@stacksjs/ts-cloud 0.16.43 → 0.16.45

package/dist/bin/{chunk-t80pxn04.js → chunk-50r8znqt.js}

@@ -1,4 +1,4 @@
-import{oa,A,w,ki,aa,ca,F,T,Wt,Lr}from"./chunk-tf8qxy9k.js";import{p}from"./chunk-dkf2kcsc.js";import{v}from"./chunk-7593hjcq.js";import{Q}from"./chunk-pf9dbm3b.js";import{g}from"./chunk-nmqjmx30.js";import{J,Ei,zs,P,U,Ir,St,et,No,wi,_o,vt,Hc,Oo,$o,Ii,Lo,Vt,Ws,qc,Pi,Ks,Js,Xs,Qs,Mo,pn,Ys,mn,Zs,Uo}from"./chunk-cqc4e8md.js";import{Ao,Ro,xs}from"./chunk-xxe9ga9r.js";import{ps}from"./chunk-n7yefy09.js";import{rn}from"./chunk-5nmt4s5w.js";import{Cr}from"./chunk-k343q24p.js";import{existsSync as Wl,readFileSync as Gl}from"node:fs";import{readFileSync as es}from"node:fs";import{join as Oa}from"node:path";function rs(e={}){let t=new Set;for(let r of Object.values(e)){if(!r.domain)continue;if(r.redirect||r.deploy==="server"||r.start)t.add(r.domain)}return t}function tr(e){return e.replace(/\.$/,"").toLowerCase()}function Ho(e,t,r){let n=tr(e.name),s=tr(t),i=tr(r),o=i===s?"@":i.endsWith(`.${s}`)?i.slice(0,-(s.length+1)):i;return n===i||n===o||o==="@"&&(n===""||n===s)}async function ko(e,t,r,n,s="A"){let i=await e.listRecords(t);if(!i.success)return[`could not list ${s} records: ${i.message||"unknown provider error"}`];let o=i.records.filter((l)=>l.type===s&&Ho(l,t,r)),a=o.findIndex((l)=>l.content===n);if(o.length<=1||a===-1)return[];let c=[];for(let[l,u]of o.entries()){if(l===a)continue;let d=await e.deleteRecord(t,u);if(!d.success)c.push(`could not remove stale ${u.name} ${s} ${u.content}: ${d.message||"unknown provider error"}`)}return c}function ue(e){if(!e)return;let t=e.trim();if(!t)return;if(!t.includes("/"))return t;let[r]=t.split("/");if(!r.endsWith("::"))return r||void 0;return`${r}1`}var Fo=new Set(["mail","smtp","imap","mx"]);function Wi(e){return!Fo.has(e.split(".")[0]??"")}async function ai(e){let{provider:t,zone:r,fqdn:n,ipv4:s,ipv6:i,ttl:o=600}=e,a={published:[],warnings:[]},c=[{type:"A",content:s}];if(i&&Wi(n))c.push({type:"AAAA",content:i});for(let{type:l,content:u}of c){let d=await t.upsertRecord(r,{name:n,type:l,content:u,ttl:o});if(d?.success===!1){a.warnings.push(`${n} → ${u} failed: ${d.error||d.message||"unknown error"}`);continue}if(a.warnings.push(...(await ko(t,r,n,u,l)).map((m)=>`${n} cleanup: ${m}`)),await Ki(t,r,n,u,l))a.published.push({fqdn:n,type:l,content:u});else a.warnings.push(`${n} → ${u} reported success at ${t.name} but no matching ${l} record exists — create it manually: ${l} ${n} → ${u}`)}return a}async function Ki(e,t,r,n,s){try{if(typeof e?.listRecords!=="function")return!0;let i=await e.listRecords(t);if(!i?.success||!Array.isArray(i.records))return!0;return i.records.some((o)=>{let a=typeof o?.name==="string"?o.name.replace(/\.$/,""):"";return o?.type===s&&a===r&&o?.content===n})}catch{return!0}}function rr(e){return(Buffer.isBuffer(e)?e.toString("utf8"):typeof e==="string"?e:"").replace(/(^|\n)(\s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_]*=).*$/gm,"$1$2[redacted]").replace(/encrypted:[A-Za-z0-9+/=]+/g,"encrypted:[redacted]").trim().slice(-8000)}function st(e,t){let r=rr(e?.stderr),n=/line (\d+): syntax error/.exec(r);if(!n)return"";let s=Number(n[1]),i=t.split(`
+import{oa,A,w,ki,aa,ca,B,T,Wt,Lr}from"./chunk-dj03v81n.js";import{p}from"./chunk-psvqpztv.js";import{v}from"./chunk-xdk0gmxt.js";import{Q}from"./chunk-q8b77zgw.js";import{g}from"./chunk-12x968en.js";import{J,Ei,zs,P,U,Ir,St,et,No,wi,_o,vt,Hc,Oo,$o,Ii,Lo,Vt,Ws,qc,Pi,Ks,Js,Xs,Qs,Mo,pn,Ys,mn,Zs,Uo}from"./chunk-yp3a0j9n.js";import{Ao,Ro,xs}from"./chunk-gyvkravq.js";import{ps}from"./chunk-n7yefy09.js";import{rn}from"./chunk-5nmt4s5w.js";import{Cr}from"./chunk-k343q24p.js";import{existsSync as Wl,readFileSync as Gl}from"node:fs";import{readFileSync as es}from"node:fs";import{join as Oa}from"node:path";function rs(e={}){let t=new Set;for(let r of Object.values(e)){if(!r.domain)continue;if(r.redirect||r.deploy==="server"||r.start)t.add(r.domain)}return t}function tr(e){return e.replace(/\.$/,"").toLowerCase()}function Ho(e,t,r){let n=tr(e.name),s=tr(t),i=tr(r),o=i===s?"@":i.endsWith(`.${s}`)?i.slice(0,-(s.length+1)):i;return n===i||n===o||o==="@"&&(n===""||n===s)}async function ko(e,t,r,n,s="A"){let i=await e.listRecords(t);if(!i.success)return[`could not list ${s} records: ${i.message||"unknown provider error"}`];let o=i.records.filter((l)=>l.type===s&&Ho(l,t,r)),a=o.findIndex((l)=>l.content===n);if(o.length<=1||a===-1)return[];let c=[];for(let[l,u]of o.entries()){if(l===a)continue;let d=await e.deleteRecord(t,u);if(!d.success)c.push(`could not remove stale ${u.name} ${s} ${u.content}: ${d.message||"unknown provider error"}`)}return c}function ue(e){if(!e)return;let t=e.trim();if(!t)return;if(!t.includes("/"))return t;let[r]=t.split("/");if(!r.endsWith("::"))return r||void 0;return`${r}1`}var Fo=new Set(["mail","smtp","imap","mx"]);function Wi(e){return!Fo.has(e.split(".")[0]??"")}async function ai(e){let{provider:t,zone:r,fqdn:n,ipv4:s,ipv6:i,ttl:o=600}=e,a={published:[],warnings:[]},c=[{type:"A",content:s}];if(i&&Wi(n))c.push({type:"AAAA",content:i});for(let{type:l,content:u}of c){let d=await t.upsertRecord(r,{name:n,type:l,content:u,ttl:o});if(d?.success===!1){a.warnings.push(`${n} → ${u} failed: ${d.error||d.message||"unknown error"}`);continue}if(a.warnings.push(...(await ko(t,r,n,u,l)).map((m)=>`${n} cleanup: ${m}`)),await Ki(t,r,n,u,l))a.published.push({fqdn:n,type:l,content:u});else a.warnings.push(`${n} → ${u} reported success at ${t.name} but no matching ${l} record exists — create it manually: ${l} ${n} → ${u}`)}return a}async function Ki(e,t,r,n,s){try{if(typeof e?.listRecords!=="function")return!0;let i=await e.listRecords(t);if(!i?.success||!Array.isArray(i.records))return!0;return i.records.some((o)=>{let a=typeof o?.name==="string"?o.name.replace(/\.$/,""):"";return o?.type===s&&a===r&&o?.content===n})}catch{return!0}}function rr(e){return(Buffer.isBuffer(e)?e.toString("utf8"):typeof e==="string"?e:"").replace(/(^|\n)(\s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_]*=).*$/gm,"$1$2[redacted]").replace(/encrypted:[A-Za-z0-9+/=]+/g,"encrypted:[redacted]").trim().slice(-8000)}function st(e,t){let r=rr(e?.stderr),n=/line (\d+): syntax error/.exec(r);if(!n)return"";let s=Number(n[1]),i=t.split(`
 `),o=Math.max(1,s-12),a=Math.min(i.length,s+2),c=i.slice(o-1,a).map((l,u)=>{let d=o+u,m=/^[A-Z_][A-Z0-9_]*=/.test(l)?l.replace(/=.*/,"=<redacted>"):l;return`  ${String(d).padStart(4)}${d===s?" >":"  "} ${m}`});return["",`The deploy script bash rejected is ${i.length} lines; it stopped at ${s}.`,...c].join(`
 `)}function Pe(e){let t=e,r=typeof t?.status==="number"?` (exit ${t.status})`:"",n=t?.signal?` (signal ${t.signal})`:"",s=[rr(t?.stderr),rr(t?.stdout)].filter(Boolean).join(`
 `);return`Remote SSH command failed${r}${n}${s?`
@@ -12,7 +12,7 @@ EOF`,`DISK_PCT=$(df -P / | awk 'NR==2{gsub("%","",$5); print $5}')`,"UPTIME_SEC=
 `)}
 `}return`${["server {","    listen 80;","    listen [::]:80;",`    server_name ${r};`,...n,"}"].join(`
 `)}
-`}function sr(e){let t=`/etc/nginx/sites-available/${e.siteName}`,r=`/etc/nginx/sites-enabled/${e.siteName}`,n=sa(e),s=[...ir()];if(e.auth){let i=Dn(e.siteName),o=(l)=>l.split("'").join("'\\''"),a=o(e.auth.password),c=o(e.auth.username);s.push(`TS_CLOUD_HTPASS=$(openssl passwd -apr1 '${a}')`,`printf '%s:%s\\n' '${c}' "$TS_CLOUD_HTPASS" > ${i}`,`chmod 640 ${i}`,`chown root:www-data ${i} 2>/dev/null || true`)}return s.push(`cat > ${t} <<'TS_CLOUD_NGINX_EOF'`,n.replace(/\n$/,""),"TS_CLOUD_NGINX_EOF",`ln -sf ${t} ${r}`,"rm -f /etc/nginx/sites-enabled/default",`${ye} -t`,"systemctl reload ts-cloud-nginx 2>/dev/null || systemctl restart ts-cloud-nginx 2>/dev/null || true"),s}var ye="/usr/local/bin/ts-cloud-nginx";function ir(e="/opt/pantry"){return[...Ir(),...et(["nginx.org"]),"mkdir -p /etc/nginx/sites-available /etc/nginx/sites-enabled /var/log/nginx /var/lib/nginx/body /var/lib/nginx/proxy /var/lib/nginx/fastcgi /var/lib/nginx/uwsgi /var/lib/nginx/scgi","getent passwd www-data >/dev/null || useradd --system --no-create-home --shell /usr/sbin/nologin www-data","chown -R www-data:www-data /var/lib/nginx /var/log/nginx",`cat > ${ye} <<'TS_CLOUD_NGINXBIN_EOF'`,"#!/bin/sh",`eval "$(cd ${e} && pantry env 2>/dev/null)"`,"NGINX_BIN=/opt/pantry/pantry/.bin/nginx",'if [ ! -x "$NGINX_BIN" ]; then NGINX_BIN=$(command -v nginx || true); fi','if [ -z "$NGINX_BIN" ]; then echo "nginx binary not found; run pantry install nginx.org or install nginx explicitly" >&2; exit 1; fi','exec "$NGINX_BIN" -c /etc/nginx/nginx.conf "$@"',"TS_CLOUD_NGINXBIN_EOF",`chmod +x ${ye}`,"cat > /etc/nginx/fastcgi_params <<'TS_CLOUD_FCGI_EOF'","fastcgi_param  QUERY_STRING       $query_string;","fastcgi_param  REQUEST_METHOD     $request_method;","fastcgi_param  CONTENT_TYPE       $content_type;","fastcgi_param  CONTENT_LENGTH     $content_length;","fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;","fastcgi_param  REQUEST_URI        $request_uri;","fastcgi_param  DOCUMENT_URI       $document_uri;","fastcgi_param  DOCUMENT_ROOT      $document_root;","fastcgi_param  SERVER_PROTOCOL    $server_protocol;","fastcgi_param  REQUEST_SCHEME     $scheme;","fastcgi_param  HTTPS              $https if_not_empty;","fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;","fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;","fastcgi_param  REMOTE_ADDR        $remote_addr;","fastcgi_param  REMOTE_PORT        $remote_port;","fastcgi_param  SERVER_ADDR        $server_addr;","fastcgi_param  SERVER_PORT        $server_port;","fastcgi_param  SERVER_NAME        $server_name;","fastcgi_param  REDIRECT_STATUS    200;","TS_CLOUD_FCGI_EOF","cat > /etc/nginx/nginx.conf <<'TS_CLOUD_NGINXCONF_EOF'","user www-data;","worker_processes auto;","pid /run/nginx.pid;","error_log /var/log/nginx/error.log;","events { worker_connections 1024; }","http {","    default_type application/octet-stream;","    types {","        text/html html htm;","        text/css css;","        application/javascript js;","        application/json json;","        image/svg+xml svg;","        image/png png;","        image/jpeg jpg jpeg;","        image/gif gif;","        image/x-icon ico;","        image/webp webp;","        font/woff2 woff2;","        font/woff woff;","        text/plain txt;","    }","    access_log /var/log/nginx/access.log;","    sendfile on;","    tcp_nopush on;","    keepalive_timeout 65;","    server_tokens off;","    client_max_body_size 100m;","    client_body_temp_path /var/lib/nginx/body;","    proxy_temp_path /var/lib/nginx/proxy;","    fastcgi_temp_path /var/lib/nginx/fastcgi;","    uwsgi_temp_path /var/lib/nginx/uwsgi;","    scgi_temp_path /var/lib/nginx/scgi;","    server {","        listen 80 default_server;","        listen [::]:80 default_server;","        server_name _;","        return 444;","    }","    include /etc/nginx/sites-enabled/*;","}","TS_CLOUD_NGINXCONF_EOF","cat > /etc/systemd/system/ts-cloud-nginx.service <<'TS_CLOUD_NGINXUNIT_EOF'","[Unit]","Description=ts-cloud nginx (pantry)","After=network.target","","[Service]","Type=simple",`ExecStartPre=${ye} -t`,`ExecStart=${ye} -g 'daemon off;'`,`ExecReload=${ye} -s reload`,"Restart=always","RestartSec=3","","[Install]","WantedBy=multi-user.target","TS_CLOUD_NGINXUNIT_EOF","systemctl daemon-reload","systemctl enable ts-cloud-nginx","ls /etc/nginx/sites-enabled/* >/dev/null 2>&1 && systemctl restart ts-cloud-nginx || true"]}function it(e,t){return!e.events||e.events.includes(t)}async function or(e,t,r,n={}){if(!e)return[];let s=n.fetchImpl??globalThis.fetch,i=[],o=[],a=(c,l)=>s(c,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(l)}).catch(()=>{return});if(e.slack?.webhookUrl&&it(e,t))i.push("slack"),o.push(a(e.slack.webhookUrl,{text:r}));if(e.discord?.webhookUrl&&it(e,t))i.push("discord"),o.push(a(e.discord.webhookUrl,{content:r}));if(e.telegram?.botToken&&e.telegram.chatId&&it(e,t)){i.push("telegram");let c=`https://api.telegram.org/bot${e.telegram.botToken}/sendMessage`;o.push(a(c,{chat_id:e.telegram.chatId,text:r}))}if(e.webhook?.url&&it(e,t))if(i.push("webhook"),(e.webhook.method||"POST")==="GET"){let c=e.webhook.url.includes("?")?"&":"?",l=`${e.webhook.url}${c}event=${encodeURIComponent(t)}&message=${encodeURIComponent(r)}`;o.push(s(l,{method:"GET"}).catch(()=>{return}))}else o.push(a(e.webhook.url,{event:t,message:r}));if(e.email?.to&&it(e,t))i.push("email"),o.push(ia(e.email,t,r));return await Promise.all(o),i}async function ia(e,t,r){try{let n=await import("./chunk-vn05n5z6.js");await n.email.send({to:e.to,from:e.from,subject:`[ts-cloud] ${t}`,text:r})}catch{}}function In(e,t){return t??e}function He(e){if(!e)return[];let t=[];if(e.slack?.webhookUrl)t.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"text\\":\\"$MSG\\"}" ${e.slack.webhookUrl} || true`);if(e.discord?.webhookUrl)t.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"content\\":\\"$MSG\\"}" ${e.discord.webhookUrl} || true`);if(e.telegram?.botToken&&e.telegram.chatId)t.push(`curl -fsS -X POST "https://api.telegram.org/bot${e.telegram.botToken}/sendMessage" --data-urlencode "chat_id=${e.telegram.chatId}" --data-urlencode "text=$MSG" || true`);if(e.webhook?.url)t.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"message\\":\\"$MSG\\"}" ${e.webhook.url} || true`);if(t.length===0)return[];return["cat > /usr/local/bin/ts-cloud-notify <<'TS_CLOUD_NOTIFY_EOF'","#!/bin/bash",'MSG="$1"',...t,"TS_CLOUD_NOTIFY_EOF","chmod +x /usr/local/bin/ts-cloud-notify"]}import{isIP as Ln}from"node:net";var Xr="/etc/rpx/certs",Hn="/etc/rpx/local-ca",la="rpx-root-ca.crt";function Pt(e=Hn){return`${e.replace(/\/+$/,"")}/${la}`}function Sr(e){if(e.toLowerCase().endsWith(".local"))return!1;return e.split(".").length===2}function Xi(e,t={}){let r=new Set;for(let n of Object.values(e)){if(!n?.domain)continue;if(P(n)==="bucket")continue;r.add(n.domain)}if(t.autoWww!==!1)for(let n of[...r]){if(!Sr(n))continue;r.add(`www.${n}`)}return[...r]}var ua=["1.1.1.1","8.8.8.8"],pa="/var/www/acme-challenge";function da(e){if(typeof e==="string")return{to:e};let t={to:e.to};if(e.status!=null)t.status=e.status;if(e.preservePath!=null)t.preservePath=e.preservePath;return t}function ma(e){let t=e.auth;if(!t||t.enabled===!1||!t.password)return;return{username:t.username||"admin",password:t.password,...t.realm?{realm:t.realm}:{}}}function yr(e){if(!e)return;return e.tls??"local-ca"}function Qi(e,t){if(e.cloud?.provider!=="ssh")return;let r=e.ssh?.lan;if(!r)return;return{...r.hostname?{hostname:r.hostname}:{},tls:r.tls??"local-ca",...t?{ip:t}:{}}}function Nn(e){if(e.cloud?.provider!=="ssh")return;return e.ssh?.profile}function fa(e){let t=e.trim().toLowerCase();if(!t||t.startsWith("*")||t.includes(":")||t.includes("/")||t.includes(" "))return!1;if(Ln(t)!==0)return!1;return t.endsWith(".local")||!t.includes(".")}function ga(e,t,r){let n=[],s=new Set,i=(l,u)=>{let d=l.trim().toLowerCase();if(!d||s.has(d))return;s.add(d),n.push({host:d,source:u})},o=t.hostname?.trim(),a=(o||`${r}.local`).toLowerCase();if(i(a,o?"ssh.lan.hostname":`the ssh provider's default LAN name for project "${r}"`),Object.entries(e).some(([l,u])=>!!u&&Lr(l)))i(`dashboard.${a}`,"the management dashboard site");for(let[l,u]of Object.entries(e)){if(!u?.domain)continue;if(P(u)==="bucket")continue;if(!fa(u.domain))continue;i(u.domain,`site "${l}"`)}return n}function ha(e,t){if(!t?.length)return;return t.find((r)=>{let n=(r.startsWith(".")?r.slice(1):r).toLowerCase();return e===n||e.endsWith(`.${n}`)})}function Sa(e,t){if(!t?.enabled)return;for(let{host:r,source:n}of e){let s=ha(r,t.allowedSuffixes);if(!s)continue;throw Error(`The LAN certificate authority and public on-demand TLS both claim "${r}". LAN source: ${n}. Public source: the on-demand TLS allowed suffix "${s}", which is derived from the site domains. A host is either LAN-only, with a certificate signed by the box's own CA, or public, with one issued by Let's Encrypt, never both. Give the LAN a name no site domain covers (ssh.lan.hostname), or take that domain out of the sites this deploy routes.`)}}function Un(e){if(!e||e==="/")return;let t=`/${e}`.replace(/\/+/g,"/").replace(/\/+$/,"");if(!t.startsWith("/"))t=`/${t}`;return t===""||t==="/"?void 0:t}function ar(e,t){let n=(t?`${e}${t}`:e).replace(/[^a-zA-Z0-9._-]+/g,"-").replace(/^-+|-+$/g,"").slice(0,128);return n.length>0?n:"rpx"}function ya(e,t){if(!t||t.length===0)return`localhost:${e}`;return t.map((r)=>`${r.privateIp??r.publicIp}:${e}`)}function kn(e,t,r){let n=(t.wwwRoot??"/var/www").replace(/\/+$/,""),s=t.slug??"app",i=t.proxy.certsDir??Xr,o=t.proxy.loadBalancer,a=[],c=new Set;for(let[m,f]of Object.entries(e)){if(!f||!f.domain)continue;let h=P(f);if(h==="bucket")continue;let x=Un(f.path),_=ar(f.domain,x),y=ma(f);if(h==="redirect"){a.push({to:f.domain,path:x,redirect:da(f.redirect),id:_,...y?{auth:y}:{}}),c.add(f.domain);continue}if(h==="proxy"){let S=zs(f);if(S.length===0)continue;let R=S.length===1?S[0]:S;a.push({to:f.domain,path:x,from:R,id:_,...y?{auth:y}:{},...Array.isArray(R)&&o?{loadBalancer:o}:{}}),c.add(f.domain);continue}if(h==="server-app"){if(typeof f.port!=="number")continue;let S=ya(f.port,r);a.push({to:f.domain,path:x,from:S,id:_,...y?{auth:y}:{},...Array.isArray(S)&&o?{loadBalancer:o}:{}})}else a.push({to:f.domain,path:x,static:{dir:`${n}/${s}-${m}/current`,spa:f.spa??!1,pathRewriteStyle:f.pathRewriteStyle??"directory"},cleanUrls:f.pathRewriteStyle!=="flat",...y?{auth:y}:{},id:_});c.add(f.domain)}if(t.proxy.autoWww!==!1)for(let m of[...c]){if(!Sr(m))continue;let f=`www.${m}`;if(c.has(f))continue;a.push({to:f,redirect:{to:`https://${m}`},id:ar(f)}),c.add(f)}a.sort((m,f)=>{if(m.to!==f.to)return m.to.localeCompare(f.to);return(f.path?.length??0)-(m.path?.length??0)});let l={proxies:a,productionCerts:{certsDir:i,certsDirServerNames:[...c]},https:!0,hostsManagement:!1,cleanup:{hosts:!1,certs:!1}};if(t.proxy.onDemandTls&&c.size>0)l.onDemandTls={enabled:!0,allowedSuffixes:[...c],email:t.proxy.onDemandTlsEmail,certsDir:i,staging:t.proxy.onDemandTlsStaging??!1};if(t.proxy.onDemandTls)l.acmeChallengeWebroot=t.proxy.acmeWebroot??pa;let u=t.proxy.cdn,d=u?.frontedHosts?.length?u.frontedHosts:[...c];if(u?.secret&&d.length>0)l.originGuard={header:u.secretHeader??"X-Origin-Verify",value:u.secret,hosts:d};if(t.lan)if(yr(t.lan)==="off")l.https=!1;else{let m=ga(e,t.lan,s);Sa(m,l.onDemandTls);let f=t.lan.ip&&Ln(t.lan.ip)!==0?[t.lan.ip]:[];l.localCa={dir:Hn,hosts:m.map((h)=>h.host),...f.length>0?{ips:f}:{},installTrust:!0}}return l}function ve(e,t){return kn(e,t)}function Me(e,t,r){return kn(e,r,t)}function Z(e){return e?.webServer==="rpx"||e?.proxy?.engine==="rpx"}var ot="/etc/rpx",G="/opt/rpx-gateway",cr="/etc/rpx/gateway.ts",Ue="/etc/rpx/gateway",ce="rpx-gateway.service",Y="/etc/rpx/sites.d";function va(e=Y,t=Xr){return`// Generated by ts-cloud — rpx gateway assembler.
