",errorDocument:r="404.html",passthroughUrls:a=!1,singlePageApp:d=!1,dynamicApp:b=!1,computeOriginDomain:k,computeOriginPort:R=3008,computeOriginId:P="app-compute",retainOnStackDelete:x=!1}=t,A=x?{DeletionPolicy:"Retain",UpdateReplacePolicy:"Retain"}:{},y=b&&!!k,T=y?["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"]:["GET","HEAD"],F=y?["GET","HEAD"]:["GET","HEAD"],N={},O={};N.S3Bucket={Type:"AWS::S3::Bucket",...A,Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},O.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},O.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},N.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",...A,Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}};let D;if(a&&y)D="InstallRootRedirectFunction",N[D]={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-install-root-redirect"},AutoPublish:!0,FunctionConfig:{Comment:"Redirect curl pantry.dev | bash (GET /) to /install.sh on S3",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
   var request = event.request;
   if (request.uri === '/' || request.uri === '') {
     return {
@@ -42,7 +42,7 @@ import{Uf as U}from"./chunk-7j100g7w.js";import{eg as Z,jg as _,ng as K,rg as L,
 │                                                                             │
 │  Verification typically takes 1-2 business days.                            │
 │  After verification, re-run: bunx bunpress deploy                           │
-└─────────────────────────────────────────────────────────────────────────────┘`),{success:!1,stackId:O,stackName:i,bucket:y,message:"CloudFront account verification required. Please contact AWS Support."}}return{success:!1,stackId:O,stackName:i,bucket:y,message:`Stack deployment failed: ${o.message}`}}let u=(await r.describeStacks({stackName:i})).Stacks[0]?.Outputs||[],C=(o)=>u.find((n)=>n.OutputKey===o)?.OutputValue,f=C("DistributionDomain");if(f&&d)console.log(`Creating DNS records via ${d.name}...`),await q(d,e,f);else if(f&&!d)console.log("Skipping DNS record creation (DNS verification was skipped)");return{success:!0,stackId:O,stackName:i,bucket:C("BucketName")||y,distributionId:C("DistributionId"),distributionDomain:f,domain:e,certificateArn:b,message:"Static site infrastructure deployed successfully with external DNS"}}async function q(t,s,l){if(!t){console.log("Skipping DNS record creation (DNS verification was skipped)");return}if(s.split(".").length===2)if(t instanceof Z){console.log(`Creating Route53 alias record for apex domain ${s} -> ${l}`);let i=await t.createCloudFrontAlias({domain:s,name:s,cloudFrontDomainName:l});if(!i.success)console.warn(`Warning: Could not create Route53 alias record: ${i.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${s} -> ${l}`);else console.log(`Created Route53 alias record: ${s} -> ${l}`);let r=`www.${s}`;console.log(`Creating Route53 alias record for ${r} -> ${l}`);let a=await t.createCloudFrontAlias({domain:s,name:r,cloudFrontDomainName:l});if(!a.success)console.warn(`Warning: Could not create www Route53 alias: ${a.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${r} -> ${l}`);else console.log(`Created Route53 alias record: ${r} -> ${l}`)}else{try{let d=await t.listRecords(s,"A");if(d.success)for(let b of d.records){let k=b.name.replace(/\.$/,"");if(k===s||k==="")console.log(`Removing existing root A record (${b.content}) to make room for ALIAS...`),await t.deleteRecord(s,{name:s,type:"A",content:b.content})}}catch(d){console.log(`Note: Could not check for conflicting A records: ${d instanceof Error?d.message:d}`)}console.log(`Creating ALIAS record for apex domain ${s} -> ${l}`);let i=await t.upsertRecord(s,{name:s,type:"ALIAS",content:l,ttl:600});if(!i.success)console.warn(`Warning: Could not create ALIAS record: ${i.message}`),console.warn("Please manually create an ALIAS record in your DNS provider:"),console.warn(`  ${s} -> ${l}`);else console.log(`Created ALIAS record: ${s} -> ${l}`);let r=`www.${s}`;console.log(`Creating CNAME record for ${r} -> ${l}`);let a=await t.upsertRecord(s,{name:r,type:"CNAME",content:l,ttl:600});if(!a.success)console.warn(`Warning: Could not create www DNS record: ${a.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${r} -> ${l}`);else console.log(`Created CNAME record: ${r} -> ${l}`)}else{console.log(`Creating CNAME record for ${s} -> ${l}`);let i=await t.upsertRecord(s,{name:s,type:"CNAME",content:l,ttl:600});if(!i.success)console.warn(`Warning: Could not create DNS record: ${i.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${s} -> ${l}`);else console.log(`Created CNAME record: ${s} -> ${l}`)}}async function le(t){let{sourceDir:s,cleanBucket:l=!1,onProgress:e,...m}=t;e?.("infrastructure","Deploying CloudFormation stack...");let i=await G(m);if(!i.success)return i;if(l){e?.("clean","Cleaning old files from S3...");try{await new B(m.region||"us-east-1").emptyBucket(i.bucket)}catch(b){console.log(`Note: Could not clean bucket: ${b.message}`)}}e?.("upload","Uploading files to S3...");let{uploadStaticFiles:r}=await import("./chunk-1bj94sc2.js"),a=await r({sourceDir:s,bucket:i.bucket,region:m.region||"us-east-1",cacheControl:m.cacheControl,onProgress:(b,k,R)=>{e?.("upload",`${b}/${k}: ${R}`)}});if(a.errors.length>0)return{...i,success:!1,message:`Upload errors: ${a.errors.join(", ")}`,filesUploaded:a.uploaded};if(i.distributionId&&a.uploaded>0){e?.("invalidate","Invalidating CloudFront cache...");let{invalidateCache:b}=await import("./chunk-1bj94sc2.js");await b(i.distributionId)}e?.("complete","Deployment complete!");let d=a.skipped>0?`Deployed ${a.uploaded} files (${a.skipped} unchanged) with external DNS`:`Deployed ${a.uploaded} files successfully with external DNS`;return{...i,filesUploaded:a.uploaded,filesSkipped:a.skipped,message:d}}function Q(t){let{bucketName:s,domain:l,certificateArn:e,hostedZoneId:m,defaultRootObject:i="index.html",errorDocument:r="404.html"}=t,a={},d={};a.S3Bucket={Type:"AWS::S3::Bucket",Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},d.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},d.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},a.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},a.UrlRewriteFunction={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-url-rewrite"},AutoPublish:!0,FunctionConfig:{Comment:"Append .html extension to URLs without extensions",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
+└─────────────────────────────────────────────────────────────────────────────┘`),{success:!1,stackId:O,stackName:i,bucket:y,message:"CloudFront account verification required. Please contact AWS Support."}}return{success:!1,stackId:O,stackName:i,bucket:y,message:`Stack deployment failed: ${o.message}`}}let u=(await r.describeStacks({stackName:i})).Stacks[0]?.Outputs||[],C=(o)=>u.find((n)=>n.OutputKey===o)?.OutputValue,f=C("DistributionDomain");if(f&&d)console.log(`Creating DNS records via ${d.name}...`),await q(d,e,f);else if(f&&!d)console.log("Skipping DNS record creation (DNS verification was skipped)");return{success:!0,stackId:O,stackName:i,bucket:C("BucketName")||y,distributionId:C("DistributionId"),distributionDomain:f,domain:e,certificateArn:b,message:"Static site infrastructure deployed successfully with external DNS"}}async function q(t,s,l){if(!t){console.log("Skipping DNS record creation (DNS verification was skipped)");return}if(s.split(".").length===2)if(t instanceof Z){console.log(`Creating Route53 alias record for apex domain ${s} -> ${l}`);let i=await t.createCloudFrontAlias({domain:s,name:s,cloudFrontDomainName:l});if(!i.success)console.warn(`Warning: Could not create Route53 alias record: ${i.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${s} -> ${l}`);else console.log(`Created Route53 alias record: ${s} -> ${l}`);let r=`www.${s}`;console.log(`Creating Route53 alias record for ${r} -> ${l}`);let a=await t.createCloudFrontAlias({domain:s,name:r,cloudFrontDomainName:l});if(!a.success)console.warn(`Warning: Could not create www Route53 alias: ${a.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${r} -> ${l}`);else console.log(`Created Route53 alias record: ${r} -> ${l}`)}else{try{let d=await t.listRecords(s,"A");if(d.success)for(let b of d.records){let k=b.name.replace(/\.$/,"");if(k===s||k==="")console.log(`Removing existing root A record (${b.content}) to make room for ALIAS...`),await t.deleteRecord(s,{name:s,type:"A",content:b.content})}}catch(d){console.log(`Note: Could not check for conflicting A records: ${d instanceof Error?d.message:d}`)}console.log(`Creating ALIAS record for apex domain ${s} -> ${l}`);let i=await t.upsertRecord(s,{name:s,type:"ALIAS",content:l,ttl:600});if(!i.success)console.warn(`Warning: Could not create ALIAS record: ${i.message}`),console.warn("Please manually create an ALIAS record in your DNS provider:"),console.warn(`  ${s} -> ${l}`);else console.log(`Created ALIAS record: ${s} -> ${l}`);let r=`www.${s}`;console.log(`Creating CNAME record for ${r} -> ${l}`);let a=await t.upsertRecord(s,{name:r,type:"CNAME",content:l,ttl:600});if(!a.success)console.warn(`Warning: Could not create www DNS record: ${a.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${r} -> ${l}`);else console.log(`Created CNAME record: ${r} -> ${l}`)}else{console.log(`Creating CNAME record for ${s} -> ${l}`);let i=await t.upsertRecord(s,{name:s,type:"CNAME",content:l,ttl:600});if(!i.success)console.warn(`Warning: Could not create DNS record: ${i.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${s} -> ${l}`);else console.log(`Created CNAME record: ${s} -> ${l}`)}}async function le(t){let{sourceDir:s,cleanBucket:l=!1,onProgress:e,...m}=t;e?.("infrastructure","Deploying CloudFormation stack...");let i=await G(m);if(!i.success)return i;if(l){e?.("clean","Cleaning old files from S3...");try{await new B(m.region||"us-east-1").emptyBucket(i.bucket)}catch(b){console.log(`Note: Could not clean bucket: ${b.message}`)}}e?.("upload","Uploading files to S3...");let{uploadStaticFiles:r}=await import("./chunk-8fh4m5ge.js"),a=await r({sourceDir:s,bucket:i.bucket,region:m.region||"us-east-1",cacheControl:m.cacheControl,onProgress:(b,k,R)=>{e?.("upload",`${b}/${k}: ${R}`)}});if(a.errors.length>0)return{...i,success:!1,message:`Upload errors: ${a.errors.join(", ")}`,filesUploaded:a.uploaded};if(i.distributionId&&a.uploaded>0){e?.("invalidate","Invalidating CloudFront cache...");let{invalidateCache:b}=await import("./chunk-8fh4m5ge.js");await b(i.distributionId)}e?.("complete","Deployment complete!");let d=a.skipped>0?`Deployed ${a.uploaded} files (${a.skipped} unchanged) with external DNS`:`Deployed ${a.uploaded} files successfully with external DNS`;return{...i,filesUploaded:a.uploaded,filesSkipped:a.skipped,message:d}}function Q(t){let{bucketName:s,domain:l,certificateArn:e,hostedZoneId:m,defaultRootObject:i="index.html",errorDocument:r="404.html"}=t,a={},d={};a.S3Bucket={Type:"AWS::S3::Bucket",Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},d.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},d.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},a.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},a.UrlRewriteFunction={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-url-rewrite"},AutoPublish:!0,FunctionConfig:{Comment:"Append .html extension to URLs without extensions",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
   const request = event.request;
   var uri = request.uri;
 

