@stacksjs/ts-cloud 0.15.0 → 0.16.0

package/dist/{chunk-b2b79jtk.js → chunk-7vnj4b37.js}

@@ -539,22 +539,22 @@ console.log(JSON.stringify({
 `);r.push("write_files:","  - path: /var/lib/cloud/box-bootstrap.sh","    permissions: '0755'","    owner: root:root","    content: |",s)}if(r.push("runcmd:",`  - mkdir -p /root/.ssh && grep -qF "${t}" /root/.ssh/authorized_keys 2>/dev/null || echo "${t}" >> /root/.ssh/authorized_keys`),e.bootstrapScript)r.push("  - [ bash, /var/lib/cloud/box-bootstrap.sh ]");return`${r.join(`
 `)}
 `}function Vc(e=[]){let t=[{direction:"in",protocol:"tcp",port:"22",source_ips:["0.0.0.0/0","::/0"],description:"SSH"}];for(let r of e)t.push({direction:"in",protocol:r.protocol,...r.protocol==="icmp"?{}:{port:String(r.port)},source_ips:["0.0.0.0/0","::/0"]});return t}class oc{client;provider="hetzner";constructor(e){this.client=e}async ensureBox(e){let t=await $n(this.client,{name:`${e.name}-key`,publicKey:e.sshPublicKey}),r=await Mn(this.client,{name:`${e.name}-fw`,rules:Vc(e.ports)}),{server:n,created:s}=await Un(this.client,{name:e.name,serverType:e.size,image:e.image??"ubuntu-24.04",location:e.location,sshKeys:[t.id],firewalls:[{firewall:r.id}],userData:sc(e),labels:e.labels});return{provider:"hetzner",id:String(n.id),name:n.name,publicIp:Qn(n),created:s}}async destroyBox(e){let t=[],r=(await this.client.listServers()).find((s)=>s.name===e);if(r){let s=await this.client.deleteServer(r.id);await this.client.waitForAction(s.id).catch(()=>{}),t.push(`server ${e} (#${r.id})`)}let n=(await this.client.listFirewalls()).find((s)=>s.name===`${e}-fw`);if(n)for(let s=0;s<10;s++)try{await this.client.deleteFirewall(n.id),t.push(`firewall ${e}-fw (#${n.id})`);break}catch{if(s===9)break;await new Promise((i)=>setTimeout(i,3000))}return{destroyed:t}}}function qc(e=[]){let t=[{IpProtocol:"tcp",FromPort:22,ToPort:22,IpRanges:[{CidrIp:"0.0.0.0/0",Description:"SSH"}]}];for(let r of e)t.push(r.protocol==="icmp"?{IpProtocol:"icmp",FromPort:-1,ToPort:-1,IpRanges:[{CidrIp:"0.0.0.0/0"}]}:{IpProtocol:r.protocol,FromPort:r.port,ToPort:r.port,IpRanges:[{CidrIp:"0.0.0.0/0"}]});return t}class ac{provider="aws";ec2;ssm;constructor(e){this.ec2=e.ec2,this.ssm=e.ssm}async findInstance(e,t){return(await this.ec2.describeInstances({Filters:[{Name:"tag:Name",Values:[e]},{Name:"instance-state-name",Values:t}]})).Reservations?.flatMap((n)=>n.Instances??[])[0]}async waitForPublicIp(e,t=300000){let r=Date.now();while(Date.now()-r<t){let n=await this.ec2.getInstance(e);if(n?.State?.Name==="running"&&n.PublicIpAddress)return n;await new Promise((s)=>setTimeout(s,5000))}throw Error(`EC2 instance ${e} did not reach running with a public IP within ${t}ms`)}async ensureSecurityGroup(e){let t=`${e.name}-sg`,n=(await this.ec2.describeSecurityGroups({Filters:[{Name:"group-name",Values:[t]}]})).SecurityGroups?.[0]?.GroupId;if(n)return n;let s=await this.ec2.createSecurityGroup({GroupName:t,Description:`box ${e.name} (managed by ts-cloud box-provision)`});if(!s.GroupId)throw Error(`could not create security group ${t}`);return await this.ec2.authorizeSecurityGroupIngress({GroupId:s.GroupId,IpPermissions:qc(e.ports)}),s.GroupId}async resolveImage(e){if(e.image?.startsWith("ami-"))return e.image;let r=(await this.ssm.getParameter({Name:ic})).Parameter?.Value;if(!r)throw Error(`could not resolve the Ubuntu 24.04 AMI via SSM (${ic})`);return r}async ensureBox(e){let t=await this.findInstance(e.name,["pending","running"]);if(t?.InstanceId){let l=await this.waitForPublicIp(t.InstanceId);return{provider:"aws",id:l.InstanceId,name:e.name,publicIp:l.PublicIpAddress,created:!1}}let[r,n]=await Promise.all([this.ensureSecurityGroup(e),this.resolveImage(e)]),s=[{Key:"Name",Value:e.name},...Object.entries(e.labels??{}).map(([l,m])=>({Key:l,Value:m}))],o=(await this.ec2.runInstances({ImageId:n,InstanceType:e.size,MinCount:1,MaxCount:1,SecurityGroupIds:[r],UserData:Buffer.from(sc(e),"utf8").toString("base64"),TagSpecifications:[{ResourceType:"instance",Tags:s}]})).Instances?.[0]?.InstanceId;if(!o)throw Error(`RunInstances returned no instance for box ${e.name}`);let c=await this.waitForPublicIp(o);return{provider:"aws",id:o,name:e.name,publicIp:c.PublicIpAddress,created:!0}}async destroyBox(e){let t=[],r=await this.findInstance(e,["pending","running","stopping","stopped"]);if(r?.InstanceId){await this.ec2.terminateInstances([r.InstanceId]),t.push(`instance ${e} (${r.InstanceId})`);let i=Date.now();while(Date.now()-i<300000){let o=await this.ec2.getInstance(r.InstanceId);if(!o||o.State?.Name==="terminated")break;await new Promise((c)=>setTimeout(c,5000))}}let s=(await this.ec2.describeSecurityGroups({Filters:[{Name:"group-name",Values:[`${e}-sg`]}]})).SecurityGroups?.[0]?.GroupId;if(s)for(let i=0;i<10;i++)try{await this.ec2.deleteSecurityGroup(s),t.push(`security group ${e}-sg (${s})`);break}catch{if(i===9)break;await new Promise((o)=>setTimeout(o,3000))}return{destroyed:t}}}function rh(e){if(e.provider==="hetzner"){if(!e.hetzner)throw Error('createBoxProvisioner: options.hetzner (a HetznerClient) is required for provider "hetzner"');return new oc(e.hetzner)}if(!e.aws)throw Error('createBoxProvisioner: options.aws ({ ec2, ssm }) is required for provider "aws"');return new ac(e.aws)}function Jt(e){return Object.entries(e).map(([t,r])=>`${t}=${Wc(String(r))}`).join(`
-`)}function Wc(e){return`"${e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"").replace(/\n/g,"\\n").replace(/\r/g,"\\r").replace(/\t/g,"\\t")}"`}var Qt=["storage",".env"],Tt=4;function Ve(e){return`${e.replace(/\/+$/,"")}/.ts-cloud`}function Xc(e){return`${Ve(e)}/deploy-history.log`}function Yc(e,t){return`${Ve(e)}/deploys/${t}.log`}function oi(e){return`${Ve(e)}/shared-paths`}function Pt(e,t){let r=e.replace(/\/+$/,"");return{base:r,releases:`${r}/releases`,shared:`${r}/shared`,current:`${r}/current`,release:`${r}/releases/${t}`}}function ai(e){let t=e.split("/").pop()||e;if(t===".env"||t.startsWith(".env."))return!0;return/\.[a-z0-9]+$/i.test(t)}function Xr(e){return typeof e==="string"?e:e.path}function ci(e){let t=new Map;for(let r of e)t.set(Xr(r),r);return[...t.values()]}function li(e,t){if(typeof t==="string")return{path:t,target:`${e.shared}/${t}`,seed:!0};return{path:t.path,target:t.target??`${e.shared}/${t.path}`,seed:t.seed!==!1}}function Jc(e){return["ts_cloud_adopt_shared() {",'  TS_CLOUD_SP="$1"','  TS_CLOUD_DST="$2"',`  TS_CLOUD_SRC="${e.current}/$TS_CLOUD_SP"`,'  if [ -e "$TS_CLOUD_DST" ]; then return 0; fi','  if [ -L "$TS_CLOUD_SRC" ] || [ ! -e "$TS_CLOUD_SRC" ]; then return 0; fi','  mkdir -p "$(dirname "$TS_CLOUD_DST")"','  cp -a "$TS_CLOUD_SRC" "$TS_CLOUD_DST"',"  for TS_CLOUD_SIDECAR in -wal -shm; do",'    if [ -f "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" ]; then cp -a "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" "$TS_CLOUD_DST$TS_CLOUD_SIDECAR"; fi',"  done",'  echo "[ts-cloud] adopted $TS_CLOUD_SP from the live release into shared/ — it now survives deploys"',"  return 0","}"]}function Ct(e,t=Qt){let r=[`mkdir -p ${e.releases} ${e.shared}`,...Jc(e)],n=t.map((i)=>li(e,i));for(let{path:i,target:o,seed:c}of n){if(!c)continue;if(r.push(`ts_cloud_adopt_shared '${i}' '${o}'`),ai(i))r.push(`mkdir -p "$(dirname ${o})"`,`touch ${o}`);else if(i==="storage")r.push(`mkdir -p ${o}/app/public`,`mkdir -p ${o}/framework/cache/data`,`mkdir -p ${o}/framework/sessions`,`mkdir -p ${o}/framework/testing`,`mkdir -p ${o}/framework/views`,`mkdir -p ${o}/logs`);else r.push(`mkdir -p ${o}`)}let s=oi(e.base);return r.push(`mkdir -p ${Ve(e.base)}`,`cat > ${s} <<'TS_CLOUD_SHARED_PATHS_EOF'`,...n.map((i)=>`${i.path}	${i.target}`),"TS_CLOUD_SHARED_PATHS_EOF"),r}function Yr(e,t=900){let r=`${Ve(e.base)}/deploy.lock`;return[`mkdir -p "$(dirname ${r})"`,`exec 9>${r}`,`flock -w ${t} 9 || { echo "[ts-cloud] another deploy of this site has held the lock for ${t}s — refusing to race it" >&2; exit 1; }`]}function Jr(e){let t=`${e.release}.incoming`;return[`rm -rf ${t}`,`mkdir -p ${t}`,...Qc(e),'if [ "$TS_CLOUD_IS_LIVE" = "yes" ]; then',`  TS_CLOUD_STAGED=${t}`,"else",`  rm -rf ${e.release}`,`  mkdir -p ${e.release}`,`  rmdir ${t}`,`  TS_CLOUD_STAGED=${e.release}`,"fi"]}function Qr(e){let t=`TS_CLOUD_TRAP_LIVE="$(readlink -f ${e.current} 2>/dev/null || true)"`,r=`TS_CLOUD_TRAP_TARGET="$(readlink -f ${e.release} 2>/dev/null || echo ${e.release})"`;return`trap '${`if [ $? -ne 0 ]; then ${t}; ${r}; [ "$TS_CLOUD_TRAP_LIVE" = "$TS_CLOUD_TRAP_TARGET" ] || rm -rf ${e.release}; fi`}' EXIT`}function Qc(e){return[`TS_CLOUD_LIVE_PATH="$(readlink -f ${e.current} 2>/dev/null || true)"`,`TS_CLOUD_RELEASE_PATH="$(readlink -f ${e.release} 2>/dev/null || echo ${e.release})"`,'if [ -n "$TS_CLOUD_LIVE_PATH" ] && [ "$TS_CLOUD_LIVE_PATH" = "$TS_CLOUD_RELEASE_PATH" ]; then TS_CLOUD_IS_LIVE=yes; else TS_CLOUD_IS_LIVE=no; fi']}function Zr(e){let t=`${e.release}.incoming`;return[`if [ "$TS_CLOUD_STAGED" = "${t}" ]; then`,`  rm -rf ${e.release}.previous`,`  mv ${e.release} ${e.release}.previous`,`  mv ${t} ${e.release}`,`  rm -rf ${e.release}.previous`,"fi"]}function Zc(e,t){return[`if [ -f ${e} ] && [ ! -L ${e} ] && [ -s ${e} ] && [ ! -s ${t} ]; then`,`  cp -a ${e} ${t}`,`  echo "[ts-cloud] seeded shared/ from the release's own copy of the file"`,"fi"]}function Zt(e,t=Qt){let r=[];for(let n of t){let{path:s,target:i,seed:o}=li(e,n),c=`${e.release}/${s}`,l=[`rm -rf ${c}`,`mkdir -p "$(dirname ${c})"`,`ln -sfn ${i} ${c}`];if(o){if(s!==".env"&&ai(s))r.push(...Zc(c,i));r.push(...l);continue}r.push(`if [ -e ${i} ]; then`,...l.map((m)=>`  ${m}`),"fi")}return r}function ii(e,t){let r=oi(e.base);return[`if [ -f ${r} ]; then`,'  while IFS="\t" read -r TS_CLOUD_SP TS_CLOUD_TGT; do','    [ -n "$TS_CLOUD_SP" ] || continue',`    [ -n "$TS_CLOUD_TGT" ] || TS_CLOUD_TGT="${e.shared}/$TS_CLOUD_SP"`,'    [ -e "$TS_CLOUD_TGT" ] || continue',`    rm -rf ${t}/"$TS_CLOUD_SP"`,`    mkdir -p "$(dirname ${t}/"$TS_CLOUD_SP")"`,`    ln -sfn "$TS_CLOUD_TGT" ${t}/"$TS_CLOUD_SP"`,`  done < ${r}`,"fi"]}function dt(e){return[`ln -sfn ${e.release} ${e.current}.tmp`,`mv -Tf ${e.current}.tmp ${e.current}`]}function _u(e,t={}){let r=t.to?[`[ -d ${e.releases}/${t.to} ] || { echo "rollback target ${e.releases}/${t.to} not found" >&2; exit 1; }`,...ii(e,`${e.releases}/${t.to}`),`ln -sfn ${e.releases}/${t.to} ${e.current}.tmp`,`mv -Tf ${e.current}.tmp ${e.current}`]:[`TS_CLOUD_CURRENT=$(readlink -f ${e.current} 2>/dev/null || true)`,`TS_CLOUD_PREV=$(ls -1dt ${e.releases}/*/ 2>/dev/null | sed 's#/$##' | while read -r r; do [ "$(readlink -f "$r")" != "$TS_CLOUD_CURRENT" ] && { echo "$r"; break; }; done)`,'[ -n "$TS_CLOUD_PREV" ] || { echo "no previous release to roll back to" >&2; exit 1; }',...ii(e,'"$TS_CLOUD_PREV"'),`ln -sfn "$TS_CLOUD_PREV" ${e.current}.tmp`,`mv -Tf ${e.current}.tmp ${e.current}`,'echo "rolled back to $TS_CLOUD_PREV"'];if(!t.unitBase)return r;let n=t.unitBase;return[...r,`TS_CLOUD_RB_ID=$(basename "$(readlink -f ${e.current})")`,`if [ -f /etc/systemd/system/${n}@.service ]; then systemctl start "${n}@\${TS_CLOUD_RB_ID}.service"; sleep 2; systemctl is-active --quiet "${n}@\${TS_CLOUD_RB_ID}.service" || { echo "rolled-back release failed to start" >&2; exit 1; }; systemctl enable "${n}@\${TS_CLOUD_RB_ID}.service" 2>/dev/null || true; systemctl list-units --plain --no-legend --type=service "${n}@*.service" 2>/dev/null | awk '{print $1}' | { grep -v "^${n}@\${TS_CLOUD_RB_ID}.service$" || true; } | while read -r TS_CLOUD_U; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done; elif [ -f /etc/systemd/system/${n}.service ]; then systemctl restart ${n}.service; fi`]}function mt(e,t=4){let r=Math.max(1,t);return[`TS_CLOUD_CURRENT=$(readlink -f ${e.current} 2>/dev/null || true)`,`ls -1dt ${e.releases}/*/ 2>/dev/null | sed 's#/$##' | tail -n +${r+1} | while read -r TS_CLOUD_OLD; do`,'  [ "$(readlink -f "$TS_CLOUD_OLD")" = "$TS_CLOUD_CURRENT" ] || rm -rf "$TS_CLOUD_OLD"',"done"]}function el(e){return`${Ve(e)}/owner`}function en(e,t){let r=el(e);return[`if [ -f "${r}" ]; then`,`  TS_CLOUD_OWNER=$(cat "${r}")`,`  if [ "$TS_CLOUD_OWNER" != "${t}" ]; then`,`    echo "[ts-cloud] REFUSING deploy: ${e} belongs to project '$TS_CLOUD_OWNER', not '${t}'. Another project on this box derives the same site key — give one of them a distinct site name/domain, or remove ${r} to transfer ownership." >&2`,"    exit 1","  fi","else",`  mkdir -p "$(dirname "${r}")"`,`  printf '%s\\n' "${t}" > "${r}"`,"fi"]}function er(e,t){let r=Ve(e),n=Yc(e,t.releaseId),s=Xc(e),i=Math.max(1,t.keepLogs??20),o=t.commit||"",c=t.branch||"";return[`mkdir -p ${r}/deploys`,`exec > >(tee -a ${n}) 2>&1`,`echo "[ts-cloud] deploy ${t.releaseId} commit=${o} branch=${c} starting $(date -u +%Y-%m-%dT%H:%M:%SZ)"`,"ts_cloud_record_deploy() {","  TS_CLOUD_RC=$?",'  if [ "$TS_CLOUD_RC" -eq 0 ]; then TS_CLOUD_ST=success; else TS_CLOUD_ST=failed; fi',`  printf '%s\\t%s\\t%s\\t%s\\trc=%s\\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "${t.releaseId}" "${o}" "$TS_CLOUD_ST" "$TS_CLOUD_RC" >> ${s}`,"}","trap ts_cloud_record_deploy EXIT",`ls -1t ${r}/deploys/*.log 2>/dev/null | tail -n +${i+1} | while read -r TS_CLOUD_OLDLOG; do rm -f "$TS_CLOUD_OLDLOG"; done`]}var tl=new Set(["sqlite","sqlite3"]),rl=new Set([":memory:","memory"]);function nl(e){let t=e?.DB_CONNECTION?.trim().toLowerCase();return t!=null&&tl.has(t)}function sl(e){let t=e.trim().replace(/^\.\//,"");if(t===""||t.startsWith("/")||t.startsWith("~"))return;if(t.split("/").includes(".."))return;return t.replace(/\/+$/,"")}function tn(e,t=[]){if(!nl(e))return{};let r=e?.DB_DATABASE?.trim();if(r&&rl.has(r.toLowerCase()))return{};if(!r)return{warning:"DB_CONNECTION is sqlite but DB_DATABASE names no file, so ts-cloud cannot tell where the database lives. If it is written inside the release directory, the next deploy discards it. Set DB_DATABASE, or list the file in the site's `sharedPaths`."};let n=sl(r);if(!n)return{};if(t.some((s)=>Xr(s)===n))return{};return{path:n}}function tr(e,t=[]){let{path:r}=tn(e,t);return r?[r]:[]}function Hn(e,t){let r=t==="bun"?"/usr/local/bin/bun":t==="deno"?"/usr/local/bin/deno":"/usr/local/bin/node",n=e.replace(/^(bun|node|deno)\s+/,"");return`${r} ${n}`}function ui(e){return["TS_CLOUD_MEM_MB=$(awk '/^MemTotal:/{print int($2/1024)}' /proc/meminfo)","TS_CLOUD_HIGH_MB=$((TS_CLOUD_MEM_MB / 8))",'[ "$TS_CLOUD_HIGH_MB" -lt 512 ] && TS_CLOUD_HIGH_MB=512','[ "$TS_CLOUD_HIGH_MB" -gt 4096 ] && TS_CLOUD_HIGH_MB=4096',`mkdir -p /etc/systemd/system/${e}.d`,`printf '# Written by ts-cloud: memoryHigh resolved from this box.
+`)}function Wc(e){return`"${e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"").replace(/\n/g,"\\n").replace(/\r/g,"\\r").replace(/\t/g,"\\t")}"`}var Qt=["storage",".env"],Tt=4;function Ve(e){return`${e.replace(/\/+$/,"")}/.ts-cloud`}function Xc(e){return`${Ve(e)}/deploy-history.log`}function Yc(e,t){return`${Ve(e)}/deploys/${t}.log`}function oi(e){return`${Ve(e)}/shared-paths`}function Pt(e,t){let r=e.replace(/\/+$/,"");return{base:r,releases:`${r}/releases`,shared:`${r}/shared`,current:`${r}/current`,release:`${r}/releases/${t}`}}function ai(e){let t=e.split("/").pop()||e;if(t===".env"||t.startsWith(".env."))return!0;return/\.[a-z0-9]+$/i.test(t)}function Xr(e){return typeof e==="string"?e:e.path}function ci(e){let t=new Map;for(let r of e)t.set(Xr(r),r);return[...t.values()]}function li(e,t){if(typeof t==="string")return{path:t,target:`${e.shared}/${t}`,seed:!0};return{path:t.path,target:t.target??`${e.shared}/${t.path}`,seed:t.seed!==!1}}function Jc(e){return["ts_cloud_adopt_shared() {",'  TS_CLOUD_SP="$1"','  TS_CLOUD_DST="$2"',`  TS_CLOUD_SRC="${e.current}/$TS_CLOUD_SP"`,'  if [ -e "$TS_CLOUD_DST" ]; then return 0; fi','  if [ -L "$TS_CLOUD_SRC" ] || [ ! -e "$TS_CLOUD_SRC" ]; then return 0; fi','  mkdir -p "$(dirname "$TS_CLOUD_DST")"','  cp -a "$TS_CLOUD_SRC" "$TS_CLOUD_DST"',"  for TS_CLOUD_SIDECAR in -wal -shm; do",'    if [ -f "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" ]; then cp -a "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" "$TS_CLOUD_DST$TS_CLOUD_SIDECAR"; fi',"  done",'  echo "[ts-cloud] adopted $TS_CLOUD_SP from the live release into shared/ — it now survives deploys"',"  return 0","}"]}function Ct(e,t=Qt){let r=[`mkdir -p ${e.releases} ${e.shared}`,...Jc(e)],n=t.map((i)=>li(e,i));for(let{path:i,target:o,seed:c}of n){if(!c)continue;if(r.push(`ts_cloud_adopt_shared '${i}' '${o}'`),ai(i))r.push(`mkdir -p "$(dirname ${o})"`,`touch ${o}`);else if(i==="storage")r.push(`mkdir -p ${o}/app/public`,`mkdir -p ${o}/framework/cache/data`,`mkdir -p ${o}/framework/sessions`,`mkdir -p ${o}/framework/testing`,`mkdir -p ${o}/framework/views`,`mkdir -p ${o}/logs`);else r.push(`mkdir -p ${o}`)}let s=oi(e.base);return r.push(`mkdir -p ${Ve(e.base)}`,`cat > ${s} <<'TS_CLOUD_SHARED_PATHS_EOF'`,...n.map((i)=>`${i.path}	${i.target}`),"TS_CLOUD_SHARED_PATHS_EOF"),r}function Yr(e,t=900){let r=`${Ve(e.base)}/deploy.lock`;return[`mkdir -p "$(dirname ${r})"`,`exec 9>${r}`,`flock -w ${t} 9 || { echo "[ts-cloud] another deploy of this site has held the lock for ${t}s — refusing to race it" >&2; exit 1; }`]}function Jr(e){let t=`${e.release}.incoming`;return[`rm -rf ${t}`,`mkdir -p ${t}`,...Qc(e),'if [ "$TS_CLOUD_IS_LIVE" = "yes" ]; then',`  TS_CLOUD_STAGED=${t}`,"else",`  rm -rf ${e.release}`,`  mkdir -p ${e.release}`,`  rmdir ${t}`,`  TS_CLOUD_STAGED=${e.release}`,"fi"]}function Qr(e){let t=`TS_CLOUD_TRAP_LIVE="$(readlink -f ${e.current} 2>/dev/null || true)"`,r=`TS_CLOUD_TRAP_TARGET="$(readlink -f ${e.release} 2>/dev/null || echo ${e.release})"`;return`trap '${`if [ $? -ne 0 ]; then ${t}; ${r}; [ "$TS_CLOUD_TRAP_LIVE" = "$TS_CLOUD_TRAP_TARGET" ] || rm -rf ${e.release}; fi`}' EXIT`}function Qc(e){return[`TS_CLOUD_LIVE_PATH="$(readlink -f ${e.current} 2>/dev/null || true)"`,`TS_CLOUD_RELEASE_PATH="$(readlink -f ${e.release} 2>/dev/null || echo ${e.release})"`,'if [ -n "$TS_CLOUD_LIVE_PATH" ] && [ "$TS_CLOUD_LIVE_PATH" = "$TS_CLOUD_RELEASE_PATH" ]; then TS_CLOUD_IS_LIVE=yes; else TS_CLOUD_IS_LIVE=no; fi']}function Zr(e){let t=`${e.release}.incoming`;return[`if [ "$TS_CLOUD_STAGED" = "${t}" ]; then`,`  rm -rf ${e.release}.previous`,`  mv ${e.release} ${e.release}.previous`,`  mv ${t} ${e.release}`,`  rm -rf ${e.release}.previous`,"fi"]}function Zc(e,t){return[`if [ -f ${e} ] && [ ! -L ${e} ] && [ -s ${e} ] && [ ! -s ${t} ]; then`,`  cp -a ${e} ${t}`,`  echo "[ts-cloud] seeded shared/ from the release's own copy of the file"`,"fi"]}function Zt(e,t=Qt){let r=[];for(let n of t){let{path:s,target:i,seed:o}=li(e,n),c=`${e.release}/${s}`,l=[`rm -rf ${c}`,`mkdir -p "$(dirname ${c})"`,`ln -sfn ${i} ${c}`];if(o){if(s!==".env"&&ai(s))r.push(...Zc(c,i));r.push(...l);continue}r.push(`if [ -e ${i} ]; then`,...l.map((m)=>`  ${m}`),"fi")}return r}function ii(e,t){let r=oi(e.base);return[`if [ -f ${r} ]; then`,'  while IFS="\t" read -r TS_CLOUD_SP TS_CLOUD_TGT; do','    [ -n "$TS_CLOUD_SP" ] || continue',`    [ -n "$TS_CLOUD_TGT" ] || TS_CLOUD_TGT="${e.shared}/$TS_CLOUD_SP"`,'    [ -e "$TS_CLOUD_TGT" ] || continue',`    rm -rf ${t}/"$TS_CLOUD_SP"`,`    mkdir -p "$(dirname ${t}/"$TS_CLOUD_SP")"`,`    ln -sfn "$TS_CLOUD_TGT" ${t}/"$TS_CLOUD_SP"`,`  done < ${r}`,"fi"]}function dt(e){return[`ln -sfn ${e.release} ${e.current}.tmp`,`mv -Tf ${e.current}.tmp ${e.current}`]}function _u(e,t={}){let r=t.to?[`[ -d ${e.releases}/${t.to} ] || { echo "rollback target ${e.releases}/${t.to} not found" >&2; exit 1; }`,...ii(e,`${e.releases}/${t.to}`),`ln -sfn ${e.releases}/${t.to} ${e.current}.tmp`,`mv -Tf ${e.current}.tmp ${e.current}`]:[`TS_CLOUD_CURRENT=$(readlink -f ${e.current} 2>/dev/null || true)`,`TS_CLOUD_PREV=$(ls -1dt ${e.releases}/*/ 2>/dev/null | sed 's#/$##' | while read -r r; do [ "$(readlink -f "$r")" != "$TS_CLOUD_CURRENT" ] && { echo "$r"; break; }; done)`,'[ -n "$TS_CLOUD_PREV" ] || { echo "no previous release to roll back to" >&2; exit 1; }',...ii(e,'"$TS_CLOUD_PREV"'),`ln -sfn "$TS_CLOUD_PREV" ${e.current}.tmp`,`mv -Tf ${e.current}.tmp ${e.current}`,'echo "rolled back to $TS_CLOUD_PREV"'];if(!t.unitBase)return r;let n=t.unitBase;return[...r,`TS_CLOUD_RB_ID=$(basename "$(readlink -f ${e.current})")`,`if [ -f /etc/systemd/system/${n}@.service ]; then systemctl start "${n}@\${TS_CLOUD_RB_ID}.service"; sleep 2; systemctl is-active --quiet "${n}@\${TS_CLOUD_RB_ID}.service" || { echo "rolled-back release failed to start" >&2; exit 1; }; systemctl enable "${n}@\${TS_CLOUD_RB_ID}.service" 2>/dev/null || true; systemctl list-units --plain --no-legend --type=service "${n}@*.service" 2>/dev/null | awk '{print $1}' | { grep -v "^${n}@\${TS_CLOUD_RB_ID}.service$" || true; } | while read -r TS_CLOUD_U; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done; elif [ -f /etc/systemd/system/${n}.service ]; then systemctl restart ${n}.service; fi`]}function mt(e,t=4){let r=Math.max(1,t);return[`TS_CLOUD_CURRENT=$(readlink -f ${e.current} 2>/dev/null || true)`,`ls -1dt ${e.releases}/*/ 2>/dev/null | sed 's#/$##' | tail -n +${r+1} | while read -r TS_CLOUD_OLD; do`,'  [ "$(readlink -f "$TS_CLOUD_OLD")" = "$TS_CLOUD_CURRENT" ] || rm -rf "$TS_CLOUD_OLD"',"done"]}function el(e){return`${Ve(e)}/owner`}function en(e,t){let r=el(e);return[`if [ -f "${r}" ]; then`,`  TS_CLOUD_OWNER=$(cat "${r}")`,`  if [ "$TS_CLOUD_OWNER" != "${t}" ]; then`,`    echo "[ts-cloud] REFUSING deploy: ${e} belongs to project '$TS_CLOUD_OWNER', not '${t}'. Another project on this box derives the same site key — give one of them a distinct site name/domain, or remove ${r} to transfer ownership." >&2`,"    exit 1","  fi","else",`  mkdir -p "$(dirname "${r}")"`,`  printf '%s\\n' "${t}" > "${r}"`,"fi"]}function er(e,t){let r=Ve(e),n=Yc(e,t.releaseId),s=Xc(e),i=Math.max(1,t.keepLogs??20),o=t.commit||"",c=t.branch||"";return[`mkdir -p ${r}/deploys`,`exec > >(tee -a ${n}) 2>&1`,`echo "[ts-cloud] deploy ${t.releaseId} commit=${o} branch=${c} starting $(date -u +%Y-%m-%dT%H:%M:%SZ)"`,"ts_cloud_record_deploy() {","  TS_CLOUD_RC=$?",'  if [ "$TS_CLOUD_RC" -eq 0 ]; then TS_CLOUD_ST=success; else TS_CLOUD_ST=failed; fi',`  printf '%s\\t%s\\t%s\\t%s\\trc=%s\\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "${t.releaseId}" "${o}" "$TS_CLOUD_ST" "$TS_CLOUD_RC" >> ${s}`,"}","trap ts_cloud_record_deploy EXIT",`ls -1t ${r}/deploys/*.log 2>/dev/null | tail -n +${i+1} | while read -r TS_CLOUD_OLDLOG; do rm -f "$TS_CLOUD_OLDLOG"; done`]}var tl=new Set(["sqlite","sqlite3"]),rl=new Set([":memory:","memory"]);function nl(e){let t=e?.DB_CONNECTION?.trim().toLowerCase();return t!=null&&tl.has(t)}function sl(e){let t=e.trim().replace(/^\.\//,"");if(t===""||t.startsWith("/")||t.startsWith("~"))return;if(t.split("/").includes(".."))return;return t.replace(/\/+$/,"")}function tn(e,t=[]){if(!nl(e))return{};let r=e?.DB_DATABASE?.trim();if(r&&rl.has(r.toLowerCase()))return{};if(!r)return{warning:"DB_CONNECTION is sqlite but DB_DATABASE names no file, so ts-cloud cannot tell where the database lives. If it is written inside the release directory, the next deploy discards it. Set DB_DATABASE, or list the file in the site's `sharedPaths`."};let n=sl(r);if(!n)return{};if(t.some((s)=>Xr(s)===n))return{};return{path:n}}function tr(e,t=[]){let{path:r}=tn(e,t);return r?[r]:[]}var il=/\.(?:[cm]?[jt]sx?)$/;function Hn(e,t,r){let n=t==="bun"?"/usr/local/bin/bun":t==="deno"?"/usr/local/bin/deno":"/usr/local/bin/node",s=e.trim();if(/^(?:bun|node|deno)\s+/.test(s))return`${n} ${s.replace(/^(?:bun|node|deno)\s+/,"")}`;let[i="",...o]=s.split(/\s+/);if(i&&!il.test(i)){let c=i.startsWith("/")?i:r&&i.startsWith("./")?`${r.replace(/\/+$/,"")}/${i.replace(/^\.\//,"")}`:void 0;if(c)return[c,...o].join(" ")}return`${n} ${s}`}function ui(e){return["TS_CLOUD_MEM_MB=$(awk '/^MemTotal:/{print int($2/1024)}' /proc/meminfo)","TS_CLOUD_HIGH_MB=$((TS_CLOUD_MEM_MB / 8))",'[ "$TS_CLOUD_HIGH_MB" -lt 512 ] && TS_CLOUD_HIGH_MB=512','[ "$TS_CLOUD_HIGH_MB" -gt 4096 ] && TS_CLOUD_HIGH_MB=4096',`mkdir -p /etc/systemd/system/${e}.d`,`printf '# Written by ts-cloud: memoryHigh resolved from this box.
