@stacksjs/ts-cloud 0.12.10 → 0.12.12

package/dist/{chunk-jphewtbx.js → chunk-ze5x2bpm.js}

@@ -1,2 +1,2 @@
-import{wi as s}from"./chunk-a368cs92.js";class a{client;region;constructor(e="us-east-1",r){this.region=e,this.client=new s(void 0,{profile:r})}async createRepository(e){let r={repositoryName:e.repositoryName};if(e.imageTagMutability)r.imageTagMutability=e.imageTagMutability;if(e.imageScanningConfiguration)r.imageScanningConfiguration=e.imageScanningConfiguration;if(e.encryptionConfiguration)r.encryptionConfiguration=e.encryptionConfiguration;if(e.tags&&e.tags.length>0)r.tags=e.tags;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.CreateRepository","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{repository:t.repository?this.parseRepository(t.repository):void 0}}async describeRepositories(e){let r={};if(e?.repositoryNames&&e.repositoryNames.length>0)r.repositoryNames=e.repositoryNames;if(e?.registryId)r.registryId=e.registryId;if(e?.maxResults)r.maxResults=e.maxResults;if(e?.nextToken)r.nextToken=e.nextToken;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.DescribeRepositories","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{repositories:t.repositories?.map((i)=>this.parseRepository(i)),nextToken:t.nextToken}}async getAuthorizationToken(e){let r={};if(e&&e.length>0)r.registryIds=e;return{authorizationData:(await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.GetAuthorizationToken","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})).authorizationData?.map((i)=>({authorizationToken:i.authorizationToken,expiresAt:i.expiresAt,proxyEndpoint:i.proxyEndpoint}))}}async deleteRepository(e){let r={repositoryName:e.repositoryName};if(e.registryId)r.registryId=e.registryId;if(e.force!==void 0)r.force=e.force;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.DeleteRepository","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{repository:t.repository?this.parseRepository(t.repository):void 0}}async describeImages(e){let r={repositoryName:e.repositoryName};if(e.registryId)r.registryId=e.registryId;if(e.imageIds&&e.imageIds.length>0)r.imageIds=e.imageIds;if(e.filter)r.filter=e.filter;if(e.maxResults)r.maxResults=e.maxResults;if(e.nextToken)r.nextToken=e.nextToken;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.DescribeImages","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{imageDetails:t.imageDetails?.map((i)=>this.parseImageDetail(i)),nextToken:t.nextToken}}async batchDeleteImage(e){let r={repositoryName:e.repositoryName,imageIds:e.imageIds};if(e.registryId)r.registryId=e.registryId;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.BatchDeleteImage","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{imageIds:t.imageIds,failures:t.failures}}async putLifecyclePolicy(e){let r={repositoryName:e.repositoryName,lifecyclePolicyText:e.lifecyclePolicyText};if(e.registryId)r.registryId=e.registryId;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.PutLifecyclePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{registryId:t.registryId,repositoryName:t.repositoryName,lifecyclePolicyText:t.lifecyclePolicyText}}async getLifecyclePolicy(e){let r={repositoryName:e.repositoryName};if(e.registryId)r.registryId=e.registryId;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.GetLifecyclePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{registryId:t.registryId,repositoryName:t.repositoryName,lifecyclePolicyText:t.lifecyclePolicyText,lastEvaluatedAt:t.lastEvaluatedAt}}async setRepositoryPolicy(e){let r={repositoryName:e.repositoryName,policyText:e.policyText};if(e.registryId)r.registryId=e.registryId;if(e.force!==void 0)r.force=e.force;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.SetRepositoryPolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{registryId:t.registryId,repositoryName:t.repositoryName,policyText:t.policyText}}async getRepositoryPolicy(e){let r={repositoryName:e.repositoryName};if(e.registryId)r.registryId=e.registryId;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.GetRepositoryPolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{registryId:t.registryId,repositoryName:t.repositoryName,policyText:t.policyText}}async tagResource(e){let r={resourceArn:e.resourceArn,tags:e.tags};await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.TagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async listTagsForResource(e){let r={resourceArn:e};return{tags:(await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.ListTagsForResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})).tags}}createLifecyclePolicyText(e){return JSON.stringify({rules:e.map((r)=>({rulePriority:r.rulePriority,description:r.description,selection:r.selection,action:r.action}))})}async getDockerLoginCommand(){let e=await this.getAuthorizationToken();if(!e.authorizationData?.[0])throw Error("Failed to get authorization token");let r=e.authorizationData[0],t=r.authorizationToken||"",i=r.proxyEndpoint||"";return`echo "${Buffer.from(t,"base64").toString("utf8").split(":")[1]}" | docker login --username AWS --password-stdin ${i}`}getRegistryUri(e){return`${e}.dkr.ecr.${this.region}.amazonaws.com`}parseRepository(e){return{repositoryArn:e.repositoryArn,registryId:e.registryId,repositoryName:e.repositoryName,repositoryUri:e.repositoryUri,createdAt:e.createdAt,imageTagMutability:e.imageTagMutability,imageScanningConfiguration:e.imageScanningConfiguration,encryptionConfiguration:e.encryptionConfiguration}}parseImageDetail(e){return{registryId:e.registryId,repositoryName:e.repositoryName,imageDigest:e.imageDigest,imageTags:e.imageTags,imageSizeInBytes:e.imageSizeInBytes,imagePushedAt:e.imagePushedAt,imageScanStatus:e.imageScanStatus,imageScanFindingsSummary:e.imageScanFindingsSummary}}}
+import{tj as s}from"./chunk-ac87ds1k.js";class a{client;region;constructor(e="us-east-1",r){this.region=e,this.client=new s(void 0,{profile:r})}async createRepository(e){let r={repositoryName:e.repositoryName};if(e.imageTagMutability)r.imageTagMutability=e.imageTagMutability;if(e.imageScanningConfiguration)r.imageScanningConfiguration=e.imageScanningConfiguration;if(e.encryptionConfiguration)r.encryptionConfiguration=e.encryptionConfiguration;if(e.tags&&e.tags.length>0)r.tags=e.tags;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.CreateRepository","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{repository:t.repository?this.parseRepository(t.repository):void 0}}async describeRepositories(e){let r={};if(e?.repositoryNames&&e.repositoryNames.length>0)r.repositoryNames=e.repositoryNames;if(e?.registryId)r.registryId=e.registryId;if(e?.maxResults)r.maxResults=e.maxResults;if(e?.nextToken)r.nextToken=e.nextToken;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.DescribeRepositories","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{repositories:t.repositories?.map((i)=>this.parseRepository(i)),nextToken:t.nextToken}}async getAuthorizationToken(e){let r={};if(e&&e.length>0)r.registryIds=e;return{authorizationData:(await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.GetAuthorizationToken","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})).authorizationData?.map((i)=>({authorizationToken:i.authorizationToken,expiresAt:i.expiresAt,proxyEndpoint:i.proxyEndpoint}))}}async deleteRepository(e){let r={repositoryName:e.repositoryName};if(e.registryId)r.registryId=e.registryId;if(e.force!==void 0)r.force=e.force;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.DeleteRepository","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{repository:t.repository?this.parseRepository(t.repository):void 0}}async describeImages(e){let r={repositoryName:e.repositoryName};if(e.registryId)r.registryId=e.registryId;if(e.imageIds&&e.imageIds.length>0)r.imageIds=e.imageIds;if(e.filter)r.filter=e.filter;if(e.maxResults)r.maxResults=e.maxResults;if(e.nextToken)r.nextToken=e.nextToken;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.DescribeImages","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{imageDetails:t.imageDetails?.map((i)=>this.parseImageDetail(i)),nextToken:t.nextToken}}async batchDeleteImage(e){let r={repositoryName:e.repositoryName,imageIds:e.imageIds};if(e.registryId)r.registryId=e.registryId;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.BatchDeleteImage","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{imageIds:t.imageIds,failures:t.failures}}async putLifecyclePolicy(e){let r={repositoryName:e.repositoryName,lifecyclePolicyText:e.lifecyclePolicyText};if(e.registryId)r.registryId=e.registryId;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.PutLifecyclePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{registryId:t.registryId,repositoryName:t.repositoryName,lifecyclePolicyText:t.lifecyclePolicyText}}async getLifecyclePolicy(e){let r={repositoryName:e.repositoryName};if(e.registryId)r.registryId=e.registryId;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.GetLifecyclePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{registryId:t.registryId,repositoryName:t.repositoryName,lifecyclePolicyText:t.lifecyclePolicyText,lastEvaluatedAt:t.lastEvaluatedAt}}async setRepositoryPolicy(e){let r={repositoryName:e.repositoryName,policyText:e.policyText};if(e.registryId)r.registryId=e.registryId;if(e.force!==void 0)r.force=e.force;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.SetRepositoryPolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{registryId:t.registryId,repositoryName:t.repositoryName,policyText:t.policyText}}async getRepositoryPolicy(e){let r={repositoryName:e.repositoryName};if(e.registryId)r.registryId=e.registryId;let t=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.GetRepositoryPolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)});return{registryId:t.registryId,repositoryName:t.repositoryName,policyText:t.policyText}}async tagResource(e){let r={resourceArn:e.resourceArn,tags:e.tags};await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.TagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async listTagsForResource(e){let r={resourceArn:e};return{tags:(await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.ListTagsForResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})).tags}}createLifecyclePolicyText(e){return JSON.stringify({rules:e.map((r)=>({rulePriority:r.rulePriority,description:r.description,selection:r.selection,action:r.action}))})}async getDockerLoginCommand(){let e=await this.getAuthorizationToken();if(!e.authorizationData?.[0])throw Error("Failed to get authorization token");let r=e.authorizationData[0],t=r.authorizationToken||"",i=r.proxyEndpoint||"";return`echo "${Buffer.from(t,"base64").toString("utf8").split(":")[1]}" | docker login --username AWS --password-stdin ${i}`}getRegistryUri(e){return`${e}.dkr.ecr.${this.region}.amazonaws.com`}parseRepository(e){return{repositoryArn:e.repositoryArn,registryId:e.registryId,repositoryName:e.repositoryName,repositoryUri:e.repositoryUri,createdAt:e.createdAt,imageTagMutability:e.imageTagMutability,imageScanningConfiguration:e.imageScanningConfiguration,encryptionConfiguration:e.encryptionConfiguration}}parseImageDetail(e){return{registryId:e.registryId,repositoryName:e.repositoryName,imageDigest:e.imageDigest,imageTags:e.imageTags,imageSizeInBytes:e.imageSizeInBytes,imagePushedAt:e.imagePushedAt,imageScanStatus:e.imageScanStatus,imageScanFindingsSummary:e.imageScanFindingsSummary}}}
 export{a as Vf};