package/dist/{chunk-0hw5wjjg.js → chunk-zjyz926j.js}

@@ -1,2 +1,2 @@
 import{createRequire as q}from"node:module";var j=Object.create;var{getPrototypeOf:k,defineProperty:i,getOwnPropertyNames:l}=Object;var m=Object.prototype.hasOwnProperty;function n(a){return this[a]}var o,p,r=(a,b,d)=>{var f=a!=null&&typeof a==="object";if(f){var g=b?o??=new WeakMap:p??=new WeakMap,h=g.get(a);if(h)return h}d=a!=null?j(k(a)):{};let c=b||!a||!a.__esModule?i(d,"default",{value:a,enumerable:!0}):d;if(a&&typeof a==="object"||typeof a==="function"){for(let e of l(a))if(!m.call(c,e))i(c,e,{get:n.bind(a,e),enumerable:!0})}if(f)g.set(a,c);return c};var s=(a,b)=>()=>(b||a((b={exports:{}}).exports,b),b.exports);var u=q(import.meta.url);
-export{r as Ou,s as Pu,u as Qu};
+export{r as Mv,s as Nv,u as Ov};

package/dist/deploy/index.js

@@ -1 +1 @@
-import{$c as ra,Ac as I,Bc as J,Cc as K,Dc as L,Ec as M,Fc as N,Gc as O,Hc as P,Ic as Q,Jc as R,Kc as S,Lc as T,Mc as U,Nc as V,Oc as W,Pc as X,Pd as Ha,Qc as ga,Qd as Ia,Rc as ha,Rd as Ja,Sc as ia,Sd as Ka,Tc as ja,Uc as ka,Vc as la,Wc as ma,Xc as na,Yc as oa,Zc as pa,_c as qa,ad as ta,bd as ua,cd as va,dd as wa,ed as xa,fd as ya,gd as za,hd as Aa,id as Ba,jd as Ca,kd as Da,ld as Ea,md as Fa,nd as Ga,xc as F,yc as G,zc as H}from"../chunk-y3tbcxb7.js";import{$d as fa,Td as Y,Ud as Z,Vd as _,Wd as aa,Xd as ba,Yd as ca,Zd as da,_d as ea}from"../chunk-jxrs1219.js";import{he as sa}from"../chunk-2k0mt6j5.js";import"../chunk-gkj1tpsn.js";import"../chunk-82gezmen.js";import"../chunk-7j100g7w.js";import"../chunk-jphewtbx.js";import"../chunk-fbwpm0zm.js";import"../chunk-rg7d67xk.js";import"../chunk-982rye5b.js";import{$h as D,Ag as y,Xh as z,Yh as A,Zh as B,_h as C,ai as E,ug as s,vg as t,wg as u,xg as v,yg as w,zg as x}from"../chunk-3swnmwfc.js";import"../chunk-bcffjsnj.js";import"../chunk-557qj7q9.js";import"../chunk-c8cadhgc.js";import"../chunk-70v77sqv.js";import"../chunk-a368cs92.js";import{rj as l,sj as m,tj as n,uj as o,vj as p,wj as q,xj as r}from"../chunk-2qm3rw8b.js";import{Aj as c,Bj as d,Cj as e,Dj as f,Ej as g,Fj as h,Gj as i,Hj as j,Ij as k,yj as a,zj as b}from"../chunk-c1hr34a5.js";import"../chunk-5hkq5081.js";import"../chunk-pb47hr0h.js";import"../chunk-fsssdd5k.js";import"../chunk-0hw5wjjg.js";export{m as DEFAULT_SITE_PORT_RANGE,l as HOST_SITES_DIR,v as IPV6_EXCLUDED_HOST_LABELS,z as MANAGEMENT_DASHBOARD_SITE,F as addSiteToCloudConfig,r as allocateSitePorts,ra as buildAndPushContainerImage,sa as buildAndPushServerlessImage,ua as buildFunctionEnv,p as buildHostSitePortsScript,E as buildManagementDashboardArtifact,Aa as buildServerTopology,Ba as buildServerlessTopology,Ca as buildTopology,Ga as collectEgressMetrics,s as collectServerDnsDomains,qa as createContainerImageDependencies,la as createExistingStaticFullStackDependencies,ha as createStaticApiOriginDependencies,Ia as dashboardActions,A as dashboardCredentialsFile,V as dashboardPageRoutes,ea as deleteStaticSite,na as deployExistingStaticFullStack,va as deployServerlessApp,k as deployShipsFiles,ga as deploySite,ia as deployStaticApiOrigin,ba as deployStaticSite,fa as deployStaticSiteFull,Z as deployStaticSiteWithExternalDns,_ as deployStaticSiteWithExternalDnsFull,Ea as egressReportMetrics,R as ensureDashboardActor,D as ensureManagementDashboard,oa as estimateExistingStaticFullStackMonthlyCost,ka as estimateStaticApiOriginMonthlyCost,Fa as fetchEgressReport,ma as generateExistingStaticFullStackTemplate,Y as generateExternalDnsStaticSiteTemplate,aa as generateStaticSiteTemplate,g as hasComputeConfigured,d as hasProxyUpstream,pa as hashContainerContext,w as hostAcceptsIpv6,ta as infraEnvFromOutputs,S as initializeDashboardControlPlane,da as invalidateCache,b as isPhpSite,M as isValidHostname,u as normalizePublicIpv6,o as occupiedHostPorts,q as parseHostSiteFragments,n as parseUpstreamPort,x as reconcileAddressRecords,wa as redeployServerlessApp,G as removeSiteFromCloudConfig,t as removeStaleServerAddressRecords,N as renderAliasesValue,L as renderEnvValue,O as renderRedirectsValue,P as renderSiteSnippet,J as renderSslValue,K as renderStringValue,Ja as resolveDashboardAction,B as resolveDashboardAuth,Da as resolveDashboardData,W as resolveLegacyDashboardRoute,c as resolveProxyUpstreams,e as resolveSiteDeployTarget,f as resolveSiteKind,C as resolveUiSource,xa as rollbackServerlessApp,X as routesForDashboard,za as runRemoteCommand,Ha as sanitizeCloudConfig,Q as setAttachToInCloudConfig,ya as setMaintenance,I as setSitePropertyInCloudConfig,i as shipsARelease,j as shipsToBucket,a as siteInstallBase,Ka as startLocalDashboardServer,T as synchronizeDashboardUsers,U as trackDashboardOperation,H as updateSiteInCloudConfig,ca as uploadStaticFiles,h as validateDeploymentConfig,y as verifyAddressRecord,ja as verifyStaticApiOrigin};
