@stacksjs/ts-cloud 0.15.1 → 0.16.0

package/dist/{chunk-b2b79jtk.js → chunk-7vnj4b37.js}

@@ -539,22 +539,22 @@ console.log(JSON.stringify({
 `);r.push("write_files:","  - path: /var/lib/cloud/box-bootstrap.sh","    permissions: '0755'","    owner: root:root","    content: |",s)}if(r.push("runcmd:",`  - mkdir -p /root/.ssh && grep -qF "${t}" /root/.ssh/authorized_keys 2>/dev/null || echo "${t}" >> /root/.ssh/authorized_keys`),e.bootstrapScript)r.push("  - [ bash, /var/lib/cloud/box-bootstrap.sh ]");return`${r.join(`
 `)}
 `}function Vc(e=[]){let t=[{direction:"in",protocol:"tcp",port:"22",source_ips:["0.0.0.0/0","::/0"],description:"SSH"}];for(let r of e)t.push({direction:"in",protocol:r.protocol,...r.protocol==="icmp"?{}:{port:String(r.port)},source_ips:["0.0.0.0/0","::/0"]});return t}class oc{client;provider="hetzner";constructor(e){this.client=e}async ensureBox(e){let t=await $n(this.client,{name:`${e.name}-key`,publicKey:e.sshPublicKey}),r=await Mn(this.client,{name:`${e.name}-fw`,rules:Vc(e.ports)}),{server:n,created:s}=await Un(this.client,{name:e.name,serverType:e.size,image:e.image??"ubuntu-24.04",location:e.location,sshKeys:[t.id],firewalls:[{firewall:r.id}],userData:sc(e),labels:e.labels});return{provider:"hetzner",id:String(n.id),name:n.name,publicIp:Qn(n),created:s}}async destroyBox(e){let t=[],r=(await this.client.listServers()).find((s)=>s.name===e);if(r){let s=await this.client.deleteServer(r.id);await this.client.waitForAction(s.id).catch(()=>{}),t.push(`server ${e} (#${r.id})`)}let n=(await this.client.listFirewalls()).find((s)=>s.name===`${e}-fw`);if(n)for(let s=0;s<10;s++)try{await this.client.deleteFirewall(n.id),t.push(`firewall ${e}-fw (#${n.id})`);break}catch{if(s===9)break;await new Promise((i)=>setTimeout(i,3000))}return{destroyed:t}}}function qc(e=[]){let t=[{IpProtocol:"tcp",FromPort:22,ToPort:22,IpRanges:[{CidrIp:"0.0.0.0/0",Description:"SSH"}]}];for(let r of e)t.push(r.protocol==="icmp"?{IpProtocol:"icmp",FromPort:-1,ToPort:-1,IpRanges:[{CidrIp:"0.0.0.0/0"}]}:{IpProtocol:r.protocol,FromPort:r.port,ToPort:r.port,IpRanges:[{CidrIp:"0.0.0.0/0"}]});return t}class ac{provider="aws";ec2;ssm;constructor(e){this.ec2=e.ec2,this.ssm=e.ssm}async findInstance(e,t){return(await this.ec2.describeInstances({Filters:[{Name:"tag:Name",Values:[e]},{Name:"instance-state-name",Values:t}]})).Reservations?.flatMap((n)=>n.Instances??[])[0]}async waitForPublicIp(e,t=300000){let r=Date.now();while(Date.now()-r<t){let n=await this.ec2.getInstance(e);if(n?.State?.Name==="running"&&n.PublicIpAddress)return n;await new Promise((s)=>setTimeout(s,5000))}throw Error(`EC2 instance ${e} did not reach running with a public IP within ${t}ms`)}async ensureSecurityGroup(e){let t=`${e.name}-sg`,n=(await this.ec2.describeSecurityGroups({Filters:[{Name:"group-name",Values:[t]}]})).SecurityGroups?.[0]?.GroupId;if(n)return n;let s=await this.ec2.createSecurityGroup({GroupName:t,Description:`box ${e.name} (managed by ts-cloud box-provision)`});if(!s.GroupId)throw Error(`could not create security group ${t}`);return await this.ec2.authorizeSecurityGroupIngress({GroupId:s.GroupId,IpPermissions:qc(e.ports)}),s.GroupId}async resolveImage(e){if(e.image?.startsWith("ami-"))return e.image;let r=(await this.ssm.getParameter({Name:ic})).Parameter?.Value;if(!r)throw Error(`could not resolve the Ubuntu 24.04 AMI via SSM (${ic})`);return r}async ensureBox(e){let t=await this.findInstance(e.name,["pending","running"]);if(t?.InstanceId){let l=await this.waitForPublicIp(t.InstanceId);return{provider:"aws",id:l.InstanceId,name:e.name,publicIp:l.PublicIpAddress,created:!1}}let[r,n]=await Promise.all([this.ensureSecurityGroup(e),this.resolveImage(e)]),s=[{Key:"Name",Value:e.name},...Object.entries(e.labels??{}).map(([l,m])=>({Key:l,Value:m}))],o=(await this.ec2.runInstances({ImageId:n,InstanceType:e.size,MinCount:1,MaxCount:1,SecurityGroupIds:[r],UserData:Buffer.from(sc(e),"utf8").toString("base64"),TagSpecifications:[{ResourceType:"instance",Tags:s}]})).Instances?.[0]?.InstanceId;if(!o)throw Error(`RunInstances returned no instance for box ${e.name}`);let c=await this.waitForPublicIp(o);return{provider:"aws",id:o,name:e.name,publicIp:c.PublicIpAddress,created:!0}}async destroyBox(e){let t=[],r=await this.findInstance(e,["pending","running","stopping","stopped"]);if(r?.InstanceId){await this.ec2.terminateInstances([r.InstanceId]),t.push(`instance ${e} (${r.InstanceId})`);let i=Date.now();while(Date.now()-i<300000){let o=await this.ec2.getInstance(r.InstanceId);if(!o||o.State?.Name==="terminated")break;await new Promise((c)=>setTimeout(c,5000))}}let s=(await this.ec2.describeSecurityGroups({Filters:[{Name:"group-name",Values:[`${e}-sg`]}]})).SecurityGroups?.[0]?.GroupId;if(s)for(let i=0;i<10;i++)try{await this.ec2.deleteSecurityGroup(s),t.push(`security group ${e}-sg (${s})`);break}catch{if(i===9)break;await new Promise((o)=>setTimeout(o,3000))}return{destroyed:t}}}function rh(e){if(e.provider==="hetzner"){if(!e.hetzner)throw Error('createBoxProvisioner: options.hetzner (a HetznerClient) is required for provider "hetzner"');return new oc(e.hetzner)}if(!e.aws)throw Error('createBoxProvisioner: options.aws ({ ec2, ssm }) is required for provider "aws"');return new ac(e.aws)}function Jt(e){return Object.entries(e).map(([t,r])=>`${t}=${Wc(String(r))}`).join(`
-`)}function Wc(e){return`"${e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"").replace(/\n/g,"\\n").replace(/\r/g,"\\r").replace(/\t/g,"\\t")}"`}var Qt=["storage",".env"],Tt=4;function Ve(e){return`${e.replace(/\/+$/,"")}/.ts-cloud`}function Xc(e){return`${Ve(e)}/deploy-history.log`}function Yc(e,t){return`${Ve(e)}/deploys/${t}.log`}function oi(e){return`${Ve(e)}/shared-paths`}function Pt(e,t){let r=e.replace(/\/+$/,"");return{base:r,releases:`${r}/releases`,shared:`${r}/shared`,current:`${r}/current`,release:`${r}/releases/${t}`}}function ai(e){let t=e.split("/").pop()||e;if(t===".env"||t.startsWith(".env."))return!0;return/\.[a-z0-9]+$/i.test(t)}function Xr(e){return typeof e==="string"?e:e.path}function ci(e){let t=new Map;for(let r of e)t.set(Xr(r),r);return[...t.values()]}function li(e,t){if(typeof t==="string")return{path:t,target:`${e.shared}/${t}`,seed:!0};return{path:t.path,target:t.target??`${e.shared}/${t.path}`,seed:t.seed!==!1}}function Jc(e){return["ts_cloud_adopt_shared() {",'  TS_CLOUD_SP="$1"','  TS_CLOUD_DST="$2"',`  TS_CLOUD_SRC="${e.current}/$TS_CLOUD_SP"`,'  if [ -e "$TS_CLOUD_DST" ]; then return 0; fi','  if [ -L "$TS_CLOUD_SRC" ] || [ ! -e "$TS_CLOUD_SRC" ]; then return 0; fi','  mkdir -p "$(dirname "$TS_CLOUD_DST")"','  cp -a "$TS_CLOUD_SRC" "$TS_CLOUD_DST"',"  for TS_CLOUD_SIDECAR in -wal -shm; do",'    if [ -f "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" ]; then cp -a "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" "$TS_CLOUD_DST$TS_CLOUD_SIDECAR"; fi',"  done",'  echo "[ts-cloud] adopted $TS_CLOUD_SP from the live release into shared/ — it now survives deploys"',"  return 0","}"]}function Ct(e,t=Qt){let r=[`mkdir -p ${e.releases} ${e.shared}`,...Jc(e)],n=t.map((i)=>li(e,i));for(let{path:i,target:o,seed:c}of n){if(!c)continue;if(r.push(`ts_cloud_adopt_shared '${i}' '${o}'`),ai(i))r.push(`mkdir -p "$(dirname ${o})"`,`touch ${o}`);else if(i==="storage")r.push(`mkdir -p ${o}/app/public`,`mkdir -p ${o}/framework/cache/data`,`mkdir -p ${o}/framework/sessions`,`mkdir -p ${o}/framework/testing`,`mkdir -p ${o}/framework/views`,`mkdir -p ${o}/logs`);else r.push(`mkdir -p ${o}`)}let s=oi(e.base);return r.push(`mkdir -p ${Ve(e.base)}`,`cat > ${s} <<'TS_CLOUD_SHARED_PATHS_EOF'`,...n.map((i)=>`${i.path}	${i.target}`),"TS_CLOUD_SHARED_PATHS_EOF"),r}function Yr(e,t=900){let r=`${Ve(e.base)}/deploy.lock`;return[`mkdir -p "$(dirname ${r})"`,`exec 9>${r}`,`flock -w ${t} 9 || { echo "[ts-cloud] another deploy of this site has held the lock for ${t}s — refusing to race it" >&2; exit 1; }`]}function Jr(e){let t=`${e.release}.incoming`;return[`rm -rf ${t}`,`mkdir -p ${t}`,...Qc(e),'if [ "$TS_CLOUD_IS_LIVE" = "yes" ]; then',`  TS_CLOUD_STAGED=${t}`,"else",`  rm -rf ${e.release}`,`  mkdir -p ${e.release}`,`  rmdir ${t}`,`  TS_CLOUD_STAGED=${e.release}`,"fi"]}function Qr(e){let t=`TS_CLOUD_TRAP_LIVE="$(readlink -f ${e.current} 2>/dev/null || true)"`,r=`TS_CLOUD_TRAP_TARGET="$(readlink -f ${e.release} 2>/dev/null || echo ${e.release})"`;return`trap '${`if [ $? -ne 0 ]; then ${t}; ${r}; [ "$TS_CLOUD_TRAP_LIVE" = "$TS_CLOUD_TRAP_TARGET" ] || rm -rf ${e.release}; fi`}' EXIT`}function Qc(e){return[`TS_CLOUD_LIVE_PATH="$(readlink -f ${e.current} 2>/dev/null || true)"`,`TS_CLOUD_RELEASE_PATH="$(readlink -f ${e.release} 2>/dev/null || echo ${e.release})"`,'if [ -n "$TS_CLOUD_LIVE_PATH" ] && [ "$TS_CLOUD_LIVE_PATH" = "$TS_CLOUD_RELEASE_PATH" ]; then TS_CLOUD_IS_LIVE=yes; else TS_CLOUD_IS_LIVE=no; fi']}function Zr(e){let t=`${e.release}.incoming`;return[`if [ "$TS_CLOUD_STAGED" = "${t}" ]; then`,`  rm -rf ${e.release}.previous`,`  mv ${e.release} ${e.release}.previous`,`  mv ${t} ${e.release}`,`  rm -rf ${e.release}.previous`,"fi"]}function Zc(e,t){return[`if [ -f ${e} ] && [ ! -L ${e} ] && [ -s ${e} ] && [ ! -s ${t} ]; then`,`  cp -a ${e} ${t}`,`  echo "[ts-cloud] seeded shared/ from the release's own copy of the file"`,"fi"]}function Zt(e,t=Qt){let r=[];for(let n of t){let{path:s,target:i,seed:o}=li(e,n),c=`${e.release}/${s}`,l=[`rm -rf ${c}`,`mkdir -p "$(dirname ${c})"`,`ln -sfn ${i} ${c}`];if(o){if(s!==".env"&&ai(s))r.push(...Zc(c,i));r.push(...l);continue}r.push(`if [ -e ${i} ]; then`,...l.map((m)=>`  ${m}`),"fi")}return r}function ii(e,t){let r=oi(e.base);return[`if [ -f ${r} ]; then`,'  while IFS="\t" read -r TS_CLOUD_SP TS_CLOUD_TGT; do','    [ -n "$TS_CLOUD_SP" ] || continue',`    [ -n "$TS_CLOUD_TGT" ] || TS_CLOUD_TGT="${e.shared}/$TS_CLOUD_SP"`,'    [ -e "$TS_CLOUD_TGT" ] || continue',`    rm -rf ${t}/"$TS_CLOUD_SP"`,`    mkdir -p "$(dirname ${t}/"$TS_CLOUD_SP")"`,`    ln -sfn "$TS_CLOUD_TGT" ${t}/"$TS_CLOUD_SP"`,`  done < ${r}`,"fi"]}function dt(e){return[`ln -sfn ${e.release} ${e.current}.tmp`,`mv -Tf ${e.current}.tmp ${e.current}`]}function _u(e,t={}){let r=t.to?[`[ -d ${e.releases}/${t.to} ] || { echo "rollback target ${e.releases}/${t.to} not found" >&2; exit 1; }`,...ii(e,`${e.releases}/${t.to}`),`ln -sfn ${e.releases}/${t.to} ${e.current}.tmp`,`mv -Tf ${e.current}.tmp ${e.current}`]:[`TS_CLOUD_CURRENT=$(readlink -f ${e.current} 2>/dev/null || true)`,`TS_CLOUD_PREV=$(ls -1dt ${e.releases}/*/ 2>/dev/null | sed 's#/$##' | while read -r r; do [ "$(readlink -f "$r")" != "$TS_CLOUD_CURRENT" ] && { echo "$r"; break; }; done)`,'[ -n "$TS_CLOUD_PREV" ] || { echo "no previous release to roll back to" >&2; exit 1; }',...ii(e,'"$TS_CLOUD_PREV"'),`ln -sfn "$TS_CLOUD_PREV" ${e.current}.tmp`,`mv -Tf ${e.current}.tmp ${e.current}`,'echo "rolled back to $TS_CLOUD_PREV"'];if(!t.unitBase)return r;let n=t.unitBase;return[...r,`TS_CLOUD_RB_ID=$(basename "$(readlink -f ${e.current})")`,`if [ -f /etc/systemd/system/${n}@.service ]; then systemctl start "${n}@\${TS_CLOUD_RB_ID}.service"; sleep 2; systemctl is-active --quiet "${n}@\${TS_CLOUD_RB_ID}.service" || { echo "rolled-back release failed to start" >&2; exit 1; }; systemctl enable "${n}@\${TS_CLOUD_RB_ID}.service" 2>/dev/null || true; systemctl list-units --plain --no-legend --type=service "${n}@*.service" 2>/dev/null | awk '{print $1}' | { grep -v "^${n}@\${TS_CLOUD_RB_ID}.service$" || true; } | while read -r TS_CLOUD_U; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done; elif [ -f /etc/systemd/system/${n}.service ]; then systemctl restart ${n}.service; fi`]}function mt(e,t=4){let r=Math.max(1,t);return[`TS_CLOUD_CURRENT=$(readlink -f ${e.current} 2>/dev/null || true)`,`ls -1dt ${e.releases}/*/ 2>/dev/null | sed 's#/$##' | tail -n +${r+1} | while read -r TS_CLOUD_OLD; do`,'  [ "$(readlink -f "$TS_CLOUD_OLD")" = "$TS_CLOUD_CURRENT" ] || rm -rf "$TS_CLOUD_OLD"',"done"]}function el(e){return`${Ve(e)}/owner`}function en(e,t){let r=el(e);return[`if [ -f "${r}" ]; then`,`  TS_CLOUD_OWNER=$(cat "${r}")`,`  if [ "$TS_CLOUD_OWNER" != "${t}" ]; then`,`    echo "[ts-cloud] REFUSING deploy: ${e} belongs to project '$TS_CLOUD_OWNER', not '${t}'. Another project on this box derives the same site key — give one of them a distinct site name/domain, or remove ${r} to transfer ownership." >&2`,"    exit 1","  fi","else",`  mkdir -p "$(dirname "${r}")"`,`  printf '%s\\n' "${t}" > "${r}"`,"fi"]}function er(e,t){let r=Ve(e),n=Yc(e,t.releaseId),s=Xc(e),i=Math.max(1,t.keepLogs??20),o=t.commit||"",c=t.branch||"";return[`mkdir -p ${r}/deploys`,`exec > >(tee -a ${n}) 2>&1`,`echo "[ts-cloud] deploy ${t.releaseId} commit=${o} branch=${c} starting $(date -u +%Y-%m-%dT%H:%M:%SZ)"`,"ts_cloud_record_deploy() {","  TS_CLOUD_RC=$?",'  if [ "$TS_CLOUD_RC" -eq 0 ]; then TS_CLOUD_ST=success; else TS_CLOUD_ST=failed; fi',`  printf '%s\\t%s\\t%s\\t%s\\trc=%s\\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "${t.releaseId}" "${o}" "$TS_CLOUD_ST" "$TS_CLOUD_RC" >> ${s}`,"}","trap ts_cloud_record_deploy EXIT",`ls -1t ${r}/deploys/*.log 2>/dev/null | tail -n +${i+1} | while read -r TS_CLOUD_OLDLOG; do rm -f "$TS_CLOUD_OLDLOG"; done`]}var tl=new Set(["sqlite","sqlite3"]),rl=new Set([":memory:","memory"]);function nl(e){let t=e?.DB_CONNECTION?.trim().toLowerCase();return t!=null&&tl.has(t)}function sl(e){let t=e.trim().replace(/^\.\//,"");if(t===""||t.startsWith("/")||t.startsWith("~"))return;if(t.split("/").includes(".."))return;return t.replace(/\/+$/,"")}function tn(e,t=[]){if(!nl(e))return{};let r=e?.DB_DATABASE?.trim();if(r&&rl.has(r.toLowerCase()))return{};if(!r)return{warning:"DB_CONNECTION is sqlite but DB_DATABASE names no file, so ts-cloud cannot tell where the database lives. If it is written inside the release directory, the next deploy discards it. Set DB_DATABASE, or list the file in the site's `sharedPaths`."};let n=sl(r);if(!n)return{};if(t.some((s)=>Xr(s)===n))return{};return{path:n}}function tr(e,t=[]){let{path:r}=tn(e,t);return r?[r]:[]}function Hn(e,t){let r=t==="bun"?"/usr/local/bin/bun":t==="deno"?"/usr/local/bin/deno":"/usr/local/bin/node",n=e.replace(/^(bun|node|deno)\s+/,"");return`${r} ${n}`}function ui(e){return["TS_CLOUD_MEM_MB=$(awk '/^MemTotal:/{print int($2/1024)}' /proc/meminfo)","TS_CLOUD_HIGH_MB=$((TS_CLOUD_MEM_MB / 8))",'[ "$TS_CLOUD_HIGH_MB" -lt 512 ] && TS_CLOUD_HIGH_MB=512','[ "$TS_CLOUD_HIGH_MB" -gt 4096 ] && TS_CLOUD_HIGH_MB=4096',`mkdir -p /etc/systemd/system/${e}.d`,`printf '# Written by ts-cloud: memoryHigh resolved from this box.
+`)}function Wc(e){return`"${e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"").replace(/\n/g,"\\n").replace(/\r/g,"\\r").replace(/\t/g,"\\t")}"`}var Qt=["storage",".env"],Tt=4;function Ve(e){return`${e.replace(/\/+$/,"")}/.ts-cloud`}function Xc(e){return`${Ve(e)}/deploy-history.log`}function Yc(e,t){return`${Ve(e)}/deploys/${t}.log`}function oi(e){return`${Ve(e)}/shared-paths`}function Pt(e,t){let r=e.replace(/\/+$/,"");return{base:r,releases:`${r}/releases`,shared:`${r}/shared`,current:`${r}/current`,release:`${r}/releases/${t}`}}function ai(e){let t=e.split("/").pop()||e;if(t===".env"||t.startsWith(".env."))return!0;return/\.[a-z0-9]+$/i.test(t)}function Xr(e){return typeof e==="string"?e:e.path}function ci(e){let t=new Map;for(let r of e)t.set(Xr(r),r);return[...t.values()]}function li(e,t){if(typeof t==="string")return{path:t,target:`${e.shared}/${t}`,seed:!0};return{path:t.path,target:t.target??`${e.shared}/${t.path}`,seed:t.seed!==!1}}function Jc(e){return["ts_cloud_adopt_shared() {",'  TS_CLOUD_SP="$1"','  TS_CLOUD_DST="$2"',`  TS_CLOUD_SRC="${e.current}/$TS_CLOUD_SP"`,'  if [ -e "$TS_CLOUD_DST" ]; then return 0; fi','  if [ -L "$TS_CLOUD_SRC" ] || [ ! -e "$TS_CLOUD_SRC" ]; then return 0; fi','  mkdir -p "$(dirname "$TS_CLOUD_DST")"','  cp -a "$TS_CLOUD_SRC" "$TS_CLOUD_DST"',"  for TS_CLOUD_SIDECAR in -wal -shm; do",'    if [ -f "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" ]; then cp -a "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" "$TS_CLOUD_DST$TS_CLOUD_SIDECAR"; fi',"  done",'  echo "[ts-cloud] adopted $TS_CLOUD_SP from the live release into shared/ — it now survives deploys"',"  return 0","}"]}function Ct(e,t=Qt){let r=[`mkdir -p ${e.releases} ${e.shared}`,...Jc(e)],n=t.map((i)=>li(e,i));for(let{path:i,target:o,seed:c}of n){if(!c)continue;if(r.push(`ts_cloud_adopt_shared '${i}' '${o}'`),ai(i))r.push(`mkdir -p "$(dirname ${o})"`,`touch ${o}`);else if(i==="storage")r.push(`mkdir -p ${o}/app/public`,`mkdir -p ${o}/framework/cache/data`,`mkdir -p ${o}/framework/sessions`,`mkdir -p ${o}/framework/testing`,`mkdir -p ${o}/framework/views`,`mkdir -p ${o}/logs`);else r.push(`mkdir -p ${o}`)}let s=oi(e.base);return r.push(`mkdir -p ${Ve(e.base)}`,`cat > ${s} <<'TS_CLOUD_SHARED_PATHS_EOF'`,...n.map((i)=>`${i.path}	${i.target}`),"TS_CLOUD_SHARED_PATHS_EOF"),r}function Yr(e,t=900){let r=`${Ve(e.base)}/deploy.lock`;return[`mkdir -p "$(dirname ${r})"`,`exec 9>${r}`,`flock -w ${t} 9 || { echo "[ts-cloud] another deploy of this site has held the lock for ${t}s — refusing to race it" >&2; exit 1; }`]}function Jr(e){let t=`${e.release}.incoming`;return[`rm -rf ${t}`,`mkdir -p ${t}`,...Qc(e),'if [ "$TS_CLOUD_IS_LIVE" = "yes" ]; then',`  TS_CLOUD_STAGED=${t}`,"else",`  rm -rf ${e.release}`,`  mkdir -p ${e.release}`,`  rmdir ${t}`,`  TS_CLOUD_STAGED=${e.release}`,"fi"]}function Qr(e){let t=`TS_CLOUD_TRAP_LIVE="$(readlink -f ${e.current} 2>/dev/null || true)"`,r=`TS_CLOUD_TRAP_TARGET="$(readlink -f ${e.release} 2>/dev/null || echo ${e.release})"`;return`trap '${`if [ $? -ne 0 ]; then ${t}; ${r}; [ "$TS_CLOUD_TRAP_LIVE" = "$TS_CLOUD_TRAP_TARGET" ] || rm -rf ${e.release}; fi`}' EXIT`}function Qc(e){return[`TS_CLOUD_LIVE_PATH="$(readlink -f ${e.current} 2>/dev/null || true)"`,`TS_CLOUD_RELEASE_PATH="$(readlink -f ${e.release} 2>/dev/null || echo ${e.release})"`,'if [ -n "$TS_CLOUD_LIVE_PATH" ] && [ "$TS_CLOUD_LIVE_PATH" = "$TS_CLOUD_RELEASE_PATH" ]; then TS_CLOUD_IS_LIVE=yes; else TS_CLOUD_IS_LIVE=no; fi']}function Zr(e){let t=`${e.release}.incoming`;return[`if [ "$TS_CLOUD_STAGED" = "${t}" ]; then`,`  rm -rf ${e.release}.previous`,`  mv ${e.release} ${e.release}.previous`,`  mv ${t} ${e.release}`,`  rm -rf ${e.release}.previous`,"fi"]}function Zc(e,t){return[`if [ -f ${e} ] && [ ! -L ${e} ] && [ -s ${e} ] && [ ! -s ${t} ]; then`,`  cp -a ${e} ${t}`,`  echo "[ts-cloud] seeded shared/ from the release's own copy of the file"`,"fi"]}function Zt(e,t=Qt){let r=[];for(let n of t){let{path:s,target:i,seed:o}=li(e,n),c=`${e.release}/${s}`,l=[`rm -rf ${c}`,`mkdir -p "$(dirname ${c})"`,`ln -sfn ${i} ${c}`];if(o){if(s!==".env"&&ai(s))r.push(...Zc(c,i));r.push(...l);continue}r.push(`if [ -e ${i} ]; then`,...l.map((m)=>`  ${m}`),"fi")}return r}function ii(e,t){let r=oi(e.base);return[`if [ -f ${r} ]; then`,'  while IFS="\t" read -r TS_CLOUD_SP TS_CLOUD_TGT; do','    [ -n "$TS_CLOUD_SP" ] || continue',`    [ -n "$TS_CLOUD_TGT" ] || TS_CLOUD_TGT="${e.shared}/$TS_CLOUD_SP"`,'    [ -e "$TS_CLOUD_TGT" ] || continue',`    rm -rf ${t}/"$TS_CLOUD_SP"`,`    mkdir -p "$(dirname ${t}/"$TS_CLOUD_SP")"`,`    ln -sfn "$TS_CLOUD_TGT" ${t}/"$TS_CLOUD_SP"`,`  done < ${r}`,"fi"]}function dt(e){return[`ln -sfn ${e.release} ${e.current}.tmp`,`mv -Tf ${e.current}.tmp ${e.current}`]}function _u(e,t={}){let r=t.to?[`[ -d ${e.releases}/${t.to} ] || { echo "rollback target ${e.releases}/${t.to} not found" >&2; exit 1; }`,...ii(e,`${e.releases}/${t.to}`),`ln -sfn ${e.releases}/${t.to} ${e.current}.tmp`,`mv -Tf ${e.current}.tmp ${e.current}`]:[`TS_CLOUD_CURRENT=$(readlink -f ${e.current} 2>/dev/null || true)`,`TS_CLOUD_PREV=$(ls -1dt ${e.releases}/*/ 2>/dev/null | sed 's#/$##' | while read -r r; do [ "$(readlink -f "$r")" != "$TS_CLOUD_CURRENT" ] && { echo "$r"; break; }; done)`,'[ -n "$TS_CLOUD_PREV" ] || { echo "no previous release to roll back to" >&2; exit 1; }',...ii(e,'"$TS_CLOUD_PREV"'),`ln -sfn "$TS_CLOUD_PREV" ${e.current}.tmp`,`mv -Tf ${e.current}.tmp ${e.current}`,'echo "rolled back to $TS_CLOUD_PREV"'];if(!t.unitBase)return r;let n=t.unitBase;return[...r,`TS_CLOUD_RB_ID=$(basename "$(readlink -f ${e.current})")`,`if [ -f /etc/systemd/system/${n}@.service ]; then systemctl start "${n}@\${TS_CLOUD_RB_ID}.service"; sleep 2; systemctl is-active --quiet "${n}@\${TS_CLOUD_RB_ID}.service" || { echo "rolled-back release failed to start" >&2; exit 1; }; systemctl enable "${n}@\${TS_CLOUD_RB_ID}.service" 2>/dev/null || true; systemctl list-units --plain --no-legend --type=service "${n}@*.service" 2>/dev/null | awk '{print $1}' | { grep -v "^${n}@\${TS_CLOUD_RB_ID}.service$" || true; } | while read -r TS_CLOUD_U; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done; elif [ -f /etc/systemd/system/${n}.service ]; then systemctl restart ${n}.service; fi`]}function mt(e,t=4){let r=Math.max(1,t);return[`TS_CLOUD_CURRENT=$(readlink -f ${e.current} 2>/dev/null || true)`,`ls -1dt ${e.releases}/*/ 2>/dev/null | sed 's#/$##' | tail -n +${r+1} | while read -r TS_CLOUD_OLD; do`,'  [ "$(readlink -f "$TS_CLOUD_OLD")" = "$TS_CLOUD_CURRENT" ] || rm -rf "$TS_CLOUD_OLD"',"done"]}function el(e){return`${Ve(e)}/owner`}function en(e,t){let r=el(e);return[`if [ -f "${r}" ]; then`,`  TS_CLOUD_OWNER=$(cat "${r}")`,`  if [ "$TS_CLOUD_OWNER" != "${t}" ]; then`,`    echo "[ts-cloud] REFUSING deploy: ${e} belongs to project '$TS_CLOUD_OWNER', not '${t}'. Another project on this box derives the same site key — give one of them a distinct site name/domain, or remove ${r} to transfer ownership." >&2`,"    exit 1","  fi","else",`  mkdir -p "$(dirname "${r}")"`,`  printf '%s\\n' "${t}" > "${r}"`,"fi"]}function er(e,t){let r=Ve(e),n=Yc(e,t.releaseId),s=Xc(e),i=Math.max(1,t.keepLogs??20),o=t.commit||"",c=t.branch||"";return[`mkdir -p ${r}/deploys`,`exec > >(tee -a ${n}) 2>&1`,`echo "[ts-cloud] deploy ${t.releaseId} commit=${o} branch=${c} starting $(date -u +%Y-%m-%dT%H:%M:%SZ)"`,"ts_cloud_record_deploy() {","  TS_CLOUD_RC=$?",'  if [ "$TS_CLOUD_RC" -eq 0 ]; then TS_CLOUD_ST=success; else TS_CLOUD_ST=failed; fi',`  printf '%s\\t%s\\t%s\\t%s\\trc=%s\\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "${t.releaseId}" "${o}" "$TS_CLOUD_ST" "$TS_CLOUD_RC" >> ${s}`,"}","trap ts_cloud_record_deploy EXIT",`ls -1t ${r}/deploys/*.log 2>/dev/null | tail -n +${i+1} | while read -r TS_CLOUD_OLDLOG; do rm -f "$TS_CLOUD_OLDLOG"; done`]}var tl=new Set(["sqlite","sqlite3"]),rl=new Set([":memory:","memory"]);function nl(e){let t=e?.DB_CONNECTION?.trim().toLowerCase();return t!=null&&tl.has(t)}function sl(e){let t=e.trim().replace(/^\.\//,"");if(t===""||t.startsWith("/")||t.startsWith("~"))return;if(t.split("/").includes(".."))return;return t.replace(/\/+$/,"")}function tn(e,t=[]){if(!nl(e))return{};let r=e?.DB_DATABASE?.trim();if(r&&rl.has(r.toLowerCase()))return{};if(!r)return{warning:"DB_CONNECTION is sqlite but DB_DATABASE names no file, so ts-cloud cannot tell where the database lives. If it is written inside the release directory, the next deploy discards it. Set DB_DATABASE, or list the file in the site's `sharedPaths`."};let n=sl(r);if(!n)return{};if(t.some((s)=>Xr(s)===n))return{};return{path:n}}function tr(e,t=[]){let{path:r}=tn(e,t);return r?[r]:[]}var il=/\.(?:[cm]?[jt]sx?)$/;function Hn(e,t,r){let n=t==="bun"?"/usr/local/bin/bun":t==="deno"?"/usr/local/bin/deno":"/usr/local/bin/node",s=e.trim();if(/^(?:bun|node|deno)\s+/.test(s))return`${n} ${s.replace(/^(?:bun|node|deno)\s+/,"")}`;let[i="",...o]=s.split(/\s+/);if(i&&!il.test(i)){let c=i.startsWith("/")?i:r&&i.startsWith("./")?`${r.replace(/\/+$/,"")}/${i.replace(/^\.\//,"")}`:void 0;if(c)return[c,...o].join(" ")}return`${n} ${s}`}function ui(e){return["TS_CLOUD_MEM_MB=$(awk '/^MemTotal:/{print int($2/1024)}' /proc/meminfo)","TS_CLOUD_HIGH_MB=$((TS_CLOUD_MEM_MB / 8))",'[ "$TS_CLOUD_HIGH_MB" -lt 512 ] && TS_CLOUD_HIGH_MB=512','[ "$TS_CLOUD_HIGH_MB" -gt 4096 ] && TS_CLOUD_HIGH_MB=4096',`mkdir -p /etc/systemd/system/${e}.d`,`printf '# Written by ts-cloud: memoryHigh resolved from this box.
 # An eighth of %sMB RAM. Set memoryHigh in config to override.
 [Service]
 MemoryAccounting=true
 MemoryHigh=%sM