package/dist/{chunk-jxrs1219.js → chunk-zh0apedk.js}

@@ -1,4 +1,4 @@
-import{Uf as U}from"./chunk-7j100g7w.js";import{eg as Z,jg as _,ng as K,rg as L,sg as Y}from"./chunk-rg7d67xk.js";import{tg as M}from"./chunk-982rye5b.js";import{si as W}from"./chunk-c8cadhgc.js";import{ui as B}from"./chunk-70v77sqv.js";import{Qu as j}from"./chunk-0hw5wjjg.js";function J(t){let{bucketName:s,domain:l,aliases:e,certificateArn:m,defaultRootObject:i="index.html",errorDocument:r="404.html",passthroughUrls:a=!1,singlePageApp:d=!1,dynamicApp:b=!1,computeOriginDomain:k,computeOriginPort:R=3008,computeOriginId:P="app-compute",retainOnStackDelete:x=!1}=t,A=x?{DeletionPolicy:"Retain",UpdateReplacePolicy:"Retain"}:{},y=b&&!!k,T=y?["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"]:["GET","HEAD"],F=y?["GET","HEAD"]:["GET","HEAD"],N={},O={};N.S3Bucket={Type:"AWS::S3::Bucket",...A,Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},O.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},O.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},N.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",...A,Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}};let D;if(a&&y)D="InstallRootRedirectFunction",N[D]={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-install-root-redirect"},AutoPublish:!0,FunctionConfig:{Comment:"Redirect curl pantry.dev | bash (GET /) to /install.sh on S3",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
+import{Uf as U}from"./chunk-n1fyryha.js";import{eg as Z,jg as _,ng as K,rg as L,sg as Y}from"./chunk-j06r5rwv.js";import{tg as M}from"./chunk-2ybcnrte.js";import{pj as W}from"./chunk-ess6vxfj.js";import{rj as B}from"./chunk-j1g67djb.js";import{Ov as j}from"./chunk-zjyz926j.js";function J(t){let{bucketName:s,domain:l,aliases:e,certificateArn:m,defaultRootObject:i="index.html",errorDocument:r="404.html",passthroughUrls:a=!1,singlePageApp:d=!1,dynamicApp:b=!1,computeOriginDomain:k,computeOriginPort:R=3008,computeOriginId:P="app-compute",retainOnStackDelete:x=!1}=t,A=x?{DeletionPolicy:"Retain",UpdateReplacePolicy:"Retain"}:{},y=b&&!!k,T=y?["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"]:["GET","HEAD"],F=y?["GET","HEAD"]:["GET","HEAD"],N={},O={};N.S3Bucket={Type:"AWS::S3::Bucket",...A,Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},O.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},O.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},N.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",...A,Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}};let D;if(a&&y)D="InstallRootRedirectFunction",N[D]={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-install-root-redirect"},AutoPublish:!0,FunctionConfig:{Comment:"Redirect curl pantry.dev | bash (GET /) to /install.sh on S3",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
   var request = event.request;
   if (request.uri === '/' || request.uri === '') {
     return {
@@ -42,7 +42,7 @@ import{Uf as U}from"./chunk-7j100g7w.js";import{eg as Z,jg as _,ng as K,rg as L,
 │                                                                             │
 │  Verification typically takes 1-2 business days.                            │
 │  After verification, re-run: bunx bunpress deploy                           │
-└─────────────────────────────────────────────────────────────────────────────┘`),{success:!1,stackId:O,stackName:i,bucket:y,message:"CloudFront account verification required. Please contact AWS Support."}}return{success:!1,stackId:O,stackName:i,bucket:y,message:`Stack deployment failed: ${o.message}`}}let u=(await r.describeStacks({stackName:i})).Stacks[0]?.Outputs||[],C=(o)=>u.find((n)=>n.OutputKey===o)?.OutputValue,f=C("DistributionDomain");if(f&&d)console.log(`Creating DNS records via ${d.name}...`),await q(d,e,f);else if(f&&!d)console.log("Skipping DNS record creation (DNS verification was skipped)");return{success:!0,stackId:O,stackName:i,bucket:C("BucketName")||y,distributionId:C("DistributionId"),distributionDomain:f,domain:e,certificateArn:b,message:"Static site infrastructure deployed successfully with external DNS"}}async function q(t,s,l){if(!t){console.log("Skipping DNS record creation (DNS verification was skipped)");return}if(s.split(".").length===2)if(t instanceof Z){console.log(`Creating Route53 alias record for apex domain ${s} -> ${l}`);let i=await t.createCloudFrontAlias({domain:s,name:s,cloudFrontDomainName:l});if(!i.success)console.warn(`Warning: Could not create Route53 alias record: ${i.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${s} -> ${l}`);else console.log(`Created Route53 alias record: ${s} -> ${l}`);let r=`www.${s}`;console.log(`Creating Route53 alias record for ${r} -> ${l}`);let a=await t.createCloudFrontAlias({domain:s,name:r,cloudFrontDomainName:l});if(!a.success)console.warn(`Warning: Could not create www Route53 alias: ${a.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${r} -> ${l}`);else console.log(`Created Route53 alias record: ${r} -> ${l}`)}else{try{let d=await t.listRecords(s,"A");if(d.success)for(let b of d.records){let k=b.name.replace(/\.$/,"");if(k===s||k==="")console.log(`Removing existing root A record (${b.content}) to make room for ALIAS...`),await t.deleteRecord(s,{name:s,type:"A",content:b.content})}}catch(d){console.log(`Note: Could not check for conflicting A records: ${d instanceof Error?d.message:d}`)}console.log(`Creating ALIAS record for apex domain ${s} -> ${l}`);let i=await t.upsertRecord(s,{name:s,type:"ALIAS",content:l,ttl:600});if(!i.success)console.warn(`Warning: Could not create ALIAS record: ${i.message}`),console.warn("Please manually create an ALIAS record in your DNS provider:"),console.warn(`  ${s} -> ${l}`);else console.log(`Created ALIAS record: ${s} -> ${l}`);let r=`www.${s}`;console.log(`Creating CNAME record for ${r} -> ${l}`);let a=await t.upsertRecord(s,{name:r,type:"CNAME",content:l,ttl:600});if(!a.success)console.warn(`Warning: Could not create www DNS record: ${a.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${r} -> ${l}`);else console.log(`Created CNAME record: ${r} -> ${l}`)}else{console.log(`Creating CNAME record for ${s} -> ${l}`);let i=await t.upsertRecord(s,{name:s,type:"CNAME",content:l,ttl:600});if(!i.success)console.warn(`Warning: Could not create DNS record: ${i.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${s} -> ${l}`);else console.log(`Created CNAME record: ${s} -> ${l}`)}}async function le(t){let{sourceDir:s,cleanBucket:l=!1,onProgress:e,...m}=t;e?.("infrastructure","Deploying CloudFormation stack...");let i=await G(m);if(!i.success)return i;if(l){e?.("clean","Cleaning old files from S3...");try{await new B(m.region||"us-east-1").emptyBucket(i.bucket)}catch(b){console.log(`Note: Could not clean bucket: ${b.message}`)}}e?.("upload","Uploading files to S3...");let{uploadStaticFiles:r}=await import("./chunk-1bj94sc2.js"),a=await r({sourceDir:s,bucket:i.bucket,region:m.region||"us-east-1",cacheControl:m.cacheControl,onProgress:(b,k,R)=>{e?.("upload",`${b}/${k}: ${R}`)}});if(a.errors.length>0)return{...i,success:!1,message:`Upload errors: ${a.errors.join(", ")}`,filesUploaded:a.uploaded};if(i.distributionId&&a.uploaded>0){e?.("invalidate","Invalidating CloudFront cache...");let{invalidateCache:b}=await import("./chunk-1bj94sc2.js");await b(i.distributionId)}e?.("complete","Deployment complete!");let d=a.skipped>0?`Deployed ${a.uploaded} files (${a.skipped} unchanged) with external DNS`:`Deployed ${a.uploaded} files successfully with external DNS`;return{...i,filesUploaded:a.uploaded,filesSkipped:a.skipped,message:d}}function Q(t){let{bucketName:s,domain:l,certificateArn:e,hostedZoneId:m,defaultRootObject:i="index.html",errorDocument:r="404.html"}=t,a={},d={};a.S3Bucket={Type:"AWS::S3::Bucket",Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},d.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},d.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},a.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},a.UrlRewriteFunction={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-url-rewrite"},AutoPublish:!0,FunctionConfig:{Comment:"Append .html extension to URLs without extensions",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
+└─────────────────────────────────────────────────────────────────────────────┘`),{success:!1,stackId:O,stackName:i,bucket:y,message:"CloudFront account verification required. Please contact AWS Support."}}return{success:!1,stackId:O,stackName:i,bucket:y,message:`Stack deployment failed: ${o.message}`}}let u=(await r.describeStacks({stackName:i})).Stacks[0]?.Outputs||[],C=(o)=>u.find((n)=>n.OutputKey===o)?.OutputValue,f=C("DistributionDomain");if(f&&d)console.log(`Creating DNS records via ${d.name}...`),await q(d,e,f);else if(f&&!d)console.log("Skipping DNS record creation (DNS verification was skipped)");return{success:!0,stackId:O,stackName:i,bucket:C("BucketName")||y,distributionId:C("DistributionId"),distributionDomain:f,domain:e,certificateArn:b,message:"Static site infrastructure deployed successfully with external DNS"}}async function q(t,s,l){if(!t){console.log("Skipping DNS record creation (DNS verification was skipped)");return}if(s.split(".").length===2)if(t instanceof Z){console.log(`Creating Route53 alias record for apex domain ${s} -> ${l}`);let i=await t.createCloudFrontAlias({domain:s,name:s,cloudFrontDomainName:l});if(!i.success)console.warn(`Warning: Could not create Route53 alias record: ${i.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${s} -> ${l}`);else console.log(`Created Route53 alias record: ${s} -> ${l}`);let r=`www.${s}`;console.log(`Creating Route53 alias record for ${r} -> ${l}`);let a=await t.createCloudFrontAlias({domain:s,name:r,cloudFrontDomainName:l});if(!a.success)console.warn(`Warning: Could not create www Route53 alias: ${a.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${r} -> ${l}`);else console.log(`Created Route53 alias record: ${r} -> ${l}`)}else{try{let d=await t.listRecords(s,"A");if(d.success)for(let b of d.records){let k=b.name.replace(/\.$/,"");if(k===s||k==="")console.log(`Removing existing root A record (${b.content}) to make room for ALIAS...`),await t.deleteRecord(s,{name:s,type:"A",content:b.content})}}catch(d){console.log(`Note: Could not check for conflicting A records: ${d instanceof Error?d.message:d}`)}console.log(`Creating ALIAS record for apex domain ${s} -> ${l}`);let i=await t.upsertRecord(s,{name:s,type:"ALIAS",content:l,ttl:600});if(!i.success)console.warn(`Warning: Could not create ALIAS record: ${i.message}`),console.warn("Please manually create an ALIAS record in your DNS provider:"),console.warn(`  ${s} -> ${l}`);else console.log(`Created ALIAS record: ${s} -> ${l}`);let r=`www.${s}`;console.log(`Creating CNAME record for ${r} -> ${l}`);let a=await t.upsertRecord(s,{name:r,type:"CNAME",content:l,ttl:600});if(!a.success)console.warn(`Warning: Could not create www DNS record: ${a.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${r} -> ${l}`);else console.log(`Created CNAME record: ${r} -> ${l}`)}else{console.log(`Creating CNAME record for ${s} -> ${l}`);let i=await t.upsertRecord(s,{name:s,type:"CNAME",content:l,ttl:600});if(!i.success)console.warn(`Warning: Could not create DNS record: ${i.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${s} -> ${l}`);else console.log(`Created CNAME record: ${s} -> ${l}`)}}async function le(t){let{sourceDir:s,cleanBucket:l=!1,onProgress:e,...m}=t;e?.("infrastructure","Deploying CloudFormation stack...");let i=await G(m);if(!i.success)return i;if(l){e?.("clean","Cleaning old files from S3...");try{await new B(m.region||"us-east-1").emptyBucket(i.bucket)}catch(b){console.log(`Note: Could not clean bucket: ${b.message}`)}}e?.("upload","Uploading files to S3...");let{uploadStaticFiles:r}=await import("./chunk-8fh4m5ge.js"),a=await r({sourceDir:s,bucket:i.bucket,region:m.region||"us-east-1",cacheControl:m.cacheControl,onProgress:(b,k,R)=>{e?.("upload",`${b}/${k}: ${R}`)}});if(a.errors.length>0)return{...i,success:!1,message:`Upload errors: ${a.errors.join(", ")}`,filesUploaded:a.uploaded};if(i.distributionId&&a.uploaded>0){e?.("invalidate","Invalidating CloudFront cache...");let{invalidateCache:b}=await import("./chunk-8fh4m5ge.js");await b(i.distributionId)}e?.("complete","Deployment complete!");let d=a.skipped>0?`Deployed ${a.uploaded} files (${a.skipped} unchanged) with external DNS`:`Deployed ${a.uploaded} files successfully with external DNS`;return{...i,filesUploaded:a.uploaded,filesSkipped:a.skipped,message:d}}function Q(t){let{bucketName:s,domain:l,certificateArn:e,hostedZoneId:m,defaultRootObject:i="index.html",errorDocument:r="404.html"}=t,a={},d={};a.S3Bucket={Type:"AWS::S3::Bucket",Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},d.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},d.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},a.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},a.UrlRewriteFunction={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-url-rewrite"},AutoPublish:!0,FunctionConfig:{Comment:"Append .html extension to URLs without extensions",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
   const request = event.request;
   var uri = request.uri;
 