+import{$c as ra,Ac as I,Bc as J,Cc as K,Dc as L,Ec as M,Fc as N,Gc as O,Hc as P,Ic as Q,Jc as R,Kc as S,Lc as T,Mc as U,Nc as V,Oc as W,Pc as X,Pd as Ha,Qc as ga,Qd as Ia,Rc as ha,Rd as Ja,Sc as ia,Sd as Ka,Tc as ja,Uc as ka,Vc as la,Wc as ma,Xc as na,Yc as oa,Zc as pa,_c as qa,ad as ta,bd as ua,cd as va,dd as wa,ed as xa,fd as ya,gd as za,hd as Aa,id as Ba,jd as Ca,kd as Da,ld as Ea,md as Fa,nd as Ga,xc as F,yc as G,zc as H}from"../chunk-0a4tqwm9.js";import{$d as fa,Td as Y,Ud as Z,Vd as _,Wd as aa,Xd as ba,Yd as ca,Zd as da,_d as ea}from"../chunk-zh0apedk.js";import{he as sa}from"../chunk-whyttetx.js";import"../chunk-yf8stygs.js";import"../chunk-mnmz8t7q.js";import"../chunk-n1fyryha.js";import"../chunk-ze5x2bpm.js";import"../chunk-k8x8mrkr.js";import"../chunk-j06r5rwv.js";import"../chunk-2ybcnrte.js";import{Ag as y,Ui as z,Vi as A,Wi as B,Xi as C,Yi as D,Zi as E,ug as s,vg as t,wg as u,xg as v,yg as w,zg as x}from"../chunk-fvpkxznh.js";import"../chunk-n5xmh0ma.js";import"../chunk-6cxb8d6y.js";import"../chunk-ess6vxfj.js";import"../chunk-j1g67djb.js";import"../chunk-ac87ds1k.js";import{ok as l,pk as m,qk as n,rk as o,sk as p,tk as q,uk as r}from"../chunk-7z50g5xz.js";import{Ak as f,Bk as g,Ck as h,Dk as i,Ek as j,Fk as k,vk as a,wk as b,xk as c,yk as d,zk as e}from"../chunk-n1hg0jxs.js";import"../chunk-q9a1z53k.js";import"../chunk-4wdxsnn2.js";import"../chunk-r8t25tbm.js";import"../chunk-zjyz926j.js";export{m as DEFAULT_SITE_PORT_RANGE,l as HOST_SITES_DIR,v as IPV6_EXCLUDED_HOST_LABELS,z as MANAGEMENT_DASHBOARD_SITE,F as addSiteToCloudConfig,r as allocateSitePorts,ra as buildAndPushContainerImage,sa as buildAndPushServerlessImage,ua as buildFunctionEnv,p as buildHostSitePortsScript,E as buildManagementDashboardArtifact,Aa as buildServerTopology,Ba as buildServerlessTopology,Ca as buildTopology,Ga as collectEgressMetrics,s as collectServerDnsDomains,qa as createContainerImageDependencies,la as createExistingStaticFullStackDependencies,ha as createStaticApiOriginDependencies,Ia as dashboardActions,A as dashboardCredentialsFile,V as dashboardPageRoutes,ea as deleteStaticSite,na as deployExistingStaticFullStack,va as deployServerlessApp,k as deployShipsFiles,ga as deploySite,ia as deployStaticApiOrigin,ba as deployStaticSite,fa as deployStaticSiteFull,Z as deployStaticSiteWithExternalDns,_ as deployStaticSiteWithExternalDnsFull,Ea as egressReportMetrics,R as ensureDashboardActor,D as ensureManagementDashboard,oa as estimateExistingStaticFullStackMonthlyCost,ka as estimateStaticApiOriginMonthlyCost,Fa as fetchEgressReport,ma as generateExistingStaticFullStackTemplate,Y as generateExternalDnsStaticSiteTemplate,aa as generateStaticSiteTemplate,g as hasComputeConfigured,d as hasProxyUpstream,pa as hashContainerContext,w as hostAcceptsIpv6,ta as infraEnvFromOutputs,S as initializeDashboardControlPlane,da as invalidateCache,b as isPhpSite,M as isValidHostname,u as normalizePublicIpv6,o as occupiedHostPorts,q as parseHostSiteFragments,n as parseUpstreamPort,x as reconcileAddressRecords,wa as redeployServerlessApp,G as removeSiteFromCloudConfig,t as removeStaleServerAddressRecords,N as renderAliasesValue,L as renderEnvValue,O as renderRedirectsValue,P as renderSiteSnippet,J as renderSslValue,K as renderStringValue,Ja as resolveDashboardAction,B as resolveDashboardAuth,Da as resolveDashboardData,W as resolveLegacyDashboardRoute,c as resolveProxyUpstreams,e as resolveSiteDeployTarget,f as resolveSiteKind,C as resolveUiSource,xa as rollbackServerlessApp,X as routesForDashboard,za as runRemoteCommand,Ha as sanitizeCloudConfig,Q as setAttachToInCloudConfig,ya as setMaintenance,I as setSitePropertyInCloudConfig,i as shipsARelease,j as shipsToBucket,a as siteInstallBase,Ka as startLocalDashboardServer,T as synchronizeDashboardUsers,U as trackDashboardOperation,H as updateSiteInCloudConfig,ca as uploadStaticFiles,h as validateDeploymentConfig,y as verifyAddressRecord,ja as verifyStaticApiOrigin};