 # An eighth of %sMB RAM. Set memoryHigh in config to override.
 [Service]
 MemoryAccounting=true
 MemoryHigh=%sM
-' "$TS_CLOUD_MEM_MB" "$TS_CLOUD_HIGH_MB" > /etc/systemd/system/${e}.d/50-ts-cloud-memory.conf`,"systemctl daemon-reload",'echo "[ts-cloud] memoryHigh=auto resolved to ${TS_CLOUD_HIGH_MB}M (one eighth of ${TS_CLOUD_MEM_MB}M)"',...rn()]}function rn(){return[`TS_CLOUD_COMMIT=$(for f in /sys/fs/cgroup/system.slice/*.service/memory.high /sys/fs/cgroup/system.slice/*.slice/*.service/memory.high; do [ -f "$f" ] || continue; v=$(cat "$f" 2>/dev/null); [ "$v" = "max" ] && continue; echo "$v"; done | awk '{s+=$1} END {print int(s/1048576)}')`,"TS_CLOUD_RAM=$(awk '/^MemTotal:/{print int($2/1024)}' /proc/meminfo)",'if [ -n "$TS_CLOUD_COMMIT" ] && [ "$TS_CLOUD_COMMIT" -gt 0 ] && [ "$TS_CLOUD_RAM" -gt 0 ]; then TS_CLOUD_PCT=$((TS_CLOUD_COMMIT * 100 / TS_CLOUD_RAM)); if [ "$TS_CLOUD_PCT" -gt 300 ]; then echo "[ts-cloud] WARNING: services on this box declare ${TS_CLOUD_COMMIT}M of MemoryHigh against ${TS_CLOUD_RAM}M of RAM (${TS_CLOUD_PCT}% committed). Soft ceilings, so this is not fatal - but no ceiling can protect the box once enough of them are drawn on at once."; else echo "[ts-cloud] memory commitment: ${TS_CLOUD_COMMIT}M declared against ${TS_CLOUD_RAM}M RAM (${TS_CLOUD_PCT}%)"; fi; fi']}function il(e){return[`TS_CLOUD_SLICE=$(systemctl show ${e} -p Slice --value 2>/dev/null || true)`,'if [ -n "$TS_CLOUD_SLICE" ] && [ "$TS_CLOUD_SLICE" != "system.slice" ]; then systemctl set-property --runtime "$TS_CLOUD_SLICE" MemoryHigh=infinity MemoryMax=infinity 2>/dev/null || true; systemctl set-property "$TS_CLOUD_SLICE" MemoryHigh=infinity MemoryMax=infinity 2>/dev/null || true; fi']}function pi(e){let{unitBase:t,unitPattern:r,port:n}=e,s=e.path&&e.path.startsWith("/")?e.path:"/",i=Math.max(10,e.intervalSeconds??60),o=Math.max(1,e.failuresBeforeRestart??3),c=`/usr/local/sbin/${t}-liveness`,m=r.includes("@*")?`TS_CLOUD_UNIT=$(systemctl list-units --plain --no-legend --type=service '${r}' 2>/dev/null | awk '{print $1}' | head -1)`:`TS_CLOUD_UNIT=${r}`;return[`cat > ${c} <<'TS_CLOUD_LIVENESS_EOF'`,"#!/bin/sh","set -eu",`exec 9>/run/${t}-liveness.lock`,"flock -n 9 || exit 0",m,'[ -n "$TS_CLOUD_UNIT" ] || exit 0','systemctl is-active --quiet "$TS_CLOUD_UNIT" || exit 0',`if curl -s -o /dev/null --max-time 5 "http://127.0.0.1:${n}${s}"; then`,`  rm -f /run/${t}-liveness.fail`,"  exit 0","fi",`TS_CLOUD_FAILS=$(cat /run/${t}-liveness.fail 2>/dev/null || echo 0)`,"TS_CLOUD_FAILS=$((TS_CLOUD_FAILS + 1))",`echo "$TS_CLOUD_FAILS" > /run/${t}-liveness.fail`,`[ "$TS_CLOUD_FAILS" -ge ${o} ] || exit 0`,`logger -t ${t}-liveness "no HTTP response on 127.0.0.1:${n}${s} after $TS_CLOUD_FAILS checks; restarting $TS_CLOUD_UNIT"`,'systemctl restart "$TS_CLOUD_UNIT"',`rm -f /run/${t}-liveness.fail`,"TS_CLOUD_LIVENESS_EOF",`chmod +x ${c}`,`cat > /etc/systemd/system/${t}-liveness.service <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=Liveness check for ${t} (managed by ts-cloud)`,"","[Service]","Type=oneshot",`ExecStart=${c}`,"TS_CLOUD_UNIT_EOF",`cat > /etc/systemd/system/${t}-liveness.timer <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=Run the ${t} liveness check every ${i}s`,"","[Timer]",`OnUnitActiveSec=${i}s`,`OnBootSec=${i}s`,"Persistent=true","","[Install]","WantedBy=timers.target","TS_CLOUD_UNIT_EOF","systemctl daemon-reload",`systemctl enable --now ${t}-liveness.timer >/dev/null 2>&1 || true`]}function Gn(e){let{siteName:t,slug:r,artifactFetch:n,releaseId:s,execStart:i,envEntries:o,port:c,keepReleases:l=Tt,preStartCommands:m=[],healthCheckPath:S,healthGateSeconds:y=5,liveness:v,memoryHigh:h="auto",memoryMax:w,cpuWeight:E,ioWeight:R,tasksMax:x,stopTimeout:C}=e,T=[...E!=null?[`CPUWeight=${E}`]:[],...R!=null?[`IOWeight=${R}`]:[],...x!=null?[`TasksMax=${x}`]:[],...C?[`TimeoutStopSec=${C}`]:[]],P=e.zeroDowntime??c!=null,A=e.appDir??`/var/www/${t}`,D=Pt(A,s),O=`${r}-${t}`,U=`${O}.service`,oe=Vn(r,t,s),F=e.sharedPaths??[],Y=ci([".env",...F,...tr(o,F)]),J=Jt(o),j=m.length>0?[`cd ${D.release}`,...m]:[],te=["set -euo pipefail",...Yr(D),Qr(D),...n,...Ct(D,Y),...Jr(D),`tar xzf ${oe} -C "$TS_CLOUD_STAGED"`,`rm -f ${oe}`,`cat > ${D.shared}/.env <<'TS_CLOUD_ENV_EOF'`,J,"TS_CLOUD_ENV_EOF",`chmod 600 ${D.shared}/.env`,...Zr(D),`find ${D.release} -maxdepth 1 \\( -type f -o -type l \\) -name '.env*' ! -name '.env.example' ! -name '*.example' -delete`,`sed -i -E '/^[[:space:]]*(PORT|PORT_BACKEND|PORT_ADMIN|PORT_FRONTEND)[[:space:]]*=/d' ${D.shared}/.env 2>/dev/null || true`,...Zt(D,Y),...j];if(P&&c!=null){let H=`${O}@${s}.service`,Te=S?S.startsWith("/")?S:`/${S}`:null,Q=`{ echo "[ts-cloud] release ${s} failed its health gate — previous release keeps serving" >&2; journalctl -u ${H} -n 50 --no-pager >&2 || true; systemctl stop ${H} 2>/dev/null || true; exit 1; }`;return[...te,`cat > /etc/systemd/system/${O}@.service <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=${t} release %i (managed by ts-cloud)`,"After=network.target","","[Service]","Type=simple",`WorkingDirectory=${D.releases}/%i`,`ExecStart=${i}`,"Restart=always","RestartSec=5","MemoryAccounting=true",...h&&h!=="auto"?[`MemoryHigh=${h}`]:[],...w?[`MemoryMax=${w}`]:[],...T,`EnvironmentFile=${D.releases}/%i/.env`,`Environment=PORT=${c}`,"","[Install]","WantedBy=multi-user.target","TS_CLOUD_UNIT_EOF","systemctl daemon-reload",...h==="auto"?ui(`${O}@.service`):rn(),...il(H),`TS_CLOUD_OLD_UNITS=$(systemctl list-units --plain --no-legend --type=service "${O}@*.service" 2>/dev/null | awk '{print $1}' | grep -v "^${H}$" || true)`,`if [ -f /etc/systemd/system/${U} ] && systemctl is-active --quiet ${U}; then echo "[ts-cloud] retiring pre-zero-downtime unit ${U} (one-time restart cutover)"; systemctl stop ${U}; fi`,`systemctl restart ${H}`,`TS_CLOUD_GATE_OK=1; for TS_CLOUD_I in $(seq 1 ${Math.max(1,y)}); do sleep 1; systemctl is-active --quiet ${H} || { TS_CLOUD_GATE_OK=0; break; }; done`,`if [ "$TS_CLOUD_GATE_OK" -ne 1 ]; then echo "[ts-cloud] release ${s} could not overlap the previous release (no SO_REUSEPORT?) — retiring old instances and retrying" >&2; for TS_CLOUD_RU in \${TS_CLOUD_OLD_UNITS}; do systemctl stop "$TS_CLOUD_RU" 2>/dev/null || true; done; systemctl restart ${H}; for TS_CLOUD_I in $(seq 1 ${Math.max(1,y)}); do sleep 1; systemctl is-active --quiet ${H} || ${Q}; done; fi`,...Te?[`curl -sf -o /dev/null --max-time 10 "http://127.0.0.1:${c}${Te}" || ${Q}`]:[],...dt(D),`systemctl enable ${H} 2>/dev/null || true`,'for TS_CLOUD_U in ${TS_CLOUD_OLD_UNITS}; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done',`TS_CLOUD_LISTENING=0; for TS_CLOUD_I in $(seq 1 ${Math.max(1,y)}); do if ss -ltnH "sport = :${c}" 2>/dev/null | grep -q .; then TS_CLOUD_LISTENING=1; break; fi; sleep 1; done`,`if [ "$TS_CLOUD_LISTENING" -ne 1 ]; then echo "[ts-cloud] nothing is listening on ${c} after retiring the previous release — restarting ${H} on the now-free port" >&2; systemctl restart ${H}; for TS_CLOUD_I in $(seq 1 ${Math.max(1,y)}); do if ss -ltnH "sport = :${c}" 2>/dev/null | grep -q .; then TS_CLOUD_LISTENING=1; break; fi; sleep 1; done; fi`,`if [ "$TS_CLOUD_LISTENING" -ne 1 ]; then echo "[ts-cloud] ${H} is active but never bound ${c}" >&2; journalctl -u ${H} -n 50 --no-pager >&2 || true; exit 1; fi`,`systemctl list-unit-files --plain --no-legend "${O}@*.service" 2>/dev/null | awk '{print $1}' | { grep -v -e "^${H}$" -e "^${O}@\\.service$" || true; } | while read -r TS_CLOUD_U; do systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done`,`if [ -f /etc/systemd/system/${U} ]; then systemctl disable ${U} 2>/dev/null || true; rm -f /etc/systemd/system/${U}; systemctl daemon-reload; fi`,...mt(D,l),...v===!1?[]:pi({unitBase:O,unitPattern:`${O}@*.service`,port:c,path:v?.path??S,intervalSeconds:v?.intervalSeconds,failuresBeforeRestart:v?.failuresBeforeRestart})]}return[...te,`cat > /etc/systemd/system/${U} <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=${t} (managed by ts-cloud)`,"After=network.target","","[Service]","Type=simple",`WorkingDirectory=${D.current}`,`ExecStart=${i}`,"Restart=always","RestartSec=5","MemoryAccounting=true",...h&&h!=="auto"?[`MemoryHigh=${h}`]:[],...w?[`MemoryMax=${w}`]:[],...T,`EnvironmentFile=${D.current}/.env`,...c?[`Environment=PORT=${c}`]:[],"","[Install]","WantedBy=multi-user.target","TS_CLOUD_UNIT_EOF","systemctl daemon-reload",...h==="auto"?ui(U):rn(),`systemctl enable ${U}`,...dt(D),`systemctl restart ${U}`,`systemctl is-active ${U}`,...mt(D,l),...v===!1||!c?[]:pi({unitBase:O,unitPattern:U,port:c,path:v?.path??S,intervalSeconds:v?.intervalSeconds,failuresBeforeRestart:v?.failuresBeforeRestart})]}function qn(e){let{siteName:t,artifactFetch:r,releaseId:n,keepReleases:s=Tt,preStartCommands:i=[]}=e,o=e.appDir??`/var/www/${t}`,c=Pt(o,n),l=Vn(e.slug,t,n),m=i.length>0?[`cd ${c.release}`,...i]:[];return["set -euo pipefail",...Yr(c),Qr(c),...r,...Ct(c,[]),...Jr(c),`tar xzf ${l} -C "$TS_CLOUD_STAGED"`,...Zr(c),`rm -f ${l}`,...m,...dt(c),...mt(c,s)]}function Vn(e,t,r){return`/tmp/${[e,t,r].filter(Boolean).join("-")}-release.tar.gz`}function cc(e,t,r,n){return[`aws s3 cp "s3://${e}/${t}" ${n} --region ${r}`]}function dc(e,t){return[`mv "${e}" ${t}`]}function jn(){return['echo "[ts-cloud] host cleanup (disk before): $(df -h / | tail -1)"',"find /var/ts-cloud/staging -xdev -maxdepth 1 -type f -mmin +60 -delete 2>/dev/null || true",'find /tmp -xdev -maxdepth 1 -type f -name "*-release.tar.gz" -mmin +60 -delete 2>/dev/null || true',"find /root/.bun/install/cache -xdev -type f -mtime +7 -delete 2>/dev/null || true","find /root/.bun/install/cache -xdev -depth -type d -empty -delete 2>/dev/null || true","journalctl --vacuum-time=14d --vacuum-size=512M >/dev/null 2>&1 || true",'if command -v docker >/dev/null 2>&1; then docker image prune --all --force --filter "until=168h" >/dev/null 2>&1 || true; fi','if command -v podman >/dev/null 2>&1; then podman image prune --all --force --filter "until=168h" >/dev/null 2>&1 || true; fi',"if command -v apt-get >/dev/null 2>&1; then apt-get clean >/dev/null 2>&1 || true; fi",'echo "[ts-cloud] host cleanup (disk after): $(df -h / | tail -1)"']}import{copyFileSync as zl}from"node:fs";import{tmpdir as Bl}from"node:os";import{join as Kl}from"node:path";var ol=`${V}/project`;function di(e,t){let r=t.ownerSlug.trim(),n=t.selfSlug?.trim(),s={total:e.length,owner:[],self:[],others:new Map,unmanaged:[]};for(let i of e){let o=i.labels?.[ol]?.trim();if(!o){s.unmanaged.push(i.name);continue}if(o===r){s.owner.push(i.name);continue}if(n&&o===n){s.self.push(i.name);continue}let c=s.others.get(o);if(c)c.push(i.name);else s.others.set(o,[i.name])}return s}function nn(e){let t=e.unmanaged.length;for(let r of e.others.values())t+=r.length;return t}function fi(e,t){let r=nn(e),n=[];if(n.push(`Attaching to '${t.ownerSlug}' shares one provider project, so this deploy's credential can write to all ${e.total} server(s) it can see.`),r===0)return n.push("Nothing outside the two projects being joined is reachable with it."),n;n.push(`${r} of them belong to neither project:`);for(let s of[...e.others.keys()].sort())n.push(`  ${s}: ${[...e.others.get(s)].sort().join(", ")}`);if(e.unmanaged.length>0)n.push(`  not managed by ts-cloud: ${[...e.unmanaged].sort().join(", ")}`);return n.push("A compromised CI run or a mistargeted teardown in this project now reaches those. Keep the app in its own provider project instead if that is not acceptable, which rules out attaching."),n}import{execSync as Si}from"node:child_process";import{randomBytes as cl}from"node:crypto";import{chmodSync as ll,copyFileSync as ul,existsSync as qe,mkdirSync as vi,readFileSync as yi,statSync as pl,writeFileSync as on}from"node:fs";import{tmpdir as dl}from"node:os";import{basename as ml,dirname as cn,isAbsolute as bi,join as ee,resolve as fl}from"node:path";import{fileURLToPath as _i}from"node:url";function sn(e){if(!e||typeof e!=="object")return e;return Object.fromEntries(Object.keys(e).map((t)=>[t,""]))}function al(e){let t=JSON.parse(JSON.stringify(e??{}));if(t.hetzner)delete t.hetzner.apiToken;delete t.aws,delete t.stateDir;for(let r of Object.values(t.sites??{})){if(r?.env)r.env=sn(r.env);if(r?.environment)r.environment=sn(r.environment)}for(let r of Object.values(t.environments??{}))if(r?.variables)r.variables=sn(r.variables);for(let r of Object.values(t.infrastructure?.databases??{}))if(r?.password)r.password="";if(t.infrastructure?.appDatabase?.password)t.infrastructure.appDatabase.password="";if(t.infrastructure?.compute?.database?.password)t.infrastructure.compute.database.password="";if(t.infrastructure?.compute?.managedServices?.vitess?.password)t.infrastructure.compute.managedServices.vitess.password="";return t}function gi(e){let t=al(e);return["// Generated by ts-cloud for the management dashboard — do not edit.","//","// This is the project's resolved cloud config, inlined so it needs no","// imports on the box. Credentials are deliberately absent.",`export default ${JSON.stringify(t,null,2)}`,""].join(`
-`)}var lc="dashboard";function Ss(){return _("dashboard-credentials.json")}function gl(){return cl(24).toString("base64url")}function uc(e,t,r){let n=process.env.TS_CLOUD_UI_PASSWORD?.trim();if(n)return{password:n,source:"env"};if(an(process.env.TS_CLOUD_UI_PUBLIC))return{password:void 0,source:"public"};let s=Ss(),i=d(e,"dashboard-credentials.json");try{if(qe(i)){let c=JSON.parse(yi(i,"utf8"));if(c?.password)return{password:c.password,source:"generated"}}}catch{}let o=gl();try{vi(cn(i),{recursive:!0}),on(i,`${JSON.stringify({username:t,password:o,generatedAt:new Date().toISOString()},null,2)}
-`),ll(i,384),r.info(`Management dashboard: generated a password for '${t}' and saved it to ${s} (read it there — it is not printed). Set TS_CLOUD_UI_PASSWORD to pin your own, or TS_CLOUD_UI_PUBLIC=1 to serve without auth.`)}catch(c){r.warn(`Management dashboard: could not persist the generated password (${c?.message??c}). Using it for this deploy only — pass: ${o}
-This password is now in your deploy log. Set TS_CLOUD_UI_PASSWORD to a value of your own and redeploy once ${s} is writable.`)}return{password:o,source:"generated"}}var $i={info:()=>{},warn:()=>{}};function an(e){return e!=null&&e!==""&&e!=="0"&&e.toLowerCase()!=="false"}function hl(){return _("dashboard-release")}function wi(){let e=cn(_i(import.meta.url));for(let t of[ee(e,"..","..","package.json"),ee(e,"..","package.json")])try{let r=JSON.parse(yi(t,"utf8"));if(r.name==="@stacksjs/ts-cloud"&&r.version)return`^${r.version}`}catch{}return"latest"}function Sl(){return process.env.TS_CLOUD_UI_VERSION?.trim()||wi()}function vl(e,t,r){if(!e?.project?.slug)return r.warn("Management dashboard: the cloud config has no project slug — skipping the live dashboard."),null;let n=d(t,"dashboard-release");try{vi(n,{recursive:!0}),on(ee(n,"cloud.config.ts"),gi(e));let s=Sl();if(s.startsWith("file:")){let o=s.slice(5),c=bi(o)?o:fl(t,o);if(!qe(c)||!pl(c).isFile())s=wi(),r.warn(`Management dashboard: TS_CLOUD_UI_VERSION points to a missing package file (${c}); using the deploying ts-cloud version ${s} instead.`);else{let l=ml(c),m=ee(n,l);if(c!==m)ul(c,m);s=`file:./${l}`}}let i={name:"ts-cloud-dashboard",private:!0,type:"module",dependencies:{"@stacksjs/ts-cloud":s}};return on(ee(n,"package.json"),`${JSON.stringify(i,null,2)}
-`),hl()}catch(s){return r.warn(`Management dashboard: could not stage the live release (${s?.message??s}) — skipping.`),null}}function Nt(e){if(qe(ee(e,"packages","ui","pages"))||qe(ee(e,"packages","ui","package.json")))return{uiRoot:"packages/ui/dist",build:"cd packages/ui && bun install && bun run build"};let t=cn(_i(import.meta.url)),r=[ee(t,"ui"),ee(t,"..","ui"),ee(t,"..","..","ui"),ee(t,"..","dist","ui")];for(let n of r)if(qe(ee(n,"index.html"))||qe(ee(n,"serverless.html")))return{uiRoot:n,build:!1};return null}function zn(e,t={}){let r=t.logger??$i,n=t.cwd??process.cwd();if(an(process.env.TS_CLOUD_UI_DISABLE))return r.info("Management dashboard: skipped (TS_CLOUD_UI_DISABLE set)."),e;if(e.cloud?.attachTo)return r.info(`Management dashboard: ${e.project.slug} is attached to ${e.cloud.attachTo}; the server owner's dashboard monitors every attached project.`),e;if(Ht(e))return e;let s=e.environments&&Object.keys(e.environments)[0],i=process.env.TS_CLOUD_UI_DOMAIN?.trim()||void 0,o=Number(process.env.TS_CLOUD_UI_PORT)||void 0,c={...e.sites??{}};if(!an(process.env.TS_CLOUD_UI_STATIC)){let h=vl(e,n,r);if(!h)return e;let w=Ai(e,s??"production",{uiRoot:h,build:!1,domain:i,port:o,live:!0});if(w.length===0)return r.info("Management dashboard: no domain resolved (set TS_CLOUD_UI_DOMAIN or configure a site domain) — skipping."),e;for(let{name:E,site:R}of w)c[E]=R,r.info(`Management dashboard → https://${R.domain} (sign in with your ts-cloud account; the first deploy prints an admin password once)`);return e.sites=c,e}let l=Nt(n);if(!l)return r.info("Management dashboard: UI not found (no local ui/ or packaged dist/ui) — skipping auto-deploy."),e;let m=process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin",S=uc(n,m,r),y=Ai(e,s??"production",{uiRoot:l.uiRoot,build:l.build,domain:i,username:m,password:S.password,realm:process.env.TS_CLOUD_UI_REALM?.trim()||void 0,live:!1,port:o});if(y.length===0)return r.info("Management dashboard: no domain resolved (set TS_CLOUD_UI_DOMAIN or configure a site domain) — skipping."),e;let v=S.source==="public"?"NO AUTH — TS_CLOUD_UI_PUBLIC is set (dashboard is publicly reachable)":S.source==="env"?"htpasswd-protected (TS_CLOUD_UI_PASSWORD)":`htpasswd-protected (auto-generated — see ${Ss()})`;r.warn("Management dashboard: static mode — one shared password, and no per-site collaborators. Unset TS_CLOUD_UI_STATIC for the live dashboard.");for(let{name:h,site:w}of y)c[h]=w,r.info(`Management dashboard → https://${w.domain} (${v})`);return e.sites=c,e}function ln(e){return Object.keys(e.sites??{}).filter(_r)}function Cs(e,t){if(!e?.root)return null;let r=t.cwd??process.cwd(),n=t.logger??$i;try{if(typeof e.build==="string"&&e.build.trim())n.info(`Management dashboard: building UI (${e.build})`),Si(e.build,{cwd:r,stdio:"inherit"});let s=bi(e.root)?e.root:ee(r,e.root);if(!qe(s))return n.warn(`Management dashboard: build output not found at ${s} — skipping dashboard artifact.`),null;let i=ee(dl(),`${t.slug}-${t.siteName??lc}-${t.sha}.tar.gz`);return Si(`tar czf "${i}" -C "${s}" .`,{stdio:"inherit"}),i}catch(s){return n.warn(`Management dashboard: failed to build artifact — ${s?.message??s}. Skipping dashboard deploy.`),null}}var yl=new Set(["laravel","php","statamic","wordpress"]);function fr(e){if(e.framework)return e.framework;if(e.type&&yl.has(e.type))return"laravel";return"stacks"}var Ti=`eval "$(cd ${b} && pantry env 2>/dev/null)"`,Pi="/usr/local/bin/bun",bl="storage/framework/core/buddy/src/cli.ts",_l="node_modules/@stacksjs/ts-cloud/dist/bin/stacks-scheduler.js",Ci={id:"stacks",wrapExec:(e)=>e,execEnv:{PATH:"/usr/local/bin:/usr/bin:/bin",BUN_INSTALL:"/root/.bun",APP_ENV:"production",NODE_ENV:"production"},schedulerMode:"daemon",schedulerCommand:()=>`${Pi} ${_l}`,queueWorkerCommand:(e,{current:t})=>{let r=[`--queue=${e.queue||"default"}`,`--sleep=${e.sleep??3}`,`--tries=${e.tries??3}`,`--timeout=${e.timeout??60}`];return`${Pi} ${t}/${bl} queue:work ${r.join(" ")}`}},$l={id:"laravel",wrapExec:(e)=>`/bin/sh -lc '${Ti}; exec ${e}'`,schedulerMode:"cron",schedulerCommand:({current:e})=>`cd ${e} && ${Ti} && php artisan schedule:run`,queueWorkerCommand:(e,{current:t})=>{let r=`${t}/artisan`;if(e.horizon)return`php ${r} horizon`;let n=[e.connection||"default",`--queue=${e.queue||"default"}`,`--sleep=${e.sleep??3}`,`--tries=${e.tries??3}`,`--timeout=${e.timeout??60}`,`--memory=${e.memory??128}`];if(e.maxJobs)n.push(`--max-jobs=${e.maxJobs}`);if(e.maxTime)n.push(`--max-time=${e.maxTime}`);return`php ${r} queue:work ${n.join(" ")}`}},wl={stacks:Ci,laravel:$l};function xi(e){return wl[e]??Ci}function Ri(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function Tl(e){return`'${e.split("'").join("'\\''")}'`}function Ei(e){return e.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"unnamed"}function Pl(e,t,r){return`${e}-${t}-queue-${r}`}function Cl(e,t,r,n){return`${e}-${t}-daemon-${r.name?Ei(r.name):Ei(r.command).slice(0,32)||String(n)}`}function un(e){let t=["[Unit]",`Description=${e.description}`,"After=network.target","","[Service]","Type=simple",`WorkingDirectory=${e.workingDir}`,...Object.entries(e.environment??{}).map(([r,n])=>`Environment="${r}=${n}"`),`ExecStart=${e.execStart}`,`Restart=${e.restart||"always"}`,"RestartSec=5","MemoryAccounting=true",`MemoryHigh=${e.memoryHigh??"2G"}`,...e.memoryMax?[`MemoryMax=${e.memoryMax}`]:[]];if(e.user)t.push(`User=${e.user}`);if(typeof e.stopWaitSecs==="number")t.push(`TimeoutStopSec=${e.stopWaitSecs}`);return t.push("","[Install]","WantedBy=multi-user.target"),`${t.join(`