-' "$TS_CLOUD_MEM_MB" "$TS_CLOUD_HIGH_MB" > /etc/systemd/system/${e}.d/50-ts-cloud-memory.conf`,"systemctl daemon-reload",'echo "[ts-cloud] memoryHigh=auto resolved to ${TS_CLOUD_HIGH_MB}M (one eighth of ${TS_CLOUD_MEM_MB}M)"',...rn()]}function rn(){return[`TS_CLOUD_COMMIT=$(for f in /sys/fs/cgroup/system.slice/*.service/memory.high /sys/fs/cgroup/system.slice/*.slice/*.service/memory.high; do [ -f "$f" ] || continue; v=$(cat "$f" 2>/dev/null); [ "$v" = "max" ] && continue; echo "$v"; done | awk '{s+=$1} END {print int(s/1048576)}')`,"TS_CLOUD_RAM=$(awk '/^MemTotal:/{print int($2/1024)}' /proc/meminfo)",'if [ -n "$TS_CLOUD_COMMIT" ] && [ "$TS_CLOUD_COMMIT" -gt 0 ] && [ "$TS_CLOUD_RAM" -gt 0 ]; then TS_CLOUD_PCT=$((TS_CLOUD_COMMIT * 100 / TS_CLOUD_RAM)); if [ "$TS_CLOUD_PCT" -gt 300 ]; then echo "[ts-cloud] WARNING: services on this box declare ${TS_CLOUD_COMMIT}M of MemoryHigh against ${TS_CLOUD_RAM}M of RAM (${TS_CLOUD_PCT}% committed). Soft ceilings, so this is not fatal - but no ceiling can protect the box once enough of them are drawn on at once."; else echo "[ts-cloud] memory commitment: ${TS_CLOUD_COMMIT}M declared against ${TS_CLOUD_RAM}M RAM (${TS_CLOUD_PCT}%)"; fi; fi']}function il(e){return[`TS_CLOUD_SLICE=$(systemctl show ${e} -p Slice --value 2>/dev/null || true)`,'if [ -n "$TS_CLOUD_SLICE" ] && [ "$TS_CLOUD_SLICE" != "system.slice" ]; then systemctl set-property --runtime "$TS_CLOUD_SLICE" MemoryHigh=infinity MemoryMax=infinity 2>/dev/null || true; systemctl set-property "$TS_CLOUD_SLICE" MemoryHigh=infinity MemoryMax=infinity 2>/dev/null || true; fi']}function pi(e){let{unitBase:t,unitPattern:r,port:n}=e,s=e.path&&e.path.startsWith("/")?e.path:"/",i=Math.max(10,e.intervalSeconds??60),o=Math.max(1,e.failuresBeforeRestart??3),c=`/usr/local/sbin/${t}-liveness`,m=r.includes("@*")?`TS_CLOUD_UNIT=$(systemctl list-units --plain --no-legend --type=service '${r}' 2>/dev/null | awk '{print $1}' | head -1)`:`TS_CLOUD_UNIT=${r}`;return[`cat > ${c} <<'TS_CLOUD_LIVENESS_EOF'`,"#!/bin/sh","set -eu",`exec 9>/run/${t}-liveness.lock`,"flock -n 9 || exit 0",m,'[ -n "$TS_CLOUD_UNIT" ] || exit 0','systemctl is-active --quiet "$TS_CLOUD_UNIT" || exit 0',`if curl -s -o /dev/null --max-time 5 "http://127.0.0.1:${n}${s}"; then`,`  rm -f /run/${t}-liveness.fail`,"  exit 0","fi",`TS_CLOUD_FAILS=$(cat /run/${t}-liveness.fail 2>/dev/null || echo 0)`,"TS_CLOUD_FAILS=$((TS_CLOUD_FAILS + 1))",`echo "$TS_CLOUD_FAILS" > /run/${t}-liveness.fail`,`[ "$TS_CLOUD_FAILS" -ge ${o} ] || exit 0`,`logger -t ${t}-liveness "no HTTP response on 127.0.0.1:${n}${s} after $TS_CLOUD_FAILS checks; restarting $TS_CLOUD_UNIT"`,'systemctl restart "$TS_CLOUD_UNIT"',`rm -f /run/${t}-liveness.fail`,"TS_CLOUD_LIVENESS_EOF",`chmod +x ${c}`,`cat > /etc/systemd/system/${t}-liveness.service <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=Liveness check for ${t} (managed by ts-cloud)`,"","[Service]","Type=oneshot",`ExecStart=${c}`,"TS_CLOUD_UNIT_EOF",`cat > /etc/systemd/system/${t}-liveness.timer <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=Run the ${t} liveness check every ${i}s`,"","[Timer]",`OnUnitActiveSec=${i}s`,`OnBootSec=${i}s`,"Persistent=true","","[Install]","WantedBy=timers.target","TS_CLOUD_UNIT_EOF","systemctl daemon-reload",`systemctl enable --now ${t}-liveness.timer >/dev/null 2>&1 || true`]}function Gn(e){let{siteName:t,slug:r,artifactFetch:n,releaseId:s,execStart:i,envEntries:o,port:c,keepReleases:l=Tt,preStartCommands:m=[],healthCheckPath:S,healthGateSeconds:y=5,liveness:v,memoryHigh:h="auto",memoryMax:w,cpuWeight:E,ioWeight:R,tasksMax:x,stopTimeout:C}=e,T=[...E!=null?[`CPUWeight=${E}`]:[],...R!=null?[`IOWeight=${R}`]:[],...x!=null?[`TasksMax=${x}`]:[],...C?[`TimeoutStopSec=${C}`]:[]],P=e.zeroDowntime??c!=null,A=e.appDir??`/var/www/${t}`,D=Pt(A,s),O=`${r}-${t}`,U=`${O}.service`,oe=Vn(r,t,s),F=e.sharedPaths??[],Y=ci([".env",...F,...tr(o,F)]),J=Jt(o),j=m.length>0?[`cd ${D.release}`,...m]:[],te=["set -euo pipefail",...Yr(D),Qr(D),...n,...Ct(D,Y),...Jr(D),`tar xzf ${oe} -C "$TS_CLOUD_STAGED"`,`rm -f ${oe}`,`cat > ${D.shared}/.env <<'TS_CLOUD_ENV_EOF'`,J,"TS_CLOUD_ENV_EOF",`chmod 600 ${D.shared}/.env`,...Zr(D),`find ${D.release} -maxdepth 1 \\( -type f -o -type l \\) -name '.env*' ! -name '.env.example' ! -name '*.example' -delete`,`sed -i -E '/^[[:space:]]*(PORT|PORT_BACKEND|PORT_ADMIN|PORT_FRONTEND)[[:space:]]*=/d' ${D.shared}/.env 2>/dev/null || true`,...Zt(D,Y),...j];if(P&&c!=null){let H=`${O}@${s}.service`,Te=S?S.startsWith("/")?S:`/${S}`:null,Q=`{ echo "[ts-cloud] release ${s} failed its health gate — previous release keeps serving" >&2; journalctl -u ${H} -n 50 --no-pager >&2 || true; systemctl stop ${H} 2>/dev/null || true; exit 1; }`;return[...te,`cat > /etc/systemd/system/${O}@.service <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=${t} release %i (managed by ts-cloud)`,"After=network.target","","[Service]","Type=simple",`WorkingDirectory=${D.releases}/%i`,`ExecStart=${i}`,"Restart=always","RestartSec=5","MemoryAccounting=true",...h&&h!=="auto"?[`MemoryHigh=${h}`]:[],...w?[`MemoryMax=${w}`]:[],...T,`EnvironmentFile=${D.releases}/%i/.env`,`Environment=PORT=${c}`,"","[Install]","WantedBy=multi-user.target","TS_CLOUD_UNIT_EOF","systemctl daemon-reload",...h==="auto"?ui(`${O}@.service`):rn(),...il(H),`TS_CLOUD_OLD_UNITS=$(systemctl list-units --plain --no-legend --type=service "${O}@*.service" 2>/dev/null | awk '{print $1}' | grep -v "^${H}$" || true)`,`if [ -f /etc/systemd/system/${U} ] && systemctl is-active --quiet ${U}; then echo "[ts-cloud] retiring pre-zero-downtime unit ${U} (one-time restart cutover)"; systemctl stop ${U}; fi`,`systemctl restart ${H}`,`TS_CLOUD_GATE_OK=1; for TS_CLOUD_I in $(seq 1 ${Math.max(1,y)}); do sleep 1; systemctl is-active --quiet ${H} || { TS_CLOUD_GATE_OK=0; break; }; done`,`if [ "$TS_CLOUD_GATE_OK" -ne 1 ]; then echo "[ts-cloud] release ${s} could not overlap the previous release (no SO_REUSEPORT?) — retiring old instances and retrying" >&2; for TS_CLOUD_RU in \${TS_CLOUD_OLD_UNITS}; do systemctl stop "$TS_CLOUD_RU" 2>/dev/null || true; done; systemctl restart ${H}; for TS_CLOUD_I in $(seq 1 ${Math.max(1,y)}); do sleep 1; systemctl is-active --quiet ${H} || ${Q}; done; fi`,...Te?[`curl -sf -o /dev/null --max-time 10 "http://127.0.0.1:${c}${Te}" || ${Q}`]:[],...dt(D),`systemctl enable ${H} 2>/dev/null || true`,'for TS_CLOUD_U in ${TS_CLOUD_OLD_UNITS}; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done',`TS_CLOUD_LISTENING=0; for TS_CLOUD_I in $(seq 1 ${Math.max(1,y)}); do if ss -ltnH "sport = :${c}" 2>/dev/null | grep -q .; then TS_CLOUD_LISTENING=1; break; fi; sleep 1; done`,`if [ "$TS_CLOUD_LISTENING" -ne 1 ]; then echo "[ts-cloud] nothing is listening on ${c} after retiring the previous release — restarting ${H} on the now-free port" >&2; systemctl restart ${H}; for TS_CLOUD_I in $(seq 1 ${Math.max(1,y)}); do if ss -ltnH "sport = :${c}" 2>/dev/null | grep -q .; then TS_CLOUD_LISTENING=1; break; fi; sleep 1; done; fi`,`if [ "$TS_CLOUD_LISTENING" -ne 1 ]; then echo "[ts-cloud] ${H} is active but never bound ${c}" >&2; journalctl -u ${H} -n 50 --no-pager >&2 || true; exit 1; fi`,`systemctl list-unit-files --plain --no-legend "${O}@*.service" 2>/dev/null | awk '{print $1}' | { grep -v -e "^${H}$" -e "^${O}@\\.service$" || true; } | while read -r TS_CLOUD_U; do systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done`,`if [ -f /etc/systemd/system/${U} ]; then systemctl disable ${U} 2>/dev/null || true; rm -f /etc/systemd/system/${U}; systemctl daemon-reload; fi`,...mt(D,l),...v===!1?[]:pi({unitBase:O,unitPattern:`${O}@*.service`,port:c,path:v?.path??S,intervalSeconds:v?.intervalSeconds,failuresBeforeRestart:v?.failuresBeforeRestart})]}return[...te,`cat > /etc/systemd/system/${U} <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=${t} (managed by ts-cloud)`,"After=network.target","","[Service]","Type=simple",`WorkingDirectory=${D.current}`,`ExecStart=${i}`,"Restart=always","RestartSec=5","MemoryAccounting=true",...h&&h!=="auto"?[`MemoryHigh=${h}`]:[],...w?[`MemoryMax=${w}`]:[],...T,`EnvironmentFile=${D.current}/.env`,...c?[`Environment=PORT=${c}`]:[],"","[Install]","WantedBy=multi-user.target","TS_CLOUD_UNIT_EOF","systemctl daemon-reload",...h==="auto"?ui(U):rn(),`systemctl enable ${U}`,...dt(D),`systemctl restart ${U}`,`systemctl is-active ${U}`,...mt(D,l),...v===!1||!c?[]:pi({unitBase:O,unitPattern:U,port:c,path:v?.path??S,intervalSeconds:v?.intervalSeconds,failuresBeforeRestart:v?.failuresBeforeRestart})]}function qn(e){let{siteName:t,artifactFetch:r,releaseId:n,keepReleases:s=Tt,preStartCommands:i=[]}=e,o=e.appDir??`/var/www/${t}`,c=Pt(o,n),l=Vn(e.slug,t,n),m=i.length>0?[`cd ${c.release}`,...i]:[];return["set -euo pipefail",...Yr(c),Qr(c),...r,...Ct(c,[]),...Jr(c),`tar xzf ${l} -C "$TS_CLOUD_STAGED"`,...Zr(c),`rm -f ${l}`,...m,...dt(c),...mt(c,s)]}function Vn(e,t,r){return`/tmp/${[e,t,r].filter(Boolean).join("-")}-release.tar.gz`}function cc(e,t,r,n){return[`aws s3 cp "s3://${e}/${t}" ${n} --region ${r}`]}function dc(e,t){return[`mv "${e}" ${t}`]}function jn(){return['echo "[ts-cloud] host cleanup (disk before): $(df -h / | tail -1)"',"find /var/ts-cloud/staging -xdev -maxdepth 1 -type f -mmin +60 -delete 2>/dev/null || true",'find /tmp -xdev -maxdepth 1 -type f -name "*-release.tar.gz" -mmin +60 -delete 2>/dev/null || true',"find /root/.bun/install/cache -xdev -type f -mtime +7 -delete 2>/dev/null || true","find /root/.bun/install/cache -xdev -depth -type d -empty -delete 2>/dev/null || true","journalctl --vacuum-time=14d --vacuum-size=512M >/dev/null 2>&1 || true",'if command -v docker >/dev/null 2>&1; then docker image prune --all --force --filter "until=168h" >/dev/null 2>&1 || true; fi','if command -v podman >/dev/null 2>&1; then podman image prune --all --force --filter "until=168h" >/dev/null 2>&1 || true; fi',"if command -v apt-get >/dev/null 2>&1; then apt-get clean >/dev/null 2>&1 || true; fi",'echo "[ts-cloud] host cleanup (disk after): $(df -h / | tail -1)"']}import{copyFileSync as zl}from"node:fs";import{tmpdir as Bl}from"node:os";import{join as Kl}from"node:path";var ol=`${V}/project`;function di(e,t){let r=t.ownerSlug.trim(),n=t.selfSlug?.trim(),s={total:e.length,owner:[],self:[],others:new Map,unmanaged:[]};for(let i of e){let o=i.labels?.[ol]?.trim();if(!o){s.unmanaged.push(i.name);continue}if(o===r){s.owner.push(i.name);continue}if(n&&o===n){s.self.push(i.name);continue}let c=s.others.get(o);if(c)c.push(i.name);else s.others.set(o,[i.name])}return s}function nn(e){let t=e.unmanaged.length;for(let r of e.others.values())t+=r.length;return t}function fi(e,t){let r=nn(e),n=[];if(n.push(`Attaching to '${t.ownerSlug}' shares one provider project, so this deploy's credential can write to all ${e.total} server(s) it can see.`),r===0)return n.push("Nothing outside the two projects being joined is reachable with it."),n;n.push(`${r} of them belong to neither project:`);for(let s of[...e.others.keys()].sort())n.push(`  ${s}: ${[...e.others.get(s)].sort().join(", ")}`);if(e.unmanaged.length>0)n.push(`  not managed by ts-cloud: ${[...e.unmanaged].sort().join(", ")}`);return n.push("A compromised CI run or a mistargeted teardown in this project now reaches those. Keep the app in its own provider project instead if that is not acceptable, which rules out attaching."),n}import{execSync as Si}from"node:child_process";import{randomBytes as cl}from"node:crypto";import{chmodSync as ll,copyFileSync as ul,existsSync as qe,mkdirSync as vi,readFileSync as yi,statSync as pl,writeFileSync as on}from"node:fs";import{tmpdir as dl}from"node:os";import{basename as ml,dirname as cn,isAbsolute as bi,join as ee,resolve as fl}from"node:path";import{fileURLToPath as _i}from"node:url";function sn(e){if(!e||typeof e!=="object")return e;return Object.fromEntries(Object.keys(e).map((t)=>[t,""]))}function al(e){let t=JSON.parse(JSON.stringify(e??{}));if(t.hetzner)delete t.hetzner.apiToken;delete t.aws,delete t.stateDir;for(let r of Object.values(t.sites??{})){if(r?.env)r.env=sn(r.env);if(r?.environment)r.environment=sn(r.environment)}for(let r of Object.values(t.environments??{}))if(r?.variables)r.variables=sn(r.variables);for(let r of Object.values(t.infrastructure?.databases??{}))if(r?.password)r.password="";if(t.infrastructure?.appDatabase?.password)t.infrastructure.appDatabase.password="";if(t.infrastructure?.compute?.database?.password)t.infrastructure.compute.database.password="";if(t.infrastructure?.compute?.managedServices?.vitess?.password)t.infrastructure.compute.managedServices.vitess.password="";return t}function gi(e){let t=al(e);return["// Generated by ts-cloud for the management dashboard — do not edit.","//","// This is the project's resolved cloud config, inlined so it needs no","// imports on the box. Credentials are deliberately absent.",`export default ${JSON.stringify(t,null,2)}`,""].join(`
-`)}var lc="dashboard";function Ss(){return _("dashboard-credentials.json")}function gl(){return cl(24).toString("base64url")}function uc(e,t,r){let n=process.env.TS_CLOUD_UI_PASSWORD?.trim();if(n)return{password:n,source:"env"};if(an(process.env.TS_CLOUD_UI_PUBLIC))return{password:void 0,source:"public"};let s=Ss(),i=d(e,"dashboard-credentials.json");try{if(qe(i)){let c=JSON.parse(yi(i,"utf8"));if(c?.password)return{password:c.password,source:"generated"}}}catch{}let o=gl();try{vi(cn(i),{recursive:!0}),on(i,`${JSON.stringify({username:t,password:o,generatedAt:new Date().toISOString()},null,2)}
-`),ll(i,384),r.info(`Management dashboard: generated a password for '${t}' and saved it to ${s} (read it there — it is not printed). Set TS_CLOUD_UI_PASSWORD to pin your own, or TS_CLOUD_UI_PUBLIC=1 to serve without auth.`)}catch(c){r.warn(`Management dashboard: could not persist the generated password (${c?.message??c}). Using it for this deploy only — pass: ${o}
-This password is now in your deploy log. Set TS_CLOUD_UI_PASSWORD to a value of your own and redeploy once ${s} is writable.`)}return{password:o,source:"generated"}}var $i={info:()=>{},warn:()=>{}};function an(e){return e!=null&&e!==""&&e!=="0"&&e.toLowerCase()!=="false"}function hl(){return _("dashboard-release")}function wi(){let e=cn(_i(import.meta.url));for(let t of[ee(e,"..","..","package.json"),ee(e,"..","package.json")])try{let r=JSON.parse(yi(t,"utf8"));if(r.name==="@stacksjs/ts-cloud"&&r.version)return`^${r.version}`}catch{}return"latest"}function Sl(){return process.env.TS_CLOUD_UI_VERSION?.trim()||wi()}function vl(e,t,r){if(!e?.project?.slug)return r.warn("Management dashboard: the cloud config has no project slug — skipping the live dashboard."),null;let n=d(t,"dashboard-release");try{vi(n,{recursive:!0}),on(ee(n,"cloud.config.ts"),gi(e));let s=Sl();if(s.startsWith("file:")){let o=s.slice(5),c=bi(o)?o:fl(t,o);if(!qe(c)||!pl(c).isFile())s=wi(),r.warn(`Management dashboard: TS_CLOUD_UI_VERSION points to a missing package file (${c}); using the deploying ts-cloud version ${s} instead.`);else{let l=ml(c),m=ee(n,l);if(c!==m)ul(c,m);s=`file:./${l}`}}let i={name:"ts-cloud-dashboard",private:!0,type:"module",dependencies:{"@stacksjs/ts-cloud":s}};return on(ee(n,"package.json"),`${JSON.stringify(i,null,2)}
-`),hl()}catch(s){return r.warn(`Management dashboard: could not stage the live release (${s?.message??s}) — skipping.`),null}}function Nt(e){if(qe(ee(e,"packages","ui","pages"))||qe(ee(e,"packages","ui","package.json")))return{uiRoot:"packages/ui/dist",build:"cd packages/ui && bun install && bun run build"};let t=cn(_i(import.meta.url)),r=[ee(t,"ui"),ee(t,"..","ui"),ee(t,"..","..","ui"),ee(t,"..","dist","ui")];for(let n of r)if(qe(ee(n,"index.html"))||qe(ee(n,"serverless.html")))return{uiRoot:n,build:!1};return null}function zn(e,t={}){let r=t.logger??$i,n=t.cwd??process.cwd();if(an(process.env.TS_CLOUD_UI_DISABLE))return r.info("Management dashboard: skipped (TS_CLOUD_UI_DISABLE set)."),e;if(e.cloud?.attachTo)return r.info(`Management dashboard: ${e.project.slug} is attached to ${e.cloud.attachTo}; the server owner's dashboard monitors every attached project.`),e;if(Ht(e))return e;let s=e.environments&&Object.keys(e.environments)[0],i=process.env.TS_CLOUD_UI_DOMAIN?.trim()||void 0,o=Number(process.env.TS_CLOUD_UI_PORT)||void 0,c={...e.sites??{}};if(!an(process.env.TS_CLOUD_UI_STATIC)){let h=vl(e,n,r);if(!h)return e;let w=Ai(e,s??"production",{uiRoot:h,build:!1,domain:i,port:o,live:!0});if(w.length===0)return r.info("Management dashboard: no domain resolved (set TS_CLOUD_UI_DOMAIN or configure a site domain) — skipping."),e;for(let{name:E,site:R}of w)c[E]=R,r.info(`Management dashboard → https://${R.domain} (sign in with your ts-cloud account; the first deploy prints an admin password once)`);return e.sites=c,e}let l=Nt(n);if(!l)return r.info("Management dashboard: UI not found (no local ui/ or packaged dist/ui) — skipping auto-deploy."),e;let m=process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin",S=uc(n,m,r),y=Ai(e,s??"production",{uiRoot:l.uiRoot,build:l.build,domain:i,username:m,password:S.password,realm:process.env.TS_CLOUD_UI_REALM?.trim()||void 0,live:!1,port:o});if(y.length===0)return r.info("Management dashboard: no domain resolved (set TS_CLOUD_UI_DOMAIN or configure a site domain) — skipping."),e;let v=S.source==="public"?"NO AUTH — TS_CLOUD_UI_PUBLIC is set (dashboard is publicly reachable)":S.source==="env"?"htpasswd-protected (TS_CLOUD_UI_PASSWORD)":`htpasswd-protected (auto-generated — see ${Ss()})`;r.warn("Management dashboard: static mode — one shared password, and no per-site collaborators. Unset TS_CLOUD_UI_STATIC for the live dashboard.");for(let{name:h,site:w}of y)c[h]=w,r.info(`Management dashboard → https://${w.domain} (${v})`);return e.sites=c,e}function ln(e){return Object.keys(e.sites??{}).filter(_r)}function Cs(e,t){if(!e?.root)return null;let r=t.cwd??process.cwd(),n=t.logger??$i;try{if(typeof e.build==="string"&&e.build.trim())n.info(`Management dashboard: building UI (${e.build})`),Si(e.build,{cwd:r,stdio:"inherit"});let s=bi(e.root)?e.root:ee(r,e.root);if(!qe(s))return n.warn(`Management dashboard: build output not found at ${s} — skipping dashboard artifact.`),null;let i=ee(dl(),`${t.slug}-${t.siteName??lc}-${t.sha}.tar.gz`);return Si(`tar czf "${i}" -C "${s}" .`,{stdio:"inherit"}),i}catch(s){return n.warn(`Management dashboard: failed to build artifact — ${s?.message??s}. Skipping dashboard deploy.`),null}}var yl=new Set(["laravel","php","statamic","wordpress"]);function fr(e){if(e.framework)return e.framework;if(e.type&&yl.has(e.type))return"laravel";return"stacks"}var Ti=`eval "$(cd ${b} && pantry env 2>/dev/null)"`,Pi="/usr/local/bin/bun",bl="storage/framework/core/buddy/src/cli.ts",_l="node_modules/@stacksjs/ts-cloud/dist/bin/stacks-scheduler.js",Ci={id:"stacks",wrapExec:(e)=>e,execEnv:{PATH:"/usr/local/bin:/usr/bin:/bin",BUN_INSTALL:"/root/.bun",APP_ENV:"production",NODE_ENV:"production"},schedulerMode:"daemon",schedulerCommand:()=>`${Pi} ${_l}`,queueWorkerCommand:(e,{current:t})=>{let r=[`--queue=${e.queue||"default"}`,`--sleep=${e.sleep??3}`,`--tries=${e.tries??3}`,`--timeout=${e.timeout??60}`];return`${Pi} ${t}/${bl} queue:work ${r.join(" ")}`}},$l={id:"laravel",wrapExec:(e)=>`/bin/sh -lc '${Ti}; exec ${e}'`,schedulerMode:"cron",schedulerCommand:({current:e})=>`cd ${e} && ${Ti} && php artisan schedule:run`,queueWorkerCommand:(e,{current:t})=>{let r=`${t}/artisan`;if(e.horizon)return`php ${r} horizon`;let n=[e.connection||"default",`--queue=${e.queue||"default"}`,`--sleep=${e.sleep??3}`,`--tries=${e.tries??3}`,`--timeout=${e.timeout??60}`,`--memory=${e.memory??128}`];if(e.maxJobs)n.push(`--max-jobs=${e.maxJobs}`);if(e.maxTime)n.push(`--max-time=${e.maxTime}`);return`php ${r} queue:work ${n.join(" ")}`}},wl={stacks:Ci,laravel:$l};function xi(e){return wl[e]??Ci}function Ri(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function Tl(e){return`'${e.split("'").join("'\\''")}'`}function Ei(e){return e.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"unnamed"}function Pl(e,t,r){return`${e}-${t}-queue-${r}`}function Cl(e,t,r,n){return`${e}-${t}-daemon-${r.name?Ei(r.name):Ei(r.command).slice(0,32)||String(n)}`}function un(e){let t=["[Unit]",`Description=${e.description}`,"After=network.target","","[Service]","Type=simple",`WorkingDirectory=${e.workingDir}`,...Object.entries(e.environment??{}).map(([r,n])=>`Environment="${r}=${n}"`),`ExecStart=${e.execStart}`,`Restart=${e.restart||"always"}`,"RestartSec=5","MemoryAccounting=true",`MemoryHigh=${e.memoryHigh??"2G"}`,...e.memoryMax?[`MemoryMax=${e.memoryMax}`]:[]];if(e.user)t.push(`User=${e.user}`);if(typeof e.stopWaitSecs==="number")t.push(`TimeoutStopSec=${e.stopWaitSecs}`);return t.push("","[Install]","WantedBy=multi-user.target"),`${t.join(`
+' "$TS_CLOUD_MEM_MB" "$TS_CLOUD_HIGH_MB" > /etc/systemd/system/${e}.d/50-ts-cloud-memory.conf`,"systemctl daemon-reload",'echo "[ts-cloud] memoryHigh=auto resolved to ${TS_CLOUD_HIGH_MB}M (one eighth of ${TS_CLOUD_MEM_MB}M)"',...rn()]}function rn(){return[`TS_CLOUD_COMMIT=$(for f in /sys/fs/cgroup/system.slice/*.service/memory.high /sys/fs/cgroup/system.slice/*.slice/*.service/memory.high; do [ -f "$f" ] || continue; v=$(cat "$f" 2>/dev/null); [ "$v" = "max" ] && continue; echo "$v"; done | awk '{s+=$1} END {print int(s/1048576)}')`,"TS_CLOUD_RAM=$(awk '/^MemTotal:/{print int($2/1024)}' /proc/meminfo)",'if [ -n "$TS_CLOUD_COMMIT" ] && [ "$TS_CLOUD_COMMIT" -gt 0 ] && [ "$TS_CLOUD_RAM" -gt 0 ]; then TS_CLOUD_PCT=$((TS_CLOUD_COMMIT * 100 / TS_CLOUD_RAM)); if [ "$TS_CLOUD_PCT" -gt 300 ]; then echo "[ts-cloud] WARNING: services on this box declare ${TS_CLOUD_COMMIT}M of MemoryHigh against ${TS_CLOUD_RAM}M of RAM (${TS_CLOUD_PCT}% committed). Soft ceilings, so this is not fatal - but no ceiling can protect the box once enough of them are drawn on at once."; else echo "[ts-cloud] memory commitment: ${TS_CLOUD_COMMIT}M declared against ${TS_CLOUD_RAM}M RAM (${TS_CLOUD_PCT}%)"; fi; fi']}function ol(e){return[`TS_CLOUD_SLICE=$(systemctl show ${e} -p Slice --value 2>/dev/null || true)`,'if [ -n "$TS_CLOUD_SLICE" ] && [ "$TS_CLOUD_SLICE" != "system.slice" ]; then systemctl set-property --runtime "$TS_CLOUD_SLICE" MemoryHigh=infinity MemoryMax=infinity 2>/dev/null || true; systemctl set-property "$TS_CLOUD_SLICE" MemoryHigh=infinity MemoryMax=infinity 2>/dev/null || true; fi']}function pi(e){let{unitBase:t,unitPattern:r,port:n}=e,s=e.path&&e.path.startsWith("/")?e.path:"/",i=Math.max(10,e.intervalSeconds??60),o=Math.max(1,e.failuresBeforeRestart??3),c=`/usr/local/sbin/${t}-liveness`,m=r.includes("@*")?`TS_CLOUD_UNIT=$(systemctl list-units --plain --no-legend --type=service '${r}' 2>/dev/null | awk '{print $1}' | head -1)`:`TS_CLOUD_UNIT=${r}`;return[`cat > ${c} <<'TS_CLOUD_LIVENESS_EOF'`,"#!/bin/sh","set -eu",`exec 9>/run/${t}-liveness.lock`,"flock -n 9 || exit 0",m,'[ -n "$TS_CLOUD_UNIT" ] || exit 0','systemctl is-active --quiet "$TS_CLOUD_UNIT" || exit 0',`if curl -s -o /dev/null --max-time 5 "http://127.0.0.1:${n}${s}"; then`,`  rm -f /run/${t}-liveness.fail`,"  exit 0","fi",`TS_CLOUD_FAILS=$(cat /run/${t}-liveness.fail 2>/dev/null || echo 0)`,"TS_CLOUD_FAILS=$((TS_CLOUD_FAILS + 1))",`echo "$TS_CLOUD_FAILS" > /run/${t}-liveness.fail`,`[ "$TS_CLOUD_FAILS" -ge ${o} ] || exit 0`,`logger -t ${t}-liveness "no HTTP response on 127.0.0.1:${n}${s} after $TS_CLOUD_FAILS checks; restarting $TS_CLOUD_UNIT"`,'systemctl restart "$TS_CLOUD_UNIT"',`rm -f /run/${t}-liveness.fail`,"TS_CLOUD_LIVENESS_EOF",`chmod +x ${c}`,`cat > /etc/systemd/system/${t}-liveness.service <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=Liveness check for ${t} (managed by ts-cloud)`,"","[Service]","Type=oneshot",`ExecStart=${c}`,"TS_CLOUD_UNIT_EOF",`cat > /etc/systemd/system/${t}-liveness.timer <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=Run the ${t} liveness check every ${i}s`,"","[Timer]",`OnUnitActiveSec=${i}s`,`OnBootSec=${i}s`,"Persistent=true","","[Install]","WantedBy=timers.target","TS_CLOUD_UNIT_EOF","systemctl daemon-reload",`systemctl enable --now ${t}-liveness.timer >/dev/null 2>&1 || true`]}function Gn(e){let{siteName:t,slug:r,artifactFetch:n,releaseId:s,execStart:i,envEntries:o,port:c,keepReleases:l=Tt,preStartCommands:m=[],healthCheckPath:S,healthGateSeconds:y=5,liveness:v,memoryHigh:h="auto",memoryMax:w,cpuWeight:E,ioWeight:R,tasksMax:x,stopTimeout:C}=e,T=[...E!=null?[`CPUWeight=${E}`]:[],...R!=null?[`IOWeight=${R}`]:[],...x!=null?[`TasksMax=${x}`]:[],...C?[`TimeoutStopSec=${C}`]:[]],P=e.zeroDowntime??c!=null,A=e.appDir??`/var/www/${t}`,D=Pt(A,s),O=`${r}-${t}`,U=`${O}.service`,oe=Vn(r,t,s),F=e.sharedPaths??[],Y=ci([".env",...F,...tr(o,F)]),J=Jt(o),j=m.length>0?[`cd ${D.release}`,...m]:[],te=["set -euo pipefail",...Yr(D),Qr(D),...n,...Ct(D,Y),...Jr(D),`tar xzf ${oe} -C "$TS_CLOUD_STAGED"`,`rm -f ${oe}`,`cat > ${D.shared}/.env <<'TS_CLOUD_ENV_EOF'`,J,"TS_CLOUD_ENV_EOF",`chmod 600 ${D.shared}/.env`,...Zr(D),`find ${D.release} -maxdepth 1 \\( -type f -o -type l \\) -name '.env*' ! -name '.env.example' ! -name '*.example' -delete`,`sed -i -E '/^[[:space:]]*(PORT|PORT_BACKEND|PORT_ADMIN|PORT_FRONTEND)[[:space:]]*=/d' ${D.shared}/.env 2>/dev/null || true`,...Zt(D,Y),...j];if(P&&c!=null){let H=`${O}@${s}.service`,Te=S?S.startsWith("/")?S:`/${S}`:null,Q=`{ echo "[ts-cloud] release ${s} failed its health gate — previous release keeps serving" >&2; journalctl -u ${H} -n 50 --no-pager >&2 || true; systemctl stop ${H} 2>/dev/null || true; exit 1; }`;return[...te,`cat > /etc/systemd/system/${O}@.service <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=${t} release %i (managed by ts-cloud)`,"After=network.target","","[Service]","Type=simple",`WorkingDirectory=${D.releases}/%i`,`ExecStart=${i}`,"Restart=always","RestartSec=5","MemoryAccounting=true",...h&&h!