@stacksjs/ts-cloud 0.12.11 → 0.12.13

package/dist/deploy/index.js

@@ -1 +1 @@
-import{$c as ra,Ac as I,Bc as J,Cc as K,Dc as L,Ec as M,Fc as N,Gc as O,Hc as P,Ic as Q,Jc as R,Kc as S,Lc as T,Mc as U,Nc as V,Oc as W,Pc as X,Pd as Ha,Qc as ga,Qd as Ia,Rc as ha,Rd as Ja,Sc as ia,Sd as Ka,Tc as ja,Uc as ka,Vc as la,Wc as ma,Xc as na,Yc as oa,Zc as pa,_c as qa,ad as ta,bd as ua,cd as va,dd as wa,ed as xa,fd as ya,gd as za,hd as Aa,id as Ba,jd as Ca,kd as Da,ld as Ea,md as Fa,nd as Ga,xc as F,yc as G,zc as H}from"../chunk-0a4tqwm9.js";import{$d as fa,Td as Y,Ud as Z,Vd as _,Wd as aa,Xd as ba,Yd as ca,Zd as da,_d as ea}from"../chunk-zh0apedk.js";import{he as sa}from"../chunk-whyttetx.js";import"../chunk-yf8stygs.js";import"../chunk-mnmz8t7q.js";import"../chunk-n1fyryha.js";import"../chunk-ze5x2bpm.js";import"../chunk-k8x8mrkr.js";import"../chunk-j06r5rwv.js";import"../chunk-2ybcnrte.js";import{Ag as y,Ui as z,Vi as A,Wi as B,Xi as C,Yi as D,Zi as E,ug as s,vg as t,wg as u,xg as v,yg as w,zg as x}from"../chunk-fvpkxznh.js";import"../chunk-n5xmh0ma.js";import"../chunk-6cxb8d6y.js";import"../chunk-ess6vxfj.js";import"../chunk-j1g67djb.js";import"../chunk-ac87ds1k.js";import{ok as l,pk as m,qk as n,rk as o,sk as p,tk as q,uk as r}from"../chunk-7z50g5xz.js";import{Ak as f,Bk as g,Ck as h,Dk as i,Ek as j,Fk as k,vk as a,wk as b,xk as c,yk as d,zk as e}from"../chunk-n1hg0jxs.js";import"../chunk-q9a1z53k.js";import"../chunk-4wdxsnn2.js";import"../chunk-r8t25tbm.js";import"../chunk-zjyz926j.js";export{m as DEFAULT_SITE_PORT_RANGE,l as HOST_SITES_DIR,v as IPV6_EXCLUDED_HOST_LABELS,z as MANAGEMENT_DASHBOARD_SITE,F as addSiteToCloudConfig,r as allocateSitePorts,ra as buildAndPushContainerImage,sa as buildAndPushServerlessImage,ua as buildFunctionEnv,p as buildHostSitePortsScript,E as buildManagementDashboardArtifact,Aa as buildServerTopology,Ba as buildServerlessTopology,Ca as buildTopology,Ga as collectEgressMetrics,s as collectServerDnsDomains,qa as createContainerImageDependencies,la as createExistingStaticFullStackDependencies,ha as createStaticApiOriginDependencies,Ia as dashboardActions,A as dashboardCredentialsFile,V as dashboardPageRoutes,ea as deleteStaticSite,na as deployExistingStaticFullStack,va as deployServerlessApp,k as deployShipsFiles,ga as deploySite,ia as deployStaticApiOrigin,ba as deployStaticSite,fa as deployStaticSiteFull,Z as deployStaticSiteWithExternalDns,_ as deployStaticSiteWithExternalDnsFull,Ea as egressReportMetrics,R as ensureDashboardActor,D as ensureManagementDashboard,oa as estimateExistingStaticFullStackMonthlyCost,ka as estimateStaticApiOriginMonthlyCost,Fa as fetchEgressReport,ma as generateExistingStaticFullStackTemplate,Y as generateExternalDnsStaticSiteTemplate,aa as generateStaticSiteTemplate,g as hasComputeConfigured,d as hasProxyUpstream,pa as hashContainerContext,w as hostAcceptsIpv6,ta as infraEnvFromOutputs,S as initializeDashboardControlPlane,da as invalidateCache,b as isPhpSite,M as isValidHostname,u as normalizePublicIpv6,o as occupiedHostPorts,q as parseHostSiteFragments,n as parseUpstreamPort,x as reconcileAddressRecords,wa as redeployServerlessApp,G as removeSiteFromCloudConfig,t as removeStaleServerAddressRecords,N as renderAliasesValue,L as renderEnvValue,O as renderRedirectsValue,P as renderSiteSnippet,J as renderSslValue,K as renderStringValue,Ja as resolveDashboardAction,B as resolveDashboardAuth,Da as resolveDashboardData,W as resolveLegacyDashboardRoute,c as resolveProxyUpstreams,e as resolveSiteDeployTarget,f as resolveSiteKind,C as resolveUiSource,xa as rollbackServerlessApp,X as routesForDashboard,za as runRemoteCommand,Ha as sanitizeCloudConfig,Q as setAttachToInCloudConfig,ya as setMaintenance,I as setSitePropertyInCloudConfig,i as shipsARelease,j as shipsToBucket,a as siteInstallBase,Ka as startLocalDashboardServer,T as synchronizeDashboardUsers,U as trackDashboardOperation,H as updateSiteInCloudConfig,ca as uploadStaticFiles,h as validateDeploymentConfig,y as verifyAddressRecord,ja as verifyStaticApiOrigin};