+' "$TS_CLOUD_MEM_MB" "$TS_CLOUD_HIGH_MB" > /etc/systemd/system/${e}.d/50-ts-cloud-memory.conf`,"systemctl daemon-reload",'echo "[ts-cloud] memoryHigh=auto resolved to ${TS_CLOUD_HIGH_MB}M (one eighth of ${TS_CLOUD_MEM_MB}M)"',...rn()]}function rn(){return[`TS_CLOUD_COMMIT=$(for f in /sys/fs/cgroup/system.slice/*.service/memory.high /sys/fs/cgroup/system.slice/*.slice/*.service/memory.high; do [ -f "$f" ] || continue; v=$(cat "$f" 2>/dev/null); [ "$v" = "max" ] && continue; echo "$v"; done | awk '{s+=$1} END {print int(s/1048576)}')`,"TS_CLOUD_RAM=$(awk '/^MemTotal:/{print int($2/1024)}' /proc/meminfo)",'if [ -n "$TS_CLOUD_COMMIT" ] && [ "$TS_CLOUD_COMMIT" -gt 0 ] && [ "$TS_CLOUD_RAM" -gt 0 ]; then TS_CLOUD_PCT=$((TS_CLOUD_COMMIT * 100 / TS_CLOUD_RAM)); if [ "$TS_CLOUD_PCT" -gt 300 ]; then echo "[ts-cloud] WARNING: services on this box declare ${TS_CLOUD_COMMIT}M of MemoryHigh against ${TS_CLOUD_RAM}M of RAM (${TS_CLOUD_PCT}% committed). Soft ceilings, so this is not fatal - but no ceiling can protect the box once enough of them are drawn on at once."; else echo "[ts-cloud] memory commitment: ${TS_CLOUD_COMMIT}M declared against ${TS_CLOUD_RAM}M RAM (${TS_CLOUD_PCT}%)"; fi; fi']}function ol(e){return[`TS_CLOUD_SLICE=$(systemctl show ${e} -p Slice --value 2>/dev/null || true)`,'if [ -n "$TS_CLOUD_SLICE" ] && [ "$TS_CLOUD_SLICE" != "system.slice" ]; then systemctl set-property --runtime "$TS_CLOUD_SLICE" MemoryHigh=infinity MemoryMax=infinity 2>/dev/null || true; systemctl set-property "$TS_CLOUD_SLICE" MemoryHigh=infinity MemoryMax=infinity 2>/dev/null || true; fi']}function pi(e){let{unitBase:t,unitPattern:r,port:n}=e,s=e.path&&e.path.startsWith("/")?e.path:"/",i=Math.max(10,e.intervalSeconds??60),o=Math.max(1,e.failuresBeforeRestart??3),c=`/usr/local/sbin/${t}-liveness`,m=r.includes("@*")?`TS_CLOUD_UNIT=$(systemctl list-units --plain --no-legend --type=service '${r}' 2>/dev/null | awk '{print $1}' | head -1)`:`TS_CLOUD_UNIT=${r}`;return[`cat > ${c} <<'TS_CLOUD_LIVENESS_EOF'`,"#!/bin/sh","set -eu",`exec 9>/run/${t}-liveness.lock`,"flock -n 9 || exit 0",m,'[ -n "$TS_CLOUD_UNIT" ] || exit 0','systemctl is-active --quiet "$TS_CLOUD_UNIT" || exit 0',`if curl -s -o /dev/null --max-time 5 "http://127.0.0.1:${n}${s}"; then`,`  rm -f /run/${t}-liveness.fail`,"  exit 0","fi",`TS_CLOUD_FAILS=$(cat /run/${t}-liveness.fail 2>/dev/null || echo 0)`,"TS_CLOUD_FAILS=$((TS_CLOUD_FAILS + 1))",`echo "$TS_CLOUD_FAILS" > /run/${t}-liveness.fail`,`[ "$TS_CLOUD_FAILS" -ge ${o} ] || exit 0`,`logger -t ${t}-liveness "no HTTP response on 127.0.0.1:${n}${s} after $TS_CLOUD_FAILS checks; restarting $TS_CLOUD_UNIT"`,'systemctl restart "$TS_CLOUD_UNIT"',`rm -f /run/${t}-liveness.fail`,"TS_CLOUD_LIVENESS_EOF",`chmod +x ${c}`,`cat > /etc/systemd/system/${t}-liveness.service <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=Liveness check for ${t} (managed by ts-cloud)`,"","[Service]","Type=oneshot",`ExecStart=${c}`,"TS_CLOUD_UNIT_EOF",`cat > /etc/systemd/system/${t}-liveness.timer <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=Run the ${t} liveness check every ${i}s`,"","[Timer]",`OnUnitActiveSec=${i}s`,`OnBootSec=${i}s`,"Persistent=true","","[Install]","WantedBy=timers.target","TS_CLOUD_UNIT_EOF","systemctl daemon-reload",`systemctl enable --now ${t}-liveness.timer >/dev/null 2>&1 || true`]}function Gn(e){let{siteName:t,slug:r,artifactFetch:n,releaseId:s,execStart:i,envEntries:o,port:c,keepReleases:l=Tt,preStartCommands:m=[],healthCheckPath:S,healthGateSeconds:y=5,liveness:v,memoryHigh:h="auto",memoryMax:w,cpuWeight:E,ioWeight:R,tasksMax:x,stopTimeout:C}=e,T=[...E!=null?[`CPUWeight=${E}`]:[],...R!=null?[`IOWeight=${R}`]:[],...x!=null?[`TasksMax=${x}`]:[],...C?[`TimeoutStopSec=${C}`]:[]],P=e.zeroDowntime??c!=null,A=e.appDir??`/var/www/${t}`,D=Pt(A,s),O=`${r}-${t}`,U=`${O}.service`,oe=Vn(r,t,s),F=e.sharedPaths??[],Y=ci([".env",...F,...tr(o,F)]),J=Jt(o),j=m.length>0?[`cd ${D.release}`,...m]:[],te=["set -euo pipefail",...Yr(D),Qr(D),...n,...Ct(D,Y),...Jr(D),`tar xzf ${oe} -C "$TS_CLOUD_STAGED"`,`rm -f ${oe}`,`cat > ${D.shared}/.env <<'TS_CLOUD_ENV_EOF'`,J,"TS_CLOUD_ENV_EOF",`chmod 600 ${D.shared}/.env`,...Zr(D),`find ${D.release} -maxdepth 1 \\( -type f -o -type l \\) -name '.env*' ! -name '.env.example' ! -name '*.example' -delete`,`sed -i -E '/^[[:space:]]*(PORT|PORT_BACKEND|PORT_ADMIN|PORT_FRONTEND)[[:space:]]*=/d' ${D.shared}/.env 2>/dev/null || true`,...Zt(D,Y),...j];if(P&&c!=null){let H=`${O}@${s}.service`,Te=S?S.startsWith("/")?S:`/${S}`:null,Q=`{ echo "[ts-cloud] release ${s} failed its health gate — previous release keeps serving" >&2; journalctl -u ${H} -n 50 --no-pager >&2 || true; systemctl stop ${H} 2>/dev/null || true; exit 1; }`;return[...te,`cat > /etc/systemd/system/${O}@.service <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=${t} release %i (managed by ts-cloud)`,"After=network.target","","[Service]","Type=simple",`WorkingDirectory=${D.releases}/%i`,`ExecStart=${i}`,"Restart=always","RestartSec=5","MemoryAccounting=true",...h&&h!=="auto"?[`MemoryHigh=${h}`]:[],...w?[`MemoryMax=${w}`]:[],...T,`EnvironmentFile=${D.releases}/%i/.env`,`Environment=PORT=${c}`,"","[Install]","WantedBy=multi-user.target","TS_CLOUD_UNIT_EOF","systemctl daemon-reload",...h==="auto"?ui(`${O}@.service`):rn(),...ol(H),`TS_CLOUD_OLD_UNITS=$(systemctl list-units --plain --no-legend --type=service "${O}@*.service" 2>/dev/null | awk '{print $1}' | grep -v "^${H}$" || true)`,`if [ -f /etc/systemd/system/${U} ] && systemctl is-active --quiet ${U}; then echo "[ts-cloud] retiring pre-zero-downtime unit ${U} (one-time restart cutover)"; systemctl stop ${U}; fi`,`systemctl restart ${H}`,`TS_CLOUD_GATE_OK=1; for TS_CLOUD_I in $(seq 1 ${Math.max(1,y)}); do sleep 1; systemctl is-active --quiet ${H} || { TS_CLOUD_GATE_OK=0; break; }; done`,`if [ "$TS_CLOUD_GATE_OK" -ne 1 ]; then echo "[ts-cloud] release ${s} could not overlap the previous release (no SO_REUSEPORT?) — retiring old instances and retrying" >&2; for TS_CLOUD_RU in \${TS_CLOUD_OLD_UNITS}; do systemctl stop "$TS_CLOUD_RU" 2>/dev/null || true; done; systemctl restart ${H}; for TS_CLOUD_I in $(seq 1 ${Math.max(1,y)}); do sleep 1; systemctl is-active --quiet ${H} || ${Q}; done; fi`,...Te?[`curl -sf -o /dev/null --max-time 10 "http://127.0.0.1:${c}${Te}" || ${Q}`]:[],...dt(D),`systemctl enable ${H} 2>/dev/null || true`,'for TS_CLOUD_U in ${TS_CLOUD_OLD_UNITS}; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done',`TS_CLOUD_LISTENING=0; for TS_CLOUD_I in $(seq 1 ${Math.max(1,y)}); do if ss -ltnH "sport = :${c}" 2>/dev/null | grep -q .; then TS_CLOUD_LISTENING=1; break; fi; sleep 1; done`,`if [ "$TS_CLOUD_LISTENING" -ne 1 ]; then echo "[ts-cloud] nothing is listening on ${c} after retiring the previous release — restarting ${H} on the now-free port" >&2; systemctl restart ${H}; for TS_CLOUD_I in $(seq 1 ${Math.max(1,y)}); do if ss -ltnH "sport = :${c}" 2>/dev/null | grep -q .; then TS_CLOUD_LISTENING=1; break; fi; sleep 1; done; fi`,`if [ "$TS_CLOUD_LISTENING" -ne 1 ]; then echo "[ts-cloud] ${H} is active but never bound ${c}" >&2; journalctl -u ${H} -n 50 --no-pager >&2 || true; exit 1; fi`,`systemctl list-unit-files --plain --no-legend "${O}@*.service" 2>/dev/null | awk '{print $1}' | { grep -v -e "^${H}$" -e "^${O}@\\.service$" || true; } | while read -r TS_CLOUD_U; do systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done`,`if [ -f /etc/systemd/system/${U} ]; then systemctl disable ${U} 2>/dev/null || true; rm -f /etc/systemd/system/${U}; systemctl daemon-reload; fi`,...mt(D,l),...v===!1?[]:pi({unitBase:O,unitPattern:`${O}@*.service`,port:c,path:v?.path??S,intervalSeconds:v?.intervalSeconds,failuresBeforeRestart:v?.failuresBeforeRestart})]}return[...te,`cat > /etc/systemd/system/${U} <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=${t} (managed by ts-cloud)`,"After=network.target","","[Service]","Type=simple",`WorkingDirectory=${D.current}`,`ExecStart=${i}`,"Restart=always","RestartSec=5","MemoryAccounting=true",...h&&h!=="auto"?[`MemoryHigh=${h}`]:[],...w?[`MemoryMax=${w}`]:[],...T,`EnvironmentFile=${D.current}/.env`,...c?[`Environment=PORT=${c}`]:[],"","[Install]","WantedBy=multi-user.target","TS_CLOUD_UNIT_EOF","systemctl daemon-reload",...h==="auto"?ui(U):rn(),`systemctl enable ${U}`,...dt(D),`systemctl restart ${U}`,`systemctl is-active ${U}`,...mt(D,l),...v===!1||!c?[]:pi({unitBase:O,unitPattern:U,port:c,path:v?.path??S,intervalSeconds:v?.intervalSeconds,failuresBeforeRestart:v?.failuresBeforeRestart})]}function qn(e){let{siteName:t,artifactFetch:r,releaseId:n,keepReleases:s=Tt,preStartCommands:i=[]}=e,o=e.appDir??`/var/www/${t}`,c=Pt(o,n),l=Vn(e.slug,t,n),m=i.length>0?[`cd ${c.release}`,...i]:[];return["set -euo pipefail",...Yr(c),Qr(c),...r,...Ct(c,[]),...Jr(c),`tar xzf ${l} -C "$TS_CLOUD_STAGED"`,...Zr(c),`rm -f ${l}`,...m,...dt(c),...mt(c,s)]}function Vn(e,t,r){return`/tmp/${[e,t,r].filter(Boolean).join("-")}-release.tar.gz`}function cc(e,t,r,n){return[`aws s3 cp "s3://${e}/${t}" ${n} --region ${r}`]}function dc(e,t){return[`mv "${e}" ${t}`]}function jn(){return['echo "[ts-cloud] host cleanup (disk before): $(df -h / | tail -1)"',"find /var/ts-cloud/staging -xdev -maxdepth 1 -type f -mmin +60 -delete 2>/dev/null || true",'find /tmp -xdev -maxdepth 1 -type f -name "*-release.tar.gz" -mmin +60 -delete 2>/dev/null || true',"find /root/.bun/install/cache -xdev -type f -mtime +7 -delete 2>/dev/null || true","find /root/.bun/install/cache -xdev -depth -type d -empty -delete 2>/dev/null || true","journalctl --vacuum-time=14d --vacuum-size=512M >/dev/null 2>&1 || true",'if command -v docker >/dev/null 2>&1; then docker image prune --all --force --filter "until=168h" >/dev/null 2>&1 || true; fi','if command -v podman >/dev/null 2>&1; then podman image prune --all --force --filter "until=168h" >/dev/null 2>&1 || true; fi',"if command -v apt-get >/dev/null 2>&1; then apt-get clean >/dev/null 2>&1 || true; fi",'echo "[ts-cloud] host cleanup (disk after): $(df -h / | tail -1)"']}import{copyFileSync as Bl}from"node:fs";import{tmpdir as Kl}from"node:os";import{join as jl}from"node:path";var al=`${V}/project`;function di(e,t){let r=t.ownerSlug.trim(),n=t.selfSlug?.trim(),s={total:e.length,owner:[],self:[],others:new Map,unmanaged:[]};for(let i of e){let o=i.labels?.[al]?.trim();if(!o){s.unmanaged.push(i.name);continue}if(o===r){s.owner.push(i.name);continue}if(n&&o===n){s.self.push(i.name);continue}let c=s.others.get(o);if(c)c.push(i.name);else s.others.set(o,[i.name])}return s}function nn(e){let t=e.unmanaged.length;for(let r of e.others.values())t+=r.length;return t}function fi(e,t){let r=nn(e),n=[];if(n.push(`Attaching to '${t.ownerSlug}' shares one provider project, so this deploy's credential can write to all ${e.total} server(s) it can see.`),r===0)return n.push("Nothing outside the two projects being joined is reachable with it."),n;n.push(`${r} of them belong to neither project:`);for(let s of[...e.others.keys()].sort())n.push(`  ${s}: ${[...e.others.get(s)].sort().join(", ")}`);if(e.unmanaged.length>0)n.push(`  not managed by ts-cloud: ${[...e.unmanaged].sort().join(", ")}`);return n.push("A compromised CI run or a mistargeted teardown in this project now reaches those. Keep the app in its own provider project instead if that is not acceptable, which rules out attaching."),n}import{execSync as Si}from"node:child_process";import{randomBytes as ll}from"node:crypto";import{chmodSync as ul,copyFileSync as pl,existsSync as qe,mkdirSync as vi,readFileSync as yi,statSync as dl,writeFileSync as on}from"node:fs";import{tmpdir as ml}from"node:os";import{basename as fl,dirname as cn,isAbsolute as bi,join as ee,resolve as gl}from"node:path";import{fileURLToPath as _i}from"node:url";function sn(e){if(!e||typeof e!=="object")return e;return Object.fromEntries(Object.keys(e).map((t)=>[t,""]))}function cl(e){let t=JSON.parse(JSON.stringify(e??{}));if(t.hetzner)delete t.hetzner.apiToken;delete t.aws,delete t.stateDir;for(let r of Object.values(t.sites??{})){if(r?.env)r.env=sn(r.env);if(r?.environment)r.environment=sn(r.environment)}for(let r of Object.values(t.environments??{}))if(r?.variables)r.variables=sn(r.variables);for(let r of Object.values(t.infrastructure?.databases??{}))if(r?.password)r.password="";if(t.infrastructure?.appDatabase?.password)t.infrastructure.appDatabase.password="";if(t.infrastructure?.compute?.database?.password)t.infrastructure.compute.database.password="";if(t.infrastructure?.compute?.managedServices?.vitess?.password)t.infrastructure.compute.managedServices.vitess.password="";return t}function gi(e){let t=cl(e);return["// Generated by ts-cloud for the management dashboard — do not edit.","//","// This is the project's resolved cloud config, inlined so it needs no","// imports on the box. Credentials are deliberately absent.",`export default ${JSON.stringify(t,null,2)}`,""].join(`
+`)}var lc="dashboard";function Ss(){return _("dashboard-credentials.json")}function hl(){return ll(24).toString("base64url")}function uc(e,t,r){let n=process.env.TS_CLOUD_UI_PASSWORD?.trim();if(n)return{password:n,source:"env"};if(an(process.env.TS_CLOUD_UI_PUBLIC))return{password:void 0,source:"public"};let s=Ss(),i=d(e,"dashboard-credentials.json");try{if(qe(i)){let c=JSON.parse(yi(i,"utf8"));if(c?.password)return{password:c.password,source:"generated"}}}catch{}let o=hl();try{vi(cn(i),{recursive:!0}),on(i,`${JSON.stringify({username:t,password:o,generatedAt:new Date().toISOString()},null,2)}
+`),ul(i,384),r.info(`Management dashboard: generated a password for '${t}' and saved it to ${s} (read it there — it is not printed). Set TS_CLOUD_UI_PASSWORD to pin your own, or TS_CLOUD_UI_PUBLIC=1 to serve without auth.`)}catch(c){r.warn(`Management dashboard: could not persist the generated password (${c?.message??c}). Using it for this deploy only — pass: ${o}
+This password is now in your deploy log. Set TS_CLOUD_UI_PASSWORD to a value of your own and redeploy once ${s} is writable.`)}return{password:o,source:"generated"}}var $i={info:()=>{},warn:()=>{}};function an(e){return e!=null&&e!==""&&e!=="0"&&e.toLowerCase()!=="false"}function Sl(){return _("dashboard-release")}function wi(){let e=cn(_i(import.meta.url));for(let t of[ee(e,"..","..","package.json"),ee(e,"..","package.json")])try{let r=JSON.parse(yi(t,"utf8"));if(r.name==="@stacksjs/ts-cloud"&&r.version)return`^${r.version}`}catch{}return"latest"}function vl(){return process.env.TS_CLOUD_UI_VERSION?.trim()||wi()}function yl(e,t,r){if(!e?.project?.slug)return r.warn("Management dashboard: the cloud config has no project slug — skipping the live dashboard."),null;let n=d(t,"dashboard-release");try{vi(n,{recursive:!0}),on(ee(n,"cloud.config.ts"),gi(e));let s=vl();if(s.startsWith("file:")){let o=s.slice(5),c=bi(o)?o:gl(t,o);if(!qe(c)||!dl(c).isFile())s=wi(),r.warn(`Management dashboard: TS_CLOUD_UI_VERSION points to a missing package file (${c}); using the deploying ts-cloud version ${s} instead.`);else{let l=fl(c),m=ee(n,l);if(c!==m)pl(c,m);s=`file:./${l}`}}let i={name:"ts-cloud-dashboard",private:!0,type:"module",dependencies:{"@stacksjs/ts-cloud":s}};return on(ee(n,"package.json"),`${JSON.stringify(i,null,2)}
+`),Sl()}catch(s){return r.warn(`Management dashboard: could not stage the live release (${s?.message??s}) — skipping.`),null}}function Nt(e){if(qe(ee(e,"packages","ui","pages"))||qe(ee(e,"packages","ui","package.json")))return{uiRoot:"packages/ui/dist",build:"cd packages/ui && bun install && bun run build"};let t=cn(_i(import.meta.url)),r=[ee(t,"ui"),ee(t,"..","ui"),ee(t,"..","..","ui"),ee(t,"..","dist","ui")];for(let n of r)if(qe(ee(n,"index.html"))||qe(ee(n,"serverless.html")))return{uiRoot:n,build:!1};return null}function zn(e,t={}){let r=t.logger??$i,n=t.cwd??process.cwd();if(an(process.env.TS_CLOUD_UI_DISABLE))return r.info("Management dashboard: skipped (TS_CLOUD_UI_DISABLE set)."),e;if(e.cloud?.attachTo)return r.info(`Management dashboard: ${e.project.slug} is attached to ${e.cloud.attachTo}; the server owner's dashboard monitors every attached project.`),e;if(Ht(e))return e;let s=e.environments&&Object.keys(e.environments)[0],i=process.env.TS_CLOUD_UI_DOMAIN?.trim()||void 0,o=Number(process.env.TS_CLOUD_UI_PORT)||void 0,c={...e.sites??{}};if(!an(process.env.TS_CLOUD_UI_STATIC)){let h=yl(e,n,r);if(!h)return e;let w=Ai(e,s??"production",{uiRoot:h,build:!1,domain:i,port:o,live:!0});if(w.length===0)return r.info("Management dashboard: no domain resolved (set TS_CLOUD_UI_DOMAIN or configure a site domain) — skipping."),e;for(let{name:E,site:R}of w)c[E]=R,r.info(`Management dashboard → https://${R.domain} (sign in with your ts-cloud account; the first deploy prints an admin password once)`);return e.sites=c,e}let l=Nt(n);if(!l)return r.info("Management dashboard: UI not found (no local ui/ or packaged dist/ui) — skipping auto-deploy."),e;let m=process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin",S=uc(n,m,r),y=Ai(e,s??"production",{uiRoot:l.uiRoot,build:l.build,domain:i,username:m,password:S.password,realm:process.env.TS_CLOUD_UI_REALM?.trim()||void 0,live:!1,port:o});if(y.length===0)return r.info("Management dashboard: no domain resolved (set TS_CLOUD_UI_DOMAIN or configure a site domain) — skipping."),e;let v=S.source==="public"?"NO AUTH — TS_CLOUD_UI_PUBLIC is set (dashboard is publicly reachable)":S.source==="env"?"htpasswd-protected (TS_CLOUD_UI_PASSWORD)":`htpasswd-protected (auto-generated — see ${Ss()})`;r.warn("Management dashboard: static mode — one shared password, and no per-site collaborators. Unset TS_CLOUD_UI_STATIC for the live dashboard.");for(let{name:h,site:w}of y)c[h]=w,r.info(`Management dashboard → https://${w.domain} (${v})`);return e.sites=c,e}function ln(e){return Object.keys(e.sites??{}).filter(_r)}function Cs(e,t){if(!e?.root)return null;let r=t.cwd??process.cwd(),n=t.logger??$i;try{if(typeof e.build==="string"&&e.build.trim())n.info(`Management dashboard: building UI (${e.build})`),Si(e.build,{cwd:r,stdio:"inherit"});let s=bi(e.root)?e.root:ee(r,e.root);if(!qe(s))return n.warn(`Management dashboard: build output not found at ${s} — skipping dashboard artifact.`),null;let i=ee(ml(),`${t.slug}-${t.siteName??lc}-${t.sha}.tar.gz`);return Si(`tar czf "${i}" -C "${s}" .`,{stdio:"inherit"}),i}catch(s){return n.warn(`Management dashboard: failed to build artifact — ${s?.message??s}. Skipping dashboard deploy.`),null}}var bl=new Set(["laravel","php","statamic","wordpress"]);function fr(e){if(e.framework)return e.framework;if(e.type&&bl.has(e.type))return"laravel";return"stacks"}var Ti=`eval "$(cd ${b} && pantry env 2>/dev/null)"`,Pi="/usr/local/bin/bun",_l="storage/framework/core/buddy/src/cli.ts",$l="node_modules/@stacksjs/ts-cloud/dist/bin/stacks-scheduler.js",Ci={id:"stacks",wrapExec:(e)=>e,execEnv:{PATH:"/usr/local/bin:/usr/bin:/bin",BUN_INSTALL:"/root/.bun",APP_ENV:"production",NODE_ENV:"production"},schedulerMode:"daemon",schedulerCommand:()=>`${Pi} ${$l}`,queueWorkerCommand:(e,{current:t})=>{let r=[`--queue=${e.queue||"default"}`,`--sleep=${e.sleep??3}`,`--tries=${e.tries??3}`,`--timeout=${e.timeout??60}`];return`${Pi} ${t}/${_l} queue:work ${r.join(" ")}`}},wl={id:"laravel",wrapExec:(e)=>`/bin/sh -lc '${Ti}; exec ${e}'`,schedulerMode:"cron",schedulerCommand:({current:e})=>`cd ${e} && ${Ti} && php artisan schedule:run`,queueWorkerCommand:(e,{current:t})=>{let r=`${t}/artisan`;if(e.horizon)return`php ${r} horizon`;let n=[e.connection||"default",`--queue=${e.queue||"default"}`,`--sleep=${e.sleep??3}`,`--tries=${e.tries??3}`,`--timeout=${e.timeout??60}`,`--memory=${e.memory??128}`];if(e.maxJobs)n.push(`--max-jobs=${e.maxJobs}`);if(e.maxTime)n.push(`--max-time=${e.maxTime}`);return`php ${r} queue:work ${n.join(" ")}`}},Tl={stacks:Ci,laravel:wl};function xi(e){return Tl[e]??Ci}function Ri(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function Pl(e){return`'${e.split("'").join("'\\''")}'`}function Ei(e){return e.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"unnamed"}function Cl(e,t,r){return`${e}-${t}-queue-${r}`}function xl(e,t,r,n){return`${e}-${t}-daemon-${r.name?Ei(r.name):Ei(r.command).slice(0,32)||String(n)}`}function un(e){let t=["[Unit]",`Description=${e.description}`,"After=network.target","","[Service]","Type=simple",`WorkingDirectory=${e.workingDir}`,...Object.entries(e.environment??{}).map(([r,n])=>`Environment="${r}=${n}"`),`ExecStart=${e.execStart}`,`Restart=${e.restart||"always"}`,"RestartSec=5","MemoryAccounting=true",`MemoryHigh=${e.memoryHigh??"2G"}`,...e.memoryMax?[`MemoryMax=${e.memoryMax}`]:[]];if(e.user)t.push(`User=${e.user}`);if(typeof e.stopWaitSecs==="number")t.push(`TimeoutStopSec=${e.stopWaitSecs}`);return t.push("","[Install]","WantedBy=multi-user.target"),`${t.join(`
 `)}
-`}function pn(e,t){return[`cat > /etc/systemd/system/${e}.service <<'TS_CLOUD_UNIT_EOF'`,t.replace(/\n$/,""),"TS_CLOUD_UNIT_EOF"]}function xl(e,t){return`/etc/cron.d/${e}-${t}-scheduler`}function dn(e){let{slug:t,siteName:r,site:n}=e,i=`${e.appBase??`/var/www/${r}`}/current`,o=xi(fr(n)),c={current:i},l=[],m=[];(n.queues||[]).forEach((x,C)=>{let T=Math.max(1,x.processes??1);for(let P=0;P<T;P++){let A=Pl(t,r,m.length);m.push(A),l.push(...pn(A,un({description:`${r} queue worker ${C}.${P} (managed by ts-cloud)`,workingDir:i,execStart:o.wrapExec(o.queueWorkerCommand(x,c)),environment:o.execEnv,stopWaitSecs:x.stopWaitSecs??90})))}}),(n.daemons||[]).forEach((x,C)=>{let T=Math.max(1,x.processes??1);for(let P=0;P<T;P++){let A=`${Cl(t,r,x,C)}-${P}`;m.push(A),l.push(...pn(A,un({description:`${r} daemon ${x.name||x.command} (managed by ts-cloud)`,workingDir:x.directory||i,execStart:o.wrapExec(x.command),environment:o.execEnv,restart:x.restart,user:x.user})))}});let v=n.scheduler,h=v===!0||typeof v==="object"&&v!==null,w=`${t}-${r}-scheduler`;if(h&&o.schedulerMode==="daemon")m.push(w),l.push(...pn(w,un({description:`${r} scheduler (managed by ts-cloud)`,workingDir:i,execStart:o.wrapExec(o.schedulerCommand(c)),environment:o.execEnv})));let E=m.map((x)=>`${x}.service`).join(" ");l.push("systemctl daemon-reload",`TS_CLOUD_DESIRED="${E}"`,`for unit in $(ls /etc/systemd/system/ 2>/dev/null | grep -E '^${Ri(t)}-${Ri(r)}-((queue|daemon)-.*|scheduler)\\.service$' || true); do`,'  case " $TS_CLOUD_DESIRED " in','    *" $unit "*) ;;','    *) systemctl stop "$unit" 2>/dev/null || true; systemctl disable "$unit" 2>/dev/null || true; rm -f "/etc/systemd/system/$unit" ;;',"  esac","done","systemctl daemon-reload");for(let x of m)l.push(`systemctl enable ${x}.service`,`systemctl restart ${x}.service`);let R=xl(t,r);if(h&&o.schedulerMode==="cron"){let x=typeof v==="object"&&v!==null?v:void 0,C=`${o.schedulerCommand(c)} >> /dev/null 2>&1`;if(x?.heartbeatUrl){let P=x.heartbeatMethod||"GET",A=P==="GET"?"":`-X ${P} `;C+=` && curl -fsS -m 10 ${A}${Tl(x.heartbeatUrl)} >/dev/null 2>&1`}let T=`* * * * * root ${C}
-`.replace(/%/g,"\\%");l.push(`cat > ${R} <<'TS_CLOUD_CRON_EOF'`,T.replace(/\n$/,""),"TS_CLOUD_CRON_EOF",`chmod 644 ${R}`)}else l.push(`rm -f ${R}`);return l}function mn(e){return!!(e.queues?.length||e.daemons?.length||e.scheduler)}function fn(e){if(e.ssl?.provider)return e.ssl.provider;return e.domain?"letsencrypt":"none"}var Oi={cloudflare:{pkg:"python3-certbot-dns-cloudflare",plugin:"dns-cloudflare"},route53:{pkg:"python3-certbot-dns-route53",plugin:"dns-route53"},digitalocean:{pkg:"python3-certbot-dns-digitalocean",plugin:"dns-digitalocean"},google:{pkg:"python3-certbot-dns-google",plugin:"dns-google"}};function Di(e){return`/etc/letsencrypt/ts-cloud-${e}.ini`}function Rl(e){let t=e?Oi[e.provider]:void 0,r=["certbot","python3-certbot-nginx",...t?[t.pkg]:[]].join(" ");return["export DEBIAN_FRONTEND=noninteractive",t?`apt-get update -y && apt-get install -y ${r}`:`command -v certbot >/dev/null 2>&1 || { apt-get update -y && apt-get install -y ${r}; }`,"mkdir -p /etc/letsencrypt/renewal-hooks/deploy","cat > /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh <<'TS_CLOUD_HOOK_EOF'","#!/bin/sh","systemctl reload ts-cloud-nginx 2>/dev/null || systemctl reload nginx 2>/dev/null || true","TS_CLOUD_HOOK_EOF","chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh","systemctl enable certbot.timer 2>/dev/null || true","systemctl start certbot.timer 2>/dev/null || true"]}function El(e){if(!e.credentials||Object.keys(e.credentials).length===0)return[];let t=Di(e.provider),r=Object.entries(e.credentials).map(([n,s])=>`${n} = ${s}`).join(`