+`}function sr(e){let t=`/etc/nginx/sites-available/${e.siteName}`,r=`/etc/nginx/sites-enabled/${e.siteName}`,n=sa(e),s=[...ir()];if(e.auth){let i=Dn(e.siteName),o=(l)=>l.split("'").join("'\\''"),a=o(e.auth.password),c=o(e.auth.username);s.push(`TS_CLOUD_HTPASS=$(openssl passwd -apr1 '${a}')`,`printf '%s:%s\\n' '${c}' "$TS_CLOUD_HTPASS" > ${i}`,`chmod 640 ${i}`,`chown root:www-data ${i} 2>/dev/null || true`)}return s.push(`cat > ${t} <<'TS_CLOUD_NGINX_EOF'`,n.replace(/\n$/,""),"TS_CLOUD_NGINX_EOF",`ln -sf ${t} ${r}`,"rm -f /etc/nginx/sites-enabled/default",`${ye} -t`,"systemctl reload ts-cloud-nginx 2>/dev/null || systemctl restart ts-cloud-nginx 2>/dev/null || true"),s}var ye="/usr/local/bin/ts-cloud-nginx";function ir(e="/opt/pantry"){return[...Ir(),...et(["nginx.org"]),"mkdir -p /etc/nginx/sites-available /etc/nginx/sites-enabled /var/log/nginx /var/lib/nginx/body /var/lib/nginx/proxy /var/lib/nginx/fastcgi /var/lib/nginx/uwsgi /var/lib/nginx/scgi","getent passwd www-data >/dev/null || useradd --system --no-create-home --shell /usr/sbin/nologin www-data","chown -R www-data:www-data /var/lib/nginx /var/log/nginx",`cat > ${ye} <<'TS_CLOUD_NGINXBIN_EOF'`,"#!/bin/sh",`eval "$(cd ${e} && pantry env 2>/dev/null)"`,"NGINX_BIN=/opt/pantry/pantry/.bin/nginx",'if [ ! -x "$NGINX_BIN" ]; then NGINX_BIN=$(command -v nginx || true); fi','if [ -z "$NGINX_BIN" ]; then echo "nginx binary not found; run pantry install nginx.org or install nginx explicitly" >&2; exit 1; fi','exec "$NGINX_BIN" -c /etc/nginx/nginx.conf "$@"',"TS_CLOUD_NGINXBIN_EOF",`chmod +x ${ye}`,"cat > /etc/nginx/fastcgi_params <<'TS_CLOUD_FCGI_EOF'","fastcgi_param  QUERY_STRING       $query_string;","fastcgi_param  REQUEST_METHOD     $request_method;","fastcgi_param  CONTENT_TYPE       $content_type;","fastcgi_param  CONTENT_LENGTH     $content_length;","fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;","fastcgi_param  REQUEST_URI        $request_uri;","fastcgi_param  DOCUMENT_URI       $document_uri;","fastcgi_param  DOCUMENT_ROOT      $document_root;","fastcgi_param  SERVER_PROTOCOL    $server_protocol;","fastcgi_param  REQUEST_SCHEME     $scheme;","fastcgi_param  HTTPS              $https if_not_empty;","fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;","fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;","fastcgi_param  REMOTE_ADDR        $remote_addr;","fastcgi_param  REMOTE_PORT        $remote_port;","fastcgi_param  SERVER_ADDR        $server_addr;","fastcgi_param  SERVER_PORT        $server_port;","fastcgi_param  SERVER_NAME        $server_name;","fastcgi_param  REDIRECT_STATUS    200;","TS_CLOUD_FCGI_EOF","cat > /etc/nginx/nginx.conf <<'TS_CLOUD_NGINXCONF_EOF'","user www-data;","worker_processes auto;","pid /run/nginx.pid;","error_log /var/log/nginx/error.log;","events { worker_connections 1024; }","http {","    default_type application/octet-stream;","    types {","        text/html html htm;","        text/css css;","        application/javascript js;","        application/json json;","        image/svg+xml svg;","        image/png png;","        image/jpeg jpg jpeg;","        image/gif gif;","        image/x-icon ico;","        image/webp webp;","        font/woff2 woff2;","        font/woff woff;","        text/plain txt;","    }","    access_log /var/log/nginx/access.log;","    sendfile on;","    tcp_nopush on;","    keepalive_timeout 65;","    server_tokens off;","    client_max_body_size 100m;","    client_body_temp_path /var/lib/nginx/body;","    proxy_temp_path /var/lib/nginx/proxy;","    fastcgi_temp_path /var/lib/nginx/fastcgi;","    uwsgi_temp_path /var/lib/nginx/uwsgi;","    scgi_temp_path /var/lib/nginx/scgi;","    server {","        listen 80 default_server;","        listen [::]:80 default_server;","        server_name _;","        return 444;","    }","    include /etc/nginx/sites-enabled/*;","}","TS_CLOUD_NGINXCONF_EOF","cat > /etc/systemd/system/ts-cloud-nginx.service <<'TS_CLOUD_NGINXUNIT_EOF'","[Unit]","Description=ts-cloud nginx (pantry)","After=network.target","","[Service]","Type=simple",`ExecStartPre=${ye} -t`,`ExecStart=${ye} -g 'daemon off;'`,`ExecReload=${ye} -s reload`,"Restart=always","RestartSec=3","","[Install]","WantedBy=multi-user.target","TS_CLOUD_NGINXUNIT_EOF","systemctl daemon-reload","systemctl enable ts-cloud-nginx","ls /etc/nginx/sites-enabled/* >/dev/null 2>&1 && systemctl restart ts-cloud-nginx || true"]}function it(e,t){return!e.events||e.events.includes(t)}async function or(e,t,r,n={}){if(!e)return[];let s=n.fetchImpl??globalThis.fetch,i=[],o=[],a=(c,l)=>s(c,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(l)}).catch(()=>{return});if(e.slack?.webhookUrl&&it(e,t))i.push("slack"),o.push(a(e.slack.webhookUrl,{text:r}));if(e.discord?.webhookUrl&&it(e,t))i.push("discord"),o.push(a(e.discord.webhookUrl,{content:r}));if(e.telegram?.botToken&&e.telegram.chatId&&it(e,t)){i.push("telegram");let c=`https://api.telegram.org/bot${e.telegram.botToken}/sendMessage`;o.push(a(c,{chat_id:e.telegram.chatId,text:r}))}if(e.webhook?.url&&it(e,t))if(i.push("webhook"),(e.webhook.method||"POST")==="GET"){let c=e.webhook.url.includes("?")?"&":"?",l=`${e.webhook.url}${c}event=${encodeURIComponent(t)}&message=${encodeURIComponent(r)}`;o.push(s(l,{method:"GET"}).catch(()=>{return}))}else o.push(a(e.webhook.url,{event:t,message:r}));if(e.email?.to&&it(e,t))i.push("email"),o.push(ia(e.email,t,r));return await Promise.all(o),i}async function ia(e,t,r){try{let n=await import("./chunk-pr1dg1km.js");await n.email.send({to:e.to,from:e.from,subject:`[ts-cloud] ${t}`,text:r})}catch{}}function In(e,t){return t??e}function He(e){if(!e)return[];let t=[];if(e.slack?.webhookUrl)t.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"text\\":\\"$MSG\\"}" ${e.slack.webhookUrl} || true`);if(e.discord?.webhookUrl)t.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"content\\":\\"$MSG\\"}" ${e.discord.webhookUrl} || true`);if(e.telegram?.botToken&&e.telegram.chatId)t.push(`curl -fsS -X POST "https://api.telegram.org/bot${e.telegram.botToken}/sendMessage" --data-urlencode "chat_id=${e.telegram.chatId}" --data-urlencode "text=$MSG" || true`);if(e.webhook?.url)t.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"message\\":\\"$MSG\\"}" ${e.webhook.url} || true`);if(t.length===0)return[];return["cat > /usr/local/bin/ts-cloud-notify <<'TS_CLOUD_NOTIFY_EOF'","#!/bin/bash",'MSG="$1"',...t,"TS_CLOUD_NOTIFY_EOF","chmod +x /usr/local/bin/ts-cloud-notify"]}import{isIP as Ln}from"node:net";var Xr="/etc/rpx/certs",Hn="/etc/rpx/local-ca",la="rpx-root-ca.crt";function Pt(e=Hn){return`${e.replace(/\/+$/,"")}/${la}`}function Sr(e){if(e.toLowerCase().endsWith(".local"))return!1;return e.split(".").length===2}function Xi(e,t={}){let r=new Set;for(let n of Object.values(e)){if(!n?.domain)continue;if(P(n)==="bucket")continue;r.add(n.domain)}if(t.autoWww!==!1)for(let n of[...r]){if(!Sr(n))continue;r.add(`www.${n}`)}return[...r]}var ua=["1.1.1.1","8.8.8.8"],pa="/var/www/acme-challenge";function da(e){if(typeof e==="string")return{to:e};let t={to:e.to};if(e.status!=null)t.status=e.status;if(e.preservePath!=null)t.preservePath=e.preservePath;return t}function ma(e){let t=e.auth;if(!t||t.enabled===!1||!t.password)return;return{username:t.username||"admin",password:t.password,...t.realm?{realm:t.realm}:{}}}function yr(e){if(!e)return;return e.tls??"local-ca"}function Qi(e,t){if(e.cloud?.provider!=="ssh")return;let r=e.ssh?.lan;if(!r)return;return{...r.hostname?{hostname:r.hostname}:{},tls:r.tls??"local-ca",...t?{ip:t}:{}}}function Nn(e){if(e.cloud?.provider!=="ssh")return;return e.ssh?.profile}function fa(e){let t=e.trim().toLowerCase();if(!t||t.startsWith("*")||t.includes(":")||t.includes("/")||t.includes(" "))return!1;if(Ln(t)!==0)return!1;return t.endsWith(".local")||!t.includes(".")}function ga(e,t,r){let n=[],s=new Set,i=(l,u)=>{let d=l.trim().toLowerCase();if(!d||s.has(d))return;s.add(d),n.push({host:d,source:u})},o=t.hostname?.trim(),a=(o||`${r}.local`).toLowerCase();if(i(a,o?"ssh.lan.hostname":`the ssh provider's default LAN name for project "${r}"`),Object.entries(e).some(([l,u])=>!!u&&Lr(l)))i(`dashboard.${a}`,"the management dashboard site");for(let[l,u]of Object.entries(e)){if(!u?.domain)continue;if(P(u)==="bucket")continue;if(!fa(u.domain))continue;i(u.domain,`site "${l}"`)}return n}function ha(e,t){if(!t?.length)return;return t.find((r)=>{let n=(r.startsWith(".")?r.slice(1):r).toLowerCase();return e===n||e.endsWith(`.${n}`)})}function Sa(e,t){if(!t?.enabled)return;for(let{host:r,source:n}of e){let s=ha(r,t.allowedSuffixes);if(!s)continue;throw Error(`The LAN certificate authority and public on-demand TLS both claim "${r}". LAN source: ${n}. Public source: the on-demand TLS allowed suffix "${s}", which is derived from the site domains. A host is either LAN-only, with a certificate signed by the box's own CA, or public, with one issued by Let's Encrypt, never both. Give the LAN a name no site domain covers (ssh.lan.hostname), or take that domain out of the sites this deploy routes.`)}}function Un(e){if(!e||e==="/")return;let t=`/${e}`.replace(/\/+/g,"/").replace(/\/+$/,"");if(!t.startsWith("/"))t=`/${t}`;return t===""||t==="/"?void 0:t}function ar(e,t){let n=(t?`${e}${t}`:e).replace(/[^a-zA-Z0-9._-]+/g,"-").replace(/^-+|-+$/g,"").slice(0,128);return n.length>0?n:"rpx"}function ya(e,t){if(!t||t.length===0)return`localhost:${e}`;return t.map((r)=>`${r.privateIp??r.publicIp}:${e}`)}function kn(e,t,r){let n=(t.wwwRoot??"/var/www").replace(/\/+$/,""),s=t.slug??"app",i=t.proxy.certsDir??Xr,o=t.proxy.loadBalancer,a=[],c=new Set;for(let[m,f]of Object.entries(e)){if(!f||!f.domain)continue;let h=P(f);if(h==="bucket")continue;let x=Un(f.path),_=ar(f.domain,x),y=ma(f);if(h==="redirect"){a.push({to:f.domain,path:x,redirect:da(f.redirect),id:_,...y?{auth:y}:{}}),c.add(f.domain);continue}if(h==="proxy"){let S=zs(f);if(S.length===0)continue;let R=S.length===1?S[0]:S;a.push({to:f.domain,path:x,from:R,id:_,...y?{auth:y}:{},...Array.isArray(R)&&o?{loadBalancer:o}:{}}),c.add(f.domain);continue}if(h==="server-app"){if(typeof f.port!=="number")continue;let S=ya(f.port,r);a.push({to:f.domain,path:x,from:S,id:_,...y?{auth:y}:{},...Array.isArray(S)&&o?{loadBalancer:o}:{}})}else a.push({to:f.domain,path:x,static:{dir:`${n}/${s}-${m}/current`,spa:f.spa??!1,pathRewriteStyle:f.pathRewriteStyle??"directory"},cleanUrls:f.pathRewriteStyle!=="flat",...y?{auth:y}:{},id:_});c.add(f.domain)}if(t.proxy.autoWww!==!1)for(let m of[...c]){if(!Sr(m))continue;let f=`www.${m}`;if(c.has(f))continue;a.push({to:f,redirect:{to:`https://${m}`},id:ar(f)}),c.add(f)}a.sort((m,f)=>{if(m.to!==f.to)return m.to.localeCompare(f.to);return(f.path?.length??0)-(m.path?.length??0)});let l={proxies:a,productionCerts:{certsDir:i,certsDirServerNames:[...c]},https:!0,hostsManagement:!1,cleanup:{hosts:!1,certs:!1}};if(t.proxy.onDemandTls&&c.size>0)l.onDemandTls={enabled:!0,allowedSuffixes:[...c],email:t.proxy.onDemandTlsEmail,certsDir:i,staging:t.proxy.onDemandTlsStaging??!1};if(t.proxy.onDemandTls)l.acmeChallengeWebroot=t.proxy.acmeWebroot??pa;let u=t.proxy.cdn,d=u?.frontedHosts?.length?u.frontedHosts:[...c];if(u?.secret&&d.length>0)l.originGuard={header:u.secretHeader??"X-Origin-Verify",value:u.secret,hosts:d};if(t.lan)if(yr(t.lan)==="off")l.https=!1;else{let m=ga(e,t.lan,s);Sa(m,l.onDemandTls);let f=t.lan.ip&&Ln(t.lan.ip)!==0?[t.lan.ip]:[];l.localCa={dir:Hn,hosts:m.map((h)=>h.host),...f.length>0?{ips:f}:{},installTrust:!0}}return l}function ve(e,t){return kn(e,t)}function Me(e,t,r){return kn(e,r,t)}function Z(e){return e?.webServer==="rpx"||e?.proxy?.engine==="rpx"}var ot="/etc/rpx",G="/opt/rpx-gateway",cr="/etc/rpx/gateway.ts",Ue="/etc/rpx/gateway",ce="rpx-gateway.service",Y="/etc/rpx/sites.d";function va(e=Y,t=Xr){return`// Generated by ts-cloud — rpx gateway assembler.
 // Merges every app's fragment in ${e} so independent deploys compose
 // without clobbering each other. Each deploy writes only its own <slug>.json.
 import { startProxies } from '@stacksjs/rpx'
@@ -141,7 +141,7 @@ writeFileSync(candidatePath, JSON.stringify(candidate, null, 2) + '\\n', { mode:
 `);return[`mkdir -p ${n}`,...e.tenant?[]:[`(cd ${G} && ${i} add @stacksjs/tlsx@${o}) || true`],...ke(f,_,"TS_CLOUD_RENEW_EOF"),`chmod +x ${f}`,...ke(`/etc/systemd/system/${h}`,y,"TS_CLOUD_RENEW_SVC_EOF"),...ke(`/etc/systemd/system/${x}`,S,"TS_CLOUD_RENEW_TIMER_EOF"),"systemctl daemon-reload",`systemctl enable --now ${x} || true`,`${f} || true`]}function le(e){let{config:t,proxy:r}=e,n=e.bunBin??"/usr/local/bin/bun",s=r.version??"latest",i=t.productionCerts.certsDir,o=(e.slug||"app").replace(/[^a-z0-9._-]+/gi,"-"),a=JSON.stringify({slug:o,...t},null,2),c=va(Y,i);if(e.tenant)return["set -euo pipefail",`if [ ! -x ${Ue} ] || [ ! -d ${G}/node_modules/@stacksjs/rpx ]; then`,`  echo "ts-cloud: no rpx gateway on this box. This project attaches to another project's compute, so it does not provision one - deploy the owning project first." >&2`,"  exit 1","fi",`mkdir -p ${Y} ${i}`,`__tsc_rpx_before="$(sha256sum ${Y}/${o}.json 2>/dev/null | cut -d' ' -f1 || true)"`,...hr(`${Y}/${o}.json`,a,"TS_CLOUD_RPX_FRAGMENT_EOF",{bunBin:n,preserveManagementDashboardRoutes:e.preserveManagementDashboardRoutes}),`__tsc_rpx_after="$(sha256sum ${Y}/${o}.json 2>/dev/null | cut -d' ' -f1 || true)"`,`if [ "$__tsc_rpx_before" != "$__tsc_rpx_after" ] || ! systemctl is-active --quiet ${ce}; then`,`  systemctl restart ${ce}`,"else",`  echo "[ts-cloud] rpx routes for ${o} unchanged - leaving the shared gateway alone"`,"fi",...An(e)];let u=[`Environment=RPX_UPSTREAM_TIMEOUT=${r.upstreamTimeout??60}`];if(typeof r.maxUpstreamConns==="number")u.push(`Environment=RPX_MAX_UPSTREAM_CONNS=${r.maxUpstreamConns}`);let d=e.profile==="raspberry-pi"?_a:wa,m=r.memoryHigh??d.high,f=r.memoryMax??d.max;return["set -euo pipefail",`mkdir -p ${ot} ${Y} ${i} ${G}`,`rm -rf ${G}.next ${G}.prev`,`mkdir -p ${G}.next`,`(cd ${G}.next && ${n} add @stacksjs/rpx@${s})`,`mv ${G} ${G}.prev`,`mv ${G}.next ${G}`,`rm -rf ${G}.prev`,`ln -sfn ${G}/node_modules ${ot}/node_modules`,...hr(`${Y}/${o}.json`,a,"TS_CLOUD_RPX_FRAGMENT_EOF",{bunBin:n,preserveManagementDashboardRoutes:e.preserveManagementDashboardRoutes}),...ke(cr,c,"TS_CLOUD_RPX_EOF"),`${n} build --production --compile --outfile ${Ue}.next ${cr}`,`chmod 0755 ${Ue}.next`,`mv -f ${Ue}.next ${Ue}`,...ke(`/etc/systemd/system/${ce}`,["[Unit]","Description=rpx reverse-proxy gateway (managed by ts-cloud)","After=network.target network-online.target","Wants=network-online.target","","[Service]","Type=simple",`ExecStart=${Ue}`,`WorkingDirectory=${G}`,"Environment=BUN_INSTALL=/root/.bun","Environment=APP_ENV=production","Environment=NODE_ENV=production",...u,"MemoryAccounting=true",`MemoryHigh=${m}`,`MemoryMax=${f}`,"CPUWeight=500","IOWeight=500","OOMPolicy=stop","Restart=always","RestartSec=5","StartLimitIntervalSec=120","StartLimitBurst=5",`ExecStartPre=/bin/sh -c 'for p in 80 443; do fuser -k -n tcp "$p" 2>/dev/null || true; done; sleep 1'`,"LimitNOFILE=1048576","AmbientCapabilities=CAP_NET_BIND_SERVICE","","[Install]","WantedBy=multi-user.target"].join(`
 `),"TS_CLOUD_RPX_UNIT_EOF"),"systemctl daemon-reload","systemctl disable --now bun-gateway.service 2>/dev/null || true","systemctl disable --now bun-gateway-renew.timer bun-gateway-renew.service 2>/dev/null || true","rm -f /etc/systemd/system/bun-gateway-renew.timer /etc/systemd/system/bun-gateway-renew.service","systemctl disable --now ts-cloud-nginx.service 2>/dev/null || true",`for timer in /etc/systemd/system/rpx-cert-renew-*.timer; do [ -e "$timer" ] || continue; unit="$(basename "$timer")"; tenant="\${unit#rpx-cert-renew-}"; tenant="\${tenant%.timer}"; [ -f "${Y}/$tenant.json" ] && continue; systemctl disable --now "$unit" 2>/dev/null || true; rm -f "$timer" "/etc/systemd/system/rpx-cert-renew-$tenant.service" "${ot}/renew-certs-$tenant.sh"; done`,`systemctl enable ${ce}`,`systemctl restart ${ce}`,...An(e)]}function Ge(e){let t=(e.slug||"app").replace(/[^a-z0-9._-]+/gi,"-"),r=JSON.stringify({slug:t,...e.config},null,2);return["set -euo pipefail",`mkdir -p ${Y}`,...hr(`${Y}/${t}.json`,r,"TS_CLOUD_RPX_FRAGMENT_EOF",{bunBin:"/usr/local/bin/bun",preserveManagementDashboardRoutes:e.preserveManagementDashboardRoutes}),`systemctl restart ${ce}`]}function Fe(e=[],t={}){let r=t.path??"/root/.ssh/authorized_keys",s=[`mkdir -p ${r.replace(/\/[^/]*$/,"")}`,`touch ${r}`,`sed -i '/^${Mn("# >>> ts-cloud managed keys >>>")}$/,/^${Mn("# <<< ts-cloud managed keys <<<")}$/d' ${r}`];if(e.length>0){let i=["# >>> ts-cloud managed keys >>>",...e.map((o)=>`${o.publicKey.trim()} ${o.name}`),"# <<< ts-cloud managed keys <<<"].join(`
 `);s.push(`cat >> ${r} <<'TS_CLOUD_KEYS_EOF'`,i,"TS_CLOUD_KEYS_EOF",`chmod 600 ${r}`)}return s}function Mn(e){return e.replace(/[.*[\]\\/^$]/g,"\\$&")}function zn(e,t){let r=`/tmp/ts-cloud-${e}.sh`,n=`TS_CLOUD_${e.toUpperCase().replace(/[^A-Z0-9]/g,"_")}_EOF`;return[`cat > ${r} <<'${n}'`,t.replace(/\n$/,""),n,`chmod +x ${r}`,`bash ${r} || echo "ts-cloud: ${e} setup did not complete; continuing" >&2`,`rm -f ${r}`]}function Bn(e,t){if(e===!1)return;if(e===!0||e===void 0)return t;return e}var Fn={enabled:!0,ports:[80,443]},Ta={mode:"detection",paranoiaLevel:1};function $a(e=!0,t=[]){let r=Bn(e,Fn);if(!r||r.enabled===!1)return[];let n=[...new Set([...r.ports??Fn.ports??[],...t])].sort((s,i)=>s-i);return zn("ddos",Cr({...r,ports:n}))}function Ca(e=!0){let t=Bn(e,Ta);if(!t||t.mode==="off")return[];return zn("waf",ps(t))}function Kn(e={},t=[]){return[...$a(e.ddos,t),...Ca(e.waf)]}function Pa(e){return`${e}-sftp`}function jn(e){return e.port??2222}function xa(e){let t=e.sftp.storage;if(t?.type==="efs"&&t.path)return t.path;return`/var/sftp/${e.slug}`}function ze(e){return`'${e.split("'").join("'\\''")}'`}function Wn(e,t){if(t==="aws")return;let r=e.storage;if(r?.type==="s3"||!r&&!!e.bucket)throw Error(`sftp: bucket-backed storage is only available on the aws provider (Transfer Family). On ${t}, use storage: { type: 'efs' } to serve a directory on the server.`);for(let[s,i]of Object.entries(e.users))if(!i.sshPublicKeys?.length)throw Error(`sftp: user ${s} needs at least one SSH public key`)}function Gn(e){let{slug:t,sftp:r}=e,n=Pa(t),s=xa(e),i=jn(r),o="/etc/ts-sftp/host_key",a="/etc/ts-sftp/users",c=r.serviceUser??"ts-sftp",l=[`# --- ts-sftp (${n}) ---`,`id -u ${c} >/dev/null 2>&1 || useradd --system --home-dir ${ze(s)} --shell /usr/sbin/nologin ${c}`,'export HOME="${HOME:-/root}"','command -v bun >/dev/null 2>&1 || (curl -fsSL https://bun.sh/install | bash && ln -sf "$HOME/.bun/bin/bun" /usr/local/bin/bun)',`mkdir -p ${ze(s)} /etc/ts-sftp /etc/ts-sftp/users /opt/ts-sftp`,"chmod 750 /etc/ts-sftp",`cd /opt/ts-sftp && [ -f package.json ] || printf '{"name":"ts-sftp-host","private":true}' > package.json`,`cd /opt/ts-sftp && bun add ts-sftp@${r.version??"latest"} --no-save --production || bun add ts-sftp@${r.version??"latest"}`,`[ -f /etc/ts-sftp/host_key ] || bun /opt/ts-sftp/node_modules/ts-sftp/dist/bin/cli.js keygen --out /etc/ts-sftp/host_key --comment ${ze(`${t}-sftp`)}`,"chmod 600 /etc/ts-sftp/host_key",'BUN_REAL=$(readlink -f "$(command -v bun)")','case "$BUN_REAL" in /root/*) install -m 0755 "$BUN_REAL" /usr/local/bin/ts-sftp-bun; BUN_BIN=/usr/local/bin/ts-sftp-bun;; *) BUN_BIN="$BUN_REAL";; esac'],u=[];for(let[d,m]of Object.entries(r.users)){let f=(m.homeDirectory??d).replace(/^\/+|\/+$/g,"");if(!f||f.split("/").includes(".."))throw Error(`sftp: invalid homeDirectory for user ${d}`);let h=`/etc/ts-sftp/users/${d}.pub`;l.push(`mkdir -p ${ze(`${s}/${f}`)}`,`printf '%s\\n' ${ze(m.sshPublicKeys.join(`