+import{jr,zr,Sl,xi,Cl,bl,El,Jo,vl,Tl,fm,wl,S,Rl,_i,we,Dl,Pl,bA,Nl,Am,EA,vA,TA,ym,Im,wA,RA,Sm,Cm,DA,Oi,Kt,Xo,Kr,Wr,Wt,je,ht,Li,bm,Jr,kl,Bl,Yo,Mi,Yr,Fi,pa}from"../chunk-7ww65b66.js";import{ga,Zr,en,Ui,Qi,Hi,Gi,ma,ha}from"../chunk-ej4sm2tw.js";import{fa}from"../chunk-3qp10j0j.js";import"../chunk-zmyv76f0.js";import"../chunk-thpce63q.js";import"../chunk-6g81m01r.js";import"../chunk-r5emv4x8.js";import"../chunk-zftpjxkr.js";import"../chunk-emg3shmb.js";import"../chunk-wjgnfg6q.js";import{Kl,Na,me,ka,mn,Wl,Ba,rc,us,nc,Pt,Hn,ps}from"../chunk-tnjae324.js";import"../chunk-6nvn041c.js";import"../chunk-jb8em9ba.js";import"../chunk-3kapcdpn.js";import"../chunk-30h9rgfn.js";import{rt,wh,dc,zn,Kn,Wn,zu}from"../chunk-edqhhcg9.js";import{B,hr,fr,lc,hs,u,Rh,Ku,Wu,sy,oy}from"../chunk-wpqj98h8.js";import"../chunk-sct6mdgc.js";import"../chunk-1n3ckctd.js";export{wh as DEFAULT_SITE_PORT_RANGE,rt as HOST_SITES_DIR,ka as IPV6_EXCLUDED_HOST_LABELS,rc as MANAGEMENT_DASHBOARD_SITE,jr as addSiteToCloudConfig,zu as allocateSitePorts,DA as buildAndPushContainerImage,fa as buildAndPushServerlessImage,Kt as buildFunctionEnv,Kn as buildHostSitePortsScript,ps as buildManagementDashboardArtifact,ht as buildServerTopology,Li as buildServerlessTopology,bm as buildTopology,Yo as collectEgressMetrics,Kl as collectServerDnsDomains,Cm as createContainerImageDependencies,ym as createExistingStaticFullStackDependencies,Am as createStaticApiOriginDependencies,Yr as dashboardActions,us as dashboardCredentialsFile,Dl as dashboardPageRoutes,ma as deleteStaticSite,wA as deployExistingStaticFullStack,Xo as deployServerlessApp,oy as deployShipsFiles,Nl as deploySite,EA as deployStaticApiOrigin,Qi as deployStaticSite,ha as deployStaticSiteFull,Zr as deployStaticSiteWithExternalDns,en as deployStaticSiteWithExternalDnsFull,kl as egressReportMetrics,S as ensureDashboardActor,Hn as ensureManagementDashboard,RA as estimateExistingStaticFullStackMonthlyCost,TA as estimateStaticApiOriginMonthlyCost,Bl as fetchEgressReport,Im as generateExistingStaticFullStackTemplate,ga as generateExternalDnsStaticSiteTemplate,Ui as generateStaticSiteTemplate,Rh as hasComputeConfigured,lc as hasProxyUpstream,Sm as hashContainerContext,mn as hostAcceptsIpv6,Oi as infraEnvFromOutputs,Rl as initializeDashboardControlPlane,Gi as invalidateCache,hr as isPhpSite,Jo as isValidHostname,me as normalizePublicIpv6,zn as occupiedHostPorts,Wn as parseHostSiteFragments,dc as parseUpstreamPort,Wl as reconcileAddressRecords,Kr as redeployServerlessApp,zr as removeSiteFromCloudConfig,Na as removeStaleServerAddressRecords,vl as renderAliasesValue,El as renderEnvValue,Tl as renderRedirectsValue,fm as renderSiteSnippet,Cl as renderSslValue,bl as renderStringValue,Fi as resolveDashboardAction,nc as resolveDashboardAuth,Jr as resolveDashboardData,Pl as resolveLegacyDashboardRoute,fr as resolveProxyUpstreams,hs as resolveSiteDeployTarget,u as resolveSiteKind,Pt as resolveUiSource,Wr as rollbackServerlessApp,bA as routesForDashboard,je as runRemoteCommand,Mi as sanitizeCloudConfig,wl as setAttachToInCloudConfig,Wt as setMaintenance,xi as setSitePropertyInCloudConfig,Wu as shipsARelease,sy as shipsToBucket,B as siteInstallBase,pa as startLocalDashboardServer,_i as synchronizeDashboardUsers,we as trackDashboardOperation,Sl as updateSiteInCloudConfig,Hi as uploadStaticFiles,Ku as validateDeploymentConfig,Ba as verifyAddressRecord,vA as verifyStaticApiOrigin};