package/dist/{chunk-0hw5wjjg.js → chunk-zjyz926j.js}

@@ -1,2 +1,2 @@
 import{createRequire as q}from"node:module";var j=Object.create;var{getPrototypeOf:k,defineProperty:i,getOwnPropertyNames:l}=Object;var m=Object.prototype.hasOwnProperty;function n(a){return this[a]}var o,p,r=(a,b,d)=>{var f=a!=null&&typeof a==="object";if(f){var g=b?o??=new WeakMap:p??=new WeakMap,h=g.get(a);if(h)return h}d=a!=null?j(k(a)):{};let c=b||!a||!a.__esModule?i(d,"default",{value:a,enumerable:!0}):d;if(a&&typeof a==="object"||typeof a==="function"){for(let e of l(a))if(!m.call(c,e))i(c,e,{get:n.bind(a,e),enumerable:!0})}if(f)g.set(a,c);return c};var s=(a,b)=>()=>(b||a((b={exports:{}}).exports,b),b.exports);var u=q(import.meta.url);
-export{r as Ou,s as Pu,u as Qu};
+export{r as Mv,s as Nv,u as Ov};

package/dist/deploy/index.js

@@ -1 +1 @@
-import{$c as ra,Ac as I,Bc as J,Cc as K,Dc as L,Ec as M,Fc as N,Gc as O,Hc as P,Ic as Q,Jc as R,Kc as S,Lc as T,Mc as U,Nc as V,Oc as W,Pc as X,Pd as Ha,Qc as ga,Qd as Ia,Rc as ha,Rd as Ja,Sc as ia,Sd as Ka,Tc as ja,Uc as ka,Vc as la,Wc as ma,Xc as na,Yc as oa,Zc as pa,_c as qa,ad as ta,bd as ua,cd as va,dd as wa,ed as xa,fd as ya,gd as za,hd as Aa,id as Ba,jd as Ca,kd as Da,ld as Ea,md as Fa,nd as Ga,xc as F,yc as G,zc as H}from"../chunk-y3tbcxb7.js";import{$d as fa,Td as Y,Ud as Z,Vd as _,Wd as aa,Xd as ba,Yd as ca,Zd as da,_d as ea}from"../chunk-jxrs1219.js";import{he as sa}from"../chunk-2k0mt6j5.js";import"../chunk-gkj1tpsn.js";import"../chunk-82gezmen.js";import"../chunk-7j100g7w.js";import"../chunk-jphewtbx.js";import"../chunk-fbwpm0zm.js";import"../chunk-rg7d67xk.js";import"../chunk-982rye5b.js";import{$h as D,Ag as y,Xh as z,Yh as A,Zh as B,_h as C,ai as E,ug as s,vg as t,wg as u,xg as v,yg as w,zg as x}from"../chunk-3swnmwfc.js";import"../chunk-bcffjsnj.js";import"../chunk-557qj7q9.js";import"../chunk-c8cadhgc.js";import"../chunk-70v77sqv.js";import"../chunk-a368cs92.js";import{rj as l,sj as m,tj as n,uj as o,vj as p,wj as q,xj as r}from"../chunk-2qm3rw8b.js";import{Aj as c,Bj as d,Cj as e,Dj as f,Ej as g,Fj as h,Gj as i,Hj as j,Ij as k,yj as a,zj as b}from"../chunk-c1hr34a5.js";import"../chunk-5hkq5081.js";import"../chunk-pb47hr0h.js";import"../chunk-fsssdd5k.js";import"../chunk-0hw5wjjg.js";export{m as DEFAULT_SITE_PORT_RANGE,l as HOST_SITES_DIR,v as IPV6_EXCLUDED_HOST_LABELS,z as MANAGEMENT_DASHBOARD_SITE,F as addSiteToCloudConfig,r as allocateSitePorts,ra as buildAndPushContainerImage,sa as buildAndPushServerlessImage,ua as buildFunctionEnv,p as buildHostSitePortsScript,E as buildManagementDashboardArtifact,Aa as buildServerTopology,Ba as buildServerlessTopology,Ca as buildTopology,Ga as collectEgressMetrics,s as collectServerDnsDomains,qa as createContainerImageDependencies,la as createExistingStaticFullStackDependencies,ha as createStaticApiOriginDependencies,Ia as dashboardActions,A as dashboardCredentialsFile,V as dashboardPageRoutes,ea as deleteStaticSite,na as deployExistingStaticFullStack,va as deployServerlessApp,k as deployShipsFiles,ga as deploySite,ia as deployStaticApiOrigin,ba as deployStaticSite,fa as deployStaticSiteFull,Z as deployStaticSiteWithExternalDns,_ as deployStaticSiteWithExternalDnsFull,Ea as egressReportMetrics,R as ensureDashboardActor,D as ensureManagementDashboard,oa as estimateExistingStaticFullStackMonthlyCost,ka as estimateStaticApiOriginMonthlyCost,Fa as fetchEgressReport,ma as generateExistingStaticFullStackTemplate,Y as generateExternalDnsStaticSiteTemplate,aa as generateStaticSiteTemplate,g as hasComputeConfigured,d as hasProxyUpstream,pa as hashContainerContext,w as hostAcceptsIpv6,ta as infraEnvFromOutputs,S as initializeDashboardControlPlane,da as invalidateCache,b as isPhpSite,M as isValidHostname,u as normalizePublicIpv6,o as occupiedHostPorts,q as parseHostSiteFragments,n as parseUpstreamPort,x as reconcileAddressRecords,wa as redeployServerlessApp,G as removeSiteFromCloudConfig,t as removeStaleServerAddressRecords,N as renderAliasesValue,L as renderEnvValue,O as renderRedirectsValue,P as renderSiteSnippet,J as renderSslValue,K as renderStringValue,Ja as resolveDashboardAction,B as resolveDashboardAuth,Da as resolveDashboardData,W as resolveLegacyDashboardRoute,c as resolveProxyUpstreams,e as resolveSiteDeployTarget,f as resolveSiteKind,C as resolveUiSource,xa as rollbackServerlessApp,X as routesForDashboard,za as runRemoteCommand,Ha as sanitizeCloudConfig,Q as setAttachToInCloudConfig,ya as setMaintenance,I as setSitePropertyInCloudConfig,i as shipsARelease,j as shipsToBucket,a as siteInstallBase,Ka as startLocalDashboardServer,T as synchronizeDashboardUsers,U as trackDashboardOperation,H as updateSiteInCloudConfig,ca as uploadStaticFiles,h as validateDeploymentConfig,y as verifyAddressRecord,ja as verifyStaticApiOrigin};