=="auto"?[`MemoryHigh=${h}`]:[],...w?[`MemoryMax=${w}`]:[],...T,`EnvironmentFile=${D.releases}/%i/.env`,`Environment=PORT=${c}`,"","[Install]","WantedBy=multi-user.target","TS_CLOUD_UNIT_EOF","systemctl daemon-reload",...h==="auto"?ui(`${O}@.service`):rn(),...ol(H),`TS_CLOUD_OLD_UNITS=$(systemctl list-units --plain --no-legend --type=service "${O}@*.service" 2>/dev/null | awk '{print $1}' | grep -v "^${H}$" || true)`,`if [ -f /etc/systemd/system/${U} ] && systemctl is-active --quiet ${U}; then echo "[ts-cloud] retiring pre-zero-downtime unit ${U} (one-time restart cutover)"; systemctl stop ${U}; fi`,`systemctl restart ${H}`,`TS_CLOUD_GATE_OK=1; for TS_CLOUD_I in $(seq 1 ${Math.max(1,y)}); do sleep 1; systemctl is-active --quiet ${H} || { TS_CLOUD_GATE_OK=0; break; }; done`,`if [ "$TS_CLOUD_GATE_OK" -ne 1 ]; then echo "[ts-cloud] release ${s} could not overlap the previous release (no SO_REUSEPORT?) — retiring old instances and retrying" >&2; for TS_CLOUD_RU in \${TS_CLOUD_OLD_UNITS}; do systemctl stop "$TS_CLOUD_RU" 2>/dev/null || true; done; systemctl restart ${H}; for TS_CLOUD_I in $(seq 1 ${Math.max(1,y)}); do sleep 1; systemctl is-active --quiet ${H} || ${Q}; done; fi`,...Te?[`curl -sf -o /dev/null --max-time 10 "http://127.0.0.1:${c}${Te}" || ${Q}`]:[],...dt(D),`systemctl enable ${H} 2>/dev/null || true`,'for TS_CLOUD_U in ${TS_CLOUD_OLD_UNITS}; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done',`TS_CLOUD_LISTENING=0; for TS_CLOUD_I in $(seq 1 ${Math.max(1,y)}); do if ss -ltnH "sport = :${c}" 2>/dev/null | grep -q .; then TS_CLOUD_LISTENING=1; break; fi; sleep 1; done`,`if [ "$TS_CLOUD_LISTENING" -ne 1 ]; then echo "[ts-cloud] nothing is listening on ${c} after retiring the previous release — restarting ${H} on the now-free port" >&2; systemctl restart ${H}; for TS_CLOUD_I in $(seq 1 ${Math.max(1,y)}); do if ss -ltnH "sport = :${c}" 2>/dev/null | grep -q .; then TS_CLOUD_LISTENING=1; break; fi; sleep 1; done; fi`,`if [ "$TS_CLOUD_LISTENING" -ne 1 ]; then echo "[ts-cloud] ${H} is active but never bound ${c}" >&2; journalctl -u ${H} -n 50 --no-pager >&2 || true; exit 1; fi`,`systemctl list-unit-files --plain --no-legend "${O}@*.service" 2>/dev/null | awk '{print $1}' | { grep -v -e "^${H}$" -e "^${O}@\\.service$" || true; } | while read -r TS_CLOUD_U; do systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done`,`if [ -f /etc/systemd/system/${U} ]; then systemctl disable ${U} 2>/dev/null || true; rm -f /etc/systemd/system/${U}; systemctl daemon-reload; fi`,...mt(D,l),...v===!1?[]:pi({unitBase:O,unitPattern:`${O}@*.service`,port:c,path:v?.path??S,intervalSeconds:v?.intervalSeconds,failuresBeforeRestart:v?.failuresBeforeRestart})]}return[...te,`cat > /etc/systemd/system/${U} <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=${t} (managed by ts-cloud)`,"After=network.target","","[Service]","Type=simple",`WorkingDirectory=${D.current}`,`ExecStart=${i}`,"Restart=always","RestartSec=5","MemoryAccounting=true",...h&&h!=="auto"?[`MemoryHigh=${h}`]:[],...w?[`MemoryMax=${w}`]:[],...T,`EnvironmentFile=${D.current}/.env`,...c?[`Environment=PORT=${c}`]:[],"","[Install]","WantedBy=multi-user.target","TS_CLOUD_UNIT_EOF","systemctl daemon-reload",...h==="auto"?ui(U):rn(),`systemctl enable ${U}`,...dt(D),`systemctl restart ${U}`,`systemctl is-active ${U}`,...mt(D,l),...v===!1||!c?[]:pi({unitBase:O,unitPattern:U,port:c,path:v?.path??S,intervalSeconds:v?.intervalSeconds,failuresBeforeRestart:v?.failuresBeforeRestart})]}function qn(e){let{siteName:t,artifactFetch:r,releaseId:n,keepReleases:s=Tt,preStartCommands:i=[]}=e,o=e.appDir??`/var/www/${t}`,c=Pt(o,n),l=Vn(e.slug,t,n),m=i.length>0?[`cd ${c.release}`,...i]:[];return["set -euo pipefail",...Yr(c),Qr(c),...r,...Ct(c,[]),...Jr(c),`tar xzf ${l} -C "$TS_CLOUD_STAGED"`,...Zr(c),`rm -f ${l}`,...m,...dt(c),...mt(c,s)]}function Vn(e,t,r){return`/tmp/${[e,t,r].filter(Boolean).join("-")}-release.tar.gz`}function cc(e,t,r,n){return[`aws s3 cp "s3://${e}/${t}" ${n} --region ${r}`]}function dc(e,t){return[`mv "${e}" ${t}`]}function jn(){return['echo "[ts-cloud] host cleanup (disk before): $(df -h / | tail -1)"',"find /var/ts-cloud/staging -xdev -maxdepth 1 -type f -mmin +60 -delete 2>/dev/null || true",'find /tmp -xdev -maxdepth 1 -type f -name "*-release.tar.gz" -mmin +60 -delete 2>/dev/null || true',"find /root/.bun/install/cache -xdev -type f -mtime +7 -delete 2>/dev/null || true","find /root/.bun/install/cache -xdev -depth -type d -empty -delete 2>/dev/null || true","journalctl --vacuum-time=14d --vacuum-size=512M >/dev/null 2>&1 || true",'if command -v docker >/dev/null 2>&1; then docker image prune --all --force --filter "until=168h" >/dev/null 2>&1 || true; fi','if command -v podman >/dev/null 2>&1; then podman image prune --all --force --filter "until=168h" >/dev/null 2>&1 || true; fi',"if command -v apt-get >/dev/null 2>&1; then apt-get clean >/dev/null 2>&1 || true; fi",'echo "[ts-cloud] host cleanup (disk after): $(df -h / | tail -1)"']}import{copyFileSync as Bl}from"node:fs";import{tmpdir as Kl}from"node:os";import{join as jl}from"node:path";var al=`${V}/project`;function di(e,t){let r=t.ownerSlug.trim(),n=t.selfSlug?.trim(),s={total:e.length,owner:[],self:[],others:new Map,unmanaged:[]};for(let i of e){let o=i.labels?.[al]?.trim();if(!o){s.unmanaged.push(i.name);continue}if(o===r){s.owner.push(i.name);continue}if(n&&o===n){s.self.push(i.name);continue}let c=s.others.get(o);if(c)c.push(i.name);else s.others.set(o,[i.name])}return s}function nn(e){let t=e.unmanaged.length;for(let r of e.others.values())t+=r.length;return t}function fi(e,t){let r=nn(e),n=[];if(n.push(`Attaching to '${t.ownerSlug}' shares one provider project, so this deploy's credential can write to all ${e.total} server(s) it can see.`),r===0)return n.push("Nothing outside the two projects being joined is reachable with it."),n;n.push(`${r} of them belong to neither project:`);for(let s of[...e.others.keys()].sort())n.push(`  ${s}: ${[...e.others.get(s)].sort().join(", ")}`);if(e.unmanaged.length>0)n.push(`  not managed by ts-cloud: ${[...e.unmanaged].sort().join(", ")}`);return n.push("A compromised CI run or a mistargeted teardown in this project now reaches those. Keep the app in its own provider project instead if that is not acceptable, which rules out attaching."),n}import{execSync as Si}from"node:child_process";import{randomBytes as ll}from"node:crypto";import{chmodSync as ul,copyFileSync as pl,existsSync as qe,mkdirSync as vi,readFileSync as yi,statSync as dl,writeFileSync as on}from"node:fs";import{tmpdir as ml}from"node:os";import{basename as fl,dirname as cn,isAbsolute as bi,join as ee,resolve as gl}from"node:path";import{fileURLToPath as _i}from"node:url";function sn(e){if(!e||typeof e!=="object")return e;return Object.fromEntries(Object.keys(e).map((t)=>[t,""]))}function cl(e){let t=JSON.parse(JSON.stringify(e??{}));if(t.hetzner)delete t.hetzner.apiToken;delete t.aws,delete t.stateDir;for(let r of Object.values(t.sites??{})){if(r?.env)r.env=sn(r.env);if(r?.environment)r.environment=sn(r.environment)}for(let r of Object.values(t.environments??{}))if(r?.variables)r.variables=sn(r.variables);for(let r of Object.values(t.infrastructure?.databases??{}))if(r?.password)r.password="";if(t.infrastructure?.appDatabase?.password)t.infrastructure.appDatabase.password="";if(t.infrastructure?.compute?.database?.password)t.infrastructure.compute.database.password="";if(t.infrastructure?.compute?.managedServices?.vitess?.password)t.infrastructure.compute.managedServices.vitess.password="";return t}function gi(e){let t=cl(e);return["// Generated by ts-cloud for the management dashboard — do not edit.","//","// This is the project's resolved cloud config, inlined so it needs no","// imports on the box. Credentials are deliberately absent.",`export default ${JSON.stringify(t,null,2)}`,""].join(`
+`)}var lc="dashboard";function Ss(){return _("dashboard-credentials.json")}function hl(){return ll(24).toString("base64url")}function uc(e,t,r){let n=process.env.TS_CLOUD_UI_PASSWORD?.trim();if(n)return{password:n,source:"env"};if(an(process.env.TS_CLOUD_UI_PUBLIC))return{password:void 0,source:"public"};let s=Ss(),i=d(e,"dashboard-credentials.json");try{if(qe(i)){let c=JSON.parse(yi(i,"utf8"));if(c?.password)return{password:c.password,source:"generated"}}}catch{}let o=hl();try{vi(cn(i),{recursive:!0}),on(i,`${JSON.stringify({username:t,password:o,generatedAt:new Date().toISOString()},null,2)}
+`),ul(i,384),r.info(`Management dashboard: generated a password for '${t}' and saved it to ${s} (read it there — it is not printed). Set TS_CLOUD_UI_PASSWORD to pin your own, or TS_CLOUD_UI_PUBLIC=1 to serve without auth.`)}catch(c){r.warn(`Management dashboard: could not persist the generated password (${c?.message??c}). Using it for this deploy only — pass: ${o}
+This password is now in your deploy log. Set TS_CLOUD_UI_PASSWORD to a value of your own and redeploy once ${s} is writable.`)}return{password:o,source:"generated"}}var $i={info:()=>{},warn:()=>{}};function an(e){return e!=null&&e!==""&&e!=="0"&&e.toLowerCase()!=="false"}function Sl(){return _("dashboard-release")}function wi(){let e=cn(_i(import.meta.url));for(let t of[ee(e,"..","..","package.json"),ee(e,"..","package.json")])try{let r=JSON.parse(yi(t,"utf8"));if(r.name==="@stacksjs/ts-cloud"&&r.version)return`^${r.version}`}catch{}return"latest"}function vl(){return process.env.TS_CLOUD_UI_VERSION?.trim()||wi()}function yl(e,t,r){if(!e?.project?.slug)return r.warn("Management dashboard: the cloud config has no project slug — skipping the live dashboard."),null;let n=d(t,"dashboard-release");try{vi(n,{recursive:!0}),on(ee(n,"cloud.config.ts"),gi(e));let s=vl();if(s.startsWith("file:")){let o=s.slice(5),c=bi(o)?o:gl(t,o);if(!qe(c)||!dl(c).isFile())s=wi(),r.warn(`Management dashboard: TS_CLOUD_UI_VERSION points to a missing package file (${c}); using the deploying ts-cloud version ${s} instead.`);else{let l=fl(c),m=ee(n,l);if(c!==m)pl(c,m);s=`file:./${l}`}}let i={name:"ts-cloud-dashboard",private:!0,type:"module",dependencies:{"@stacksjs/ts-cloud":s}};return on(ee(n,"package.json"),`${JSON.stringify(i,null,2)}
+`),Sl()}catch(s){return r.warn(`Management dashboard: could not stage the live release (${s?.message??s}) — skipping.`),null}}function Nt(e){if(qe(ee(e,"packages","ui","pages"))||qe(ee(e,"packages","ui","package.json")))return{uiRoot:"packages/ui/dist",build:"cd packages/ui && bun install && bun run build"};let t=cn(_i(import.meta.url)),r=[ee(t,"ui"),ee(t,"..","ui"),ee(t,"..","..","ui"),ee(t,"..","dist","ui")];for(let n of r)if(qe(ee(n,"index.html"))||qe(ee(n,"serverless.html")))return{uiRoot:n,build:!1};return null}function zn(e,t={}){let r=t.logger??$i,n=t.cwd??process.cwd();if(an(process.env.TS_CLOUD_UI_DISABLE))return r.info("Management dashboard: skipped (TS_CLOUD_UI_DISABLE set)."),e;if(e.cloud?.attachTo)return r.info(`Management dashboard: ${e.project.slug} is attached to ${e.cloud.attachTo}; the server owner's dashboard monitors every attached project.`),e;if(Ht(e))return e;let s=e.environments&&Object.keys(e.environments)[0],i=process.env.TS_CLOUD_UI_DOMAIN?.trim()||void 0,o=Number(process.env.TS_CLOUD_UI_PORT)||void 0,c={...e.sites??{}};if(!an(process.env.TS_CLOUD_UI_STATIC)){let h=yl(e,n,r);if(!h)return e;let w=Ai(e,s??"production",{uiRoot:h,build:!1,domain:i,port:o,live:!0});if(w.length===0)return r.info("Management dashboard: no domain resolved (set TS_CLOUD_UI_DOMAIN or configure a site domain) — skipping."),e;for(let{name:E,site:R}of w)c[E]=R,r.info(`Management dashboard → https://${R.domain} (sign in with your ts-cloud account; the first deploy prints an admin password once)`);return e.sites=c,e}let l=Nt(n);if(!l)return r.info("Management dashboard: UI not found (no local ui/ or packaged dist/ui) — skipping auto-deploy."),e;let m=process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin",S=uc(n,m,r),y=Ai(e,s??"production",{uiRoot:l.uiRoot,build:l.build,domain:i,username:m,password:S.password,realm:process.env.TS_CLOUD_UI_REALM?.trim()||void 0,live:!1,port:o});if(y.length===0)return r.info("Management dashboard: no domain resolved (set TS_CLOUD_UI_DOMAIN or configure a site domain) — skipping."),e;let v=S.source==="public"?"NO AUTH — TS_CLOUD_UI_PUBLIC is set (dashboard is publicly reachable)":S.source==="env"?"htpasswd-protected (TS_CLOUD_UI_PASSWORD)":`htpasswd-protected (auto-generated — see ${Ss()})`;r.warn("Management dashboard: static mode — one shared password, and no per-site collaborators. Unset TS_CLOUD_UI_STATIC for the live dashboard.");for(let{name:h,site:w}of y)c[h]=w,r.info(`Management dashboard → https://${w.domain} (${v})`);return e.sites=c,e}function ln(e){return Object.keys(e.sites??{}).filter(_r)}function Cs(e,t){if(!e?.root)return null;let r=t.cwd??process.cwd(),n=t.logger??$i;try{if(typeof e.build==="string"&&e.build.trim())n.info(`Management dashboard: building UI (${e.build})`),Si(e.build,{cwd:r,stdio:"inherit"});let s=bi(e.root)?e.root:ee(r,e.root);if(!qe(s))return n.warn(`Management dashboard: build output not found at ${s} — skipping dashboard artifact.`),null;let i=ee(ml(),`${t.slug}-${t.siteName??lc}-${t.sha}.tar.gz`);return Si(`tar czf "${i}" -C "${s}" .`,{stdio:"inherit"}),i}catch(s){return n.warn(`Management dashboard: failed to build artifact — ${s?.message??s}. Skipping dashboard deploy.`),null}}var bl=new Set(["laravel","php","statamic","wordpress"]);function fr(e){if(e.framework)return e.framework;if(e.type&&bl.has(e.type))return"laravel";return"stacks"}var Ti=`eval "$(cd ${b} && pantry env 2>/dev/null)"`,Pi="/usr/local/bin/bun",_l="storage/framework/core/buddy/src/cli.ts",$l="node_modules/@stacksjs/ts-cloud/dist/bin/stacks-scheduler.js",Ci={id:"stacks",wrapExec:(e)=>e,execEnv:{PATH:"/usr/local/bin:/usr/bin:/bin",BUN_INSTALL:"/root/.bun",APP_ENV:"production",NODE_ENV:"production"},schedulerMode:"daemon",schedulerCommand:()=>`${Pi} ${$l}`,queueWorkerCommand:(e,{current:t})=>{let r=[`--queue=${e.queue||"default"}`,`--sleep=${e.sleep??3}`,`--tries=${e.tries??3}`,`--timeout=${e.timeout??60}`];return`${Pi} ${t}/${_l} queue:work ${r.join(" ")}`}},wl={id:"laravel",wrapExec:(e)=>`/bin/sh -lc '${Ti}; exec ${e}'`,schedulerMode:"cron",schedulerCommand:({current:e})=>`cd ${e} && ${Ti} && php artisan schedule:run`,queueWorkerCommand:(e,{current:t})=>{let r=`${t}/artisan`;if(e.horizon)return`php ${r} horizon`;let n=[e.connection||"default",`--queue=${e.queue||"default"}`,`--sleep=${e.sleep??3}`,`--tries=${e.tries??3}`,`--timeout=${e.timeout??60}`,`--memory=${e.memory??128}`];if(e.maxJobs)n.push(`--max-jobs=${e.maxJobs}`);if(e.maxTime)n.push(`--max-time=${e.maxTime}`);return`php ${r} queue:work ${n.join(" ")}`}},Tl={stacks:Ci,laravel:wl};function xi(e){return Tl[e]??Ci}function Ri(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function Pl(e){return`'${e.split("'").join("'\\''")}'`}function Ei(e){return e.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"unnamed"}function Cl(e,t,r){return`${e}-${t}-queue-${r}`}function xl(e,t,r,n){return`${e}-${t}-daemon-${r.name?Ei(r.name):Ei(r.command).slice(0,32)||String(n)}`}function un(e){let t=["[Unit]",`Description=${e.description}`,"After=network.target","","[Service]","Type=simple",`WorkingDirectory=${e.workingDir}`,...Object.entries(e.environment??{}).map(([r,n])=>`Environment="${r}=${n}"`),`ExecStart=${e.execStart}`,`Restart=${e.restart||"always"}`,"RestartSec=5","MemoryAccounting=true",`MemoryHigh=${e.memoryHigh??"2G"}`,...e.memoryMax?[`MemoryMax=${e.memoryMax}`]:[]];if(e.user)t.push(`User=${e.user}`);if(typeof e.stopWaitSecs==="number")t.push(`TimeoutStopSec=${e.stopWaitSecs}`);return t.push("","[Install]","WantedBy=multi-user.target"),`${t.join(`
 `)}
-`}function pn(e,t){return[`cat > /etc/systemd/system/${e}.service <<'TS_CLOUD_UNIT_EOF'`,t.replace(/\n$/,""),"TS_CLOUD_UNIT_EOF"]}function xl(e,t){return`/etc/cron.d/${e}-${t}-scheduler`}function dn(e){let{slug:t,siteName:r,site:n}=e,i=`${e.appBase??`/var/www/${r}`}/current`,o=xi(fr(n)),c={current:i},l=[],m=[];(n.queues||[]).forEach((x,C)=>{let T=Math.max(1,x.processes??1);for(let P=0;P<T;P++){let A=Pl(t,r,m.length);m.push(A),l.push(...pn(A,un({description:`${r} queue worker ${C}.${P} (managed by ts-cloud)`,workingDir:i,execStart:o.wrapExec(o.queueWorkerCommand(x,c)),environment:o.execEnv,stopWaitSecs:x.stopWaitSecs??90})))}}),(n.daemons||[]).forEach((x,C)=>{let T=Math.max(1,x.processes??1);for(let P=0;P<T;P++){let A=`${Cl(t,r,x,C)}-${P}`;m.push(A),l.push(...pn(A,un({description:`${r} daemon ${x.name||x.command} (managed by ts-cloud)`,workingDir:x.directory||i,execStart:o.wrapExec(x.command),environment:o.execEnv,restart:x.restart,user:x.user})))}});let v=n.scheduler,h=v===!0||typeof v==="object"&&v!==null,w=`${t}-${r}-scheduler`;if(h&&o.schedulerMode==="daemon")m.push(w),l.push(...pn(w,un({description:`${r} scheduler (managed by ts-cloud)`,workingDir:i,execStart:o.wrapExec(o.schedulerCommand(c)),environment:o.execEnv})));let E=m.map((x)=>`${x}.service`).join(" ");l.push("systemctl daemon-reload",`TS_CLOUD_DESIRED="${E}"`,`for unit in $(ls /etc/systemd/system/ 2>/dev/null | grep -E '^${Ri(t)}-${Ri(r)}-((queue|daemon)-.*|scheduler)\\.service$' || true); do`,'  case " $TS_CLOUD_DESIRED " in','    *" $unit "*) ;;','    *) systemctl stop "$unit" 2>/dev/null || true; systemctl disable "$unit" 2>/dev/null || true; rm -f "/etc/systemd/system/$unit" ;;',"  esac","done","systemctl daemon-reload");for(let x of m)l.push(`systemctl enable ${x}.service`,`systemctl restart ${x}.service`);let R=xl(t,r);if(h&&o.schedulerMode==="cron"){let x=typeof v==="object"&&v!==null?v:void 0,C=`${o.schedulerCommand(c)} >> /dev/null 2>&1`;if(x?.heartbeatUrl){let P=x.heartbeatMethod||"GET",A=P==="GET"?"":`-X ${P} `;C+=` && curl -fsS -m 10 ${A}${Tl(x.heartbeatUrl)} >/dev/null 2>&1`}let T=`* * * * * root ${C}
-`.replace(/%/g,"\\%");l.push(`cat > ${R} <<'TS_CLOUD_CRON_EOF'`,T.replace(/\n$/,""),"TS_CLOUD_CRON_EOF",`chmod 644 ${R}`)}else l.push(`rm -f ${R}`);return l}function mn(e){return!!(e.queues?.length||e.daemons?.length||e.scheduler)}function fn(e){if(e.ssl?.provider)return e.ssl.provider;return e.domain?"letsencrypt":"none"}var Oi={cloudflare:{pkg:"python3-certbot-dns-cloudflare",plugin:"dns-cloudflare"},route53:{pkg:"python3-certbot-dns-route53",plugin:"dns-route53"},digitalocean:{pkg:"python3-certbot-dns-digitalocean",plugin:"dns-digitalocean"},google:{pkg:"python3-certbot-dns-google",plugin:"dns-google"}};function Di(e){return`/etc/letsencrypt/ts-cloud-${e}.ini`}function Rl(e){let t=e?Oi[e.provider]:void 0,r=["certbot","python3-certbot-nginx",...t?[t.pkg]:[]].join(" ");return["export DEBIAN_FRONTEND=noninteractive",t?`apt-get update -y && apt-get install -y ${r}`:`command -v certbot >/dev/null 2>&1 || { apt-get update -y && apt-get install -y ${r}; }`,"mkdir -p /etc/letsencrypt/renewal-hooks/deploy","cat > /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh <<'TS_CLOUD_HOOK_EOF'","#!/bin/sh","systemctl reload ts-cloud-nginx 2>/dev/null || systemctl reload nginx 2>/dev/null || true","TS_CLOUD_HOOK_EOF","chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh","systemctl enable certbot.timer 2>/dev/null || true","systemctl start certbot.timer 2>/dev/null || true"]}function El(e){if(!e.credentials||Object.keys(e.credentials).length===0)return[];let t=Di(e.provider),r=Object.entries(e.credentials).map(([n,s])=>`${n} = ${s}`).join(`
-`);return[`cat > ${t} <<'TS_CLOUD_DNSCREDS_EOF'`,r,"TS_CLOUD_DNSCREDS_EOF",`chmod 600 ${t}`]}function Ol(e){let t=e.dns,r=e.wildcard?[`*.${e.domain}`,e.domain]:[e.domain,...e.aliases||[]].filter(Boolean),n=["certbot","--non-interactive","--agree-tos","--keep-until-expiring"];if(t){let s=Oi[t.provider].plugin;if(n.push(`--${s}`),t.provider!=="route53"&&t.credentials)n.push(`--${s}-credentials ${Di(t.provider)}`);if(typeof t.propagationSeconds==="number"&&t.provider!=="route53")n.push(`--${s}-propagation-seconds ${t.propagationSeconds}`);n.push("certonly")}else n.push("--nginx",`--nginx-ctl ${He}`,e.redirect===!1?"--no-redirect":"--redirect");if(e.email)n.push(`-m ${e.email}`);else n.push("--register-unsafely-without-email");for(let s of r)n.push(`-d ${s}`);return[n.join(" ")]}function gn(e){if(fn(e)!=="letsencrypt"||!e.domain)return[];let t=e.ssl,r=t?.dns,n=t?.wildcard===!0;if(n&&!r)return[];return[...Rl(r),...r?El(r):[],...Ol({domain:e.domain,aliases:e.aliases,email:t?.email,wildcard:n,dns:r})]}function Ii(e){let{repository:t,releaseDir:r,commit:n}=e,s=t.branch||"main",i=t.url,o=[`rm -rf ${r}`,`mkdir -p ${r}`];if(t.strategy==="tag")if(t.tag)o.push(`git clone -q --depth 1 --branch ${ue(t.tag)} ${ue(i)} ${r}`),o.push(`printf '%s' ${ue(t.tag)} > ${r}/.ts-cloud-tag`);else{let c=t.tagPattern||"v*";o.push(`TS_CLOUD_TAG="$(git ls-remote --tags --refs --sort=-v:refname ${ue(i)} ${ue(`refs/tags/${c}`)} | head -n1 | sed 's#.*refs/tags/##')"`,`test -n "$TS_CLOUD_TAG" || { echo "no tags matching" ${ue(c)} "found in" ${ue(i)} >&2; exit 1; }`,`git clone -q --depth 1 --branch "$TS_CLOUD_TAG" ${ue(i)} ${r}`,`printf '%s' "$TS_CLOUD_TAG" > ${r}/.ts-cloud-tag`)}else if(n)o.push(`git -C ${r} init -q`,`git -C ${r} remote add origin ${ue(i)}`,`git -C ${r} fetch -q --depth 1 origin ${ue(n)}`,`git -C ${r} checkout -q FETCH_HEAD`);else o.push(`git clone -q --depth 1 --branch ${ue(s)} ${ue(i)} ${r}`);return o.push(`git -C ${r} rev-parse HEAD > ${r}/.ts-cloud-sha`),o}function ue(e){return`'${e.split("'").join("'\\''")}'`}var rr="$CREATE_RELEASE",nr="$ACTIVATE_RELEASE",Ni="$RESTART_QUEUES",Li="composer install --no-interaction --prefer-dist --optimize-autoloader --no-dev",Dl=["php artisan migrate --force","php artisan config:cache","php artisan route:cache","php artisan view:cache","php artisan event:cache","php artisan storage:link"];function Il(e){switch(e){case"laravel":case"statamic":return[rr,Li,...Dl,nr,Ni];case"php":case"wordpress":return[rr,`${Li} || true`,nr];case"static":case"spa":return[rr,nr]}}function Al(e,t){return e.replace(/^php\s+/,`${t} `).replace(/(\s)php\s+artisan\s+/g,`$1${t} artisan `)}function Ll(e,t){let r=Jt(t);return[`cat > ${e} <<'TS_CLOUD_ENV_EOF'`,r,"TS_CLOUD_ENV_EOF",`chmod 600 ${e}`]}function ki(e,t,r){return[`cat > ${e} <<'${r}'`,t.replace(/\n$/,""),r,`chmod 600 ${e}`]}function kl(e,t){if(!t)return[];let r=[];if(t.composerAuth){let n=typeof t.composerAuth==="string"?t.composerAuth:JSON.stringify(t.composerAuth,null,2);r.push(...ki(`${e}/auth.json`,n,"TS_CLOUD_AUTHJSON_EOF"))}if(t.npmrc)r.push(...ki(`${e}/.npmrc`,t.npmrc,"TS_CLOUD_NPMRC_EOF"));return r}function Ui(e){let t=e.healthCheck?.path;if(!t||!e.domain)return[];let n=`http://127.0.0.1${t.startsWith("/")?t:`/${t}`}`;return[`echo "[ts-cloud] health check ${n} (Host: ${e.domain})"`,"TS_CLOUD_HC_OK=0",`for i in $(seq 1 10); do TS_CLOUD_HC=$(curl -s -o /dev/null -w "%{http_code}" -H "Host: ${e.domain}" -m 10 "${n}" 2>/dev/null || echo 000); case "$TS_CLOUD_HC" in 2*|3*) TS_CLOUD_HC_OK=1; break ;; esac; sleep 3; done`,'[ "$TS_CLOUD_HC_OK" = 1 ] && echo "health check passed ($TS_CLOUD_HC)" || { echo "health check FAILED (last=$TS_CLOUD_HC)" >&2; exit 1; }']}function Hi(e){let{siteName:t,site:r,releaseId:n,commit:s}=e;if(!r.repository?.url)throw Error(`Site '${t}' is a PHP/git site but has no repository.url to clone`);let i=e.appBase??`/var/www/${t}`,o="php",c=Pt(i,n),l=r.sharedPaths??Qt,m=[...l,...tr(r.env,l)],S=r.keepReleases??Tt,y=r.deployScript?.length?r.deployScript:Il(r.type??"laravel"),v=["set -euo pipefail",'export HOME="${HOME:-/root}"','export COMPOSER_HOME="${COMPOSER_HOME:-/root/.composer}"',"export COMPOSER_ALLOW_SUPERUSER=1",Pe()];if(v.push(...er(i,{releaseId:n,commit:s,branch:r.repository.branch,keepLogs:S})),v.push(...Ct(c,m)),r.env&&Object.keys(r.env).length>0)v.push(...Ll(`${c.shared}/.env`,r.env));for(let h of y){let w=h.trim();if(w===rr)v.push(...Ii({repository:r.repository,releaseDir:c.release,commit:s})),v.push(...Zt(c,m)),v.push(`cd ${c.release}`),v.push(...kl(c.release,r.credentials)),v.push(`chown -R www-data:www-data ${c.shared}/storage 2>/dev/null || true`,`[ -d ${c.release}/bootstrap/cache ] && chown -R www-data:www-data ${c.release}/bootstrap/cache 2>/dev/null || true`,`chmod -R ug+rwX ${c.shared}/storage 2>/dev/null || true`);else if(w===nr)v.push(...dt(c)),v.push(...mt(c,S)),v.push(`(cd ${b} && pantry restart php-fpm) 2>/dev/null || true`);else if(w===Ni)v.push(`${o} artisan queue:restart || true`);else v.push(Al(h,o))}return v}var sr={mysql:{port:3306,binaries:["mysqld","mysql"]},mariadb:{port:3306,binaries:["mariadbd","mariadb","mysqld"]},postgres:{port:5432,binaries:["postgres","psql"]},redis:{port:6379,binaries:["redis-server","redis-cli"]},memcached:{port:11211,binaries:["memcached"]},meilisearch:{port:7700,binaries:["meilisearch"]},vitess:{port:15306,binaries:["vtgate"]}},xt="ts-cloud-service:";function Nl(e){return e===!0||typeof e==="object"&&e!=null}function Mi(e){if(!e)return[];return Object.keys(sr).filter((t)=>Nl(e[t]))}function Fi(e){if(e.length===0)return[];return[Pe(),"ts_cloud_port_open() {",'  if command -v ss >/dev/null 2>&1; then ss -ltn 2>/dev/null | grep -qE "[:.]$1[[:space:]]" && return 0; fi','  if command -v netstat >/dev/null 2>&1; then netstat -ltn 2>/dev/null | grep -qE "[:.]$1[[:space:]]" && return 0; fi',"  (exec 3<>/dev/tcp/127.0.0.1/$1) 2>/dev/null && { exec 3<&- 3>&-; return 0; }","  return 1","}","ts_cloud_probe() {",'  TS_CLOUD_SVC="$1"; TS_CLOUD_PORT="$2"; shift 2','  for TS_CLOUD_BIN in "$@"; do',`    if command -v "$TS_CLOUD_BIN" >/dev/null 2>&1; then echo "${xt}$TS_CLOUD_SVC:present"; return 0; fi`,"  done",`  if ts_cloud_port_open "$TS_CLOUD_PORT"; then echo "${xt}$TS_CLOUD_SVC:present"; return 0; fi`,`  echo "${xt}$TS_CLOUD_SVC:missing"`,"  return 0","}",...e.filter((t)=>sr[t]).map((t)=>`ts_cloud_probe ${t} ${sr[t].port} ${sr[t].binaries.join(" ")}`),"exit 0"]}function zi(e,t){if(!e)return[];let r=new Map;for(let n of e.split(`