-`))} > ${h}`,`chmod 644 ${h}`),u.push(`--user ${d}:${h}`)}return l.push(`chown -R ${c}:${c} ${ze(s)} /etc/ts-sftp`,`cat > /etc/systemd/system/${n}.service <<TSCLOUD_SFTP_UNIT`,"[Unit]","Description=ts-sftp file transfer server","After=network.target","","[Service]",`User=${c}`,`ExecStart=$BUN_BIN /opt/ts-sftp/node_modules/ts-sftp/dist/bin/cli.js serve --root ${s} --host-key /etc/ts-sftp/host_key --port ${i}${r.readOnly?" --read-only":""} ${u.join(" ")}`,"Restart=always","RestartSec=2","NoNewPrivileges=true","PrivateTmp=true","ProtectSystem=strict",`ReadWritePaths=${s}`,"","[Install]","WantedBy=multi-user.target","TSCLOUD_SFTP_UNIT","systemctl daemon-reload",`systemctl enable ${n}.service`,`systemctl restart ${n}.service`),l}function Vn(e){return e?[jn(e)]:[]}var Ra=[80,443];function xt(e={}){if(e.enabled===!1)return[];let t=[...new Set([...Ra,...e.allowedPorts||[]])].filter((n)=>Number.isInteger(n)&&n>=1&&n<=65535).sort((n,s)=>n-s),r=["export DEBIAN_FRONTEND=noninteractive","command -v ufw >/dev/null 2>&1 || apt-get install -y ufw","ufw --force reset","ufw default deny incoming","ufw default allow outgoing","ufw allow OpenSSH"];for(let n of t)r.push(`ufw allow ${n}/tcp`);return r.push("ufw --force enable"),r}function Re(e,t){let r=e.infrastructure?.compute??{},n=r.runtime==="php"||!!r.php,s=ki(e,{environment:t?.environment}),i=n||!!r.managedServices,o=i?Ir():[],a=!Z(r),c=n?[...o,...Ct({versions:r.php?.versions,default:r.php?.default,extensions:r.php?.extensions,installNginx:a,optimizeForProduction:r.php?.optimizeForProduction,ini:r.php?.ini}),...a?ir():[]]:void 0,l=[],u=w(e);if(!n&&i)l.push(...o);if(l.push(...He(e.notifications)),r.managedServices)l.push(..._o(r.managedServices,{mail:s.enabled?s:void 0}),...vt(u,r.managedServices));let d=e.infrastructure?.sftp;if(d)Wn(d,F(e)),l.push(...Gn({slug:e.project.slug,sftp:d}));let m=r.firewall??(n?{enabled:!0}:{enabled:!1}),f=aa(s);if(l.push(...xt(f.length>0?{...m,allowedPorts:[...m.allowedPorts??[],...f]}:m)),l.push(...Kn({ddos:r.ddos,waf:r.waf},[...r.firewall?.allowedPorts??[],...f])),l.push(...he(r.autoUpdates??n)),l.push(...Ji(r.appUpdates)),l.push(...Se(r.monitoring??n)),l.push(...Fe(r.sshKeys,{path:t?.authorizedKeysPath})),r.backups?.enabled)l.push(...Oo({database:u,backups:r.backups}));return{runtime:r.runtime||"bun",runtimeVersion:r.runtimeVersion||"latest",phpBox:n,phpProvision:c,servicesProvision:l.length>0?l:void 0}}function ee(e={}){let{runtime:t="bun",runtimeVersion:r="latest",systemPackages:n=[],database:s,phpProvision:i,servicesProvision:o,caddyfile:a,rpxProvision:c,baked:l=!1,swapGb:u=2}=e,d=new Set(n);if(s==="sqlite")d.add("sqlite3");else if(s==="mysql")d.add("mysql-client");else if(s==="postgres")d.add("postgresql-client");let m=`#!/bin/bash
+`))} > ${h}`,`chmod 644 ${h}`),u.push(`--user ${d}:${h}`)}return l.push(`chown -R ${c}:${c} ${ze(s)} /etc/ts-sftp`,`cat > /etc/systemd/system/${n}.service <<TSCLOUD_SFTP_UNIT`,"[Unit]","Description=ts-sftp file transfer server","After=network.target","","[Service]",`User=${c}`,`ExecStart=$BUN_BIN /opt/ts-sftp/node_modules/ts-sftp/dist/bin/cli.js serve --root ${s} --host-key /etc/ts-sftp/host_key --port ${i}${r.readOnly?" --read-only":""} ${u.join(" ")}`,"Restart=always","RestartSec=2","NoNewPrivileges=true","PrivateTmp=true","ProtectSystem=strict",`ReadWritePaths=${s}`,"","[Install]","WantedBy=multi-user.target","TSCLOUD_SFTP_UNIT","systemctl daemon-reload",`systemctl enable ${n}.service`,`systemctl restart ${n}.service`),l}function Vn(e){return e?[jn(e)]:[]}var Ra=[80,443];function xt(e={}){if(e.enabled===!1)return[];let t=[...new Set([...Ra,...e.allowedPorts||[]])].filter((n)=>Number.isInteger(n)&&n>=1&&n<=65535).sort((n,s)=>n-s),r=["export DEBIAN_FRONTEND=noninteractive","command -v ufw >/dev/null 2>&1 || apt-get install -y ufw","ufw --force reset","ufw default deny incoming","ufw default allow outgoing","ufw allow OpenSSH"];for(let n of t)r.push(`ufw allow ${n}/tcp`);return r.push("ufw --force enable"),r}function Re(e,t){let r=e.infrastructure?.compute??{},n=r.runtime==="php"||!!r.php,s=ki(e,{environment:t?.environment}),i=n||!!r.managedServices,o=i?Ir():[],a=!Z(r),c=n?[...o,...Ct({versions:r.php?.versions,default:r.php?.default,extensions:r.php?.extensions,installNginx:a,optimizeForProduction:r.php?.optimizeForProduction,ini:r.php?.ini}),...a?ir():[]]:void 0,l=[],u=w(e);if(!n&&i)l.push(...o);if(l.push(...He(e.notifications)),r.managedServices)l.push(..._o(r.managedServices,{mail:s.enabled?s:void 0}),...vt(u,r.managedServices));let d=e.infrastructure?.sftp;if(d)Wn(d,B(e)),l.push(...Gn({slug:e.project.slug,sftp:d}));let m=r.firewall??(n?{enabled:!0}:{enabled:!1}),f=aa(s);if(l.push(...xt(f.length>0?{...m,allowedPorts:[...m.allowedPorts??[],...f]}:m)),l.push(...Kn({ddos:r.ddos,waf:r.waf},[...r.firewall?.allowedPorts??[],...f])),l.push(...he(r.autoUpdates??n)),l.push(...Ji(r.appUpdates)),l.push(...Se(r.monitoring??n)),l.push(...Fe(r.sshKeys,{path:t?.authorizedKeysPath})),r.backups?.enabled)l.push(...Oo({database:u,backups:r.backups}));return{runtime:r.runtime||"bun",runtimeVersion:r.runtimeVersion||"latest",phpBox:n,phpProvision:c,servicesProvision:l.length>0?l:void 0}}function ee(e={}){let{runtime:t="bun",runtimeVersion:r="latest",systemPackages:n=[],database:s,phpProvision:i,servicesProvision:o,caddyfile:a,rpxProvision:c,baked:l=!1,swapGb:u=2}=e,d=new Set(n);if(s==="sqlite")d.add("sqlite3");else if(s==="mysql")d.add("mysql-client");else if(s==="postgres")d.add("postgresql-client");let m=`#!/bin/bash
 set -euo pipefail
 `,f=Math.floor(u);if(f>0)m+=`
 # Swap: a swapless box under memory pressure lets the kernel OOM killer choose
@@ -274,7 +274,7 @@ ${s}
 runcmd:
   - [ bash, ${r} ]
 ${Es(t.after)}`}function Yr(e){let t=new Set([80,443,...e.sitePorts,...e.allowedPorts??[]]);if(e.allowSsh)t.add(22);return[...t].map((r)=>({direction:"in",protocol:"tcp",port:String(r),source_ips:["0.0.0.0/0","::/0"],description:`ts-cloud port ${r}`}))}var Br={micro:"cpx11",small:"cx23",medium:"cx33",large:"cx43",xlarge:"cx53","2xlarge":"ccx33"};function dt(e){if(!e)return Br.micro;if(e in Br)return Br[e];return e}var K="ts-cloud";function j(e,t,r="app"){return{[`${K}/project`]:e,[`${K}/environment`]:t,[`${K}/role`]:r,[`${K}/managed-by`]:"ts-cloud"}}function te(e,t,r,n="app"){return Kr(e,t,r)&&e[`${K}/role`]===n}function Kr(e,t,r){if(!e)return!1;return e[`${K}/project`]===t&&e[`${K}/environment`]===r}import{mkdir as Xa,readFile as Ya,rename as Ja,writeFile as Qa}from"node:fs/promises";import{join as Os}from"node:path";var jr="storage/cloud/state";function be(e=process.cwd()){return oa()?A(e,"state"):Os(e,jr)}function Xe(e,t=process.cwd()){return Os(be(t),`${e}.json`)}async function Ie(e,t=process.cwd()){try{let r=await Ya(Xe(e,t),"utf8");return JSON.parse(r)}catch{return null}}async function Ye(e,t,r=process.cwd()){let n=Xe(e,r);await Xa(be(r),{recursive:!0});let s=`${n}.${process.pid}.tmp`;await Qa(s,`${JSON.stringify(t,null,2)}
-`,"utf8"),await Ja(s,n)}async function pe(e){return Ie(e)}async function ut(e,t){await Ye(e,t)}var Wr=268435456;function yt(e){return`'${e.replace(/'/g,`'"'"'`)}'`}async function sc(e){let t=ec("sha256");for await(let r of tc(e))t.update(r);return t.digest("hex")}class _e{name="hetzner";usesCloudFormation=!1;client;sshPrivateKeyPath;sshPublicKeyPath;sshUser;location;stateOnly;waitForBoot;bootWait;constructor(e={}){let t=ft(e.apiToken);if(this.stateOnly=!e.client&&!t&&e.allowStateOnly===!0,!e.client&&!t&&!this.stateOnly)throw Error("Hetzner API token required. Set hetzner.apiToken in cloud.config.ts or HCLOUD_TOKEN / HETZNER_API_TOKEN.");this.client=e.client??new We({apiToken:t??""});let r=lr(void 0,{sshPrivateKeyPath:e.sshPrivateKeyPath,sshPublicKeyPath:e.sshPublicKeyPath,sshUser:e.sshUser,location:e.location});this.sshPrivateKeyPath=r.sshPrivateKeyPath,this.sshPublicKeyPath=r.sshPublicKeyPath,this.sshUser=r.sshUser,this.location=r.location,this.waitForBoot=e.waitForBoot??!0,this.bootWait={sshIntervalMs:e.bootWait?.sshIntervalMs??5000,sshTimeoutMs:e.bootWait?.sshTimeoutMs??300000,cloudInitIntervalMs:e.bootWait?.cloudInitIntervalMs??5000,cloudInitTimeoutMs:e.bootWait?.cloudInitTimeoutMs??600000}}async provisionComputeInfrastructure(e){let{config:t,environment:r}=e,n=t.project.slug,s=t.infrastructure?.compute;if(!s)throw Error("infrastructure.compute is required to provision Hetzner compute");if(t.cloud?.attachTo)return this.attachToComputeInfrastructure(t.cloud.attachTo,t,r);let i=T(t,r),o=`${n}-${r}-app`,a=s.runtime==="php"||!!s.php,c=Cs(s);if(c.dedicatedServices||c.appServers>1)return a?this.provisionFleet(e,c):this.provisionBunFleet(e,c);let l=j(n,r,"app"),u=t.sites||{},d=Z(s)?[]:this.collectUpstreamPorts(u),m=`${n}-${r}-app-fw`,{firewall:f}=await this.ensureFirewall(m,l,Yr({allowSsh:s.allowSsh!==!1,sitePorts:d,allowedPorts:[...s.firewall?.allowedPorts??[],...Vn(t.infrastructure?.sftp)]})),h=await this.ensureSshKey(n,r,l),x=await pe(i);if(x?.serverId){let k=await this.tryGetServer(x.serverId);if(k&&k.status!=="off")return this.outputsFromState(x,k)}let _=await this.findExistingServer(n,r,o);if(_&&_.status!=="off"){let k={provider:"hetzner",stackName:i,serverId:_.id,serverName:_.name,publicIp:_.public_net.ipv4?.ip,publicIpv6:ue(_.public_net.ipv6?.ip),deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser};return await ut(i,k),this.outputsFromState(k,_)}let y=s.proxy?.engine==="rpx"?le({proxy:s.proxy,config:ve(u,{proxy:s.proxy,slug:t.project.slug}),slug:t.project.slug,bunBin:s.runtime==="node"||s.runtime==="deno"?void 0:"/usr/local/bin/bun"}):void 0,S=Re(t,{environment:r}),R=s.bakedImage===!0,b=ee({runtime:S.runtime,runtimeVersion:S.runtimeVersion,systemPackages:s.systemPackages,database:t.infrastructure?.database,phpProvision:S.phpProvision,servicesProvision:S.servicesProvision,rpxProvision:y,baked:R,swapGb:s.swapGb}),I=de(b),C=dt(s.size),E=gt(t),{server:H,action:re}=await this.client.createServer({name:o,serverType:C,image:E,location:t.hetzner?.location||this.location,userData:I,labels:l,sshKeys:h?[h]:void 0,firewalls:[{firewall:f.id}]});await this.client.waitForAction(re.id);let W=await this.client.waitForServerRunning(H.id),N={provider:"hetzner",stackName:i,serverId:W.id,serverName:W.name,firewallId:f.id,publicIp:W.public_net.ipv4?.ip,publicIpv6:ue(W.public_net.ipv6?.ip),deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser};await ut(i,N);let q=W.public_net.ipv4?.ip;if(q&&this.waitForBoot)await this.waitForSshReady(q),await this.waitForCloudInit(q);return this.outputsFromState(N,W)}async provisionFleet(e,t){let{config:r,environment:n}=e,s=r.project.slug,i=r.infrastructure.compute,o=T(r,n),a=dt(i.size),c=gt(r),l=r.hetzner?.location||this.location,u=i.bakedImage===!0,d=await pe(o);if(d?.loadBalancerId){let M=(await this.client.listLoadBalancers().catch(()=>[])).find((D)=>D.id===d.loadBalancerId);if(M)return{appPublicIp:M.public_net?.ipv4?.ip,loadBalancerIp:M.public_net?.ipv4?.ip,servicesPrivateIp:d.servicesPrivateIp,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser}}let m=await this.ensureSshKey(s,n,j(s,n,"app")),f=`${s}-${n}-net`,x=(await this.client.listNetworks().catch(()=>[])).find((L)=>L.name===f)??await this.client.createNetwork({name:f,labels:j(s,n,"app")}),{firewall:_}=await this.ensureFirewall(`${s}-${n}-app-fw`,j(s,n,"app"),Yr({allowSsh:!0,sitePorts:[],allowedPorts:i.firewall?.allowedPorts})),{firewall:y}=await this.ensureFirewall(`${s}-${n}-services-fw`,j(s,n,"services"),[{direction:"in",protocol:"tcp",port:"22",source_ips:["0.0.0.0/0","::/0"]},{direction:"in",protocol:"tcp",port:"3306",source_ips:[x.ip_range]},{direction:"in",protocol:"tcp",port:"5432",source_ips:[x.ip_range]},{direction:"in",protocol:"tcp",port:"6379",source_ips:[x.ip_range]},{direction:"in",protocol:"tcp",port:"7700",source_ips:[x.ip_range]}]),S=Fr(r),R=de(ee({runtime:"php",servicesProvision:S,baked:u,swapGb:i.swapGb})),b=await this.client.listServers().catch(()=>[]),I=[],C=b.find((L)=>te(L.labels,s,n,"services"));if(!C){let{server:L,action:M}=await this.client.createServer({name:`${s}-${n}-services`,serverType:dt(typeof i.servicesServer==="object"?i.servicesServer.size:i.size),image:c,location:l,userData:R,labels:j(s,n,"services"),sshKeys:m?[m]:void 0,firewalls:[{firewall:y.id}],networks:[x.id]});await this.client.waitForAction(M.id),C=await this.client.waitForServerRunning(L.id),I.push(L.id)}let E=C.id,H=C.private_net?.[0]?.ip??(await this.client.getServer(E)).private_net?.[0]?.ip,re=[...he(!0),...Se(!0),...Fe(i.sshKeys),...He(r.notifications)],W=Ct({versions:i.php?.versions,default:i.php?.default,extensions:i.php?.extensions,installNginx:!Z(i),optimizeForProduction:i.php?.optimizeForProduction,ini:i.php?.ini}),N=de(ee({runtime:"php",phpProvision:W,servicesProvision:re,baked:u,swapGb:i.swapGb})),q=b.filter((L)=>te(L.labels,s,n,"app")),k=q.map((L)=>L.id);if(q.length>t.appServers)for(let L of q.slice(t.appServers))await this.client.deleteServer(L.id).catch(()=>{}),k.splice(k.indexOf(L.id),1);for(let L=q.length;L<t.appServers;L++){let{server:M,action:D}=await this.client.createServer({name:`${s}-${n}-app-${L+1}`,serverType:a,image:c,location:l,userData:N,labels:j(s,n,"app"),sshKeys:m?[m]:void 0,firewalls:[{firewall:_.id}],networks:[x.id]});await this.client.waitForAction(D.id),k.push(M.id),I.push(M.id)}if(this.waitForBoot&&I.length>0)await Promise.all(I.map(async(L)=>{let D=(await this.client.waitForServerRunning(L)).public_net.ipv4?.ip;if(D)await this.waitForSshReady(D),await this.waitForCloudInit(D)}));let X=`${s}-${n}-lb`,oe,fe;if(t.loadBalancer){let M=(await this.client.listLoadBalancers().catch(()=>[])).find((D)=>D.name===X)??await this.client.createLoadBalancer({name:X,location:l,network:x.id,labels:j(s,n,"lb"),labelSelector:`ts-cloud/project=${s},ts-cloud/environment=${n},ts-cloud/role=app`,services:[{listenPort:80,destinationPort:80},{listenPort:443,destinationPort:443}]});fe=M.id,oe=M.public_net?.ipv4?.ip}let $e=oe??(await this.client.getServer(k[0]).catch(()=>{return}))?.public_net.ipv4?.ip,ne={provider:"hetzner",stackName:o,networkId:x.id,loadBalancerId:fe,servicesServerId:E,servicesPrivateIp:H,publicIp:$e,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser};return await ut(o,ne),{appPublicIp:$e,loadBalancerIp:oe,servicesPrivateIp:H,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser}}async provisionBunFleet(e,t){let{config:r,environment:n}=e,s=r.project.slug,i=r.infrastructure.compute,o=T(r,n),a=dt(i.size),c=gt(r),l=r.hetzner?.location||this.location,u=i.bakedImage===!0,d=r.sites||{},m=await pe(o);if(m?.lbServerId){let D=await this.tryGetServer(m.lbServerId);if(D&&D.status!=="off"){let z=i.proxy?.engine==="rpx"?i.proxy:{engine:"rpx"},B=await this.findComputeTargets({slug:s,environment:n,role:"app",stackName:o});return this.refreshLbRoutes(D,d,B.map((ae)=>({privateIp:ae.privateIp,publicIp:ae.publicIp})),z,s),{appPublicIp:D.public_net.ipv4?.ip??m.publicIp,loadBalancerIp:D.public_net.ipv4?.ip??m.publicIp,servicesPrivateIp:m.servicesPrivateIp,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser}}}let f=await this.ensureSshKey(s,n,j(s,n,"app")),h=`${s}-${n}-net`,_=(await this.client.listNetworks().catch(()=>[])).find((D)=>D.name===h)??await this.client.createNetwork({name:h,labels:j(s,n,"app")}),y=this.collectUpstreamPorts(d),{firewall:S}=await this.ensureFirewall(`${s}-${n}-app-fw`,j(s,n,"app"),[{direction:"in",protocol:"tcp",port:"22",source_ips:["0.0.0.0/0","::/0"]},...y.map((D)=>({direction:"in",protocol:"tcp",port:String(D),source_ips:[_.ip_range],description:`ts-cloud port ${D} (private, LB-only)`}))]),{firewall:R}=await this.ensureFirewall(`${s}-${n}-lb-fw`,j(s,n,"lb"),Yr({allowSsh:!0,sitePorts:[],allowedPorts:i.firewall?.allowedPorts})),b=await this.client.listServers().catch(()=>[]),I=[],C,E,H=!!i.servicesServer||!!i.managedServices,re=t.dedicatedServices&&H;if(re){let{firewall:D}=await this.ensureFirewall(`${s}-${n}-services-fw`,j(s,n,"services"),[{direction:"in",protocol:"tcp",port:"22",source_ips:["0.0.0.0/0","::/0"]},{direction:"in",protocol:"tcp",port:"3306",source_ips:[_.ip_range]},{direction:"in",protocol:"tcp",port:"5432",source_ips:[_.ip_range]},{direction:"in",protocol:"tcp",port:"6379",source_ips:[_.ip_range]},{direction:"in",protocol:"tcp",port:"7700",source_ips:[_.ip_range]}]),z=Fr(r),B=de(ee({runtime:"bun",servicesProvision:z,baked:u,swapGb:i.swapGb})),ae=b.find((ge)=>te(ge.labels,s,n,"services"));if(!ae){let{server:ge,action:rt}=await this.client.createServer({name:`${s}-${n}-services`,serverType:dt(typeof i.servicesServer==="object"?i.servicesServer.size:i.size),image:c,location:l,userData:B,labels:j(s,n,"services"),sshKeys:f?[f]:void 0,firewalls:[{firewall:D.id}],networks:[_.id]});await this.client.waitForAction(rt.id),ae=await this.client.waitForServerRunning(ge.id),I.push(ge.id)}C=ae.id,E=ae.private_net?.[0]?.ip??(await this.client.getServer(C)).private_net?.[0]?.ip}let W=re?{...i,managedServices:void 0,backups:void 0}:i,N=Re({...r,infrastructure:{...r.infrastructure,compute:W}},{environment:n}),q=de(ee({runtime:N.runtime,runtimeVersion:N.runtimeVersion,systemPackages:i.systemPackages,database:r.infrastructure?.database,servicesProvision:N.servicesProvision,baked:u,swapGb:i.swapGb})),k=b.filter((D)=>te(D.labels,s,n,"app")),X=k.map((D)=>D.id);if(k.length>t.appServers)for(let D of k.slice(t.appServers))await this.client.deleteServer(D.id).catch(()=>{}),X.splice(X.indexOf(D.id),1);for(let D=k.length;D<t.appServers;D++){let{server:z,action:B}=await this.client.createServer({name:`${s}-${n}-app-${D+1}`,serverType:a,image:c,location:l,userData:q,labels:j(s,n,"app"),sshKeys:f?[f]:void 0,firewalls:[{firewall:S.id}],networks:[_.id]});await this.client.waitForAction(B.id),X.push(z.id),I.push(z.id)}if(this.waitForBoot&&I.length>0)await Promise.all(I.map(async(D)=>{let B=(await this.client.waitForServerRunning(D)).public_net.ipv4?.ip;if(B)await this.waitForSshReady(B),await this.waitForCloudInit(B)}));let oe=[];for(let D of X){let z=b.find((B)=>B.id===D);if(!z||!z.private_net?.