+import{$c as ra,Ac as I,Bc as J,Cc as K,Dc as L,Ec as M,Fc as N,Gc as O,Hc as P,Ic as Q,Jc as R,Kc as S,Lc as T,Mc as U,Nc as V,Oc as W,Pc as X,Pd as Ha,Qc as ga,Qd as Ia,Rc as ha,Rd as Ja,Sc as ia,Sd as Ka,Tc as ja,Uc as ka,Vc as la,Wc as ma,Xc as na,Yc as oa,Zc as pa,_c as qa,ad as ta,bd as ua,cd as va,dd as wa,ed as xa,fd as ya,gd as za,hd as Aa,id as Ba,jd as Ca,kd as Da,ld as Ea,md as Fa,nd as Ga,xc as F,yc as G,zc as H}from"../chunk-ea7tn8nn.js";import{$d as fa,Td as Y,Ud as Z,Vd as _,Wd as aa,Xd as ba,Yd as ca,Zd as da,_d as ea}from"../chunk-zh0apedk.js";import{he as sa}from"../chunk-whyttetx.js";import"../chunk-yf8stygs.js";import"../chunk-mnmz8t7q.js";import"../chunk-n1fyryha.js";import"../chunk-ze5x2bpm.js";import"../chunk-k8x8mrkr.js";import"../chunk-j06r5rwv.js";import"../chunk-2ybcnrte.js";import{Ag as y,Ui as z,Vi as A,Wi as B,Xi as C,Yi as D,Zi as E,ug as s,vg as t,wg as u,xg as v,yg as w,zg as x}from"../chunk-t8hzekmk.js";import"../chunk-n5xmh0ma.js";import"../chunk-6cxb8d6y.js";import"../chunk-ess6vxfj.js";import"../chunk-j1g67djb.js";import"../chunk-ac87ds1k.js";import{ok as l,pk as m,qk as n,rk as o,sk as p,tk as q,uk as r}from"../chunk-7z50g5xz.js";import{Ak as f,Bk as g,Ck as h,Dk as i,Ek as j,Fk as k,vk as a,wk as b,xk as c,yk as d,zk as e}from"../chunk-n1hg0jxs.js";import"../chunk-q9a1z53k.js";import"../chunk-4wdxsnn2.js";import"../chunk-r8t25tbm.js";import"../chunk-zjyz926j.js";export{m as DEFAULT_SITE_PORT_RANGE,l as HOST_SITES_DIR,v as IPV6_EXCLUDED_HOST_LABELS,z as MANAGEMENT_DASHBOARD_SITE,F as addSiteToCloudConfig,r as allocateSitePorts,ra as buildAndPushContainerImage,sa as buildAndPushServerlessImage,ua as buildFunctionEnv,p as buildHostSitePortsScript,E as buildManagementDashboardArtifact,Aa as buildServerTopology,Ba as buildServerlessTopology,Ca as buildTopology,Ga as collectEgressMetrics,s as collectServerDnsDomains,qa as createContainerImageDependencies,la as createExistingStaticFullStackDependencies,ha as createStaticApiOriginDependencies,Ia as dashboardActions,A as dashboardCredentialsFile,V as dashboardPageRoutes,ea as deleteStaticSite,na as deployExistingStaticFullStack,va as deployServerlessApp,k as deployShipsFiles,ga as deploySite,ia as deployStaticApiOrigin,ba as deployStaticSite,fa as deployStaticSiteFull,Z as deployStaticSiteWithExternalDns,_ as deployStaticSiteWithExternalDnsFull,Ea as egressReportMetrics,R as ensureDashboardActor,D as ensureManagementDashboard,oa as estimateExistingStaticFullStackMonthlyCost,ka as estimateStaticApiOriginMonthlyCost,Fa as fetchEgressReport,ma as generateExistingStaticFullStackTemplate,Y as generateExternalDnsStaticSiteTemplate,aa as generateStaticSiteTemplate,g as hasComputeConfigured,d as hasProxyUpstream,pa as hashContainerContext,w as hostAcceptsIpv6,ta as infraEnvFromOutputs,S as initializeDashboardControlPlane,da as invalidateCache,b as isPhpSite,M as isValidHostname,u as normalizePublicIpv6,o as occupiedHostPorts,q as parseHostSiteFragments,n as parseUpstreamPort,x as reconcileAddressRecords,wa as redeployServerlessApp,G as removeSiteFromCloudConfig,t as removeStaleServerAddressRecords,N as renderAliasesValue,L as renderEnvValue,O as renderRedirectsValue,P as renderSiteSnippet,J as renderSslValue,K as renderStringValue,Ja as resolveDashboardAction,B as resolveDashboardAuth,Da as resolveDashboardData,W as resolveLegacyDashboardRoute,c as resolveProxyUpstreams,e as resolveSiteDeployTarget,f as resolveSiteKind,C as resolveUiSource,xa as rollbackServerlessApp,X as routesForDashboard,za as runRemoteCommand,Ha as sanitizeCloudConfig,Q as setAttachToInCloudConfig,ya as setMaintenance,I as setSitePropertyInCloudConfig,i as shipsARelease,j as shipsToBucket,a as siteInstallBase,Ka as startLocalDashboardServer,T as synchronizeDashboardUsers,U as trackDashboardOperation,H as updateSiteInCloudConfig,ca as uploadStaticFiles,h as validateDeploymentConfig,y as verifyAddressRecord,ja as verifyStaticApiOrigin};

package/dist/dns/index.js

@@ -1 +1 @@
-import{$f as d,Xf as a,Yf as b,Zf as c,ag as e,bg as f,cg as g,dg as h,eg as i,fg as j,gg as k,hg as l,ig as m,jg as n,kg as o,lg as p,mg as q,ng as r,og as s,pg as t,qg as u}from"../chunk-rg7d67xk.js";import"../chunk-982rye5b.js";import"../chunk-a368cs92.js";import"../chunk-0hw5wjjg.js";export{d as CloudflareProvider,t as DnsProviderFactory,c as GoDaddyProvider,a as PROXIABLE_RECORD_TYPES,b as PorkbunProvider,i as Route53Provider,n as UnifiedDnsValidator,l as applyZoneMigration,r as createDnsProvider,p as createGoDaddyValidator,o as createPorkbunValidator,q as createRoute53Validator,s as detectDnsProvider,u as dnsProviders,j as exportRoute53Zone,k as planZoneMigration,e as policyTag,f as qualifyName,h as reconcileDeclaredRecords,g as resolveDeclaredRecords,m as verifyZoneParity};
+import{$f as d,Xf as a,Yf as b,Zf as c,ag as e,bg as f,cg as g,dg as h,eg as i,fg as j,gg as k,hg as l,ig as m,jg as n,kg as o,lg as p,mg as q,ng as r,og as s,pg as t,qg as u}from"../chunk-j06r5rwv.js";import"../chunk-2ybcnrte.js";import"../chunk-ac87ds1k.js";import"../chunk-zjyz926j.js";export{d as CloudflareProvider,t as DnsProviderFactory,c as GoDaddyProvider,a as PROXIABLE_RECORD_TYPES,b as PorkbunProvider,i as Route53Provider,n as UnifiedDnsValidator,l as applyZoneMigration,r as createDnsProvider,p as createGoDaddyValidator,o as createPorkbunValidator,q as createRoute53Validator,s as detectDnsProvider,u as dnsProviders,j as exportRoute53Zone,k as planZoneMigration,e as policyTag,f as qualifyName,h as reconcileDeclaredRecords,g as resolveDeclaredRecords,m as verifyZoneParity};