-`)){let s=n.indexOf(xt);if(s===-1)continue;let[i,o]=n.slice(s+xt.length).trim().split(":");if(i)r.set(i,o)}return t.filter((n)=>r.get(n)==="missing")}function Bi(e,t,r){let n=r?` on ${r}`:"",s=e.map((o)=>`managedServices.${o}`).join(", "),i=e.length===1?`no ${e[0]}`:`none of ${e.join(", ")}`;return`This project declares ${s}, but '${t}' has ${i}${n}. Attach mode does not provision services on the owner's box, so nothing will install ${e.length===1?"it":"them"}. Point the app at an external service, or ask the owner of '${t}' to add ${e.length===1?"it":"them"} to their own config and re-provision.`}var Ki="/var/lib/pantry/php-fpm/pool.d",Ul=9100,Hl=400;function ir(e){return(e.toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/^_+|_+$/g,"")||"site").slice(0,28)}function ji(e){return`web_${ir(e)}`}function Ml(e){let t=ir(e),r=0;for(let n=0;n<t.length;n++)r=r*31+t.charCodeAt(n)>>>0;return Ul+r%Hl}function hn(e){return`127.0.0.1:${Ml(e)}`}function Fl(e){let t=ir(e.siteName),r=ji(e.siteName),n=e.maxChildren??10;return[`; ts-cloud-managed pool for ${e.siteName} (site isolation)`,`[${t}]`,`user = ${r}`,`group = ${r}`,`listen = ${hn(e.siteName)}`,"pm = dynamic",`pm.max_children = ${n}`,"pm.start_servers = 2","pm.min_spare_servers = 1","pm.max_spare_servers = 3","pm.max_requests = 500","catch_workers_output = yes",`php_admin_value[open_basedir] = ${e.appBase}:/tmp`,""].join(`
-`)}function Gi(e){let t=ji(e.siteName),r=ir(e.siteName),n=`${Ki}/${r}.conf`;return[`getent group ${t} >/dev/null || groupadd --system ${t}`,`id -u ${t} >/dev/null 2>&1 || useradd --system --no-create-home --shell /usr/sbin/nologin -g ${t} ${t}`,`usermod -aG ${t} www-data 2>/dev/null || true`,`chown -R ${t}:${t} ${e.appBase} || true`,`chmod -R g+rX ${e.appBase} || true`,`chmod 600 ${e.appBase}/shared/.env 2>/dev/null || true`,`mkdir -p ${Ki}`,`cat > ${n} <<'TS_CLOUD_FPMPOOL_EOF'`,Fl(e).replace(/\n$/,""),"TS_CLOUD_FPMPOOL_EOF",`(cd ${b} && pantry restart php-fpm) 2>/dev/null || true`]}var vr={info:()=>{},warn:()=>{},error:()=>{},step:()=>{},success:()=>{}};function jl(e){return`'${e.replace(/'/g,`'"'"'`)}'`}async function bs(e,t,r=vr){let{config:n,environment:s,siteName:i,site:o,slug:c,sha:l,runtime:m,localTarballPath:S}=t,y=`releases/${i}/${l}.tar.gz`,v=g(n,s),h=await e.getComputeOutputs({config:n,environment:s}),w=await e.findComputeTargets({slug:c,environment:s,role:"app",stackName:v});if(w.length===0)return{success:!1,error:e.name==="aws"?`Stack '${v}' has no EC2 instances tagged Project=${c} Environment=${s} Role=app, and storage/cloud/state/${v}.json pins no live instance. For a shared box, record its instanceId there.`:`No Hetzner servers labeled ts-cloud/project=${c} ts-cloud/environment=${s} ts-cloud/role=app, and storage/cloud/state/${v}.json pins no live server. For a shared box, record its serverId there.`};let E=h.servicesPrivateIp?zs(h.servicesPrivateIp,p(n)):ss(p(n)),R=cd(hi(n,{environment:s})),x=n.infrastructure?.compute,C=se(x)?{HOST:"127.0.0.1"}:{},T=s==="production"?{APP_ENV:"production",NODE_ENV:"production"}:{},P={...E,...R,...C,...o.env||{},...T},A=tn(P,o.sharedPaths??[]);if(A.warning)r.warn(`Site '${i}': ${A.warning}`);else if(A.path)r.info(`Site '${i}': sharing '${A.path}' so the SQLite database survives deploys.`);if(Ir(o)){let he=o.phpVersion??x?.php?.default??x?.php?.versions?.[0],L=B(c,i),W=Object.keys(E).length>0?{...o,env:P}:o,I=Hi({siteName:i,site:W,releaseId:l,appBase:L,defaultPhpVersion:he}),M=!se(x),pe=fn(o)==="custom"&&o.ssl?.certPath&&o.ssl?.keyPath?{certPath:o.ssl.certPath,keyPath:o.ssl.keyPath}:void 0,ke=o.isolation?Gi({siteName:i,appBase:L}):[],ft=M?Nr({siteName:i,domain:o.domain||i,aliases:o.aliases,type:o.type,appDir:`${L}/current`,webDirectory:o.webDirectory,phpVersion:he,fastcgiPass:o.isolation?hn(i):void 0,redirects:o.redirects,ssl:pe,auth:o.auth&&o.auth.enabled!==!1&&o.auth.password?{username:o.auth.username||"admin",password:o.auth.password,realm:o.auth.realm}:void 0,serverSnippet:kr(o.nginx,x?.nginxTemplates),clientMaxBodySize:o.nginx?.clientMaxBodySize,hsts:o.ssl?.hsts,tlsProtocols:o.ssl?.tlsProtocols,security:o.security}):[],yr=M?gn(o):[],gt=mn(o)?dn({slug:c,siteName:i,site:o,phpVersion:he,appBase:L}):[],qi=M?Ui(o):[];r.step(`Deploying PHP site '${i}' to ${w.length} target(s)...`);let Me=await e.runRemoteDeploy({targets:w,commands:[...en(L,c),...I,...ke,...ft,...yr,...gt,...qi],comment:`ts-cloud deploy ${c}/${i}@${l}`,tags:{Project:c,Environment:s,Role:"app"}}),An=ls(n.notifications,o.notifications);if(!Me.success)return await Hr(An,"deploy-failed",`❌ Deploy of ${c}/${i}@${l} failed: ${Me.error||"unknown error"}`),{success:!1,error:Me.error||"Remote PHP deploy failed",instanceCount:Me.instanceCount,perInstance:Me.perInstance};let Wi=o.domain?` → https://${o.domain}`:"";return await Hr(An,"deploy",`✅ Deployed ${c}/${i}@${l}${Wi}`),{success:!0,instanceCount:Me.instanceCount,perInstance:Me.perInstance}}if(!S)return{success:!1,error:`Site '${i}' requires a release tarball but none was provided`};let D=await e.uploadRelease({config:n,environment:s,localPath:S,remoteKey:y,targets:w}),O=Vn(c,i,l),U=e.name==="aws"?cc(h.deployBucketName,y,n.project.region||"us-east-1",O):dc(D.artifactRef,O),oe=u(o),F=B(c,i),Y=oe==="server-static"?qn({siteName:i,slug:c,appDir:F,artifactFetch:U,releaseId:l,preStartCommands:o.preStart}):Gn({siteName:i,slug:c,appDir:F,artifactFetch:U,releaseId:l,execStart:Hn(o.start,m),envEntries:P,port:o.port,preStartCommands:o.preStart,sharedPaths:o.sharedPaths,zeroDowntime:o.zeroDowntime!==!1,healthCheckPath:o.healthCheck?.path,memoryHigh:o.memoryHigh,memoryMax:o.memoryMax,cpuWeight:o.cpuWeight,ioWeight:o.ioWeight,tasksMax:o.tasksMax,stopTimeout:o.stopTimeout}),J=oe==="server-static"&&!se(x)&&!!o.domain,j=J?Nr({siteName:i,domain:o.domain,aliases:o.aliases,type:o.type==="spa"?"spa":"static",appDir:`${F}/current`,webDirectory:"",redirects:o.redirects,auth:o.auth&&o.auth.enabled!==!1&&o.auth.password?{username:o.auth.username||"admin",password:o.auth.password,realm:o.auth.realm}:void 0,serverSnippet:kr(o.nginx,x?.nginxTemplates),clientMaxBodySize:o.nginx?.clientMaxBodySize,hsts:o.ssl?.hsts,tlsProtocols:o.ssl?.tlsProtocols,security:o.security}):[],te=J?gn(o):[],H=mn(o)?dn({slug:c,siteName:i,site:o,appBase:F}):[],Te=[...er(F,{releaseId:l,commit:l,branch:o.repository?.branch??"main"}),...en(F,c),...Y,...j,...te,...H,...jn()];r.step(`Deploying to ${w.length} target(s)...`);let Q=await e.runRemoteDeploy({targets:w,commands:Te,comment:`ts-cloud deploy ${c}/${i}@${l}`,tags:{Project:c,Environment:s,Role:"app"}});if(!Q.success)return{success:!1,error:Q.error||"Remote deploy failed",instanceCount:Q.instanceCount,perInstance:Q.perInstance};return{success:!0,instanceCount:Q.instanceCount,perInstance:Q.perInstance}}function or(e){return`'${e.replaceAll("'","'\\''")}'`}function Gl(e,t,r=!1,n=[]){let s=`${e}-dashboard-`,i=t.map((c)=>`${e}-${c}.service`),o=r?[`export TS_CLOUD_DASHBOARD_KEEP_DOMAINS=${or(JSON.stringify(n))}`,"rm -f /run/ts-cloud-dashboard-routes-changed",`/usr/local/bin/bun --bun -e ${or(`
+`}function pn(e,t){return[`cat > /etc/systemd/system/${e}.service <<'TS_CLOUD_UNIT_EOF'`,t.replace(/\n$/,""),"TS_CLOUD_UNIT_EOF"]}function Rl(e,t){return`/etc/cron.d/${e}-${t}-scheduler`}function dn(e){let{slug:t,siteName:r,site:n}=e,i=`${e.appBase??`/var/www/${r}`}/current`,o=xi(fr(n)),c={current:i},l=[],m=[];(n.queues||[]).forEach((x,C)=>{let T=Math.max(1,x.processes??1);for(let P=0;P<T;P++){let A=Cl(t,r,m.length);m.push(A),l.push(...pn(A,un({description:`${r} queue worker ${C}.${P} (managed by ts-cloud)`,workingDir:i,execStart:o.wrapExec(o.queueWorkerCommand(x,c)),environment:o.execEnv,stopWaitSecs:x.stopWaitSecs??90})))}}),(n.daemons||[]).forEach((x,C)=>{let T=Math.max(1,x.processes??1);for(let P=0;P<T;P++){let A=`${xl(t,r,x,C)}-${P}`;m.push(A),l.push(...pn(A,un({description:`${r} daemon ${x.name||x.command} (managed by ts-cloud)`,workingDir:x.directory||i,execStart:o.wrapExec(x.command),environment:o.execEnv,restart:x.restart,user:x.user})))}});let v=n.scheduler,h=v===!0||typeof v==="object"&&v!==null,w=`${t}-${r}-scheduler`;if(h&&o.schedulerMode==="daemon")m.push(w),l.push(...pn(w,un({description:`${r} scheduler (managed by ts-cloud)`,workingDir:i,execStart:o.wrapExec(o.schedulerCommand(c)),environment:o.execEnv})));let E=m.map((x)=>`${x}.service`).join(" ");l.push("systemctl daemon-reload",`TS_CLOUD_DESIRED="${E}"`,`for unit in $(ls /etc/systemd/system/ 2>/dev/null | grep -E '^${Ri(t)}-${Ri(r)}-((queue|daemon)-.*|scheduler)\\.service$' || true); do`,'  case " $TS_CLOUD_DESIRED " in','    *" $unit "*) ;;','    *) systemctl stop "$unit" 2>/dev/null || true; systemctl disable "$unit" 2>/dev/null || true; rm -f "/etc/systemd/system/$unit" ;;',"  esac","done","systemctl daemon-reload");for(let x of m)l.push(`systemctl enable ${x}.service`,`systemctl restart ${x}.service`);let R=Rl(t,r);if(h&&o.schedulerMode==="cron"){let x=typeof v==="object"&&v!==null?v:void 0,C=`${o.schedulerCommand(c)} >> /dev/null 2>&1`;if(x?.heartbeatUrl){let P=x.heartbeatMethod||"GET",A=P==="GET"?"":`-X ${P} `;C+=` && curl -fsS -m 10 ${A}${Pl(x.heartbeatUrl)} >/dev/null 2>&1`}let T=`* * * * * root ${C}
+`.replace(/%/g,"\\%");l.push(`cat > ${R} <<'TS_CLOUD_CRON_EOF'`,T.replace(/\n$/,""),"TS_CLOUD_CRON_EOF",`chmod 644 ${R}`)}else l.push(`rm -f ${R}`);return l}function mn(e){return!!(e.queues?.length||e.daemons?.length||e.scheduler)}function fn(e){if(e.ssl?.provider)return e.ssl.provider;return e.domain?"letsencrypt":"none"}var Oi={cloudflare:{pkg:"python3-certbot-dns-cloudflare",plugin:"dns-cloudflare"},route53:{pkg:"python3-certbot-dns-route53",plugin:"dns-route53"},digitalocean:{pkg:"python3-certbot-dns-digitalocean",plugin:"dns-digitalocean"},google:{pkg:"python3-certbot-dns-google",plugin:"dns-google"}};function Di(e){return`/etc/letsencrypt/ts-cloud-${e}.ini`}function El(e){let t=e?Oi[e.provider]:void 0,r=["certbot","python3-certbot-nginx",...t?[t.pkg]:[]].join(" ");return["export DEBIAN_FRONTEND=noninteractive",t?`apt-get update -y && apt-get install -y ${r}`:`command -v certbot >/dev/null 2>&1 || { apt-get update -y && apt-get install -y ${r}; }`,"mkdir -p /etc/letsencrypt/renewal-hooks/deploy","cat > /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh <<'TS_CLOUD_HOOK_EOF'","#!/bin/sh","systemctl reload ts-cloud-nginx 2>/dev/null || systemctl reload nginx 2>/dev/null || true","TS_CLOUD_HOOK_EOF","chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh","systemctl enable certbot.timer 2>/dev/null || true","systemctl start certbot.timer 2>/dev/null || true"]}function Ol(e){if(!e.credentials||Object.keys(e.credentials).length===0)return[];let t=Di(e.provider),r=Object.entries(e.credentials).map(([n,s])=>`${n} = ${s}`).join(`
+`);return[`cat > ${t} <<'TS_CLOUD_DNSCREDS_EOF'`,r,"TS_CLOUD_DNSCREDS_EOF",`chmod 600 ${t}`]}function Dl(e){let t=e.dns,r=e.wildcard?[`*.${e.domain}`,e.domain]:[e.domain,...e.aliases||[]].filter(Boolean),n=["certbot","--non-interactive","--agree-tos","--keep-until-expiring"];if(t){let s=Oi[t.provider].plugin;if(n.push(`--${s}`),t.provider!=="route53"&&t.credentials)n.push(`--${s}-credentials ${Di(t.provider)}`);if(typeof t.propagationSeconds==="number"&&t.provider!=="route53")n.push(`--${s}-propagation-seconds ${t.propagationSeconds}`);n.push("certonly")}else n.push("--nginx",`--nginx-ctl ${He}`,e.redirect===!1?"--no-redirect":"--redirect");if(e.email)n.push(`-m ${e.email}`);else n.push("--register-unsafely-without-email");for(let s of r)n.push(`-d ${s}`);return[n.join(" ")]}function gn(e){if(fn(e)!=="letsencrypt"||!e.domain)return[];let t=e.ssl,r=t?.dns,n=t?.wildcard===!0;if(n&&!r)return[];return[...El(r),...r?Ol(r):[],...Dl({domain:e.domain,aliases:e.aliases,email:t?.email,wildcard:n,dns:r})]}function Ii(e){let{repository:t,releaseDir:r,commit:n}=e,s=t.branch||"main",i=t.url,o=[`rm -rf ${r}`,`mkdir -p ${r}`];if(t.strategy==="tag")if(t.tag)o.push(`git clone -q --depth 1 --branch ${ue(t.tag)} ${ue(i)} ${r}`),o.push(`printf '%s' ${ue(t.tag)} > ${r}/.ts-cloud-tag`);else{let c=t.tagPattern||"v*";o.push(`TS_CLOUD_TAG="$(git ls-remote --tags --refs --sort=-v:refname ${ue(i)} ${ue(`refs/tags/${c}`)} | head -n1 | sed 's#.*refs/tags/##')"`,`test -n "$TS_CLOUD_TAG" || { echo "no tags matching" ${ue(c)} "found in" ${ue(i)} >&2; exit 1; }`,`git clone -q --depth 1 --branch "$TS_CLOUD_TAG" ${ue(i)} ${r}`,`printf '%s' "$TS_CLOUD_TAG" > ${r}/.ts-cloud-tag`)}else if(n)o.push(`git -C ${r} init -q`,`git -C ${r} remote add origin ${ue(i)}`,`git -C ${r} fetch -q --depth 1 origin ${ue(n)}`,`git -C ${r} checkout -q FETCH_HEAD`);else o.push(`git clone -q --depth 1 --branch ${ue(s)} ${ue(i)} ${r}`);return o.push(`git -C ${r} rev-parse HEAD > ${r}/.ts-cloud-sha`),o}function ue(e){return`'${e.split("'").join("'\\''")}'`}var rr="$CREATE_RELEASE",nr="$ACTIVATE_RELEASE",Ni="$RESTART_QUEUES",Li="composer install --no-interaction --prefer-dist --optimize-autoloader --no-dev",Il=["php artisan migrate --force","php artisan config:cache","php artisan route:cache","php artisan view:cache","php artisan event:cache","php artisan storage:link"];function Al(e){switch(e){case"laravel":case"statamic":return[rr,Li,...Il,nr,Ni];case"php":case"wordpress":return[rr,`${Li} || true`,nr];case"static":case"spa":return[rr,nr]}}function Ll(e,t){return e.replace(/^php\s+/,`${t} `).replace(/(\s)php\s+artisan\s+/g,`$1${t} artisan `)}function kl(e,t){let r=Jt(t);return[`cat > ${e} <<'TS_CLOUD_ENV_EOF'`,r,"TS_CLOUD_ENV_EOF",`chmod 600 ${e}`]}function ki(e,t,r){return[`cat > ${e} <<'${r}'`,t.replace(/\n$/,""),r,`chmod 600 ${e}`]}function Nl(e,t){if(!t)return[];let r=[];if(t.composerAuth){let n=typeof t.composerAuth==="string"?t.composerAuth:JSON.stringify(t.composerAuth,null,2);r.push(...ki(`${e}/auth.json`,n,"TS_CLOUD_AUTHJSON_EOF"))}if(t.npmrc)r.push(...ki(`${e}/.npmrc`,t.npmrc,"TS_CLOUD_NPMRC_EOF"));return r}function Ui(e){let t=e.healthCheck?.path;if(!t||!e.domain)return[];let n=`http://127.0.0.1${t.startsWith("/")?t:`/${t}`}`;return[`echo "[ts-cloud] health check ${n} (Host: ${e.domain})"`,"TS_CLOUD_HC_OK=0",`for i in $(seq 1 10); do TS_CLOUD_HC=$(curl -s -o /dev/null -w "%{http_code}" -H "Host: ${e.domain}" -m 10 "${n}" 2>/dev/null || echo 000); case "$TS_CLOUD_HC" in 2*|3*) TS_CLOUD_HC_OK=1; break ;; esac; sleep 3; done`,'[ "$TS_CLOUD_HC_OK" = 1 ] && echo "health check passed ($TS_CLOUD_HC)" || { echo "health check FAILED (last=$TS_CLOUD_HC)" >&2; exit 1; }']}function Hi(e){let{siteName:t,site:r,releaseId:n,commit:s}=e;if(!r.repository?.url)throw Error(`Site '${t}' is a PHP/git site but has no repository.url to clone`);let i=e.appBase??`/var/www/${t}`,o="php",c=Pt(i,n),l=r.sharedPaths??Qt,m=[...l,...tr(r.env,l)],S=r.keepReleases??Tt,y=r.deployScript?.length?r.deployScript:Al(r.type??"laravel"),v=["set -euo pipefail",'export HOME="${HOME:-/root}"','export COMPOSER_HOME="${COMPOSER_HOME:-/root/.composer}"',"export COMPOSER_ALLOW_SUPERUSER=1",Pe()];if(v.push(...er(i,{releaseId:n,commit:s,branch:r.repository.branch,keepLogs:S})),v.push(...Ct(c,m)),r.env&&Object.keys(r.env).length>0)v.push(...kl(`${c.shared}/.env`,r.env));for(let h of y){let w=h.trim();if(w===rr)v.push(...Ii({repository:r.repository,releaseDir:c.release,commit:s})),v.push(...Zt(c,m)),v.push(`cd ${c.release}`),v.push(...Nl(c.release,r.credentials)),v.push(`chown -R www-data:www-data ${c.shared}/storage 2>/dev/null || true`,`[ -d ${c.release}/bootstrap/cache ] && chown -R www-data:www-data ${c.release}/bootstrap/cache 2>/dev/null || true`,`chmod -R ug+rwX ${c.shared}/storage 2>/dev/null || true`);else if(w===nr)v.push(...dt(c)),v.push(...mt(c,S)),v.push(`(cd ${b} && pantry restart php-fpm) 2>/dev/null || true`);else if(w===Ni)v.push(`${o} artisan queue:restart || true`);else v.push(Ll(h,o))}return v}var sr={mysql:{port:3306,binaries:["mysqld","mysql"]},mariadb:{port:3306,binaries:["mariadbd","mariadb","mysqld"]},postgres:{port:5432,binaries:["postgres","psql"]},redis:{port:6379,binaries:["redis-server","redis-cli"]},memcached:{port:11211,binaries:["memcached"]},meilisearch:{port:7700,binaries:["meilisearch"]},vitess:{port:15306,binaries:["vtgate"]}},xt="ts-cloud-service:";function Ul(e){return e===!0||typeof e==="object"&&e!=null}function Mi(e){if(!e)return[];return Object.keys(sr).filter((t)=>Ul(e[t]))}function Fi(e){if(e.length===0)return[];return[Pe(),"ts_cloud_port_open() {",'  if command -v ss >/dev/null 2>&1; then ss -ltn 2>/dev/null | grep -qE "[:.]$1[[:space:]]" && return 0; fi','  if command -v netstat >/dev/null 2>&1; then netstat -ltn 2>/dev/null | grep -qE "[:.]$1[[:space:]]" && return 0; fi',"  (exec 3<>/dev/tcp/127.0.0.1/$1) 2>/dev/null && { exec 3<&- 3>&-; return 0; }","  return 1","}","ts_cloud_probe() {",'  TS_CLOUD_SVC="$1"; TS_CLOUD_PORT="$2"; shift 2','  for TS_CLOUD_BIN in "$@"; do',`    if command -v "$TS_CLOUD_BIN" >/dev/null 2>&1; then echo "${xt}$TS_CLOUD_SVC:present"; return 0; fi`,"  done",`  if ts_cloud_port_open "$TS_CLOUD_PORT"; then echo "${xt}$TS_CLOUD_SVC:present"; return 0; fi`,`  echo "${xt}$TS_CLOUD_SVC:missing"`,"  return 0","}",...e.filter((t)=>sr[t]).map((t)=>`ts_cloud_probe ${t} ${sr[t].port} ${sr[t].binaries.join(" ")}`),"exit 0"]}function zi(e,t){if(!e)return[];let r=new Map;for(let n of e.split(`
+`)){let s=n.indexOf(xt);if(s===-1)continue;let[i,o]=n.slice(s+xt.length).trim().split(":");if(i)r.set(i,o)}return t.filter((n)=>r.get(n)==="missing")}function Bi(e,t,r){let n=r?` on ${r}`:"",s=e.map((o)=>`managedServices.${o}`).join(", "),i=e.length===1?`no ${e[0]}`:`none of ${e.join(", ")}`;return`This project declares ${s}, but '${t}' has ${i}${n}. Attach mode does not provision services on the owner's box, so nothing will install ${e.length===1?"it":"them"}. Point the app at an external service, or ask the owner of '${t}' to add ${e.length===1?"it":"them"} to their own config and re-provision.`}var Ki="/var/lib/pantry/php-fpm/pool.d",Hl=9100,Ml=400;function ir(e){return(e.toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/^_+|_+$/g,"")||"site").slice(0,28)}function ji(e){return`web_${ir(e)}`}function Fl(e){let t=ir(e),r=0;for(let n=0;n<t.length;n++)r=r*31+t.charCodeAt(n)>>>0;return Hl+r%Ml}function hn(e){return`127.0.0.1:${Fl(e)}`}function zl(e){let t=ir(e.siteName),r=ji(e.siteName),n=e.maxChildren??10;return[`; ts-cloud-managed pool for ${e.siteName} (site isolation)`,`[${t}]`,`user = ${r}`,`group = ${r}`,`listen = ${hn(e.siteName)}`,"pm = dynamic",`pm.max_children = ${n}`,"pm.start_servers = 2","pm.min_spare_servers = 1","pm.max_spare_servers = 3","pm.max_requests = 500","catch_workers_output = yes",`php_admin_value[open_basedir] = ${e.appBase}:/tmp`,""].join(`
+`)}function Gi(e){let t=ji(e.siteName),r=ir(e.siteName),n=`${Ki}/${r}.conf`;return[`getent group ${t} >/dev/null || groupadd --system ${t}`,`id -u ${t} >/dev/null 2>&1 || useradd --system --no-create-home --shell /usr/sbin/nologin -g ${t} ${t}`,`usermod -aG ${t} www-data 2>/dev/null || true`,`chown -R ${t}:${t} ${e.appBase} || true`,`chmod -R g+rX ${e.appBase} || true`,`chmod 600 ${e.appBase}/shared/.env 2>/dev/null || true`,`mkdir -p ${Ki}`,`cat > ${n} <<'TS_CLOUD_FPMPOOL_EOF'`,zl(e).replace(/\n$/,""),"TS_CLOUD_FPMPOOL_EOF",`(cd ${b} && pantry restart php-fpm) 2>/dev/null || true`]}var vr={info:()=>{},warn:()=>{},error:()=>{},step:()=>{},success:()=>{}};function Gl(e){return`'${e.replace(/'/g,`'"'"'`)}'`}async function bs(e,t,r=vr){let{config:n,environment:s,siteName:i,site:o,slug:c,sha:l,runtime:m,localTarballPath:S}=t,y=`releases/${i}/${l}.tar.gz`,v=g(n,s),h=await e.getComputeOutputs({config:n,environment:s}),w=await e.findComputeTargets({slug:c,environment:s,role:"app",stackName:v});if(w.length===0)return{success:!1,error:e.name==="aws"?`Stack '${v}' has no EC2 instances tagged Project=${c} Environment=${s} Role=app, and storage/cloud/state/${v}.json pins no live instance. For a shared box, record its instanceId there.`:`No Hetzner servers labeled ts-cloud/project=${c} ts-cloud/environment=${s} ts-cloud/role=app, and storage/cloud/state/${v}.json pins no live server. For a shared box, record its serverId there.`};let E=h.servicesPrivateIp?zs(h.servicesPrivateIp,p(n)):ss(p(n)),R=cd(hi(n,{environment:s})),x=n.infrastructure?.compute,C=se(x)?{HOST:"127.0.0.1"}:{},T=s==="production"?{APP_ENV:"production",NODE_ENV:"production"}:{},P={...E,...R,...C,...o.env||{},...T},A=tn(P,o.sharedPaths??[]);if(A.warning)r.warn(`Site '${i}': ${A.warning}`);else if(A.path)r.info(`Site '${i}': sharing '${A.path}' so the SQLite database survives deploys.`);if(Ir(o)){let he=o.phpVersion??x?.php?.default??x?.php?.versions?.[0],L=B(c,i),W=Object.keys(E).length>0?{...o,env:P}:o,I=Hi({siteName:i,site:W,releaseId:l,appBase:L,defaultPhpVersion:he}),M=!se(x),pe=fn(o)==="custom"&&o.ssl?.certPath&&o.ssl?.keyPath?{certPath:o.ssl.certPath,keyPath:o.ssl.keyPath}:void 0,ke=o.isolation?Gi({siteName:i,appBase:L}):[],ft=M?Nr({siteName:i,domain:o.domain||i,aliases:o.aliases,type:o.type,appDir:`${L}/current`,webDirectory:o.webDirectory,phpVersion:he,fastcgiPass:o.isolation?hn(i):void 0,redirects:o.redirects,ssl:pe,auth:o.auth&&o.auth.enabled!==!1&&o.auth.password?{username:o.auth.username||"admin",password:o.auth.password,realm:o.auth.realm}:void 0,serverSnippet:kr(o.nginx,x?.nginxTemplates),clientMaxBodySize:o.nginx?.clientMaxBodySize,hsts:o.ssl?.hsts,tlsProtocols:o.ssl?.tlsProtocols,security:o.security}):[],yr=M?gn(o):[],gt=mn(o)?dn({slug:c,siteName:i,site:o,phpVersion:he,appBase:L}):[],qi=M?Ui(o):[];r.step(`Deploying PHP site '${i}' to ${w.length} target(s)...`);let Me=await e.runRemoteDeploy({targets:w,commands:[...en(L,c),...I,...ke,...ft,...yr,...gt,...qi],comment:`ts-cloud deploy ${c}/${i}@${l}`,tags:{Project:c,Environment:s,Role:"app"}}),An=ls(n.notifications,o.notifications);if(!Me.success)return await Hr(An,"deploy-failed",`❌ Deploy of ${c}/${i}@${l} failed: ${Me.error||"unknown error"}`),{success:!1,error:Me.error||"Remote PHP deploy failed",instanceCount:Me.instanceCount,perInstance:Me.perInstance};let Wi=o.domain?` → https://${o.domain}`:"";return await Hr(An,"deploy",`✅ Deployed ${c}/${i}@${l}${Wi}`),{success:!0,instanceCount:Me.instanceCount,perInstance:Me.perInstance}}if(!S)return{success:!1,error:`Site '${i}' requires a release tarball but none was provided`};let D=await e.uploadRelease({config:n,environment:s,localPath:S,remoteKey:y,targets:w}),O=Vn(c,i,l),U=e.name==="aws"?cc(h.deployBucketName,y,n.project.region||"us-east-1",O):dc(D.artifactRef,O),oe=u(o),F=B(c,i),Y=oe==="server-static"?qn({siteName:i,slug:c,appDir:F,artifactFetch:U,releaseId:l,preStartCommands:o.preStart}):Gn({siteName:i,slug:c,appDir:F,artifactFetch:U,releaseId:l,execStart:Hn(o.start,m,`${F.replace(/\/+$/,"")}/releases/%i`),envEntries:P,port:o.port,preStartCommands:o.preStart,sharedPaths:o.sharedPaths,zeroDowntime:o.zeroDowntime!==!1,healthCheckPath:o.healthCheck?.path,memoryHigh:o.memoryHigh,memoryMax:o.memoryMax,cpuWeight:o.cpuWeight,ioWeight:o.ioWeight,tasksMax:o.tasksMax,stopTimeout:o.stopTimeout}),J=oe==="server-static"&&!se(x)&&!!o.domain,j=J?Nr({siteName:i,domain:o.domain,aliases:o.aliases,type:o.type==="spa"?"spa":"static",appDir:`${F}/current`,webDirectory:"",redirects:o.redirects,auth:o.auth&&o.auth.enabled!==!1&&o.auth.password?{username:o.auth.username||"admin",password:o.auth.password,realm:o.auth.realm}:void 0,serverSnippet:kr(o.nginx,x?.nginxTemplates),clientMaxBodySize:o.nginx?.clientMaxBodySize,hsts:o.ssl?.hsts,tlsProtocols:o.ssl?.tlsProtocols,security:o.security}):[],te=J?gn(o):[],H=mn(o)?dn({slug:c,siteName:i,site:o,appBase:F}):[],Te=[...er(F,{releaseId:l,commit:l,branch:o.repository?.branch??"main"}),...en(F,c),...Y,...j,...te,...H,...jn()];r.step(`Deploying to ${w.length} target(s)...`);let Q=await e.runRemoteDeploy({targets:w,commands:Te,comment:`ts-cloud deploy ${c}/${i}@${l}`,tags:{Project:c,Environment:s,Role:"app"}});if(!Q.success)return{success:!1,error:Q.error||"Remote deploy failed",instanceCount:Q.instanceCount,perInstance:Q.perInstance};return{success:!0,instanceCount:Q.instanceCount,perInstance:Q.perInstance}}function or(e){return`'${e.replaceAll("'","'\\''")}'`}function Vl(e,t,r=!1,n=[]){let s=`${e}-dashboard-`,i=t.map((c)=>`${e}-${c}.service`),o=r?[`export TS_CLOUD_DASHBOARD_KEEP_DOMAINS=${or(JSON.stringify(n))}`,"rm -f /run/ts-cloud-dashboard-routes-changed",`/usr/local/bin/bun --bun -e ${or(`