package/dist/dns/index.js

@@ -1 +1 @@
-import{$f as d,Xf as a,Yf as b,Zf as c,ag as e,bg as f,cg as g,dg as h,eg as i,fg as j,gg as k,hg as l,ig as m,jg as n,kg as o,lg as p,mg as q,ng as r,og as s,pg as t,qg as u}from"../chunk-j06r5rwv.js";import"../chunk-2ybcnrte.js";import"../chunk-ac87ds1k.js";import"../chunk-zjyz926j.js";export{d as CloudflareProvider,t as DnsProviderFactory,c as GoDaddyProvider,a as PROXIABLE_RECORD_TYPES,b as PorkbunProvider,i as Route53Provider,n as UnifiedDnsValidator,l as applyZoneMigration,r as createDnsProvider,p as createGoDaddyValidator,o as createPorkbunValidator,q as createRoute53Validator,s as detectDnsProvider,u as dnsProviders,j as exportRoute53Zone,k as planZoneMigration,e as policyTag,f as qualifyName,h as reconcileDeclaredRecords,g as resolveDeclaredRecords,m as verifyZoneParity};
+import{un,Ne,Ct,bt,Et,pn,Xi,Yi,ge,Zi,es,ts,rs,ne,ns,is,ss,T,Da,gn,Pa}from"../chunk-emg3shmb.js";import"../chunk-wjgnfg6q.js";import"../chunk-30h9rgfn.js";export{bt as CloudflareProvider,gn as DnsProviderFactory,Ct as GoDaddyProvider,un as PROXIABLE_RECORD_TYPES,Ne as PorkbunProvider,ge as Route53Provider,ne as UnifiedDnsValidator,ts as applyZoneMigration,T as createDnsProvider,is as createGoDaddyValidator,ns as createPorkbunValidator,ss as createRoute53Validator,Da as detectDnsProvider,Pa as dnsProviders,Zi as exportRoute53Zone,es as planZoneMigration,Et as policyTag,pn as qualifyName,Yi as reconcileDeclaredRecords,Xi as resolveDeclaredRecords,rs as verifyZoneParity};

package/dist/drivers/index.d.ts

@@ -36,6 +36,7 @@ export { AwsBoxProvisioner, buildBoxUserData, createBoxProvisioner, HetznerBoxPr
 export type { AwsBoxProvisionerOptions, BoxPort, BoxProviderName, BoxProvisioner, BoxSpec, CreateBoxProvisionerOptions, ProvisionedBox, } from './shared/box-provision';
 export { buildAwsArtifactFetch, buildHostCleanupScript, buildLocalArtifactFetch, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, resolveExecStart, } from './shared/deploy-script';
 export { deployAllComputeSites, deploySiteRelease, reloadRpxGateway, renewRpxCertificates, } from './shared/compute-deploy';
+export { isLocalDatabase } from './shared/db-provision';
 export { buildRpxConfig, buildRpxFragmentRefreshScript, buildRpxLbConfig, buildRpxProvisionScript, deriveRouteId, gatewayHostnames, hasAutoWwwVariant, normalizeRoutePath, renderRpxLauncher, DEFAULT_RPX_CERTS_DIR, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, } from './shared/rpx-gateway';
 export type { BuildRpxConfigOptions, BuildRpxFragmentRefreshOptions, BuildRpxProvisionOptions, RpxGatewayConfig, RpxLbAppBox, RpxRoute, } from './shared/rpx-gateway';
 export { buildCloudFrontOriginConfig, MANAGED_CACHE_POLICY_DISABLED, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, } from './shared/cloudfront-origin';