package/dist/drivers/hetzner/cloud-init.d.ts

@@ -17,4 +17,17 @@ export { buildUbuntuBootstrapScript as generateUbuntuAppCloudInit, type UbuntuBo
  * inline under `runcmd:` silently breaks bun/caddy installation. Writing the
  * file (shebang preserved) and running `bash <file>` guarantees a bash shell.
  */
-export declare function wrapCloudInitUserData(bootstrapScript: string): string;
+export interface CloudInitUserDataExtras {
+    /** Where the script is written on the box. @default '/var/lib/cloud/ts-cloud-bootstrap.sh' */
+    scriptPath?: string;
+    /** File mode of the written script. @default '0755' */
+    permissions?: string;
+    /**
+     * Top-level cloud-config YAML emitted before `write_files:` (hostname,
+     * users, packages, ...). Complete lines, already at top-level indentation.
+     */
+    before?: string;
+    /** Top-level cloud-config YAML emitted after `runcmd:`. */
+    after?: string;
+}
+export declare function wrapCloudInitUserData(bootstrapScript: string, extras?: CloudInitUserDataExtras): string;

package/dist/drivers/hetzner/driver.d.ts

@@ -1,20 +1,7 @@
 import type { CloudDriver, ComputeStackOutputs, ComputeTarget, FindComputeTargetsOptions, ProvisionComputeOptions, ReachableResource, RemoteDeployResult, RunRemoteDeployOptions, UploadReleaseOptions, UploadReleaseResult } from '@ts-cloud/core';
 import { HetznerClient } from './client';
-/**
- * The part of the deploy script bash refused to parse.
- *
- * A syntax error names a line number in a file that only ever existed on the
- * box, and the deploy deletes it on the way out — so the one thing needed to
- * understand the failure is the one thing nobody can look at. Without this you
- * are reduced to guessing which generated fragment is unbalanced, or to
- * reproducing the whole script by hand from its builders.
- *
- * Only a window around the reported line, and every `KEY="value"` line inside
- * it is redacted: the script carries the runtime environment, and a deploy
- * failure must not become the reason a database password is in a CI log.
- */
-export declare function describeScriptSyntaxError(error: unknown, script: string): string;
-export declare function formatSshFailure(error: unknown): string;
+import { describeScriptSyntaxError, formatSshFailure } from '../shared/remote-failure';
+export { describeScriptSyntaxError, formatSshFailure };
 export interface HetznerDriverOptions {
     apiToken?: string;
     /**

package/dist/drivers/hetzner/state.d.ts

@@ -1,3 +1,13 @@
+/**
+ * Hetzner driver state.
+ *
+ * The file handling itself lives in `../shared/driver-state` (one reader and
+ * writer for every SSH-style driver); this module keeps the Hetzner-typed
+ * view of it so the driver, the dashboard and the CLI read `serverId` and
+ * friends without a cast at every call site.
+ */
+import type { DriverState } from '../shared/driver-state';
+export { LEGACY_DRIVER_STATE_DIR } from '../shared/driver-state';
 export interface HetznerDriverState {
     provider: 'hetzner';
     stackName: string;
@@ -30,7 +40,12 @@ export interface HetznerDriverState {
     lbServerId?: number;
     appServerIds?: number[];
 }
-export declare const STATE_DIR = "storage/cloud/state";
+/**
+ * The legacy, project-relative driver-state directory. Kept for callers that
+ * spell the path by hand; new code should ask `driverStateDir()` instead,
+ * which also honours a configured state directory.
+ */
+export declare const STATE_DIR: string;
 export declare function driverStatePath(stackName: string): string;
 export declare function readDriverState(stackName: string): Promise<HetznerDriverState | null>;
-export declare function writeDriverState(stackName: string, state: HetznerDriverState): Promise<void>;
+export declare function writeDriverState(stackName: string, state: DriverState): Promise<void>;

package/dist/drivers/index.d.ts

@@ -2,6 +2,21 @@ export * from './factory';
 export { AwsDriver } from './aws/driver';
 export { HetznerDriver } from './hetzner/driver';
 export { isBoxMode, LocalBoxDriver } from './local-box/driver';
+export { assertSshComputeConfig, SSH_DEPLOY_STORAGE_PATH, SSH_SKIP_BOOTSTRAP_ENV, SshDriver } from './ssh/driver';
+export type { SshDriverOptions } from './ssh/driver';
+export { resolveSshHostKeyPolicy, resolveSshHosts, resolveSshLan, resolveSshPort, resolveSshPrivateKeyPath, resolveSshProfile, resolveSshPublicIp, resolveSshSettings, resolveSshSudo, resolveSshUser, SSH_DEFAULTS, } from './ssh/config';
+export type { ResolvedSshHost, ResolvedSshSettings, SshHostKeyPolicyName, SshLanConfig, SshOverrides, SshProfile } from './ssh/config';
+export { assertArchSupported, buildSshBootstrapScript, RASPBERRY_PI_DEFAULT_SWAP_GB, SSH_BOOTSTRAP_MARKER_DIR, SSH_BOOTSTRAP_VERSION, sshBootstrapMarkerPath, } from './ssh/bootstrap';
+export type { SshBootstrapOptions } from './ssh/bootstrap';
+export { evaluatePreflight, formatPreflightFindings, parsePreflightFacts, preflightFailed, SSH_PREFLIGHT_SCRIPT, } from './ssh/preflight';
+export type { PreflightContext, SshPreflightFacts } from './ssh/preflight';
+export { BOOT_PARTITION_LABEL, buildCloudInitFirstBoot, FIRST_BOOT_SCRIPT_PATH } from './ssh/first-boot';
+export type { FirstBootBundle, FirstBootIdentity, FirstBootOptions, FirstBootOs, FirstBootWifi } from './ssh/first-boot';
+export { buildScpArgsFor, buildSshArgsFor, findKnownHostKey, knownHostsLine, knownHostsToken, scanHostKey, SSH_INSECURE_HOST_KEY_OPTS, SSH_KEEPALIVE_OPTS, sshHostKeyFingerprint, sshKnownHostsPath, SystemSshTransport, } from './shared/ssh-transport';
+export type { CommandResult, CommandRunner, ScannedHostKey, SshExecOptions, SshHostKeyPolicy, SshHostKeyResult, SshTransport, SshTransportOptions, SystemSshTransportDeps, } from './shared/ssh-transport';
+export { driverStateDir, driverStatePath, LEGACY_DRIVER_STATE_DIR, readDriverState, writeDriverState, } from './shared/driver-state';
+export type { DriverState, SshDriverState } from './shared/driver-state';
+export { describeScriptSyntaxError, formatSshFailure, summarizeRemoteFailures, surfaceRemoteNotices } from './shared/remote-failure';
 export { HetznerClient, normalizeSshPublicKey, resolveHetznerApiToken } from './hetzner/client';
 export { executeHetznerServerResize, isHetznerCapacityError, planHetznerServerResize, } from './hetzner/resize';
 export type { ExecuteHetznerResizeOptions, HetznerResizeHooks, HetznerResizePhase, HetznerResizePlan, HetznerResizeResult, HetznerResizeVerification, } from './hetzner/resize';
@@ -12,9 +27,10 @@ export type { HetznerHostOptimizationOptions, HetznerHostOptimizationPlan, Hetzn
 export { acquireResizeLock, readResizeCheckpoint, resizeCheckpointPath, resizeLockPath, writeResizeCheckpoint, } from './hetzner/resize-state';
 export type { HetznerResizeCheckpoint } from './hetzner/resize-state';
 export { generateUbuntuAppCloudInit, wrapCloudInitUserData } from './hetzner/cloud-init';
+export type { CloudInitUserDataExtras } from './hetzner/cloud-init';
 export { ensureFirewall, ensureServer, ensureSshKey, serverPublicIpv4 } from './hetzner/provision';
 export type { EnsuredResource, EnsuredServer, EnsureFirewallOptions, EnsureServerOptions, EnsureSshKeyOptions, } from './hetzner/provision';
-export { buildSshArgs, scpUpload, sshExec, sshExecOrThrow, waitForCloudInit, waitForSsh } from './shared/remote-exec';
+export { buildSshArgs, REMOTE_SCRIPT_RUNNER, remoteScriptRunner, scpUpload, sshExec, sshExecOrThrow, waitForCloudInit, waitForSsh } from './shared/remote-exec';
 export type { RemoteExecOptions, RemoteExecResult, WaitOptions } from './shared/remote-exec';
 export { AwsBoxProvisioner, buildBoxUserData, createBoxProvisioner, HetznerBoxProvisioner, UBUNTU_2404_AMI_PARAM, } from './shared/box-provision';
 export type { AwsBoxProvisionerOptions, BoxPort, BoxProviderName, BoxProvisioner, BoxSpec, CreateBoxProvisionerOptions, ProvisionedBox, } from './shared/box-provision';