           const { chmodSync, existsSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync } = require('node:fs')
           const { basename, join } = require('node:path')
           const root = '/etc/rpx/sites.d'
@@ -582,4 +582,4 @@ This password is now in your deploy log. Set TS_CLOUD_UI_PASSWORD to a value of
             changed = true
           }
           if (changed) writeFileSync('/run/ts-cloud-dashboard-routes-changed', '')
-        `)}`,"if [ -e /run/ts-cloud-dashboard-routes-changed ]; then","  systemctl restart rpx-gateway.service","  rm -f /run/ts-cloud-dashboard-routes-changed","fi"]:[];return["set -euo pipefail",`TS_CLOUD_DASHBOARD_PREFIX=${or(s)}`,`TS_CLOUD_DASHBOARD_SERVER_OWNER=${r?"1":"0"}`,`TS_CLOUD_DASHBOARD_DESIRED=${or(` ${i.join(" ")} `)}`,"for TS_CLOUD_UNIT_FILE in /etc/systemd/system/*.service; do",'  [ -e "$TS_CLOUD_UNIT_FILE" ] || continue','  TS_CLOUD_UNIT=$(basename "$TS_CLOUD_UNIT_FILE")','  case "$TS_CLOUD_UNIT" in',"    *-dashboard-*.service)",'      if [ "$TS_CLOUD_DASHBOARD_SERVER_OWNER" != 1 ]; then','        case "$TS_CLOUD_UNIT" in "$TS_CLOUD_DASHBOARD_PREFIX"*.service) ;; *) continue ;; esac',"      fi",'      case "$TS_CLOUD_DASHBOARD_DESIRED" in','        *" $TS_CLOUD_UNIT "*) ;;',"        *)",'          systemctl disable --now "$TS_CLOUD_UNIT" 2>/dev/null || true','          rm -f "$TS_CLOUD_UNIT_FILE"',"          ;;","      esac","      ;;","  esac","done","systemctl daemon-reload","systemctl reset-failed",...o]}async function Vl(e,t,r,n){let{config:s,environment:i}=t,o=s.project.slug,c=g(s,i),l=await e.findComputeTargets({slug:o,environment:i,role:"app",stackName:c});if(l.length===0)return!0;let m=await e.runRemoteDeploy({targets:l,commands:Gl(o,r,!s.cloud?.attachTo,r.map((S)=>s.sites?.[S]?.domain).filter((S)=>typeof S==="string")),comment:`ts-cloud reconcile management dashboard ${o}`,tags:{Project:o,Environment:i,Role:"app"}});if(!m.success)return n.error(`Management dashboard reconciliation failed: ${m.error||"unknown error"}`),!1;return!0}async function ql(e,t,r){let{config:n}=t,s=n.cloud?.attachTo;if(!s||!e.listReachableResources)return;let i;try{i=await e.listReachableResources()}catch(l){r.warn(`Could not determine this credential's reach: ${l instanceof Error?l.message:String(l)}`);return}let o=di(i,{ownerSlug:s,selfSlug:n.project.slug}),c=nn(o)>0;for(let l of fi(o,{ownerSlug:s,selfSlug:n.project.slug}))if(c)r.warn(l);else r.info(l)}async function Wl(e,t,r){let{config:n,environment:s}=t,i=n.cloud?.attachTo;if(!i)return!0;let o=Mi(n.infrastructure?.compute?.managedServices);if(o.length===0)return!0;let c=n.project.slug,l=g(n,s),m=await e.findComputeTargets({slug:c,environment:s,role:"app",stackName:l});if(m.length===0)return!0;let S=await e.runRemoteDeploy({targets:m,commands:Fi(o),comment:`ts-cloud preflight managed services ${c}`,tags:{Project:c,Environment:s,Role:"app"}});if(!S.success)return r.warn(`Could not check '${i}' for the declared services: ${S.error||"unknown error"}`),!0;let y=new Set;for(let v of S.perInstance)for(let h of zi(v.output,o))y.add(h);if(y.size===0)return!0;return r.error(Bi([...y],i,m[0]?.publicIp)),!1}async function Xl(e,t,r){let{config:n,environment:s}=t;if(!n.cloud?.attachTo)return!0;let i=n.infrastructure?.compute,o=p(n),c=Ye(o,i?.managedServices??{});if(c.length===0)return!0;let l=n.project.slug,m=g(n,s),S=await e.findComputeTargets({slug:l,environment:s,role:"app",stackName:m});if(S.length===0)return!0;r.step(`Ensuring database '${o?.name}' + role exist on the shared box...`);let y=await e.runRemoteDeploy({targets:S,commands:c,comment:`ts-cloud ensure database ${l}/${o?.name}`,tags:{Project:l,Environment:s,Role:"app"}});if(!y.success)return r.error(`Ensuring database '${o?.name}' failed: ${y.error||"unknown error"}`),!1;return r.success(`Database '${o?.name}' is ready on ${y.instanceCount} target(s)`),!0}async function pc(e){let{config:t,environment:r,driver:n,sha:s,runtime:i,tarballForSite:o,logger:c=vr}=e,l=t.project.slug,m=e.cwd??process.cwd(),S=e.managementDashboard!==!1,y=Ht(t);if(S)zn(t,{cwd:m,logger:{info:c.info,warn:c.warn}});let v=!S||y?[]:ln(t);if(S&&e.rpxConfig&&e.rpxConfig!==t&&!Ht(e.rpxConfig))zn(e.rpxConfig,{cwd:m,logger:{info:()=>{},warn:()=>{}}});if(S&&!await Vl(n,e,ln(t),c))return!1;let h=null,w=new Map;if(v.length>0)if(h=Cs(t.sites?.[v[0]],{cwd:m,slug:l,sha:s,siteName:v[0],logger:{info:c.info,warn:c.warn}}),!h){c.warn("Management dashboard: no artifact available — skipping dashboard site(s) for this deploy.");for(let T of v)if(t.sites)delete t.sites[T]}else for(let T of v){if(T===v[0]){w.set(T,h);continue}try{let P=Kl(Bl(),`${l}-${T}-${s}.tar.gz`);zl(h,P),w.set(T,P)}catch{w.set(T,h)}}let E=t.sites||{},R=Object.entries(E).filter(([T,P])=>{if(!P)return!1;let A=u(P);if(A==="bucket")return c.warn(`Site '${T}' targets a bucket — skipping (handled by the static-site path, not compute).`),!1;if(A==="redirect")return!1;if(A==="proxy")return!1;return!0});if(R.length===0)return Kn(e);if(await ql(n,e,c),!await Wl(n,e,c))return!1;if(!await Xl(n,e,c))return!1;let x=(T)=>w.get(T)??o(T);for(let[T,P]of R){c.step(`Deploying site: ${T}`);let A=Ir(P)?void 0:x(T),D=await bs(n,{config:t,environment:r,siteName:T,site:P,slug:l,sha:s,runtime:i,localTarballPath:A},c);if(!D.success){if(c.error(`Deploy of '${T}' failed: ${D.error||"unknown error"}`),D.perInstance)for(let O of D.perInstance)c.error(`  ${O.instanceId}: ${O.status}${O.error?` — ${O.error}`:""}`);return!1}if(c.success(`Deployed ${l}/${T}@${s} to ${D.instanceCount} target(s)`),D.perInstance)for(let O of D.perInstance)c.info(`  ✓ ${O.instanceId}: ${O.status}`)}if(!await Kn(e))return!1;return!0}async function Yl(e,t,r){let n=ms(e);if(!n||n.tls==="off")return n;let s=await $e(t,r),i=s?.provider==="ssh"?s.lanIp:void 0;return i?{...n,ip:i}:n}async function Kn(e){let{config:t,environment:r,driver:n,logger:s=vr}=e,i=e.rpxConfig??t,o=i.infrastructure?.compute?.proxy??t.infrastructure?.compute?.proxy;if(o?.engine!=="rpx")return!0;let c=i.sites||{},l=t.project.slug,m=g(t,r),S=await n.findComputeTargets({slug:l,environment:r,role:"lb",stackName:m});if(S.length>0){let C=(await n.findComputeTargets({slug:l,environment:r,role:"app",stackName:m})).map((A)=>({privateIp:A.privateIp,publicIp:A.publicIp})),T=lr(c,C,{proxy:o,slug:l});if(T.proxies.length===0)return s.warn("rpx gateway: no server sites with a domain to route — skipping gateway reload."),!0;s.step(`Reloading the load balancer's rpx gateway with ${T.proxies.length} route(s)...`);let P=await n.runRemoteDeploy({targets:S,commands:_e({config:T,slug:l,preserveManagementDashboardRoutes:e.managementDashboard===!1}),comment:`ts-cloud rpx gateway reload ${l}`,tags:{Project:l,Environment:r,Role:"lb"}});if(!P.success)return s.error(`rpx gateway reload failed: ${P.error||"unknown error"}`),!1;return s.success(`rpx gateway reloaded on ${P.instanceCount} load balancer(s)`),!0}let y=await Yl(t,m,e.cwd),v=z(c,{proxy:o,slug:l,lan:y});if(v.proxies.length===0)return s.warn("rpx gateway: no server sites with a domain to route — skipping gateway reload."),!0;let h=await n.findComputeTargets({slug:l,environment:r,role:"app",stackName:m});if(h.length===0)return s.warn("rpx gateway: no compute targets found — skipping gateway reload."),!0;let w=Boolean(t.cloud?.attachTo);if(w&&(o.version||o.tlsxVersion))s.warn(`rpx gateway: ignoring proxy.version/tlsxVersion — this project attaches to '${t.cloud?.attachTo}' and the gateway belongs to that box's owner.`);s.step(`Reloading rpx gateway with ${v.proxies.length} route(s)...`);let E=ye({proxy:o,config:v,slug:l,tenant:w,profile:gs(t),preserveManagementDashboardRoutes:e.managementDashboard===!1}),R=await n.runRemoteDeploy({targets:h,commands:E,comment:`ts-cloud rpx gateway reload ${l}`,tags:{Project:l,Environment:r,Role:"app"}});if(!R.success)return s.error(`rpx gateway reload failed: ${R.error||"unknown error"}`),!1;return s.success(`rpx gateway reloaded on ${R.instanceCount} target(s)`),!0}async function gc(e){let{config:t,environment:r,driver:n,logger:s=vr}=e,i=e.rpxConfig??t,o=i.infrastructure?.compute?.proxy??t.infrastructure?.compute?.proxy;if(o?.engine!=="rpx"||!o.onDemandTls)return!0;let c=z(i.sites||{},{proxy:o,slug:t.project.slug});if(c.proxies.length===0)return!0;let l=Br(c);if(l.length===0)return!0;let m=t.project.slug,S=g(t,r),y="lb",v=await n.findComputeTargets({slug:m,environment:r,role:y,stackName:S});if(v.length===0)y="app",v=await n.findComputeTargets({slug:m,environment:r,role:y,stackName:S});if(v.length===0)return s.warn("rpx TLS: no gateway targets found - skipping certificate issuance."),!0;s.step("Issuing rpx TLS certificates after DNS reconciliation...");let h=l.map((E)=>`test -s ${jl(`${c.productionCerts.certsDir}/${E}.crt`)}`).join(" && "),w=await n.runRemoteDeploy({targets:v,commands:[`systemctl start ${zr(m)}`,h],comment:`ts-cloud rpx TLS issuance ${m}`,tags:{Project:m,Environment:r,Role:y}});if(!w.success)return s.error(`rpx TLS issuance failed: ${w.error||"unknown error"}`),!1;return s.success(`rpx TLS certificates reconciled on ${w.instanceCount} gateway target(s)`),!0}var nh="658327ea-f89d-4fab-a63d-7e88639e58f6",ih="4135ea2d-6df8-44a3-9df3-4b5a84be39ad",sh="216adef6-5c7f-47e4-b989-5492eafa07d3";function Vi(e,t){let r={TargetOriginId:"origin",ViewerProtocolPolicy:"redirect-to-https",Compress:!0,CachePolicyId:t==="dynamic"?"4135ea2d-6df8-44a3-9df3-4b5a84be39ad":"658327ea-f89d-4fab-a63d-7e88639e58f6",OriginRequestPolicyId:"216adef6-5c7f-47e4-b989-5492eafa07d3",SmoothStreaming:!1,FieldLevelEncryptionId:"",TrustedSigners:{Enabled:!1,Quantity:0},TrustedKeyGroups:{Enabled:!1,Quantity:0},LambdaFunctionAssociations:{Quantity:0},FunctionAssociations:{Quantity:0},AllowedMethods:t==="dynamic"?{Quantity:7,Items:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:{Quantity:2,Items:["GET","HEAD"]}}:{Quantity:3,Items:["GET","HEAD","OPTIONS"],CachedMethods:{Quantity:2,Items:["GET","HEAD"]}}};if(e!==null)r.PathPattern=e;return r}function oh(e){let t=e.aliases;if(t.length===0)throw Error("buildCloudFrontOriginConfig: at least one alias is required");if(t.includes(e.originDomain))throw Error(`buildCloudFrontOriginConfig: originDomain ${e.originDomain} must not be one of the aliases (it would loop)`);if(e.originShield&&!e.originShieldRegion)throw Error("buildCloudFrontOriginConfig: originShieldRegion is required when originShield is enabled");let r=e.originSecretHeader??"X-Origin-Verify",n=e.originSecret?{Quantity:1,Items:[{HeaderName:r,HeaderValue:e.originSecret}]}:{Quantity:0},s=[...e.behaviors??[]].sort((i,o)=>o.pathPattern.length-i.pathPattern.length);return{CallerReference:e.callerReference??e.originDomain,Comment:e.comment??`Origin-fronted distribution for ${t[0]} → ${e.originDomain}`,Enabled:!0,Aliases:{Quantity:t.length,Items:t},DefaultRootObject:"",Origins:{Quantity:1,Items:[{Id:"origin",DomainName:e.originDomain,OriginPath:"",CustomHeaders:n,CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:"https-only",OriginSslProtocols:{Quantity:1,Items:["TLSv1.2"]},OriginReadTimeout:30,OriginKeepaliveTimeout:5},ConnectionAttempts:3,ConnectionTimeout:10,OriginShield:e.originShield?{Enabled:!0,OriginShieldRegion:e.originShieldRegion}:{Enabled:!1},OriginAccessControlId:""}]},OriginGroups:{Quantity:0},DefaultCacheBehavior:Vi(null,"static"),CacheBehaviors:{Quantity:s.length,Items:s.map((i)=>Vi(i.pathPattern,i.kind))},ViewerCertificate:{CloudFrontDefaultCertificate:!1,ACMCertificateArn:e.viewerCertificateArn,Certificate:e.viewerCertificateArn,CertificateSource:"acm",SSLSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"},PriceClass:e.priceClass??"PriceClass_All",HttpVersion:"http2and3",IsIPV6Enabled:!0,Restrictions:{GeoRestriction:{RestrictionType:"none",Quantity:0}},Logging:{Enabled:!1,IncludeCookies:!1,Bucket:"",Prefix:""},WebACLId:"",CustomErrorResponses:{Quantity:0}}}export{ru,Fa,Ae,Ua,yn,nu,Qa,In,wt,ar,Rt,iu,su,Vm,b,cr,hs,Sn,Dt,dr,ou,fs,Cn,bn,En,au,Ha,z,lr,jm,vn,Ga,xe,ye,_e,N,ur,Tn,pr,ae,qa,wn,Va,Rn,ja,za,gr,Ka,Oe,K,Wa,rt,Le,$e,nt,Ie,As,Ja,cu,du,Xa,lu,it,Dn,Ya,uu,pu,Za,mr,Se,ec,gu,mu,ys,Pn,st,hu,fu,Au,yu,Iu,Su,Cu,bu,Eu,Nn,kn,Bn,xn,_n,On,Ln,vu,Tu,hr,k,Is,wu,Ru,Du,tc,Pu,Nu,zm,rc,Km,Wm,ku,Bu,Jm,Xm,Ym,nc,xu,Zm,eh,th,$n,Mn,Un,Qn,ic,sc,oc,ac,rh,Pt,_u,Hn,Gn,qn,Vn,cc,dc,jn,lc,Ss,uc,Nt,zn,Cs,fr,bs,pc,Kn,gc,nh,ih,sh,oh};
+        `)}`,"if [ -e /run/ts-cloud-dashboard-routes-changed ]; then","  systemctl restart rpx-gateway.service","  rm -f /run/ts-cloud-dashboard-routes-changed","fi"]:[];return["set -euo pipefail",`TS_CLOUD_DASHBOARD_PREFIX=${or(s)}`,`TS_CLOUD_DASHBOARD_SERVER_OWNER=${r?"1":"0"}`,`TS_CLOUD_DASHBOARD_DESIRED=${or(` ${i.join(" ")} `)}`,"for TS_CLOUD_UNIT_FILE in /etc/systemd/system/*.service; do",'  [ -e "$TS_CLOUD_UNIT_FILE" ] || continue','  TS_CLOUD_UNIT=$(basename "$TS_CLOUD_UNIT_FILE")','  case "$TS_CLOUD_UNIT" in',"    *-dashboard-*.service)",'      if [ "$TS_CLOUD_DASHBOARD_SERVER_OWNER" != 1 ]; then','        case "$TS_CLOUD_UNIT" in "$TS_CLOUD_DASHBOARD_PREFIX"*.service) ;; *) continue ;; esac',"      fi",'      case "$TS_CLOUD_DASHBOARD_DESIRED" in','        *" $TS_CLOUD_UNIT "*) ;;',"        *)",'          systemctl disable --now "$TS_CLOUD_UNIT" 2>/dev/null || true','          rm -f "$TS_CLOUD_UNIT_FILE"',"          ;;","      esac","      ;;","  esac","done","systemctl daemon-reload","systemctl reset-failed",...o]}async function ql(e,t,r,n){let{config:s,environment:i}=t,o=s.project.slug,c=g(s,i),l=await e.findComputeTargets({slug:o,environment:i,role:"app",stackName:c});if(l.length===0)return!0;let m=await e.runRemoteDeploy({targets:l,commands:Vl(o,r,!s.cloud?.attachTo,r.map((S)=>s.sites?.[S]?.domain).filter((S)=>typeof S==="string")),comment:`ts-cloud reconcile management dashboard ${o}`,tags:{Project:o,Environment:i,Role:"app"}});if(!m.success)return n.error(`Management dashboard reconciliation failed: ${m.error||"unknown error"}`),!1;return!0}async function Wl(e,t,r){let{config:n}=t,s=n.cloud?.attachTo;if(!s||!e.listReachableResources)return;let i;try{i=await e.listReachableResources()}catch(l){r.warn(`Could not determine this credential's reach: ${l instanceof Error?l.message:String(l)}`);return}let o=di(i,{ownerSlug:s,selfSlug:n.project.slug}),c=nn(o)>0;for(let l of fi(o,{ownerSlug:s,selfSlug:n.project.slug}))if(c)r.warn(l);else r.info(l)}async function Xl(e,t,r){let{config:n,environment:s}=t,i=n.cloud?.attachTo;if(!i)return!0;let o=Mi(n.infrastructure?.compute?.managedServices);if(o.length===0)return!0;let c=n.project.slug,l=g(n,s),m=await e.findComputeTargets({slug:c,environment:s,role:"app",stackName:l});if(m.length===0)return!0;let S=await e.runRemoteDeploy({targets:m,commands:Fi(o),comment:`ts-cloud preflight managed services ${c}`,tags:{Project:c,Environment:s,Role:"app"}});if(!S.success)return r.warn(`Could not check '${i}' for the declared services: ${S.error||"unknown error"}`),!0;let y=new Set;for(let v of S.perInstance)for(let h of zi(v.output,o))y.add(h);if(y.size===0)return!0;return r.error(Bi([...y],i,m[0]?.publicIp)),!1}async function Yl(e,t,r){let{config:n,environment:s}=t;if(!n.cloud?.attachTo)return!0;let i=n.infrastructure?.compute,o=p(n),c=Ye(o,i?.managedServices??{});if(c.length===0)return!0;let l=n.project.slug,m=g(n,s),S=await e.findComputeTargets({slug:l,environment:s,role:"app",stackName:m});if(S.length===0)return!0;r.step(`Ensuring database '${o?.name}' + role exist on the shared box...`);let y=await e.runRemoteDeploy({targets:S,commands:c,comment:`ts-cloud ensure database ${l}/${o?.name}`,tags:{Project:l,Environment:s,Role:"app"}});if(!y.success)return r.error(`Ensuring database '${o?.name}' failed: ${y.error||"unknown error"}`),!1;return r.success(`Database '${o?.name}' is ready on ${y.instanceCount} target(s)`),!0}async function pc(e){let{config:t,environment:r,driver:n,sha:s,runtime:i,tarballForSite:o,logger:c=vr}=e,l=t.project.slug,m=e.cwd??process.cwd(),S=e.managementDashboard!==!1,y=Ht(t);if(S)zn(t,{cwd:m,logger:{info:c.info,warn:c.warn}});let v=!S||y?[]:ln(t);if(S&&e.rpxConfig&&e.rpxConfig!==t&&!Ht(e.rpxConfig))zn(e.rpxConfig,{cwd:m,logger:{info:()=>{},warn:()=>{}}});if(S&&!await ql(n,e,ln(t),c))return!1;let h=null,w=new Map;if(v.length>0)if(h=Cs(t.sites?.[v[0]],{cwd:m,slug:l,sha:s,siteName:v[0],logger:{info:c.info,warn:c.warn}}),!h){c.warn("Management dashboard: no artifact available — skipping dashboard site(s) for this deploy.");for(let T of v)if(t.sites)delete t.sites[T]}else for(let T of v){if(T===v[0]){w.set(T,h);continue}try{let P=jl(Kl(),`${l}-${T}-${s}.tar.gz`);Bl(h,P),w.set(T,P)}catch{w.set(T,h)}}let E=t.sites||{},R=Object.entries(E).filter(([T,P])=>{if(!P)return!1;let A=u(P);if(A==="bucket")return c.warn(`Site '${T}' targets a bucket — skipping (handled by the static-site path, not compute).`),!1;if(A==="redirect")return!1;if(A==="proxy")return!1;return!0});if(R.length===0)return Kn(e);if(await Wl(n,e,c),!await Xl(n,e,c))return!1;if(!await Yl(n,e,c))return!1;let x=(T)=>w.get(T)??o(T);for(let[T,P]of R){c.step(`Deploying site: ${T}`);let A=Ir(P)?void 0:x(T),D=await bs(n,{config:t,environment:r,siteName:T,site:P,slug:l,sha:s,runtime:i,localTarballPath:A},c);if(!D.success){if(c.error(`Deploy of '${T}' failed: ${D.error||"unknown error"}`),D.perInstance)for(let O of D.perInstance)c.error(`  ${O.instanceId}: ${O.status}${O.error?` — ${O.error}`:""}`);return!1}if(c.success(`Deployed ${l}/${T}@${s} to ${D.instanceCount} target(s)`),D.perInstance)for(let O of D.perInstance)c.info(`  ✓ ${O.instanceId}: ${O.status}`)}if(!await Kn(e))return!1;return!0}async function Jl(e,t,r){let n=ms(e);if(!n||n.tls==="off")return n;let s=await $e(t,r),i=s?.provider==="ssh"?s.lanIp:void 0;return i?{...n,ip:i}:n}async function Kn(e){let{config:t,environment:r,driver:n,logger:s=vr}=e,i=e.rpxConfig??t,o=i.infrastructure?.compute?.proxy??t.infrastructure?.compute?.proxy;if(o?.engine!=="rpx")return!0;let c=i.sites||{},l=t.project.slug,m=g(t,r),S=await n.findComputeTargets({slug:l,environment:r,role:"lb",stackName:m});if(S.length>0){let C=(await n.findComputeTargets({slug:l,environment:r,role:"app",stackName:m})).map((A)=>({privateIp:A.privateIp,publicIp:A.publicIp})),T=lr(c,C,{proxy:o,slug:l});if(T.proxies.length===0)return s.warn("rpx gateway: no server sites with a domain to route — skipping gateway reload."),!0;s.step(`Reloading the load balancer's rpx gateway with ${T.proxies.length} route(s)...`);let P=await n.runRemoteDeploy({targets:S,commands:_e({config:T,slug:l,preserveManagementDashboardRoutes:e.managementDashboard===!1}),comment:`ts-cloud rpx gateway reload ${l}`,tags:{Project:l,Environment:r,Role:"lb"}});if(!P.success)return s.error(`rpx gateway reload failed: ${P.error||"unknown error"}`),!1;return s.success(`rpx gateway reloaded on ${P.instanceCount} load balancer(s)`),!0}let y=await Jl(t,m,e.cwd),v=z(c,{proxy:o,slug:l,lan:y});if(v.proxies.length===0)return s.warn("rpx gateway: no server sites with a domain to route — skipping gateway reload."),!0;let h=await n.findComputeTargets({slug:l,environment:r,role:"app",stackName:m});if(h.length===0)return s.warn("rpx gateway: no compute targets found — skipping gateway reload."),!0;let w=Boolean(t.cloud?.attachTo);if(w&&(o.version||o.tlsxVersion))s.warn(`rpx gateway: ignoring proxy.version/tlsxVersion — this project attaches to '${t.cloud?.attachTo}' and the gateway belongs to that box's owner.`);s.step(`Reloading rpx gateway with ${v.proxies.length} route(s)...`);let E=ye({proxy:o,config:v,slug:l,tenant:w,profile:gs(t),preserveManagementDashboardRoutes:e.managementDashboard===!1}),R=await n.runRemoteDeploy({targets:h,commands:E,comment:`ts-cloud rpx gateway reload ${l}`,tags:{Project:l,Environment:r,Role:"app"}});if(!R.success)return s.error(`rpx gateway reload failed: ${R.error||"unknown error"}`),!1;return s.success(`rpx gateway reloaded on ${R.instanceCount} target(s)`),!0}async function gc(e){let{config:t,environment:r,driver:n,logger:s=vr}=e,i=e.rpxConfig??t,o=i.infrastructure?.compute?.proxy??t.infrastructure?.compute?.proxy;if(o?.engine!=="rpx"||!o.onDemandTls)return!0;let c=z(i.sites||{},{proxy:o,slug:t.project.slug});if(c.proxies.length===0)return!0;let l=Br(c);if(l.length===0)return!0;let m=t.project.slug,S=g(t,r),y="lb",v=await n.findComputeTargets({slug:m,environment:r,role:y,stackName:S});if(v.length===0)y="app",v=await n.findComputeTargets({slug:m,environment:r,role:y,stackName:S});if(v.length===0)return s.warn("rpx TLS: no gateway targets found - skipping certificate issuance."),!0;s.step("Issuing rpx TLS certificates after DNS reconciliation...");let h=l.map((E)=>`test -s ${Gl(`${c.productionCerts.certsDir}/${E}.crt`)}`).join(" && "),w=await n.runRemoteDeploy({targets:v,commands:[`systemctl start ${zr(m)}`,h],comment:`ts-cloud rpx TLS issuance ${m}`,tags:{Project:m,Environment:r,Role:y}});if(!w.success)return s.error(`rpx TLS issuance failed: ${w.error||"unknown error"}`),!1;return s.success(`rpx TLS certificates reconciled on ${w.instanceCount} gateway target(s)`),!0}var nh="658327ea-f89d-4fab-a63d-7e88639e58f6",ih="4135ea2d-6df8-44a3-9df3-4b5a84be39ad",sh="216adef6-5c7f-47e4-b989-5492eafa07d3";function Vi(e,t){let r={TargetOriginId:"origin",ViewerProtocolPolicy:"redirect-to-https",Compress:!0,CachePolicyId:t==="dynamic"?"4135ea2d-6df8-44a3-9df3-4b5a84be39ad":"658327ea-f89d-4fab-a63d-7e88639e58f6",OriginRequestPolicyId:"216adef6-5c7f-47e4-b989-5492eafa07d3",SmoothStreaming:!1,FieldLevelEncryptionId:"",TrustedSigners:{Enabled:!1,Quantity:0},TrustedKeyGroups:{Enabled:!1,Quantity:0},LambdaFunctionAssociations:{Quantity:0},FunctionAssociations:{Quantity:0},AllowedMethods:t==="dynamic"?{Quantity:7,Items:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:{Quantity:2,Items:["GET","HEAD"]}}:{Quantity:3,Items:["GET","HEAD","OPTIONS"],CachedMethods:{Quantity:2,Items:["GET","HEAD"]}}};if(e!==null)r.PathPattern=e;return r}function oh(e){let t=e.aliases;if(t.length===0)throw Error("buildCloudFrontOriginConfig: at least one alias is required");if(t.includes(e.originDomain))throw Error(`buildCloudFrontOriginConfig: originDomain ${e.originDomain} must not be one of the aliases (it would loop)`);if(e.originShield&&!e.originShieldRegion)throw Error("buildCloudFrontOriginConfig: originShieldRegion is required when originShield is enabled");let r=e.originSecretHeader??"X-Origin-Verify",n=e.originSecret?{Quantity:1,Items:[{HeaderName:r,HeaderValue:e.originSecret}]}:{Quantity:0},s=[...e.behaviors??[]].sort((i,o)=>o.pathPattern.length-i.pathPattern.length);return{CallerReference:e.callerReference??e.originDomain,Comment:e.comment??`Origin-fronted distribution for ${t[0]} → ${e.originDomain}`,Enabled:!0,Aliases:{Quantity:t.length,Items:t},DefaultRootObject:"",Origins:{Quantity:1,Items:[{Id:"origin",DomainName:e.originDomain,OriginPath:"",CustomHeaders:n,CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:"https-only",OriginSslProtocols:{Quantity:1,Items:["TLSv1.2"]},OriginReadTimeout:30,OriginKeepaliveTimeout:5},ConnectionAttempts:3,ConnectionTimeout:10,OriginShield:e.originShield?{Enabled:!0,OriginShieldRegion:e.originShieldRegion}:{Enabled:!1},OriginAccessControlId:""}]},OriginGroups:{Quantity:0},DefaultCacheBehavior:Vi(null,"static"),CacheBehaviors:{Quantity:s.length,Items:s.map((i)=>Vi(i.pathPattern,i.kind))},ViewerCertificate:{CloudFrontDefaultCertificate:!1,ACMCertificateArn:e.viewerCertificateArn,Certificate:e.viewerCertificateArn,CertificateSource:"acm",SSLSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"},PriceClass:e.priceClass??"PriceClass_All",HttpVersion:"http2and3",IsIPV6Enabled:!0,Restrictions:{GeoRestriction:{RestrictionType:"none",Quantity:0}},Logging:{Enabled:!1,IncludeCookies:!1,Bucket:"",Prefix:""},WebACLId:"",CustomErrorResponses:{Quantity:0}}}export{ru,Fa,Ae,Ua,yn,nu,Qa,In,wt,ar,Rt,iu,su,Vm,b,cr,hs,Sn,Dt,dr,ou,fs,Cn,bn,En,au,Ha,z,lr,jm,vn,Ga,xe,ye,_e,N,ur,Tn,pr,ae,qa,wn,Va,Rn,ja,za,gr,Ka,Oe,K,Wa,rt,Le,$e,nt,Ie,As,Ja,cu,du,Xa,lu,it,Dn,Ya,uu,pu,Za,mr,Se,ec,gu,mu,ys,Pn,st,hu,fu,Au,yu,Iu,Su,Cu,bu,Eu,Nn,kn,Bn,xn,_n,On,Ln,vu,Tu,hr,k,Is,wu,Ru,Du,tc,Pu,Nu,zm,rc,Km,Wm,ku,Bu,Jm,Xm,Ym,nc,xu,Zm,eh,th,$n,Mn,Un,Qn,ic,sc,oc,ac,rh,Pt,_u,Hn,Gn,qn,Vn,cc,dc,jn,lc,Ss,uc,Nt,zn,Cs,fr,bs,pc,Kn,gc,nh,ih,sh,oh};