[0]?.ip)z=await this.client.getServer(D).catch(()=>z);oe.push({privateIp:z?.private_net?.[0]?.ip,publicIp:z?.public_net.ipv4?.ip})}let fe=`${s}-${n}-lb`,$e,ne;if(t.loadBalancer){let D=b.find((B)=>te(B.labels,s,n,"lb")),z=i.proxy?.engine==="rpx"?i.proxy:{engine:"rpx"};if(!D){let B=le({proxy:z,config:Me(d,oe,{proxy:z,slug:s}),slug:s,bunBin:N.runtime==="node"||N.runtime==="deno"?void 0:"/usr/local/bin/bun"}),ae=de(ee({runtime:"bun",rpxProvision:B,baked:!1})),ge=typeof i.loadBalancer==="object"?i.loadBalancer.size:void 0,{server:rt,action:er}=await this.client.createServer({name:fe,serverType:dt(ge??"micro"),image:c,location:l,userData:ae,labels:j(s,n,"lb"),sshKeys:f?[f]:void 0,firewalls:[{firewall:R.id}],networks:[_.id]});if(await this.client.waitForAction(er.id),D=await this.client.waitForServerRunning(rt.id),this.waitForBoot){let nt=D.public_net.ipv4?.ip;if(nt)await this.waitForSshReady(nt),await this.waitForCloudInit(nt)}}else this.refreshLbRoutes(D,d,oe,z,s);$e=D.id,ne=D.public_net.ipv4?.ip}let L=ne??(await this.client.getServer(X[0]).catch(()=>{return}))?.public_net.ipv4?.ip,M={provider:"hetzner",stackName:o,networkId:_.id,lbServerId:$e,appServerIds:X,servicesServerId:C,servicesPrivateIp:E,publicIp:L,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser};return await ut(o,M),{appPublicIp:L,loadBalancerIp:ne,servicesPrivateIp:E,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser}}async destroyCompute(e){let{config:t,environment:r}=e,n=t.project.slug,s=T(t,r),i=await pe(s),o=[],a=`${n}-${r}-lb`,l=(await this.client.listLoadBalancers().catch(()=>[])).find((S)=>S.name===a);if(l)try{await this.client.deleteLoadBalancer(l.id),o.push(`load balancer ${a}`)}catch{}let u=await this.client.listServers().catch(()=>[]),d=new Set;for(let S of u)if(te(S.labels,n,r,"app")||te(S.labels,n,r,"services")||te(S.labels,n,r,"lb"))d.add(S.id);if(i?.serverId)d.add(i.serverId);if(i?.servicesServerId)d.add(i.servicesServerId);if(i?.lbServerId)d.add(i.lbServerId);for(let S of i?.appServerIds??[])d.add(S);for(let S of d)try{await this.client.deleteServer(S),o.push(`server ${S}`)}catch{}let m=await this.client.listFirewalls().catch(()=>[]);for(let S of[`${n}-${r}-app-fw`,`${n}-${r}-services-fw`,`${n}-${r}-lb-fw`]){let R=m.find((b)=>b.name===S);if(!R)continue;for(let b=0;b<12;b++)try{await this.client.deleteFirewall(R.id),o.push(`firewall ${S}`);break}catch{await this.sleep(3000)}}let f=`${n}-${r}-net`,x=(await this.client.listNetworks().catch(()=>[])).find((S)=>S.name===f);if(x)for(let S=0;S<12;S++)try{await this.client.deleteNetwork(x.id),o.push(`network ${f}`);break}catch{await this.sleep(3000)}let y=(await this.client.listSshKeys().catch(()=>[])).filter((S)=>Kr(S.labels,n,r));for(let S of y)try{await this.client.deleteSshKey(S.id),o.push(`ssh key ${S.name}`)}catch{}return await ut(s,{provider:"hetzner",stackName:s}).catch(()=>{}),{destroyed:o}}async getComputeOutputs(e){let t=T(e.config,e.environment),r=await pe(t);if(r?.serverId){let i=await this.tryGetServer(r.serverId);if(i)return this.outputsFromState(r,i)}if(r?.lbServerId){let o=(await this.tryGetServer(r.lbServerId))?.public_net.ipv4?.ip??r.publicIp;return{...this.outputsFromState(r),appPublicIp:o,loadBalancerIp:o}}if(r?.loadBalancerId||r?.servicesPrivateIp)return this.outputsFromState(r);let s=(await this.findComputeTargets({slug:e.config.project.slug,environment:e.environment,role:"app",stackName:T(e.config,e.environment)}))[0];return{deployStoragePath:"/var/ts-cloud/staging",appInstanceId:s?.id,appPublicIp:s?.publicIp,sshUser:this.sshUser}}async uploadRelease(e){let t=e.targets?.length?e.targets:await this.findComputeTargets({slug:e.config.project.slug,environment:e.environment,role:"app",stackName:T(e.config,e.environment)});if(t.length===0)throw Error("No Hetzner compute targets found for release upload");let s=`/var/ts-cloud/staging/${`${e.remoteKey.replace(/^releases\//,"").replace(/\.tar\.gz$/,"").replace(/\//g,"-")}-${Is()}.tar.gz`}`,i=await sc(e.localPath),o=Be,a=`${o}/${i}.tar.gz`;for(let c of t){if(!c.publicIp)throw Error(`Target ${c.id} has no public IP for SCP upload`);let l=["set -euo pipefail",`mkdir -p ${yt(o)} /var/ts-cloud/staging`,`test -s ${yt(a)}`,`cp -- ${yt(a)} ${yt(s)}`].join(`
+`,"utf8"),await Ja(s,n)}async function pe(e){return Ie(e)}async function ut(e,t){await Ye(e,t)}var Wr=268435456;function yt(e){return`'${e.replace(/'/g,`'"'"'`)}'`}async function sc(e){let t=ec("sha256");for await(let r of tc(e))t.update(r);return t.digest("hex")}class _e{name="hetzner";usesCloudFormation=!1;client;sshPrivateKeyPath;sshPublicKeyPath;sshUser;location;stateOnly;waitForBoot;bootWait;constructor(e={}){let t=ft(e.apiToken);if(this.stateOnly=!e.client&&!t&&e.allowStateOnly===!0,!e.client&&!t&&!this.stateOnly)throw Error("Hetzner API token required. Set hetzner.apiToken in cloud.config.ts or HCLOUD_TOKEN / HETZNER_API_TOKEN.");this.client=e.client??new We({apiToken:t??""});let r=lr(void 0,{sshPrivateKeyPath:e.sshPrivateKeyPath,sshPublicKeyPath:e.sshPublicKeyPath,sshUser:e.sshUser,location:e.location});this.sshPrivateKeyPath=r.sshPrivateKeyPath,this.sshPublicKeyPath=r.sshPublicKeyPath,this.sshUser=r.sshUser,this.location=r.location,this.waitForBoot=e.waitForBoot??!0,this.bootWait={sshIntervalMs:e.bootWait?.sshIntervalMs??5000,sshTimeoutMs:e.bootWait?.sshTimeoutMs??300000,cloudInitIntervalMs:e.bootWait?.cloudInitIntervalMs??5000,cloudInitTimeoutMs:e.bootWait?.cloudInitTimeoutMs??600000}}async provisionComputeInfrastructure(e){let{config:t,environment:r}=e,n=t.project.slug,s=t.infrastructure?.compute;if(!s)throw Error("infrastructure.compute is required to provision Hetzner compute");if(t.cloud?.attachTo)return this.attachToComputeInfrastructure(t.cloud.attachTo,t,r);let i=T(t,r),o=`${n}-${r}-app`,a=s.runtime==="php"||!!s.php,c=Cs(s);if(c.dedicatedServices||c.appServers>1)return a?this.provisionFleet(e,c):this.provisionBunFleet(e,c);let l=j(n,r,"app"),u=t.sites||{},d=Z(s)?[]:this.collectUpstreamPorts(u),m=`${n}-${r}-app-fw`,{firewall:f}=await this.ensureFirewall(m,l,Yr({allowSsh:s.allowSsh!==!1,sitePorts:d,allowedPorts:[...s.firewall?.allowedPorts??[],...Vn(t.infrastructure?.sftp)]})),h=await this.ensureSshKey(n,r,l),x=await pe(i);if(x?.serverId){let k=await this.tryGetServer(x.serverId);if(k&&k.status!=="off")return this.outputsFromState(x,k)}let _=await this.findExistingServer(n,r,o);if(_&&_.status!=="off"){let k={provider:"hetzner",stackName:i,serverId:_.id,serverName:_.name,publicIp:_.public_net.ipv4?.ip,publicIpv6:ue(_.public_net.ipv6?.ip),deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser};return await ut(i,k),this.outputsFromState(k,_)}let y=s.proxy?.engine==="rpx"?le({proxy:s.proxy,config:ve(u,{proxy:s.proxy,slug:t.project.slug}),slug:t.project.slug,bunBin:s.runtime==="node"||s.runtime==="deno"?void 0:"/usr/local/bin/bun"}):void 0,S=Re(t,{environment:r}),R=s.bakedImage===!0,b=ee({runtime:S.runtime,runtimeVersion:S.runtimeVersion,systemPackages:s.systemPackages,database:t.infrastructure?.database,phpProvision:S.phpProvision,servicesProvision:S.servicesProvision,rpxProvision:y,baked:R,swapGb:s.swapGb}),I=de(b),C=dt(s.size),E=gt(t),{server:H,action:re}=await this.client.createServer({name:o,serverType:C,image:E,location:t.hetzner?.location||this.location,userData:I,labels:l,sshKeys:h?[h]:void 0,firewalls:[{firewall:f.id}]});await this.client.waitForAction(re.id);let W=await this.client.waitForServerRunning(H.id),N={provider:"hetzner",stackName:i,serverId:W.id,serverName:W.name,firewallId:f.id,publicIp:W.public_net.ipv4?.ip,publicIpv6:ue(W.public_net.ipv6?.ip),deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser};await ut(i,N);let q=W.public_net.ipv4?.ip;if(q&&this.waitForBoot)await this.waitForSshReady(q),await this.waitForCloudInit(q);return this.outputsFromState(N,W)}async provisionFleet(e,t){let{config:r,environment:n}=e,s=r.project.slug,i=r.infrastructure.compute,o=T(r,n),a=dt(i.size),c=gt(r),l=r.hetzner?.location||this.location,u=i.bakedImage===!0,d=await pe(o);if(d?.loadBalancerId){let M=(await this.client.listLoadBalancers().catch(()=>[])).find((D)=>D.id===d.loadBalancerId);if(M)return{appPublicIp:M.public_net?.ipv4?.ip,loadBalancerIp:M.public_net?.ipv4?.ip,servicesPrivateIp:d.servicesPrivateIp,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser}}let m=await this.ensureSshKey(s,n,j(s,n,"app")),f=`${s}-${n}-net`,x=(await this.client.listNetworks().catch(()=>[])).find((L)=>L.name===f)??await this.client.createNetwork({name:f,labels:j(s,n,"app")}),{firewall:_}=await this.ensureFirewall(`${s}-${n}-app-fw`,j(s,n,"app"),Yr({allowSsh:!0,sitePorts:[],allowedPorts:i.firewall?.allowedPorts})),{firewall:y}=await this.ensureFirewall(`${s}-${n}-services-fw`,j(s,n,"services"),[{direction:"in",protocol:"tcp",port:"22",source_ips:["0.0.0.0/0","::/0"]},{direction:"in",protocol:"tcp",port:"3306",source_ips:[x.ip_range]},{direction:"in",protocol:"tcp",port:"5432",source_ips:[x.ip_range]},{direction:"in",protocol:"tcp",port:"6379",source_ips:[x.ip_range]},{direction:"in",protocol:"tcp",port:"7700",source_ips:[x.ip_range]}]),S=Fr(r),R=de(ee({runtime:"php",servicesProvision:S,baked:u,swapGb:i.swapGb})),b=await this.client.listServers().catch(()=>[]),I=[],C=b.find((L)=>te(L.labels,s,n,"services"));if(!C){let{server:L,action:M}=await this.client.createServer({name:`${s}-${n}-services`,serverType:dt(typeof i.servicesServer==="object"?i.servicesServer.size:i.size),image:c,location:l,userData:R,labels:j(s,n,"services"),sshKeys:m?[m]:void 0,firewalls:[{firewall:y.id}],networks:[x.id]});await this.client.waitForAction(M.id),C=await this.client.waitForServerRunning(L.id),I.push(L.id)}let E=C.id,H=C.private_net?.[0]?.ip??(await this.client.getServer(E)).private_net?.[0]?.ip,re=[...he(!0),...Se(!0),...Fe(i.sshKeys),...He(r.notifications)],W=Ct({versions:i.php?.versions,default:i.php?.default,extensions:i.php?.extensions,installNginx:!Z(i),optimizeForProduction:i.php?.optimizeForProduction,ini:i.php?.ini}),N=de(ee({runtime:"php",phpProvision:W,servicesProvision:re,baked:u,swapGb:i.swapGb})),q=b.filter((L)=>te(L.labels,s,n,"app")),k=q.map((L)=>L.id);if(q.length>t.appServers)for(let L of q.slice(t.appServers))await this.client.deleteServer(L.id).catch(()=>{}),k.splice(k.indexOf(L.id),1);for(let L=q.length;L<t.appServers;L++){let{server:M,action:D}=await this.client.createServer({name:`${s}-${n}-app-${L+1}`,serverType:a,image:c,location:l,userData:N,labels:j(s,n,"app"),sshKeys:m?[m]:void 0,firewalls:[{firewall:_.id}],networks:[x.id]});await this.client.waitForAction(D.id),k.push(M.id),I.push(M.id)}if(this.waitForBoot&&I.length>0)await Promise.all(I.map(async(L)=>{let D=(await this.client.waitForServerRunning(L)).public_net.ipv4?.ip;if(D)await this.waitForSshReady(D),await this.waitForCloudInit(D)}));let X=`${s}-${n}-lb`,oe,fe;if(t.loadBalancer){let M=(await this.client.listLoadBalancers().catch(()=>[])).find((D)=>D.name===X)??await this.client.createLoadBalancer({name:X,location:l,network:x.id,labels:j(s,n,"lb"),labelSelector:`ts-cloud/project=${s},ts-cloud/environment=${n},ts-cloud/role=app`,services:[{listenPort:80,destinationPort:80},{listenPort:443,destinationPort:443}]});fe=M.id,oe=M.public_net?.ipv4?.ip}let $e=oe??(await this.client.getServer(k[0]).catch(()=>{return}))?.public_net.ipv4?.ip,ne={provider:"hetzner",stackName:o,networkId:x.id,loadBalancerId:fe,servicesServerId:E,servicesPrivateIp:H,publicIp:$e,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser};return await ut(o,ne),{appPublicIp:$e,loadBalancerIp:oe,servicesPrivateIp:H,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser}}async provisionBunFleet(e,t){let{config:r,environment:n}=e,s=r.project.slug,i=r.infrastructure.compute,o=T(r,n),a=dt(i.size),c=gt(r),l=r.hetzner?.location||this.location,u=i.bakedImage===!0,d=r.sites||{},m=await pe(o);if(m?.lbServerId){let D=await this.tryGetServer(m.lbServerId);if(D&&D.status!=="off"){let F=i.proxy?.engine==="rpx"?i.proxy:{engine:"rpx"},z=await this.findComputeTargets({slug:s,environment:n,role:"app",stackName:o});return this.refreshLbRoutes(D,d,z.map((ae)=>({privateIp:ae.privateIp,publicIp:ae.publicIp})),F,s),{appPublicIp:D.public_net.ipv4?.ip??m.publicIp,loadBalancerIp:D.public_net.ipv4?.ip??m.publicIp,servicesPrivateIp:m.servicesPrivateIp,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser}}}let f=await this.ensureSshKey(s,n,j(s,n,"app")),h=`${s}-${n}-net`,_=(await this.client.listNetworks().catch(()=>[])).find((D)=>D.name===h)??await this.client.createNetwork({name:h,labels:j(s,n,"app")}),y=this.collectUpstreamPorts(d),{firewall:S}=await this.ensureFirewall(`${s}-${n}-app-fw`,j(s,n,"app"),[{direction:"in",protocol:"tcp",port:"22",source_ips:["0.0.0.0/0","::/0"]},...y.map((D)=>({direction:"in",protocol:"tcp",port:String(D),source_ips:[_.ip_range],description:`ts-cloud port ${D} (private, LB-only)`}))]),{firewall:R}=await this.ensureFirewall(`${s}-${n}-lb-fw`,j(s,n,"lb"),Yr({allowSsh:!0,sitePorts:[],allowedPorts:i.firewall?.allowedPorts})),b=await this.client.listServers().catch(()=>[]),I=[],C,E,H=!!i.servicesServer||!!i.managedServices,re=t.dedicatedServices&&H;if(re){let{firewall:D}=await this.ensureFirewall(`${s}-${n}-services-fw`,j(s,n,"services"),[{direction:"in",protocol:"tcp",port:"22",source_ips:["0.0.0.0/0","::/0"]},{direction:"in",protocol:"tcp",port:"3306",source_ips:[_.ip_range]},{direction:"in",protocol:"tcp",port:"5432",source_ips:[_.ip_range]},{direction:"in",protocol:"tcp",port:"6379",source_ips:[_.ip_range]},{direction:"in",protocol:"tcp",port:"7700",source_ips:[_.ip_range]}]),F=Fr(r),z=de(ee({runtime:"bun",servicesProvision:F,baked:u,swapGb:i.swapGb})),ae=b.find((ge)=>te(ge.labels,s,n,"services"));if(!ae){let{server:ge,action:rt}=await this.client.createServer({name:`${s}-${n}-services`,serverType:dt(typeof i.servicesServer==="object"?i.servicesServer.size:i.size),image:c,location:l,userData:z,labels:j(s,n,"services"),sshKeys:f?[f]:void 0,firewalls:[{firewall:D.id}],networks:[_.id]});await this.client.waitForAction(rt.id),ae=await this.client.waitForServerRunning(ge.id),I.push(ge.id)}C=ae.id,E=ae.private_net?.[0]?.ip??(await this.client.getServer(C)).private_net?.[0]?.ip}let W=re?{...i,managedServices:void 0,backups:void 0}:i,N=Re({...r,infrastructure:{...r.infrastructure,compute:W}},{environment:n}),q=de(ee({runtime:N.runtime,runtimeVersion:N.runtimeVersion,systemPackages:i.systemPackages,database:r.infrastructure?.database,servicesProvision:N.servicesProvision,baked:u,swapGb:i.swapGb})),k=b.filter((D)=>te(D.labels,s,n,"app")),X=k.map((D)=>D.id);if(k.length>t.appServers)for(let D of k.slice(t.appServers))await this.client.deleteServer(D.id).catch(()=>{}),X.splice(X.indexOf(D.id),1);for(let D=k.length;D<t.appServers;D++){let{server:F,action:z}=await this.client.createServer({name:`${s}-${n}-app-${D+1}`,serverType:a,image:c,location:l,userData:q,labels:j(s,n,"app"),sshKeys:f?[f]:void 0,firewalls:[{firewall:S.id}],networks:[_.id]});await this.client.waitForAction(z.id),X.push(F.id),I.push(F.id)}if(this.waitForBoot&&I.length>0)await Promise.all(I.map(async(D)=>{let z=(await this.client.waitForServerRunning(D)).public_net.ipv4?.ip;if(z)await this.waitForSshReady(z),await this.waitForCloudInit(z)}));let oe=[];for(let D of X){let F=b.find((z)=>z.id===D);if(!F||!F.private_net?.[0]?.ip)F=await this.client.getServer(D).catch(()=>F);oe.push({privateIp:F?.private_net?.[0]?.ip,publicIp:F?.public_net.ipv4?.ip})}let fe=`${s}-${n}-lb`,$e,ne;if(t.loadBalancer){let D=b.find((z)=>te(z.labels,s,n,"lb")),F=i.proxy?.engine==="rpx"?i.proxy:{engine:"rpx"};if(!D){let z=le({proxy:F,config:Me(d,oe,{proxy:F,slug:s}),slug:s,bunBin:N.runtime==="node"||N.runtime==="deno"?void 0:"/usr/local/bin/bun"}),ae=de(ee({runtime:"bun",rpxProvision:z,baked:!1})),ge=typeof i.loadBalancer==="object"?i.loadBalancer.size:void 0,{server:rt,action:er}=await this.client.createServer({name:fe,serverType:dt(ge??"micro"),image:c,location:l,userData:ae,labels:j(s,n,"lb"),sshKeys:f?[f]:void 0,firewalls:[{firewall:R.id}],networks:[_.id]});if(await this.client.waitForAction(er.id),D=await this.client.waitForServerRunning(rt.id),this.waitForBoot){let nt=D.public_net.ipv4?.ip;if(nt)await this.waitForSshReady(nt),await this.waitForCloudInit(nt)}}else this.refreshLbRoutes(D,d,oe,F,s);$e=D.id,ne=D.public_net.ipv4?.ip}let L=ne??(await this.client.getServer(X[0]).catch(()=>{return}))?.public_net.ipv4?.ip,M={provider:"hetzner",stackName:o,networkId:_.id,lbServerId:$e,appServerIds:X,servicesServerId:C,servicesPrivateIp:E,publicIp:L,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser};return await ut(o,M),{appPublicIp:L,loadBalancerIp:ne,servicesPrivateIp:E,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser}}async destroyCompute(e){let{config:t,environment:r}=e,n=t.project.slug,s=T(t,r),i=await pe(s),o=[],a=`${n}-${r}-lb`,l=(await this.client.listLoadBalancers().catch(()=>[])).find((S)=>S.name===a);if(l)try{await this.client.deleteLoadBalancer(l.id),o.push(`load balancer ${a}`)}catch{}let u=await this.client.listServers().catch(()=>[]),d=new Set;for(let S of u)if(te(S.labels,n,r,"app")||te(S.labels,n,r,"services")||te(S.labels,n,r,"lb"))d.add(S.id);if(i?.serverId)d.add(i.serverId);if(i?.servicesServerId)d.add(i.servicesServerId);if(i?.lbServerId)d.add(i.lbServerId);for(let S of i?.appServerIds??[])d.add(S);for(let S of d)try{await this.client.deleteServer(S),o.push(`server ${S}`)}catch{}let m=await this.client.listFirewalls().catch(()=>[]);for(let S of[`${n}-${r}-app-fw`,`${n}-${r}-services-fw`,`${n}-${r}-lb-fw`]){let R=m.find((b)=>b.name===S);if(!R)continue;for(let b=0;b<12;b++)try{await this.client.deleteFirewall(R.id),o.push(`firewall ${S}`);break}catch{await this.sleep(3000)}}let f=`${n}-${r}-net`,x=(await this.client.listNetworks().catch(()=>[])).find((S)=>S.name===f);if(x)for(let S=0;S<12;S++)try{await this.client.deleteNetwork(x.id),o.push(`network ${f}`);break}catch{await this.sleep(3000)}let y=(await this.client.listSshKeys().catch(()=>[])).filter((S)=>Kr(S.labels,n,r));for(let S of y)try{await this.client.deleteSshKey(S.id),o.push(`ssh key ${S.name}`)}catch{}return await ut(s,{provider:"hetzner",stackName:s}).catch(()=>{}),{destroyed:o}}async getComputeOutputs(e){let t=T(e.config,e.environment),r=await pe(t);if(r?.serverId){let i=await this.tryGetServer(r.serverId);if(i)return this.outputsFromState(r,i)}if(r?.lbServerId){let o=(await this.tryGetServer(r.lbServerId))?.public_net.ipv4?.ip??r.publicIp;return{...this.outputsFromState(r),appPublicIp:o,loadBalancerIp:o}}if(r?.loadBalancerId||r?.servicesPrivateIp)return this.outputsFromState(r);let s=(await this.findComputeTargets({slug:e.config.project.slug,environment:e.environment,role:"app",stackName:T(e.config,e.environment)}))[0];return{deployStoragePath:"/var/ts-cloud/staging",appInstanceId:s?.id,appPublicIp:s?.publicIp,sshUser:this.sshUser}}async uploadRelease(e){let t=e.targets?.length?e.targets:await this.findComputeTargets({slug:e.config.project.slug,environment:e.environment,role:"app",stackName:T(e.config,e.environment)});if(t.length===0)throw Error("No Hetzner compute targets found for release upload");let s=`/var/ts-cloud/staging/${`${e.remoteKey.replace(/^releases\//,"").replace(/\.tar\.gz$/,"").replace(/\//g,"-")}-${Is()}.tar.gz`}`,i=await sc(e.localPath),o=Be,a=`${o}/${i}.tar.gz`;for(let c of t){if(!c.publicIp)throw Error(`Target ${c.id} has no public IP for SCP upload`);let l=["set -euo pipefail",`mkdir -p ${yt(o)} /var/ts-cloud/staging`,`test -s ${yt(a)}`,`cp -- ${yt(a)} ${yt(s)}`].join(`