package/dist/drivers/index.js

@@ -1 +1 @@
-import{$g as q,Ah as Q,Bh as R,Ch as S,Dh as T,Eh as U,Fh as V,Gh as W,Hh as X,Ih as Y,Jh as Z,Kh as _,Lg as a,Lh as aa,Mg as b,Mh as ba,Ng as c,Nh as ca,Og as d,Pg as e,Qg as f,Qh as da,Rg as g,Rh as ea,Sg as h,Sh as fa,Tg as i,Th as ga,Ug as j,Uh as ha,Vg as k,Vh as ia,Wg as l,Wh as ja,Xg as m,Yg as n,Zg as o,_g as p,ah as r,bh as s,ch as t,ci as ka,dh as u,di as la,ei as ma,fh as v,fi as na,gh as w,gi as oa,hh as x,hi as pa,ih as y,ii as qa,jh as z,ji as ra,kh as A,lh as B,mh as C,nh as D,oh as E,ph as F,qh as G,rh as H,sh as I,th as J,uh as K,vh as L,wh as M,xh as N,yh as O,zh as P}from"../chunk-3swnmwfc.js";import"../chunk-bcffjsnj.js";import"../chunk-557qj7q9.js";import"../chunk-c8cadhgc.js";import"../chunk-70v77sqv.js";import"../chunk-a368cs92.js";import"../chunk-c1hr34a5.js";import"../chunk-pb47hr0h.js";import"../chunk-fsssdd5k.js";import"../chunk-0hw5wjjg.js";export{ba as AwsBoxProvisioner,o as AwsDriver,D as CloudDriverFactory,a as DEFAULT_RPX_CERTS_DIR,aa as HetznerBoxProvisioner,v as HetznerClient,z as HetznerDriver,A as LocalBoxDriver,pa as MANAGED_CACHE_POLICY_DISABLED,oa as MANAGED_CACHE_POLICY_OPTIMIZED,qa as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,i as RPX_DIR,j as RPX_LAUNCHER_PATH,k as RPX_SERVICE_NAME,Z as UBUNTU_2404_AMI_PARAM,U as acquireResizeLock,N as applyHetznerHostOptimization,ha as buildAwsArtifactFetch,_ as buildBoxUserData,ra as buildCloudFrontOriginConfig,M as buildHetznerHostOptimizationScript,ja as buildHostCleanupScript,ia as buildLocalArtifactFetch,f as buildRpxConfig,m as buildRpxFragmentRefreshScript,g as buildRpxLbConfig,l as buildRpxProvisionScript,ea as buildSiteDeployScript,p as buildSshArgs,fa as buildStaticSiteDeployScript,E as cloudDrivers,O as collectHetznerHostOptimizationReport,I as collectHetznerResizeManifest,ca as createBoxProvisioner,C as createCloudDriver,la as deployAllComputeSites,ka as deploySiteRelease,e as deriveRouteId,W as ensureFirewall,X as ensureServer,V as ensureSshKey,H as executeHetznerServerResize,c as gatewayHostnames,n as generateUbuntuAppCloudInit,b as hasAutoWwwVariant,B as isBoxMode,G as isHetznerCapacityError,d as normalizeRoutePath,x as normalizeSshPublicKey,F as planHetznerServerResize,J as prepareHetznerResize,S as readResizeCheckpoint,ga as releaseTarballTmpPath,ma as reloadRpxGateway,h as renderRpxLauncher,na as renewRpxCertificates,Q as resizeCheckpointPath,R as resizeLockPath,da as resolveExecStart,w as resolveHetznerApiToken,L as resolveHetznerHostOptimizationPlan,s as scpUpload,Y as serverPublicIpv4,q as sshExec,r as sshExecOrThrow,P as verifyHetznerHostOptimization,K as verifyHetznerResize,u as waitForCloudInit,t as waitForSsh,y as wrapCloudInitUserData,T as writeResizeCheckpoint};
+import{$g as q,$h as qa,$i as hb,Ah as Q,Ai as Ra,Bg as a,Bh as R,Bi as Sa,Cg as b,Ch as S,Ci as Ta,Dg as c,Dh as T,Di as Ua,Eg as d,Eh as U,Ei as Va,Fh as V,Fi as Wa,Gh as W,Gi as Xa,Hh as X,Hi as Ya,Ih as Y,Ii as Za,Jh as Z,Ji as _a,Kh as _,Ki as $a,Lh as aa,Mh as ba,Nh as ca,Ni as ab,Oh as da,Oi as bb,Pg as e,Ph as ea,Pi as cb,Qg as f,Qh as fa,Qi as db,Rg as g,Rh as ga,Ri as eb,Sg as h,Sh as ha,Si as fb,Tg as i,Th as ia,Ti as gb,Ug as j,Uh as ja,Vg as k,Vh as ka,Wg as l,Wh as la,Xg as m,Xh as ma,Yg as n,Yh as na,Zg as o,Zh as oa,_g as p,_h as pa,ah as r,ai as ra,aj as ib,bh as s,bi as sa,bj as jb,ch as t,ci as ta,cj as kb,dh as u,di as ua,dj as lb,eh as v,ei as va,ej as mb,fh as w,fi as wa,fj as nb,gh as x,gi as xa,gj as ob,hh as y,hi as ya,ih as z,ii as za,jh as A,ji as Aa,ki as Ba,lh as B,li as Ca,mh as C,mi as Da,nh as D,ni as Ea,oh as E,oi as Fa,ph as F,pi as Ga,qh as G,qi as Ha,rh as H,ri as Ia,sh as I,si as Ja,th as J,ti as Ka,uh as K,ui as La,vh as L,vi as Ma,wh as M,wi as Na,xh as N,xi as Oa,yh as O,yi as Pa,zh as P,zi as Qa}from"../chunk-t8hzekmk.js";import"../chunk-n5xmh0ma.js";import"../chunk-6cxb8d6y.js";import"../chunk-ess6vxfj.js";import"../chunk-j1g67djb.js";import"../chunk-ac87ds1k.js";import"../chunk-n1hg0jxs.js";import"../chunk-4wdxsnn2.js";import"../chunk-r8t25tbm.js";import"../chunk-zjyz926j.js";export{_a as AwsBoxProvisioner,s as AwsDriver,Ba as BOOT_PARTITION_LABEL,ya as CloudDriverFactory,e as DEFAULT_RPX_CERTS_DIR,Aa as FIRST_BOOT_SCRIPT_PATH,Za as HetznerBoxProvisioner,B as HetznerClient,K as HetznerDriver,F as LEGACY_DRIVER_STATE_DIR,L as LocalBoxDriver,mb as MANAGED_CACHE_POLICY_DISABLED,lb as MANAGED_CACHE_POLICY_OPTIMIZED,nb as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,aa as RASPBERRY_PI_DEFAULT_SWAP_GB,A as REMOTE_SCRIPT_RUNNER,m as RPX_DIR,n as RPX_LAUNCHER_PATH,o as RPX_SERVICE_NAME,Z as SSH_BOOTSTRAP_MARKER_DIR,Y as SSH_BOOTSTRAP_VERSION,da as SSH_DEFAULTS,ta as SSH_DEPLOY_STORAGE_PATH,N as SSH_INSECURE_HOST_KEY_OPTS,O as SSH_KEEPALIVE_OPTS,oa as SSH_PREFLIGHT_SCRIPT,ua as SSH_SKIP_BOOTSTRAP_ENV,wa as SshDriver,X as SystemSshTransport,Xa as UBUNTU_2404_AMI_PARAM,Sa as acquireResizeLock,La as applyHetznerHostOptimization,ba as assertArchSupported,va as assertSshComputeConfig,eb as buildAwsArtifactFetch,Ya as buildBoxUserData,ob as buildCloudFrontOriginConfig,Ca as buildCloudInitFirstBoot,Ka as buildHetznerHostOptimizationScript,gb as buildHostCleanupScript,fb as buildLocalArtifactFetch,j as buildRpxConfig,q as buildRpxFragmentRefreshScript,k as buildRpxLbConfig,p as buildRpxProvisionScript,Q as buildScpArgsFor,bb as buildSiteDeployScript,t as buildSshArgs,P as buildSshArgsFor,ca as buildSshBootstrapScript,cb as buildStaticSiteDeployScript,za as cloudDrivers,Ma as collectHetznerHostOptimizationReport,Ga as collectHetznerResizeManifest,$a as createBoxProvisioner,xa as createCloudDriver,ib as deployAllComputeSites,hb as deploySiteRelease,i as deriveRouteId,a as describeScriptSyntaxError,G as driverStateDir,H as driverStatePath,Ua as ensureFirewall,Va as ensureServer,Ta as ensureSshKey,qa as evaluatePreflight,Fa as executeHetznerServerResize,V as findKnownHostKey,sa as formatPreflightFindings,b as formatSshFailure,g as gatewayHostnames,r as generateUbuntuAppCloudInit,f as hasAutoWwwVariant,M as isBoxMode,Ea as isHetznerCapacityError,U as knownHostsLine,T as knownHostsToken,h as normalizeRoutePath,D as normalizeSshPublicKey,pa as parsePreflightFacts,Da as planHetznerServerResize,ra as preflightFailed,Ha as prepareHetznerResize,I as readDriverState,Qa as readResizeCheckpoint,db as releaseTarballTmpPath,jb as reloadRpxGateway,z as remoteScriptRunner,l as renderRpxLauncher,kb as renewRpxCertificates,Oa as resizeCheckpointPath,Pa as resizeLockPath,ab as resolveExecStart,C as resolveHetznerApiToken,Ja as resolveHetznerHostOptimizationPlan,ia as resolveSshHostKeyPolicy,ea as resolveSshHosts,ma as resolveSshLan,ga as resolveSshPort,ha as resolveSshPrivateKeyPath,ka as resolveSshProfile,la as resolveSshPublicIp,na as resolveSshSettings,ja as resolveSshSudo,fa as resolveSshUser,S as scanHostKey,w as scpUpload,Wa as serverPublicIpv4,_ as sshBootstrapMarkerPath,u as sshExec,v as sshExecOrThrow,R as sshHostKeyFingerprint,W as sshKnownHostsPath,d as summarizeRemoteFailures,c as surfaceRemoteNotices,Na as verifyHetznerHostOptimization,Ia as verifyHetznerResize,y as waitForCloudInit,x as waitForSsh,E as wrapCloudInitUserData,J as writeDriverState,Ra as writeResizeCheckpoint};