package/dist/{chunk-5f26x0x9.js → chunk-jsffdsrf.js}

@@ -1,4 +1,4 @@
-import{nd,_,d,sd,O,p,de,g,Ft,ld,Js,gd,md,Ad,Mr,io,qt,yd,Id,wd,Rd}from"./chunk-b9pm7mbd.js";import{B,u}from"./chunk-xacvkpf8.js";import{ce,Bt,w,xt,s,ti,ws,br,wc,Rc,J,c,Ps,Ue,Er,Dc,_t,ks,Pc,vr,Bs,Tr,ii,$t,ci,di,Qe,Mt,Jc,Xc,ui,pi,lt,Vs,i,gi,zs,Ks}from"./chunk-dky93h4d.js";import{n,l}from"./chunk-4w8d2mf0.js";import{kt,a}from"./chunk-t5e5phth.js";import{sn}from"./chunk-f9pzjzye.js";import{on,Kl,Wi,P,v,Ji,Wl}from"./chunk-jnt7ab86.js";import{pe,Xt,es,Xe,V,re,C,ge,er,Ze,rr}from"./chunk-bkv2p4hp.js";import{j}from"./chunk-1bxqrj7m.js";import{b,cr,hs,Dt,dr,ou,za,Le,it,Dn,k,Pt,_u,Nt,fr}from"./chunk-b2b79jtk.js";import{me}from"./chunk-srh0ctd4.js";import{y}from"./chunk-sxtgx8fj.js";import{ke}from"./chunk-cwjskpj4.js";import{Ce}from"./chunk-etmbw4er.js";import{f}from"./chunk-trsaqsgv.js";function Jr(e){let t=Mc(e.name),r=Ju(e.configText);if(ZS(e.configText,r.start,r.end,t))throw Error(`Site '${t}' already exists in cloud.config.ts`);let o=vm({...e,name:t}),m=e.configText.slice(0,r.end).trimEnd(),h=e.configText.slice(r.end),I=m.endsWith("{")?`
+import{nd,_,d,sd,O,p,de,g,Ft,ld,Js,gd,md,Ad,Mr,io,qt,yd,Id,wd,Rd}from"./chunk-b9pm7mbd.js";import{B,u}from"./chunk-xacvkpf8.js";import{ce,Bt,w,xt,s,ti,ws,br,wc,Rc,J,c,Ps,Ue,Er,Dc,_t,ks,Pc,vr,Bs,Tr,ii,$t,ci,di,Qe,Mt,Jc,Xc,ui,pi,lt,Vs,i,gi,zs,Ks}from"./chunk-dky93h4d.js";import{n,l}from"./chunk-4w8d2mf0.js";import{kt,a}from"./chunk-t5e5phth.js";import{sn}from"./chunk-f9pzjzye.js";import{on,Kl,Wi,P,v,Ji,Wl}from"./chunk-jnt7ab86.js";import{pe,Xt,es,Xe,V,re,C,ge,er,Ze,rr}from"./chunk-bkv2p4hp.js";import{j}from"./chunk-1bxqrj7m.js";import{b,cr,hs,Dt,dr,ou,za,Le,it,Dn,k,Pt,_u,Nt,fr}from"./chunk-7vnj4b37.js";import{me}from"./chunk-srh0ctd4.js";import{y}from"./chunk-sxtgx8fj.js";import{ke}from"./chunk-cwjskpj4.js";import{Ce}from"./chunk-etmbw4er.js";import{f}from"./chunk-trsaqsgv.js";function Jr(e){let t=Mc(e.name),r=Ju(e.configText);if(ZS(e.configText,r.start,r.end,t))throw Error(`Site '${t}' already exists in cloud.config.ts`);let o=vm({...e,name:t}),m=e.configText.slice(0,r.end).trimEnd(),h=e.configText.slice(r.end),I=m.endsWith("{")?`
 `:m.endsWith(",")?`
 