package/dist/dns/index.js

@@ -1 +1 @@
-import{$f as d,Xf as a,Yf as b,Zf as c,ag as e,bg as f,cg as g,dg as h,eg as i,fg as j,gg as k,hg as l,ig as m,jg as n,kg as o,lg as p,mg as q,ng as r,og as s,pg as t,qg as u}from"../chunk-rg7d67xk.js";import"../chunk-982rye5b.js";import"../chunk-a368cs92.js";import"../chunk-0hw5wjjg.js";export{d as CloudflareProvider,t as DnsProviderFactory,c as GoDaddyProvider,a as PROXIABLE_RECORD_TYPES,b as PorkbunProvider,i as Route53Provider,n as UnifiedDnsValidator,l as applyZoneMigration,r as createDnsProvider,p as createGoDaddyValidator,o as createPorkbunValidator,q as createRoute53Validator,s as detectDnsProvider,u as dnsProviders,j as exportRoute53Zone,k as planZoneMigration,e as policyTag,f as qualifyName,h as reconcileDeclaredRecords,g as resolveDeclaredRecords,m as verifyZoneParity};
+import{$f as d,Xf as a,Yf as b,Zf as c,ag as e,bg as f,cg as g,dg as h,eg as i,fg as j,gg as k,hg as l,ig as m,jg as n,kg as o,lg as p,mg as q,ng as r,og as s,pg as t,qg as u}from"../chunk-j06r5rwv.js";import"../chunk-2ybcnrte.js";import"../chunk-ac87ds1k.js";import"../chunk-zjyz926j.js";export{d as CloudflareProvider,t as DnsProviderFactory,c as GoDaddyProvider,a as PROXIABLE_RECORD_TYPES,b as PorkbunProvider,i as Route53Provider,n as UnifiedDnsValidator,l as applyZoneMigration,r as createDnsProvider,p as createGoDaddyValidator,o as createPorkbunValidator,q as createRoute53Validator,s as detectDnsProvider,u as dnsProviders,j as exportRoute53Zone,k as planZoneMigration,e as policyTag,f as qualifyName,h as reconcileDeclaredRecords,g as resolveDeclaredRecords,m as verifyZoneParity};

package/dist/drivers/hetzner/cloud-init.d.ts

@@ -17,4 +17,17 @@ export { buildUbuntuBootstrapScript as generateUbuntuAppCloudInit, type UbuntuBo
  * inline under `runcmd:` silently breaks bun/caddy installation. Writing the
  * file (shebang preserved) and running `bash <file>` guarantees a bash shell.
  */
-export declare function wrapCloudInitUserData(bootstrapScript: string): string;
+export interface CloudInitUserDataExtras {
+    /** Where the script is written on the box. @default '/var/lib/cloud/ts-cloud-bootstrap.sh' */
+    scriptPath?: string;
+    /** File mode of the written script. @default '0755' */
+    permissions?: string;
+    /**
+     * Top-level cloud-config YAML emitted before `write_files:` (hostname,
+     * users, packages, ...). Complete lines, already at top-level indentation.
+     */
+    before?: string;
+    /** Top-level cloud-config YAML emitted after `runcmd:`. */
+    after?: string;
+}
+export declare function wrapCloudInitUserData(bootstrapScript: string, extras?: CloudInitUserDataExtras): string;

package/dist/drivers/hetzner/driver.d.ts

@@ -1,20 +1,7 @@
 import type { CloudDriver, ComputeStackOutputs, ComputeTarget, FindComputeTargetsOptions, ProvisionComputeOptions, ReachableResource, RemoteDeployResult, RunRemoteDeployOptions, UploadReleaseOptions, UploadReleaseResult } from '@ts-cloud/core';
 import { HetznerClient } from './client';
-/**
- * The part of the deploy script bash refused to parse.
- *
- * A syntax error names a line number in a file that only ever existed on the
- * box, and the deploy deletes it on the way out — so the one thing needed to
- * understand the failure is the one thing nobody can look at. Without this you
- * are reduced to guessing which generated fragment is unbalanced, or to
- * reproducing the whole script by hand from its builders.
- *
- * Only a window around the reported line, and every `KEY="value"` line inside
- * it is redacted: the script carries the runtime environment, and a deploy
- * failure must not become the reason a database password is in a CI log.
- */
-export declare function describeScriptSyntaxError(error: unknown, script: string): string;
-export declare function formatSshFailure(error: unknown): string;
+import { describeScriptSyntaxError, formatSshFailure } from '../shared/remote-failure';
+export { describeScriptSyntaxError, formatSshFailure };
 export interface HetznerDriverOptions {
     apiToken?: string;
     /**

package/dist/drivers/hetzner/state.d.ts

@@ -1,3 +1,13 @@
+/**
+ * Hetzner driver state.
+ *
+ * The file handling itself lives in `../shared/driver-state` (one reader and
+ * writer for every SSH-style driver); this module keeps the Hetzner-typed
+ * view of it so the driver, the dashboard and the CLI read `serverId` and
+ * friends without a cast at every call site.
+ */
+import type { DriverState } from '../shared/driver-state';
+export { LEGACY_DRIVER_STATE_DIR } from '../shared/driver-state';
 export interface HetznerDriverState {
     provider: 'hetzner';
     stackName: string;
@@ -30,7 +40,12 @@ export interface HetznerDriverState {
     lbServerId?: number;
     appServerIds?: number[];
 }
-export declare const STATE_DIR = "storage/cloud/state";
+/**
+ * The legacy, project-relative driver-state directory. Kept for callers that
+ * spell the path by hand; new code should ask `driverStateDir()` instead,
+ * which also honours a configured state directory.
+ */
+export declare const STATE_DIR: string;
 export declare function driverStatePath(stackName: string): string;
 export declare function readDriverState(stackName: string): Promise<HetznerDriverState | null>;
-export declare function writeDriverState(stackName: string, state: HetznerDriverState): Promise<void>;
+export declare function writeDriverState(stackName: string, state: DriverState): Promise<void>;