package/dist/drivers/local-box/driver.d.ts

@@ -9,7 +9,7 @@ import type { CloudDriver, ComputeStackOutputs, ComputeTarget, FindComputeTarget
  * the box; provisioning/upload methods are inert (the box is already up).
  */
 export declare class LocalBoxDriver implements CloudDriver {
-    readonly name: 'hetzner';
+    readonly name: 'ssh';
     readonly usesCloudFormation = false;
     getComputeOutputs(): Promise<ComputeStackOutputs>;
     uploadRelease(options: UploadReleaseOptions): Promise<UploadReleaseResult>;

package/dist/drivers/shared/compute-deploy.d.ts

@@ -49,18 +49,6 @@ export declare function buildManagementDashboardServiceReconciliationScript(slug
  * without `start`, shipped to `/var/www/<site>`). Bucket sites are skipped.
  */
 export declare function deployAllComputeSites(options: DeployAllSitesOptions): Promise<boolean>;
-/**
- * Regenerate the rpx gateway config from the sites model and (re)start the
- * gateway. No-op (returns `true`) unless `compute.proxy.engine === 'rpx'`.
- *
- * Two shapes, resolved by probing for a dedicated load-balancer target:
- *  - **Fleet** (bun-style: one rpx LB box fronts N gateway-less app boxes) —
- *    rewrite ONLY the LB's route fragment with the multi-upstream LB config
- *    ({@link buildRpxLbConfig} + {@link buildRpxFragmentRefreshScript}).
- *  - **Single box** — the gateway is co-located with the app, so the full
- *    provision script runs on the app targets. Re-runnable: it rewrites the
- *    launcher + unit and `systemctl restart`s, reloading the new routes.
- */
 export declare function reloadRpxGateway(options: DeployAllSitesOptions): Promise<boolean>;
 /**
  * Request the first production certificates after DNS has been reconciled.

package/dist/drivers/shared/compute-provision.d.ts

@@ -33,6 +33,13 @@ export interface ComputeProvisionOptions {
      * than one that offers SMTP to the internet.
      */
     environment?: string;
+    /**
+     * Where the managed `authorized_keys` block is written. Defaults to root's
+     * file; a bootstrap that deploys as another user (the ssh provider with a
+     * `pi` or `deploy` user) points it at that user's home, or the operator
+     * keys in `compute.sshKeys` would authorize logins for the wrong account.
+     */
+    authorizedKeysPath?: string;
 }
 /**
  * Build the machine provisioning scripts from a CloudConfig. Returns the

package/dist/drivers/shared/driver-state.d.ts

@@ -0,0 +1,68 @@
+/**
+ * The per-stack state a compute driver records on the machine running deploys.
+ *
+ * Every SSH-style driver has to remember which box a stack lives on: Hetzner
+ * pins a server id so CI can find the existing box instead of provisioning a
+ * duplicate, and the ssh driver pins the host it adopted plus what it did to
+ * it. One file per stack, one reader and one writer, so a driver, the
+ * dashboard and the CLI cannot disagree about where that file is.
+ *
+ * ## Where the file lives
+ *
+ * Driver state predates the configurable state directory and has a legacy
+ * home of its own, `storage/cloud/state/` (the Stacks storage convention),
+ * which is meant to be COMMITTED: unlike dashboard credentials it holds
+ * nothing secret, and a checkout without it re-provisions. A project that
+ * configured `stateDir` (or set `TS_CLOUD_STATE_DIR`) keeps driver state
+ * under it instead, in `<stateDir>/state/`. A Stacks application sets
+ * `stateDir: 'storage/cloud'`, so for it the two spellings name the same
+ * directory and nothing moves.
+ */
+import type { HetznerDriverState } from '../hetzner/state';
+/** The committed driver-state directory used when no state directory is configured. */
+export declare const LEGACY_DRIVER_STATE_DIR = "storage/cloud/state";
+/** What the ssh driver remembers about a host it adopted. */
+export interface SshDriverState {
+    provider: 'ssh';
+    stackName: string;
+    /** The hostname or address deploys connect to, exactly as configured. */
+    host: string;
+    sshUser: string;
+    sshPort: number;
+    /** `SHA256:...` of the pinned host key, when the host-key policy pins. */
+    hostKeyFingerprint?: string;
+    /** The address DNS should point at, when known (configured, or detected). */
+    publicIp?: string;
+    /** The host's first LAN address, as reported by the preflight. */
+    lanIp?: string;
+    deployStoragePath?: string;
+    profile?: 'raspberry-pi' | 'generic';
+    /** The bootstrap recipe version last applied to the host. */
+    bootstrapVersion?: number;
+    /** When that bootstrap ran, ISO 8601. */
+    bootstrappedAt?: string;
+}
+export type DriverState = HetznerDriverState | SshDriverState;
+/**
+ * The directory driver state files live in, absolute.
+ *
+ * `<stateDir>/state` when a state directory is configured, the legacy
+ * `storage/cloud/state` otherwise. See the module comment for why the legacy
+ * path is not simply `.ts-cloud/state`.
+ */
+export declare function driverStateDir(cwd?: string): string;
+/** Absolute path of the state file for `stackName`. */
+export declare function driverStatePath(stackName: string, cwd?: string): string;
+/**
+ * Read the state file for `stackName`, or null when there is none (or it is
+ * unreadable: a corrupt file is treated as absent, and the atomic write below
+ * is what keeps that from ever losing a pin).
+ */
+export declare function readDriverState<T extends DriverState = DriverState>(stackName: string, cwd?: string): Promise<T | null>;
+/**
+ * Replace the state file for `stackName` atomically: a crash mid-write would
+ * corrupt the JSON, and the reader's catch-all would then lose the pinned box
+ * (silently re-provisioning a duplicate). Temp file + rename on the same
+ * filesystem is atomic.
+ */
+export declare function writeDriverState(stackName: string, state: DriverState, cwd?: string): Promise<void>;

package/dist/drivers/shared/remote-exec.d.ts

@@ -9,6 +9,8 @@
 export interface RemoteExecOptions {
     /** SSH user. @default 'root' */
     user?: string;
+    /** SSH port. Omit for the ambient default (22, or whatever `~/.ssh/config` says). */
+    port?: number;
     /** Private key passed as `ssh -i`. Omit to use the ambient SSH config/agent. */
     identityFile?: string;
     /** SSH `ConnectTimeout` in seconds. @default 10 */
@@ -23,8 +25,11 @@ export interface RemoteExecResult {
  * The ssh/scp CLI arguments implied by {@link RemoteExecOptions}. Host key
  * checking is disabled because these helpers target freshly-created servers
  * whose host keys cannot be known in advance.
+ *
+ * `scp` spells the port flag differently (`-P`; its `-p` preserves file
+ * times), so say which binary the arguments are for.
  */
-export declare function buildSshArgs(options?: RemoteExecOptions): string[];
+export declare function buildSshArgs(options?: RemoteExecOptions, binary?: 'ssh' | 'scp'): string[];
 /** Run a command on the host over SSH, capturing exit code and output. */
 export declare function sshExec(host: string, command: string, options?: RemoteExecOptions): Promise<RemoteExecResult>;
 /** Like {@link sshExec}, but throws on non-zero exit and returns stdout. */
@@ -63,4 +68,8 @@ export declare function waitForCloudInit(host: string, options?: WaitOptions): P
  * `-s` in the first place), and `mktemp` creates the file 0600, so the window
  * where they touch disk is both short and unreadable to other users.
  */
+export declare function remoteScriptRunner(options?: {
+    sudo?: boolean;
+}): string;
+/** The runner for a root deploy user; see {@link remoteScriptRunner}. */
 export declare const REMOTE_SCRIPT_RUNNER: string;

package/dist/drivers/shared/remote-failure.d.ts

@@ -12,6 +12,47 @@
  * `formatSshFailure`), so this only has to decide what is worth showing.
  */
 import type { RemoteDeployInstanceResult } from '@ts-cloud/core';
+/**
+ * The part of the deploy script bash refused to parse.
+ *
+ * A syntax error names a line number in a file that only ever existed on the
+ * box, and the deploy deletes it on the way out, so the one thing needed to
+ * understand the failure is the one thing nobody can look at. Without this you
+ * are reduced to guessing which generated fragment is unbalanced, or to
+ * reproducing the whole script by hand from its builders.
+ *
+ * Only a window around the reported line, and every `KEY="value"` line inside
+ * it is redacted: the script carries the runtime environment, and a deploy
+ * failure must not become the reason a database password is in a CI log.
+ */
+export declare function describeScriptSyntaxError(error: unknown, script: string): string;
+/**
+ * One operator-facing line (plus redacted output) for a failed ssh/scp child.
+ *
+ * Takes the shape Node's `execFileSync` error has (`status`, `signal`,
+ * `stdout`, `stderr`) so a `Bun.spawn`-based transport only has to build the
+ * same object. Never includes the command line: it carries the deploy script.
+ */
+export declare function formatSshFailure(error: unknown): string;
+/**
+ * Print the lines a remote deploy script meant a human to read.
+ *
+ * The remote stdout has always been captured and then dropped on the floor,
+ * which is why nothing the box says has ever reached a CI log: not the
+ * memory-commitment report, not `migrate`, not `catalog:sync`. A deploy that
+ * cannot tell you what it did on the box is one you have to SSH in to
+ * understand, and by then you are debugging rather than reading.
+ *
+ * Only `[ts-cloud]`-prefixed lines are surfaced, and that restraint is
+ * deliberate rather than tidy. The script fed to `bash -s` carries the runtime
+ * environment here-document - database credentials, APP_KEY, provider tokens -
+ * which is why {@link formatSshFailure} refuses to echo a failing command back.
+ * Remote *stdout* is not the script, so it does not contain those secrets by
+ * construction, but it is whatever arbitrary `preStart` commands chose to
+ * print, and an app that logs its own config on boot would leak it here. An
+ * explicit marker means ts-cloud only ever republishes lines ts-cloud wrote.
+ */
+export declare function surfaceRemoteNotices(output: string): void;
 /**
  * Build the `error` for a {@link import('@ts-cloud/core').RemoteDeployResult}
  * whose run did not fully succeed. `summary` is the one-line what-failed (e.g.