 `);try{this.sshExec(c.publicIp,l);continue}catch{}let u=`${o}/.${i}-${Is()}.tmp`;try{this.scpToHost(c.publicIp,e.localPath,u),this.sshExec(c.publicIp,Lt(u,a,s))}catch(d){try{this.sshExec(c.publicIp,Ht(u))}catch{}throw d}}return{artifactRef:s}}async findComputeTargets(e){let t=e.role||"app",r=(i)=>({id:String(i.id),name:i.name,publicIp:i.public_net.ipv4?.ip,publicIpv6:ue(i.public_net.ipv6?.ip),privateIp:i.private_net?.[0]?.ip,status:i.status});if(t==="app"||t==="lb"||t==="services"){let i=await pe(e.stackName??`${e.slug}-${e.environment}`),o=[...new Set(t==="app"?[i?.serverId,...i?.appServerIds??[]]:t==="lb"?[i?.lbServerId]:[i?.servicesServerId])].filter((l)=>typeof l==="number");if(this.stateOnly){if(o.length>0&&i?.publicIp)return o.map((l)=>({id:String(l),name:l===i.serverId?i.serverName:void 0,publicIp:i.publicIp,publicIpv6:i.publicIpv6,status:"running"}));if(t!=="app")return[];throw Error(`Hetzner API token required because '${e.stackName??`${e.slug}-${e.environment}`}' has no complete local compute state pin.`)}let a=await this.client.listServers();if(o.length>0){let l=[];for(let u of o){let d=a.find((m)=>m.id===u)??await this.tryGetServer(u);if(u===i?.serverId&&i.serverName&&d?.name!==i.serverName)continue;if(d&&d.status!=="off")l.push(d)}if(l.length>0)return l.map(r)}let c=a.filter((l)=>te(l.labels,e.slug,e.environment,t));if(c.length>0)return c.map(r);if(t==="app"){let l=a.filter((u)=>u.status!=="off"&&u.labels?.[`${K}/managed-by`]==="ts-cloud"&&u.labels?.[`${K}/environment`]===e.environment&&u.labels?.[`${K}/role`]==="app");if(l.length===1)return l.map(r)}return[]}if(this.stateOnly)throw Error(`Hetzner API token required to discover '${t}' compute targets.`);let s=(await this.client.listServers()).filter((i)=>te(i.labels,e.slug,e.environment,t));if(s.length>0)return s.map(r);return[]}async attachToComputeInfrastructure(e,t,r){let n=await this.client.listServers(),s=(m)=>n.filter((f)=>f.status!=="off"&&te(f.labels,e,r,m)),i=s("app");if(i.length===0)throw Error(`Cannot attach '${t.project.slug}' to '${e}': no running Hetzner app server is labeled for ${e}/${r}. Deploy the owner project first.`);let o=s("lb")[0],a=s("services")[0],c=i[0],l=o??c,u=T(t,r),d={provider:"hetzner",stackName:u,serverId:c.id,serverName:c.name,appServerIds:i.map((m)=>m.id),lbServerId:o?.id,servicesServerId:a?.id,servicesPrivateIp:a?.private_net?.[0]?.ip,publicIp:l.public_net.ipv4?.ip,deployStoragePath:"/var/ts-cloud/staging",sshUser:this.sshUser};return await ut(u,d),this.outputsFromState(d)}async listReachableResources(){return(await this.client.listServers()).map((t)=>({name:t.name,labels:t.labels}))}async runRemoteDeploy(e){if(e.targets.length===0)return{success:!1,instanceCount:0,perInstance:[],error:"No targets provided"};let t=e.commands.join(`
 `),r=[];for(let s of e.targets){if(!s.publicIp){r.push({instanceId:s.id,status:"Failed",error:"Missing public IP"});continue}try{let i=this.sshExec(s.publicIp,t);Le(i),r.push({instanceId:s.id,status:"Success",output:i})}catch(i){r.push({instanceId:s.id,status:"Failed",error:i.message})}}let n=r.every((s)=>s.status==="Success");return{success:n,instanceCount:e.targets.length,perInstance:r,error:n?void 0:xe(r,"One or more SSH deploy commands failed")}}async ensureSshKey(e,t,r){if(!rc(this.sshPublicKeyPath))throw Error(`SSH public key not found at ${this.sshPublicKeyPath}. ts-cloud deploys to Hetzner over SSH and needs a public key to authorize on the server. Generate one (\`ssh-keygen -t ed25519\`) or set hetzner.sshPrivateKeyPath / HCLOUD_SSH_PUBLIC_KEY.`);let n=nc(this.sshPublicKeyPath,"utf8").trim(),s=ht(n),o=(await this.client.listSshKeys()).find((c)=>ht(c.public_key)===s);if(o)return o.id;return(await this.client.createSshKey({name:`${e}-${t}-deploy`,publicKey:n,labels:r})).id}async tryGetServer(e){try{return await this.client.getServer(e)}catch{return null}}refreshLbRoutes(e,t,r,n,s){let i=e.public_net.ipv4?.ip;if(!i){console.warn(`[ts-cloud] LB server '${e.name}' has no public IP — skipping the rpx route refresh; its routes may be stale.`);return}let o=r.filter((c)=>c.privateIp||c.publicIp);if(o.length===0){console.warn(`[ts-cloud] No routable app boxes found for LB '${e.name}' — leaving its current rpx routes untouched.`);return}let a=Me(t,o,{proxy:n,slug:s});this.sshExec(i,Ge({config:a,slug:s}).join(`
 `))}async findExistingServer(e,t,r){let n=await this.client.listServers(),s=n.find((o)=>te(o.labels,e,t,"app")||o.name===r);if(s)return s;let i=n.filter((o)=>o.status!=="off"&&o.labels?.[`${K}/managed-by`]==="ts-cloud"&&o.labels?.[`${K}/environment`]===t&&o.labels?.[`${K}/role`]==="app");if(i.length===1){let o=i[0],a=o.labels?.[`${K}/project`]??"unknown";return console.warn(`[ts-cloud] No server named '${r}' found; adopting existing ts-cloud app server '${o.name}' (project label '${a}') for project '${e}' — `+"updating it in place instead of provisioning a new server."),o}return}async ensureFirewall(e,t,r){let s=(await this.client.listFirewalls()).find((o)=>o.name===e);if(s)return await this.client.setFirewallRules(s.id,r),{firewall:s};let{firewall:i}=await this.client.createFirewall({name:e,labels:t,rules:r});return{firewall:i}}collectUpstreamPorts(e){let t=new Set;for(let r of Object.values(e))if(typeof r.port==="number")t.add(r.port);return[...t].filter((r)=>![80,443].includes(r))}async sleep(e){await new Promise((t)=>setTimeout(t,e))}async waitForSshReady(e){let{sshIntervalMs:t,sshTimeoutMs:r}=this.bootWait,n=Date.now(),s;while(Date.now()-n<r)try{Ds(`ssh ${this.sshBaseArgs(e,["-o","ConnectTimeout=5"]).map(yt).join(" ")} true`,{stdio:"pipe",maxBuffer:Wr});return}catch(i){s=i,await this.sleep(t)}throw Error(`Timed out waiting for SSH on ${e} after ${r}ms: ${s?.message??"unknown error"}`)}async waitForCloudInit(e){let{cloudInitIntervalMs:t,cloudInitTimeoutMs:r}=this.bootWait,n=Date.now();while(Date.now()-n<r){try{let s=this.sshExec(e,"if command -v cloud-init >/dev/null 2>&1; then cloud-init status --long 2>/dev/null || true; else echo 'status: done'; fi");if(/status:\s*error/.test(s))throw Error(`cloud-init reported an error on ${e}:
@@ -373,7 +373,7 @@ ${" ".repeat(t+10)}${r.remediation}`:n}).join(`
 `);try{await this.exec(a.publicIp,c);continue}catch{}let l=`${cn}/.${i}-${fi()}.tmp`;try{await this.transport.scp(a.publicIp,e.localPath,l),await this.exec(a.publicIp,Lt(l,o,s))}catch(u){throw await this.exec(a.publicIp,Ht(l)).catch(()=>{}),u}}return{artifactRef:s}}async runRemoteDeploy(e){if(e.targets.length===0)return{success:!1,instanceCount:0,perInstance:[],error:"No targets provided"};let t=e.commands.join(`
 `),r=[];for(let s of e.targets){if(!s.publicIp){r.push({instanceId:s.id,status:"Failed",error:"Missing address"});continue}try{let i=await this.exec(s.publicIp,t);Le(i),r.push({instanceId:s.id,status:"Success",output:i})}catch(i){r.push({instanceId:s.id,status:"Failed",error:i.message})}}let n=r.every((s)=>s.status==="Success");return{success:n,instanceCount:e.targets.length,perInstance:r,error:n?void 0:xe(r,"One or more SSH deploy commands failed")}}targetHost(){return this.host.host}ensureHostKey(e=this.host.host){return this.transport.ensureHostKey(e)}async preflight(e=this.host.host){let t=await this.transport.exec(e,sn,{sudo:!1}),r=on(t);return{facts:r,findings:an(r,{user:this.host.user,profile:this.settings.profile})}}async provisionComputeInfrastructure(e){let{config:t,environment:r}=e;for(let h of hi(t,this.settings))console.warn(`[ts-cloud] ${h}`);let n=this.host,s=T(t,r),i=await Ie(s,this.cwd),o=process.env[gi]==="1"&&i?.provider==="ssh"&&i.host===n.host&&i.bootstrapVersion===we,a=await this.ensureHostKey(n.host);if(a.pinnedNow)console.warn(`[ts-cloud] pinned ${n.host} host key ${a.fingerprint}`);await this.waitForSshReady(n.host);let{facts:c,findings:l}=await this.preflight(n.host);if(gr(l))throw Error(`Preflight failed for ${n.host}; refusing to bootstrap it.
 ${Zr(l)}`);for(let h of l)console.warn(`[ts-cloud] ${h.severity}: ${h.message}`);if(c.cloudInitPresent&&/running/i.test(c.cloudInitStatus??""))await this.waitForCloudInit(n.host);let u=c.lanIp?.trim()||($c(n.host)!==0?n.host:void 0),d=i?.provider==="ssh"?i.bootstrappedAt:void 0;if(!o){let h=pr({config:t,environment:r,profile:this.settings.profile,facts:c,sudoUser:n.user!=="root"?n.user:void 0,lan:this.settings.lan,lanIp:u});Le(await this.exec(n.host,h)),d=new Date().toISOString()}let m={provider:"ssh",stackName:s,host:n.host,sshUser:n.user,sshPort:n.port,hostKeyFingerprint:a.fingerprint||void 0,publicIp:this.settings.publicIp==="auto"?void 0:this.settings.publicIp,lanIp:c.lanIp||void 0,deployStoragePath:Tt,profile:this.settings.profile,bootstrapVersion:we,bootstrappedAt:d};await Ye(s,m,this.cwd);let f=await this.getComputeOutputs();if(Z(t.infrastructure?.compute)&&yr(this.settings.lan)==="local-ca")f.lanCaCertPath=Pt(),console.warn(`[ts-cloud] LAN certificate authority on ${n.host} at ${f.lanCaCertPath}. Fetch it with: scp ${n.user}@${n.host}:${f.lanCaCertPath} ./rpx-root-ca.crt`);return f}async destroyCompute(e){let t=T(e.config,e.environment),r=this.host;return console.warn(`[ts-cloud] forgot ${r.host} for ${t}; nothing was removed on the host (stop the systemd units and remove /var/ts-cloud and /etc/rpx by hand if you want it clean).`),await Ye(t,{provider:"ssh",stackName:t,host:r.host,sshUser:r.user,sshPort:r.port},this.cwd).catch(()=>{}),{destroyed:[`local state for ${t}`]}}async sleep(e){await new Promise((t)=>setTimeout(t,e))}async waitForSshReady(e){let{sshIntervalMs:t,sshTimeoutMs:r}=this.bootWait,n=Date.now();do{if(await this.transport.probe(e))return;await this.sleep(t)}while(Date.now()-n<r);throw Error(`Timed out waiting for SSH on ${e} after ${r}ms`)}async waitForCloudInit(e){let{cloudInitIntervalMs:t,cloudInitTimeoutMs:r}=this.bootWait,n=Date.now();while(Date.now()-n<r){try{let s=await this.transport.exec(e,"if command -v cloud-init >/dev/null 2>&1; then cloud-init status --long 2>/dev/null || true; else echo 'status: done'; fi",{sudo:!1});if(/status:\s*error/.test(s))throw Error(`cloud-init reported an error on ${e}:
-${s}`);if(/status:\s*(?:done|degraded)/.test(s))return}catch(s){if(s instanceof Error&&/cloud-init reported an error/.test(s.message))throw s}await this.sleep(t)}throw Error(`Timed out waiting for cloud-init to finish on ${e} after ${r}ms`)}}function O(e){if(Gr())return new Mt;switch(e.provider??F(e.config)){case"aws":return new Et({region:e.config.project.region});case"hetzner":return new _e({apiToken:e.config.hetzner?.apiToken,allowStateOnly:Boolean(e.config.cloud?.attachTo),sshPrivateKeyPath:e.config.hetzner?.sshPrivateKeyPath,sshPublicKeyPath:e.config.hetzner?.sshPublicKeyPath,sshUser:e.config.hetzner?.sshUser,location:e.config.hetzner?.location});case"ssh":return new fr({hosts:e.config.ssh?.hosts,hostKey:e.config.ssh?.hostKey,sudo:e.config.ssh?.sudo,profile:e.config.ssh?.profile,publicIp:e.config.ssh?.publicIp,lan:e.config.ssh?.lan});default:throw Error(`Unknown cloud provider: ${e.provider??F(e.config)}`)}}class Si{drivers=new Map;getDriver(e,t){let r=t??F(e),n=`${r}:${e.project.slug}:${e.project.region||"default"}`,s=this.drivers.get(n);if(s)return s;let i=O({config:e,provider:r});return this.drivers.set(n,i),i}}var im=new Si;var yi="/var/lib/ts-cloud/bootstrap.sh",Zi={"raspberry-pi-os":"bootfs",ubuntu:"system-boot"},xc=/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/,Rc=/^[a-z_][a-z0-9_-]{0,31}$/,Ec=/^[A-Z]{2}$/;function se(e){return JSON.stringify(e)}function Oc(e){if(!xc.test(e.hostname))throw Error(`Invalid hostname '${e.hostname}': use lowercase letters, digits and hyphens.`);if(!Rc.test(e.user))throw Error(`Invalid user '${e.user}': use a lowercase Unix user name.`);let t=e.publicKey.trim();if(!t||t.includes(`
+${s}`);if(/status:\s*(?:done|degraded)/.test(s))return}catch(s){if(s instanceof Error&&/cloud-init reported an error/.test(s.message))throw s}await this.sleep(t)}throw Error(`Timed out waiting for cloud-init to finish on ${e} after ${r}ms`)}}function O(e){if(Gr())return new Mt;switch(e.provider??B(e.config)){case"aws":return new Et({region:e.config.project.region});case"hetzner":return new _e({apiToken:e.config.hetzner?.apiToken,allowStateOnly:Boolean(e.config.cloud?.attachTo),sshPrivateKeyPath:e.config.hetzner?.sshPrivateKeyPath,sshPublicKeyPath:e.config.hetzner?.sshPublicKeyPath,sshUser:e.config.hetzner?.sshUser,location:e.config.hetzner?.location});case"ssh":return new fr({hosts:e.config.ssh?.hosts,hostKey:e.config.ssh?.hostKey,sudo:e.config.ssh?.sudo,profile:e.config.ssh?.profile,publicIp:e.config.ssh?.publicIp,lan:e.config.ssh?.lan});case"fly":throw Error("Fly.io has no box to provision or reach over SSH: deploy it with deployToFly() from @stacksjs/ts-cloud.");default:throw Error(`Unknown cloud provider: ${e.provider??B(e.config)}`)}}class Si{drivers=new Map;getDriver(e,t){let r=t??B(e),n=`${r}:${e.project.slug}:${e.project.region||"default"}`,s=this.drivers.get(n);if(s)return s;let i=O({config:e,provider:r});return this.drivers.set(n,i),i}}var im=new Si;var yi="/var/lib/ts-cloud/bootstrap.sh",Zi={"raspberry-pi-os":"bootfs",ubuntu:"system-boot"},xc=/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/,Rc=/^[a-z_][a-z0-9_-]{0,31}$/,Ec=/^[A-Z]{2}$/;function se(e){return JSON.stringify(e)}function Oc(e){if(!xc.test(e.hostname))throw Error(`Invalid hostname '${e.hostname}': use lowercase letters, digits and hyphens.`);if(!Rc.test(e.user))throw Error(`Invalid user '${e.user}': use a lowercase Unix user name.`);let t=e.publicKey.trim();if(!t||t.includes(`
 `)||!/^(?:ssh|ecdsa|sk)-/.test(t))throw Error("publicKey must be one public key line, e.g. the contents of ~/.ssh/id_ed25519.pub.");if(e.wifi){if(!e.wifi.ssid)throw Error("wifi.ssid is required.");if(!e.wifi.passphrase)throw Error("wifi.passphrase is required.");if(!Ec.test(e.wifi.country))throw Error(`wifi.country must be a two-letter regulatory domain such as DE or US, not '${e.wifi.country}'.`)}}function Dc(e,t){let r=[`hostname: ${se(e.hostname)}`,"manage_etc_hosts: true","users:",`  - name: ${se(e.user)}`,"    ssh_authorized_keys:",`      - ${se(e.publicKey.trim())}`,`    sudo: ${se("ALL=(ALL) NOPASSWD:ALL")}`,"    shell: /bin/bash","    lock_passwd: true","ssh_pwauth: false"];if(e.timezone)r.push(`timezone: ${se(e.timezone)}`);if(e.locale)r.push(`locale: ${se(e.locale)}`);if(r.push("package_update: true"),t==="raspberry-pi-os")r.push("rpi:","  enable_ssh: true","  interfaces:","    spi: false","    i2c: false","    onewire: false","    remote_gpio: false","    serial:","      console: false","      hardware: false");return`${r.join(`
 `)}
 `}function Ic(e){let t=["version: 2","ethernets:","  eth0:","    match:",`      name: ${se("e*")}`,"    dhcp4: true","    dhcp6: true","    optional: true"];if(e.wifi)t.push("wifis:","  wlan0:","    dhcp4: true","    dhcp6: true","    optional: true",`    regulatory-domain: ${se(e.wifi.country)}`,"    access-points:",`      ${se(e.wifi.ssid)}:`,`        password: ${se(e.wifi.passphrase)}`);return`${t.join(`
@@ -526,7 +526,7 @@ console.log(JSON.stringify({
 `.replace(/%/g,"\\%");c.push(`cat > ${_} <<'TS_CLOUD_CRON_EOF'`,R.replace(/\n$/,""),"TS_CLOUD_CRON_EOF",`chmod 644 ${_}`)}else c.push(`rm -f ${_}`);return c}function Sn(e){return!!(e.queues?.length||e.daemons?.length||e.scheduler)}function yn(e){if(e.ssl?.provider)return e.ssl.provider;return e.domain?"letsencrypt":"none"}var Mi={cloudflare:{pkg:"python3-certbot-dns-cloudflare",plugin:"dns-cloudflare"},route53:{pkg:"python3-certbot-dns-route53",plugin:"dns-route53"},digitalocean:{pkg:"python3-certbot-dns-digitalocean",plugin:"dns-digitalocean"},google:{pkg:"python3-certbot-dns-google",plugin:"dns-google"}};function Fi(e){return`/etc/letsencrypt/ts-cloud-${e}.ini`}function gl(e){let t=e?Mi[e.provider]:void 0,r=["certbot","python3-certbot-nginx",...t?[t.pkg]:[]].join(" ");return["export DEBIAN_FRONTEND=noninteractive",t?`apt-get update -y && apt-get install -y ${r}`:`command -v certbot >/dev/null 2>&1 || { apt-get update -y && apt-get install -y ${r}; }`,"mkdir -p /etc/letsencrypt/renewal-hooks/deploy","cat > /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh <<'TS_CLOUD_HOOK_EOF'","#!/bin/sh","systemctl reload ts-cloud-nginx 2>/dev/null || systemctl reload nginx 2>/dev/null || true","TS_CLOUD_HOOK_EOF","chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh","systemctl enable certbot.timer 2>/dev/null || true","systemctl start certbot.timer 2>/dev/null || true"]}function hl(e){if(!e.credentials||Object.keys(e.credentials).length===0)return[];let t=Fi(e.provider),r=Object.entries(e.credentials).map(([n,s])=>`${n} = ${s}`).join(`