-`);return[`cat > ${t} <<'TS_CLOUD_DNSCREDS_EOF'`,r,"TS_CLOUD_DNSCREDS_EOF",`chmod 600 ${t}`]}function Ol(e){let t=e.dns,r=e.wildcard?[`*.${e.domain}`,e.domain]:[e.domain,...e.aliases||[]].filter(Boolean),n=["certbot","--non-interactive","--agree-tos","--keep-until-expiring"];if(t){let s=Oi[t.provider].plugin;if(n.push(`--${s}`),t.provider!=="route53"&&t.credentials)n.push(`--${s}-credentials ${Di(t.provider)}`);if(typeof t.propagationSeconds==="number"&&t.provider!=="route53")n.push(`--${s}-propagation-seconds ${t.propagationSeconds}`);n.push("certonly")}else n.push("--nginx",`--nginx-ctl ${He}`,e.redirect===!1?"--no-redirect":"--redirect");if(e.email)n.push(`-m ${e.email}`);else n.push("--register-unsafely-without-email");for(let s of r)n.push(`-d ${s}`);return[n.join(" ")]}function gn(e){if(fn(e)!=="letsencrypt"||!e.domain)return[];let t=e.ssl,r=t?.dns,n=t?.wildcard===!0;if(n&&!r)return[];return[...Rl(r),...r?El(r):[],...Ol({domain:e.domain,aliases:e.aliases,email:t?.email,wildcard:n,dns:r})]}function Ii(e){let{repository:t,releaseDir:r,commit:n}=e,s=t.branch||"main",i=t.url,o=[`rm -rf ${r}`,`mkdir -p ${r}`];if(t.strategy==="tag")if(t.tag)o.push(`git clone -q --depth 1 --branch ${ue(t.tag)} ${ue(i)} ${r}`),o.push(`printf '%s' ${ue(t.tag)} > ${r}/.ts-cloud-tag`);else{let c=t.tagPattern||"v*";o.push(`TS_CLOUD_TAG="$(git ls-remote --tags --refs --sort=-v:refname ${ue(i)} ${ue(`refs/tags/${c}`)} | head -n1 | sed 's#.*refs/tags/##')"`,`test -n "$TS_CLOUD_TAG" || { echo "no tags matching" ${ue(c)} "found in" ${ue(i)} >&2; exit 1; }`,`git clone -q --depth 1 --branch "$TS_CLOUD_TAG" ${ue(i)} ${r}`,`printf '%s' "$TS_CLOUD_TAG" > ${r}/.ts-cloud-tag`)}else if(n)o.push(`git -C ${r} init -q`,`git -C ${r} remote add origin ${ue(i)}`,`git -C ${r} fetch -q --depth 1 origin ${ue(n)}`,`git -C ${r} checkout -q FETCH_HEAD`);else o.push(`git clone -q --depth 1 --branch ${ue(s)} ${ue(i)} ${r}`);return o.push(`git -C ${r} rev-parse HEAD > ${r}/.ts-cloud-sha`),o}function ue(e){return`'${e.split("'").join("'\\''")}'`}var rr="$CREATE_RELEASE",nr="$ACTIVATE_RELEASE",Ni="$RESTART_QUEUES",Li="composer install --no-interaction --prefer-dist --optimize-autoloader --no-dev",Dl=["php artisan migrate --force","php artisan config:cache","php artisan route:cache","php artisan view:cache","php artisan event:cache","php artisan storage:link"];function Il(e){switch(e){case"laravel":case"statamic":return[rr,Li,...Dl,nr,Ni];case"php":case"wordpress":return[rr,`${Li} || true`,nr];case"static":case"spa":return[rr,nr]}}function Al(e,t){return e.replace(/^php\s+/,`${t} `).replace(/(\s)php\s+artisan\s+/g,`$1${t} artisan `)}function Ll(e,t){let r=Jt(t);return[`cat > ${e} <<'TS_CLOUD_ENV_EOF'`,r,"TS_CLOUD_ENV_EOF",`chmod 600 ${e}`]}function ki(e,t,r){return[`cat > ${e} <<'${r}'`,t.replace(/\n$/,""),r,`chmod 600 ${e}`]}function kl(e,t){if(!t)return[];let r=[];if(t.composerAuth){let n=typeof t.composerAuth==="string"?t.composerAuth:JSON.stringify(t.composerAuth,null,2);r.push(...ki(`${e}/auth.json`,n,"TS_CLOUD_AUTHJSON_EOF"))}if(t.npmrc)r.push(...ki(`${e}/.npmrc`,t.npmrc,"TS_CLOUD_NPMRC_EOF"));return r}function Ui(e){let t=e.healthCheck?.path;if(!t||!e.domain)return[];let n=`http://127.0.0.1${t.startsWith("/")?t:`/${t}`}`;return[`echo "[ts-cloud] health check ${n} (Host: ${e.domain})"`,"TS_CLOUD_HC_OK=0",`for i in $(seq 1 10); do TS_CLOUD_HC=$(curl -s -o /dev/null -w "%{http_code}" -H "Host: ${e.domain}" -m 10 "${n}" 2>/dev/null || echo 000); case "$TS_CLOUD_HC" in 2*|3*) TS_CLOUD_HC_OK=1; break ;; esac; sleep 3; done`,'[ "$TS_CLOUD_HC_OK" = 1 ] && echo "health check passed ($TS_CLOUD_HC)" || { echo "health check FAILED (last=$TS_CLOUD_HC)" >&2; exit 1; }']}function Hi(e){let{siteName:t,site:r,releaseId:n,commit:s}=e;if(!r.repository?.url)throw Error(`Site '${t}' is a PHP/git site but has no repository.url to clone`);let i=e.appBase??`/var/www/${t}`,o="php",c=Pt(i,n),l=r.sharedPaths??Qt,m=[...l,...tr(r.env,l)],S=r.keepReleases??Tt,y=r.deployScript?.length?r.deployScript:Il(r.type??"laravel"),v=["set -euo pipefail",'export HOME="${HOME:-/root}"','export COMPOSER_HOME="${COMPOSER_HOME:-/root/.composer}"',"export COMPOSER_ALLOW_SUPERUSER=1",Pe()];if(v.push(...er(i,{releaseId:n,commit:s,branch:r.repository.branch,keepLogs:S})),v.push(...Ct(c,m)),r.env&&Object.keys(r.env).length>0)v.push(...Ll(`${c.shared}/.env`,r.env));for(let h of y){let w=h.trim();if(w===rr)v.push(...Ii({repository:r.repository,releaseDir:c.release,commit:s})),v.push(...Zt(c,m)),v.push(`cd ${c.release}`),v.push(...kl(c.release,r.credentials)),v.push(`chown -R www-data:www-data ${c.shared}/storage 2>/dev/null || true`,`[ -d ${c.release}/bootstrap/cache ] && chown -R www-data:www-data ${c.release}/bootstrap/cache 2>/dev/null || true`,`chmod -R ug+rwX ${c.shared}/storage 2>/dev/null || true`);else if(w===nr)v.push(...dt(c)),v.push(...mt(c,S)),v.push(`(cd ${b} && pantry restart php-fpm) 2>/dev/null || true`);else if(w===Ni)v.push(`${o} artisan queue:restart || true`);else v.push(Al(h,o))}return v}var sr={mysql:{port:3306,binaries:["mysqld","mysql"]},mariadb:{port:3306,binaries:["mariadbd","mariadb","mysqld"]},postgres:{port:5432,binaries:["postgres","psql"]},redis:{port:6379,binaries:["redis-server","redis-cli"]},memcached:{port:11211,binaries:["memcached"]},meilisearch:{port:7700,binaries:["meilisearch"]},vitess:{port:15306,binaries:["vtgate"]}},xt="ts-cloud-service:";function Nl(e){return e===!0||typeof e==="object"&&e!=null}function Mi(e){if(!e)return[];return Object.keys(sr).filter((t)=>Nl(e[t]))}function Fi(e){if(e.length===0)return[];return[Pe(),"ts_cloud_port_open() {",'  if command -v ss >/dev/null 2>&1; then ss -ltn 2>/dev/null | grep -qE "[:.]$1[[:space:]]" && return 0; fi','  if command -v netstat >/dev/null 2>&1; then netstat -ltn 2>/dev/null | grep -qE "[:.]$1[[:space:]]" && return 0; fi',"  (exec 3<>/dev/tcp/127.0.0.1/$1) 2>/dev/null && { exec 3<&- 3>&-; return 0; }","  return 1","}","ts_cloud_probe() {",'  TS_CLOUD_SVC="$1"; TS_CLOUD_PORT="$2"; shift 2','  for TS_CLOUD_BIN in "$@"; do',`    if command -v "$TS_CLOUD_BIN" >/dev/null 2>&1; then echo "${xt}$TS_CLOUD_SVC:present"; return 0; fi`,"  done",`  if ts_cloud_port_open "$TS_CLOUD_PORT"; then echo "${xt}$TS_CLOUD_SVC:present"; return 0; fi`,`  echo "${xt}$TS_CLOUD_SVC:missing"`,"  return 0","}",...e.filter((t)=>sr[t]).map((t)=>`ts_cloud_probe ${t} ${sr[t].port} ${sr[t].binaries.join(" ")}`),"exit 0"]}function zi(e,t){if(!e)return[];let r=new Map;for(let n of e.split(`
-`)){let s=n.indexOf(xt);if(s===-1)continue;let[i,o]=n.slice(s+xt.length).trim().split(":");if(i)r.set(i,o)}return t.filter((n)=>r.get(n)==="missing")}function Bi(e,t,r){let n=r?` on ${r}`:"",s=e.map((o)=>`managedServices.${o}`).join(", "),i=e.length===1?`no ${e[0]}`:`none of ${e.join(", ")}`;return`This project declares ${s}, but '${t}' has ${i}${n}. Attach mode does not provision services on the owner's box, so nothing will install ${e.length===1?"it":"them"}. Point the app at an external service, or ask the owner of '${t}' to add ${e.length===1?"it":"them"} to their own config and re-provision.`}var Ki="/var/lib/pantry/php-fpm/pool.d",Ul=9100,Hl=400;function ir(e){return(e.toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/^_+|_+$/g,"")||"site").slice(0,28)}function ji(e){return`web_${ir(e)}`}function Ml(e){let t=ir(e),r=0;for(let n=0;n<t.length;n++)r=r*31+t.charCodeAt(n)>>>0;return Ul+r%Hl}function hn(e){return`127.0.0.1:${Ml(e)}`}function Fl(e){let t=ir(e.siteName),r=ji(e.siteName),n=e.maxChildren??10;return[`; ts-cloud-managed pool for ${e.siteName} (site isolation)`,`[${t}]`,`user = ${r}`,`group = ${r}`,`listen = ${hn(e.siteName)}`,"pm = dynamic",`pm.max_children = ${n}`,"pm.start_servers = 2","pm.min_spare_servers = 1","pm.max_spare_servers = 3","pm.max_requests = 500","catch_workers_output = yes",`php_admin_value[open_basedir] = ${e.appBase}:/tmp`,""].join(`
-`)}function Gi(e){let t=ji(e.siteName),r=ir(e.siteName),n=`${Ki}/${r}.conf`;return[`getent group ${t} >/dev/null || groupadd --system ${t}`,`id -u ${t} >/dev/null 2>&1 || useradd --system --no-create-home --shell /usr/sbin/nologin -g ${t} ${t}`,`usermod -aG ${t} www-data 2>/dev/null || true`,`chown -R ${t}:${t} ${e.appBase} || true`,`chmod -R g+rX ${e.appBase} || true`,`chmod 600 ${e.appBase}/shared/.env 2>/dev/null || true`,`mkdir -p ${Ki}`,`cat > ${n} <<'TS_CLOUD_FPMPOOL_EOF'`,Fl(e).replace(/\n$/,""),"TS_CLOUD_FPMPOOL_EOF",`(cd ${b} && pantry restart php-fpm) 2>/dev/null || true`]}var vr={info:()=>{},warn:()=>{},error:()=>{},step:()=>{},success:()=>{}};function jl(e){return`'${e.replace(/'/g,`'"'"'`)}'`}async function bs(e,t,r=vr){let{config:n,environment:s,siteName:i,site:o,slug:c,sha:l,runtime:m,localTarballPath:S}=t,y=`releases/${i}/${l}.tar.gz`,v=g(n,s),h=await e.getComputeOutputs({config:n,environment:s}),w=await e.findComputeTargets({slug:c,environment:s,role:"app",stackName:v});if(w.length===0)return{success:!1,error:e.name==="aws"?`Stack '${v}' has no EC2 instances tagged Project=${c} Environment=${s} Role=app, and storage/cloud/state/${v}.json pins no live instance. For a shared box, record its instanceId there.`:`No Hetzner servers labeled ts-cloud/project=${c} ts-cloud/environment=${s} ts-cloud/role=app, and storage/cloud/state/${v}.json pins no live server. For a shared box, record its serverId there.`};let E=h.servicesPrivateIp?zs(h.servicesPrivateIp,p(n)):ss(p(n)),R=cd(hi(n,{environment:s})),x=n.infrastructure?.compute,C=se(x)?{HOST:"127.0.0.1"}:{},T=s==="production"?{APP_ENV:"production",NODE_ENV:"production"}:{},P={...E,...R,...C,...o.env||{},...T},A=tn(P,o.sharedPaths??[]);if(A.warning)r.warn(`Site '${i}': ${A.warning}`);else if(A.path)r.info(`Site '${i}': sharing '${A.path}' so the SQLite database survives deploys.`);if(Ir(o)){let he=o.phpVersion??x?.php?.default??x?.php?.versions?.[0],L=B(c,i),W=Object.keys(E).length>0?{...o,env:P}:o,I=Hi({siteName:i,site:W,releaseId:l,appBase:L,defaultPhpVersion:he}),M=!se(x),pe=fn(o)==="custom"&&o.ssl?.certPath&&o.ssl?.keyPath?{certPath:o.ssl.certPath,keyPath:o.ssl.keyPath}:void 0,ke=o.isolation?Gi({siteName:i,appBase:L}):[],ft=M?Nr({siteName:i,domain:o.domain||i,aliases:o.aliases,type:o.type,appDir:`${L}/current`,webDirectory:o.webDirectory,phpVersion:he,fastcgiPass:o.isolation?hn(i):void 0,redirects:o.redirects,ssl:pe,auth:o.auth&&o.auth.enabled!==!1&&o.auth.password?{username:o.auth.username||"admin",password:o.auth.password,realm:o.auth.realm}:void 0,serverSnippet:kr(o.nginx,x?.nginxTemplates),clientMaxBodySize:o.nginx?.clientMaxBodySize,hsts:o.ssl?.hsts,tlsProtocols:o.ssl?.tlsProtocols,security:o.security}):[],yr=M?gn(o):[],gt=mn(o)?dn({slug:c,siteName:i,site:o,phpVersion:he,appBase:L}):[],qi=M?Ui(o):[];r.step(`Deploying PHP site '${i}' to ${w.length} target(s)...`);let Me=await e.runRemoteDeploy({targets:w,commands:[...en(L,c),...I,...ke,...ft,...yr,...gt,...qi],comment:`ts-cloud deploy ${c}/${i}@${l}`,tags:{Project:c,Environment:s,Role:"app"}}),An=ls(n.notifications,o.notifications);if(!Me.success)return await Hr(An,"deploy-failed",`❌ Deploy of ${c}/${i}@${l} failed: ${Me.error||"unknown error"}`),{success:!1,error:Me.error||"Remote PHP deploy failed",instanceCount:Me.instanceCount,perInstance:Me.perInstance};let Wi=o.domain?` → https://${o.domain}`:"";return await Hr(An,"deploy",`✅ Deployed ${c}/${i}@${l}${Wi}`),{success:!0,instanceCount:Me.instanceCount,perInstance:Me.perInstance}}if(!S)return{success:!1,error:`Site '${i}' requires a release tarball but none was provided`};let D=await e.uploadRelease({config:n,environment:s,localPath:S,remoteKey:y,targets:w}),O=Vn(c,i,l),U=e.name==="aws"?cc(h.deployBucketName,y,n.project.region||"us-east-1",O):dc(D.artifactRef,O),oe=u(o),F=B(c,i),Y=oe==="server-static"?qn({siteName:i,slug:c,appDir:F,artifactFetch:U,releaseId:l,preStartCommands:o.preStart}):Gn({siteName:i,slug:c,appDir:F,artifactFetch:U,releaseId:l,execStart:Hn(o.start,m),envEntries:P,port:o.port,preStartCommands:o.preStart,sharedPaths:o.sharedPaths,zeroDowntime:o.zeroDowntime!==!1,healthCheckPath:o.healthCheck?.path,memoryHigh:o.memoryHigh,memoryMax:o.memoryMax,cpuWeight:o.cpuWeight,ioWeight:o.ioWeight,tasksMax:o.tasksMax,stopTimeout:o.stopTimeout}),J=oe==="server-static"&&!se(x)&&!!o.domain,j=J?Nr({siteName:i,domain:o.domain,aliases:o.aliases,type:o.type==="spa"?"spa":"static",appDir:`${F}/current`,webDirectory:"",redirects:o.redirects,auth:o.auth&&o.auth.enabled!==!1&&o.auth.password?{username:o.auth.username||"admin",password:o.auth.password,realm:o.auth.realm}:void 0,serverSnippet:kr(o.nginx,x?.nginxTemplates),clientMaxBodySize:o.nginx?.clientMaxBodySize,hsts:o.ssl?.hsts,tlsProtocols:o.ssl?.tlsProtocols,security:o.security}):[],te=J?gn(o):[],H=mn(o)?dn({slug:c,siteName:i,site:o,appBase:F}):[],Te=[...er(F,{releaseId:l,commit:l,branch:o.repository?.branch??"main"}),...en(F,c),...Y,...j,...te,...H,...jn()];r.step(`Deploying to ${w.length} target(s)...`);let Q=await e.runRemoteDeploy({targets:w,commands:Te,comment:`ts-cloud deploy ${c}/${i}@${l}`,tags:{Project:c,Environment:s,Role:"app"}});if(!Q.success)return{success:!1,error:Q.error||"Remote deploy failed",instanceCount:Q.instanceCount,perInstance:Q.perInstance};return{success:!0,instanceCount:Q.instanceCount,perInstance:Q.perInstance}}function or(e){return`'${e.replaceAll("'","'\\''")}'`}function Gl(e,t,r=!1,n=[]){let s=`${e}-dashboard-`,i=t.map((c)=>`${e}-${c}.service`),o=r?[`export TS_CLOUD_DASHBOARD_KEEP_DOMAINS=${or(JSON.stringify(n))}`,"rm -f /run/ts-cloud-dashboard-routes-changed",`/usr/local/bin/bun --bun -e ${or(`
+`}function pn(e,t){return[`cat > /etc/systemd/system/${e}.service <<'TS_CLOUD_UNIT_EOF'`,t.replace(/\n$/,""),"TS_CLOUD_UNIT_EOF"]}function Rl(e,t){return`/etc/cron.d/${e}-${t}-scheduler`}function dn(e){let{slug:t,siteName:r,site:n}=e,i=`${e.appBase??`/var/www/${r}`}/current`,o=xi(fr(n)),c={current:i},l=[],m=[];(n.queues||[]).forEach((x,C)=>{let T=Math.max(1,x.processes??1);for(let P=0;P<T;P++){let A=Cl(t,r,m.length);m.push(A),l.push(...pn(A,un({description:`${r} queue worker ${C}.${P} (managed by ts-cloud)`,workingDir:i,execStart:o.wrapExec(o.queueWorkerCommand(x,c)),environment:o.execEnv,stopWaitSecs:x.stopWaitSecs??90})))}}),(n.daemons||[]).forEach((x,C)=>{let T=Math.max(1,x.processes??1);for(let P=0;P<T;P++){let A=`${xl(t,r,x,C)}-${P}`;m.push(A),l.push(...pn(A,un({description:`${r} daemon ${x.name||x.command} (managed by ts-cloud)`,workingDir:x.directory||i,execStart:o.wrapExec(x.command),environment:o.execEnv,restart:x.restart,user:x.user})))}});let v=n.scheduler,h=v===!0||typeof v==="object"&&v!==null,w=`${t}-${r}-scheduler`;if(h&&o.schedulerMode==="daemon")m.push(w),l.push(...pn(w,un({description:`${r} scheduler (managed by ts-cloud)`,workingDir:i,execStart:o.wrapExec(o.schedulerCommand(c)),environment:o.execEnv})));let E=m.map((x)=>`${x}.service`).join(" ");l.push("systemctl daemon-reload",`TS_CLOUD_DESIRED="${E}"`,`for unit in $(ls /etc/systemd/system/ 2>/dev/null | grep -E '^${Ri(t)}-${Ri(r)}-((queue|daemon)-.*|scheduler)\\.service$' || true); do`,'  case " $TS_CLOUD_DESIRED " in','    *" $unit "*) ;;','    *) systemctl stop "$unit" 2>/dev/null || true; systemctl disable "$unit" 2>/dev/null || true; rm -f "/etc/systemd/system/$unit" ;;',"  esac","done","systemctl daemon-reload");for(let x of m)l.push(`systemctl enable ${x}.service`,`systemctl restart ${x}.service`);let R=Rl(t,r);if(h&&o.schedulerMode==="cron"){let x=typeof v==="object"&&v!==null?v:void 0,C=`${o.schedulerCommand(c)} >> /dev/null 2>&1`;if(x?.heartbeatUrl){let P=x.heartbeatMethod||"GET",A=P==="GET"?"":`-X ${P} `;C+=` && curl -fsS -m 10 ${A}${Pl(x.heartbeatUrl)} >/dev/null 2>&1`}let T=`* * * * * root ${C}
+`.replace(/%/g,"\\%");l.push(`cat > ${R} <<'TS_CLOUD_CRON_EOF'`,T.replace(/\n$/,""),"TS_CLOUD_CRON_EOF",`chmod 644 ${R}`)}else l.push(`rm -f ${R}`);return l}function mn(e){return!!(e.queues?.length||e.daemons?.length||e.scheduler)}function fn(e){if(e.ssl?.provider)return e.ssl.provider;return e.domain?"letsencrypt":"none"}var Oi={cloudflare:{pkg:"python3-certbot-dns-cloudflare",plugin:"dns-cloudflare"},route53:{pkg:"python3-certbot-dns-route53",plugin:"dns-route53"},digitalocean:{pkg:"python3-certbot-dns-digitalocean",plugin:"dns-digitalocean"},google:{pkg:"python3-certbot-dns-google",plugin:"dns-google"}};function Di(e){return`/etc/letsencrypt/ts-cloud-${e}.ini`}function El(e){let t=e?Oi[e.provider]:void 0,r=["certbot","python3-certbot-nginx",...t?[t.pkg]:[]].join(" ");return["export DEBIAN_FRONTEND=noninteractive",t?`apt-get update -y && apt-get install -y ${r}`:`command -v certbot >/dev/null 2>&1 || { apt-get update -y && apt-get install -y ${r}; }`,"mkdir -p /etc/letsencrypt/renewal-hooks/deploy","cat > /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh <<'TS_CLOUD_HOOK_EOF'","#!/bin/sh","systemctl reload ts-cloud-nginx 2>/dev/null || systemctl reload nginx 2>/dev/null || true","TS_CLOUD_HOOK_EOF","chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh","systemctl enable certbot.timer 2>/dev/null || true","systemctl start certbot.timer 2>/dev/null || true"]}function Ol(e){if(!e.credentials||Object.keys(e.credentials).length===0)return[];let t=Di(e.provider),r=Object.entries(e.credentials).map(([n,s])=>`${n} = ${s}`).join(`
+`);return[`cat > ${t} <<'TS_CLOUD_DNSCREDS_EOF'`,r,"TS_CLOUD_DNSCREDS_EOF",`chmod 600 ${t}`]}function Dl(e){let t=e.dns,r=e.wildcard?[`*.${e.domain}`,e.domain]:[e.domain,...e.aliases||[]].filter(Boolean),n=["certbot","--non-interactive","--agree-tos","--keep-until-expiring"];if(t){let s=Oi[t.provider].plugin;if(n.push(`--${s}`),t.provider!=="route53"&&t.credentials)n.push(`--${s}-credentials ${Di(t.provider)}`);if(typeof t.propagationSeconds==="number"&&t.provider!=="route53")n.push(`--${s}-propagation-seconds ${t.propagationSeconds}`);n.push("certonly")}else n.push("--nginx",`--nginx-ctl ${He}`,e.redirect===!1?"--no-redirect":"--redirect");if(e.email)n.push(`-m ${e.email}`);else n.push("--register-unsafely-without-email");for(let s of r)n.push(`-d ${s}`);return[n.join(" ")]}function gn(e){if(fn(e)!=="letsencrypt"||!e.domain)return[];let t=e.ssl,r=t?.dns,n=t?.wildcard===!0;if(n&&!r)return[];return[...El(r),...r?Ol(r):[],...Dl({domain:e.domain,aliases:e.aliases,email:t?.email,wildcard:n,dns:r})]}function Ii(e){let{repository:t,releaseDir:r,commit:n}=e,s=t.branch||"main",i=t.url,o=[`rm -rf ${r}`,`mkdir -p ${r}`];if(t.strategy==="tag")if(t.tag)o.push(`git clone -q --depth 1 --branch ${ue(t.tag)} ${ue(i)} ${r}`),o.push(`printf '%s' ${ue(t.tag)} > ${r}/.ts-cloud-tag`);else{let c=t.tagPattern||"v*";o.push(`TS_CLOUD_TAG="$(git ls-remote --tags --refs --sort=-v:refname ${ue(i)} ${ue(`refs/tags/${c}`)} | head -n1 | sed 's#.*refs/tags/##')"`,`test -n "$TS_CLOUD_TAG" || { echo "no tags matching" ${ue(c)} "found in" ${ue(i)} >&2; exit 1; }`,`git clone -q --depth 1 --branch "$TS_CLOUD_TAG" ${ue(i)} ${r}`,`printf '%s' "$TS_CLOUD_TAG" > ${r}/.ts-cloud-tag`)}else if(n)o.push(`git -C ${r} init -q`,`git -C ${r} remote add origin ${ue(i)}`,`git -C ${r} fetch -q --depth 1 origin ${ue(n)}`,`git -C ${r} checkout -q FETCH_HEAD`);else o.push(`git clone -q --depth 1 --branch ${ue(s)} ${ue(i)} ${r}`);return o.push(`git -C ${r} rev-parse HEAD > ${r}/.ts-cloud-sha`),o}function ue(e){return`'${e.split("'").join("'\\''")}'`}var rr="$CREATE_RELEASE",nr="$ACTIVATE_RELEASE",Ni="$RESTART_QUEUES",Li="composer install --no-interaction --prefer-dist --optimize-autoloader --no-dev",Il=["php artisan migrate --force","php artisan config:cache","php artisan route:cache","php artisan view:cache","php artisan event:cache","php artisan storage:link"];function Al(e){switch(e){case"laravel":case"statamic":return[rr,Li,...Il,nr,Ni];case"php":case"wordpress":return[rr,`${Li} || true`,nr];case"static":case"spa":return[rr,nr]}}function Ll(e,t){return e.replace(/^php\s+/,`${t} `).replace(/(\s)php\s+artisan\s+/g,`$1${t} artisan `)}function kl(e,t){let r=Jt(t);return[`cat > ${e} <<'TS_CLOUD_ENV_EOF'`,r,"TS_CLOUD_ENV_EOF",`chmod 600 ${e}`]}function ki(e,t,r){return[`cat > ${e} <<'${r}'`,t.replace(/\n$/,""),r,`chmod 600 ${e}`]}function Nl(e,t){if(!t)return[];let r=[];if(t.composerAuth){let n=typeof t.composerAuth==="string"?t.composerAuth:JSON.stringify(t.composerAuth,null,2);r.push(...ki(`${e}/auth.json`,n,"TS_CLOUD_AUTHJSON_EOF"))}if(t.npmrc)r.push(...ki(`${e}/.npmrc`,t.npmrc,"TS_CLOUD_NPMRC_EOF"));return r}function Ui(e){let t=e.healthCheck?.path;if(!t||!e.domain)return[];let n=`http://127.0.0.1${t.startsWith("/")?t:`/${t}`}`;return[`echo "[ts-cloud] health check ${n} (Host: ${e.domain})"`,"TS_CLOUD_HC_OK=0",`for i in $(seq 1 10); do TS_CLOUD_HC=$(curl -s -o /dev/null -w "%{http_code}" -H "Host: ${e.domain}" -m 10 "${n}" 2>/dev/null || echo 000); case "$TS_CLOUD_HC" in 2*|3*) TS_CLOUD_HC_OK=1; break ;; esac; sleep 3; done`,'[ "$TS_CLOUD_HC_OK" = 1 ] && echo "health check passed ($TS_CLOUD_HC)" || { echo "health check FAILED (last=$TS_CLOUD_HC)" >&2; exit 1; }']}function Hi(e){let{siteName:t,site:r,releaseId:n,commit:s}=e;if(!r.repository?.url)throw Error(`Site '${t}' is a PHP/git site but has no repository.url to clone`);let i=e.appBase??`/var/www/${t}`,o="php",c=Pt(i,n),l=r.sharedPaths??Qt,m=[...l,...tr(r.env,l)],S=r.keepReleases??Tt,y=r.deployScript?.length?r.deployScript:Al(r.type??"laravel"),v=["set -euo pipefail",'export HOME="${HOME:-/root}"','export COMPOSER_HOME="${COMPOSER_HOME:-/root/.composer}"',"export COMPOSER_ALLOW_SUPERUSER=1",Pe()];if(v.push(...er(i,{releaseId:n,commit:s,branch:r.repository.branch,keepLogs:S})),v.push(...Ct(c,m)),r.env&&Object.keys(r.env).length>0)v.push(...kl(`${c.shared}/.env`,r.env));for(let h of y){let w=h.trim();if(w===rr)v.push(...Ii({repository:r.repository,releaseDir:c.release,commit:s})),v.push(...Zt(c,m)),v.push(`cd ${c.release}`),v.push(...Nl(c.release,r.credentials)),v.push(`chown -R www-data:www-data ${c.shared}/storage 2>/dev/null || true`,`[ -d ${c.release}/bootstrap/cache ] && chown -R www-data:www-data ${c.release}/bootstrap/cache 2>/dev/null || true`,`chmod -R ug+rwX ${c.shared}/storage 2>/dev/null || true`);else if(w===nr)v.push(...dt(c)),v.push(...mt(c,S)),v.push(`(cd ${b} && pantry restart php-fpm) 2>/dev/null || true`);else if(w===Ni)v.push(`${o} artisan queue:restart || true`);else v.push(Ll(h,o))}return v}var sr={mysql:{port:3306,binaries:["mysqld","mysql"]},mariadb:{port:3306,binaries:["mariadbd","mariadb","mysqld"]},postgres:{port:5432,binaries:["postgres","psql"]},redis:{port:6379,binaries:["redis-server","redis-cli"]},memcached:{port:11211,binaries:["memcached"]},meilisearch:{port:7700,binaries:["meilisearch"]},vitess:{port:15306,binaries:["vtgate"]}},xt="ts-cloud-service:";function Ul(e){return e===!0||typeof e==="object"&&e!=null}function Mi(e){if(!e)return[];return Object.keys(sr).filter((t)=>Ul(e[t]))}function Fi(e){if(e.length===0)return[];return[Pe(),"ts_cloud_port_open() {",'  if command -v ss >/dev/null 2>&1; then ss -ltn 2>/dev/null | grep -qE "[:.]$1[[:space:]]" && return 0; fi','  if command -v netstat >/dev/null 2>&1; then netstat -ltn 2>/dev/null | grep -qE "[:.]$1[[:space:]]" && return 0; fi',"  (exec 3<>/dev/tcp/127.0.0.1/$1) 2>/dev/null && { exec 3<&- 3>&-; return 0; }","  return 1","}","ts_cloud_probe() {",'  TS_CLOUD_SVC="$1"; TS_CLOUD_PORT="$2"; shift 2','  for TS_CLOUD_BIN in "$@"; do',`    if command -v "$TS_CLOUD_BIN" >/dev/null 2>&1; then echo "${xt}$TS_CLOUD_SVC:present"; return 0; fi`,"  done",`  if ts_cloud_port_open "$TS_CLOUD_PORT"; then echo "${xt}$TS_CLOUD_SVC:present"; return 0; fi`,`  echo "${xt}$TS_CLOUD_SVC:missing"`,"  return 0","}",...e.filter((t)=>sr[t]).map((t)=>`ts_cloud_probe ${t} ${sr[t].port} ${sr[t].binaries.join(" ")}`),"exit 0"]}function zi(e,t){if(!e)return[];let r=new Map;for(let n of e.split(`
+`)){let s=n.indexOf(xt);if(s===-1)continue;let[i,o]=n.slice(s+xt.length).trim().split(":");if(i)r.set(i,o)}return t.filter((n)=>r.get(n)==="missing")}function Bi(e,t,r){let n=r?` on ${r}`:"",s=e.map((o)=>`managedServices.${o}`).join(", "),i=e.length===1?`no ${e[0]}`:`none of ${e.join(", ")}`;return`This project declares ${s}, but '${t}' has ${i}${n}. Attach mode does not provision services on the owner's box, so nothing will install ${e.length===1?"it":"them"}. Point the app at an external service, or ask the owner of '${t}' to add ${e.length===1?"it":"them"} to their own config and re-provision.`}var Ki="/var/lib/pantry/php-fpm/pool.d",Hl=9100,Ml=400;function ir(e){return(e.toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/^_+|_+$/g,"")||"site").slice(0,28)}function ji(e){return`web_${ir(e)}`}function Fl(e){let t=ir(e),r=0;for(let n=0;n<t.length;n++)r=r*31+t.charCodeAt(n)>>>0;return Hl+r%Ml}function hn(e){return`127.0.0.1:${Fl(e)}`}function zl(e){let t=ir(e.siteName),r=ji(e.siteName),n=e.maxChildren??10;return[`; ts-cloud-managed pool for ${e.siteName} (site isolation)`,`[${t}]`,`user = ${r}`,`group = ${r}`,`listen = ${hn(e.siteName)}`,"pm = dynamic",`pm.max_children = ${n}`,"pm.start_servers = 2","pm.min_spare_servers = 1","pm.max_spare_servers = 3","pm.max_requests = 500","catch_workers_output = yes",`php_admin_value[open_basedir] = ${e.appBase}:/tmp`,""].join(`