package/dist/drivers/shared/rpx-gateway.d.ts

@@ -19,10 +19,27 @@
  * It replaces the old Caddyfile generation — pantry/stacks use rpx (their own
  * tooling), so the gateway is rpx, not Caddy.
  */
-import type { ComputeProxyConfig, RpxLoadBalancerConfig, SiteConfig, SiteRedirectConfig } from '@ts-cloud/core';
+import type { CloudConfig, ComputeProxyConfig, RpxLoadBalancerConfig, SiteConfig, SiteRedirectConfig } from '@ts-cloud/core';
 /** Default directory on the box that holds real per-domain TLS certs. */
 export declare const DEFAULT_RPX_CERTS_DIR = "/etc/rpx/certs";
-/** Whether the gateway adds a `www.` redirect for `domain` on its own. */
+/**
+ * Where the LAN certificate authority lives on the box. rpx writes the CA
+ * (`rpx-root-ca.crt` / `.key`) and the leaf it signs here; the CA cert is the
+ * one file an operator copies off the box to trust on a laptop or a phone.
+ */
+export declare const DEFAULT_LOCAL_CA_DIR = "/etc/rpx/local-ca";
+/** rpx's own filename for the CA certificate inside {@link DEFAULT_LOCAL_CA_DIR}. */
+export declare const LOCAL_CA_ROOT_CERT_FILENAME = "rpx-root-ca.crt";
+/** Absolute path to the CA certificate a client has to trust. */
+export declare function localCaCertPath(dir?: string): string;
+/**
+ * Whether the gateway adds a `www.` redirect for `domain` on its own.
+ *
+ * Apex domains only, and never an mDNS name: `pi-app.local` also has two
+ * labels, but nobody types `www.pi-app.local`, no LAN resolves it, and the
+ * route it would create is a host the LAN certificate does not cover, so it
+ * is a browser warning on a name that exists for no reason.
+ */
 export declare function hasAutoWwwVariant(domain: string): boolean;
 /**
  * Every hostname the gateway will answer for a sites config.
@@ -137,6 +154,68 @@ export interface RpxRoute {
  * enabled (default) AND a password is present — no password is ever invented.
  */
 export declare function resolveRouteAuth(site: SiteConfig): RpxRoute['auth'];
+/**
+ * The gateway's LAN certificate authority, mirroring rpx's `LocalCaConfig`
+ * (see `@stacksjs/rpx`'s `types.ts`, available since 0.11.49). rpx loads or
+ * creates the CA under `dir`, signs ONE leaf covering `hosts` + `ips`, and
+ * registers it both per server name and as the default TLS context, so a
+ * connection that sends no SNI at all (an IP-literal URL) still gets it.
+ */
+export interface RpxLocalCaConfig {
+    /** Directory holding the CA and the leaf it signs. See {@link DEFAULT_LOCAL_CA_DIR}. */
+    dir: string;
+    /** dNSName SANs on the leaf, e.g. `['pi-app.local']`. Never empty. */
+    hosts: string[];
+    /** iPAddress SANs, so the box is also reachable by address over TLS. */
+    ips?: string[];
+    /** Install the CA into the box's OWN system trust store (rpx runs as root here). */
+    installTrust?: boolean;
+    /** Leaf validity in days. Omitted so rpx applies its documented default (825). */
+    validityDays?: number;
+    /** Re-mint when fewer than this many days remain. Omitted for rpx's default (30). */
+    renewBeforeDays?: number;
+}
+/**
+ * LAN settings for a gateway on a host that is not on the public internet.
+ *
+ * This is the ONLY input that makes {@link buildRpxConfig} emit `localCa` or
+ * `https: false`, and it is passed exclusively on the ssh-provider path (see
+ * {@link resolveGatewayLan}), which is what keeps every cloud driver's
+ * emitted config byte-identical to what it produced before LAN TLS existed.
+ */
+export interface RpxLanOptions {
+    /** The LAN name the gateway's certificate covers. Defaults to `<slug>.local`. */
+    hostname?: string;
+    /** `'local-ca'` issues a LAN certificate; `'off'` serves plain HTTP. @default 'local-ca' */
+    tls?: 'local-ca' | 'off';
+    /**
+     * The box's LAN address, when it is actually known: the ssh preflight's
+     * `lanIp`, else the configured ssh host when that is an IP literal. Never
+     * guessed: a wrong iPAddress SAN is worse than an absent one.
+     */
+    ip?: string;
+}
+/** `lan.tls` with its default applied, or `undefined` when there is no LAN config. */
+export declare function lanTlsMode(lan?: RpxLanOptions): 'local-ca' | 'off' | undefined;
+/**
+ * The LAN options for a config, or `undefined` when LAN TLS does not apply.
+ *
+ * The provider gate lives HERE, in one function, rather than at each call
+ * site: `ssh.lan` is meaningless for a cloud box (a Hetzner host has no LAN an
+ * operator can reach), and a driver that reads it anyway would start emitting
+ * a `localCa` the box can never use. Callers with resolved ssh settings should
+ * pass those instead; this reads `cloud.config.ts` alone, so a `TS_CLOUD_SSH_*`
+ * override is not visible to it.
+ */
+export declare function resolveGatewayLan(config: Pick<CloudConfig, 'cloud' | 'ssh'>, lanIp?: string): RpxLanOptions | undefined;
+/** The host profile the gateway unit should be tuned for, when one is known. */
+export declare function resolveGatewayProfile(config: Pick<CloudConfig, 'cloud' | 'ssh'>): 'raspberry-pi' | 'generic' | undefined;
+/**
+ * Is `domain` a name only a LAN can resolve? Either an mDNS `.local` name or a
+ * bare single-label hostname. Public CAs cannot issue for either, so these are
+ * exactly the names that need the box's own CA instead.
+ */
+export declare function isLanHostname(domain: string): boolean;
 /** The rpx daemon/proxy config produced from a sites model. */
 export interface RpxGatewayConfig {
     /** Multi-proxy route list (host + path keyed). */
@@ -167,8 +246,18 @@ export interface RpxGatewayConfig {
      * down to free `:80`. Omitted ⇒ the `:80` server only redirects.
      */
     acmeChallengeWebroot?: string;
-    /** Always `true` — the gateway terminates TLS on the box. */
-    https: true;
+    /**
+     * `true` (the only value any public deploy produces) terminates TLS on the
+     * box. `false` is the LAN opt-out (`ssh.lan.tls: 'off'`): rpx then binds the
+     * HTTP port only, and nothing on `:443`.
+     */
+    https: boolean;
+    /**
+     * LAN certificate authority: rpx signs one leaf for these names with a CA it
+     * keeps on the box. Emitted ONLY on the ssh-provider path; see
+     * {@link RpxLanOptions}.
+     */
+    localCa?: RpxLocalCaConfig;
     /** Never touch `/etc/hosts` on a real server with real DNS. */
     hostsManagement: false;
     /** Don't remove certs/hosts on exit. */
@@ -199,6 +288,12 @@ export interface BuildRpxConfigOptions {
      * wrong directory.
      */
     slug?: string;
+    /**
+     * LAN settings for a host with no public DNS. Passed on the ssh-provider
+     * path only (see {@link resolveGatewayLan}); every other driver leaves it
+     * undefined and gets exactly the config it always got.
+     */
+    lan?: RpxLanOptions;
 }
 /**
  * Normalize a path prefix to a leading-slash, no-trailing-slash form, or
@@ -313,7 +408,32 @@ export interface BuildRpxProvisionOptions {
     bunBin?: string;
     /** Keep the dashboard route currently running on the box during an app-only deploy. */
     preserveManagementDashboardRoutes?: boolean;
+    /**
+     * Host profile, when the caller knows it (the ssh provider resolves one; the
+     * cloud drivers do not and leave this undefined, keeping their unit byte for
+     * byte what it was). `raspberry-pi` lowers the gateway's memory ceilings, see
+     * {@link RASPBERRY_PI_PROXY_MEMORY}.
+     */
+    profile?: 'raspberry-pi' | 'generic';
 }
+/**
+ * Gateway cgroup ceilings by host profile.
+ *
+ * The generic defaults are sized for a 4G+ cloud box. A Pi is commonly a 2G
+ * board also running the app, a database and swap on an SD card, where a
+ * 768M ceiling is not a bound at all: the gateway can take a third of RAM
+ * before systemd notices, and the reclaim that follows lands on the SD card.
+ * The gateway's steady state is well under 100M on either machine, so the
+ * lower pair still leaves the same order of magnitude of burst room.
+ */
+export declare const RASPBERRY_PI_PROXY_MEMORY: {
+    readonly high: '256M';
+    readonly max: '384M';
+};
+export declare const DEFAULT_PROXY_MEMORY: {
+    readonly high: '512M';
+    readonly max: '768M';
+};
 export declare const RPX_CERT_RENEW_SCRIPT = "/etc/rpx/renew-certs.sh";
 export declare const RPX_CERT_RENEW_SERVICE = "rpx-cert-renew.service";
 export declare const RPX_CERT_RENEW_TIMER = "rpx-cert-renew.timer";