 `:`,

package/dist/deploy/index.js

@@ -1 +1 @@
-import{Jr,Xr,Dl,Mi,Pl,Nl,kl,sa,Bl,xl,vm,_l,S,Ol,Fi,De,Ll,$l,NA,Ml,Tm,kA,BA,xA,wm,Rm,_A,OA,Dm,Pm,LA,Ui,Wt,oa,Yr,Zr,Jt,Je,It,Qi,Nm,en,Fl,Ul,aa,Gi,rn,qi,Ca}from"../chunk-5f26x0x9.js";import{ba,nn,sn,Vi,ji,zi,Ki,Ea,va}from"../chunk-f9pzjzye.js";import{Ta}from"../chunk-jnt7ab86.js";import"../chunk-bkv2p4hp.js";import"../chunk-srh0ctd4.js";import"../chunk-sxtgx8fj.js";import"../chunk-cwjskpj4.js";import"../chunk-1bxqrj7m.js";import"../chunk-azcvwr5m.js";import"../chunk-t054j0zn.js";import{ru,Fa,Ae,Ua,yn,nu,Qa,lc,Ss,uc,Nt,zn,Cs}from"../chunk-b2b79jtk.js";import"../chunk-etmbw4er.js";import"../chunk-trsaqsgv.js";import"../chunk-t5e5phth.js";import"../chunk-4w8d2mf0.js";import{ot,_h,Ac,Yn,Zn,ei,tp}from"../chunk-tg6yasej.js";import{B,Ir,Sr,yc,vs,u,Oh,rp,np,gy,my}from"../chunk-xacvkpf8.js";import"../chunk-dky93h4d.js";import"../chunk-b9pm7mbd.js";export{_h as DEFAULT_SITE_PORT_RANGE,ot as HOST_SITES_DIR,Ua as IPV6_EXCLUDED_HOST_LABELS,lc as MANAGEMENT_DASHBOARD_SITE,Jr as addSiteToCloudConfig,tp as allocateSitePorts,LA as buildAndPushContainerImage,Ta as buildAndPushServerlessImage,Wt as buildFunctionEnv,Zn as buildHostSitePortsScript,Cs as buildManagementDashboardArtifact,It as buildServerTopology,Qi as buildServerlessTopology,Nm as buildTopology,aa as collectEgressMetrics,ru as collectServerDnsDomains,Pm as createContainerImageDependencies,wm as createExistingStaticFullStackDependencies,Tm as createStaticApiOriginDependencies,rn as dashboardActions,Ss as dashboardCredentialsFile,Ll as dashboardPageRoutes,Ea as deleteStaticSite,_A as deployExistingStaticFullStack,oa as deployServerlessApp,my as deployShipsFiles,Ml as deploySite,kA as deployStaticApiOrigin,ji as deployStaticSite,va as deployStaticSiteFull,nn as deployStaticSiteWithExternalDns,sn as deployStaticSiteWithExternalDnsFull,Fl as egressReportMetrics,S as ensureDashboardActor,zn as ensureManagementDashboard,OA as estimateExistingStaticFullStackMonthlyCost,xA as estimateStaticApiOriginMonthlyCost,Ul as fetchEgressReport,Rm as generateExistingStaticFullStackTemplate,ba as generateExternalDnsStaticSiteTemplate,Vi as generateStaticSiteTemplate,Oh as hasComputeConfigured,yc as hasProxyUpstream,Dm as hashContainerContext,yn as hostAcceptsIpv6,Ui as infraEnvFromOutputs,Ol as initializeDashboardControlPlane,Ki as invalidateCache,Ir as isPhpSite,sa as isValidHostname,Ae as normalizePublicIpv6,Yn as occupiedHostPorts,ei as parseHostSiteFragments,Ac as parseUpstreamPort,nu as reconcileAddressRecords,Yr as redeployServerlessApp,Xr as removeSiteFromCloudConfig,Fa as removeStaleServerAddressRecords,Bl as renderAliasesValue,kl as renderEnvValue,xl as renderRedirectsValue,vm as renderSiteSnippet,Pl as renderSslValue,Nl as renderStringValue,qi as resolveDashboardAction,uc as resolveDashboardAuth,en as resolveDashboardData,$l as resolveLegacyDashboardRoute,Sr as resolveProxyUpstreams,vs as resolveSiteDeployTarget,u as resolveSiteKind,Nt as resolveUiSource,Zr as rollbackServerlessApp,NA as routesForDashboard,Je as runRemoteCommand,Gi as sanitizeCloudConfig,_l as setAttachToInCloudConfig,Jt as setMaintenance,Mi as setSitePropertyInCloudConfig,np as shipsARelease,gy as shipsToBucket,B as siteInstallBase,Ca as startLocalDashboardServer,Fi as synchronizeDashboardUsers,De as trackDashboardOperation,Dl as updateSiteInCloudConfig,zi as uploadStaticFiles,rp as validateDeploymentConfig,Qa as verifyAddressRecord,BA as verifyStaticApiOrigin};
+import{Jr,Xr,Dl,Mi,Pl,Nl,kl,sa,Bl,xl,vm,_l,S,Ol,Fi,De,Ll,$l,NA,Ml,Tm,kA,BA,xA,wm,Rm,_A,OA,Dm,Pm,LA,Ui,Wt,oa,Yr,Zr,Jt,Je,It,Qi,Nm,en,Fl,Ul,aa,Gi,rn,qi,Ca}from"../chunk-jsffdsrf.js";import{ba,nn,sn,Vi,ji,zi,Ki,Ea,va}from"../chunk-f9pzjzye.js";import{Ta}from"../chunk-jnt7ab86.js";import"../chunk-bkv2p4hp.js";import"../chunk-srh0ctd4.js";import"../chunk-sxtgx8fj.js";import"../chunk-cwjskpj4.js";import"../chunk-1bxqrj7m.js";import"../chunk-azcvwr5m.js";import"../chunk-t054j0zn.js";import{ru,Fa,Ae,Ua,yn,nu,Qa,lc,Ss,uc,Nt,zn,Cs}from"../chunk-7vnj4b37.js";import"../chunk-etmbw4er.js";import"../chunk-trsaqsgv.js";import"../chunk-t5e5phth.js";import"../chunk-4w8d2mf0.js";import{ot,_h,Ac,Yn,Zn,ei,tp}from"../chunk-tg6yasej.js";import{B,Ir,Sr,yc,vs,u,Oh,rp,np,gy,my}from"../chunk-xacvkpf8.js";import"../chunk-dky93h4d.js";import"../chunk-b9pm7mbd.js";export{_h as DEFAULT_SITE_PORT_RANGE,ot as HOST_SITES_DIR,Ua as IPV6_EXCLUDED_HOST_LABELS,lc as MANAGEMENT_DASHBOARD_SITE,Jr as addSiteToCloudConfig,tp as allocateSitePorts,LA as buildAndPushContainerImage,Ta as buildAndPushServerlessImage,Wt as buildFunctionEnv,Zn as buildHostSitePortsScript,Cs as buildManagementDashboardArtifact,It as buildServerTopology,Qi as buildServerlessTopology,Nm as buildTopology,aa as collectEgressMetrics,ru as collectServerDnsDomains,Pm as createContainerImageDependencies,wm as createExistingStaticFullStackDependencies,Tm as createStaticApiOriginDependencies,rn as dashboardActions,Ss as dashboardCredentialsFile,Ll as dashboardPageRoutes,Ea as deleteStaticSite,_A as deployExistingStaticFullStack,oa as deployServerlessApp,my as deployShipsFiles,Ml as deploySite,kA as deployStaticApiOrigin,ji as deployStaticSite,va as deployStaticSiteFull,nn as deployStaticSiteWithExternalDns,sn as deployStaticSiteWithExternalDnsFull,Fl as egressReportMetrics,S as ensureDashboardActor,zn as ensureManagementDashboard,OA as estimateExistingStaticFullStackMonthlyCost,xA as estimateStaticApiOriginMonthlyCost,Ul as fetchEgressReport,Rm as generateExistingStaticFullStackTemplate,ba as generateExternalDnsStaticSiteTemplate,Vi as generateStaticSiteTemplate,Oh as hasComputeConfigured,yc as hasProxyUpstream,Dm as hashContainerContext,yn as hostAcceptsIpv6,Ui as infraEnvFromOutputs,Ol as initializeDashboardControlPlane,Ki as invalidateCache,Ir as isPhpSite,sa as isValidHostname,Ae as normalizePublicIpv6,Yn as occupiedHostPorts,ei as parseHostSiteFragments,Ac as parseUpstreamPort,nu as reconcileAddressRecords,Yr as redeployServerlessApp,Xr as removeSiteFromCloudConfig,Fa as removeStaleServerAddressRecords,Bl as renderAliasesValue,kl as renderEnvValue,xl as renderRedirectsValue,vm as renderSiteSnippet,Pl as renderSslValue,Nl as renderStringValue,qi as resolveDashboardAction,uc as resolveDashboardAuth,en as resolveDashboardData,$l as resolveLegacyDashboardRoute,Sr as resolveProxyUpstreams,vs as resolveSiteDeployTarget,u as resolveSiteKind,Nt as resolveUiSource,Zr as rollbackServerlessApp,NA as routesForDashboard,Je as runRemoteCommand,Gi as sanitizeCloudConfig,_l as setAttachToInCloudConfig,Jt as setMaintenance,Mi as setSitePropertyInCloudConfig,np as shipsARelease,gy as shipsToBucket,B as siteInstallBase,Ca as startLocalDashboardServer,Fi as synchronizeDashboardUsers,De as trackDashboardOperation,Dl as updateSiteInCloudConfig,zi as uploadStaticFiles,rp as validateDeploymentConfig,Qa as verifyAddressRecord,BA as verifyStaticApiOrigin};

package/dist/drivers/index.js

@@ -1 +1 @@
-import{In,wt,ar,Rt,Sn,Cn,bn,En,au,Ha,z,lr,jm,vn,Ga,xe,ye,_e,N,ur,Tn,pr,ae,qa,wn,Va,Rn,ja,gr,Ka,Oe,K,Wa,rt,Le,$e,nt,Ie,As,Ja,cu,du,Xa,lu,it,Dn,Ya,uu,pu,Za,mr,Se,ec,gu,mu,ys,Pn,st,hu,fu,Au,yu,Iu,Su,Cu,bu,Eu,Nn,kn,Bn,xn,_n,On,Ln,vu,Tu,hr,k,Is,wu,Ru,Du,tc,Pu,Nu,zm,rc,Km,Wm,ku,Bu,Jm,Xm,Ym,nc,xu,Zm,eh,th,$n,Mn,Un,Qn,ic,sc,oc,ac,rh,Hn,Gn,qn,Vn,cc,dc,jn,bs,pc,Kn,gc,nh,ih,sh,oh}from"../chunk-b2b79jtk.js";import"../chunk-etmbw4er.js";import"../chunk-trsaqsgv.js";import"../chunk-t5e5phth.js";import"../chunk-4w8d2mf0.js";import"../chunk-xacvkpf8.js";import"../chunk-b9pm7mbd.js";export{ac as AwsBoxProvisioner,ur as AwsDriver,Du as BOOT_PARTITION_LABEL,Is as CloudDriverFactory,Cn as DEFAULT_RPX_CERTS_DIR,Ru as FIRST_BOOT_SCRIPT_PATH,oc as HetznerBoxProvisioner,gr as HetznerClient,Ie as HetznerDriver,Wa as LEGACY_DRIVER_STATE_DIR,As as LocalBoxDriver,ih as MANAGED_CACHE_POLICY_DISABLED,nh as MANAGED_CACHE_POLICY_OPTIMIZED,sh as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,mu as RASPBERRY_PI_DEFAULT_SWAP_GB,ja as REMOTE_SCRIPT_RUNNER,vn as RPX_DIR,Ga as RPX_LAUNCHER_PATH,xe as RPX_SERVICE_NAME,ec as SSH_BOOTSTRAP_MARKER_DIR,Se as SSH_BOOTSTRAP_VERSION,st as SSH_DEFAULTS,Ln as SSH_DEPLOY_STORAGE_PATH,cu as SSH_INSECURE_HOST_KEY_OPTS,du as SSH_KEEPALIVE_OPTS,kn as SSH_PREFLIGHT_SCRIPT,vu as SSH_SKIP_BOOTSTRAP_ENV,hr as SshDriver,mr as SystemSshTransport,ic as UBUNTU_2404_AMI_PARAM,th as acquireResizeLock,Jm as applyHetznerHostOptimization,ys as assertArchSupported,Tu as assertSshComputeConfig,cc as buildAwsArtifactFetch,sc as buildBoxUserData,oh as buildCloudFrontOriginConfig,tc as buildCloudInitFirstBoot,Bu as buildHetznerHostOptimizationScript,jn as buildHostCleanupScript,dc as buildLocalArtifactFetch,z as buildRpxConfig,_e as buildRpxFragmentRefreshScript,lr as buildRpxLbConfig,ye as buildRpxProvisionScript,lu as buildScpArgsFor,Gn as buildSiteDeployScript,Tn as buildSshArgs,Xa as buildSshArgsFor,Pn as buildSshBootstrapScript,qn as buildStaticSiteDeployScript,wu as cloudDrivers,Xm as collectHetznerHostOptimizationReport,rc as collectHetznerResizeManifest,rh as createBoxProvisioner,k as createCloudDriver,pc as deployAllComputeSites,bs as deploySiteRelease,Ha as deriveRouteId,In as describeScriptSyntaxError,rt as driverStateDir,Le as driverStatePath,Mn as ensureFirewall,Un as ensureServer,$n as ensureSshKey,xn as evaluatePreflight,zm as executeHetznerServerResize,pu as findKnownHostKey,On as formatPreflightFindings,wt as formatSshFailure,En as gatewayHostnames,N as generateUbuntuAppCloudInit,bn as hasAutoWwwVariant,Ja as isBoxMode,Nu as isHetznerCapacityError,Sn as isLocalDatabase,uu as knownHostsLine,Ya as knownHostsToken,au as normalizeRoutePath,Oe as normalizeSshPublicKey,Bn as parsePreflightFacts,Pu as planHetznerServerResize,_n as preflightFailed,Km as prepareHetznerResize,$e as readDriverState,Zm as readResizeCheckpoint,Vn as releaseTarballTmpPath,Kn as reloadRpxGateway,Rn as remoteScriptRunner,jm as renderRpxLauncher,gc as renewRpxCertificates,nc as resizeCheckpointPath,xu as resizeLockPath,Hn as resolveExecStart,Ka as resolveHetznerApiToken,ku as resolveHetznerHostOptimizationPlan,Iu as resolveSshHostKeyPolicy,hu as resolveSshHosts,Eu as resolveSshLan,Au as resolveSshPort,yu as resolveSshPrivateKeyPath,Cu as resolveSshProfile,bu as resolveSshPublicIp,Nn as resolveSshSettings,Su as resolveSshSudo,fu as resolveSshUser,Dn as scanHostKey,qa as scpUpload,Qn as serverPublicIpv4,gu as sshBootstrapMarkerPath,pr as sshExec,ae as sshExecOrThrow,it as sshHostKeyFingerprint,Za as sshKnownHostsPath,Rt as summarizeRemoteFailures,ar as surfaceRemoteNotices,Ym as verifyHetznerHostOptimization,Wm as verifyHetznerResize,Va as waitForCloudInit,wn as waitForSsh,K as wrapCloudInitUserData,nt as writeDriverState,eh as writeResizeCheckpoint};
+import{In,wt,ar,Rt,Sn,Cn,bn,En,au,Ha,z,lr,jm,vn,Ga,xe,ye,_e,N,ur,Tn,pr,ae,qa,wn,Va,Rn,ja,gr,Ka,Oe,K,Wa,rt,Le,$e,nt,Ie,As,Ja,cu,du,Xa,lu,it,Dn,Ya,uu,pu,Za,mr,Se,ec,gu,mu,ys,Pn,st,hu,fu,Au,yu,Iu,Su,Cu,bu,Eu,Nn,kn,Bn,xn,_n,On,Ln,vu,Tu,hr,k,Is,wu,Ru,Du,tc,Pu,Nu,zm,rc,Km,Wm,ku,Bu,Jm,Xm,Ym,nc,xu,Zm,eh,th,$n,Mn,Un,Qn,ic,sc,oc,ac,rh,Hn,Gn,qn,Vn,cc,dc,jn,bs,pc,Kn,gc,nh,ih,sh,oh}from"../chunk-7vnj4b37.js";import"../chunk-etmbw4er.js";import"../chunk-trsaqsgv.js";import"../chunk-t5e5phth.js";import"../chunk-4w8d2mf0.js";import"../chunk-xacvkpf8.js";import"../chunk-b9pm7mbd.js";export{ac as AwsBoxProvisioner,ur as AwsDriver,Du as BOOT_PARTITION_LABEL,Is as CloudDriverFactory,Cn as DEFAULT_RPX_CERTS_DIR,Ru as FIRST_BOOT_SCRIPT_PATH,oc as HetznerBoxProvisioner,gr as HetznerClient,Ie as HetznerDriver,Wa as LEGACY_DRIVER_STATE_DIR,As as LocalBoxDriver,ih as MANAGED_CACHE_POLICY_DISABLED,nh as MANAGED_CACHE_POLICY_OPTIMIZED,sh as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,mu as RASPBERRY_PI_DEFAULT_SWAP_GB,ja as REMOTE_SCRIPT_RUNNER,vn as RPX_DIR,Ga as RPX_LAUNCHER_PATH,xe as RPX_SERVICE_NAME,ec as SSH_BOOTSTRAP_MARKER_DIR,Se as SSH_BOOTSTRAP_VERSION,st as SSH_DEFAULTS,Ln as SSH_DEPLOY_STORAGE_PATH,cu as SSH_INSECURE_HOST_KEY_OPTS,du as SSH_KEEPALIVE_OPTS,kn as SSH_PREFLIGHT_SCRIPT,vu as SSH_SKIP_BOOTSTRAP_ENV,hr as SshDriver,mr as SystemSshTransport,ic as UBUNTU_2404_AMI_PARAM,th as acquireResizeLock,Jm as applyHetznerHostOptimization,ys as assertArchSupported,Tu as assertSshComputeConfig,cc as buildAwsArtifactFetch,sc as buildBoxUserData,oh as buildCloudFrontOriginConfig,tc as buildCloudInitFirstBoot,Bu as buildHetznerHostOptimizationScript,jn as buildHostCleanupScript,dc as buildLocalArtifactFetch,z as buildRpxConfig,_e as buildRpxFragmentRefreshScript,lr as buildRpxLbConfig,ye as buildRpxProvisionScript,lu as buildScpArgsFor,Gn as buildSiteDeployScript,Tn as buildSshArgs,Xa as buildSshArgsFor,Pn as buildSshBootstrapScript,qn as buildStaticSiteDeployScript,wu as cloudDrivers,Xm as collectHetznerHostOptimizationReport,rc as collectHetznerResizeManifest,rh as createBoxProvisioner,k as createCloudDriver,pc as deployAllComputeSites,bs as deploySiteRelease,Ha as deriveRouteId,In as describeScriptSyntaxError,rt as driverStateDir,Le as driverStatePath,Mn as ensureFirewall,Un as ensureServer,$n as ensureSshKey,xn as evaluatePreflight,zm as executeHetznerServerResize,pu as findKnownHostKey,On as formatPreflightFindings,wt as formatSshFailure,En as gatewayHostnames,N as generateUbuntuAppCloudInit,bn as hasAutoWwwVariant,Ja as isBoxMode,Nu as isHetznerCapacityError,Sn as isLocalDatabase,uu as knownHostsLine,Ya as knownHostsToken,au as normalizeRoutePath,Oe as normalizeSshPublicKey,Bn as parsePreflightFacts,Pu as planHetznerServerResize,_n as preflightFailed,Km as prepareHetznerResize,$e as readDriverState,Zm as readResizeCheckpoint,Vn as releaseTarballTmpPath,Kn as reloadRpxGateway,Rn as remoteScriptRunner,jm as renderRpxLauncher,gc as renewRpxCertificates,nc as resizeCheckpointPath,xu as resizeLockPath,Hn as resolveExecStart,Ka as resolveHetznerApiToken,ku as resolveHetznerHostOptimizationPlan,Iu as resolveSshHostKeyPolicy,hu as resolveSshHosts,Eu as resolveSshLan,Au as resolveSshPort,yu as resolveSshPrivateKeyPath,Cu as resolveSshProfile,bu as resolveSshPublicIp,Nn as resolveSshSettings,Su as resolveSshSudo,fu as resolveSshUser,Dn as scanHostKey,qa as scpUpload,Qn as serverPublicIpv4,gu as sshBootstrapMarkerPath,pr as sshExec,ae as sshExecOrThrow,it as sshHostKeyFingerprint,Za as sshKnownHostsPath,Rt as summarizeRemoteFailures,ar as surfaceRemoteNotices,Ym as verifyHetznerHostOptimization,Wm as verifyHetznerResize,Va as waitForCloudInit,wn as waitForSsh,K as wrapCloudInitUserData,nt as writeDriverState,eh as writeResizeCheckpoint};

package/dist/drivers/shared/deploy-script.d.ts

@@ -12,10 +12,32 @@
  */
 import type { SharedPathEntry } from '@ts-cloud/core';
 /**
- * Translate a `start` command (e.g. "bun run server.ts") into an absolute
- * systemd ExecStart by swapping the leading runtime word for its absolute path.
+ * Translate a `start` command into an absolute systemd ExecStart.
+ *
+ * Three shapes, because a site's entry point is not always a module:
+ *
+ *  1. `bun run server.ts` — a leading runtime word is swapped for its absolute
+ *     path, which is where the runtime actually lives on the box.
+ *  2. `dist/index.js` — a bare module gets the runtime put in front of it.
+ *  3. `./buddy serve` — an EXECUTABLE in the release, run directly.
+ *
+ * The third used to be impossible: every start was prefixed with the runtime,
+ * so pointing at a CLI wrapper — a shell script with a shebang, which is what
+ * `./buddy` is — had systemd run `bun ./buddy serve`, and bun parsed the shell
+ * as JavaScript. The service crash-looped on the wrapper's first line before
+ * it ever bound its port, which reads as an application crash rather than as
+ * the deploy handing the file to the wrong interpreter.
+ *
+ * That mattered because a project's CLI is the documented way to start it.
+ * Without this an app had to keep a bundled JS entry point beside the CLI it
+ * otherwise uses for everything, and keep the two in step by hand.
+ *
+ * `workingDirectory` is where a relative executable is resolved from —
+ * systemd requires an absolute ExecStart and does NOT resolve one against
+ * `WorkingDirectory`. Relative executables are left untouched without it,
+ * rather than emitting a unit that fails to start.
  */
-export declare function resolveExecStart(start: string, runtime: 'bun' | 'node' | 'deno'): string;
+export declare function resolveExecStart(start: string, runtime: 'bun' | 'node' | 'deno', workingDirectory?: string): string;
 /**
  * Shell that installs a recurring liveness check for one ported service.
  *