+`)}function Gi(e){let t=ji(e.siteName),r=ir(e.siteName),n=`${Ki}/${r}.conf`;return[`getent group ${t} >/dev/null || groupadd --system ${t}`,`id -u ${t} >/dev/null 2>&1 || useradd --system --no-create-home --shell /usr/sbin/nologin -g ${t} ${t}`,`usermod -aG ${t} www-data 2>/dev/null || true`,`chown -R ${t}:${t} ${e.appBase} || true`,`chmod -R g+rX ${e.appBase} || true`,`chmod 600 ${e.appBase}/shared/.env 2>/dev/null || true`,`mkdir -p ${Ki}`,`cat > ${n} <<'TS_CLOUD_FPMPOOL_EOF'`,zl(e).replace(/\n$/,""),"TS_CLOUD_FPMPOOL_EOF",`(cd ${b} && pantry restart php-fpm) 2>/dev/null || true`]}var vr={info:()=>{},warn:()=>{},error:()=>{},step:()=>{},success:()=>{}};function Gl(e){return`'${e.replace(/'/g,`'"'"'`)}'`}async function bs(e,t,r=vr){let{config:n,environment:s,siteName:i,site:o,slug:c,sha:l,runtime:m,localTarballPath:S}=t,y=`releases/${i}/${l}.tar.gz`,v=g(n,s),h=await e.getComputeOutputs({config:n,environment:s}),w=await e.findComputeTargets({slug:c,environment:s,role:"app",stackName:v});if(w.length===0)return{success:!1,error:e.name==="aws"?`Stack '${v}' has no EC2 instances tagged Project=${c} Environment=${s} Role=app, and storage/cloud/state/${v}.json pins no live instance. For a shared box, record its instanceId there.`:`No Hetzner servers labeled ts-cloud/project=${c} ts-cloud/environment=${s} ts-cloud/role=app, and storage/cloud/state/${v}.json pins no live server. For a shared box, record its serverId there.`};let E=h.servicesPrivateIp?zs(h.servicesPrivateIp,p(n)):ss(p(n)),R=cd(hi(n,{environment:s})),x=n.infrastructure?.compute,C=se(x)?{HOST:"127.0.0.1"}:{},T=s==="production"?{APP_ENV:"production",NODE_ENV:"production"}:{},P={...E,...R,...C,...o.env||{},...T},A=tn(P,o.sharedPaths??[]);if(A.warning)r.warn(`Site '${i}': ${A.warning}`);else if(A.path)r.info(`Site '${i}': sharing '${A.path}' so the SQLite database survives deploys.`);if(Ir(o)){let he=o.phpVersion??x?.php?.default??x?.php?.versions?.[0],L=B(c,i),W=Object.keys(E).length>0?{...o,env:P}:o,I=Hi({siteName:i,site:W,releaseId:l,appBase:L,defaultPhpVersion:he}),M=!se(x),pe=fn(o)==="custom"&&o.ssl?.certPath&&o.ssl?.keyPath?{certPath:o.ssl.certPath,keyPath:o.ssl.keyPath}:void 0,ke=o.isolation?Gi({siteName:i,appBase:L}):[],ft=M?Nr({siteName:i,domain:o.domain||i,aliases:o.aliases,type:o.type,appDir:`${L}/current`,webDirectory:o.webDirectory,phpVersion:he,fastcgiPass:o.isolation?hn(i):void 0,redirects:o.redirects,ssl:pe,auth:o.auth&&o.auth.enabled!==!1&&o.auth.password?{username:o.auth.username||"admin",password:o.auth.password,realm:o.auth.realm}:void 0,serverSnippet:kr(o.nginx,x?.nginxTemplates),clientMaxBodySize:o.nginx?.clientMaxBodySize,hsts:o.ssl?.hsts,tlsProtocols:o.ssl?.tlsProtocols,security:o.security}):[],yr=M?gn(o):[],gt=mn(o)?dn({slug:c,siteName:i,site:o,phpVersion:he,appBase:L}):[],qi=M?Ui(o):[];r.step(`Deploying PHP site '${i}' to ${w.length} target(s)...`);let Me=await e.runRemoteDeploy({targets:w,commands:[...en(L,c),...I,...ke,...ft,...yr,...gt,...qi],comment:`ts-cloud deploy ${c}/${i}@${l}`,tags:{Project:c,Environment:s,Role:"app"}}),An=ls(n.notifications,o.notifications);if(!Me.success)return await Hr(An,"deploy-failed",`❌ Deploy of ${c}/${i}@${l} failed: ${Me.error||"unknown error"}`),{success:!1,error:Me.error||"Remote PHP deploy failed",instanceCount:Me.instanceCount,perInstance:Me.perInstance};let Wi=o.domain?` → https://${o.domain}`:"";return await Hr(An,"deploy",`✅ Deployed ${c}/${i}@${l}${Wi}`),{success:!0,instanceCount:Me.instanceCount,perInstance:Me.perInstance}}if(!S)return{success:!1,error:`Site '${i}' requires a release tarball but none was provided`};let D=await e.uploadRelease({config:n,environment:s,localPath:S,remoteKey:y,targets:w}),O=Vn(c,i,l),U=e.name==="aws"?cc(h.deployBucketName,y,n.project.region||"us-east-1",O):dc(D.artifactRef,O),oe=u(o),F=B(c,i),Y=oe==="server-static"?qn({siteName:i,slug:c,appDir:F,artifactFetch:U,releaseId:l,preStartCommands:o.preStart}):Gn({siteName:i,slug:c,appDir:F,artifactFetch:U,releaseId:l,execStart:Hn(o.start,m,`${F.replace(/\/+$/,"")}/releases/%i`),envEntries:P,port:o.port,preStartCommands:o.preStart,sharedPaths:o.sharedPaths,zeroDowntime:o.zeroDowntime!==!1,healthCheckPath:o.healthCheck?.path,memoryHigh:o.memoryHigh,memoryMax:o.memoryMax,cpuWeight:o.cpuWeight,ioWeight:o.ioWeight,tasksMax:o.tasksMax,stopTimeout:o.stopTimeout}),J=oe==="server-static"&&!se(x)&&!!o.domain,j=J?Nr({siteName:i,domain:o.domain,aliases:o.aliases,type:o.type==="spa"?"spa":"static",appDir:`${F}/current`,webDirectory:"",redirects:o.redirects,auth:o.auth&&o.auth.enabled!==!1&&o.auth.password?{username:o.auth.username||"admin",password:o.auth.password,realm:o.auth.realm}:void 0,serverSnippet:kr(o.nginx,x?.nginxTemplates),clientMaxBodySize:o.nginx?.clientMaxBodySize,hsts:o.ssl?.hsts,tlsProtocols:o.ssl?.tlsProtocols,security:o.security}):[],te=J?gn(o):[],H=mn(o)?dn({slug:c,siteName:i,site:o,appBase:F}):[],Te=[...er(F,{releaseId:l,commit:l,branch:o.repository?.branch??"main"}),...en(F,c),...Y,...j,...te,...H,...jn()];r.step(`Deploying to ${w.length} target(s)...`);let Q=await e.runRemoteDeploy({targets:w,commands:Te,comment:`ts-cloud deploy ${c}/${i}@${l}`,tags:{Project:c,Environment:s,Role:"app"}});if(!Q.success)return{success:!1,error:Q.error||"Remote deploy failed",instanceCount:Q.instanceCount,perInstance:Q.perInstance};return{success:!0,instanceCount:Q.instanceCount,perInstance:Q.perInstance}}function or(e){return`'${e.replaceAll("'","'\\''")}'`}function Vl(e,t,r=!1,n=[]){let s=`${e}-dashboard-`,i=t.map((c)=>`${e}-${c}.service`),o=r?[`export TS_CLOUD_DASHBOARD_KEEP_DOMAINS=${or(JSON.stringify(n))}`,"rm -f /run/ts-cloud-dashboard-routes-changed",`/usr/local/bin/bun --bun -e ${or(`
           const { chmodSync, existsSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync } = require('node:fs')
           const { basename, join } = require('node:path')
           const root = '/etc/rpx/sites.d'
@@ -582,4 +582,4 @@ This password is now in your deploy log. Set TS_CLOUD_UI_PASSWORD to a value of
             changed = true
           }
           if (changed) writeFileSync('/run/ts-cloud-dashboard-routes-changed', '')
-        `)}`,"if [ -e /run/ts-cloud-dashboard-routes-changed ]; then","  systemctl restart rpx-gateway.service","  rm -f /run/ts-cloud-dashboard-routes-changed","fi"]:[];return["set -euo pipefail",`TS_CLOUD_DASHBOARD_PREFIX=${or(s)}`,`TS_CLOUD_DASHBOARD_SERVER_OWNER=${r?"1":"0"}`,`TS_CLOUD_DASHBOARD_DESIRED=${or(` ${i.join(" ")} `)}`,"for TS_CLOUD_UNIT_FILE in /etc/systemd/system/*.service; do",'  [ -e "$TS_CLOUD_UNIT_FILE" ] || continue','  TS_CLOUD_UNIT=$(basename "$TS_CLOUD_UNIT_FILE")','  case "$TS_CLOUD_UNIT" in',"    *-dashboard-*.service)",'      if [ "$TS_CLOUD_DASHBOARD_SERVER_OWNER" != 1 ]; then','        case "$TS_CLOUD_UNIT" in "$TS_CLOUD_DASHBOARD_PREFIX"*.service) ;; *) continue ;; esac',"      fi",'      case "$TS_CLOUD_DASHBOARD_DESIRED" in','        *" $TS_CLOUD_UNIT "*) ;;',"        *)",'          systemctl disable --now "$TS_CLOUD_UNIT" 2>/dev/null || true','          rm -f "$TS_CLOUD_UNIT_FILE"',"          ;;","      esac","      ;;","  esac","done","systemctl daemon-reload","systemctl reset-failed",...o]}async function Vl(e,t,r,n){let{config:s,environment:i}=t,o=s.project.slug,c=g(s,i),l=await e.findComputeTargets({slug:o,environment:i,role:"app",stackName:c});if(l.length===0)return!0;let m=await e.runRemoteDeploy({targets:l,commands:Gl(o,r,!s.cloud?.attachTo,r.map((S)=>s.sites?.[S]?.domain).filter((S)=>typeof S==="string")),comment:`ts-cloud reconcile management dashboard ${o}`,tags:{Project:o,Environment:i,Role:"app"}});if(!m.success)return n.error(`Management dashboard reconciliation failed: ${m.error||"unknown error"}`),!1;return!0}async function ql(e,t,r){let{config:n}=t,s=n.cloud?.attachTo;if(!s||!e.listReachableResources)return;let i;try{i=await e.listReachableResources()}catch(l){r.warn(`Could not determine this credential's reach: ${l instanceof Error?l.message:String(l)}`);return}let o=di(i,{ownerSlug:s,selfSlug:n.project.slug}),c=nn(o)>0;for(let l of fi(o,{ownerSlug:s,selfSlug:n.project.slug}))if(c)r.warn(l);else r.info(l)}async function Wl(e,t,r){let{config:n,environment:s}=t,i=n.cloud?.attachTo;if(!i)return!0;let o=Mi(n.infrastructure?.compute?.managedServices);if(o.length===0)return!0;let c=n.project.slug,l=g(n,s),m=await e.findComputeTargets({slug:c,environment:s,role:"app",stackName:l});if(m.length===0)return!0;let S=await e.runRemoteDeploy({targets:m,commands:Fi(o),comment:`ts-cloud preflight managed services ${c}`,tags:{Project:c,Environment:s,Role:"app"}});if(!S.success)return r.warn(`Could not check '${i}' for the declared services: ${S.error||"unknown error"}`),!0;let y=new Set;for(let v of S.perInstance)for(let h of zi(v.output,o))y.add(h);if(y.size===0)return!0;return r.error(Bi([...y],i,m[0]?.publicIp)),!1}async function Xl(e,t,r){let{config:n,environment:s}=t;if(!n.cloud?.attachTo)return!0;let i=n.infrastructure?.compute,o=p(n),c=Ye(o,i?.managedServices??{});if(c.length===0)return!0;let l=n.project.slug,m=g(n,s),S=await e.findComputeTargets({slug:l,environment:s,role:"app",stackName:m});if(S.length===0)return!0;r.step(`Ensuring database '${o?.name}' + role exist on the shared box...`);let y=await e.runRemoteDeploy({targets:S,commands:c,comment:`ts-cloud ensure database ${l}/${o?.name}`,tags:{Project:l,Environment:s,Role:"app"}});if(!y.success)return r.error(`Ensuring database '${o?.name}' failed: ${y.error||"unknown error"}`),!1;return r.success(`Database '${o?.name}' is ready on ${y.instanceCount} target(s)`),!0}async function pc(e){let{config:t,environment:r,driver:n,sha:s,runtime:i,tarballForSite:o,logger:c=vr}=e,l=t.project.slug,m=e.cwd??process.cwd(),S=e.managementDashboard!==!1,y=Ht(t);if(S)zn(t,{cwd:m,logger:{info:c.info,warn:c.warn}});let v=!S||y?[]:ln(t);if(S&&e.rpxConfig&&e.rpxConfig!==t&&!Ht(e.rpxConfig))zn(e.rpxConfig,{cwd:m,logger:{info:()=>{},warn:()=>{}}});if(S&&!await Vl(n,e,ln(t),c))return!1;let h=null,w=new Map;if(v.length>0)if(h=Cs(t.sites?.[v[0]],{cwd:m,slug:l,sha:s,siteName:v[0],logger:{info:c.info,warn:c.warn}}),!h){c.warn("Management dashboard: no artifact available — skipping dashboard site(s) for this deploy.");for(let T of v)if(t.sites)delete t.sites[T]}else for(let T of v){if(T===v[0]){w.set(T,h);continue}try{let P=Kl(Bl(),`${l}-${T}-${s}.tar.gz`);zl(h,P),w.set(T,P)}catch{w.set(T,h)}}let E=t.sites||{},R=Object.entries(E).filter(([T,P])=>{if(!P)return!1;let A=u(P);if(A==="bucket")return c.warn(`Site '${T}' targets a bucket — skipping (handled by the static-site path, not compute).`),!1;if(A==="redirect")return!1;if(A==="proxy")return!1;return!0});if(R.length===0)return Kn(e);if(await ql(n,e,c),!await Wl(n,e,c))return!1;if(!await Xl(n,e,c))return!1;let x=(T)=>w.get(T)??o(T);for(let[T,P]of R){c.step(`Deploying site: ${T}`);let A=Ir(P)?void 0:x(T),D=await bs(n,{config:t,environment:r,siteName:T,site:P,slug:l,sha:s,runtime:i,localTarballPath:A},c);if(!D.success){if(c.error(`Deploy of '${T}' failed: ${D.error||"unknown error"}`),D.perInstance)for(let O of D.perInstance)c.error(`  ${O.instanceId}: ${O.status}${O.error?` — ${O.error}`:""}`);return!1}if(c.success(`Deployed ${l}/${T}@${s} to ${D.instanceCount} target(s)`),D.perInstance)for(let O of D.perInstance)c.info(`  ✓ ${O.instanceId}: ${O.status}`)}if(!await Kn(e))return!1;return!0}async function Yl(e,t,r){let n=ms(e);if(!n||n.tls==="off")return n;let s=await $e(t,r),i=s?.provider==="ssh"?s.lanIp:void 0;return i?{...n,ip:i}:n}async function Kn(e){let{config:t,environment:r,driver:n,logger:s=vr}=e,i=e.rpxConfig??t,o=i.infrastructure?.compute?.proxy??t.infrastructure?.compute?.proxy;if(o?.engine!=="rpx")return!0;let c=i.sites||{},l=t.project.slug,m=g(t,r),S=await n.findComputeTargets({slug:l,environment:r,role:"lb",stackName:m});if(S.length>0){let C=(await n.findComputeTargets({slug:l,environment:r,role:"app",stackName:m})).map((A)=>({privateIp:A.privateIp,publicIp:A.publicIp})),T=lr(c,C,{proxy:o,slug:l});if(T.proxies.length===0)return s.warn("rpx gateway: no server sites with a domain to route — skipping gateway reload."),!0;s.step(`Reloading the load balancer's rpx gateway with ${T.proxies.length} route(s)...`);let P=await n.runRemoteDeploy({targets:S,commands:_e({config:T,slug:l,preserveManagementDashboardRoutes:e.managementDashboard===!1}),comment:`ts-cloud rpx gateway reload ${l}`,tags:{Project:l,Environment:r,Role:"lb"}});if(!P.success)return s.error(`rpx gateway reload failed: ${P.error||"unknown error"}`),!1;return s.success(`rpx gateway reloaded on ${P.instanceCount} load balancer(s)`),!0}let y=await Yl(t,m,e.cwd),v=z(c,{proxy:o,slug:l,lan:y});if(v.proxies.length===0)return s.warn("rpx gateway: no server sites with a domain to route — skipping gateway reload."),!0;let h=await n.findComputeTargets({slug:l,environment:r,role:"app",stackName:m});if(h.length===0)return s.warn("rpx gateway: no compute targets found — skipping gateway reload."),!0;let w=Boolean(t.cloud?.attachTo);if(w&&(o.version||o.tlsxVersion))s.warn(`rpx gateway: ignoring proxy.version/tlsxVersion — this project attaches to '${t.cloud?.attachTo}' and the gateway belongs to that box's owner.`);s.step(`Reloading rpx gateway with ${v.proxies.length} route(s)...`);let E=ye({proxy:o,config:v,slug:l,tenant:w,profile:gs(t),preserveManagementDashboardRoutes:e.managementDashboard===!1}),R=await n.runRemoteDeploy({targets:h,commands:E,comment:`ts-cloud rpx gateway reload ${l}`,tags:{Project:l,Environment:r,Role:"app"}});if(!R.success)return s.error(`rpx gateway reload failed: ${R.error||"unknown error"}`),!1;return s.success(`rpx gateway reloaded on ${R.instanceCount} target(s)`),!0}async function gc(e){let{config:t,environment:r,driver:n,logger:s=vr}=e,i=e.rpxConfig??t,o=i.infrastructure?.compute?.proxy??t.infrastructure?.compute?.proxy;if(o?.engine!=="rpx"||!o.onDemandTls)return!0;let c=z(i.sites||{},{proxy:o,slug:t.project.slug});if(c.proxies.length===0)return!0;let l=Br(c);if(l.length===0)return!0;let m=t.project.slug,S=g(t,r),y="lb",v=await n.findComputeTargets({slug:m,environment:r,role:y,stackName:S});if(v.length===0)y="app",v=await n.findComputeTargets({slug:m,environment:r,role:y,stackName:S});if(v.length===0)return s.warn("rpx TLS: no gateway targets found - skipping certificate issuance."),!0;s.step("Issuing rpx TLS certificates after DNS reconciliation...");let h=l.map((E)=>`test -s ${jl(`${c.productionCerts.certsDir}/${E}.crt`)}`).join(" && "),w=await n.runRemoteDeploy({targets:v,commands:[`systemctl start ${zr(m)}`,h],comment:`ts-cloud rpx TLS issuance ${m}`,tags:{Project:m,Environment:r,Role:y}});if(!w.success)return s.error(`rpx TLS issuance failed: ${w.error||"unknown error"}`),!1;return s.success(`rpx TLS certificates reconciled on ${w.instanceCount} gateway target(s)`),!0}var nh="658327ea-f89d-4fab-a63d-7e88639e58f6",ih="4135ea2d-6df8-44a3-9df3-4b5a84be39ad",sh="216adef6-5c7f-47e4-b989-5492eafa07d3";function Vi(e,t){let r={TargetOriginId:"origin",ViewerProtocolPolicy:"redirect-to-https",Compress:!0,CachePolicyId:t==="dynamic"?"4135ea2d-6df8-44a3-9df3-4b5a84be39ad":"658327ea-f89d-4fab-a63d-7e88639e58f6",OriginRequestPolicyId:"216adef6-5c7f-47e4-b989-5492eafa07d3",SmoothStreaming:!1,FieldLevelEncryptionId:"",TrustedSigners:{Enabled:!1,Quantity:0},TrustedKeyGroups:{Enabled:!1,Quantity:0},LambdaFunctionAssociations:{Quantity:0},FunctionAssociations:{Quantity:0},AllowedMethods:t==="dynamic"?{Quantity:7,Items:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:{Quantity:2,Items:["GET","HEAD"]}}:{Quantity:3,Items:["GET","HEAD","OPTIONS"],CachedMethods:{Quantity:2,Items:["GET","HEAD"]}}};if(e!==null)r.PathPattern=e;return r}function oh(e){let t=e.aliases;if(t.length===0)throw Error("buildCloudFrontOriginConfig: at least one alias is required");if(t.includes(e.originDomain))throw Error(`buildCloudFrontOriginConfig: originDomain ${e.originDomain} must not be one of the aliases (it would loop)`);if(e.originShield&&!e.originShieldRegion)throw Error("buildCloudFrontOriginConfig: originShieldRegion is required when originShield is enabled");let r=e.originSecretHeader??"X-Origin-Verify",n=e.originSecret?{Quantity:1,Items:[{HeaderName:r,HeaderValue:e.originSecret}]}:{Quantity:0},s=[...e.behaviors??[]].sort((i,o)=>o.pathPattern.length-i.pathPattern.length);return{CallerReference:e.callerReference??e.originDomain,Comment:e.comment??`Origin-fronted distribution for ${t[0]} → ${e.originDomain}`,Enabled:!0,Aliases:{Quantity:t.length,Items:t},DefaultRootObject:"",Origins:{Quantity:1,Items:[{Id:"origin",DomainName:e.originDomain,OriginPath:"",CustomHeaders:n,CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:"https-only",OriginSslProtocols:{Quantity:1,Items:["TLSv1.2"]},OriginReadTimeout:30,OriginKeepaliveTimeout:5},ConnectionAttempts:3,ConnectionTimeout:10,OriginShield:e.originShield?{Enabled:!0,OriginShieldRegion:e.originShieldRegion}:{Enabled:!1},OriginAccessControlId:""}]},OriginGroups:{Quantity:0},DefaultCacheBehavior:Vi(null,"static"),CacheBehaviors:{Quantity:s.length,Items:s.map((i)=>Vi(i.pathPattern,i.kind))},ViewerCertificate:{CloudFrontDefaultCertificate:!1,ACMCertificateArn:e.viewerCertificateArn,Certificate:e.viewerCertificateArn,CertificateSource:"acm",SSLSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"},PriceClass:e.priceClass??"PriceClass_All",HttpVersion:"http2and3",IsIPV6Enabled:!0,Restrictions:{GeoRestriction:{RestrictionType:"none",Quantity:0}},Logging:{Enabled:!1,IncludeCookies:!1,Bucket:"",Prefix:""},WebACLId:"",CustomErrorResponses:{Quantity:0}}}export{ru,Fa,Ae,Ua,yn,nu,Qa,In,wt,ar,Rt,iu,su,Vm,b,cr,hs,Sn,Dt,dr,ou,fs,Cn,bn,En,au,Ha,z,lr,jm,vn,Ga,xe,ye,_e,N,ur,Tn,pr,ae,qa,wn,Va,Rn,ja,za,gr,Ka,Oe,K,Wa,rt,Le,$e,nt,Ie,As,Ja,cu,du,Xa,lu,it,Dn,Ya,uu,pu,Za,mr,Se,ec,gu,mu,ys,Pn,st,hu,fu,Au,yu,Iu,Su,Cu,bu,Eu,Nn,kn,Bn,xn,_n,On,Ln,vu,Tu,hr,k,Is,wu,Ru,Du,tc,Pu,Nu,zm,rc,Km,Wm,ku,Bu,Jm,Xm,Ym,nc,xu,Zm,eh,th,$n,Mn,Un,Qn,ic,sc,oc,ac,rh,Pt,_u,Hn,Gn,qn,Vn,cc,dc,jn,lc,Ss,uc,Nt,zn,Cs,fr,bs,pc,Kn,gc,nh,ih,sh,oh};
+        `)}`,"if [ -e /run/ts-cloud-dashboard-routes-changed ]; then","  systemctl restart rpx-gateway.service","  rm -f /run/ts-cloud-dashboard-routes-changed","fi"]:[];return["set -euo pipefail",`TS_CLOUD_DASHBOARD_PREFIX=${or(s)}`,`TS_CLOUD_DASHBOARD_SERVER_OWNER=${r?"1":"0"}`,`TS_CLOUD_DASHBOARD_DESIRED=${or(` ${i.join(" ")} `)}`,"for TS_CLOUD_UNIT_FILE in /etc/systemd/system/*.service; do",'  [ -e "$TS_CLOUD_UNIT_FILE" ] || continue','  TS_CLOUD_UNIT=$(basename "$TS_CLOUD_UNIT_FILE")','  case "$TS_CLOUD_UNIT" in',"    *-dashboard-*.service)",'      if [ "$TS_CLOUD_DASHBOARD_SERVER_OWNER" != 1 ]; then','        case "$TS_CLOUD_UNIT" in "$TS_CLOUD_DASHBOARD_PREFIX"*.service) ;; *) continue ;; esac',"      fi",'      case "$TS_CLOUD_DASHBOARD_DESIRED" in','        *" $TS_CLOUD_UNIT "*) ;;',"        *)",'          systemctl disable --now "$TS_CLOUD_UNIT" 2>/dev/null || true','          rm -f "$TS_CLOUD_UNIT_FILE"',"          ;;","      esac","      ;;","  esac","done","systemctl daemon-reload","systemctl reset-failed",...o]}async function ql(e,t,r,n){let{config:s,environment:i}=t,o=s.project.slug,c=g(s,i),l=await e.findComputeTargets({slug:o,environment:i,role:"app",stackName:c});if(l.length===0)return!0;let m=await e.runRemoteDeploy({targets:l,commands:Vl(o,r,!s.cloud?.attachTo,r.map((S)=>s.sites?.[S]?.domain).filter((S)=>typeof S==="string")),comment:`ts-cloud reconcile management dashboard ${o}`,tags:{Project:o,Environment:i,Role:"app"}});if(!m.success)return n.error(`Management dashboard reconciliation failed: ${m.error||"unknown error"}`),!1;return!0}async function Wl(e,t,r){let{config:n}=t,s=n.cloud?.attachTo;if(!s||!e.listReachableResources)return;let i;try{i=await e.listReachableResources()}catch(l){r.warn(`Could not determine this credential's reach: ${l instanceof Error?l.message:String(l)}`);return}let o=di(i,{ownerSlug:s,selfSlug:n.project.slug}),c=nn(o)>0;for(let l of fi(o,{ownerSlug:s,selfSlug:n.project.slug}))if(c)r.warn(l);else r.info(l)}async function Xl(e,t,r){let{config:n,environment:s}=t,i=n.cloud?.attachTo;if(!i)return!0;let o=Mi(n.infrastructure?.compute?.managedServices);if(o.length===0)return!0;let c=n.project.slug,l=g(n,s),m=await e.findComputeTargets({slug:c,environment:s,role:"app",stackName:l});if(m.length===0)return!0;let S=await e.runRemoteDeploy({targets:m,commands:Fi(o),comment:`ts-cloud preflight managed services ${c}`,tags:{Project:c,Environment:s,Role:"app"}});if(!S.success)return r.warn(`Could not check '${i}' for the declared services: ${S.error||"unknown error"}`),!0;let y=new Set;for(let v of S.perInstance)for(let h of zi(v.output,o))y.add(h);if(y.size===0)return!0;return r.error(Bi([...y],i,m[0]?.publicIp)),!1}async function Yl(e,t,r){let{config:n,environment:s}=t;if(!n.cloud?.attachTo)return!0;let i=n.infrastructure?.compute,o=p(n),c=Ye(o,i?.managedServices??{});if(c.length===0)return!0;let l=n.project.slug,m=g(n,s),S=await e.findComputeTargets({slug:l,environment:s,role:"app",stackName:m});if(S.length===0)return!0;r.step(`Ensuring database '${o?.name}' + role exist on the shared box...`);let y=await e.runRemoteDeploy({targets:S,commands:c,comment:`ts-cloud ensure database ${l}/${o?.name}`,tags:{Project:l,Environment:s,Role:"app"}});if(!y.success)return r.error(`Ensuring database '${o?.name}' failed: ${y.error||"unknown error"}`),!1;return r.success(`Database '${o?.name}' is ready on ${y.instanceCount} target(s)`),!0}async function pc(e){let{config:t,environment:r,driver:n,sha:s,runtime:i,tarballForSite:o,logger:c=vr}=e,l=t.project.slug,m=e.cwd??process.cwd(),S=e.managementDashboard!==!1,y=Ht(t);if(S)zn(t,{cwd:m,logger:{info:c.info,warn:c.warn}});let v=!S||y?[]:ln(t);if(S&&e.rpxConfig&&e.rpxConfig!==t&&!Ht(e.rpxConfig))zn(e.rpxConfig,{cwd:m,logger:{info:()=>{},warn:()=>{}}});if(S&&!await ql(n,e,ln(t),c))return!1;let h=null,w=new Map;if(v.length>0)if(h=Cs(t.sites?.[v[0]],{cwd:m,slug:l,sha:s,siteName:v[0],logger:{info:c.info,warn:c.warn}}),!h){c.warn("Management dashboard: no artifact available — skipping dashboard site(s) for this deploy.");for(let T of v)if(t.sites)delete t.sites[T]}else for(let T of v){if(T===v[0]){w.set(T,h);continue}try{let P=jl(Kl(),`${l}-${T}-${s}.tar.gz`);Bl(h,P),w.set(T,P)}catch{w.set(T,h)}}let E=t.sites||{},R=Object.entries(E).filter(([T,P])=>{if(!P)return!1;let A=u(P);if(A==="bucket")return c.warn(`Site '${T}' targets a bucket — skipping (handled by the static-site path, not compute).`),!1;if(A==="redirect")return!1;if(A==="proxy")return!1;return!0});if(R.length===0)return Kn(e);if(await Wl(n,e,c),!await Xl(n,e,c))return!1;if(!await Yl(n,e,c))return!1;let x=(T)=>w.get(T)??o(T);for(let[T,P]of R){c.step(`Deploying site: ${T}`);let A=Ir(P)?void 0:x(T),D=await bs(n,{config:t,environment:r,siteName:T,site:P,slug:l,sha:s,runtime:i,localTarballPath:A},c);if(!D.success){if(c.error(`Deploy of '${T}' failed: ${D.error||"unknown error"}`),D.perInstance)for(let O of D.perInstance)c.error(`  ${O.instanceId}: ${O.status}${O.error?` — ${O.error}`:""}`);return!1}if(c.success(`Deployed ${l}/${T}@${s} to ${D.instanceCount} target(s)`),D.perInstance)for(let O of D.perInstance)c.info(`  ✓ ${O.instanceId}: ${O.status}`)}if(!await Kn(e))return!1;return!0}async function Jl(e,t,r){let n=ms(e);if(!n||n.tls==="off")return n;let s=await $e(t,r),i=s?.provider==="ssh"?s.lanIp:void 0;return i?{...n,ip:i}:n}async function Kn(e){let{config:t,environment:r,driver:n,logger:s=vr}=e,i=e.rpxConfig??t,o=i.infrastructure?.compute?.proxy??t.infrastructure?.compute?.proxy;if(o?.engine!=="rpx")return!0;let c=i.sites||{},l=t.project.slug,m=g(t,r),S=await n.findComputeTargets({slug:l,environment:r,role:"lb",stackName:m});if(S.length>0){let C=(await n.findComputeTargets({slug:l,environment:r,role:"app",stackName:m})).map((A)=>({privateIp:A.privateIp,publicIp:A.publicIp})),T=lr(c,C,{proxy:o,slug:l});if(T.proxies.length===0)return s.warn("rpx gateway: no server sites with a domain to route — skipping gateway reload."),!0;s.step(`Reloading the load balancer's rpx gateway with ${T.proxies.length} route(s)...`);let P=await n.runRemoteDeploy({targets:S,commands:_e({config:T,slug:l,preserveManagementDashboardRoutes:e.managementDashboard===!1}),comment:`ts-cloud rpx gateway reload ${l}`,tags:{Project:l,Environment:r,Role:"lb"}});if(!P.success)return s.error(`rpx gateway reload failed: ${P.error||"unknown error"}`),!1;return s.success(`rpx gateway reloaded on ${P.instanceCount} load balancer(s)`),!0}let y=await Jl(t,m,e.cwd),v=z(c,{proxy:o,slug:l,lan:y});if(v.proxies.length===0)return s.warn("rpx gateway: no server sites with a domain to route — skipping gateway reload."),!0;let h=await n.findComputeTargets({slug:l,environment:r,role:"app",stackName:m});if(h.length===0)return s.warn("rpx gateway: no compute targets found — skipping gateway reload."),!0;let w=Boolean(t.cloud?.attachTo);if(w&&(o.version||o.tlsxVersion))s.warn(`rpx gateway: ignoring proxy.version/tlsxVersion — this project attaches to '${t.cloud?.attachTo}' and the gateway belongs to that box's owner.