package/dist/drivers/index.js

@@ -1 +1 @@
-import{$g as q,$h as qa,$i as hb,Ah as Q,Ai as Ra,Bg as a,Bh as R,Bi as Sa,Cg as b,Ch as S,Ci as Ta,Dg as c,Dh as T,Di as Ua,Eg as d,Eh as U,Ei as Va,Fh as V,Fi as Wa,Gh as W,Gi as Xa,Hh as X,Hi as Ya,Ih as Y,Ii as Za,Jh as Z,Ji as _a,Kh as _,Ki as $a,Lh as aa,Mh as ba,Nh as ca,Ni as ab,Oh as da,Oi as bb,Pg as e,Ph as ea,Pi as cb,Qg as f,Qh as fa,Qi as db,Rg as g,Rh as ga,Ri as eb,Sg as h,Sh as ha,Si as fb,Tg as i,Th as ia,Ti as gb,Ug as j,Uh as ja,Vg as k,Vh as ka,Wg as l,Wh as la,Xg as m,Xh as ma,Yg as n,Yh as na,Zg as o,Zh as oa,_g as p,_h as pa,ah as r,ai as ra,aj as ib,bh as s,bi as sa,bj as jb,ch as t,ci as ta,cj as kb,dh as u,di as ua,dj as lb,eh as v,ei as va,ej as mb,fh as w,fi as wa,fj as nb,gh as x,gi as xa,gj as ob,hh as y,hi as ya,ih as z,ii as za,jh as A,ji as Aa,ki as Ba,lh as B,li as Ca,mh as C,mi as Da,nh as D,ni as Ea,oh as E,oi as Fa,ph as F,pi as Ga,qh as G,qi as Ha,rh as H,ri as Ia,sh as I,si as Ja,th as J,ti as Ka,uh as K,ui as La,vh as L,vi as Ma,wh as M,wi as Na,xh as N,xi as Oa,yh as O,yi as Pa,zh as P,zi as Qa}from"../chunk-fvpkxznh.js";import"../chunk-n5xmh0ma.js";import"../chunk-6cxb8d6y.js";import"../chunk-ess6vxfj.js";import"../chunk-j1g67djb.js";import"../chunk-ac87ds1k.js";import"../chunk-n1hg0jxs.js";import"../chunk-4wdxsnn2.js";import"../chunk-r8t25tbm.js";import"../chunk-zjyz926j.js";export{_a as AwsBoxProvisioner,s as AwsDriver,Ba as BOOT_PARTITION_LABEL,ya as CloudDriverFactory,e as DEFAULT_RPX_CERTS_DIR,Aa as FIRST_BOOT_SCRIPT_PATH,Za as HetznerBoxProvisioner,B as HetznerClient,K as HetznerDriver,F as LEGACY_DRIVER_STATE_DIR,L as LocalBoxDriver,mb as MANAGED_CACHE_POLICY_DISABLED,lb as MANAGED_CACHE_POLICY_OPTIMIZED,nb as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,aa as RASPBERRY_PI_DEFAULT_SWAP_GB,A as REMOTE_SCRIPT_RUNNER,m as RPX_DIR,n as RPX_LAUNCHER_PATH,o as RPX_SERVICE_NAME,Z as SSH_BOOTSTRAP_MARKER_DIR,Y as SSH_BOOTSTRAP_VERSION,da as SSH_DEFAULTS,ta as SSH_DEPLOY_STORAGE_PATH,N as SSH_INSECURE_HOST_KEY_OPTS,O as SSH_KEEPALIVE_OPTS,oa as SSH_PREFLIGHT_SCRIPT,ua as SSH_SKIP_BOOTSTRAP_ENV,wa as SshDriver,X as SystemSshTransport,Xa as UBUNTU_2404_AMI_PARAM,Sa as acquireResizeLock,La as applyHetznerHostOptimization,ba as assertArchSupported,va as assertSshComputeConfig,eb as buildAwsArtifactFetch,Ya as buildBoxUserData,ob as buildCloudFrontOriginConfig,Ca as buildCloudInitFirstBoot,Ka as buildHetznerHostOptimizationScript,gb as buildHostCleanupScript,fb as buildLocalArtifactFetch,j as buildRpxConfig,q as buildRpxFragmentRefreshScript,k as buildRpxLbConfig,p as buildRpxProvisionScript,Q as buildScpArgsFor,bb as buildSiteDeployScript,t as buildSshArgs,P as buildSshArgsFor,ca as buildSshBootstrapScript,cb as buildStaticSiteDeployScript,za as cloudDrivers,Ma as collectHetznerHostOptimizationReport,Ga as collectHetznerResizeManifest,$a as createBoxProvisioner,xa as createCloudDriver,ib as deployAllComputeSites,hb as deploySiteRelease,i as deriveRouteId,a as describeScriptSyntaxError,G as driverStateDir,H as driverStatePath,Ua as ensureFirewall,Va as ensureServer,Ta as ensureSshKey,qa as evaluatePreflight,Fa as executeHetznerServerResize,V as findKnownHostKey,sa as formatPreflightFindings,b as formatSshFailure,g as gatewayHostnames,r as generateUbuntuAppCloudInit,f as hasAutoWwwVariant,M as isBoxMode,Ea as isHetznerCapacityError,U as knownHostsLine,T as knownHostsToken,h as normalizeRoutePath,D as normalizeSshPublicKey,pa as parsePreflightFacts,Da as planHetznerServerResize,ra as preflightFailed,Ha as prepareHetznerResize,I as readDriverState,Qa as readResizeCheckpoint,db as releaseTarballTmpPath,jb as reloadRpxGateway,z as remoteScriptRunner,l as renderRpxLauncher,kb as renewRpxCertificates,Oa as resizeCheckpointPath,Pa as resizeLockPath,ab as resolveExecStart,C as resolveHetznerApiToken,Ja as resolveHetznerHostOptimizationPlan,ia as resolveSshHostKeyPolicy,ea as resolveSshHosts,ma as resolveSshLan,ga as resolveSshPort,ha as resolveSshPrivateKeyPath,ka as resolveSshProfile,la as resolveSshPublicIp,na as resolveSshSettings,ja as resolveSshSudo,fa as resolveSshUser,S as scanHostKey,w as scpUpload,Wa as serverPublicIpv4,_ as sshBootstrapMarkerPath,u as sshExec,v as sshExecOrThrow,R as sshHostKeyFingerprint,W as sshKnownHostsPath,d as summarizeRemoteFailures,c as surfaceRemoteNotices,Na as verifyHetznerHostOptimization,Ia as verifyHetznerResize,y as waitForCloudInit,x as waitForSsh,E as wrapCloudInitUserData,J as writeDriverState,Ra as writeResizeCheckpoint};