package/dist/drivers/index.d.ts

@@ -2,6 +2,21 @@ export * from './factory';
 export { AwsDriver } from './aws/driver';
 export { HetznerDriver } from './hetzner/driver';
 export { isBoxMode, LocalBoxDriver } from './local-box/driver';
+export { assertSshComputeConfig, SSH_DEPLOY_STORAGE_PATH, SSH_SKIP_BOOTSTRAP_ENV, SshDriver } from './ssh/driver';
+export type { SshDriverOptions } from './ssh/driver';
+export { resolveSshHostKeyPolicy, resolveSshHosts, resolveSshLan, resolveSshPort, resolveSshPrivateKeyPath, resolveSshProfile, resolveSshPublicIp, resolveSshSettings, resolveSshSudo, resolveSshUser, SSH_DEFAULTS, } from './ssh/config';
+export type { ResolvedSshHost, ResolvedSshSettings, SshHostKeyPolicyName, SshLanConfig, SshOverrides, SshProfile } from './ssh/config';
+export { assertArchSupported, buildSshBootstrapScript, RASPBERRY_PI_DEFAULT_SWAP_GB, SSH_BOOTSTRAP_MARKER_DIR, SSH_BOOTSTRAP_VERSION, sshBootstrapMarkerPath, } from './ssh/bootstrap';
+export type { SshBootstrapOptions } from './ssh/bootstrap';
+export { evaluatePreflight, formatPreflightFindings, parsePreflightFacts, preflightFailed, SSH_PREFLIGHT_SCRIPT, } from './ssh/preflight';
+export type { PreflightContext, SshPreflightFacts } from './ssh/preflight';
+export { BOOT_PARTITION_LABEL, buildCloudInitFirstBoot, FIRST_BOOT_SCRIPT_PATH } from './ssh/first-boot';
+export type { FirstBootBundle, FirstBootIdentity, FirstBootOptions, FirstBootOs, FirstBootWifi } from './ssh/first-boot';
+export { buildScpArgsFor, buildSshArgsFor, findKnownHostKey, knownHostsLine, knownHostsToken, scanHostKey, SSH_INSECURE_HOST_KEY_OPTS, SSH_KEEPALIVE_OPTS, sshHostKeyFingerprint, sshKnownHostsPath, SystemSshTransport, } from './shared/ssh-transport';
+export type { CommandResult, CommandRunner, ScannedHostKey, SshExecOptions, SshHostKeyPolicy, SshHostKeyResult, SshTransport, SshTransportOptions, SystemSshTransportDeps, } from './shared/ssh-transport';
+export { driverStateDir, driverStatePath, LEGACY_DRIVER_STATE_DIR, readDriverState, writeDriverState, } from './shared/driver-state';
+export type { DriverState, SshDriverState } from './shared/driver-state';
+export { describeScriptSyntaxError, formatSshFailure, summarizeRemoteFailures, surfaceRemoteNotices } from './shared/remote-failure';
 export { HetznerClient, normalizeSshPublicKey, resolveHetznerApiToken } from './hetzner/client';
 export { executeHetznerServerResize, isHetznerCapacityError, planHetznerServerResize, } from './hetzner/resize';
 export type { ExecuteHetznerResizeOptions, HetznerResizeHooks, HetznerResizePhase, HetznerResizePlan, HetznerResizeResult, HetznerResizeVerification, } from './hetzner/resize';
@@ -12,9 +27,10 @@ export type { HetznerHostOptimizationOptions, HetznerHostOptimizationPlan, Hetzn
 export { acquireResizeLock, readResizeCheckpoint, resizeCheckpointPath, resizeLockPath, writeResizeCheckpoint, } from './hetzner/resize-state';
 export type { HetznerResizeCheckpoint } from './hetzner/resize-state';
 export { generateUbuntuAppCloudInit, wrapCloudInitUserData } from './hetzner/cloud-init';
+export type { CloudInitUserDataExtras } from './hetzner/cloud-init';
 export { ensureFirewall, ensureServer, ensureSshKey, serverPublicIpv4 } from './hetzner/provision';
 export type { EnsuredResource, EnsuredServer, EnsureFirewallOptions, EnsureServerOptions, EnsureSshKeyOptions, } from './hetzner/provision';
-export { buildSshArgs, scpUpload, sshExec, sshExecOrThrow, waitForCloudInit, waitForSsh } from './shared/remote-exec';
+export { buildSshArgs, REMOTE_SCRIPT_RUNNER, remoteScriptRunner, scpUpload, sshExec, sshExecOrThrow, waitForCloudInit, waitForSsh } from './shared/remote-exec';
 export type { RemoteExecOptions, RemoteExecResult, WaitOptions } from './shared/remote-exec';
 export { AwsBoxProvisioner, buildBoxUserData, createBoxProvisioner, HetznerBoxProvisioner, UBUNTU_2404_AMI_PARAM, } from './shared/box-provision';
 export type { AwsBoxProvisionerOptions, BoxPort, BoxProviderName, BoxProvisioner, BoxSpec, CreateBoxProvisionerOptions, ProvisionedBox, } from './shared/box-provision';