package/dist/index.js

@@ -1,4 +1,4 @@
-import{Dp,x,Pp,uf,Iy,pf,Sy,Cy,by,Ey,vy,Ty,wy,Ry,Dy,Py,Np,kp,nd,id,Ws,_,d,sd,Bp,O,od,p,gf,hi,ad,cd,de,dd,Ny,r,t,ky,By,g,xy,_y,Oy,Ly,$y,Ft,ld,Js,mf,My,Fy,be,He,Ee,L,I,o,A,Ge,m,hf,qe,M,ut,Uy,ff,F,ud,ve,Ut,Xs,X,pd,Y,Af,Ys,U,Q,D,fi,E,Qt,pt,H,e,Zs,Qy,xp,gd,Hy,Gy,qy,Vy,md,jy,zy,Ky,Wy,Jy,Xy,Yy,Zy,eI,tI,rI,nI,yf,If,Sf,Cf,bf,Ef,vf,Ht,_p,Op,_r,Ai,iI,Lp,sI,oI,Or,aI,cI,dI,lI,uI,pI,Tf,wf,Rf,Df,Pf,eo,gI,Nf,kf,Bf,G,mI,Ve,to,Gt,xf,$p,_f,Of,Lf,Mp,Z,hI,fI,yI,II,$f,SI,q,CI,bI,EI,Fp,Up,vI,Qp,Hp,TI,wI,RI,DI,PI,Mf,hd,NI,kI,BI,xI,_I,Ff,Uf,OI,LI,$I,MI,FI,UI,QI,HI,GI,Gp,fd,qI,VI,jI,zI,qp,Vp,jp,KI,zp,WI,JI,XI,YI,Kp,ZI,eS,tS,rS,nS,iS,sS,oS,Qf,Hf,Gf,qf,Wp,aS,cS,dS,lS,uS,pS,gS,mS,hS,Vf,jf,zf,Kf,fS,AS,Jp,yS,Xp,Yp,Zp,eg,IS,SS,CS,bS,Te,yi,ES,vS,TS,wS,RS,DS,PS,NS,Wf,kS,BS,tg,rg,xS,_S,Jf,OS,LS,$S,MS,FS,US,QS,HS,GS,qS,VS,jS,zS,KS,WS,JS,XS,YS,ZS,eC,tC,ng,rC,ig,nC,sg,iC,og,sC,ag,oC,Lr,aC,cg,cC,ro,dC,dg,lC,lg,uC,ug,pC,pg,gC,gg,mC,$r,hC,mg,fC,hg,AC,fg,yC,Ag,IC,yg,SC,Ig,CC,Sg,bC,Cg,EC,bg,vC,Eg,TC,vg,wC,Tg,RC,wg,DC,Rg,PC,Dg,NC,Pg,kC,Ng,BC,kg,xC,Bg,_C,xg,OC,_g,LC,Og,$C,Lg,MC,$g,FC,Mg,UC,Xf,Yf,Zf,eA,Fg,QC,Ug,HC,Qg,GC,Hg,qC,Ii,tA,rA,no,Ad,Mr,nA,io,qt,yd,Id,iA,sA,Gg,oA,Sd,qg,VC,jC,so,oo,ao,Cd,Si,bd,Ed,co,vd,Td,Vg,aA,cA,dA,zC,lA,uA,KC,pA,jg,gA,mA,hA,WC,fA,Ci,wd,AA,JC,yA,lo,uo,Rd,zg,XC,Kg,YC,Wg,ZC,Jg,eb,Xg,tb}from"./chunk-b9pm7mbd.js";import{Ao,Yg,_d,SA,Ti,Od,yo,Zg,em,Fr,Io,Ld,je,$d,Md,Fd,wi,Ur,tm,ze,Ud,So,Co,bo,Qd,Hd,Gd,Ri,Eo,qd,Qr,Di,vo,gt,rm,Vd,jd,nm,zd,To,Vt,Kd,Wd,Jd,Xd,Ke,im,Yd,jt,wo,Ro,Do,Pi,Ni,Hr,Zd,ki,Po,No,Gr,el,qr,sm,om,mt,Vr,ko,am,tl,rl,Bo,nl,il,sl,CA,ee,ol,bA,EA,Bi,xi,vA,le,cm,ht,we,Re,ft,al,cl,dl,ll,dm,lm,xo,um,pm,_o,ul,pl,gm,te,mm,gl,ue,Oo,We,At,yt,jr,_i,ml,TA,Lo,hm,fm,Am,ym,$o,Mo,hl,zr,Fo,fl,Oi,Al,Uo,Qo,Ho,Go,qo,Vo,jo,zo,yl,zt,Ko,Il,Kr,Sl,Wo,Jo,Cl,Kt,Xo,Yo,Im,wA,Li,RA,DA,PA,Zo,ea,bl,Sm,ta,Wr,El,$i,vl,Tl,wl,ra,Cm,na,Rl,bm,ia,Em,Jr,Xr,Dl,Mi,_l,Ml,Ui,Wt,oa,Yr,Zr,Jt,Je,km,ca,Bm,xm,Ql,da,Hi,Hl,la,St,Pe,Gl,ua,pa,ql,ga,ma,ha,fa,Vl,jl,tn,Aa,ya,Ia,Sa,zl,Gi,rn,qi,Ca}from"./chunk-5f26x0x9.js";import{B,Sr,yc,vs,u,rp,np}from"./chunk-xacvkpf8.js";import{ot,Ac,Yn,Zn,ei,tp}from"./chunk-tg6yasej.js";import{lh,uh,ph,Lu,$u,Mu,gh,Fu,Uu,mh,hh,Qu,fh,Ah,hc,Hu,yh,Ih,Gu,Sh,Ch,bh,Eh,vh,Th,wh,Xn,fc,qu,Vu,ju,zu,Ku,Wu,Ju,Xu,Yu,Zu,ep,Rh,Dh,Ph,Nh,kh,Bh,xh}from"./chunk-a0d0h33y.js";import{Fe,Ic,ce,Bt,Sc,w,xt,at,Cc,Ts,Lh,ip,bc,s,ti,ws,Cr,Ec,vc,br,$h,Tc,hy,fy,Rs,Ay,yy,wc,Rc,ri,Ds,J,c,Ps,Ue,Er,Mh,Fh,Dc,_t,Uh,Ns,Qh,Hh,ks,Pc,vr,Bs,Gh,Nc,sp,Ot,Tr,qh,xs,Vh,R,jh,kc,op,_s,zh,Kh,Wh,Bc,ni,Os,xc,Lt,ct,Jh,wr,Xh,_c,ap,cp,Ls,Oc,Lc,dt,dp,ii,$c,$s,Rr,lp,si,Mc,Fc,oi,up,Uc,Qc,Hc,Gc,Ms,pp,gp,Yh,mp,qc,ai,hp,fp,Fs,Dr,Us,Qs,Hs,Vc,Ap,jc,Gs,Zh,$t,ef,zc,Pr,Kc,tf,Wc,yp,ci,Nr,qs,di,Qe,rf,Ip,Sp,Mt,Jc,Xc,Yc,li,ui,pi,nf,sf,lt,Vs,of,kr,Cp,js,af,bp,Ep,vp,cf,Tp,wp,df,i,lf,gi,zs,Ks}from"./chunk-dky93h4d.js";import{n}from"./chunk-4w8d2mf0.js";import{a}from"./chunk-t5e5phth.js";import{pe,Xi,Yi,Jl,wa,Ra,Zi,Da,Xe,V,Ye,re,C,ge,an,Pa,Ne,Na,cn,dn,ln,Ct,bt,Et,un,Yt,ka,Zt,er,Ze,pn,xa,vt,tr,gn,Oa,eu,tu,La,rr}from"./chunk-bkv2p4hp.js";import{tt,ie,Be,ts,he,Tt,hn,rs,ns,nr,ir,fn,sr,is,ss,os,as,fe,cs,ds,ls,us,se,ps,gs,ms,T,$a,An,Ma,oe,or}from"./chunk-azcvwr5m.js";import{me,et,mn}from"./chunk-srh0ctd4.js";import{j}from"./chunk-1bxqrj7m.js";import{ru,Fa,Ae,Ua,yn,nu,Qa,iu,su,Vm,Sn,fs,Cn,bn,En,z,_e,N,ur,Tn,pr,ae,qa,wn,Va,gr,Ka,Oe,K,Le,$e,nt,Ie,mr,Se,Pn,Nn,kn,Bn,xn,_n,On,hr,k,Is,wu,tc,$n,Mn,Un,Qn,Hn,Gn,qn,jn,lc,Ss,uc,Nt,zn,Cs,bs,pc,Kn,gc}from"./chunk-b2b79jtk.js";import{Dd,po,bi,Ei,go,Pd,Nd,vi,mo,ho,Bd,xd,fo}from"./chunk-jghkvdgt.js";import{ba,nn,sn,Vi,ji,zi,Ki,Ea,va}from"./chunk-f9pzjzye.js";import{Ta}from"./chunk-jnt7ab86.js";import{y}from"./chunk-sxtgx8fj.js";import{ke}from"./chunk-cwjskpj4.js";import{h}from"./chunk-t054j0zn.js";import{W,Wn,Es,mc,Jn,Ou}from"./chunk-q4bk0htq.js";import{Ar,Ce}from"./chunk-etmbw4er.js";import{f}from"./chunk-trsaqsgv.js";import{ah,Me}from"./chunk-gdbtz492.js";import{Zc,Br,ed,td,rd,mi,Rp,xr}from"./chunk-9s5sm0wt.js";import{createHmac as ys,createSign as xl,timingSafeEqual as Ll}from"node:crypto";function Wi(l){let S=l instanceof Date?l.getTime():l;if(!Number.isFinite(S))throw TypeError("Media access timestamp must be finite");return Math.floor(S/1000)}function As(l){return Buffer.from(l).toString("base64").replaceAll("+","-").replaceAll("=","_").replaceAll("/","~")}function Fl(l){return Buffer.from(l).toString("base64url")}function ec(l,S=!1){if(!l||/[\r\n]/.test(l))throw TypeError("Media resource is invalid");let b=S?l.replaceAll("*","wildcard"):l,P=new URL(b);if(!["http:","https:"].includes(P.protocol))throw TypeError("Media resource must use HTTP or HTTPS");if(!S&&l.includes("*"))throw TypeError("Canned policies cannot contain wildcards")}function rc(l,S){let b=xl("RSA-SHA1");return b.update(l),b.end(),As(b.sign(S))}function nc(l){ec(l.resource,!0);let b={DateLessThan:{"AWS:EpochTime":Wi(l.expiresAt)}};if(l.activeAt!==void 0)b.DateGreaterThan={"AWS:EpochTime":Wi(l.activeAt)};if(l.ipAddress)b.IpAddress={"AWS:SourceIp":l.ipAddress};return JSON.stringify({Statement:[{Resource:l.resource,Condition:b}]})}function Du(l,S,b){ec(l);let P=Wi(S),v=l.includes("?")?"&":"?",it=nc({resource:l,expiresAt:S}),De=rc(it,b.privateKey);return`${l}${v}Expires=${P}&Signature=${encodeURIComponent(De)}&Key-Pair-Id=${encodeURIComponent(b.keyPairId)}`}function Iu(l,S){let b=nc(l);return{"CloudFront-Key-Pair-Id":S.keyPairId,"CloudFront-Policy":As(Buffer.from(b)),"CloudFront-Signature":rc(b,S.privateKey)}}function Eu(l){if(!l.resource||/[\r\n]/.test(l.resource))throw TypeError("Media resource is invalid");let S=Fl(Buffer.from(JSON.stringify({resource:l.resource,expiresAt:Wi(l.expiresAt),...l.keyId?{keyId:l.keyId}:{},...l.audience?{audience:l.audience}:{}}))),b=ys("sha256",l.secret).update(S).digest("base64url");return`${S}.${b}`}function vu(l,S){let[b,P,v]=l.split(".");if(!b||!P||v)return null;let it=ys("sha256",S.secret).update(b).digest(),De;try{De=Buffer.from(P,"base64url")}catch{return null}if(it.length!==De.length||!Ll(it,De))return null;try{let ye=JSON.parse(Buffer.from(b,"base64url").toString("utf8")),rt=Wi(S.now??Date.now());if(!ye.resource||!Number.isSafeInteger(ye.expiresAt)||ye.expiresAt<=rt)return null;if(S.resource&&ye.resource!==S.resource)return null;if(S.audience&&ye.audience!==S.audience)return null;return ye}catch{return null}}function Nu(l,S=!1){let b=new URL(l,"https://media.invalid").pathname.toLowerCase(),P=/\.(?:m3u8|mpd|vtt|json)$/.test(b),v=/\.(?:key|license)$/.test(b)||b.includes("/keys/")||b.includes("/licenses/");return{"Accept-Ranges":"bytes","Cache-Control":S&&(P||v)?"private, no-store":P?"public, max-age=5, s-maxage=30, stale-while-revalidate=30":"public, max-age=31536000, immutable","Cross-Origin-Resource-Policy":"cross-origin","X-Content-Type-Options":"nosniff"}}function ku(l){if(!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(l.bucket))throw TypeError("Media bucket is invalid");if(!/^[a-z0-9-]+$/.test(l.region))throw TypeError("Media bucket region is invalid");let S=l.prefix?`/${l.prefix.replace(/^\/+|\/+$/g,"")}`:"",b=l.protected??!1,P="public, max-age=31536000, immutable",v=b?"private, no-store":"public, max-age=5, s-maxage=30, stale-while-revalidate=30";return{originDomain:`${l.bucket}.s3.${l.region}.amazonaws.com`,originPath:S,domain:l.domain,trustedKeyGroupIds:[...new Set(l.trustedKeyGroupIds??[])],behaviors:[{pathPattern:"*.m3u8",cacheControl:v,compress:!0,signed:b},{pathPattern:"*.mpd",cacheControl:v,compress:!0,signed:b},{pathPattern:"*.vtt",cacheControl:v,compress:!0,signed:b},{pathPattern:"*",cacheControl:P,compress:!1,signed:b}],responseHeaders:{"Access-Control-Allow-Headers":"Range, If-Range","Access-Control-Allow-Methods":"GET, HEAD, OPTIONS","Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":"Accept-Ranges, Content-Length, Content-Range, ETag","X-Content-Type-Options":"nosniff"}}}class Bl{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;constructor(l){this.config=l.config,this.environment=l.environment,this.builder=new dd(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let S=this.config.environments[this.environment]?.infrastructure;if(!S)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...S,compute:{...this.config.infrastructure?.compute,...S.compute},storage:{...this.config.infrastructure?.storage,...S.storage},functions:{...this.config.infrastructure?.functions,...S.functions},servers:{...this.config.infrastructure?.servers,...S.servers},databases:{...this.config.infrastructure?.databases,...S.databases},cdn:{...this.config.infrastructure?.cdn,...S.cdn},sftp:S.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...S.queues},redirects:{...this.config.infrastructure?.redirects,...S.redirects},realtime:{...this.config.infrastructure?.realtime,...S.realtime},cache:{...this.config.infrastructure?.cache,...S.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...S.fileSystem},email:{...this.config.infrastructure?.email,...S.email},search:{...this.config.infrastructure?.search,...S.search},ai:{...this.config.infrastructure?.ai,...S.ai}}}}shouldDeploy(l){if(l.environments&&!l.environments.includes(this.environment))return!1;if(l.requiresFeatures){let S=this.config.features||{};if(!l.requiresFeatures.every((P)=>S[P]===!0))return!1}if(l.regions){let S=this.config.environments[this.environment]?.region||this.config.project.region;if(!l.regions.includes(S))return!1}if(l.condition&&typeof l.condition==="function")return l.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let l=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,S=Number(l||3008);return Number.isFinite(S)&&S>0?S:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(l,S){return l==="public"||S.routeCompute===!0}storageBucketName(l,S,b){return this.mergedConfig.infrastructure?.storage?.[b]?.bucket??`${l}-${S}-${b}`}fileSystemLogicalId(l,S,b){return t(r({slug:`${l}-${b}`,environment:S,resourceType:"efs"}))}resolveSftpStorage(l,S,b){let P=l.storage;if(P?.type==="efs"&&P.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[P.fileSystem])throw Error(`sftp: storage.fileSystem "${P.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(S,b,P.fileSystem)},posixProfile:P.posixProfile}}if(P?.type==="s3"&&P.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[P.storageBucket])throw Error(`sftp: storage.storageBucket "${P.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(S,b,P.storageBucket)}}return}resolveComputeCachePathPatterns(l){if(l&&l.length>0)return l;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(l,S){return{PathPattern:l,TargetOriginId:S,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(l,S,b,P,v,it){let De=this.serverEipLogicalIds.get("app"),ye=this.serverEipLogicalIds.get("appInstance");if(!De)return;let rt=`EC2-${P}-${v}-api`,Rt=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",st=Rt==="us-east-1"?".compute-1.amazonaws.com":`.${Rt}.compute.amazonaws.com`,lr={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:De}]}]},st]]},Xt=this.resolveApiOriginPort();if(l.push({Id:rt,DomainName:lr,CustomOriginConfig:{HTTPPort:Xt,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),b.push(De),ye)b.push(ye);for(let fr of it)S.push(this.createComputeCacheBehavior(fr,rt))}buildCaddyfile(l){let S=l.filter(([,v])=>typeof v.domain==="string"&&v.domain&&typeof v.port==="number");if(S.length===0)return;let b=new Map;for(let[,v]of S){let it=b.get(v.domain)??[];it.push({port:v.port,path:v.path}),b.set(v.domain,it)}let P=[];for(let[v,it]of b){let ye=[...it].sort((rt,Rt)=>{let st=!rt.path||rt.path==="/",lr=!Rt.path||Rt.path==="/";if(st&&!lr)return 1;if(!st&&lr)return-1;return(Rt.path?.length??0)-(rt.path?.length??0)}).map((rt)=>{let Rt=!rt.path||rt.path==="/",st=`reverse_proxy localhost:${rt.port}`;return Rt?`  handle {
+import{Dp,x,Pp,uf,Iy,pf,Sy,Cy,by,Ey,vy,Ty,wy,Ry,Dy,Py,Np,kp,nd,id,Ws,_,d,sd,Bp,O,od,p,gf,hi,ad,cd,de,dd,Ny,r,t,ky,By,g,xy,_y,Oy,Ly,$y,Ft,ld,Js,mf,My,Fy,be,He,Ee,L,I,o,A,Ge,m,hf,qe,M,ut,Uy,ff,F,ud,ve,Ut,Xs,X,pd,Y,Af,Ys,U,Q,D,fi,E,Qt,pt,H,e,Zs,Qy,xp,gd,Hy,Gy,qy,Vy,md,jy,zy,Ky,Wy,Jy,Xy,Yy,Zy,eI,tI,rI,nI,yf,If,Sf,Cf,bf,Ef,vf,Ht,_p,Op,_r,Ai,iI,Lp,sI,oI,Or,aI,cI,dI,lI,uI,pI,Tf,wf,Rf,Df,Pf,eo,gI,Nf,kf,Bf,G,mI,Ve,to,Gt,xf,$p,_f,Of,Lf,Mp,Z,hI,fI,yI,II,$f,SI,q,CI,bI,EI,Fp,Up,vI,Qp,Hp,TI,wI,RI,DI,PI,Mf,hd,NI,kI,BI,xI,_I,Ff,Uf,OI,LI,$I,MI,FI,UI,QI,HI,GI,Gp,fd,qI,VI,jI,zI,qp,Vp,jp,KI,zp,WI,JI,XI,YI,Kp,ZI,eS,tS,rS,nS,iS,sS,oS,Qf,Hf,Gf,qf,Wp,aS,cS,dS,lS,uS,pS,gS,mS,hS,Vf,jf,zf,Kf,fS,AS,Jp,yS,Xp,Yp,Zp,eg,IS,SS,CS,bS,Te,yi,ES,vS,TS,wS,RS,DS,PS,NS,Wf,kS,BS,tg,rg,xS,_S,Jf,OS,LS,$S,MS,FS,US,QS,HS,GS,qS,VS,jS,zS,KS,WS,JS,XS,YS,ZS,eC,tC,ng,rC,ig,nC,sg,iC,og,sC,ag,oC,Lr,aC,cg,cC,ro,dC,dg,lC,lg,uC,ug,pC,pg,gC,gg,mC,$r,hC,mg,fC,hg,AC,fg,yC,Ag,IC,yg,SC,Ig,CC,Sg,bC,Cg,EC,bg,vC,Eg,TC,vg,wC,Tg,RC,wg,DC,Rg,PC,Dg,NC,Pg,kC,Ng,BC,kg,xC,Bg,_C,xg,OC,_g,LC,Og,$C,Lg,MC,$g,FC,Mg,UC,Xf,Yf,Zf,eA,Fg,QC,Ug,HC,Qg,GC,Hg,qC,Ii,tA,rA,no,Ad,Mr,nA,io,qt,yd,Id,iA,sA,Gg,oA,Sd,qg,VC,jC,so,oo,ao,Cd,Si,bd,Ed,co,vd,Td,Vg,aA,cA,dA,zC,lA,uA,KC,pA,jg,gA,mA,hA,WC,fA,Ci,wd,AA,JC,yA,lo,uo,Rd,zg,XC,Kg,YC,Wg,ZC,Jg,eb,Xg,tb}from"./chunk-b9pm7mbd.js";import{Ao,Yg,_d,SA,Ti,Od,yo,Zg,em,Fr,Io,Ld,je,$d,Md,Fd,wi,Ur,tm,ze,Ud,So,Co,bo,Qd,Hd,Gd,Ri,Eo,qd,Qr,Di,vo,gt,rm,Vd,jd,nm,zd,To,Vt,Kd,Wd,Jd,Xd,Ke,im,Yd,jt,wo,Ro,Do,Pi,Ni,Hr,Zd,ki,Po,No,Gr,el,qr,sm,om,mt,Vr,ko,am,tl,rl,Bo,nl,il,sl,CA,ee,ol,bA,EA,Bi,xi,vA,le,cm,ht,we,Re,ft,al,cl,dl,ll,dm,lm,xo,um,pm,_o,ul,pl,gm,te,mm,gl,ue,Oo,We,At,yt,jr,_i,ml,TA,Lo,hm,fm,Am,ym,$o,Mo,hl,zr,Fo,fl,Oi,Al,Uo,Qo,Ho,Go,qo,Vo,jo,zo,yl,zt,Ko,Il,Kr,Sl,Wo,Jo,Cl,Kt,Xo,Yo,Im,wA,Li,RA,DA,PA,Zo,ea,bl,Sm,ta,Wr,El,$i,vl,Tl,wl,ra,Cm,na,Rl,bm,ia,Em,Jr,Xr,Dl,Mi,_l,Ml,Ui,Wt,oa,Yr,Zr,Jt,Je,km,ca,Bm,xm,Ql,da,Hi,Hl,la,St,Pe,Gl,ua,pa,ql,ga,ma,ha,fa,Vl,jl,tn,Aa,ya,Ia,Sa,zl,Gi,rn,qi,Ca}from"./chunk-jsffdsrf.js";import{B,Sr,yc,vs,u,rp,np}from"./chunk-xacvkpf8.js";import{ot,Ac,Yn,Zn,ei,tp}from"./chunk-tg6yasej.js";import{lh,uh,ph,Lu,$u,Mu,gh,Fu,Uu,mh,hh,Qu,fh,Ah,hc,Hu,yh,Ih,Gu,Sh,Ch,bh,Eh,vh,Th,wh,Xn,fc,qu,Vu,ju,zu,Ku,Wu,Ju,Xu,Yu,Zu,ep,Rh,Dh,Ph,Nh,kh,Bh,xh}from"./chunk-a0d0h33y.js";import{Fe,Ic,ce,Bt,Sc,w,xt,at,Cc,Ts,Lh,ip,bc,s,ti,ws,Cr,Ec,vc,br,$h,Tc,hy,fy,Rs,Ay,yy,wc,Rc,ri,Ds,J,c,Ps,Ue,Er,Mh,Fh,Dc,_t,Uh,Ns,Qh,Hh,ks,Pc,vr,Bs,Gh,Nc,sp,Ot,Tr,qh,xs,Vh,R,jh,kc,op,_s,zh,Kh,Wh,Bc,ni,Os,xc,Lt,ct,Jh,wr,Xh,_c,ap,cp,Ls,Oc,Lc,dt,dp,ii,$c,$s,Rr,lp,si,Mc,Fc,oi,up,Uc,Qc,Hc,Gc,Ms,pp,gp,Yh,mp,qc,ai,hp,fp,Fs,Dr,Us,Qs,Hs,Vc,Ap,jc,Gs,Zh,$t,ef,zc,Pr,Kc,tf,Wc,yp,ci,Nr,qs,di,Qe,rf,Ip,Sp,Mt,Jc,Xc,Yc,li,ui,pi,nf,sf,lt,Vs,of,kr,Cp,js,af,bp,Ep,vp,cf,Tp,wp,df,i,lf,gi,zs,Ks}from"./chunk-dky93h4d.js";import{n}from"./chunk-4w8d2mf0.js";import{a}from"./chunk-t5e5phth.js";import{pe,Xi,Yi,Jl,wa,Ra,Zi,Da,Xe,V,Ye,re,C,ge,an,Pa,Ne,Na,cn,dn,ln,Ct,bt,Et,un,Yt,ka,Zt,er,Ze,pn,xa,vt,tr,gn,Oa,eu,tu,La,rr}from"./chunk-bkv2p4hp.js";import{tt,ie,Be,ts,he,Tt,hn,rs,ns,nr,ir,fn,sr,is,ss,os,as,fe,cs,ds,ls,us,se,ps,gs,ms,T,$a,An,Ma,oe,or}from"./chunk-azcvwr5m.js";import{me,et,mn}from"./chunk-srh0ctd4.js";import{j}from"./chunk-1bxqrj7m.js";import{ru,Fa,Ae,Ua,yn,nu,Qa,iu,su,Vm,Sn,fs,Cn,bn,En,z,_e,N,ur,Tn,pr,ae,qa,wn,Va,gr,Ka,Oe,K,Le,$e,nt,Ie,mr,Se,Pn,Nn,kn,Bn,xn,_n,On,hr,k,Is,wu,tc,$n,Mn,Un,Qn,Hn,Gn,qn,jn,lc,Ss,uc,Nt,zn,Cs,bs,pc,Kn,gc}from"./chunk-7vnj4b37.js";import{Dd,po,bi,Ei,go,Pd,Nd,vi,mo,ho,Bd,xd,fo}from"./chunk-jghkvdgt.js";import{ba,nn,sn,Vi,ji,zi,Ki,Ea,va}from"./chunk-f9pzjzye.js";import{Ta}from"./chunk-jnt7ab86.js";import{y}from"./chunk-sxtgx8fj.js";import{ke}from"./chunk-cwjskpj4.js";import{h}from"./chunk-t054j0zn.js";import{W,Wn,Es,mc,Jn,Ou}from"./chunk-q4bk0htq.js";import{Ar,Ce}from"./chunk-etmbw4er.js";import{f}from"./chunk-trsaqsgv.js";import{ah,Me}from"./chunk-gdbtz492.js";import{Zc,Br,ed,td,rd,mi,Rp,xr}from"./chunk-9s5sm0wt.js";import{createHmac as ys,createSign as xl,timingSafeEqual as Ll}from"node:crypto";function Wi(l){let S=l instanceof Date?l.getTime():l;if(!Number.isFinite(S))throw TypeError("Media access timestamp must be finite");return Math.floor(S/1000)}function As(l){return Buffer.from(l).toString("base64").replaceAll("+","-").replaceAll("=","_").replaceAll("/","~")}function Fl(l){return Buffer.from(l).toString("base64url")}function ec(l,S=!1){if(!l||/[\r\n]/.test(l))throw TypeError("Media resource is invalid");let b=S?l.replaceAll("*","wildcard"):l,P=new URL(b);if(!["http:","https:"].includes(P.protocol))throw TypeError("Media resource must use HTTP or HTTPS");if(!S&&l.includes("*"))throw TypeError("Canned policies cannot contain wildcards")}function rc(l,S){let b=xl("RSA-SHA1");return b.update(l),b.end(),As(b.sign(S))}function nc(l){ec(l.resource,!0);let b={DateLessThan:{"AWS:EpochTime":Wi(l.expiresAt)}};if(l.activeAt!==void 0)b.DateGreaterThan={"AWS:EpochTime":Wi(l.activeAt)};if(l.ipAddress)b.IpAddress={"AWS:SourceIp":l.ipAddress};return JSON.stringify({Statement:[{Resource:l.resource,Condition:b}]})}function Du(l,S,b){ec(l);let P=Wi(S),v=l.includes("?")?"&":"?",it=nc({resource:l,expiresAt:S}),De=rc(it,b.privateKey);return`${l}${v}Expires=${P}&Signature=${encodeURIComponent(De)}&Key-Pair-Id=${encodeURIComponent(b.keyPairId)}`}function Iu(l,S){let b=nc(l);return{"CloudFront-Key-Pair-Id":S.keyPairId,"CloudFront-Policy":As(Buffer.from(b)),"CloudFront-Signature":rc(b,S.privateKey)}}function Eu(l){if(!l.resource||/[\r\n]/.test(l.resource))throw TypeError("Media resource is invalid");let S=Fl(Buffer.from(JSON.stringify({resource:l.resource,expiresAt:Wi(l.expiresAt),...l.keyId?{keyId:l.keyId}:{},...l.audience?{audience:l.audience}:{}}))),b=ys("sha256",l.secret).update(S).digest("base64url");return`${S}.${b}`}function vu(l,S){let[b,P,v]=l.split(".");if(!b||!P||v)return null;let it=ys("sha256",S.secret).update(b).digest(),De;try{De=Buffer.from(P,"base64url")}catch{return null}if(it.length!==De.length||!Ll(it,De))return null;try{let ye=JSON.parse(Buffer.from(b,"base64url").toString("utf8")),rt=Wi(S.now??Date.now());if(!ye.resource||!Number.isSafeInteger(ye.expiresAt)||ye.expiresAt<=rt)return null;if(S.resource&&ye.resource!==S.resource)return null;if(S.audience&&ye.audience!==S.audience)return null;return ye}catch{return null}}function Nu(l,S=!1){let b=new URL(l,"https://media.invalid").pathname.toLowerCase(),P=/\.(?:m3u8|mpd|vtt|json)$/.test(b),v=/\.(?:key|license)$/.test(b)||b.includes("/keys/")||b.includes("/licenses/");return{"Accept-Ranges":"bytes","Cache-Control":S&&(P||v)?"private, no-store":P?"public, max-age=5, s-maxage=30, stale-while-revalidate=30":"public, max-age=31536000, immutable","Cross-Origin-Resource-Policy":"cross-origin","X-Content-Type-Options":"nosniff"}}function ku(l){if(!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(l.bucket))throw TypeError("Media bucket is invalid");if(!/^[a-z0-9-]+$/.test(l.region))throw TypeError("Media bucket region is invalid");let S=l.prefix?`/${l.prefix.replace(/^\/+|\/+$/g,"")}`:"",b=l.protected??!1,P="public, max-age=31536000, immutable",v=b?"private, no-store":"public, max-age=5, s-maxage=30, stale-while-revalidate=30";return{originDomain:`${l.bucket}.s3.${l.region}.amazonaws.com`,originPath:S,domain:l.domain,trustedKeyGroupIds:[...new Set(l.trustedKeyGroupIds??[])],behaviors:[{pathPattern:"*.m3u8",cacheControl:v,compress:!0,signed:b},{pathPattern:"*.mpd",cacheControl:v,compress:!0,signed:b},{pathPattern:"*.vtt",cacheControl:v,compress:!0,signed:b},{pathPattern:"*",cacheControl:P,compress:!1,signed:b}],responseHeaders:{"Access-Control-Allow-Headers":"Range, If-Range","Access-Control-Allow-Methods":"GET, HEAD, OPTIONS","Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":"Accept-Ranges, Content-Length, Content-Range, ETag","X-Content-Type-Options":"nosniff"}}}class Bl{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;constructor(l){this.config=l.config,this.environment=l.environment,this.builder=new dd(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let S=this.config.environments[this.environment]?.infrastructure;if(!S)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...S,compute:{...this.config.infrastructure?.compute,...S.compute},storage:{...this.config.infrastructure?.storage,...S.storage},functions:{...this.config.infrastructure?.functions,...S.functions},servers:{...this.config.infrastructure?.servers,...S.servers},databases:{...this.config.infrastructure?.databases,...S.databases},cdn:{...this.config.infrastructure?.cdn,...S.cdn},sftp:S.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...S.queues},redirects:{...this.config.infrastructure?.redirects,...S.redirects},realtime:{...this.config.infrastructure?.realtime,...S.realtime},cache:{...this.config.infrastructure?.cache,...S.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...S.fileSystem},email:{...this.config.infrastructure?.email,...S.email},search:{...this.config.infrastructure?.search,...S.search},ai:{...this.config.infrastructure?.ai,...S.ai}}}}shouldDeploy(l){if(l.environments&&!l.environments.includes(this.environment))return!1;if(l.requiresFeatures){let S=this.config.features||{};if(!l.requiresFeatures.every((P)=>S[P]===!0))return!1}if(l.regions){let S=this.config.environments[this.environment]?.region||this.config.project.region;if(!l.regions.includes(S))return!1}if(l.condition&&typeof l.condition==="function")return l.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let l=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,S=Number(l||3008);return Number.isFinite(S)&&S>0?S:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(l,S){return l==="public"||S.routeCompute===!0}storageBucketName(l,S,b){return this.mergedConfig.infrastructure?.storage?.[b]?.bucket??`${l}-${S}-${b}`}fileSystemLogicalId(l,S,b){return t(r({slug:`${l}-${b}`,environment:S,resourceType:"efs"}))}resolveSftpStorage(l,S,b){let P=l.storage;if(P?.type==="efs"&&P.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[P.fileSystem])throw Error(`sftp: storage.fileSystem "${P.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(S,b,P.fileSystem)},posixProfile:P.posixProfile}}if(P?.type==="s3"&&P.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[P.storageBucket])throw Error(`sftp: storage.storageBucket "${P.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(S,b,P.storageBucket)}}return}resolveComputeCachePathPatterns(l){if(l&&l.length>0)return l;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(l,S){return{PathPattern:l,TargetOriginId:S,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(l,S,b,P,v,it){let De=this.serverEipLogicalIds.get("app"),ye=this.serverEipLogicalIds.get("appInstance");if(!De)return;let rt=`EC2-${P}-${v}-api`,Rt=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",st=Rt==="us-east-1"?".compute-1.amazonaws.com":`.${Rt}.compute.amazonaws.com`,lr={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:De}]}]},st]]},Xt=this.resolveApiOriginPort();if(l.push({Id:rt,DomainName:lr,CustomOriginConfig:{HTTPPort:Xt,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),b.push(De),ye)b.push(ye);for(let fr of it)S.push(this.createComputeCacheBehavior(fr,rt))}buildCaddyfile(l){let S=l.filter(([,v])=>typeof v.domain==="string"&&v.domain&&typeof v.port==="number");if(S.length===0)return;let b=new Map;for(let[,v]of S){let it=b.get(v.domain)??[];it.push({port:v.port,path:v.path}),b.set(v.domain,it)}let P=[];for(let[v,it]of b){let ye=[...it].sort((rt,Rt)=>{let st=!rt.path||rt.path==="/",lr=!Rt.path||Rt.path==="/";if(st&&!lr)return 1;if(!st&&lr)return-1;return(Rt.path?.length??0)-(rt.path?.length??0)}).map((rt)=>{let Rt=!rt.path||rt.path==="/",st=`reverse_proxy localhost:${rt.port}`;return Rt?`  handle {
     ${st}
   }`:`  handle ${rt.path} {
     ${st}

package/dist/ui/404.html

@@ -2,7 +2,7 @@
 <html lang="en" data-theme="dark">
 <head>
   <meta charset="UTF-8">
-  <meta name="stx-build" content="mtv5h7ggamaaq5">
+  <meta name="stx-build" content="mtvsy44ynhl7gk">
 
 <!-- stx SEO Tags -->
 <meta name="title" content="Page not found · ts-cloud">

package/dist/ui/accept-invitation.html

@@ -1,4 +1,4 @@
-<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mtv5go5mo7h6k4"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - Accept invitation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.616c25f3.css"></head><body class="auth-page"><main class="auth-card" id="main-content"><a class="brand" href="/"><span class="dot"></span><span>ts-cloud</span></a><div><span class="context-label">Organization invitation</span><h1>Join your team</h1><p>Choose the dashboard username and password you will use after this invitation is accepted.</p></div><form id="accept-invitation-form" class="auth-form"><div class="field-block"><label for="invite-name">Name</label><input id="invite-name" name="name" autocomplete="name" placeholder="Chris Breuer"></div><div class="field-block"><label for="invite-username">Username</label><input id="invite-username" name="username" autocomplete="username" minlength="2" maxlength="32" required></div><div class="field-block"><label for="invite-password">Password</label><input id="invite-password" name="password" type="password" autocomplete="new-password" minlength="12" required><small>At least 12 characters.</small></div><button class="btn" type="submit">Accept invitation</button><div id="invitation-status" class="auth-status" role="status"></div></form><p class="note">If this link expired or was already used, ask an organization owner to resend the invitation.</p></main> <script data-stx-scoped data-stx-run="always">
+<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mtvsxq9wshu7w5"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - Accept invitation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.616c25f3.css"></head><body class="auth-page"><main class="auth-card" id="main-content"><a class="brand" href="/"><span class="dot"></span><span>ts-cloud</span></a><div><span class="context-label">Organization invitation</span><h1>Join your team</h1><p>Choose the dashboard username and password you will use after this invitation is accepted.</p></div><form id="accept-invitation-form" class="auth-form"><div class="field-block"><label for="invite-name">Name</label><input id="invite-name" name="name" autocomplete="name" placeholder="Chris Breuer"></div><div class="field-block"><label for="invite-username">Username</label><input id="invite-username" name="username" autocomplete="username" minlength="2" maxlength="32" required></div><div class="field-block"><label for="invite-password">Password</label><input id="invite-password" name="password" type="password" autocomplete="new-password" minlength="12" required><small>At least 12 characters.</small></div><button class="btn" type="submit">Accept invitation</button><div id="invitation-status" class="auth-status" role="status"></div></form><p class="note">If this link expired or was already used, ask an organization owner to resend the invitation.</p></main> <script data-stx-scoped data-stx-run="always">
 ;(function() {
   'use strict';
 (() => {