+import{hn,vt,nr,Tt,fn,xa,An,yn,Zl,_a,he,or,Mm,In,Oa,Xe,fe,Rt,N,ar,Sn,cr,se,La,Cn,$a,bn,Ma,dr,Ua,ke,z,Qa,Ye,Be,xe,Ze,Ae,cs,Ha,eu,tu,Ga,ru,et,En,qa,nu,iu,Va,lr,ye,ja,su,ou,ds,vn,tt,au,cu,du,lu,uu,pu,gu,mu,hu,Tn,wn,Rn,Dn,Pn,Nn,kn,fu,Au,ur,k,ls,yu,Iu,Su,za,Cu,bu,Fm,Ka,Um,Qm,Eu,vu,Hm,Gm,qm,Wa,Tu,Vm,jm,zm,Bn,xn,_n,On,Ja,Xa,Ya,Za,Km,Ln,$n,Mn,Un,ec,tc,Qn,gs,ic,Gn,sc,Wm,Jm,Xm,Ym}from"../chunk-tnjae324.js";import"../chunk-6nvn041c.js";import"../chunk-jb8em9ba.js";import"../chunk-3kapcdpn.js";import"../chunk-30h9rgfn.js";import"../chunk-wpqj98h8.js";import"../chunk-1n3ckctd.js";export{Za as AwsBoxProvisioner,ar as AwsDriver,Su as BOOT_PARTITION_LABEL,ls as CloudDriverFactory,xa as DEFAULT_RPX_CERTS_DIR,Iu as FIRST_BOOT_SCRIPT_PATH,Ya as HetznerBoxProvisioner,dr as HetznerClient,Ae as HetznerDriver,Qa as LEGACY_DRIVER_STATE_DIR,cs as LocalBoxDriver,Jm as MANAGED_CACHE_POLICY_DISABLED,Wm as MANAGED_CACHE_POLICY_OPTIMIZED,Xm as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,ou as RASPBERRY_PI_DEFAULT_SWAP_GB,Ma as REMOTE_SCRIPT_RUNNER,In as RPX_DIR,Oa as RPX_LAUNCHER_PATH,Xe as RPX_SERVICE_NAME,ja as SSH_BOOTSTRAP_MARKER_DIR,ye as SSH_BOOTSTRAP_VERSION,tt as SSH_DEFAULTS,kn as SSH_DEPLOY_STORAGE_PATH,eu as SSH_INSECURE_HOST_KEY_OPTS,tu as SSH_KEEPALIVE_OPTS,wn as SSH_PREFLIGHT_SCRIPT,fu as SSH_SKIP_BOOTSTRAP_ENV,ur as SshDriver,lr as SystemSshTransport,Ja as UBUNTU_2404_AMI_PARAM,zm as acquireResizeLock,Hm as applyHetznerHostOptimization,ds as assertArchSupported,Au as assertSshComputeConfig,ec as buildAwsArtifactFetch,Xa as buildBoxUserData,Ym as buildCloudFrontOriginConfig,za as buildCloudInitFirstBoot,vu as buildHetznerHostOptimizationScript,Qn as buildHostCleanupScript,tc as buildLocalArtifactFetch,he as buildRpxConfig,Rt as buildRpxFragmentRefreshScript,or as buildRpxLbConfig,fe as buildRpxProvisionScript,ru as buildScpArgsFor,$n as buildSiteDeployScript,Sn as buildSshArgs,Ga as buildSshArgsFor,vn as buildSshBootstrapScript,Mn as buildStaticSiteDeployScript,yu as cloudDrivers,Gm as collectHetznerHostOptimizationReport,Ka as collectHetznerResizeManifest,Km as createBoxProvisioner,k as createCloudDriver,ic as deployAllComputeSites,gs as deploySiteRelease,_a as deriveRouteId,hn as describeScriptSyntaxError,Ye as driverStateDir,Be as driverStatePath,xn as ensureFirewall,_n as ensureServer,Bn as ensureSshKey,Dn as evaluatePreflight,Fm as executeHetznerServerResize,iu as findKnownHostKey,Nn as formatPreflightFindings,vt as formatSshFailure,yn as gatewayHostnames,N as generateUbuntuAppCloudInit,An as hasAutoWwwVariant,Ha as isBoxMode,bu as isHetznerCapacityError,fn as isLocalDatabase,nu as knownHostsLine,qa as knownHostsToken,Zl as normalizeRoutePath,ke as normalizeSshPublicKey,Rn as parsePreflightFacts,Cu as planHetznerServerResize,Pn as preflightFailed,Um as prepareHetznerResize,xe as readDriverState,Vm as readResizeCheckpoint,Un as releaseTarballTmpPath,Gn as reloadRpxGateway,bn as remoteScriptRunner,Mm as renderRpxLauncher,sc as renewRpxCertificates,Wa as resizeCheckpointPath,Tu as resizeLockPath,Ln as resolveExecStart,Ua as resolveHetznerApiToken,Eu as resolveHetznerHostOptimizationPlan,uu as resolveSshHostKeyPolicy,au as resolveSshHosts,hu as resolveSshLan,du as resolveSshPort,lu as resolveSshPrivateKeyPath,gu as resolveSshProfile,mu as resolveSshPublicIp,Tn as resolveSshSettings,pu as resolveSshSudo,cu as resolveSshUser,En as scanHostKey,La as scpUpload,On as serverPublicIpv4,su as sshBootstrapMarkerPath,cr as sshExec,se as sshExecOrThrow,et as sshHostKeyFingerprint,Va as sshKnownHostsPath,Tt as summarizeRemoteFailures,nr as surfaceRemoteNotices,qm as verifyHetznerHostOptimization,Qm as verifyHetznerResize,$a as waitForCloudInit,Cn as waitForSsh,z as wrapCloudInitUserData,Ze as writeDriverState,jm as writeResizeCheckpoint};