package/dist/drivers/index.js

@@ -1 +1 @@
-import{$g as q,Ah as Q,Bh as R,Ch as S,Dh as T,Eh as U,Fh as V,Gh as W,Hh as X,Ih as Y,Jh as Z,Kh as _,Lg as a,Lh as aa,Mg as b,Mh as ba,Ng as c,Nh as ca,Og as d,Pg as e,Qg as f,Qh as da,Rg as g,Rh as ea,Sg as h,Sh as fa,Tg as i,Th as ga,Ug as j,Uh as ha,Vg as k,Vh as ia,Wg as l,Wh as ja,Xg as m,Yg as n,Zg as o,_g as p,ah as r,bh as s,ch as t,ci as ka,dh as u,di as la,ei as ma,fh as v,fi as na,gh as w,gi as oa,hh as x,hi as pa,ih as y,ii as qa,jh as z,ji as ra,kh as A,lh as B,mh as C,nh as D,oh as E,ph as F,qh as G,rh as H,sh as I,th as J,uh as K,vh as L,wh as M,xh as N,yh as O,zh as P}from"../chunk-3swnmwfc.js";import"../chunk-bcffjsnj.js";import"../chunk-557qj7q9.js";import"../chunk-c8cadhgc.js";import"../chunk-70v77sqv.js";import"../chunk-a368cs92.js";import"../chunk-c1hr34a5.js";import"../chunk-pb47hr0h.js";import"../chunk-fsssdd5k.js";import"../chunk-0hw5wjjg.js";export{ba as AwsBoxProvisioner,o as AwsDriver,D as CloudDriverFactory,a as DEFAULT_RPX_CERTS_DIR,aa as HetznerBoxProvisioner,v as HetznerClient,z as HetznerDriver,A as LocalBoxDriver,pa as MANAGED_CACHE_POLICY_DISABLED,oa as MANAGED_CACHE_POLICY_OPTIMIZED,qa as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,i as RPX_DIR,j as RPX_LAUNCHER_PATH,k as RPX_SERVICE_NAME,Z as UBUNTU_2404_AMI_PARAM,U as acquireResizeLock,N as applyHetznerHostOptimization,ha as buildAwsArtifactFetch,_ as buildBoxUserData,ra as buildCloudFrontOriginConfig,M as buildHetznerHostOptimizationScript,ja as buildHostCleanupScript,ia as buildLocalArtifactFetch,f as buildRpxConfig,m as buildRpxFragmentRefreshScript,g as buildRpxLbConfig,l as buildRpxProvisionScript,ea as buildSiteDeployScript,p as buildSshArgs,fa as buildStaticSiteDeployScript,E as cloudDrivers,O as collectHetznerHostOptimizationReport,I as collectHetznerResizeManifest,ca as createBoxProvisioner,C as createCloudDriver,la as deployAllComputeSites,ka as deploySiteRelease,e as deriveRouteId,W as ensureFirewall,X as ensureServer,V as ensureSshKey,H as executeHetznerServerResize,c as gatewayHostnames,n as generateUbuntuAppCloudInit,b as hasAutoWwwVariant,B as isBoxMode,G as isHetznerCapacityError,d as normalizeRoutePath,x as normalizeSshPublicKey,F as planHetznerServerResize,J as prepareHetznerResize,S as readResizeCheckpoint,ga as releaseTarballTmpPath,ma as reloadRpxGateway,h as renderRpxLauncher,na as renewRpxCertificates,Q as resizeCheckpointPath,R as resizeLockPath,da as resolveExecStart,w as resolveHetznerApiToken,L as resolveHetznerHostOptimizationPlan,s as scpUpload,Y as serverPublicIpv4,q as sshExec,r as sshExecOrThrow,P as verifyHetznerHostOptimization,K as verifyHetznerResize,u as waitForCloudInit,t as waitForSsh,y as wrapCloudInitUserData,T as writeResizeCheckpoint};
+import{$g as q,$h as qa,$i as hb,Ah as Q,Ai as Ra,Bg as a,Bh as R,Bi as Sa,Cg as b,Ch as S,Ci as Ta,Dg as c,Dh as T,Di as Ua,Eg as d,Eh as U,Ei as Va,Fh as V,Fi as Wa,Gh as W,Gi as Xa,Hh as X,Hi as Ya,Ih as Y,Ii as Za,Jh as Z,Ji as _a,Kh as _,Ki as $a,Lh as aa,Mh as ba,Nh as ca,Ni as ab,Oh as da,Oi as bb,Pg as e,Ph as ea,Pi as cb,Qg as f,Qh as fa,Qi as db,Rg as g,Rh as ga,Ri as eb,Sg as h,Sh as ha,Si as fb,Tg as i,Th as ia,Ti as gb,Ug as j,Uh as ja,Vg as k,Vh as ka,Wg as l,Wh as la,Xg as m,Xh as ma,Yg as n,Yh as na,Zg as o,Zh as oa,_g as p,_h as pa,ah as r,ai as ra,aj as ib,bh as s,bi as sa,bj as jb,ch as t,ci as ta,cj as kb,dh as u,di as ua,dj as lb,eh as v,ei as va,ej as mb,fh as w,fi as wa,fj as nb,gh as x,gi as xa,gj as ob,hh as y,hi as ya,ih as z,ii as za,jh as A,ji as Aa,ki as Ba,lh as B,li as Ca,mh as C,mi as Da,nh as D,ni as Ea,oh as E,oi as Fa,ph as F,pi as Ga,qh as G,qi as Ha,rh as H,ri as Ia,sh as I,si as Ja,th as J,ti as Ka,uh as K,ui as La,vh as L,vi as Ma,wh as M,wi as Na,xh as N,xi as Oa,yh as O,yi as Pa,zh as P,zi as Qa}from"../chunk-fvpkxznh.js";import"../chunk-n5xmh0ma.js";import"../chunk-6cxb8d6y.js";import"../chunk-ess6vxfj.js";import"../chunk-j1g67djb.js";import"../chunk-ac87ds1k.js";import"../chunk-n1hg0jxs.js";import"../chunk-4wdxsnn2.js";import"../chunk-r8t25tbm.js";import"../chunk-zjyz926j.js";export{_a as AwsBoxProvisioner,s as AwsDriver,Ba as BOOT_PARTITION_LABEL,ya as CloudDriverFactory,e as DEFAULT_RPX_CERTS_DIR,Aa as FIRST_BOOT_SCRIPT_PATH,Za as HetznerBoxProvisioner,B as HetznerClient,K as HetznerDriver,F as LEGACY_DRIVER_STATE_DIR,L as LocalBoxDriver,mb as MANAGED_CACHE_POLICY_DISABLED,lb as MANAGED_CACHE_POLICY_OPTIMIZED,nb as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,aa as RASPBERRY_PI_DEFAULT_SWAP_GB,A as REMOTE_SCRIPT_RUNNER,m as RPX_DIR,n as RPX_LAUNCHER_PATH,o as RPX_SERVICE_NAME,Z as SSH_BOOTSTRAP_MARKER_DIR,Y as SSH_BOOTSTRAP_VERSION,da as SSH_DEFAULTS,ta as SSH_DEPLOY_STORAGE_PATH,N as SSH_INSECURE_HOST_KEY_OPTS,O as SSH_KEEPALIVE_OPTS,oa as SSH_PREFLIGHT_SCRIPT,ua as SSH_SKIP_BOOTSTRAP_ENV,wa as SshDriver,X as SystemSshTransport,Xa as UBUNTU_2404_AMI_PARAM,Sa as acquireResizeLock,La as applyHetznerHostOptimization,ba as assertArchSupported,va as assertSshComputeConfig,eb as buildAwsArtifactFetch,Ya as buildBoxUserData,ob as buildCloudFrontOriginConfig,Ca as buildCloudInitFirstBoot,Ka as buildHetznerHostOptimizationScript,gb as buildHostCleanupScript,fb as buildLocalArtifactFetch,j as buildRpxConfig,q as buildRpxFragmentRefreshScript,k as buildRpxLbConfig,p as buildRpxProvisionScript,Q as buildScpArgsFor,bb as buildSiteDeployScript,t as buildSshArgs,P as buildSshArgsFor,ca as buildSshBootstrapScript,cb as buildStaticSiteDeployScript,za as cloudDrivers,Ma as collectHetznerHostOptimizationReport,Ga as collectHetznerResizeManifest,$a as createBoxProvisioner,xa as createCloudDriver,ib as deployAllComputeSites,hb as deploySiteRelease,i as deriveRouteId,a as describeScriptSyntaxError,G as driverStateDir,H as driverStatePath,Ua as ensureFirewall,Va as ensureServer,Ta as ensureSshKey,qa as evaluatePreflight,Fa as executeHetznerServerResize,V as findKnownHostKey,sa as formatPreflightFindings,b as formatSshFailure,g as gatewayHostnames,r as generateUbuntuAppCloudInit,f as hasAutoWwwVariant,M as isBoxMode,Ea as isHetznerCapacityError,U as knownHostsLine,T as knownHostsToken,h as normalizeRoutePath,D as normalizeSshPublicKey,pa as parsePreflightFacts,Da as planHetznerServerResize,ra as preflightFailed,Ha as prepareHetznerResize,I as readDriverState,Qa as readResizeCheckpoint,db as releaseTarballTmpPath,jb as reloadRpxGateway,z as remoteScriptRunner,l as renderRpxLauncher,kb as renewRpxCertificates,Oa as resizeCheckpointPath,Pa as resizeLockPath,ab as resolveExecStart,C as resolveHetznerApiToken,Ja as resolveHetznerHostOptimizationPlan,ia as resolveSshHostKeyPolicy,ea as resolveSshHosts,ma as resolveSshLan,ga as resolveSshPort,ha as resolveSshPrivateKeyPath,ka as resolveSshProfile,la as resolveSshPublicIp,na as resolveSshSettings,ja as resolveSshSudo,fa as resolveSshUser,S as scanHostKey,w as scpUpload,Wa as serverPublicIpv4,_ as sshBootstrapMarkerPath,u as sshExec,v as sshExecOrThrow,R as sshHostKeyFingerprint,W as sshKnownHostsPath,d as summarizeRemoteFailures,c as surfaceRemoteNotices,Na as verifyHetznerHostOptimization,Ia as verifyHetznerResize,y as waitForCloudInit,x as waitForSsh,E as wrapCloudInitUserData,J as writeDriverState,Ra as writeResizeCheckpoint};

package/dist/drivers/local-box/driver.d.ts

@@ -9,7 +9,7 @@ import type { CloudDriver, ComputeStackOutputs, ComputeTarget, FindComputeTarget
  * the box; provisioning/upload methods are inert (the box is already up).
  */
 export declare class LocalBoxDriver implements CloudDriver {
-    readonly name: 'hetzner';
+    readonly name: 'ssh';
     readonly usesCloudFormation = false;
     getComputeOutputs(): Promise<ComputeStackOutputs>;
     uploadRelease(options: UploadReleaseOptions): Promise<UploadReleaseResult>;

package/dist/drivers/shared/compute-provision.d.ts

@@ -33,6 +33,13 @@ export interface ComputeProvisionOptions {
      * than one that offers SMTP to the internet.
      */
     environment?: string;
+    /**
+     * Where the managed `authorized_keys` block is written. Defaults to root's
+     * file; a bootstrap that deploys as another user (the ssh provider with a
+     * `pi` or `deploy` user) points it at that user's home, or the operator
+     * keys in `compute.sshKeys` would authorize logins for the wrong account.
+     */
+    authorizedKeysPath?: string;
 }
 /**
  * Build the machine provisioning scripts from a CloudConfig. Returns the