`);s.step(`Reloading rpx gateway with ${v.proxies.length} route(s)...`);let E=ye({proxy:o,config:v,slug:l,tenant:w,profile:gs(t),preserveManagementDashboardRoutes:e.managementDashboard===!1}),R=await n.runRemoteDeploy({targets:h,commands:E,comment:`ts-cloud rpx gateway reload ${l}`,tags:{Project:l,Environment:r,Role:"app"}});if(!R.success)return s.error(`rpx gateway reload failed: ${R.error||"unknown error"}`),!1;return s.success(`rpx gateway reloaded on ${R.instanceCount} target(s)`),!0}async function gc(e){let{config:t,environment:r,driver:n,logger:s=vr}=e,i=e.rpxConfig??t,o=i.infrastructure?.compute?.proxy??t.infrastructure?.compute?.proxy;if(o?.engine!=="rpx"||!o.onDemandTls)return!0;let c=z(i.sites||{},{proxy:o,slug:t.project.slug});if(c.proxies.length===0)return!0;let l=Br(c);if(l.length===0)return!0;let m=t.project.slug,S=g(t,r),y="lb",v=await n.findComputeTargets({slug:m,environment:r,role:y,stackName:S});if(v.length===0)y="app",v=await n.findComputeTargets({slug:m,environment:r,role:y,stackName:S});if(v.length===0)return s.warn("rpx TLS: no gateway targets found - skipping certificate issuance."),!0;s.step("Issuing rpx TLS certificates after DNS reconciliation...");let h=l.map((E)=>`test -s ${Gl(`${c.productionCerts.certsDir}/${E}.crt`)}`).join(" && "),w=await n.runRemoteDeploy({targets:v,commands:[`systemctl start ${zr(m)}`,h],comment:`ts-cloud rpx TLS issuance ${m}`,tags:{Project:m,Environment:r,Role:y}});if(!w.success)return s.error(`rpx TLS issuance failed: ${w.error||"unknown error"}`),!1;return s.success(`rpx TLS certificates reconciled on ${w.instanceCount} gateway target(s)`),!0}var nh="658327ea-f89d-4fab-a63d-7e88639e58f6",ih="4135ea2d-6df8-44a3-9df3-4b5a84be39ad",sh="216adef6-5c7f-47e4-b989-5492eafa07d3";function Vi(e,t){let r={TargetOriginId:"origin",ViewerProtocolPolicy:"redirect-to-https",Compress:!0,CachePolicyId:t==="dynamic"?"4135ea2d-6df8-44a3-9df3-4b5a84be39ad":"658327ea-f89d-4fab-a63d-7e88639e58f6",OriginRequestPolicyId:"216adef6-5c7f-47e4-b989-5492eafa07d3",SmoothStreaming:!1,FieldLevelEncryptionId:"",TrustedSigners:{Enabled:!1,Quantity:0},TrustedKeyGroups:{Enabled:!1,Quantity:0},LambdaFunctionAssociations:{Quantity:0},FunctionAssociations:{Quantity:0},AllowedMethods:t==="dynamic"?{Quantity:7,Items:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:{Quantity:2,Items:["GET","HEAD"]}}:{Quantity:3,Items:["GET","HEAD","OPTIONS"],CachedMethods:{Quantity:2,Items:["GET","HEAD"]}}};if(e!==null)r.PathPattern=e;return r}function oh(e){let t=e.aliases;if(t.length===0)throw Error("buildCloudFrontOriginConfig: at least one alias is required");if(t.includes(e.originDomain))throw Error(`buildCloudFrontOriginConfig: originDomain ${e.originDomain} must not be one of the aliases (it would loop)`);if(e.originShield&&!e.originShieldRegion)throw Error("buildCloudFrontOriginConfig: originShieldRegion is required when originShield is enabled");let r=e.originSecretHeader??"X-Origin-Verify",n=e.originSecret?{Quantity:1,Items:[{HeaderName:r,HeaderValue:e.originSecret}]}:{Quantity:0},s=[...e.behaviors??[]].sort((i,o)=>o.pathPattern.length-i.pathPattern.length);return{CallerReference:e.callerReference??e.originDomain,Comment:e.comment??`Origin-fronted distribution for ${t[0]} → ${e.originDomain}`,Enabled:!0,Aliases:{Quantity:t.length,Items:t},DefaultRootObject:"",Origins:{Quantity:1,Items:[{Id:"origin",DomainName:e.originDomain,OriginPath:"",CustomHeaders:n,CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:"https-only",OriginSslProtocols:{Quantity:1,Items:["TLSv1.2"]},OriginReadTimeout:30,OriginKeepaliveTimeout:5},ConnectionAttempts:3,ConnectionTimeout:10,OriginShield:e.originShield?{Enabled:!0,OriginShieldRegion:e.originShieldRegion}:{Enabled:!1},OriginAccessControlId:""}]},OriginGroups:{Quantity:0},DefaultCacheBehavior:Vi(null,"static"),CacheBehaviors:{Quantity:s.length,Items:s.map((i)=>Vi(i.pathPattern,i.kind))},ViewerCertificate:{CloudFrontDefaultCertificate:!1,ACMCertificateArn:e.viewerCertificateArn,Certificate:e.viewerCertificateArn,CertificateSource:"acm",SSLSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"},PriceClass:e.priceClass??"PriceClass_All",HttpVersion:"http2and3",IsIPV6Enabled:!0,Restrictions:{GeoRestriction:{RestrictionType:"none",Quantity:0}},Logging:{Enabled:!1,IncludeCookies:!1,Bucket:"",Prefix:""},WebACLId:"",CustomErrorResponses:{Quantity:0}}}export{ru,Fa,Ae,Ua,yn,nu,Qa,In,wt,ar,Rt,iu,su,Vm,b,cr,hs,Sn,Dt,dr,ou,fs,Cn,bn,En,au,Ha,z,lr,jm,vn,Ga,xe,ye,_e,N,ur,Tn,pr,ae,qa,wn,Va,Rn,ja,za,gr,Ka,Oe,K,Wa,rt,Le,$e,nt,Ie,As,Ja,cu,du,Xa,lu,it,Dn,Ya,uu,pu,Za,mr,Se,ec,gu,mu,ys,Pn,st,hu,fu,Au,yu,Iu,Su,Cu,bu,Eu,Nn,kn,Bn,xn,_n,On,Ln,vu,Tu,hr,k,Is,wu,Ru,Du,tc,Pu,Nu,zm,rc,Km,Wm,ku,Bu,Jm,Xm,Ym,nc,xu,Zm,eh,th,$n,Mn,Un,Qn,ic,sc,oc,ac,rh,Pt,_u,Hn,Gn,qn,Vn,cc,dc,jn,lc,Ss,uc,Nt,zn,Cs,fr,bs,pc,Kn,gc,nh,ih,sh,oh};

package/dist/chunk-azcvwr5m.js

@@ -0,0 +1,2 @@
+import{n}from"./chunk-4w8d2mf0.js";import{h}from"./chunk-t054j0zn.js";var tt=new Set(["A","AAAA","CNAME"]);function N(e,t=""){return e===408||e===409||e===425||e===429||e>=500||/rate limit|temporar|timed? ?out|try again/i.test(t)}async function P(e,t){let r=t?.headers.get("retry-after"),s=r===null||r===void 0?void 0:Number(r)*1000,o=Number.isFinite(s)?Math.max(0,s):Math.min(1000*2**(e-1),30000);await new Promise((i)=>setTimeout(i,o))}class ie{name="porkbun";apiKey;secretKey;requestTimeoutMs;constructor(e,t,r=15000){this.apiKey=e,this.secretKey=t,this.requestTimeoutMs=r}async request(e,t={}){let r;for(let s=1;s<=8;s+=1){let o,i=new AbortController,a=setTimeout(()=>{i.abort(Error(`Porkbun API request timed out after ${this.requestTimeoutMs}ms`))},this.requestTimeoutMs);try{o=await fetch(`https://api.porkbun.com/api/json/v3${e}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({apikey:this.apiKey,secretapikey:this.secretKey,...t}),signal:i.signal})}catch(d){if(r=d,s===8)throw d;await P(s);continue}finally{clearTimeout(a)}if(!o.ok){if(r=Error(`Porkbun API error: ${o.status} ${o.statusText}`),!N(o.status)||s===8)throw r;await P(s,o);continue}let c=await o.json();if(c.status==="ERROR"){if(r=Error(`Porkbun API error: ${c.message||"Unknown error"}`),!N(0,c.message)||s===8)throw r;await P(s,o);continue}return c}throw r}getSubdomain(e,t){let r=e.replace(/\.$/,""),s=t.replace(/\.$/,"");if(r===s)return"";if(r.endsWith(`.${s}`))return r.slice(0,-(s.length+1));return r}getRootDomain(e){let t=e.replace(/\.$/,"").split(".");if(t.length>=2)return t.slice(-2).join(".");return e}static ADDRESS_TYPES=new Set(["A","AAAA"]);async clearConflictingAliases(e,t){if(!ie.ADDRESS_TYPES.has(t.type))return[];let r=this.getRootDomain(e),s=this.getSubdomain(t.name,r),o=await this.listRecords(e);if(!o.success)return[`could not list records to clear ALIAS/CNAME conflicts: ${o.message??"unknown provider error"}`];let i=[];for(let a of o.records){if(a.type!=="ALIAS"&&a.type!=="CNAME")continue;if(this.getSubdomain(a.name,r)!==s)continue;let c=await this.deleteRecord(e,a);if(!c.success)i.push(`could not remove conflicting ${a.type} on ${a.name}: ${c.message??"unknown provider error"}`)}return i}async addressRecordExists(e,t){let r=this.getRootDomain(e),s=this.getSubdomain(t.name,r),o=await this.listRecords(e);if(!o.success)return!0;return o.records.some((i)=>i.type===t.type&&this.getSubdomain(i.name,r)===s&&i.content===t.content)}async createRecord(e,t){try{let r=this.getRootDomain(e),s=this.getSubdomain(t.name,r),o={type:t.type,content:t.content,ttl:String(t.ttl||600)};if(s)o.name=s;if((t.type==="MX"||t.type==="SRV")&&t.priority!==void 0)o.prio=String(t.priority);if(t.type==="SRV"&&t.weight!==void 0&&t.port!==void 0)o.content=`${t.weight} ${t.port} ${t.content}`;let i=await this.clearConflictingAliases(e,t),a=await this.request(`/dns/create/${r}`,o);if(ie.ADDRESS_TYPES.has(t.type)&&!await this.addressRecordExists(e,t))return{success:!1,message:`Porkbun reported success but no ${t.type} record for ${t.name} exists${i.length>0?` (${i.join("; ")})`:""}. A conflicting ALIAS/CNAME on the same name silently voids the write.`};return{success:!0,id:a.id?.toString(),message:"Record created successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async upsertRecord(e,t){try{let r=this.getRootDomain(e),s=this.getSubdomain(t.name,r),o=await this.listRecords(e,t.type);if(o.success){let i=o.records.find((a)=>this.getSubdomain(a.name,r)===s&&a.type===t.type);if(i?.id){let a={type:t.type,content:t.content,ttl:String(t.ttl||600)};if(s)a.name=s;if((t.type==="MX"||t.type==="SRV")&&t.priority!==void 0)a.prio=String(t.priority);if(t.type==="SRV"&&t.weight!==void 0&&t.port!==void 0)a.content=`${t.weight} ${t.port} ${t.content}`;return await this.request(`/dns/edit/${r}/${i.id}`,a),{success:!0,id:i.id,message:"Record updated successfully"}}}return this.createRecord(e,t)}catch(r){return this.createRecord(e,t)}}async deleteRecord(e,t){try{let r=this.getRootDomain(e);if("id"in t&&t.id)return await this.request(`/dns/delete/${r}/${t.id}`),{success:!0,message:"Record deleted successfully"};let s=this.getSubdomain(t.name,r),o=await this.listRecords(e);if(!o.success)return{success:!1,message:"Failed to list records"};let i=o.records.find((a)=>this.getSubdomain(a.name,r)===s&&a.type===t.type&&a.content===t.content);if(!i?.id)return{success:!1,message:"Record not found"};return await this.request(`/dns/delete/${r}/${i.id}`),{success:!0,message:"Record deleted successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async listRecords(e,t){try{let r=this.getRootDomain(e),s=`/dns/retrieve/${r}`;if(t)s=`/dns/retrieveByNameType/${r}/${t}`;return{success:!0,records:((await this.request(s)).records||[]).map((a)=>({id:a.id,name:a.name||r,type:a.type,content:a.content,ttl:Number.parseInt(a.ttl,10),priority:a.prio?Number.parseInt(a.prio,10):void 0}))}}catch(r){return{success:!1,records:[],message:r instanceof Error?r.message:"Unknown error"}}}async canManageDomain(e){try{let t=this.getRootDomain(e);return await this.request(`/dns/retrieve/${t}`),!0}catch{return!1}}async listDomains(){try{return((await this.request("/domain/listAll")).domains||[]).map((t)=>t.domain)}catch{return[]}}async getNameServers(e){try{let t=this.getRootDomain(e);return(await this.request(`/domain/getNs/${t}`)).ns||[]}catch{return[]}}async updateNameServers(e,t){try{let r=this.getRootDomain(e);return await this.request(`/domain/updateNs/${r}`,{ns:t}),!0}catch{return!1}}}class Be{name="godaddy";apiKey;apiSecret;baseUrl;constructor(e,t="",r="production"){this.apiKey=e,this.apiSecret=t,this.baseUrl=r==="ote"?"https://api.ote-godaddy.com":"https://api.godaddy.com"}authorization(){if(!this.apiSecret||this.apiKey.startsWith("gd_pat_"))return`Bearer ${this.apiKey}`;return`sso-key ${this.apiKey}:${this.apiSecret}`}async request(e,t,r){let s=`${this.baseUrl}${t}`,o={Authorization:this.authorization(),"Content-Type":"application/json",Accept:"application/json"},i={method:e,headers:o};if(r)i.body=JSON.stringify(r);let a=await fetch(s,i);if(a.status===204)return{};if(a.ok){let d=await a.text();if(d)return JSON.parse(d);return{}}let c=`GoDaddy API error: ${a.status} ${a.statusText}`;try{let d=await a.json();if(d.message)c=`GoDaddy API error: ${d.message}`;if(d.fields)c+=` - Fields: ${JSON.stringify(d.fields)}`}catch{}throw Error(c)}getSubdomain(e,t){let r=e.replace(/\.$/,""),s=t.replace(/\.$/,"");if(r===s)return"@";if(r.endsWith(`.${s}`))return r.slice(0,-(s.length+1));return r}getRootDomain(e){let t=e.replace(/\.$/,"").split(".");if(t.length>=2)return t.slice(-2).join(".");return e}toGoDaddyRecord(e,t){let r=this.getRootDomain(t),s=this.getSubdomain(e.name,r),o={type:e.type,name:s,data:e.content,ttl:e.ttl||600};if(e.type==="MX"&&e.priority!==void 0)o.priority=e.priority;return o}fromGoDaddyRecord(e,t){let r=this.getRootDomain(t),s=e.name;if(s==="@")s=r;else if(!s.endsWith(r))s=`${s}.${r}`;return{name:s,type:e.type,content:e.data,ttl:e.ttl,priority:e.priority}}async createRecord(e,t){try{let r=this.getRootDomain(e),s=this.toGoDaddyRecord(t,e);return await this.request("PATCH",`/v1/domains/${r}/records`,[s]),{success:!0,message:"Record created successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async upsertRecord(e,t){try{let r=this.getRootDomain(e),s=this.toGoDaddyRecord(t,e);return await this.request("PUT",`/v1/domains/${r}/records/${t.type}/${s.name}`,[s]),{success:!0,message:"Record upserted successfully"}}catch(r){return this.createRecord(e,t)}}async deleteRecord(e,t){try{let r=this.getRootDomain(e),s=this.getSubdomain(t.name,r),o=await this.request("GET",`/v1/domains/${r}/records/${t.type}/${s}`),i=o.filter((a)=>a.data!==t.content);if(i.length===o.length)return{success:!1,message:"Record not found"};if(i.length===0)try{await this.request("DELETE",`/v1/domains/${r}/records/${t.type}/${s}`)}catch{}else await this.request("PUT",`/v1/domains/${r}/records/${t.type}/${s}`,i);return{success:!0,message:"Record deleted successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async listRecords(e,t){try{let r=this.getRootDomain(e),s=`/v1/domains/${r}/records`;if(t)s=`/v1/domains/${r}/records/${t}`;return{success:!0,records:(await this.request("GET",s)).map((i)=>this.fromGoDaddyRecord(i,e))}}catch(r){return{success:!1,records:[],message:r instanceof Error?r.message:"Unknown error"}}}async canManageDomain(e){try{let t=this.getRootDomain(e);return await this.request("GET",`/v1/domains/${t}`),!0}catch{return!1}}async listDomains(){try{return(await this.request("GET","/v1/domains")).map((t)=>t.domain)}catch{return[]}}async getDomainDetails(e){try{let t=this.getRootDomain(e),r=await this.request("GET",`/v1/domains/${t}`);return{domain:r.domain,status:r.status,nameServers:r.nameServers,expires:r.expires}}catch{return null}}async getNameServers(e){return(await this.getDomainDetails(e))?.nameServers??[]}async updateNameServers(e,t){try{let r=this.getRootDomain(e);return await this.request("PATCH",`/v1/domains/${r}`,{nameServers:t}),!0}catch{return!1}}async checkDomainAvailability(e){try{let t=await this.request("GET",`/v1/domains/available?domain=${encodeURIComponent(e)}`);return{available:t.available,price:t.price,currency:t.currency}}catch{return{available:!1}}}}var k="https://api.cloudflare.com/client/v4",ts="[ts-cloud]";class he{name="cloudflare";apiToken;zoneCache=new Map;configuredZoneId;accountId;configuredZoneName;constructor(e,t={}){this.apiToken=e,this.configuredZoneId=t.zoneId,this.accountId=t.accountId}async request(e,t,r){let s=`${k}${t}`,o={Authorization:`Bearer ${this.apiToken}`,"Content-Type":"application/json"},i={method:e,headers:o};if(r)i.body=JSON.stringify(r);let c=await(await fetch(s,i)).json();if(!c.success){let d=c.errors.map((u)=>u.message).join(", ");throw Error(`Cloudflare API error: ${d}`)}return c}getRootDomain(e){let t=e.replace(/\.$/,"").split(".");if(t.length>=2)return t.slice(-2).join(".");return e}async resolveZone(e){let t=e.replace(/\.$/,"").toLowerCase();if(this.configuredZoneId){let a=await this.resolveConfiguredZoneName();if(a&&(t===a||t.endsWith(`.${a}`)))return{id:this.configuredZoneId,name:a}}let r=this.getRootDomain(t),s=this.zoneCache.get(r);if(s)return{id:s,name:r};let o=await this.request("GET",`/zones?name=${encodeURIComponent(r)}`);if(!o.result||o.result.length===0)throw Error(`Zone not found for domain: ${r}. `+"If the API token is scoped to a single zone, set its zone id (CLOUDFLARE_ZONE_ID) — "+"zone lookup by name needs account-wide Zone:Read.");let i=o.result[0].id;return this.zoneCache.set(r,i),{id:i,name:o.result[0].name||r}}async resolveConfiguredZoneName(){if(!this.configuredZoneId)return;if(this.configuredZoneName)return this.configuredZoneName;try{let t=(await this.request("GET",`/zones/${this.configuredZoneId}`)).result?.name?.toLowerCase();if(!t)return;return this.configuredZoneName=t,this.zoneCache.set(t,this.configuredZoneId),t}catch{return}}async getZoneId(e){return(await this.resolveZone(e)).id}getFullRecordName(e,t){let r=e.replace(/\.$/,"");if(!r||r===t||r==="@")return t;if(r.endsWith(`.${t}`))return r;return`${r}.${t}`}toCloudflareRecord(e,t,r){let s={type:e.type,name:this.getFullRecordName(e.name,t),content:e.content||e.value||"",ttl:e.ttl||1},o=r??e.proxied;if(o!==void 0&&tt.has(e.type)){if(s.proxied=o,o)s.ttl=1}if(e.type==="MX"&&e.priority!==void 0)s.priority=e.priority;if(e.type==="SRV"){let i=_(e);if(i)s.data=i,delete s.content,delete s.priority;else if(e.priority!==void 0)s.priority=e.priority}return s}fromCloudflareRecord(e){return{id:e.id,name:e.name,type:e.type,content:e.content,ttl:e.ttl,priority:e.priority,proxied:e.proxied}}async createRecord(e,t){try{let r=await this.resolveZone(e),s=this.toCloudflareRecord(t,r.name);return{success:!0,id:(await this.request("POST",`/zones/${r.id}/dns_records`,s)).result.id,message:"Record created successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async upsertRecord(e,t){try{let r=await this.resolveZone(e),s=this.getFullRecordName(t.name,r.name),i=(await this.request("GET",`/zones/${r.id}/dns_records?type=${t.type}&name=${encodeURIComponent(s)}`)).result?.[0],a=t.proxied??i?.proxied,c=this.toCloudflareRecord(t,r.name,a);if(i)return{success:!0,id:(await this.request("PUT",`/zones/${r.id}/dns_records/${i.id}`,c)).result.id,message:"Record updated successfully"};return{success:!0,id:(await this.request("POST",`/zones/${r.id}/dns_records`,c)).result.id,message:"Record created successfully"}}catch(r){return this.createRecord(e,t)}}async deleteRecord(e,t){try{let r=await this.resolveZone(e),s=r.id,o=this.getFullRecordName(t.name,r.name),i=await this.request("GET",`/zones/${s}/dns_records?type=${t.type}&name=${encodeURIComponent(o)}`);if(!i.result||i.result.length===0)return{success:!1,message:"Record not found"};let a=i.result.find((c)=>c.content===t.content);if(!a)return{success:!1,message:"Record with matching content not found"};return await this.request("DELETE",`/zones/${s}/dns_records/${a.id}`),{success:!0,message:"Record deleted successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async listRecords(e,t){try{let s=`/zones/${await this.getZoneId(e)}/dns_records?per_page=100`;if(t)s+=`&type=${t}`;let o=[],i=1,a=!0;while(a){let c=await this.request("GET",`${s}&page=${i}`);if(o.push(...c.result||[]),c.result_info)a=i<c.result_info.total_pages,i++;else a=!1}return{success:!0,records:o.map((c)=>this.fromCloudflareRecord(c))}}catch(r){return{success:!1,records:[],message:r instanceof Error?r.message:"Unknown error"}}}async canManageDomain(e){try{return await this.getZoneId(e),!0}catch{return!1}}async listDomains(){try{let e=[],t=1,r=!0;while(r){let s=await this.request("GET",`/zones?per_page=50&page=${t}`);if(e.push(...s.result||[]),s.result_info)r=t<s.result_info.total_pages,t++;else r=!1}return e.map((s)=>s.name)}catch{return[]}}async createZone(e,t={}){let r=e.replace(/\.$/,"").toLowerCase(),s=t.accountId??this.accountId;if(!s)throw Error(`Cannot create zone ${r}: no Cloudflare account id. Set CLOUDFLARE_ACCOUNT_ID, or pass accountId.`);let o=await this.getZoneDetails(r);if(o)return{...o,created:!1};try{let a=(await this.request("POST","/zones",{name:r,account:{id:s},jump_start:t.jumpStart??!1})).result;return this.zoneCache.set(a.name,a.id),{id:a.id,name:a.name,status:a.status,nameServers:a.name_servers??[],created:!0}}catch(i){let a=i instanceof Error?i.message:String(i);if(!/already exists|1061/i.test(a))throw i;let c=await this.getZoneDetails(r);if(!c)throw i;return{...c,created:!1}}}async getZoneDetails(e){try{let t=await this.getZoneId(e),r=await this.request("GET",`/zones/${t}`);return{id:r.result.id,name:r.result.name,status:r.result.status,nameServers:r.result.name_servers,paused:r.result.paused}}catch{return null}}async listEdgeCertificateHosts(e){try{let t=await this.getZoneId(e),r=await this.request("GET",`/zones/${t}/ssl/certificate_packs?per_page=50`),s=new Set;for(let o of r.result||[]){if(o.status!=="active")continue;for(let i of o.hosts||[])s.add(i.toLowerCase())}return[...s]}catch{return null}}async purgeCache(e,t){try{let r=await this.getZoneId(e),s={};if(t?.purgeEverything)s.purge_everything=!0;else{if(t?.files)s.files=t.files;if(t?.tags)s.tags=t.tags;if(t?.hosts)s.hosts=t.hosts}if(Object.keys(s).length===0)s.purge_everything=!0;return await this.request("POST",`/zones/${r}/purge_cache`,s),!0}catch{return!1}}async getRecordProxyStatus(e,t){try{let r=await this.resolveZone(e),s=r.id,o=this.getFullRecordName(t.name,r.name),i=await this.request("GET",`/zones/${s}/dns_records?type=${t.type}&name=${encodeURIComponent(o)}`);if(i.result&&i.result.length>0)return i.result.find((c)=>c.content===t.content)?.proxied??null;return null}catch{return null}}async setRecordProxyStatus(e,t,r){try{let s=await this.resolveZone(e),o=s.id,i=this.getFullRecordName(t.name,s.name),a=await this.request("GET",`/zones/${o}/dns_records?type=${t.type}&name=${encodeURIComponent(i)}`);if(!a.result||a.result.length===0)return!1;let c=a.result.find((d)=>d.content===t.content);if(!c)return!1;return await this.request("PATCH",`/zones/${o}/dns_records/${c.id}`,{proxied:r}),!0}catch{return!1}}async zoneIdFor(e){return this.getZoneId(e)}get account(){return this.accountId}async getZoneSettings(e){let t=await this.getZoneId(e),r=await this.request("GET",`/zones/${t}/settings`),s={};for(let o of r.result||[])s[o.id]=o.value;return s}async applyZoneSettings(e,t){let r=await this.getZoneId(e),s=await this.getZoneSettings(e).catch(()=>({})),o=[],i=[];for(let[a,c]of Object.entries(t)){if(c===void 0)continue;let d=s[a];if(d!==void 0&&S(d,c))continue;try{await this.request("PATCH",`/zones/${r}/settings/${a}`,{value:c}),o.push({id:a,from:d,to:c})}catch(u){i.push({id:a,error:u instanceof Error?u.message:String(u)})}}return{changed:o,failed:i}}async getManagedRequestHeaders(e){let t=await this.getZoneId(e),r=await this.request("GET",`/zones/${t}/managed_headers`),s={};for(let o of r.result?.managed_request_headers||[])s[o.id]=o.enabled===!0;return s}async applyManagedRequestHeaders(e,t){let r=[],s=[],o=Object.entries(t).filter(([,d])=>d!==void 0);if(o.length===0)return{changed:r,failed:s};let i=await this.getZoneId(e),a;try{a=await this.getManagedRequestHeaders(e)}catch(d){let u=d instanceof Error?d.message:String(d);for(let[m]of o)s.push({id:m,error:`could not read managed headers — ${u}`});return{changed:r,failed:s}}let c=[];for(let[d,u]of o){if(!(d in a)){s.push({id:d,error:"not a managed request header transform on this zone"});continue}if(a[d]!==u)c.push([d,u])}if(c.length===0)return{changed:r,failed:s};try{await this.request("PATCH",`/zones/${i}/managed_headers`,{managed_request_headers:c.map(([d,u])=>({id:d,enabled:u})),managed_response_headers:[]});for(let[d,u]of c)r.push({id:d,from:a[d],to:u})}catch(d){let u=d instanceof Error?d.message:String(d);for(let[m]of c)s.push({id:m,error:u})}return{changed:r,failed:s}}async getPhaseRules(e,t){let r=await this.getZoneId(e);try{return(await this.request("GET",`/zones/${r}/rulesets/phases/${t}/entrypoint`)).result?.rules||[]}catch{return[]}}async putManagedPhaseRules(e,t,r){try{let s=await this.getZoneId(e),i=(await this.getPhaseRules(e,t)).filter((d)=>!(d.description||"").startsWith(ts)),a=r.map((d)=>({...d,description:d.description?.startsWith(ts)?d.description:`${ts} ${d.description||t}`})),c=[...i,...a].map(({id:d,...u})=>u);return await this.request("PUT",`/zones/${s}/rulesets/phases/${t}/entrypoint`,{rules:c}),{success:!0}}catch(s){return{success:!1,message:s instanceof Error?s.message:String(s)}}}}function S(e,t){if(e===t)return!0;if(typeof e!