 `);return[`cat > ${t} <<'TS_CLOUD_DNSCREDS_EOF'`,r,"TS_CLOUD_DNSCREDS_EOF",`chmod 600 ${t}`]}function Sl(e){let t=e.dns,r=e.wildcard?[`*.${e.domain}`,e.domain]:[e.domain,...e.aliases||[]].filter(Boolean),n=["certbot","--non-interactive","--agree-tos","--keep-until-expiring"];if(t){let s=Mi[t.provider].plugin;if(n.push(`--${s}`),t.provider!=="route53"&&t.credentials)n.push(`--${s}-credentials ${Fi(t.provider)}`);if(typeof t.propagationSeconds==="number"&&t.provider!=="route53")n.push(`--${s}-propagation-seconds ${t.propagationSeconds}`);n.push("certonly")}else n.push("--nginx",`--nginx-ctl ${ye}`,e.redirect===!1?"--no-redirect":"--redirect");if(e.email)n.push(`-m ${e.email}`);else n.push("--register-unsafely-without-email");for(let s of r)n.push(`-d ${s}`);return[n.join(" ")]}function vn(e){if(yn(e)!=="letsencrypt"||!e.domain)return[];let t=e.ssl,r=t?.dns,n=t?.wildcard===!0;if(n&&!r)return[];return[...gl(r),...r?hl(r):[],...Sl({domain:e.domain,aliases:e.aliases,email:t?.email,wildcard:n,dns:r})]}function zi(e){let{repository:t,releaseDir:r,commit:n}=e,s=t.branch||"main",i=t.url,o=[`rm -rf ${r}`,`mkdir -p ${r}`];if(t.strategy==="tag")if(t.tag)o.push(`git clone -q --depth 1 --branch ${ie(t.tag)} ${ie(i)} ${r}`),o.push(`printf '%s' ${ie(t.tag)} > ${r}/.ts-cloud-tag`);else{let a=t.tagPattern||"v*";o.push(`TS_CLOUD_TAG="$(git ls-remote --tags --refs --sort=-v:refname ${ie(i)} ${ie(`refs/tags/${a}`)} | head -n1 | sed 's#.*refs/tags/##')"`,`test -n "$TS_CLOUD_TAG" || { echo "no tags matching" ${ie(a)} "found in" ${ie(i)} >&2; exit 1; }`,`git clone -q --depth 1 --branch "$TS_CLOUD_TAG" ${ie(i)} ${r}`,`printf '%s' "$TS_CLOUD_TAG" > ${r}/.ts-cloud-tag`)}else if(n)o.push(`git -C ${r} init -q`,`git -C ${r} remote add origin ${ie(i)}`,`git -C ${r} fetch -q --depth 1 origin ${ie(n)}`,`git -C ${r} checkout -q FETCH_HEAD`);else o.push(`git clone -q --depth 1 --branch ${ie(s)} ${ie(i)} ${r}`);return o.push(`git -C ${r} rev-parse HEAD > ${r}/.ts-cloud-sha`),o}function ie(e){return`'${e.split("'").join("'\\''")}'`}var qt="$CREATE_RELEASE",Xt="$ACTIVATE_RELEASE",Gi="$RESTART_QUEUES",Bi="composer install --no-interaction --prefer-dist --optimize-autoloader --no-dev",yl=["php artisan migrate --force","php artisan config:cache","php artisan route:cache","php artisan view:cache","php artisan event:cache","php artisan storage:link"];function vl(e){switch(e){case"laravel":case"statamic":return[qt,Bi,...yl,Xt,Gi];case"php":case"wordpress":return[qt,`${Bi} || true`,Xt];case"static":case"spa":return[qt,Xt]}}function bl(e,t){return e.replace(/^php\s+/,`${t} `).replace(/(\s)php\s+artisan\s+/g,`$1${t} artisan `)}function _l(e,t){let r=Ot(t);return[`cat > ${e} <<'TS_CLOUD_ENV_EOF'`,r,"TS_CLOUD_ENV_EOF",`chmod 600 ${e}`]}function ji(e,t,r){return[`cat > ${e} <<'${r}'`,t.replace(/\n$/,""),r,`chmod 600 ${e}`]}function wl(e,t){if(!t)return[];let r=[];if(t.composerAuth){let n=typeof t.composerAuth==="string"?t.composerAuth:JSON.stringify(t.composerAuth,null,2);r.push(...ji(`${e}/auth.json`,n,"TS_CLOUD_AUTHJSON_EOF"))}if(t.npmrc)r.push(...ji(`${e}/.npmrc`,t.npmrc,"TS_CLOUD_NPMRC_EOF"));return r}function Vi(e){let t=e.healthCheck?.path;if(!t||!e.domain)return[];let n=`http://127.0.0.1${t.startsWith("/")?t:`/${t}`}`;return[`echo "[ts-cloud] health check ${n} (Host: ${e.domain})"`,"TS_CLOUD_HC_OK=0",`for i in $(seq 1 10); do TS_CLOUD_HC=$(curl -s -o /dev/null -w "%{http_code}" -H "Host: ${e.domain}" -m 10 "${n}" 2>/dev/null || echo 000); case "$TS_CLOUD_HC" in 2*|3*) TS_CLOUD_HC_OK=1; break ;; esac; sleep 3; done`,'[ "$TS_CLOUD_HC_OK" = 1 ] && echo "health check passed ($TS_CLOUD_HC)" || { echo "health check FAILED (last=$TS_CLOUD_HC)" >&2; exit 1; }']}function qi(e){let{siteName:t,site:r,releaseId:n,commit:s}=e;if(!r.repository?.url)throw Error(`Site '${t}' is a PHP/git site but has no repository.url to clone`);let i=e.appBase??`/var/www/${t}`,o="php",a=Vt(i,n),c=r.sharedPaths??$o,l=[...c,...Dt(r.env,c)],u=r.keepReleases??Ii,d=r.deployScript?.length?r.deployScript:vl(r.type??"laravel"),m=["set -euo pipefail",'export HOME="${HOME:-/root}"','export COMPOSER_HOME="${COMPOSER_HOME:-/root/.composer}"',"export COMPOSER_ALLOW_SUPERUSER=1",St()];if(m.push(...Uo(i,{releaseId:n,commit:s,branch:r.repository.branch,keepLogs:u})),m.push(...Pi(a,l)),r.env&&Object.keys(r.env).length>0)m.push(..._l(`${a.shared}/.env`,r.env));for(let f of d){let h=f.trim();if(h===qt)m.push(...zi({repository:r.repository,releaseDir:a.release,commit:s})),m.push(...Mo(a,l)),m.push(`cd ${a.release}`),m.push(...wl(a.release,r.credentials)),m.push(`chown -R www-data:www-data ${a.shared}/storage 2>/dev/null || true`,`[ -d ${a.release}/bootstrap/cache ] && chown -R www-data:www-data ${a.release}/bootstrap/cache 2>/dev/null || true`,`chmod -R ug+rwX ${a.shared}/storage 2>/dev/null || true`);else if(h===Xt)m.push(...pn(a)),m.push(...mn(a,u)),m.push(`(cd ${U} && pantry restart php-fpm) 2>/dev/null || true`);else if(h===Gi)m.push(`${o} artisan queue:restart || true`);else m.push(bl(f,o))}return m}var Yt={mysql:{port:3306,binaries:["mysqld","mysql"]},mariadb:{port:3306,binaries:["mariadbd","mariadb","mysqld"]},postgres:{port:5432,binaries:["postgres","psql"]},redis:{port:6379,binaries:["redis-server","redis-cli"]},memcached:{port:11211,binaries:["memcached"]},meilisearch:{port:7700,binaries:["meilisearch"]},vitess:{port:15306,binaries:["vtgate"]}},$t="ts-cloud-service:";function Tl(e){return e===!0||typeof e==="object"&&e!=null}function so(e){if(!e)return[];return Object.keys(Yt).filter((t)=>Tl(e[t]))}function io(e){if(e.length===0)return[];return[St(),"ts_cloud_port_open() {",'  if command -v ss >/dev/null 2>&1; then ss -ltn 2>/dev/null | grep -qE "[:.]$1[[:space:]]" && return 0; fi','  if command -v netstat >/dev/null 2>&1; then netstat -ltn 2>/dev/null | grep -qE "[:.]$1[[:space:]]" && return 0; fi',"  (exec 3<>/dev/tcp/127.0.0.1/$1) 2>/dev/null && { exec 3<&- 3>&-; return 0; }","  return 1","}","ts_cloud_probe() {",'  TS_CLOUD_SVC="$1"; TS_CLOUD_PORT="$2"; shift 2','  for TS_CLOUD_BIN in "$@"; do',`    if command -v "$TS_CLOUD_BIN" >/dev/null 2>&1; then echo "${$t}$TS_CLOUD_SVC:present"; return 0; fi`,"  done",`  if ts_cloud_port_open "$TS_CLOUD_PORT"; then echo "${$t}$TS_CLOUD_SVC:present"; return 0; fi`,`  echo "${$t}$TS_CLOUD_SVC:missing"`,"  return 0","}",...e.filter((t)=>Yt[t]).map((t)=>`ts_cloud_probe ${t} ${Yt[t].port} ${Yt[t].binaries.join(" ")}`),"exit 0"]}function oo(e,t){if(!e)return[];let r=new Map;for(let n of e.split(`
 `)){let s=n.indexOf($t);if(s===-1)continue;let[i,o]=n.slice(s+$t.length).trim().split(":");if(i)r.set(i,o)}return t.filter((n)=>r.get(n)==="missing")}function ao(e,t,r){let n=r?` on ${r}`:"",s=e.map((o)=>`managedServices.${o}`).join(", "),i=e.length===1?`no ${e[0]}`:`none of ${e.join(", ")}`;return`This project declares ${s}, but '${t}' has ${i}${n}. Attach mode does not provision services on the owner's box, so nothing will install ${e.length===1?"it":"them"}. Point the app at an external service, or ask the owner of '${t}' to add ${e.length===1?"it":"them"} to their own config and re-provision.`}var co="/var/lib/pantry/php-fpm/pool.d",$l=9100,Cl=400;function Jt(e){return(e.toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/^_+|_+$/g,"")||"site").slice(0,28)}function lo(e){return`web_${Jt(e)}`}function Pl(e){let t=Jt(e),r=0;for(let n=0;n<t.length;n++)r=r*31+t.charCodeAt(n)>>>0;return $l+r%Cl}function bn(e){return`127.0.0.1:${Pl(e)}`}function xl(e){let t=Jt(e.siteName),r=lo(e.siteName),n=e.maxChildren??10;return[`; ts-cloud-managed pool for ${e.siteName} (site isolation)`,`[${t}]`,`user = ${r}`,`group = ${r}`,`listen = ${bn(e.siteName)}`,"pm = dynamic",`pm.max_children = ${n}`,"pm.start_servers = 2","pm.min_spare_servers = 1","pm.max_spare_servers = 3","pm.max_requests = 500","catch_workers_output = yes",`php_admin_value[open_basedir] = ${e.appBase}:/tmp`,""].join(`
-`)}function uo(e){let t=lo(e.siteName),r=Jt(e.siteName),n=`${co}/${r}.conf`;return[`getent group ${t} >/dev/null || groupadd --system ${t}`,`id -u ${t} >/dev/null 2>&1 || useradd --system --no-create-home --shell /usr/sbin/nologin -g ${t} ${t}`,`usermod -aG ${t} www-data 2>/dev/null || true`,`chown -R ${t}:${t} ${e.appBase} || true`,`chmod -R g+rX ${e.appBase} || true`,`chmod 600 ${e.appBase}/shared/.env 2>/dev/null || true`,`mkdir -p ${co}`,`cat > ${n} <<'TS_CLOUD_FPMPOOL_EOF'`,xl(e).replace(/\n$/,""),"TS_CLOUD_FPMPOOL_EOF",`(cd ${U} && pantry restart php-fpm) 2>/dev/null || true`]}var Zt={info:()=>{},warn:()=>{},error:()=>{},step:()=>{},success:()=>{}};function Dl(e){return`'${e.replace(/'/g,`'"'"'`)}'`}async function mo(e,t,r=Zt){let{config:n,environment:s,siteName:i,site:o,slug:a,sha:c,runtime:l,localTarballPath:u}=t,d=`releases/${i}/${c}.tar.gz`,m=T(n,s),f=await e.getComputeOutputs({config:n,environment:s}),h=await e.findComputeTargets({slug:a,environment:s,role:"app",stackName:m});if(h.length===0)return{success:!1,error:e.name==="aws"?`Stack '${m}' has no EC2 instances tagged Project=${a} Environment=${s} Role=app, and storage/cloud/state/${m}.json pins no live instance. For a shared box, record its instanceId there.`:`No Hetzner servers labeled ts-cloud/project=${a} ts-cloud/environment=${s} ts-cloud/role=app, and storage/cloud/state/${m}.json pins no live server. For a shared box, record its serverId there.`};let x=f.servicesPrivateIp?Ps(f.servicesPrivateIp,w(n)):Hc(w(n)),_=ca(ki(n,{environment:s})),y=n.infrastructure?.compute,S=Or(y?.hostCleanup),R=Z(y)?{HOST:"127.0.0.1"}:{},b=s==="production"?{APP_ENV:"production",NODE_ENV:"production"}:{},I={...x,..._,...R,...o.env||{},...b},C=Pr(I,o.sharedPaths??[]);if(C.warning)r.warn(`Site '${i}': ${C.warning}`);else if(C.path)r.info(`Site '${i}': sharing '${C.path}' so the SQLite database survives deploys.`);if(Ei(o)){let L=o.phpVersion??y?.php?.default??y?.php?.versions?.[0],M=J(a,i),D=Object.keys(x).length>0?{...o,env:I}:o,z=qi({siteName:i,site:D,releaseId:c,appBase:M,defaultPhpVersion:L}),B=!Z(y),ge=yn(o)==="custom"&&o.ssl?.certPath&&o.ssl?.keyPath?{certPath:o.ssl.certPath,keyPath:o.ssl.keyPath}:void 0,rt=o.isolation?uo({siteName:i,appBase:M}):[],er=B?sr({siteName:i,domain:o.domain||i,aliases:o.aliases,type:o.type,appDir:`${M}/current`,webDirectory:o.webDirectory,phpVersion:L,fastcgiPass:o.isolation?bn(i):void 0,redirects:o.redirects,ssl:ge,auth:o.auth&&o.auth.enabled!==!1&&o.auth.password?{username:o.auth.username||"admin",password:o.auth.password,realm:o.auth.realm}:void 0,serverSnippet:nr(o.nginx,y?.nginxTemplates),clientMaxBodySize:o.nginx?.clientMaxBodySize,hsts:o.ssl?.hsts,tlsProtocols:o.ssl?.tlsProtocols,security:o.security}):[],nt=B?vn(o):[],Eo=Sn(o)?hn({slug:a,siteName:i,site:o,phpVersion:L,appBase:M}):[],Do=B?Vi(o):[];r.step(`Deploying PHP site '${i}' to ${h.length} target(s)...`);let Ce=await e.runRemoteDeploy({targets:h,commands:[...Zs(M,a),...z,...rt,...er,...nt,...Eo,...Do,...S],comment:`ts-cloud deploy ${a}/${i}@${c}`,tags:{Project:a,Environment:s,Role:"app"}}),xn=In(n.notifications,o.notifications);if(!Ce.success)return await po(e,h,S,r),await or(xn,"deploy-failed",`❌ Deploy of ${a}/${i}@${c} failed: ${Ce.error||"unknown error"}`),{success:!1,error:Ce.error||"Remote PHP deploy failed",instanceCount:Ce.instanceCount,perInstance:Ce.perInstance};let Io=o.domain?` → https://${o.domain}`:"";return await or(xn,"deploy",`✅ Deployed ${a}/${i}@${c}${Io}`),{success:!0,instanceCount:Ce.instanceCount,perInstance:Ce.perInstance}}if(!u)return{success:!1,error:`Site '${i}' requires a release tarball but none was provided`};let E=await e.uploadRelease({config:n,environment:s,localPath:u,remoteKey:d,targets:h}),H=mt(a,i,c),re=e.name==="aws"?kr(f.deployBucketName,d,n.project.region||"us-east-1",H):Mr(E.artifactRef,H),W=P(o),N=J(a,i),q=W==="server-static"?Ur({siteName:i,slug:a,appDir:N,artifactFetch:re,releaseId:c,preStartCommands:o.preStart}):Nr({siteName:i,slug:a,appDir:N,artifactFetch:re,releaseId:c,execStart:Hr(o.start,l,`${N.replace(/\/+$/,"")}/releases/%i`),envEntries:I,port:o.port,preStartCommands:o.preStart,sharedPaths:o.sharedPaths,zeroDowntime:o.zeroDowntime!==!1,healthCheckPath:o.healthCheck?.path,liveness:o.liveness,memoryHigh:o.memoryHigh,memoryMax:o.memoryMax,cpuWeight:o.cpuWeight,ioWeight:o.ioWeight,tasksMax:o.tasksMax,stopTimeout:o.stopTimeout}),k=W==="server-static"&&!Z(y)&&!!o.domain,X=k?sr({siteName:i,domain:o.domain,aliases:o.aliases,type:o.type==="spa"?"spa":"static",appDir:`${N}/current`,webDirectory:"",redirects:o.redirects,auth:o.auth&&o.auth.enabled!==!1&&o.auth.password?{username:o.auth.username||"admin",password:o.auth.password,realm:o.auth.realm}:void 0,serverSnippet:nr(o.nginx,y?.nginxTemplates),clientMaxBodySize:o.nginx?.clientMaxBodySize,hsts:o.ssl?.hsts,tlsProtocols:o.ssl?.tlsProtocols,security:o.security}):[],oe=k?vn(o):[],fe=Sn(o)?hn({slug:a,siteName:i,site:o,appBase:N}):[],$e=[...Uo(N,{releaseId:c,commit:c,branch:o.repository?.branch??"main"}),...Zs(N,a),...q,...X,...oe,...fe,...S];r.step(`Deploying to ${h.length} target(s)...`);let ne=await e.runRemoteDeploy({targets:h,commands:$e,comment:`ts-cloud deploy ${a}/${i}@${c}`,tags:{Project:a,Environment:s,Role:"app"}});if(!ne.success)return await po(e,h,S,r),{success:!1,error:ne.error||"Remote deploy failed",instanceCount:ne.instanceCount,perInstance:ne.perInstance};return{success:!0,instanceCount:ne.instanceCount,perInstance:ne.perInstance}}async function po(e,t,r,n){if(r.length===0)return;try{let s=await e.runRemoteDeploy({targets:t,commands:r,comment:"ts-cloud host cleanup after failed deploy"});if(!s.success)n.warn(`Host cleanup after the failed deploy did not complete: ${s.error||"unknown error"}`)}catch(s){n.warn(`Host cleanup after the failed deploy did not run: ${s.message}`)}}function Qt(e){return`'${e.replaceAll("'","'\\''")}'`}function Il(e,t,r=!1,n=[]){let s=`${e}-dashboard-`,i=t.map((a)=>`${e}-${a}.service`),o=r?[`export TS_CLOUD_DASHBOARD_KEEP_DOMAINS=${Qt(JSON.stringify(n))}`,"rm -f /run/ts-cloud-dashboard-routes-changed",`/usr/local/bin/bun --bun -e ${Qt(`
+`)}function uo(e){let t=lo(e.siteName),r=Jt(e.siteName),n=`${co}/${r}.conf`;return[`getent group ${t} >/dev/null || groupadd --system ${t}`,`id -u ${t} >/dev/null 2>&1 || useradd --system --no-create-home --shell /usr/sbin/nologin -g ${t} ${t}`,`usermod -aG ${t} www-data 2>/dev/null || true`,`chown -R ${t}:${t} ${e.appBase} || true`,`chmod -R g+rX ${e.appBase} || true`,`chmod 600 ${e.appBase}/shared/.env 2>/dev/null || true`,`mkdir -p ${co}`,`cat > ${n} <<'TS_CLOUD_FPMPOOL_EOF'`,xl(e).replace(/\n$/,""),"TS_CLOUD_FPMPOOL_EOF",`(cd ${U} && pantry restart php-fpm) 2>/dev/null || true`]}var Zt={info:()=>{},warn:()=>{},error:()=>{},step:()=>{},success:()=>{}};function Dl(e){return`'${e.replace(/'/g,`'"'"'`)}'`}async function mo(e,t,r=Zt){let{config:n,environment:s,siteName:i,site:o,slug:a,sha:c,runtime:l,localTarballPath:u}=t,d=`releases/${i}/${c}.tar.gz`,m=T(n,s),f=await e.getComputeOutputs({config:n,environment:s}),h=await e.findComputeTargets({slug:a,environment:s,role:"app",stackName:m});if(h.length===0)return{success:!1,error:e.name==="aws"?`Stack '${m}' has no EC2 instances tagged Project=${a} Environment=${s} Role=app, and storage/cloud/state/${m}.json pins no live instance. For a shared box, record its instanceId there.`:`No Hetzner servers labeled ts-cloud/project=${a} ts-cloud/environment=${s} ts-cloud/role=app, and storage/cloud/state/${m}.json pins no live server. For a shared box, record its serverId there.`};let x=f.servicesPrivateIp?Ps(f.servicesPrivateIp,w(n)):Hc(w(n)),_=ca(ki(n,{environment:s})),y=n.infrastructure?.compute,S=Or(y?.hostCleanup),R=Z(y)?{HOST:"127.0.0.1"}:{},b=s==="production"?{APP_ENV:"production",NODE_ENV:"production"}:{},I={...x,..._,...R,...o.env||{},...b},C=Pr(I,o.sharedPaths??[]);if(C.warning)r.warn(`Site '${i}': ${C.warning}`);else if(C.path)r.info(`Site '${i}': sharing '${C.path}' so the SQLite database survives deploys.`);if(Ei(o)){let L=o.phpVersion??y?.php?.default??y?.php?.versions?.[0],M=J(a,i),D=Object.keys(x).length>0?{...o,env:I}:o,F=qi({siteName:i,site:D,releaseId:c,appBase:M,defaultPhpVersion:L}),z=!Z(y),ge=yn(o)==="custom"&&o.ssl?.certPath&&o.ssl?.keyPath?{certPath:o.ssl.certPath,keyPath:o.ssl.keyPath}:void 0,rt=o.isolation?uo({siteName:i,appBase:M}):[],er=z?sr({siteName:i,domain:o.domain||i,aliases:o.aliases,type:o.type,appDir:`${M}/current`,webDirectory:o.webDirectory,phpVersion:L,fastcgiPass:o.isolation?bn(i):void 0,redirects:o.redirects,ssl:ge,auth:o.auth&&o.auth.enabled!==!1&&o.auth.password?{username:o.auth.username||"admin",password:o.auth.password,realm:o.auth.realm}:void 0,serverSnippet:nr(o.nginx,y?.nginxTemplates),clientMaxBodySize:o.nginx?.clientMaxBodySize,hsts:o.ssl?.hsts,tlsProtocols:o.ssl?.tlsProtocols,security:o.security}):[],nt=z?vn(o):[],Eo=Sn(o)?hn({slug:a,siteName:i,site:o,phpVersion:L,appBase:M}):[],Do=z?Vi(o):[];r.step(`Deploying PHP site '${i}' to ${h.length} target(s)...`);let Ce=await e.runRemoteDeploy({targets:h,commands:[...Zs(M,a),...F,...rt,...er,...nt,...Eo,...Do,...S],comment:`ts-cloud deploy ${a}/${i}@${c}`,tags:{Project:a,Environment:s,Role:"app"}}),xn=In(n.notifications,o.notifications);if(!Ce.success)return await po(e,h,S,r),await or(xn,"deploy-failed",`❌ Deploy of ${a}/${i}@${c} failed: ${Ce.error||"unknown error"}`),{success:!1,error:Ce.error||"Remote PHP deploy failed",instanceCount:Ce.instanceCount,perInstance:Ce.perInstance};let Io=o.domain?` → https://${o.domain}`:"";return await or(xn,"deploy",`✅ Deployed ${a}/${i}@${c}${Io}`),{success:!0,instanceCount:Ce.instanceCount,perInstance:Ce.perInstance}}if(!u)return{success:!1,error:`Site '${i}' requires a release tarball but none was provided`};let E=await e.uploadRelease({config:n,environment:s,localPath:u,remoteKey:d,targets:h}),H=mt(a,i,c),re=e.name==="aws"?kr(f.deployBucketName,d,n.project.region||"us-east-1",H):Mr(E.artifactRef,H),W=P(o),N=J(a,i),q=W==="server-static"?Ur({siteName:i,slug:a,appDir:N,artifactFetch:re,releaseId:c,preStartCommands:o.preStart}):Nr({siteName:i,slug:a,appDir:N,artifactFetch:re,releaseId:c,execStart:Hr(o.start,l,`${N.replace(/\/+$/,"")}/releases/%i`),envEntries:I,port:o.port,preStartCommands:o.preStart,sharedPaths:o.sharedPaths,zeroDowntime:o.zeroDowntime!==!1,healthCheckPath:o.healthCheck?.path,liveness:o.liveness,memoryHigh:o.memoryHigh,memoryMax:o.memoryMax,cpuWeight:o.cpuWeight,ioWeight:o.ioWeight,tasksMax:o.tasksMax,stopTimeout:o.stopTimeout}),k=W==="server-static"&&!Z(y)&&!!o.domain,X=k?sr({siteName:i,domain:o.domain,aliases:o.aliases,type:o.type==="spa"?"spa":"static",appDir:`${N}/current`,webDirectory:"",redirects:o.redirects,auth:o.auth&&o.auth.enabled!==!1&&o.auth.password?{username:o.auth.username||"admin",password:o.auth.password,realm:o.auth.realm}:void 0,serverSnippet:nr(o.nginx,y?.nginxTemplates),clientMaxBodySize:o.nginx?.clientMaxBodySize,hsts:o.ssl?.hsts,tlsProtocols:o.ssl?.tlsProtocols,security:o.security}):[],oe=k?vn(o):[],fe=Sn(o)?hn({slug:a,siteName:i,site:o,appBase:N}):[],$e=[...Uo(N,{releaseId:c,commit:c,branch:o.repository?.branch??"main"}),...Zs(N,a),...q,...X,...oe,...fe,...S];r.step(`Deploying to ${h.length} target(s)...`);let ne=await e.runRemoteDeploy({targets:h,commands:$e,comment:`ts-cloud deploy ${a}/${i}@${c}`,tags:{Project:a,Environment:s,Role:"app"}});if(!ne.success)return await po(e,h,S,r),{success:!1,error:ne.error||"Remote deploy failed",instanceCount:ne.instanceCount,perInstance:ne.perInstance};return{success:!0,instanceCount:ne.instanceCount,perInstance:ne.perInstance}}async function po(e,t,r,n){if(r.length===0)return;try{let s=await e.runRemoteDeploy({targets:t,commands:r,comment:"ts-cloud host cleanup after failed deploy"});if(!s.success)n.warn(`Host cleanup after the failed deploy did not complete: ${s.error||"unknown error"}`)}catch(s){n.warn(`Host cleanup after the failed deploy did not run: ${s.message}`)}}function Qt(e){return`'${e.replaceAll("'","'\\''")}'`}function Il(e,t,r=!1,n=[]){let s=`${e}-dashboard-`,i=t.map((a)=>`${e}-${a}.service`),o=r?[`export TS_CLOUD_DASHBOARD_KEEP_DOMAINS=${Qt(JSON.stringify(n))}`,"rm -f /run/ts-cloud-dashboard-routes-changed",`/usr/local/bin/bun --bun -e ${Qt(`
           const { chmodSync, existsSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync } = require('node:fs')
           const { basename, join } = require('node:path')
           const root = '/etc/rpx/sites.d'