package/dist/drivers/shared/driver-state.d.ts

@@ -0,0 +1,68 @@
+/**
+ * The per-stack state a compute driver records on the machine running deploys.
+ *
+ * Every SSH-style driver has to remember which box a stack lives on: Hetzner
+ * pins a server id so CI can find the existing box instead of provisioning a
+ * duplicate, and the ssh driver pins the host it adopted plus what it did to
+ * it. One file per stack, one reader and one writer, so a driver, the
+ * dashboard and the CLI cannot disagree about where that file is.
+ *
+ * ## Where the file lives
+ *
+ * Driver state predates the configurable state directory and has a legacy
+ * home of its own, `storage/cloud/state/` (the Stacks storage convention),
+ * which is meant to be COMMITTED: unlike dashboard credentials it holds
+ * nothing secret, and a checkout without it re-provisions. A project that
+ * configured `stateDir` (or set `TS_CLOUD_STATE_DIR`) keeps driver state
+ * under it instead, in `<stateDir>/state/`. A Stacks application sets
+ * `stateDir: 'storage/cloud'`, so for it the two spellings name the same
+ * directory and nothing moves.
+ */
+import type { HetznerDriverState } from '../hetzner/state';
+/** The committed driver-state directory used when no state directory is configured. */
+export declare const LEGACY_DRIVER_STATE_DIR = "storage/cloud/state";
+/** What the ssh driver remembers about a host it adopted. */
+export interface SshDriverState {
+    provider: 'ssh';
+    stackName: string;
+    /** The hostname or address deploys connect to, exactly as configured. */
+    host: string;
+    sshUser: string;
+    sshPort: number;
+    /** `SHA256:...` of the pinned host key, when the host-key policy pins. */
+    hostKeyFingerprint?: string;
+    /** The address DNS should point at, when known (configured, or detected). */
+    publicIp?: string;
+    /** The host's first LAN address, as reported by the preflight. */
+    lanIp?: string;
+    deployStoragePath?: string;
+    profile?: 'raspberry-pi' | 'generic';
+    /** The bootstrap recipe version last applied to the host. */
+    bootstrapVersion?: number;
+    /** When that bootstrap ran, ISO 8601. */
+    bootstrappedAt?: string;
+}
+export type DriverState = HetznerDriverState | SshDriverState;
+/**
+ * The directory driver state files live in, absolute.
+ *
+ * `<stateDir>/state` when a state directory is configured, the legacy
+ * `storage/cloud/state` otherwise. See the module comment for why the legacy
+ * path is not simply `.ts-cloud/state`.
+ */
+export declare function driverStateDir(cwd?: string): string;
+/** Absolute path of the state file for `stackName`. */
+export declare function driverStatePath(stackName: string, cwd?: string): string;
+/**
+ * Read the state file for `stackName`, or null when there is none (or it is
+ * unreadable: a corrupt file is treated as absent, and the atomic write below
+ * is what keeps that from ever losing a pin).
+ */
+export declare function readDriverState<T extends DriverState = DriverState>(stackName: string, cwd?: string): Promise<T | null>;
+/**
+ * Replace the state file for `stackName` atomically: a crash mid-write would
+ * corrupt the JSON, and the reader's catch-all would then lose the pinned box
+ * (silently re-provisioning a duplicate). Temp file + rename on the same
+ * filesystem is atomic.
+ */
+export declare function writeDriverState(stackName: string, state: DriverState, cwd?: string): Promise<void>;

package/dist/drivers/shared/remote-exec.d.ts

@@ -9,6 +9,8 @@
 export interface RemoteExecOptions {
     /** SSH user. @default 'root' */
     user?: string;
+    /** SSH port. Omit for the ambient default (22, or whatever `~/.ssh/config` says). */
+    port?: number;
     /** Private key passed as `ssh -i`. Omit to use the ambient SSH config/agent. */
     identityFile?: string;
     /** SSH `ConnectTimeout` in seconds. @default 10 */
@@ -23,8 +25,11 @@ export interface RemoteExecResult {
  * The ssh/scp CLI arguments implied by {@link RemoteExecOptions}. Host key
  * checking is disabled because these helpers target freshly-created servers
  * whose host keys cannot be known in advance.
+ *
+ * `scp` spells the port flag differently (`-P`; its `-p` preserves file
+ * times), so say which binary the arguments are for.
  */
-export declare function buildSshArgs(options?: RemoteExecOptions): string[];
+export declare function buildSshArgs(options?: RemoteExecOptions, binary?: 'ssh' | 'scp'): string[];
 /** Run a command on the host over SSH, capturing exit code and output. */
 export declare function sshExec(host: string, command: string, options?: RemoteExecOptions): Promise<RemoteExecResult>;
 /** Like {@link sshExec}, but throws on non-zero exit and returns stdout. */
@@ -63,4 +68,8 @@ export declare function waitForCloudInit(host: string, options?: WaitOptions): P
  * `-s` in the first place), and `mktemp` creates the file 0600, so the window
  * where they touch disk is both short and unreadable to other users.
  */
+export declare function remoteScriptRunner(options?: {
+    sudo?: boolean;
+}): string;
+/** The runner for a root deploy user; see {@link remoteScriptRunner}. */
 export declare const REMOTE_SCRIPT_RUNNER: string;

package/dist/drivers/shared/remote-failure.d.ts

@@ -12,6 +12,47 @@
  * `formatSshFailure`), so this only has to decide what is worth showing.
  */
 import type { RemoteDeployInstanceResult } from '@ts-cloud/core';
+/**
+ * The part of the deploy script bash refused to parse.
+ *
+ * A syntax error names a line number in a file that only ever existed on the
+ * box, and the deploy deletes it on the way out, so the one thing needed to
+ * understand the failure is the one thing nobody can look at. Without this you
+ * are reduced to guessing which generated fragment is unbalanced, or to
+ * reproducing the whole script by hand from its builders.
+ *
+ * Only a window around the reported line, and every `KEY="value"` line inside
+ * it is redacted: the script carries the runtime environment, and a deploy
+ * failure must not become the reason a database password is in a CI log.
+ */
+export declare function describeScriptSyntaxError(error: unknown, script: string): string;
+/**
+ * One operator-facing line (plus redacted output) for a failed ssh/scp child.
+ *
+ * Takes the shape Node's `execFileSync` error has (`status`, `signal`,
+ * `stdout`, `stderr`) so a `Bun.spawn`-based transport only has to build the
+ * same object. Never includes the command line: it carries the deploy script.
+ */
+export declare function formatSshFailure(error: unknown): string;
+/**
+ * Print the lines a remote deploy script meant a human to read.
+ *
+ * The remote stdout has always been captured and then dropped on the floor,
+ * which is why nothing the box says has ever reached a CI log: not the
+ * memory-commitment report, not `migrate`, not `catalog:sync`. A deploy that
+ * cannot tell you what it did on the box is one you have to SSH in to
+ * understand, and by then you are debugging rather than reading.
+ *
+ * Only `[ts-cloud]`-prefixed lines are surfaced, and that restraint is
+ * deliberate rather than tidy. The script fed to `bash -s` carries the runtime
+ * environment here-document - database credentials, APP_KEY, provider tokens -
+ * which is why {@link formatSshFailure} refuses to echo a failing command back.
+ * Remote *stdout* is not the script, so it does not contain those secrets by
+ * construction, but it is whatever arbitrary `preStart` commands chose to
+ * print, and an app that logs its own config on boot would leak it here. An
+ * explicit marker means ts-cloud only ever republishes lines ts-cloud wrote.
+ */
+export declare function surfaceRemoteNotices(output: string): void;
 /**
  * Build the `error` for a {@link import('@ts-cloud/core').RemoteDeployResult}
  * whose run did not fully succeed. `summary` is the one-line what-failed (e.g.