==typeof t||e===null||t===null)return!1;if(typeof e!=="object")return!1;if(Array.isArray(e)||Array.isArray(t)){if(!Array.isArray(e)||!Array.isArray(t)||e.length!==t.length)return!1;return e.every((o,i)=>S(o,t[i]))}let r=e,s=t;return Object.keys(s).every((o)=>S(r[o],s[o]))}function _(e){let t=(e.content||e.value||"").trim();if(e.weight!==void 0&&e.port!==void 0&&e.priority!==void 0&&t)return{priority:e.priority,weight:e.weight,port:e.port,target:b(t)};let r=t.split(/\s+/);if(r.length<4)return null;let[s,o,i]=r.slice(0,3).map(Number);if(![s,o,i].every(Number.isFinite))return null;return{priority:s,weight:o,port:i,target:b(r.slice(3).join(" "))}}function b(e){return e.replace(/\.$/,"")}var Z=new Set(["A","AAAA","CNAME","ALIAS"]);function Tt(e){let t=e.trim().replace(/^"|"$/g,"").toLowerCase();if(t.startsWith("v=spf1"))return"v=spf1";if(t.startsWith("v=dmarc1"))return"v=dmarc1";return}function R(e){return e.trim().replace(/^"(.*)"$/s,"$1")}function D(e){return e.replace(/\.$/,"").toLowerCase()}function hn(e,t){let r=D(t),s=(e??"@").trim();if(!s||s==="@")return r;let o=D(s);if(o===r||o.endsWith(`.${r}`))return o;return`${o}.${r}`}function rs(e,t){return e.map((r)=>({...r,name:hn(r.name,t),proxied:r.proxied??!1}))}function V(e,t){if(e.type!==t.type)return!1;if(D(e.name)!==D(t.name))return!1;if(Z.has(t.type))return!0;if(t.type==="TXT"){let r=Tt(t.content);if(r)return Tt(R(e.content))===r;return R(e.content)===R(t.content)}return R(e.content)===R(t.content)}function M(e,t){if(R(e.content)!==R(t.content))return!1;if(t.priority!==void 0&&e.priority!==t.priority)return!1;if(t.proxied!==void 0&&e.proxied!==void 0&&e.proxied!==t.proxied)return!1;return!0}async function ns(e){let{provider:t,zone:r,records:s}=e,o={outcomes:[],warnings:[]};if(s.length===0)return o;let i=await t.listRecords(r);if(!i.success)return o.warnings.push(`could not list ${r}: ${i.message||"unknown provider error"} — records not reconciled`),o;let a=i.records;for(let c of s){let d=a.filter((l)=>V(l,c));if(d.length>0&&d.every((l)=>M(l,c))){o.outcomes.push({record:c,action:"unchanged"});continue}let u={name:c.name,type:c.type,content:c.content,ttl:c.ttl??3600,...c.priority!==void 0?{priority:c.priority}:{},...c.proxied!==void 0?{proxied:c.proxied}:{}},m=c.type==="TXT"&&Tt(c.content)!==void 0;if(m)for(let l of d){let A=await t.deleteRecord(r,{name:l.name,type:l.type,content:l.content});if(!A.success)o.warnings.push(`could not remove superseded ${l.type} at ${l.name}: ${A.message||"unknown error"}`)}let p=m||d.length===0?await t.createRecord(r,u):await t.upsertRecord(r,u);if(p.success)o.outcomes.push({record:c,action:d.length>0?"updated":"created"});else o.outcomes.push({record:c,action:"failed",message:p.message})}for(let c of["MX"]){let d=new Set(s.filter((u)=>u.type===c).map((u)=>D(u.name)));for(let u of d){let m=new Set(s.filter((l)=>l.type===c&&D(l.name)===u).map((l)=>R(l.content).toLowerCase())),p=a.filter((l)=>l.type===c&&D(l.name)===u&&!m.has(R(l.content).toLowerCase()));for(let l of p)o.warnings.push(`${u} has an undeclared ${c} record (${l.content}) alongside the declared one — mail will be split between them. Remove it at the provider if it is stale.`)}}return o}function nr(e){if(!e||typeof e!=="object")return!1;let t=e;return typeof t.getNameServers==="function"&&typeof t.updateNameServers==="function"}function ir(e){return Boolean(e&&typeof e.createZone==="function")}var O=new Set(["NS"]);function v(e){return e.replace(/\.$/,"").toLowerCase()}function fn(e,t){if(e.length===0||t.length===0)return!1;let r=new Set(e.map(v)),s=new Set(t.map(v));if(r.size!==s.size)return!1;for(let o of r)if(!s.has(o))return!1;return!0}function I(e){let t=e.content.trim(),r=t.startsWith('"')&&t.endsWith('"')?t.slice(1,-1):t;return e.type==="TXT"?r:v(r)}function z(e,t){return e.type===t.type&&v(e.name)===v(t.name)&&I(e)===I(t)}async function sr(e){let{domain:t,registrar:r,host:s,dryRun:o=!1}=e,i=new Set([...e.proxiedHosts??[]].map(v)),a=[],c=await s.createZone(t,{accountId:e.accountId,jumpStart:!1}),d=await r.getNameServers(t),u={status:"ready",domain:t,zoneId:c.id,targetNameservers:c.nameServers,currentNameservers:d,records:[],missing:[],warnings:a};if(fn(d,c.nameServers))return u.status="already-delegated",u;if(c.nameServers.length===0)return a.push(`${s.name} did not report nameservers for ${t}; cannot delegate.`),u.status="blocked",u;let m=await r.listRecords(t);if(!m.success)return a.push(`Could not read ${t} from ${r.name}: ${m.message??"unknown error"}`),u.status="blocked",u;let p=[];for(let g of m.records){if(O.has(g.type)){u.records.push({record:g,status:"skipped",reason:`${g.type} describes the delegation itself; ${s.name} owns it`});continue}let y=tt.has(g.type)&&i.has(v(g.name));p.push({name:g.name,type:g.type,content:g.content,ttl:g.ttl,priority:g.priority,...tt.has(g.type)?{proxied:y}:{}})}if(o){for(let g of p)u.records.push({record:g,status:"copied",reason:"dry run"});return u}for(let g of p){let y;try{y=await s.upsertRecord(t,g)}catch(C){y={success:!1,message:C instanceof Error?C.message:String(C)}}u.records.push(y.success?{record:g,status:"copied"}:{record:g,status:"failed",reason:y.message})}let l=await s.listRecords(t);if(!l.success)return a.push(`Could not read back ${t} from ${s.name}: ${l.message??"unknown error"}`),u.status="blocked",u;for(let g of p)if(!l.records.some((y)=>z(g,y)))u.missing.push(g);if(u.missing.length>0)return a.push(`${u.missing.length} record(s) did not arrive at ${s.name}; leaving ${r.name}'s nameservers alone. Delegating now would take the domain off a complete zone and onto an incomplete one.`),u.status="blocked",u;if(!await r.updateNameServers(t,c.nameServers))return a.push(`${r.name} refused the nameserver update for ${t}.`),u.status="blocked",u;return u.status="delegated",u}var L={add_visitor_location_headers:"visitorLocationHeaders"};function E(e){return{porkbunApiKey:e.PORKBUN_API_KEY,porkbunSecretKey:e.PORKBUN_SECRET_KEY,godaddyApiKey:e.GODADDY_API_KEY,godaddyApiSecret:e.GODADDY_API_SECRET,cloudflareApiToken:e.CLOUDFLARE_API_TOKEN,cloudflareAccountId:e.CLOUDFLARE_ACCOUNT_ID}}function U(e,t){if(e==="porkbun"){if(!t.porkbunApiKey||!t.porkbunSecretKey)return"PORKBUN_API_KEY / PORKBUN_SECRET_KEY are not set";return new ie(t.porkbunApiKey,t.porkbunSecretKey)}if(!t.godaddyApiKey||!t.godaddyApiSecret)return"GODADDY_API_KEY / GODADDY_API_SECRET are not set";let r=new Be(t.godaddyApiKey,t.godaddyApiSecret);if(!nr(r))return"the GoDaddy provider cannot change nameservers";return r}async function is(e,t={}){let r=e.registrar;if(!r)return{status:"skipped",reason:"no dns.registrar configured"};if(r.delegate===!1)return{status:"skipped",reason:"dns.registrar.delegate is false"};if(!e.domain)return{status:"skipped",reason:"no dns.domain configured"};if(!e.provider||e.provider===r.provider)return{status:"skipped",reason:`dns.provider is already ${r.provider}`};if(e.provider!=="cloudflare")return{status:"skipped",reason:`delegation to ${e.provider} is not supported yet`};let s=t.credentials??E(t.env??process.env);if(!s.cloudflareApiToken)return{status:"skipped",reason:"CLOUDFLARE_API_TOKEN is not set"};let o=U(r.provider,s);if(typeof o==="string")return{status:"skipped",reason:o};let i=new he(s.cloudflareApiToken,{accountId:s.cloudflareAccountId});if(!ir(i))return{status:"skipped",reason:"the Cloudflare provider cannot create zones"};return sr({domain:e.domain,registrar:o,host:i,proxiedHosts:r.proxied,accountId:s.cloudflareAccountId,dryRun:r.dryRun})}function ss(e){if(e.status==="skipped")return[`dns: delegation skipped — ${e.reason}`];let t=[];switch(e.status){case"already-delegated":t.push(`dns: ${e.domain} already delegated to ${e.targetNameservers.join(", ")}`);break;case"delegated":t.push(`dns: ${e.domain} delegated to ${e.targetNameservers.join(", ")} (${e.records.filter((r)=>r.status==="copied").length} record(s) copied)`),t.push("dns: nameserver changes take up to 24h to propagate; the old zone answers until then");break;case"ready":t.push(`dns: ${e.domain} would delegate to ${e.targetNameservers.join(", ")} (dry run)`);break;case"blocked":t.push(`dns: ${e.domain} NOT delegated — nameservers left at ${e.currentNameservers.join(", ")}`);for(let r of e.missing)t.push(`  missing at destination: ${r.type} ${r.name}`);break}for(let r of e.warnings)t.push(`  ${r}`);return t}function q(e){let t={};if(e.ssl!==void 0)t.ssl=e.ssl;if(e.alwaysUseHttps!==void 0)t.always_use_https=e.alwaysUseHttps?"on":"off";if(e.minTlsVersion!==void 0)t.min_tls_version=e.minTlsVersion;return t}function j(e){let t={};for(let[r,s]of Object.entries(L)){let o=e[s];if(typeof o==="boolean")t[r]=o}return t}async function os(e,t={}){if(!e.zone)return{status:"skipped",reason:"no dns.zone configured"};if(!e.domain)return{status:"skipped",reason:"no dns.domain configured"};if(e.provider!=="cloudflare")return{status:"skipped",reason:`zone settings are not supported for ${e.provider??"this provider"}`};let r=q(e.zone),s=j(e.zone);if(Object.keys(r).length===0&&Object.keys(s).length===0)return{status:"skipped",reason:"dns.zone declares no settings"};let o=t.credentials??E(t.env??process.env);if(!o.cloudflareApiToken)return{status:"skipped",reason:"CLOUDFLARE_API_TOKEN is not set"};let i=new he(o.cloudflareApiToken,{accountId:o.cloudflareAccountId}),a=await i.applyZoneSettings(e.domain,r),c=Object.keys(s).length>0?await i.applyManagedRequestHeaders(e.domain,s):{changed:[],failed:[]},d=[...a.changed,...c.changed],u=[...a.failed,...c.failed];return{status:d.length>0?"applied":"unchanged",domain:e.domain,changed:d,failed:u}}function as(e){if(e.status==="skipped")return[`dns: zone settings skipped — ${e.reason}`];let t=[];for(let r of e.changed)t.push(`dns: ${e.domain} ${r.id}: ${String(r.from)} → ${String(r.to)}`);if(e.status==="unchanged"&&e.failed.length===0)t.push(`dns: ${e.domain} zone settings already as declared`);for(let r of e.failed)t.push(`dns: ${e.domain} could not set ${r.id} — ${r.error}`);return t}class fe{name="route53";client;hostedZoneCache=new Map;providedHostedZoneId;constructor(e="us-east-1",t){this.client=new h(e),this.providedHostedZoneId=t}getRootDomain(e){let t=e.replace(/\.$/,"").split(".");if(t.length>=2)return t.slice(-2).join(".");return e}async getHostedZoneId(e){if(this.providedHostedZoneId)return this.providedHostedZoneId;let t=this.getRootDomain(e),r=this.hostedZoneCache.get(t);if(r)return r;let s=await this.client.findHostedZoneForDomain(e);if(s){let o=s.Id.replace("/hostedzone/","");return this.hostedZoneCache.set(t,o),o}return null}normalizeName(e,t){let r=e.replace(/\.$/,""),s=t.replace(/\.$/,"");if(!s||s==="@")return`${r}.`;if(s===r||s.endsWith(`.${r}`))return`${s}.`;return`${s}.${r}.`}async createRecord(e,t){try{let r=await this.getHostedZoneId(e);if(!r)return{success:!1,message:`No hosted zone found for domain: ${e}`};let s=this.normalizeName(e,t.name),o=t.content;if(t.type==="TXT"&&!o.startsWith('"'))o=`"${o}"`;if(t.type==="MX"&&t.priority!==void 0)o=`${t.priority} ${o}`;return{success:!0,id:(await this.client.changeResourceRecordSets({HostedZoneId:r,ChangeBatch:{Comment:"Created by ts-cloud DNS provider",Changes:[{Action:"CREATE",ResourceRecordSet:{Name:s,Type:t.type,TTL:t.ttl||300,ResourceRecords:[{Value:o}]}}]}})).ChangeInfo?.Id,message:"Record created successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async upsertRecord(e,t){try{let r=await this.getHostedZoneId(e);if(!r)return{success:!1,message:`No hosted zone found for domain: ${e}`};let s=this.normalizeName(e,t.name),o=t.content;if(t.type==="TXT"&&!o.startsWith('"'))o=`"${o}"`;if(t.type==="MX"&&t.priority!==void 0)o=`${t.priority} ${o}`;return{success:!0,id:(await this.client.changeResourceRecordSets({HostedZoneId:r,ChangeBatch:{Comment:"Upserted by ts-cloud DNS provider",Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:s,Type:t.type,TTL:t.ttl||300,ResourceRecords:[{Value:o}]}}]}})).ChangeInfo?.Id,message:"Record upserted successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async deleteRecord(e,t){try{let r=await this.getHostedZoneId(e);if(!r)return{success:!1,message:`No hosted zone found for domain: ${e}`};let s=this.normalizeName(e,t.name),o=t.content;if(t.type==="TXT"&&!o.startsWith('"'))o=`"${o}"`;if(t.type==="MX"&&t.priority!==void 0)o=`${t.priority} ${o}`;return await this.client.changeResourceRecordSets({HostedZoneId:r,ChangeBatch:{Comment:"Deleted by ts-cloud DNS provider",Changes:[{Action:"DELETE",ResourceRecordSet:{Name:s,Type:t.type,TTL:t.ttl||300,ResourceRecords:[{Value:o}]}}]}}),{success:!0,message:"Record deleted successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async listRecords(e,t){try{let r=await this.getHostedZoneId(e);if(!r)return{success:!1,records:[],message:`No hosted zone found for domain: ${e}`};let s=await this.client.listResourceRecordSets({HostedZoneId:r,StartRecordType:t}),o=[];for(let i of s.ResourceRecordSets){if(t&&i.Type!==t)continue;if(i.AliasTarget)continue;for(let a of i.ResourceRecords||[]){let c=a.Value,d;if(i.Type==="MX"){let u=c.split(" ");if(u.length>=2)d=Number.parseInt(u[0],10),c=u.slice(1).join(" ")}if(i.Type==="TXT"&&c.startsWith('"')&&c.endsWith('"'))c=c.slice(1,-1);o.push({name:i.Name.replace(/\.$/,""),type:i.Type,content:c,ttl:i.TTL,priority:d})}}return{success:!0,records:o}}catch(r){return{success:!1,records:[],message:r instanceof Error?r.message:"Unknown error"}}}async canManageDomain(e){return await this.getHostedZoneId(e)!==null}async listDomains(){try{return(await this.client.listHostedZones()).HostedZones.map((t)=>t.Name.replace(/\.$/,""))}catch{return[]}}getRoute53Client(){return this.client}async createAliasRecord(e){try{let t=await this.getHostedZoneId(e.domain);if(!t)return{success:!1,message:`No hosted zone found for domain: ${e.domain}`};return{success:!0,id:(await this.client.createAliasRecord({HostedZoneId:t,Name:this.normalizeName(e.domain,e.name),TargetHostedZoneId:e.targetHostedZoneId,TargetDNSName:e.targetDnsName,EvaluateTargetHealth:e.evaluateTargetHealth,Type:e.type})).ChangeInfo?.Id,message:"Alias record created successfully"}}catch(t){return{success:!1,message:t instanceof Error?t.message:"Unknown error"}}}async createCloudFrontAlias(e){return this.createAliasRecord({domain:e.domain,name:e.name,targetHostedZoneId:h.CloudFrontHostedZoneId,targetDnsName:e.cloudFrontDomainName,evaluateTargetHealth:!1})}async createAlbAlias(e){let t=h.ALBHostedZoneIds[e.region];if(!t)return{success:!1,message:`Unknown region for ALB: ${e.region}`};return this.createAliasRecord({domain:e.domain,name:e.name,targetHostedZoneId:t,targetDnsName:e.albDnsName,evaluateTargetHealth:!0})}}async function cs(e,t){let r=[],s,o;for(;;){let i=await e.listResourceRecordSets({HostedZoneId:t,StartRecordName:s,StartRecordType:o,MaxItems:"100"});if(r.push(...i.ResourceRecordSets),!i.IsTruncated)break;if(s=i.NextRecordName,o=i.NextRecordType,!s)break}return r}function f(e){return e.replace(/\.$/,"").toLowerCase()}function x(e){return e.replace(/\.$/,"")}function w(e){if(e.type==="SRV"&&e.weight!==void 0&&e.port!==void 0)return`${e.weight} ${e.port} ${x(e.content)}`;return x(e.content)}function H(e){let t=e.match(/"(?:[^"\\]|\\.)*"/g);if(!t)return e;return t.map((r)=>r.slice(1,-1).replace(/\\(.)/g,"$1")).join("")}function ds(e,t){let r=f(t),s=[],o=[],i=[],a=new Set;for(let c of e){let d=f(c.Name),u=c.Type;if(u==="SOA"||u==="NS"&&d===r){o.push({name:d,type:u,reason:"owned by the destination provider"});continue}if(c.SetIdentifier){o.push({name:d,type:u,reason:`routing policy record (SetIdentifier=${c.SetIdentifier}) has no equivalent — recreate by hand`}),i.push(`${u} ${d} is part of a Route53 routing policy and was NOT migrated`);continue}if(c.AliasTarget){if(a.has(d))continue;a.add(d);let m=f(c.AliasTarget.DNSName);if(s.push({name:d,type:"CNAME",content:m,ttl:300,translatedFrom:`${u} ALIAS → ${m}`}),c.AliasTarget.EvaluateTargetHealth)i.push(`${d} was an ALIAS with health evaluation enabled; the CNAME that replaces it has no health check`);continue}for(let m of c.ResourceRecords||[]){let p=F(d,u,m.Value,c.TTL);if("reason"in p){o.push({name:d,type:u,reason:p.reason}),i.push(`${u} ${d}: ${p.reason}`);continue}s.push(p)}}return{zone:r,records:s,skipped:o,warnings:i}}function F(e,t,r,s){let o={name:e,ttl:s};switch(t){case"A":case"AAAA":case"CNAME":case"PTR":return{...o,type:t==="PTR"?"CNAME":t,content:f(r)};case"TXT":return{...o,type:"TXT",content:H(r)};case"MX":{let[i,...a]=r.trim().split(/\s+/);if(!a.length)return{reason:`malformed MX value "${r}"`};return{...o,type:"MX",content:f(a.join(" ")),priority:Number(i)}}case"SRV":{let i=r.trim().split(/\s+/);if(i.length<4)return{reason:`malformed SRV value "${r}"`};let[a,c,d]=i.slice(0,3).map(Number);return{...o,type:"SRV",content:f(i.slice(3).join(" ")),priority:a,weight:c,port:d}}case"NS":return{...o,type:"NS",content:f(r)};case"CAA":return{...o,type:"CAA",content:r.trim()};default:return{reason:`unsupported record type ${t}`}}}var K=new Set(["TXT","MX","SRV","NS","CAA"]);async function ls(e,t){let r=[],s=[],o=new Set;try{let i=await e.listRecords(t.zone);for(let a of i.records||[])o.add(`${f(a.name)}|${a.type}|${w(a)}`)}catch{}for(let i of t.records){let a={...i,proxied:!1},c=`${f(i.name)}|${i.type}|${w(i)}`;if(!K.has(i.type)){let u=await e.upsertRecord(t.zone,a);if(u.success)r.push(i);else s.push({record:i,message:u.message||"unknown provider error"});continue}if(o.has(c)){r.push(i);continue}let d=await e.createRecord(t.zone,a);if(d.success)o.add(c),r.push(i);else s.push({record:i,message:d.message||"unknown provider error"})}return{applied:r,failed:s}}async function us(e,t){let r=await e.listRecords(t.zone),s=[],o=[],i=new Map;for(let a of r.records||[]){let c=`${f(a.name)}|${a.type}`,d=i.get(c)??[];d.push(w(a)),i.set(c,d)}for(let a of t.records){let c=i.get(`${f(a.name)}|${a.type}`),d=w(a);if(c?.some((u)=>u===d))s.push(a);else o.push({record:a,found:c?.join(", ")})}return{matched:s,missing:o,ok:o.length===0}}class oe{client;region;constructor(e="us-east-1"){this.client=new n,this.region=e}async requestCertificate(e){let t={DomainName:e.DomainName,ValidationMethod:e.ValidationMethod||"DNS"};if(e.SubjectAlternativeNames)t.SubjectAlternativeNames=e.SubjectAlternativeNames;return{CertificateArn:(await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.RequestCertificate"},body:JSON.stringify(t)})).CertificateArn||""}}async describeCertificate(e){let r=(await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.DescribeCertificate"},body:JSON.stringify({CertificateArn:e.CertificateArn})})).Certificate||{};return{CertificateArn:r.CertificateArn||"",DomainName:r.DomainName||"",SubjectAlternativeNames:r.SubjectAlternativeNames,Status:r.Status||"PENDING_VALIDATION",Type:r.Type,DomainValidationOptions:r.DomainValidationOptions?.map((s)=>({DomainName:s.DomainName,ValidationDomain:s.ValidationDomain,ValidationStatus:s.ValidationStatus,ResourceRecord:s.ResourceRecord?{Name:s.ResourceRecord.Name,Type:s.ResourceRecord.Type,Value:s.ResourceRecord.Value}:void 0,ValidationMethod:s.ValidationMethod})),CreatedAt:r.CreatedAt,IssuedAt:r.IssuedAt,NotBefore:r.NotBefore,NotAfter:r.NotAfter}}async listCertificates(e){let t={};if(e?.CertificateStatuses)t.CertificateStatuses=e.CertificateStatuses;if(e?.MaxItems)t.MaxItems=e.MaxItems;if(e?.NextToken)t.NextToken=e.NextToken;let r=await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.ListCertificates"},body:JSON.stringify(t)});return{CertificateSummaryList:(r.CertificateSummaryList||[]).map((s)=>({CertificateArn:s.CertificateArn,DomainName:s.DomainName})),NextToken:r.NextToken}}async deleteCertificate(e){await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.DeleteCertificate"},body:JSON.stringify({CertificateArn:e.CertificateArn})})}async listTagsForCertificate(e){return{Tags:(await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.ListTagsForCertificate"},body:JSON.stringify({CertificateArn:e.CertificateArn})})).Tags||[]}}async addTagsToCertificate(e){await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.AddTagsToCertificate"},body:JSON.stringify({CertificateArn:e.CertificateArn,Tags:e.Tags})})}async resendValidationEmail(e){await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.ResendValidationEmail"},body:JSON.stringify({CertificateArn:e.CertificateArn,Domain:e.Domain,ValidationDomain:e.ValidationDomain})})}async findCertificateByDomain(e){let r=(await this.listCertificates({CertificateStatuses:["ISSUED"]})).CertificateSummaryList.find((s)=>s.DomainName===e||s.DomainName===`*.${e.split(".").slice(1).join(".")}`);if(!r)return null;return this.describeCertificate({CertificateArn:r.CertificateArn})}async waitForCertificateValidation(e,t=60,r=30000){for(let s=0;s<t;s++){let o=await this.describeCertificate({CertificateArn:e});if(o.Status==="ISSUED")return o;if(o.Status==="FAILED"||o.Status==="VALIDATION_TIMED_OUT")return null;await new Promise((i)=>setTimeout(i,r))}return null}async getDnsValidationRecords(e){let t=await this.describeCertificate({CertificateArn:e});if(!t.DomainValidationOptions)return[];return t.DomainValidationOptions.filter((r)=>r.ResourceRecord&&r.ValidationMethod==="DNS").map((r)=>({domainName:r.DomainName,recordName:r.ResourceRecord.Name,recordType:r.ResourceRecord.Type,recordValue:r.ResourceRecord.Value}))}async requestCertificateWithSans(e){let t=new Set;if(t.add(e.DomainName),e.IncludeWww!==!1)t.add(`www.${e.DomainName}`);if(e.IncludeWildcard)t.add(`*.${e.DomainName}`);if(e.AdditionalSans)for(let r of e.AdditionalSans)t.add(r);return this.requestCertificate({DomainName:e.DomainName,SubjectAlternativeNames:Array.from(t),ValidationMethod:"DNS"})}async isCertificateValidForDomain(e,t){let r=await this.describeCertificate({CertificateArn:e});if(r.Status!=="ISSUED")return!1;if(r.DomainName===t)return!0;if(r.DomainName?.startsWith("*.")){let s=r.DomainName.slice(2),o=t.split("."),i=s.split(".");if(o.slice(-i.length).join(".")===s)return!0}if(r.SubjectAlternativeNames)for(let s of r.SubjectAlternativeNames){if(s===t)return!0;if(s.startsWith("*.")){let o=s.slice(2),i=t.split("."),a=o.split(".");if(i.slice(-a.length).join(".")===o)return!0}}return!1}}class or{acm;route53;dnsProvider;constructor(e="us-east-1",t){if(this.acm=new oe(e),this.route53=new h,t&&t.provider!=="route53")this.dnsProvider=T(t)}async requestAndValidate(e){let{domainName:t,hostedZoneId:r,subjectAlternativeNames:s=[],waitForValidation:o=!1,maxWaitMinutes:i=30}=e;if(!this.dnsProvider&&!r)throw Error("Either hostedZoneId or external DNS provider configuration is required");let{CertificateArn:a}=await this.acm.requestCertificate({DomainName:t,SubjectAlternativeNames:s.length>0?