package/dist/bin/chunk-5f1n5d80.js

@@ -0,0 +1 @@
+import{me}from"./chunk-z8k9mcn5.js";import"./chunk-psvqpztv.js";export{me as RDSClient};

package/dist/bin/{chunk-s64d5nw2.js → chunk-5mm6qn6m.js}

@@ -1 +1 @@
-import{qd,Ar,E}from"./chunk-gn03w47w.js";import"./chunk-dkf2kcsc.js";export{E as CloudFrontClient,qd as configOrigins,Ar as s3OriginBucket};
+import{qd,Ar,E}from"./chunk-01w4zbex.js";import"./chunk-psvqpztv.js";export{E as CloudFrontClient,qd as configOrigins,Ar as s3OriginBucket};

package/dist/bin/chunk-5xr76cms.js

@@ -0,0 +1 @@
+import{Q}from"./chunk-q8b77zgw.js";import"./chunk-psvqpztv.js";export{Q as EC2Client};

package/dist/bin/{chunk-q40k9jvk.js → chunk-65yvjecx.js}

@@ -1,2 +1,2 @@
-import{createRequire as g}from"node:module";var d=Object.defineProperty;var e=(a)=>a;function f(a,b){this[a]=e.bind(null,b)}var Xt=(a,b)=>{for(var c in b)d(a,c,{get:b[c],enumerable:!0,configurable:!0,set:f.bind(b,c)})};var Br=g(import.meta.url);
-export{Xt,Br};
+import{createRequire as g}from"node:module";var d=Object.defineProperty;var e=(a)=>a;function f(a,b){this[a]=e.bind(null,b)}var Xt=(a,b)=>{for(var c in b)d(a,c,{get:b[c],enumerable:!0,configurable:!0,set:f.bind(b,c)})};var Fr=g(import.meta.url);
+export{Xt,Fr};

package/dist/bin/{chunk-5amvqed8.js → chunk-6y6g726g.js}

@@ -1,6 +1,6 @@
-import{Xt}from"./chunk-q40k9jvk.js";var f={};Xt(f,{ProgressBar:()=>v,Spinner:()=>s,box:()=>Ce,checkAwsCli:()=>Ms,checkAwsCredentials:()=>Us,colorize:()=>jt,colors:()=>C,confirm:()=>u,error:()=>r,formatBytes:()=>dn,formatDuration:()=>b,getAwsAccountId:()=>Bs,getAwsRegions:()=>Fs,header:()=>i,info:()=>e,prompt:()=>R,select:()=>Do,step:()=>d,success:()=>n,table:()=>c,warn:()=>a,warning:()=>Rr});var C={reset:"\x1B[0m",bright:"\x1B[1m",dim:"\x1B[2m",red:"\x1B[31m",green:"\x1B[32m",yellow:"\x1B[33m",blue:"\x1B[34m",magenta:"\x1B[35m",cyan:"\x1B[36m",white:"\x1B[37m",gray:"\x1B[90m"};function jt(t,o){return`${C[o]}${t}${C.reset}`}function n(t){console.log(`${C.green}✓${C.reset} ${t}`)}function r(t){console.error(`${C.red}✗${C.reset} ${t}`)}function a(t){console.warn(`${C.yellow}⚠${C.reset} ${t}`)}var Rr=a;function e(t){console.log(`${C.blue}ℹ${C.reset} ${t}`)}function d(t){console.log(`${C.cyan}→${C.reset} ${t}`)}function i(t){console.log(`
+import{Xt}from"./chunk-65yvjecx.js";var f={};Xt(f,{ProgressBar:()=>v,Spinner:()=>s,box:()=>Ce,checkAwsCli:()=>Ms,checkAwsCredentials:()=>Us,colorize:()=>jt,colors:()=>C,confirm:()=>u,error:()=>r,formatBytes:()=>dn,formatDuration:()=>b,getAwsAccountId:()=>Fs,getAwsRegions:()=>Bs,header:()=>i,info:()=>e,prompt:()=>R,select:()=>Do,step:()=>d,success:()=>n,table:()=>c,warn:()=>a,warning:()=>Rr});var C={reset:"\x1B[0m",bright:"\x1B[1m",dim:"\x1B[2m",red:"\x1B[31m",green:"\x1B[32m",yellow:"\x1B[33m",blue:"\x1B[34m",magenta:"\x1B[35m",cyan:"\x1B[36m",white:"\x1B[37m",gray:"\x1B[90m"};function jt(t,o){return`${C[o]}${t}${C.reset}`}function n(t){console.log(`${C.green}✓${C.reset} ${t}`)}function r(t){console.error(`${C.red}✗${C.reset} ${t}`)}function a(t){console.warn(`${C.yellow}⚠${C.reset} ${t}`)}var Rr=a;function e(t){console.log(`${C.blue}ℹ${C.reset} ${t}`)}function d(t){console.log(`${C.cyan}→${C.reset} ${t}`)}function i(t){console.log(`
 ${C.bright}${C.cyan}${t}${C.reset}
 `)}var x=!!(process.env.CI||process.env.GITHUB_ACTIONS||process.env.BUILDKITE||process.env.CIRCLECI||process.env.GITLAB_CI);class s{frames=["⠋","⠙","⠹","⠸","⠼","⠴","⠦","⠧","⠇","⠏"];interval=null;currentFrame=0;message;constructor(t){this.message=t}get text(){return this.message}set text(t){if(this.message=t,x&&this.interval)console.log(`  ${t}`)}start(){if(x){console.log(`  ${this.message}`),this.interval=!0;return}this.interval=setInterval(()=>{process.stdout.write(`\r${C.cyan}${this.frames[this.currentFrame]}${C.reset} ${this.message}`),this.currentFrame=(this.currentFrame+1)%this.frames.length},80)}succeed(t){this.stop(),n(t||this.message)}fail(t){this.stop(),r(t||this.message)}warn(t){this.stop(),Rr(t||this.message)}stop(){if(this.interval){if(!x)process.stdout.write("\r");if(typeof this.interval==="object")clearInterval(this.interval);this.interval=null}}}class v{total;current=0;width=40;constructor(t){this.total=t}update(t){this.current=t,this.render()}increment(){this.current++,this.render()}render(){let t=Math.floor(this.current/this.total*100),o=Math.floor(this.current/this.total*this.width),l=this.width-o,g=`${"█".repeat(o)}${"░".repeat(l)}`;if(process.stdout.write(`\r${C.cyan}${g}${C.reset} ${t}% (${this.current}/${this.total})`),this.current>=this.total)process.stdout.write(`
 `)}}async function R(t,o){let l=await import("node:readline"),g=l.createInterface({input:process.stdin,output:process.stdout});return new Promise((p)=>{let h=o?`${C.cyan}?${C.reset} ${t} ${C.gray}(${o})${C.reset}: `:`${C.cyan}?${C.reset} ${t}: `;g.question(h,(m)=>{g.close(),p(m||o||"")})})}async function u(t,o=!1){let l=await R(`${t} (y/n)`,o?"y":"n");return l.toLowerCase()==="y"||l.toLowerCase()==="yes"}async function Do(t,o){console.log(`${C.cyan}?${C.reset} ${t}`),o.forEach((p,h)=>{console.log(`  ${C.gray}${h+1}.${C.reset} ${p}`)});let l=await R("Select","1"),g=Number.parseInt(l)-1;if(g>=0&&g<o.length)return o[g];return o[0]}function c(t,o){let l=t.map((p,h)=>{let m=Math.max(...o.map((w)=>(w[h]||"").length));return Math.max(p.length,m)}),g=t.map((p,h)=>p.padEnd(l[h])).join("  ");console.log(jt(g,"bright")),console.log(jt("─".repeat(g.length),"gray")),o.forEach((p)=>{let h=p.map((m,w)=>(m||"").padEnd(l[w])).join("  ");console.log(h)})}function dn(t){if(t===0)return"0 B";let o=1024,l=["B","KB","MB","GB","TB"],g=Math.floor(Math.log(t)/Math.log(o));return`${Number.parseFloat((t/o**g).toFixed(2))} ${l[g]}`}function b(t){if(t<1000)return`${t}ms`;let o=Math.floor(t/1000);if(o<60)return`${o}s`;let l=Math.floor(o/60),g=o%60;if(l<60)return`${l}m ${g}s`;let p=Math.floor(l/60),h=l%60;return`${p}h ${h}m`}function Ce(t,o="cyan"){let l=t.split(`
-`),g=Math.max(...l.map((h)=>h.length)),p="─".repeat(g+2);console.log(jt(`┌${p}┐`,o)),l.forEach((h)=>{console.log(jt(`│ ${h.padEnd(g)} │`,o))}),console.log(jt(`└${p}┘`,o))}async function Ms(){return!0}async function Us(){try{let{AWSClient:t}=await import("./chunk-bb08ms5q.js");return await new t().request({service:"sts",region:"us-east-1",method:"POST",path:"/",body:new URLSearchParams({Action:"GetCallerIdentity",Version:"2011-06-15"}).toString()}),!0}catch{return!1}}async function Bs(){try{let{AWSClient:t}=await import("./chunk-bb08ms5q.js"),l=await new t().request({service:"sts",region:"us-east-1",method:"POST",path:"/",body:new URLSearchParams({Action:"GetCallerIdentity",Version:"2011-06-15"}).toString()});return l.Account||l.GetCallerIdentityResult?.Account||null}catch{return null}}async function Fs(){try{let{AWSClient:t}=await import("./chunk-bb08ms5q.js"),l=await new t().request({service:"ec2",region:"us-east-1",method:"POST",path:"/",body:new URLSearchParams({Action:"DescribeRegions",Version:"2016-11-15"}).toString()}),g=[];if(l.regionInfo){let p=Array.isArray(l.regionInfo)?l.regionInfo:[l.regionInfo];g.push(...p.map((h)=>h.regionName))}return g.length>0?g:y()}catch{return y()}}function y(){return["us-east-1","us-east-2","us-west-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1","ap-northeast-1"]}
-export{C,jt,n,r,a,Rr,e,d,i,s,R,u,Do,c,dn,Ce,Ms,Us,Bs,Fs,f};
+`),g=Math.max(...l.map((h)=>h.length)),p="─".repeat(g+2);console.log(jt(`┌${p}┐`,o)),l.forEach((h)=>{console.log(jt(`│ ${h.padEnd(g)} │`,o))}),console.log(jt(`└${p}┘`,o))}async function Ms(){return!0}async function Us(){try{let{AWSClient:t}=await import("./chunk-4nn00brw.js");return await new t().request({service:"sts",region:"us-east-1",method:"POST",path:"/",body:new URLSearchParams({Action:"GetCallerIdentity",Version:"2011-06-15"}).toString()}),!0}catch{return!1}}async function Fs(){try{let{AWSClient:t}=await import("./chunk-4nn00brw.js"),l=await new t().request({service:"sts",region:"us-east-1",method:"POST",path:"/",body:new URLSearchParams({Action:"GetCallerIdentity",Version:"2011-06-15"}).toString()});return l.Account||l.GetCallerIdentityResult?.Account||null}catch{return null}}async function Bs(){try{let{AWSClient:t}=await import("./chunk-4nn00brw.js"),l=await new t().request({service:"ec2",region:"us-east-1",method:"POST",path:"/",body:new URLSearchParams({Action:"DescribeRegions",Version:"2016-11-15"}).toString()}),g=[];if(l.regionInfo){let p=Array.isArray(l.regionInfo)?l.regionInfo:[l.regionInfo];g.push(...p.map((h)=>h.regionName))}return g.length>0?g:y()}catch{return y()}}function y(){return["us-east-1","us-east-2","us-west-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1","ap-northeast-1"]}
+export{C,jt,n,r,a,Rr,e,d,i,s,R,u,Do,c,dn,Ce,Ms,Us,Fs,Bs,f};