package/dist/drivers/shared/ssh-transport.d.ts

@@ -0,0 +1,121 @@
+export type SshHostKeyPolicy = 'pin' | 'accept-new' | 'insecure';
+export interface SshTransportOptions {
+    user: string;
+    /** @default 22 */
+    port?: number;
+    /** Private key passed as `-i`. */
+    identityFile: string;
+    /**
+     * `'insecure'` disables host-key checking (the cloud drivers' behaviour).
+     * Otherwise the policy plus the known_hosts file it reads and writes.
+     */
+    hostKey: 'insecure' | {
+        policy: 'pin' | 'accept-new';
+        knownHostsFile: string;
+    };
+    /** @default 30 */
+    connectTimeoutSec?: number;
+    /**
+     * How a script is executed on the host once it arrives over stdin. Defaults
+     * to {@link remoteScriptRunner} without sudo; `exec` can pick the sudo
+     * variant per call.
+     */
+    runner?: string;
+}
+export interface SshExecOptions {
+    /**
+     * Run the script through `sudo -n`. Unset: the transport's configured
+     * runner. A deploy user that is not root needs it for everything except
+     * the preflight, which must run as the user to find out whether sudo works.
+     */
+    sudo?: boolean;
+}
+export interface SshHostKeyResult {
+    /** `SHA256:...`, empty when the key could not be learned (insecure policy, scan failed). */
+    fingerprint: string;
+    /** True when this call is what recorded the key. */
+    pinnedNow: boolean;
+}
+export interface SshTransport {
+    /** Run `script` on `host`; resolves with stdout, rejects with a redacted failure. */
+    exec(host: string, script: string, options?: SshExecOptions): Promise<string>;
+    /** Copy one local file to `remotePath` on `host`. */
+    scp(host: string, localPath: string, remotePath: string): Promise<void>;
+    /** Whether sshd on `host` accepts a connection right now. */
+    probe(host: string): Promise<boolean>;
+    /** Learn (and, when pinning, record) the host key before the first real command. */
+    ensureHostKey(host: string): Promise<SshHostKeyResult>;
+}
+export interface CommandResult {
+    code: number;
+    signal?: string | null;
+    stdout: string;
+    stderr: string;
+}
+/** Runs a command; `input`, when given, is piped to stdin. Injectable for tests. */
+export type CommandRunner = (command: string[], input?: string) => Promise<CommandResult>;
+export declare const runCommand: CommandRunner;
+/**
+ * Host-key options for a box the provider API identifies: never check, never
+ * remember. Byte-for-byte what the Hetzner driver passes.
+ */
+export declare const SSH_INSECURE_HOST_KEY_OPTS: readonly string[];
+/**
+ * Keepalive + connect timeout for every ssh/scp. Without these a connection
+ * that stalls mid-transfer (a flaky network, an sshd hiccup) hangs the deploy
+ * FOREVER. ServerAlive probes abort a silent connection after ~60s (15s x 4)
+ * so the transfer fails loudly (and, for scp, is retried) instead of wedging.
+ */
+export declare const SSH_KEEPALIVE_OPTS: readonly string[];
+/**
+ * The `ssh` arguments (everything after the binary, ending in `user@host`)
+ * for `options`. `extra` is spliced in before the destination so a caller can
+ * add a one-off `-o`. Pure, for tests.
+ */
+export declare function buildSshArgsFor(options: SshTransportOptions, host: string, extra?: string[]): string[];
+/** The `scp` arguments for copying `localPath` to `host:remotePath`. Pure, for tests. */
+export declare function buildScpArgsFor(options: SshTransportOptions, host: string, localPath: string, remotePath: string): string[];
+/** `SHA256:...` fingerprint of a base64 host key, as `ssh-keygen -l` prints it. */
+export declare function sshHostKeyFingerprint(key: string): string;
+export interface ScannedHostKey {
+    algorithm: string;
+    key: string;
+}
+/**
+ * Ask the host for its ed25519 key with `ssh-keyscan`. Bounded (`-T 10`) so an
+ * unreachable host fails in seconds rather than at the TCP timeout.
+ */
+export declare function scanHostKey(host: string, port?: number, run?: CommandRunner): Promise<ScannedHostKey>;
+/** The host field ssh looks up in known_hosts: `host` on port 22, `[host]:port` otherwise. */
+export declare function knownHostsToken(host: string, port?: number): string;
+/** The known_hosts entry recorded for `host` (one line, no trailing newline). */
+export declare function knownHostsLine(host: string, port: number, key: ScannedHostKey): string;
+/**
+ * The recorded key for `host`, or null when the file has no plain entry for
+ * it. Hashed entries (`|1|...`) cannot be matched and are ignored, which is
+ * fine: this transport only ever writes plain ones.
+ */
+export declare function findKnownHostKey(content: string, host: string, port?: number): ScannedHostKey | null;
+/** Where the ssh driver keeps the host keys it pinned: `<stateDir>/ssh/known_hosts`. */
+export declare function sshKnownHostsPath(cwd?: string): string;
+export interface SystemSshTransportDeps {
+    run?: CommandRunner;
+    scan?: typeof scanHostKey;
+    readKnownHosts?: (file: string) => Promise<string>;
+    appendKnownHosts?: (file: string, line: string) => Promise<void>;
+}
+/** {@link SshTransport} on the system `ssh`, `scp` and `ssh-keyscan` binaries. */
+export declare class SystemSshTransport implements SshTransport {
+    private readonly options;
+    private readonly run;
+    private readonly scan;
+    private readonly readKnownHosts;
+    private readonly appendKnownHosts;
+    constructor(options: SshTransportOptions, deps?: SystemSshTransportDeps);
+    /** The runner a script is fed to; see {@link SshExecOptions.sudo}. */
+    runnerFor(options?: SshExecOptions): string;
+    exec(host: string, script: string, options?: SshExecOptions): Promise<string>;
+    scp(host: string, localPath: string, remotePath: string): Promise<void>;
+    probe(host: string): Promise<boolean>;
+    ensureHostKey(host: string): Promise<SshHostKeyResult>;
+}

package/dist/drivers/ssh/bootstrap.d.ts

@@ -0,0 +1,61 @@
+/**
+ * The bootstrap for a bring-your-own host.
+ *
+ * The recipe is the Hetzner driver's, composed the same way from the same
+ * builders (the rpx gateway, the machine provisioning, the Ubuntu bootstrap),
+ * so an adopted Pi and a cloud box end up running the same stack from the
+ * same code. What differs is the machine it lands on:
+ *
+ * - It may run MORE than once. cloud-init on a Pi has an upstream bug that
+ *   reruns modules on every boot, an operator may `cloud ssh:bootstrap` twice,
+ *   and a deploy calls the adopt on every run. So the whole script is guarded
+ *   by a version marker: once `/var/lib/ts-cloud/bootstrap.v<N>` exists, only
+ *   the gateway fragment is refreshed. Bumping {@link SSH_BOOTSTRAP_VERSION}
+ *   is how a changed recipe gets applied to hosts bootstrapped by an older one.
+ * - It may run before the clock is right. A Pi 5 has no battery-backed RTC,
+ *   and apt refuses Release files "from the future" while ACME refuses a
+ *   skewed clock outright. Time sync is awaited before anything touches apt.
+ * - It may run as a user that is not root. The scripts arrive through the
+ *   sudo runner, so they ARE root, but the deploy user still has to be able
+ *   to scp into the artifact and staging directories, and the operator keys
+ *   belong in that user's `authorized_keys`, not root's.
+ * - It may run on a small SD card. The raspberry-pi profile halves the
+ *   swapfile and bounds the journal.
+ */
+import type { CloudConfig, EnvironmentType } from '@ts-cloud/core';
+import type { SshLanConfig, SshProfile } from './config';
+import type { SshPreflightFacts } from './preflight';
+/** Bump when the recipe changes in a way an already-bootstrapped host must pick up. */
+export declare const SSH_BOOTSTRAP_VERSION = 1;
+/** Where the bootstrap records that it ran. */
+export declare const SSH_BOOTSTRAP_MARKER_DIR = "/var/lib/ts-cloud";
+export declare function sshBootstrapMarkerPath(version?: number): string;
+/** Swap the raspberry-pi profile provisions when `compute.swapGb` is unset. */
+export declare const RASPBERRY_PI_DEFAULT_SWAP_GB = 1;
+export interface SshBootstrapOptions {
+    config: CloudConfig;
+    environment: EnvironmentType;
+    profile: SshProfile;
+    /** Preflight facts, when the host has been probed; `arch` gates x86_64-only services. */
+    facts?: Pick<SshPreflightFacts, 'arch'>;
+    /**
+     * The non-root deploy user, when there is one. Makes the artifact and
+     * staging directories group-writable for it and manages its
+     * `authorized_keys` rather than root's.
+     */
+    sudoUser?: string;
+    /** LAN settings; recorded in the script header today, wired to the gateway by the local-CA work. */
+    lan?: SshLanConfig;
+}
+/**
+ * Refuse a config that asks for something this host's architecture cannot
+ * run. Vitess publishes x86_64 release tarballs only, so on an arm64 host the
+ * provision would fail minutes in on a download URL; say so before contact.
+ * The raspberry-pi profile is arm64 by definition, so it needs no facts.
+ */
+export declare function assertArchSupported(config: CloudConfig, profile: SshProfile, arch?: string): void;
+/**
+ * Build the bootstrap script for an adopted host. See the module comment for
+ * what makes it different from the cloud drivers' first-boot script.
+ */
+export declare function buildSshBootstrapScript(options: SshBootstrapOptions): string;