[t,...s]:void 0,ValidationMethod:"DNS"});await this.waitForValidationOptions(a);let c=await this.acm.getDnsValidationRecords(a);if(this.dnsProvider)for(let d of c){let u=await this.dnsProvider.upsertRecord(t,{name:d.recordName,type:d.recordType,content:d.recordValue,ttl:300});if(!u.success)console.warn(`Failed to create validation record for ${d.domainName}: ${u.message}`)}else if(r)for(let d of c)await this.route53.changeResourceRecordSets({HostedZoneId:r,ChangeBatch:{Comment:`ACM DNS validation for ${d.domainName}`,Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:d.recordName,Type:d.recordType,TTL:300,ResourceRecords:[{Value:d.recordValue}]}}]}});if(o){if(!await this.acm.waitForCertificateValidation(a,i*2,30000))throw Error(`Certificate validation timed out after ${i} minutes`)}return{certificateArn:a,validationRecords:c}}async waitForValidationOptions(e,t=30){for(let r=0;r<t;r++){let s=await this.acm.describeCertificate({CertificateArn:e});if(s.DomainValidationOptions&&s.DomainValidationOptions.length>0&&s.DomainValidationOptions[0].ResourceRecord)return;await new Promise((o)=>setTimeout(o,2000))}throw Error("Timeout waiting for DNS validation options")}async createValidationRecords(e){let{certificateArn:t,hostedZoneId:r,domain:s}=e;if(!this.dnsProvider&&!r)throw Error("Either hostedZoneId or external DNS provider configuration is required");let o=await this.acm.getDnsValidationRecords(t),i=[];if(this.dnsProvider){let a=s||o[0]?.domainName;for(let c of o){let d=await this.dnsProvider.upsertRecord(a,{name:c.recordName,type:c.recordType,content:c.recordValue,ttl:300});i.push({...c,changeId:d.success?d.id:void 0})}}else if(r)for(let a of o){let c=await this.route53.changeResourceRecordSets({HostedZoneId:r,ChangeBatch:{Comment:`ACM DNS validation for ${a.domainName}`,Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:a.recordName,Type:a.recordType,TTL:300,ResourceRecords:[{Value:a.recordValue}]}}]}});i.push({...a,changeId:c.ChangeInfo?.Id})}return i}async deleteValidationRecords(e){let{certificateArn:t,hostedZoneId:r,domain:s}=e,o=await this.acm.getDnsValidationRecords(t);if(this.dnsProvider){let i=s||o[0]?.domainName;for(let a of o)try{await this.dnsProvider.deleteRecord(i,{name:a.recordName,type:a.recordType,content:a.recordValue})}catch{}}else if(r)for(let i of o)try{await this.route53.changeResourceRecordSets({HostedZoneId:r,ChangeBatch:{Comment:`Cleanup ACM DNS validation for ${i.domainName}`,Changes:[{Action:"DELETE",ResourceRecordSet:{Name:i.recordName,Type:i.recordType,TTL:300,ResourceRecords:[{Value:i.recordValue}]}}]}})}catch{}}async findOrCreateCertificate(e){let{domainName:t,hostedZoneId:r,subjectAlternativeNames:s,waitForValidation:o=!0}=e;if(!this.dnsProvider&&!r)throw Error("Either hostedZoneId or external DNS provider configuration is required");let i=await this.acm.findCertificateByDomain(t);if(i&&i.Status==="ISSUED")return{certificateArn:i.CertificateArn,isNew:!1};let{certificateArn:a}=await this.requestAndValidate({domainName:t,hostedZoneId:r,subjectAlternativeNames:s,waitForValidation:o});return{certificateArn:a,isNew:!0}}hasExternalDnsProvider(){return this.dnsProvider!==void 0}getDnsProviderName(){return this.dnsProvider?.name||"route53"}}class se{acm;dnsProvider;constructor(e,t="us-east-1"){if(this.acm=new oe(t),"provider"in e)this.dnsProvider=T(e);else this.dnsProvider=e}getProvider(){return this.dnsProvider}async requestAndValidate(e){let{domainName:t,subjectAlternativeNames:r=[],waitForValidation:s=!1,maxWaitMinutes:o=30}=e,{CertificateArn:i}=await this.acm.requestCertificate({DomainName:t,SubjectAlternativeNames:r.length>0?[t,...r]:void 0,ValidationMethod:"DNS"});await this.waitForValidationOptions(i);let a=await this.acm.getDnsValidationRecords(i);for(let d of a){let u=await this.dnsProvider.upsertRecord(t,{name:d.recordName,type:d.recordType,content:d.recordValue,ttl:300});if(!u.success)console.warn(`Failed to create validation record for ${d.domainName}: ${u.message}`)}let c="pending";if(s)c=(await this.acm.waitForCertificateValidation(i,o*2,30000))?.Status==="ISSUED"?"issued":"failed";return{certificateArn:i,validationRecords:a.map((d)=>({domainName:d.domainName,recordName:d.recordName,recordType:d.recordType,recordValue:d.recordValue})),isNew:!0,status:c}}async createValidationRecords(e){let{certificateArn:t,domain:r}=e,s=[],o=await this.acm.getDnsValidationRecords(t);for(let i of o){let a=await this.dnsProvider.upsertRecord(r,{name:i.recordName,type:i.recordType,content:i.recordValue,ttl:300});if(!a.success)s.push(`Failed to create record for ${i.domainName}: ${a.message}`)}return{success:s.length===0,records:o.map((i)=>({domainName:i.domainName,recordName:i.recordName,recordType:i.recordType,recordValue:i.recordValue})),errors:s}}async deleteValidationRecords(e){let{certificateArn:t,domain:r}=e,s=[],o=await this.acm.getDnsValidationRecords(t);for(let i of o){let a=await this.dnsProvider.deleteRecord(r,{name:i.recordName,type:i.recordType,content:i.recordValue});if(!a.success)s.push(`Failed to delete record for ${i.domainName}: ${a.message}`)}return{success:s.length===0,errors:s}}async findOrCreateCertificate(e){let{domainName:t,subjectAlternativeNames:r=[],waitForValidation:s=!0,maxWaitMinutes:o}=e,i=await this.acm.findCertificateByDomain(t);if(i&&i.Status==="ISSUED"){let a=i.SubjectAlternativeNames||[i.DomainName],c=a.some((u)=>u===`*.${t}`);if(r.every((u)=>a.includes(u)||c))return{certificateArn:i.CertificateArn,validationRecords:[],isNew:!1,status:"issued"};console.log("Existing certificate doesn't cover all required SANs, requesting new certificate...")}return this.requestAndValidate({domainName:t,subjectAlternativeNames:r,waitForValidation:s,maxWaitMinutes:o})}async requestCertificateWithCommonSans(e){let{domainName:t,includeWww:r=!0,includeWildcard:s=!1,additionalSans:o=[],waitForValidation:i=!1}=e,a=[];if(r)a.push(`www.${t}`);if(s)a.push(`*.${t}`);return a.push(...o),this.requestAndValidate({domainName:t,subjectAlternativeNames:a,waitForValidation:i})}async waitForValidationOptions(e,t=30){for(let r=0;r<t;r++){let s=await this.acm.describeCertificate({CertificateArn:e});if(s.DomainValidationOptions&&s.DomainValidationOptions.length>0&&s.DomainValidationOptions[0].ResourceRecord)return;await new Promise((o)=>setTimeout(o,2000))}throw Error("Timeout waiting for DNS validation options")}async getCertificateStatus(e){let t=await this.acm.describeCertificate({CertificateArn:e});return{status:t.Status,domainValidations:(t.DomainValidationOptions||[]).map((r)=>({domain:r.DomainName,status:r.ValidationStatus||"UNKNOWN"}))}}}function ps(e,t,r){return new se({provider:"porkbun",apiKey:e,secretKey:t},r)}function gs(e,t,r,s){return new se({provider:"godaddy",apiKey:e,apiSecret:t,environment:s},r)}function ms(e,t,r){return new se({provider:"route53",region:e,hostedZoneId:t},r||e)}function T(e){switch(e.provider){case"route53":return new fe(e.region,e.hostedZoneId);case"porkbun":return new ie(e.apiKey,e.secretKey);case"godaddy":return new Be(e.apiKey,e.apiSecret,e.environment);case"cloudflare":return new he(e.apiToken,{zoneId:e.zoneId,accountId:e.accountId});default:throw Error(`Unknown DNS provider: ${e.provider}`)}}async function $a(e,t){for(let r of t){let s=T(r);if(await s.canManageDomain(e))return s}return null}class An{providers=new Map;configs=[];addConfig(e){return this.configs.push(e),this}addRoute53(e,t){return this.configs.push({provider:"route53",region:e,hostedZoneId:t}),this}addPorkbun(e,t){return this.configs.push({provider:"porkbun",apiKey:e,secretKey:t}),this}addGoDaddy(e,t,r){return this.configs.push({provider:"godaddy",apiKey:e,apiSecret:t,environment:r}),this}addCloudflare(e,t={}){return this.configs.push({provider:"cloudflare",apiToken:e,zoneId:t.zoneId,accountId:t.accountId}),this}loadFromEnv(){if(process.env.AWS_ACCESS_KEY_ID||process.env.AWS_REGION)this.addRoute53(process.env.AWS_REGION);let e=process.env.PORKBUN_API_KEY,t=process.env.PORKBUN_SECRET_KEY;if(e&&t)this.addPorkbun(e,t);let r=process.env.GODADDY_API_KEY,s=process.env.GODADDY_API_SECRET;if(r&&s){let i=process.env.GODADDY_ENVIRONMENT;this.addGoDaddy(r,s,i)}let o=process.env.CLOUDFLARE_API_TOKEN;if(o)this.addCloudflare(o,{zoneId:process.env.CLOUDFLARE_ZONE_ID,accountId:process.env.CLOUDFLARE_ACCOUNT_ID});return this}getProvider(e){let t=this.providers.get(e);if(t)return t;let r=this.configs.find((o)=>o.provider===e);if(!r)return null;let s=T(r);return this.providers.set(e,s),s}async getProviderForDomain(e){for(let t of this.configs){let r=T(t);if(await r.canManageDomain(e))return r}return null}getAllProviders(){return this.configs.map((e)=>T(e))}}var Ma=new An;
+export{tt,ie,Be,ts,he,Tt,hn,rs,ns,nr,ir,fn,sr,is,ss,os,as,fe,cs,ds,ls,us,se,ps,gs,ms,T,$a,An,Ma,oe,or};

package/dist/{chunk-2ke75pzn.js → chunk-epqpf6jd.js}

@@ -1 +1 @@
-import{Vi,ji,zi,Ki,Ea,va}from"./chunk-zhg1kvw3.js";import"./chunk-sxtgx8fj.js";import"./chunk-kfwg1c6q.js";import"./chunk-t054j0zn.js";import"./chunk-trsaqsgv.js";import"./chunk-t5e5phth.js";import"./chunk-4w8d2mf0.js";export{Ea as deleteStaticSite,ji as deployStaticSite,va as deployStaticSiteFull,Vi as generateStaticSiteTemplate,Ki as invalidateCache,zi as uploadStaticFiles};
+import{Vi,ji,zi,Ki,Ea,va}from"./chunk-f9pzjzye.js";import"./chunk-sxtgx8fj.js";import"./chunk-azcvwr5m.js";import"./chunk-t054j0zn.js";import"./chunk-trsaqsgv.js";import"./chunk-t5e5phth.js";import"./chunk-4w8d2mf0.js";export{Ea as deleteStaticSite,ji as deployStaticSite,va as deployStaticSiteFull,Vi as generateStaticSiteTemplate,Ki as invalidateCache,zi as uploadStaticFiles};

package/dist/{chunk-zhg1kvw3.js → chunk-f9pzjzye.js}

@@ -1,4 +1,4 @@
-import{fe,se,T,oe,or}from"./chunk-kfwg1c6q.js";import{a}from"./chunk-t5e5phth.js";import{y}from"./chunk-sxtgx8fj.js";import{h}from"./chunk-t054j0zn.js";import{f}from"./chunk-trsaqsgv.js";function ba(t){let{bucketName:s,domain:u,aliases:e,certificateArn:p,defaultRootObject:i="index.html",errorDocument:r="404.html",passthroughUrls:c=!1,singlePageApp:g=!1,dynamicApp:C=!1,computeOriginDomain:w,computeOriginPort:x=3008,computeOriginId:E="app-compute",retainOnStackDelete:M=!1}=t,S=M?{DeletionPolicy:"Retain",UpdateReplacePolicy:"Retain"}:{},N=C&&!!w,j=N?["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"]:["GET","HEAD"],v=N?["GET","HEAD"]:["GET","HEAD"],O={},B={};O.S3Bucket={Type:"AWS::S3::Bucket",...S,Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},B.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},B.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},O.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",...S,Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}};let I;if(c&&N)I="InstallRootRedirectFunction",O[I]={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-install-root-redirect"},AutoPublish:!0,FunctionConfig:{Comment:"Redirect curl pantry.dev | bash (GET /) to /install.sh on S3",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
+import{fe,se,T,oe,or}from"./chunk-azcvwr5m.js";import{a}from"./chunk-t5e5phth.js";import{y}from"./chunk-sxtgx8fj.js";import{h}from"./chunk-t054j0zn.js";import{f}from"./chunk-trsaqsgv.js";function ba(t){let{bucketName:s,domain:u,aliases:e,certificateArn:p,defaultRootObject:i="index.html",errorDocument:r="404.html",passthroughUrls:c=!1,singlePageApp:g=!1,dynamicApp:C=!1,computeOriginDomain:w,computeOriginPort:x=3008,computeOriginId:E="app-compute",retainOnStackDelete:M=!1}=t,S=M?{DeletionPolicy:"Retain",UpdateReplacePolicy:"Retain"}:{},N=C&&!!w,j=N?["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"]:["GET","HEAD"],v=N?["GET","HEAD"]:["GET","HEAD"],O={},B={};O.S3Bucket={Type:"AWS::S3::Bucket",...S,Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},B.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},B.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},O.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",...S,Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}};let I;if(c&&N)I="InstallRootRedirectFunction",O[I]={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-install-root-redirect"},AutoPublish:!0,FunctionConfig:{Comment:"Redirect curl pantry.dev | bash (GET /) to /install.sh on S3",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
   var request = event.request;
   if (request.uri === '/' || request.uri === '') {
     return {
@@ -42,7 +42,7 @@ import{fe,se,T,oe,or}from"./chunk-kfwg1c6q.js";import{a}from"./chunk-t5e5phth.js
 │                                                                             │
 │  Verification typically takes 1-2 business days.                            │
 │  After verification, re-run: bunx bunpress deploy                           │
-└─────────────────────────────────────────────────────────────────────────────┘`),{success:!1,stackId:B,stackName:i,bucket:N,message:"CloudFront account verification required. Please contact AWS Support."}}return{success:!1,stackId:B,stackName:i,bucket:N,message:`Stack deployment failed: ${o.message}`}}let d=(await r.describeStacks({stackName:i})).Stacks[0]?.Outputs||[],k=(o)=>d.find((n)=>n.OutputKey===o)?.OutputValue,A=k("DistributionDomain");if(A&&g)console.log(`Creating DNS records via ${g.name}...`),await H(g,e,A);else if(A&&!g)console.log("Skipping DNS record creation (DNS verification was skipped)");return{success:!0,stackId:B,stackName:i,bucket:k("BucketName")||N,distributionId:k("DistributionId"),distributionDomain:A,domain:e,certificateArn:C,message:"Static site infrastructure deployed successfully with external DNS"}}async function H(t,s,u){if(!t){console.log("Skipping DNS record creation (DNS verification was skipped)");return}if(s.split(".").length===2)if(t instanceof fe){console.log(`Creating Route53 alias record for apex domain ${s} -> ${u}`);let i=await t.createCloudFrontAlias({domain:s,name:s,cloudFrontDomainName:u});if(!i.success)console.warn(`Warning: Could not create Route53 alias record: ${i.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${s} -> ${u}`);else console.log(`Created Route53 alias record: ${s} -> ${u}`);let r=`www.${s}`;console.log(`Creating Route53 alias record for ${r} -> ${u}`);let c=await t.createCloudFrontAlias({domain:s,name:r,cloudFrontDomainName:u});if(!c.success)console.warn(`Warning: Could not create www Route53 alias: ${c.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${r} -> ${u}`);else console.log(`Created Route53 alias record: ${r} -> ${u}`)}else{try{let g=await t.listRecords(s,"A");if(g.success)for(let C of g.records){let w=C.name.replace(/\.$/,"");if(w===s||w==="")console.log(`Removing existing root A record (${C.content}) to make room for ALIAS...`),await t.deleteRecord(s,{name:s,type:"A",content:C.content})}}catch(g){console.log(`Note: Could not check for conflicting A records: ${g instanceof Error?g.message:g}`)}console.log(`Creating ALIAS record for apex domain ${s} -> ${u}`);let i=await t.upsertRecord(s,{name:s,type:"ALIAS",content:u,ttl:600});if(!i.success)console.warn(`Warning: Could not create ALIAS record: ${i.message}`),console.warn("Please manually create an ALIAS record in your DNS provider:"),console.warn(`  ${s} -> ${u}`);else console.log(`Created ALIAS record: ${s} -> ${u}`);let r=`www.${s}`;console.log(`Creating CNAME record for ${r} -> ${u}`);let c=await t.upsertRecord(s,{name:r,type:"CNAME",content:u,ttl:600});if(!c.success)console.warn(`Warning: Could not create www DNS record: ${c.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${r} -> ${u}`);else console.log(`Created CNAME record: ${r} -> ${u}`)}else{console.log(`Creating CNAME record for ${s} -> ${u}`);let i=await t.upsertRecord(s,{name:s,type:"CNAME",content:u,ttl:600});if(!i.success)console.warn(`Warning: Could not create DNS record: ${i.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${s} -> ${u}`);else console.log(`Created CNAME record: ${s} -> ${u}`)}}async function sn(t){let{sourceDir:s,cleanBucket:u=!1,onProgress:e,...p}=t;e?.("infrastructure","Deploying CloudFormation stack...");let i=await nn(p);if(!i.success)return i;if(u){e?.("clean","Cleaning old files from S3...");try{await new a(p.region||"us-east-1").emptyBucket(i.bucket)}catch(C){console.log(`Note: Could not clean bucket: ${C.message}`)}}e?.("upload","Uploading files to S3...");let{uploadStaticFiles:r}=await import("./chunk-2ke75pzn.js"),c=await r({sourceDir:s,bucket:i.bucket,region:p.region||"us-east-1",cacheControl:p.cacheControl,onProgress:(C,w,x)=>{e?.("upload",`${C}/${w}: ${x}`)}});if(c.errors.length>0)return{...i,success:!1,message:`Upload errors: ${c.errors.join(", ")}`,filesUploaded:c.uploaded};if(i.distributionId&&c.uploaded>0){e?.("invalidate","Invalidating CloudFront cache...");let{invalidateCache:C}=await import("./chunk-2ke75pzn.js");await C(i.distributionId)}e?.("complete","Deployment complete!");let g=c.skipped>0?`Deployed ${c.uploaded} files (${c.skipped} unchanged) with external DNS`:`Deployed ${c.uploaded} files successfully with external DNS`;return{...i,filesUploaded:c.uploaded,filesSkipped:c.skipped,message:g}}function Vi(t){let{bucketName:s,domain:u,certificateArn:e,hostedZoneId:p,defaultRootObject:i="index.html",errorDocument:r="404.html"}=t,c={},g={};c.S3Bucket={Type:"AWS::S3::Bucket",Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},g.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},g.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},c.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},c.UrlRewriteFunction={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-url-rewrite"},AutoPublish:!0,FunctionConfig:{Comment:"Append .html extension to URLs without extensions",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
+└─────────────────────────────────────────────────────────────────────────────┘`),{success:!1,stackId:B,stackName:i,bucket:N,message:"CloudFront account verification required. Please contact AWS Support."}}return{success:!1,stackId:B,stackName:i,bucket:N,message:`Stack deployment failed: ${o.message}`}}let d=(await r.describeStacks({stackName:i})).Stacks[0]?.Outputs||[],k=(o)=>d.find((n)=>n.OutputKey===o)?.OutputValue,A=k("DistributionDomain");if(A&&g)console.log(`Creating DNS records via ${g.name}...`),await H(g,e,A);else if(A&&!g)console.log("Skipping DNS record creation (DNS verification was skipped)");return{success:!0,stackId:B,stackName:i,bucket:k("BucketName")||N,distributionId:k("DistributionId"),distributionDomain:A,domain:e,certificateArn:C,message:"Static site infrastructure deployed successfully with external DNS"}}async function H(t,s,u){if(!t){console.log("Skipping DNS record creation (DNS verification was skipped)");return}if(s.split(".").length===2)if(t instanceof fe){console.log(`Creating Route53 alias record for apex domain ${s} -> ${u}`);let i=await t.createCloudFrontAlias({domain:s,name:s,cloudFrontDomainName:u});if(!i.success)console.warn(`Warning: Could not create Route53 alias record: ${i.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${s} -> ${u}`);else console.log(`Created Route53 alias record: ${s} -> ${u}`);let r=`www.${s}`;console.log(`Creating Route53 alias record for ${r} -> ${u}`);let c=await t.createCloudFrontAlias({domain:s,name:r,cloudFrontDomainName:u});if(!c.success)console.warn(`Warning: Could not create www Route53 alias: ${c.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${r} -> ${u}`);else console.log(`Created Route53 alias record: ${r} -> ${u}`)}else{try{let g=await t.listRecords(s,"A");if(g.success)for(let C of g.records){let w=C.name.replace(/\.$/,"");if(w===s||w==="")console.log(`Removing existing root A record (${C.content}) to make room for ALIAS...`),await t.deleteRecord(s,{name:s,type:"A",content:C.content})}}catch(g){console.log(`Note: Could not check for conflicting A records: ${g instanceof Error?g.message:g}`)}console.log(`Creating ALIAS record for apex domain ${s} -> ${u}`);let i=await t.upsertRecord(s,{name:s,type:"ALIAS",content:u,ttl:600});if(!i.success)console.warn(`Warning: Could not create ALIAS record: ${i.message}`),console.warn("Please manually create an ALIAS record in your DNS provider:"),console.warn(`  ${s} -> ${u}`);else console.log(`Created ALIAS record: ${s} -> ${u}`);let r=`www.${s}`;console.log(`Creating CNAME record for ${r} -> ${u}`);let c=await t.upsertRecord(s,{name:r,type:"CNAME",content:u,ttl:600});if(!c.success)console.warn(`Warning: Could not create www DNS record: ${c.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${r} -> ${u}`);else console.log(`Created CNAME record: ${r} -> ${u}`)}else{console.log(`Creating CNAME record for ${s} -> ${u}`);let i=await t.upsertRecord(s,{name:s,type:"CNAME",content:u,ttl:600});if(!i.success)console.warn(`Warning: Could not create DNS record: ${i.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${s} -> ${u}`);else console.log(`Created CNAME record: ${s} -> ${u}`)}}async function sn(t){let{sourceDir:s,cleanBucket:u=!1,onProgress:e,...p}=t;e?.("infrastructure","Deploying CloudFormation stack...");let i=await nn(p);if(!i.success)return i;if(u){e?.("clean","Cleaning old files from S3...");try{await new a(p.region||"us-east-1").emptyBucket(i.bucket)}catch(C){console.log(`Note: Could not clean bucket: ${C.message}`)}}e?.("upload","Uploading files to S3...");let{uploadStaticFiles:r}=await import("./chunk-epqpf6jd.js"),c=await r({sourceDir:s,bucket:i.bucket,region:p.region||"us-east-1",cacheControl:p.cacheControl,onProgress:(C,w,x)=>{e?.("upload",`${C}/${w}: ${x}`)}});if(c.errors.length>0)return{...i,success:!1,message:`Upload errors: ${c.errors.join(", ")}`,filesUploaded:c.uploaded};if(i.distributionId&&c.uploaded>0){e?.("invalidate","Invalidating CloudFront cache...");let{invalidateCache:C}=await import("./chunk-epqpf6jd.js");await C(i.distributionId)}e?.("complete","Deployment complete!");let g=c.skipped>0?`Deployed ${c.uploaded} files (${c.skipped} unchanged) with external DNS`:`Deployed ${c.uploaded} files successfully with external DNS`;return{...i,filesUploaded:c.uploaded,filesSkipped:c.skipped,message:g}}function Vi(t){let{bucketName:s,domain:u,certificateArn:e,hostedZoneId:p,defaultRootObject:i="index.html",errorDocument:r="404.html"}=t,c={},g={};c.S3Bucket={Type:"AWS::S3::Bucket",Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},g.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},g.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},c.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},c.UrlRewriteFunction={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-url-rewrite"},AutoPublish:!0,FunctionConfig:{Comment:"Append .html extension to URLs without extensions",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
   const request = event.request;
   var uri = request.uri;
 

package/dist/{chunk-2k1tc16d.js → chunk-jsffdsrf.js}

@@ -1,4 +1,4 @@
-import{nd,_,d,sd,O,p,de,g,Ft,ld,Js,gd,md,Ad,Mr,io,qt,yd,Id,wd,Rd}from"./chunk-b9pm7mbd.js";import{B,u}from"./chunk-xacvkpf8.js";import{ce,Bt,w,xt,s,ti,ws,br,wc,Rc,J,c,Ps,Ue,Er,Dc,_t,ks,Pc,vr,Bs,Tr,ii,$t,ci,di,Qe,Mt,Jc,Xc,ui,pi,lt,Vs,i,gi,zs,Ks}from"./chunk-dky93h4d.js";import{n,l}from"./chunk-4w8d2mf0.js";import{kt,a}from"./chunk-t5e5phth.js";import{sn}from"./chunk-zhg1kvw3.js";import{on,Kl,Wi,P,v,Ji,Wl}from"./chunk-jnt7ab86.js";import{pe,Xt,es,Xe,V,re,C,ge,er,Ze,rr}from"./chunk-bkv2p4hp.js";import{j}from"./chunk-1bxqrj7m.js";import{b,cr,hs,Dt,dr,ou,za,Le,it,Dn,k,Pt,_u,Nt,fr}from"./chunk-b2b79jtk.js";import{me}from"./chunk-srh0ctd4.js";import{y}from"./chunk-sxtgx8fj.js";import{ke}from"./chunk-cwjskpj4.js";import{Ce}from"./chunk-etmbw4er.js";import{f}from"./chunk-trsaqsgv.js";function Jr(e){let t=Mc(e.name),r=Ju(e.configText);if(ZS(e.configText,r.start,r.end,t))throw Error(`Site '${t}' already exists in cloud.config.ts`);let o=vm({...e,name:t}),m=e.configText.slice(0,r.end).trimEnd(),h=e.configText.slice(r.end),I=m.endsWith("{")?`
+import{nd,_,d,sd,O,p,de,g,Ft,ld,Js,gd,md,Ad,Mr,io,qt,yd,Id,wd,Rd}from"./chunk-b9pm7mbd.js";import{B,u}from"./chunk-xacvkpf8.js";import{ce,Bt,w,xt,s,ti,ws,br,wc,Rc,J,c,Ps,Ue,Er,Dc,_t,ks,Pc,vr,Bs,Tr,ii,$t,ci,di,Qe,Mt,Jc,Xc,ui,pi,lt,Vs,i,gi,zs,Ks}from"./chunk-dky93h4d.js";import{n,l}from"./chunk-4w8d2mf0.js";import{kt,a}from"./chunk-t5e5phth.js";import{sn}from"./chunk-f9pzjzye.js";import{on,Kl,Wi,P,v,Ji,Wl}from"./chunk-jnt7ab86.js";import{pe,Xt,es,Xe,V,re,C,ge,er,Ze,rr}from"./chunk-bkv2p4hp.js";import{j}from"./chunk-1bxqrj7m.js";import{b,cr,hs,Dt,dr,ou,za,Le,it,Dn,k,Pt,_u,Nt,fr}from"./chunk-7vnj4b37.js";import{me}from"./chunk-srh0ctd4.js";import{y}from"./chunk-sxtgx8fj.js";import{ke}from"./chunk-cwjskpj4.js";import{Ce}from"./chunk-etmbw4er.js";import{f}from"./chunk-trsaqsgv.js";function Jr(e){let t=Mc(e.name),r=Ju(e.configText);if(ZS(e.configText,r.start,r.end,t))throw Error(`Site '${t}' already exists in cloud.config.ts`);let o=vm({...e,name:t}),m=e.configText.slice(0,r.end).trimEnd(),h=e.configText.slice(r.end),I=m.endsWith("{")?`
 `:m.endsWith(",")?`
 
 `:`,