package/dist/drivers/shared/compute-deploy.d.ts

@@ -49,18 +49,6 @@ export declare function buildManagementDashboardServiceReconciliationScript(slug
  * without `start`, shipped to `/var/www/<site>`). Bucket sites are skipped.
  */
 export declare function deployAllComputeSites(options: DeployAllSitesOptions): Promise<boolean>;
-/**
- * Regenerate the rpx gateway config from the sites model and (re)start the
- * gateway. No-op (returns `true`) unless `compute.proxy.engine === 'rpx'`.
- *
- * Two shapes, resolved by probing for a dedicated load-balancer target:
- *  - **Fleet** (bun-style: one rpx LB box fronts N gateway-less app boxes) —
- *    rewrite ONLY the LB's route fragment with the multi-upstream LB config
- *    ({@link buildRpxLbConfig} + {@link buildRpxFragmentRefreshScript}).
- *  - **Single box** — the gateway is co-located with the app, so the full
- *    provision script runs on the app targets. Re-runnable: it rewrites the
- *    launcher + unit and `systemctl restart`s, reloading the new routes.
- */
 export declare function reloadRpxGateway(options: DeployAllSitesOptions): Promise<boolean>;
 /**
  * Request the first production certificates after DNS has been reconciled.

package/dist/drivers/shared/rpx-gateway.d.ts

@@ -19,10 +19,27 @@
  * It replaces the old Caddyfile generation — pantry/stacks use rpx (their own
  * tooling), so the gateway is rpx, not Caddy.
  */
-import type { ComputeProxyConfig, RpxLoadBalancerConfig, SiteConfig, SiteRedirectConfig } from '@ts-cloud/core';
+import type { CloudConfig, ComputeProxyConfig, RpxLoadBalancerConfig, SiteConfig, SiteRedirectConfig } from '@ts-cloud/core';
 /** Default directory on the box that holds real per-domain TLS certs. */
 export declare const DEFAULT_RPX_CERTS_DIR = "/etc/rpx/certs";
-/** Whether the gateway adds a `www.` redirect for `domain` on its own. */
+/**
+ * Where the LAN certificate authority lives on the box. rpx writes the CA
+ * (`rpx-root-ca.crt` / `.key`) and the leaf it signs here; the CA cert is the
+ * one file an operator copies off the box to trust on a laptop or a phone.
+ */
+export declare const DEFAULT_LOCAL_CA_DIR = "/etc/rpx/local-ca";
+/** rpx's own filename for the CA certificate inside {@link DEFAULT_LOCAL_CA_DIR}. */
+export declare const LOCAL_CA_ROOT_CERT_FILENAME = "rpx-root-ca.crt";
+/** Absolute path to the CA certificate a client has to trust. */
+export declare function localCaCertPath(dir?: string): string;
+/**
+ * Whether the gateway adds a `www.` redirect for `domain` on its own.
+ *
+ * Apex domains only, and never an mDNS name: `pi-app.local` also has two
+ * labels, but nobody types `www.pi-app.local`, no LAN resolves it, and the
+ * route it would create is a host the LAN certificate does not cover, so it
+ * is a browser warning on a name that exists for no reason.
+ */
 export declare function hasAutoWwwVariant(domain: string): boolean;
 /**
  * Every hostname the gateway will answer for a sites config.
@@ -137,6 +154,68 @@ export interface RpxRoute {
  * enabled (default) AND a password is present — no password is ever invented.
  */
 export declare function resolveRouteAuth(site: SiteConfig): RpxRoute['auth'];
+/**
+ * The gateway's LAN certificate authority, mirroring rpx's `LocalCaConfig`
+ * (see `@stacksjs/rpx`'s `types.ts`, available since 0.11.49). rpx loads or
+ * creates the CA under `dir`, signs ONE leaf covering `hosts` + `ips`, and
+ * registers it both per server name and as the default TLS context, so a
+ * connection that sends no SNI at all (an IP-literal URL) still gets it.
+ */
+export interface RpxLocalCaConfig {
+    /** Directory holding the CA and the leaf it signs. See {@link DEFAULT_LOCAL_CA_DIR}. */
+    dir: string;
+    /** dNSName SANs on the leaf, e.g. `['pi-app.local']`. Never empty. */
+    hosts: string[];
+    /** iPAddress SANs, so the box is also reachable by address over TLS. */
+    ips?: string[];
+    /** Install the CA into the box's OWN system trust store (rpx runs as root here). */
+    installTrust?: boolean;
+    /** Leaf validity in days. Omitted so rpx applies its documented default (825). */
+    validityDays?: number;
+    /** Re-mint when fewer than this many days remain. Omitted for rpx's default (30). */
+    renewBeforeDays?: number;
+}
+/**
+ * LAN settings for a gateway on a host that is not on the public internet.
+ *
+ * This is the ONLY input that makes {@link buildRpxConfig} emit `localCa` or
+ * `https: false`, and it is passed exclusively on the ssh-provider path (see
+ * {@link resolveGatewayLan}), which is what keeps every cloud driver's
+ * emitted config byte-identical to what it produced before LAN TLS existed.
+ */
+export interface RpxLanOptions {
+    /** The LAN name the gateway's certificate covers. Defaults to `<slug>.local`. */
+    hostname?: string;
+    /** `'local-ca'` issues a LAN certificate; `'off'` serves plain HTTP. @default 'local-ca' */
+    tls?: 'local-ca' | 'off';
+    /**
+     * The box's LAN address, when it is actually known: the ssh preflight's
+     * `lanIp`, else the configured ssh host when that is an IP literal. Never
+     * guessed: a wrong iPAddress SAN is worse than an absent one.
+     */
+    ip?: string;
+}
+/** `lan.tls` with its default applied, or `undefined` when there is no LAN config. */
+export declare function lanTlsMode(lan?: RpxLanOptions): 'local-ca' | 'off' | undefined;
+/**
+ * The LAN options for a config, or `undefined` when LAN TLS does not apply.
+ *