package/dist/bin/{chunk-f64jvh96.js → chunk-7qbxq0be.js}

@@ -1,4 +1,4 @@
-import{p}from"./chunk-dkf2kcsc.js";class B{client;region;constructor(e="us-east-1"){this.region=e,this.client=new p}async createHostedZone(e){let t=e.CallerReference||`${Date.now()}-${Math.random().toString(36).slice(2)}`,o=`<?xml version="1.0" encoding="UTF-8"?>
+import{p}from"./chunk-psvqpztv.js";class F{client;region;constructor(e="us-east-1"){this.region=e,this.client=new p}async createHostedZone(e){let t=e.CallerReference||`${Date.now()}-${Math.random().toString(36).slice(2)}`,o=`<?xml version="1.0" encoding="UTF-8"?>
 <CreateHostedZoneRequest xmlns="https://route53.amazonaws.com/doc/2013-04-01/">
   <Name>${e.Name}</Name>
   <CallerReference>${t}</CallerReference>`;if(e.HostedZoneConfig){if(o+=`
@@ -47,4 +47,4 @@ import{p}from"./chunk-dkf2kcsc.js";class B{client;region;constructor(e="us-east-
     </Changes>
   </ChangeBatch>
 </ChangeResourceRecordSetsRequest>`;let n=await this.client.request({service:"route53",region:this.region,method:"POST",path:`/2013-04-01/hostedzone/${t}/rrset`,headers:{"content-type":"application/xml"},body:o});return this.parseChangeResourceRecordSetsResponse(n)}escapeXml(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&apos;")}parseCreateHostedZoneResponse(e){let t=e.CreateHostedZoneResponse||e;return{HostedZone:this.parseHostedZone(t.HostedZone),ChangeInfo:{Id:t.ChangeInfo?.Id||"",Status:t.ChangeInfo?.Status||"",SubmittedAt:t.ChangeInfo?.SubmittedAt||""},DelegationSet:this.parseDelegationSet(t.DelegationSet),Location:t.Location||""}}parseListHostedZonesResponse(e){let t=e.ListHostedZonesResponse||e.ListHostedZonesByNameResponse||e,o=t.HostedZones?.HostedZone||t.HostedZones||[];if(!Array.isArray(o))o=o?[o]:[];return{HostedZones:o.map((n)=>this.parseHostedZone(n)),IsTruncated:t.IsTruncated==="true"||t.IsTruncated===!0,MaxItems:t.MaxItems||"100",Marker:t.Marker,NextMarker:t.NextMarker}}parseGetHostedZoneResponse(e){let t=e.GetHostedZoneResponse||e;return{HostedZone:this.parseHostedZone(t.HostedZone),DelegationSet:this.parseDelegationSet(t.DelegationSet),VPCs:t.VPCs?.VPC?Array.isArray(t.VPCs.VPC)?t.VPCs.VPC:[t.VPCs.VPC]:void 0}}parseListResourceRecordSetsResponse(e){let t=e.ListResourceRecordSetsResponse||e,o=t.ResourceRecordSets?.ResourceRecordSet||t.ResourceRecordSets||[];if(!Array.isArray(o))o=o?[o]:[];return{ResourceRecordSets:o.map((n)=>this.parseResourceRecordSet(n)),IsTruncated:t.IsTruncated==="true"||t.IsTruncated===!0,MaxItems:t.MaxItems||"100",NextRecordName:t.NextRecordName,NextRecordType:t.NextRecordType,NextRecordIdentifier:t.NextRecordIdentifier}}parseChangeResourceRecordSetsResponse(e){let t=e.ChangeResourceRecordSetsResponse||e;return{ChangeInfo:{Id:t.ChangeInfo?.Id||"",Status:t.ChangeInfo?.Status||"",SubmittedAt:t.ChangeInfo?.SubmittedAt||"",Comment:t.ChangeInfo?.Comment}}}parseHostedZone(e){if(!e)return{Id:"",Name:""};return{Id:e.Id||"",Name:e.Name||"",CallerReference:e.CallerReference,Config:e.Config?{Comment:e.Config.Comment,PrivateZone:e.Config.PrivateZone==="true"||e.Config.PrivateZone===!0}:void 0,ResourceRecordSetCount:e.ResourceRecordSetCount?Number(e.ResourceRecordSetCount):void 0}}parseDelegationSet(e){if(!e)return{NameServers:[]};let t=e.NameServers?.NameServer||e.NameServers||[];if(!Array.isArray(t))t=t?[t]:[];return{Id:e.Id,CallerReference:e.CallerReference,NameServers:t}}parseResourceRecordSet(e){if(!e)return{Name:"",Type:""};let t=e.ResourceRecords?.ResourceRecord||e.ResourceRecords||[];if(!Array.isArray(t))t=t?[t]:[];return{Name:e.Name||"",Type:e.Type||"",TTL:e.TTL?Number(e.TTL):void 0,ResourceRecords:t.map((o)=>({Value:o.Value||o})),AliasTarget:e.AliasTarget?{HostedZoneId:e.AliasTarget.HostedZoneId,DNSName:e.AliasTarget.DNSName,EvaluateTargetHealth:e.AliasTarget.EvaluateTargetHealth==="true"||e.AliasTarget.EvaluateTargetHealth===!0}:void 0,SetIdentifier:e.SetIdentifier,Weight:e.Weight?Number(e.Weight):void 0,Region:e.Region,GeoLocation:e.GeoLocation,Failover:e.Failover,HealthCheckId:e.HealthCheckId}}async findHostedZoneByName(e){let t=e.endsWith(".")?e:`${e}.`;return(await this.listHostedZonesByName({DNSName:t})).HostedZones.find((s)=>s.Name===t)||null}async createARecord(e){let t=Array.isArray(e.Value)?e.Value:[e.Value];return this.changeResourceRecordSets({HostedZoneId:e.HostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:e.Name,Type:"A",TTL:e.TTL||300,ResourceRecords:t.map((o)=>({Value:o}))}}]}})}async createCnameRecord(e){return this.changeResourceRecordSets({HostedZoneId:e.HostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:e.Name,Type:"CNAME",TTL:e.TTL||300,ResourceRecords:[{Value:e.Value}]}}]}})}async createAliasRecord(e){return this.changeResourceRecordSets({HostedZoneId:e.HostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:e.Name,Type:e.Type||"A",AliasTarget:{HostedZoneId:e.TargetHostedZoneId,DNSName:e.TargetDNSName,EvaluateTargetHealth:e.EvaluateTargetHealth??!1}}}]}})}async createTxtRecord(e){let o=(Array.isArray(e.Value)?e.Value:[e.Value]).map((n)=>{if(!n.startsWith('"'))return`"${n}"`;return n});return this.changeResourceRecordSets({HostedZoneId:e.HostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:e.Name,Type:"TXT",TTL:e.TTL||300,ResourceRecords:o.map((n)=>({Value:n}))}}]}})}async createMxRecord(e){return this.changeResourceRecordSets({HostedZoneId:e.HostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:e.Name,Type:"MX",TTL:e.TTL||300,ResourceRecords:e.Values.map((t)=>({Value:`${t.priority} ${t.mailServer}`}))}}]}})}async deleteRecord(e){return this.changeResourceRecordSets({HostedZoneId:e.HostedZoneId,ChangeBatch:{Changes:[{Action:"DELETE",ResourceRecordSet:e.RecordSet}]}})}async waitForChange(e,t=60,o=5000){let n=e.replace("/change/","");for(let s=0;s<t;s++){let r=await this.client.request({service:"route53",region:this.region,method:"GET",path:`/2013-04-01/change/${n}`});if((r.GetChangeResponse?.ChangeInfo?.Status||r.ChangeInfo?.Status)==="INSYNC")return!0;await new Promise((a)=>setTimeout(a,o))}return!1}async findOrCreateHostedZone(e){let t=e.domainName.endsWith(".")?e.domainName:`${e.domainName}.`,o=await this.findHostedZoneByName(t);if(o){let s=await this.getHostedZone({Id:o.Id});return{hostedZone:o,nameServers:s.DelegationSet.NameServers,isNew:!1}}let n=await this.createHostedZone({Name:t,HostedZoneConfig:{Comment:e.comment||`Hosted zone for ${e.domainName}`,PrivateZone:e.privateZone},VPC:e.vpc});return{hostedZone:n.HostedZone,nameServers:n.DelegationSet.NameServers,isNew:!0}}static getRootDomain(e){let t=e.replace(/\.$/,"").split(".");if(t.length<=2)return e;return t.slice(-2).join(".")}async findHostedZoneForDomain(e){let o=e.replace(/\.$/,"").split(".");for(let n=0;n<o.length-1;n++){let s=o.slice(n).join("."),r=await this.findHostedZoneByName(s);if(r)return r}return null}async ensureHostedZone(e){let t=await this.findOrCreateHostedZone({domainName:e.domainName,comment:e.comment});return{hostedZoneId:t.hostedZone.Id.replace("/hostedzone/",""),nameServers:t.nameServers,isNew:t.isNew,action:t.isNew?"created":"found"}}async setupDomainDns(e){let{domain:t,createIfNotExists:o=!0}=e,n=await this.findHostedZoneByName(t);if(n){let r=await this.getHostedZone({Id:n.Id});return{success:!0,hostedZoneId:n.Id.replace("/hostedzone/",""),nameServers:r.DelegationSet.NameServers,isNew:!1,message:`Found existing hosted zone for ${t}`}}if(!o)return{success:!1,hostedZoneId:null,nameServers:[],isNew:!1,message:`No hosted zone found for ${t} and createIfNotExists is false`};let s=await this.createHostedZone({Name:t,HostedZoneConfig:{Comment:`Created automatically by ts-cloud for ${t}`}});return{success:!0,hostedZoneId:s.HostedZone.Id.replace("/hostedzone/",""),nameServers:s.DelegationSet.NameServers,isNew:!0,message:`Created new hosted zone for ${t}. Please update your domain registrar with these name servers: ${s.DelegationSet.NameServers.join(", ")}`}}static CloudFrontHostedZoneId="Z2FDTNDATAQYW2";static S3WebsiteHostedZoneIds={"us-east-1":"Z3AQBSTGFYJSTF","us-east-2":"Z2O1EMRO9K5GLX","us-west-1":"Z2F56UZL2M1ACD","us-west-2":"Z3BJ6K6RIION7M","ap-east-1":"ZNB98KWMFR0R6","ap-south-1":"Z11RGJOFQNVJUP","ap-northeast-1":"Z2M4EHUR26P7ZW","ap-northeast-2":"Z3W03O7B5YMIYP","ap-northeast-3":"Z2YQB5RD63NC85","ap-southeast-1":"Z3O0J2DXBE1FTB","ap-southeast-2":"Z1WCIGYICN2BYD","ca-central-1":"Z1QDHH18159H29","eu-central-1":"Z21DNDUVLTQW6Q","eu-west-1":"Z1BKCTXD74EZPE","eu-west-2":"Z3GKZC51ZF0DB4","eu-west-3":"Z3R1K369G5AVDG","eu-north-1":"Z3BAZG2TWCNX0D","sa-east-1":"Z7KQH4QJS55SO"};static ALBHostedZoneIds={"us-east-1":"Z35SXDOTRQ7X7K","us-east-2":"Z3AADJGX6KTTL2","us-west-1":"Z368ELLRRE2KJ0","us-west-2":"Z1H1FL5HABSF5","ap-east-1":"Z3DQVH9N71FHZ0","ap-south-1":"ZP97RAFLXTNZK","ap-northeast-1":"Z14GRHDCWA56QT","ap-northeast-2":"ZWKZPGTI48KDX","ap-northeast-3":"Z5LXEBD8Y73MNV","ap-southeast-1":"Z1LMS91P8CMLE5","ap-southeast-2":"Z1GM3OXH4ZPM65","ca-central-1":"ZQSVJUPU6J1EY","eu-central-1":"Z215JYRZR1TBD5","eu-west-1":"Z32O12XQLNTSW2","eu-west-2":"ZHURV8PSTC4K8","eu-west-3":"Z3Q77PNBQS71R4","eu-north-1":"Z23TAZ6LKFMNIO","sa-east-1":"Z2P70J7HTTTPLU"};static APIGatewayHostedZoneIds={"us-east-1":"Z1UJRXOUMOOFQ8","us-east-2":"ZOJJZC49E0EPZ","us-west-1":"Z2MUQ32089INYE","us-west-2":"Z2OJLYMUO9EFXC","ap-east-1":"Z3FD1VL90ND7K5","ap-south-1":"Z3VO1THU9YC4UR","ap-northeast-1":"Z1YSHQZHG15GKL","ap-northeast-2":"Z20JF4UZKIW1U8","ap-northeast-3":"Z2YQB5RD63NC85","ap-southeast-1":"ZL327KTPIQFUL","ap-southeast-2":"Z2RPCDW04V8134","ca-central-1":"Z19DQILCV0OWEC","eu-central-1":"Z1U9ULNL0V5AJ3","eu-west-1":"ZLY8HYME6SFDD","eu-west-2":"ZJ5UAJN8Y3Z2Q","eu-west-3":"Z3KY65QIEKYHQQ","eu-north-1":"Z3UWIKFBOOGXPP","sa-east-1":"ZCMLWB8V5SYIT"}}
-export{B};
+export{F};

package/dist/bin/{chunk-8z4wgqkh.js → chunk-cz2wq0tf.js}

@@ -1,4 +1,4 @@
-import{h}from"./chunk-pnj95hwr.js";var y=(e)=>e==null?void 0:String(e),w=(e)=>Number(e)===1,C=(e,r)=>{try{return e==null?r:JSON.parse(String(e))}catch{return r}};function b(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),scope:{type:String(e.scope_type),id:String(e.scope_id),environmentId:y(e.environment_id),resourceId:y(e.resource_id),previewId:y(e.preview_id)},key:String(e.key),kind:String(e.kind),value:y(e.value),valueFingerprint:String(e.value_fingerprint),secretRef:y(e.secret_ref),backend:String(e.backend),backendVersion:y(e.backend_version),origin:String(e.origin),required:w(e.required),metadata:C(e.metadata,{}),lastUsedAt:y(e.last_used_at),rotatedAt:y(e.rotated_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function I(e){return{entryId:String(e.entry_id),resourceId:String(e.resource_id),injectionTarget:String(e.injection_target),required:w(e.required),requiresRedeploy:w(e.requires_redeploy),lastDeployedVersion:e.last_deployed_version==null?void 0:Number(e.last_deployed_version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class Dr{controlPlane;now;constructor(e,r=()=>new Date){this.controlPlane=e;this.now=r}get(e){let r=this.controlPlane.database.query("SELECT * FROM configuration_entries WHERE id=?").get(e);return r?b(r):void 0}find(e,r,n){let t=this.controlPlane.database.query("SELECT * FROM configuration_entries WHERE project_id=? AND scope_type=? AND scope_id=? AND key=?").get(e,r.type,r.id,n);return t?b(t):void 0}list(e){let r=["project_id=?"],n=[e.projectId];if(e.scope)r.push("scope_type=?","scope_id=?"),n.push(e.scope.type,e.scope.id);if(e.kind)r.push("kind=?"),n.push(e.kind);return this.controlPlane.database.query(`SELECT * FROM configuration_entries WHERE ${r.join(" AND ")} ORDER BY key,scope_type,scope_id`).all(...n).map(b)}create(e){this.validateScope(e),this.validateEntry(e);let r=crypto.randomUUID(),n=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_entries (id,organization_id,project_id,scope_type,scope_id,environment_id,resource_id,preview_id,key,kind,value,value_fingerprint,secret_ref,backend,backend_version,origin,required,metadata,last_used_at,rotated_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.organizationId,e.projectId,e.scope.type,e.scope.id,e.scope.environmentId??null,e.scope.resourceId??null,e.scope.previewId??null,e.key,e.kind,e.value??null,e.valueFingerprint,e.secretRef??null,e.backend,e.backendVersion??null,e.origin,e.required?1:0,JSON.stringify(e.metadata),e.lastUsedAt??null,e.rotatedAt??null,1,n,n]),this.get(r)}update(e,r,n){let t=this.get(e);if(!t)throw Error("Configuration entry was not found.");if(this.validateEntry({...t,...n}),this.controlPlane.database.run("UPDATE configuration_entries SET value=?,value_fingerprint=?,secret_ref=?,backend=?,backend_version=?,required=?,metadata=?,rotated_at=?,version=version+1,updated_at=? WHERE id=? AND version=?",[n.value??null,n.valueFingerprint,n.secretRef??null,n.backend,n.backendVersion??null,n.required?1:0,JSON.stringify(n.metadata),n.rotatedAt??null,this.now().toISOString(),e,r]).changes!==1)throw Error("Configuration entry changed; refresh and retry.");return this.get(e)}remove(e,r){let n=this.get(e);if(!n)throw Error("Configuration entry was not found.");if(n.version!==r)throw Error("Configuration entry changed; refresh and retry.");if(this.controlPlane.database.run("DELETE FROM configuration_entries WHERE id=? AND version=?",[e,r]).changes<1)throw Error("Configuration entry changed; refresh and retry.");return n}setDependency(e){let r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_dependencies (entry_id,resource_id,injection_target,required,requires_redeploy,last_deployed_version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?) ON CONFLICT(entry_id,resource_id) DO UPDATE SET injection_target=excluded.injection_target,required=excluded.required,requires_redeploy=excluded.requires_redeploy,last_deployed_version=excluded.last_deployed_version,updated_at=excluded.updated_at",[e.entryId,e.resourceId,e.injectionTarget,e.required?1:0,e.requiresRedeploy?1:0,e.lastDeployedVersion??null,r,r]),this.dependencies(e.entryId).find((n)=>n.resourceId===e.resourceId)}dependencies(e){return this.controlPlane.database.query("SELECT * FROM configuration_dependencies WHERE entry_id=? ORDER BY resource_id").all(e).map(I)}dependenciesForResource(e){return this.controlPlane.database.query("SELECT * FROM configuration_dependencies WHERE resource_id=? ORDER BY entry_id").all(e).map(I)}mutation(e){let r=this.controlPlane.database.query("SELECT request_hash,result FROM configuration_mutations WHERE idempotency_key=?").get(e);return r?{requestHash:r.request_hash,result:C(r.result,{})}:void 0}recordMutation(e){this.controlPlane.database.run("INSERT INTO configuration_mutations (id,project_id,idempotency_key,request_hash,result,actor_id,created_at) VALUES (?,?,?,?,?,?,?)",[crypto.randomUUID(),e.projectId,e.idempotencyKey,e.requestHash,JSON.stringify(e.result),e.actorId??null,this.now().toISOString()])}validateEntry(e){if(!/^[A-Za-z_][A-Za-z0-9_]{0,255}$/.test(e.key))throw Error(`Invalid configuration key: ${e.key}`);if(e.kind==="variable"&&(e.value==null||e.secretRef||e.backend!=="plaintext"))throw Error("Variables require a plaintext value and cannot use a secret backend.");if(e.kind==="secret"&&(e.value!=null||!e.secretRef||e.backend==="plaintext"))throw Error("Secrets require a non-plaintext backend reference and cannot store a plaintext value.")}validateScope(e){let r=this.controlPlane.getProject(e.projectId);if(!r||r.organizationId!==e.organizationId)throw Error("Configuration project does not belong to the organization.");let n=e.scope;if(n.type==="project"){if(n.id!==e.projectId||n.environmentId||n.resourceId||n.previewId)throw Error("Project configuration scope must reference only its project.");return}if(n.type==="environment"){let i=this.controlPlane.database.query("SELECT project_id FROM environments WHERE id=?").get(n.id);if(!i||i.project_id!==e.projectId||n.environmentId&&n.environmentId!==n.id||n.resourceId||n.previewId)throw Error("Environment configuration scope does not belong to the project.");return}if(n.type==="service"||n.type==="function"){let i=this.controlPlane.getResource(n.id);if(!i||i.projectId!==e.projectId||n.type==="function"&&i.kind!=="function"||n.resourceId&&n.resourceId!==n.id||n.environmentId&&i.environmentId!==n.environmentId||n.previewId)throw Error(`${n.type==="function"?"Function":"Service"} configuration scope does not belong to the project.`);return}let t=this.controlPlane.database.query("SELECT project_id,base_environment_id,resource_id FROM preview_instances WHERE id=?").get(n.id);if(!t||t.project_id!==e.projectId||n.previewId&&n.previewId!==n.id||n.environmentId&&n.environmentId!==t.base_environment_id||n.resourceId&&n.resourceId!==t.resource_id)throw Error("Preview configuration scope does not belong to the project.")}}var E=/^[A-Za-z_][A-Za-z0-9_]{0,255}$/;function j(e){let r={n:`
+import{h}from"./chunk-znd507q9.js";var y=(e)=>e==null?void 0:String(e),w=(e)=>Number(e)===1,C=(e,r)=>{try{return e==null?r:JSON.parse(String(e))}catch{return r}};function b(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),scope:{type:String(e.scope_type),id:String(e.scope_id),environmentId:y(e.environment_id),resourceId:y(e.resource_id),previewId:y(e.preview_id)},key:String(e.key),kind:String(e.kind),value:y(e.value),valueFingerprint:String(e.value_fingerprint),secretRef:y(e.secret_ref),backend:String(e.backend),backendVersion:y(e.backend_version),origin:String(e.origin),required:w(e.required),metadata:C(e.metadata,{}),lastUsedAt:y(e.last_used_at),rotatedAt:y(e.rotated_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function I(e){return{entryId:String(e.entry_id),resourceId:String(e.resource_id),injectionTarget:String(e.injection_target),required:w(e.required),requiresRedeploy:w(e.requires_redeploy),lastDeployedVersion:e.last_deployed_version==null?void 0:Number(e.last_deployed_version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class Dr{controlPlane;now;constructor(e,r=()=>new Date){this.controlPlane=e;this.now=r}get(e){let r=this.controlPlane.database.query("SELECT * FROM configuration_entries WHERE id=?").get(e);return r?b(r):void 0}find(e,r,n){let t=this.controlPlane.database.query("SELECT * FROM configuration_entries WHERE project_id=? AND scope_type=? AND scope_id=? AND key=?").get(e,r.type,r.id,n);return t?b(t):void 0}list(e){let r=["project_id=?"],n=[e.projectId];if(e.scope)r.push("scope_type=?","scope_id=?"),n.push(e.scope.type,e.scope.id);if(e.kind)r.push("kind=?"),n.push(e.kind);return this.controlPlane.database.query(`SELECT * FROM configuration_entries WHERE ${r.join(" AND ")} ORDER BY key,scope_type,scope_id`).all(...n).map(b)}create(e){this.validateScope(e),this.validateEntry(e);let r=crypto.randomUUID(),n=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_entries (id,organization_id,project_id,scope_type,scope_id,environment_id,resource_id,preview_id,key,kind,value,value_fingerprint,secret_ref,backend,backend_version,origin,required,metadata,last_used_at,rotated_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.organizationId,e.projectId,e.scope.type,e.scope.id,e.scope.environmentId??null,e.scope.resourceId??null,e.scope.previewId??null,e.key,e.kind,e.value??null,e.valueFingerprint,e.secretRef??null,e.backend,e.backendVersion??null,e.origin,e.required?1:0,JSON.stringify(e.metadata),e.lastUsedAt??null,e.rotatedAt??null,1,n,n]),this.get(r)}update(e,r,n){let t=this.get(e);if(!t)throw Error("Configuration entry was not found.");if(this.validateEntry({...t,...n}),this.controlPlane.database.run("UPDATE configuration_entries SET value=?,value_fingerprint=?,secret_ref=?,backend=?,backend_version=?,required=?,metadata=?,rotated_at=?,version=version+1,updated_at=? WHERE id=? AND version=?",[n.value??null,n.valueFingerprint,n.secretRef??null,n.backend,n.backendVersion??null,n.required?1:0,JSON.stringify(n.metadata),n.rotatedAt??null,this.now().toISOString(),e,r]).changes!==1)throw Error("Configuration entry changed; refresh and retry.");return this.get(e)}remove(e,r){let n=this.get(e);if(!n)throw Error("Configuration entry was not found.");if(n.version!==r)throw Error("Configuration entry changed; refresh and retry.");if(this.controlPlane.database.run("DELETE FROM configuration_entries WHERE id=? AND version=?",[e,r]).changes<1)throw Error("Configuration entry changed; refresh and retry.");return n}setDependency(e){let r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_dependencies (entry_id,resource_id,injection_target,required,requires_redeploy,last_deployed_version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?) ON CONFLICT(entry_id,resource_id) DO UPDATE SET injection_target=excluded.injection_target,required=excluded.required,requires_redeploy=excluded.requires_redeploy,last_deployed_version=excluded.last_deployed_version,updated_at=excluded.updated_at",[e.entryId,e.resourceId,e.injectionTarget,e.required?1:0,e.requiresRedeploy?1:0,e.lastDeployedVersion??null,r,r]),this.dependencies(e.entryId).find((n)=>n.resourceId===e.resourceId)}dependencies(e){return this.controlPlane.database.query("SELECT * FROM configuration_dependencies WHERE entry_id=? ORDER BY resource_id").all(e).map(I)}dependenciesForResource(e){return this.controlPlane.database.query("SELECT * FROM configuration_dependencies WHERE resource_id=? ORDER BY entry_id").all(e).map(I)}mutation(e){let r=this.controlPlane.database.query("SELECT request_hash,result FROM configuration_mutations WHERE idempotency_key=?").get(e);return r?{requestHash:r.request_hash,result:C(r.result,{})}:void 0}recordMutation(e){this.controlPlane.database.run("INSERT INTO configuration_mutations (id,project_id,idempotency_key,request_hash,result,actor_id,created_at) VALUES (?,?,?,?,?,?,?)",[crypto.randomUUID(),e.projectId,e.idempotencyKey,e.requestHash,JSON.stringify(e.result),e.actorId??null,this.now().toISOString()])}validateEntry(e){if(!/^[A-Za-z_][A-Za-z0-9_]{0,255}$/.test(e.key))throw Error(`Invalid configuration key: ${e.key}`);if(e.kind==="variable"&&(e.value==null||e.secretRef||e.backend!=="plaintext"))throw Error("Variables require a plaintext value and cannot use a secret backend.");if(e.kind==="secret"&&(e.value!=null||!e.secretRef||e.backend==="plaintext"))throw Error("Secrets require a non-plaintext backend reference and cannot store a plaintext value.")}validateScope(e){let r=this.controlPlane.getProject(e.projectId);if(!r||r.organizationId!==e.organizationId)throw Error("Configuration project does not belong to the organization.");let n=e.scope;if(n.type==="project"){if(n.id!==e.projectId||n.environmentId||n.resourceId||n.previewId)throw Error("Project configuration scope must reference only its project.");return}if(n.type==="environment"){let i=this.controlPlane.database.query("SELECT project_id FROM environments WHERE id=?").get(n.id);if(!i||i.project_id!==e.projectId||n.environmentId&&n.environmentId!==n.id||n.resourceId||n.previewId)throw Error("Environment configuration scope does not belong to the project.");return}if(n.type==="service"||n.type==="function"){let i=this.controlPlane.getResource(n.id);if(!i||i.projectId!==e.projectId||n.type==="function"&&i.kind!=="function"||n.resourceId&&n.resourceId!==n.id||n.environmentId&&i.environmentId!==n.environmentId||n.previewId)throw Error(`${n.type==="function"?"Function":"Service"} configuration scope does not belong to the project.`);return}let t=this.controlPlane.database.query("SELECT project_id,base_environment_id,resource_id FROM preview_instances WHERE id=?").get(n.id);if(!t||t.project_id!==e.projectId||n.previewId&&n.previewId!==n.id||n.environmentId&&n.environmentId!==t.base_environment_id||n.resourceId&&n.resourceId!==t.resource_id)throw Error("Preview configuration scope does not belong to the project.")}}var E=/^[A-Za-z_][A-Za-z0-9_]{0,255}$/;function j(e){let r={n:`
 `,r:"\r",t:"\t","\\":"\\",'"':'"',$:"$"};return e.replace(/\\(n|r|t|\\|"|\$)/g,(n,t)=>r[t])}function Jc(e){let r={},n=[],t=e.replace(/\r\n?/g,`
 `).split(`
 `);for(let i=0;i<t.length;i++){let s=i+1,c=t[i];if(!c.trim()||c.trimStart().startsWith("#"))continue;if(/^\s*export\s+/.test(c))c=c.replace(/^\s*export\s+/,"");let u=c.match(/^\s*([^=\s]+)\s*=\s*(.*)$/);if(!u){n.push({line:s,severity:"error",code:"invalid_line",message:"Expected KEY=VALUE."});continue}let o=u[1],a=u[2];if(!E.test(o)){n.push({line:s,key:o,severity:"error",code:"invalid_key",message:`Invalid environment variable name: ${o}`});continue}let d=a;if(a.startsWith('"')||a.startsWith("'")){let g=a[0],l=[a.slice(1)],v=!1;while(!0){let f=l[l.length-1],m=!1,S=-1;for(let k=0;k<f.length;k++){if(g==='"'&&f[k]==="\\"&&!m){m=!0;continue}if(f[k]===g&&!m){S=k;break}m=!1}if(S>=0){l[l.length-1]=f.slice(0,S),v=!0;break}if(++i>=t.length)break;l.push(t[i])}if(!v){n.push({line:s,key:o,severity:"error",code:"unterminated_quote",message:`Unterminated quoted value for ${o}.`});continue}if(d=l.join(`

package/dist/bin/chunk-d0tmmzy5.js

@@ -0,0 +1 @@
+import{g}from"./chunk-12x968en.js";import"./chunk-psvqpztv.js";export{g as S3Client};