+ * The provider gate lives HERE, in one function, rather than at each call
+ * site: `ssh.lan` is meaningless for a cloud box (a Hetzner host has no LAN an
+ * operator can reach), and a driver that reads it anyway would start emitting
+ * a `localCa` the box can never use. Callers with resolved ssh settings should
+ * pass those instead; this reads `cloud.config.ts` alone, so a `TS_CLOUD_SSH_*`
+ * override is not visible to it.
+ */
+export declare function resolveGatewayLan(config: Pick<CloudConfig, 'cloud' | 'ssh'>, lanIp?: string): RpxLanOptions | undefined;
+/** The host profile the gateway unit should be tuned for, when one is known. */
+export declare function resolveGatewayProfile(config: Pick<CloudConfig, 'cloud' | 'ssh'>): 'raspberry-pi' | 'generic' | undefined;
+/**
+ * Is `domain` a name only a LAN can resolve? Either an mDNS `.local` name or a
+ * bare single-label hostname. Public CAs cannot issue for either, so these are
+ * exactly the names that need the box's own CA instead.
+ */
+export declare function isLanHostname(domain: string): boolean;
 /** The rpx daemon/proxy config produced from a sites model. */
 export interface RpxGatewayConfig {
     /** Multi-proxy route list (host + path keyed). */
@@ -167,8 +246,18 @@ export interface RpxGatewayConfig {
      * down to free `:80`. Omitted ⇒ the `:80` server only redirects.
      */
     acmeChallengeWebroot?: string;
-    /** Always `true` — the gateway terminates TLS on the box. */
-    https: true;
+    /**
+     * `true` (the only value any public deploy produces) terminates TLS on the
+     * box. `false` is the LAN opt-out (`ssh.lan.tls: 'off'`): rpx then binds the
+     * HTTP port only, and nothing on `:443`.
+     */
+    https: boolean;
+    /**
+     * LAN certificate authority: rpx signs one leaf for these names with a CA it
+     * keeps on the box. Emitted ONLY on the ssh-provider path; see
+     * {@link RpxLanOptions}.
+     */
+    localCa?: RpxLocalCaConfig;
     /** Never touch `/etc/hosts` on a real server with real DNS. */
     hostsManagement: false;
     /** Don't remove certs/hosts on exit. */
@@ -199,6 +288,12 @@ export interface BuildRpxConfigOptions {
      * wrong directory.
      */
     slug?: string;
+    /**
+     * LAN settings for a host with no public DNS. Passed on the ssh-provider
+     * path only (see {@link resolveGatewayLan}); every other driver leaves it
+     * undefined and gets exactly the config it always got.
+     */
+    lan?: RpxLanOptions;
 }
 /**
  * Normalize a path prefix to a leading-slash, no-trailing-slash form, or
@@ -313,7 +408,32 @@ export interface BuildRpxProvisionOptions {
     bunBin?: string;
     /** Keep the dashboard route currently running on the box during an app-only deploy. */
     preserveManagementDashboardRoutes?: boolean;
+    /**
+     * Host profile, when the caller knows it (the ssh provider resolves one; the
+     * cloud drivers do not and leave this undefined, keeping their unit byte for
+     * byte what it was). `raspberry-pi` lowers the gateway's memory ceilings, see
+     * {@link RASPBERRY_PI_PROXY_MEMORY}.
+     */
+    profile?: 'raspberry-pi' | 'generic';
 }
+/**
+ * Gateway cgroup ceilings by host profile.
+ *
+ * The generic defaults are sized for a 4G+ cloud box. A Pi is commonly a 2G
+ * board also running the app, a database and swap on an SD card, where a
+ * 768M ceiling is not a bound at all: the gateway can take a third of RAM
+ * before systemd notices, and the reclaim that follows lands on the SD card.
+ * The gateway's steady state is well under 100M on either machine, so the
+ * lower pair still leaves the same order of magnitude of burst room.
+ */
+export declare const RASPBERRY_PI_PROXY_MEMORY: {
+    readonly high: '256M';
+    readonly max: '384M';
+};
+export declare const DEFAULT_PROXY_MEMORY: {
+    readonly high: '512M';
+    readonly max: '768M';
+};
 export declare const RPX_CERT_RENEW_SCRIPT = "/etc/rpx/renew-certs.sh";
 export declare const RPX_CERT_RENEW_SERVICE = "rpx-cert-renew.service";
 export declare const RPX_CERT_RENEW_TIMER = "rpx-cert-renew.timer";

package/dist/drivers/ssh/bootstrap.d.ts

@@ -36,16 +36,26 @@ export interface SshBootstrapOptions {
     config: CloudConfig;
     environment: EnvironmentType;
     profile: SshProfile;
-    /** Preflight facts, when the host has been probed; `arch` gates x86_64-only services. */
-    facts?: Pick<SshPreflightFacts, 'arch'>;
+    /**
+     * Preflight facts, when the host has been probed. `arch` gates x86_64-only
+     * services; `lanIp` becomes the LAN certificate's iPAddress SAN.
+     */
+    facts?: Pick<SshPreflightFacts, 'arch'> & Partial<Pick<SshPreflightFacts, 'lanIp'>>;
     /**
      * The non-root deploy user, when there is one. Makes the artifact and
      * staging directories group-writable for it and manages its
      * `authorized_keys` rather than root's.
      */
     sudoUser?: string;
-    /** LAN settings; recorded in the script header today, wired to the gateway by the local-CA work. */
+    /** LAN settings; recorded in the script header and wired into the gateway's local CA. */
     lan?: SshLanConfig;
+    /**
+     * The box's LAN address, when the caller knows one that is not in `facts`
+     * (the configured ssh host, when that host is an IP literal). Wins over
+     * `facts.lanIp`. Never guessed: an address absent here is simply left off
+     * the certificate.
+     */
+    lanIp?: string;
 }
 /**
  * Refuse a config that asks for something this host's architecture cannot

package/dist/drivers/ssh/config.d.ts

@@ -52,8 +52,15 @@ export declare function resolveSshSudo(config?: CloudConfig, user?: string, expl
 export declare function resolveSshProfile(config?: CloudConfig, explicit?: string): SshProfile;
 /** The public IP DNS should point at: `'auto'` or a literal address. */
 export declare function resolveSshPublicIp(config?: CloudConfig, explicit?: string): string;
-/** LAN access settings; empty when unset. */
-export declare function resolveSshLan(config?: CloudConfig, explicit?: SshLanConfig): SshLanConfig;
+/**
+ * LAN access settings, or `undefined` when the project configured none.
+ *
+ * This used to answer `{}` for "unset", which reads as a LAN with defaults
+ * once anything acts on it: with the gateway now wired to `lan`, that sentinel
+ * would give every adopted host a local certificate authority for
+ * `<slug>.local` that nobody asked for. Absent has to be absent.
+ */
+export declare function resolveSshLan(config?: CloudConfig, explicit?: SshLanConfig): SshLanConfig | undefined;
 /** One host with every per-host value resolved. */
 export interface ResolvedSshHost {
     host: string;
@@ -69,7 +76,8 @@ export interface ResolvedSshSettings {
     sudo: boolean;
     profile: SshProfile;
     publicIp: string;
-    lan: SshLanConfig;
+    /** LAN access settings, or `undefined` when this project configured none. */
+    lan?: SshLanConfig;
 }
 export interface SshOverrides {
     hosts?: SshHostConfig[];

package/dist/index.d.ts

@@ -39,7 +39,7 @@ export { collectServerDnsDomains, hostAcceptsIpv6, IPV6_EXCLUDED_HOST_LABELS, no
 export type { AddressRecordReport } from './deploy/server-dns';
 export * from './cdn';
 export type { EnsureDashboardLogger, ResolvedDashboardAuth, StaticSiteConfig, DeployResult, UploadOptions, ExternalDnsStaticSiteConfig, ExternalDnsDeployResult, DeploySiteConfig, DeploySiteResult, StaticSiteDnsProvider, SiteDeployKind, DeploymentValidationResult, BuildImageOptions, BuiltImage, CodeSource, DeployServerlessOptions, ResolvedContext, } from './deploy';
-export { createCloudDriver, CloudDriverFactory, cloudDrivers, AwsDriver, HetznerDriver, SshDriver, SystemSshTransport, resolveSshSettings, buildSshBootstrapScript, SSH_BOOTSTRAP_VERSION, evaluatePreflight, formatPreflightFindings, parsePreflightFacts, preflightFailed, SSH_PREFLIGHT_SCRIPT, buildCloudInitFirstBoot, driverStatePath, readDriverState, writeDriverState, HetznerClient, resolveHetznerApiToken, normalizeSshPublicKey, ensureFirewall, ensureServer, ensureSshKey, serverPublicIpv4, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, buildSshArgs, generateUbuntuAppCloudInit, wrapCloudInitUserData, buildHostCleanupScript, buildSiteDeployScript, buildStaticSiteDeployScript, resolveExecStart, deployAllComputeSites, deploySiteRelease, reloadRpxGateway, renewRpxCertificates, gatewayHostnames, hasAutoWwwVariant, } from './drivers';
+export { createCloudDriver, CloudDriverFactory, cloudDrivers, AwsDriver, HetznerDriver, SshDriver, SystemSshTransport, resolveSshSettings, buildSshBootstrapScript, SSH_BOOTSTRAP_VERSION, evaluatePreflight, formatPreflightFindings, parsePreflightFacts, preflightFailed, SSH_PREFLIGHT_SCRIPT, buildCloudInitFirstBoot, driverStatePath, readDriverState, writeDriverState, HetznerClient, resolveHetznerApiToken, normalizeSshPublicKey, ensureFirewall, ensureServer, ensureSshKey, serverPublicIpv4, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, buildSshArgs, generateUbuntuAppCloudInit, wrapCloudInitUserData, buildHostCleanupScript, buildSiteDeployScript, buildStaticSiteDeployScript, resolveExecStart, deployAllComputeSites, deploySiteRelease, isLocalDatabase, reloadRpxGateway, renewRpxCertificates, gatewayHostnames, hasAutoWwwVariant, } from './drivers';
 export type { CreateCloudDriverOptions } from './drivers/factory';
 export type { DriverState, FirstBootBundle, FirstBootIdentity, FirstBootOs, ResolvedSshSettings, SshDriverOptions, SshDriverState, SshPreflightFacts, SshTransport, SshTransportOptions, } from './drivers';
 export { dashboardActions, resolveDashboardAction, sanitizeCloudConfig, startLocalDashboardServer, } from './deploy/local-dashboard-server';