@stacksjs/ts-cloud 0.16.50 → 0.16.51

package/dist/{chunk-cpba1hz2.js → chunk-pz33w7gv.js}

@@ -1,2 +1,2 @@
-import{K,Wd}from"./chunk-18h7na1g.js";function U(t,s){return`/var/www/${t}-${s}`}var y=new Set(["laravel","php","statamic","wordpress"]);function Gr(t){return t.type!=null&&y.has(t.type)}function Vr(t){let s=t.proxyTo;if(s==null)return[];return(Array.isArray(s)?s:[s]).map((n)=>String(n).trim()).filter((n)=>n.length>0)}function od(t){return Vr(t).length>0}function oo(t){if(t.deploy)return t.deploy;if(Gr(t))return"server";if(t.start)return"server";return"bucket"}function d(t){if(t.redirect)return"redirect";if(od(t))return"proxy";if(Gr(t))return"server-php";if(oo(t)==="bucket")return"bucket";return t.start?"server-app":"server-static"}function pA(t){return t.infrastructure?.compute!=null||Boolean(t.cloud?.attachTo?.trim())}function kp(t,s={}){let r=[],n=[],a=t.sites||{},p=pA(t),l=Wd(t);if(l)r.push(l);let f=new Map;for(let[o,e]of Object.entries(a)){if(!e)continue;let h=oo(e),c=d(e);if(c==="redirect"){if(!e.domain)r.push(`Site '${o}' is a redirect site but has no \`domain\` to redirect from.`);if(!(typeof e.redirect==="string"?e.redirect:e.redirect?.to))r.push(`Site '${o}' is a redirect site but has no redirect target (\`redirect\` / \`redirect.to\`).`);if(!p)r.push(`Site '${o}' is a redirect site but no \`infrastructure.compute\` is configured to host the gateway that serves the redirect.`);let u=[];if(e.start)u.push("start");if(e.root)u.push("root");if(e.proxyTo)u.push("proxyTo");if(u.length>0)n.push(`Site '${o}' is a redirect site but also sets ${u.join(", ")}. These are ignored.`);continue}if(c==="proxy"){if(!e.domain)r.push(`Site '${o}' is a proxy site but has no \`domain\` to route from.`);if(!p)r.push(`Site '${o}' is a proxy site but no \`infrastructure.compute\` is configured to host the gateway that forwards it.`);let i=[];if(e.start)i.push("start");if(e.root)i.push("root");if(typeof e.port==="number")i.push("port");if(e.build)i.push("build");if(e.preStart&&e.preStart.length>0)i.push("preStart");if(i.length>0)n.push(`Site '${o}' sets \`proxyTo\`, so ts-cloud ships and supervises nothing for it. ${i.join(", ")} ${i.length===1?"is":"are"} ignored — remove ${i.length===1?"it":"them"}, or drop \`proxyTo\` to let ts-cloud own the service.`);continue}if(h==="server"&&!e.start&&!e.root){r.push(`Site '${o}' sets deploy:'server' but declares neither \`start\` (dynamic app) nor \`root\` (static site to serve). Add one.`);continue}if(c==="server-php"){if(!p)r.push(`Site '${o}' is a PHP site (type:'${e.type}') but no \`infrastructure.compute\` is configured. Add a server (infrastructure.compute) with PHP provisioning.`);if(!e.repository?.url)r.push(`Site '${o}' is a PHP site (type:'${e.type}') but has no \`repository.url\` to clone. PHP sites deploy via git.`)}else if(c==="server-app"){if(!p)r.push(`Site '${o}' deploys to a server (deploy:'server'${e.deploy?"":" inferred from `start`"}) but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`);if(typeof e.port==="number"){let i=s.occupiedPorts?.get(e.port);if(i)r.push(`Site '${o}' wants port ${e.port}, which project '${i}' already serves on this box. Attached projects share one port namespace. Give '${o}' a free port, or let the attach allocate one.`);let u=f.get(e.port);if(u)r.push(`Sites '${u}' and '${o}' both use port ${e.port}. Server apps sharing a box must use distinct ports.`);else f.set(e.port,o)}}else if(c==="server-static"){if(!e.root)r.push(`Site '${o}' is a server static site (deploy:'server', no \`start\`) but has no \`root\` directory to serve.`);if(!p)r.push(`Site '${o}' deploys to a server (deploy:'server') but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`)}else{if(!e.root)r.push(`Site '${o}' deploys to a bucket but has no \`root\` directory to upload.`);let i=[];if(e.start)i.push("start");if(typeof e.port==="number")i.push("port");if(e.preStart&&e.preStart.length>0)i.push("preStart");if(i.length>0)n.push(`Site '${o}' deploys to a bucket but sets server-only field(s): ${i.join(", ")}. These are ignored. Set deploy:'server' to use them.`)}}return{errors:r,warnings:n}}function Bp(t){let s=d(t);return s!=="bucket"&&s!=="redirect"&&s!=="proxy"}function hI(t){return d(t)==="bucket"}function yI(t,s){if(K(t)==="serverless")return!0;let r=Object.entries(t.sites??{}).filter(([,a])=>a!=null),n=s?r.filter(([a])=>a===s):r;if(n.length===0)return!0;return!n.every(([,a])=>{let p=d(a);return p==="redirect"||p==="proxy"})}
+import{K,Wd}from"./chunk-prtvb2fh.js";function U(t,s){return`/var/www/${t}-${s}`}var y=new Set(["laravel","php","statamic","wordpress"]);function Gr(t){return t.type!=null&&y.has(t.type)}function Vr(t){let s=t.proxyTo;if(s==null)return[];return(Array.isArray(s)?s:[s]).map((n)=>String(n).trim()).filter((n)=>n.length>0)}function od(t){return Vr(t).length>0}function oo(t){if(t.deploy)return t.deploy;if(Gr(t))return"server";if(t.start)return"server";return"bucket"}function d(t){if(t.redirect)return"redirect";if(od(t))return"proxy";if(Gr(t))return"server-php";if(oo(t)==="bucket")return"bucket";return t.start?"server-app":"server-static"}function pA(t){return t.infrastructure?.compute!=null||Boolean(t.cloud?.attachTo?.trim())}function kp(t,s={}){let r=[],n=[],a=t.sites||{},p=pA(t),l=Wd(t);if(l)r.push(l);let f=new Map;for(let[o,e]of Object.entries(a)){if(!e)continue;let h=oo(e),c=d(e);if(c==="redirect"){if(!e.domain)r.push(`Site '${o}' is a redirect site but has no \`domain\` to redirect from.`);if(!(typeof e.redirect==="string"?e.redirect:e.redirect?.to))r.push(`Site '${o}' is a redirect site but has no redirect target (\`redirect\` / \`redirect.to\`).`);if(!p)r.push(`Site '${o}' is a redirect site but no \`infrastructure.compute\` is configured to host the gateway that serves the redirect.`);let u=[];if(e.start)u.push("start");if(e.root)u.push("root");if(e.proxyTo)u.push("proxyTo");if(u.length>0)n.push(`Site '${o}' is a redirect site but also sets ${u.join(", ")}. These are ignored.`);continue}if(c==="proxy"){if(!e.domain)r.push(`Site '${o}' is a proxy site but has no \`domain\` to route from.`);if(!p)r.push(`Site '${o}' is a proxy site but no \`infrastructure.compute\` is configured to host the gateway that forwards it.`);let i=[];if(e.start)i.push("start");if(e.root)i.push("root");if(typeof e.port==="number")i.push("port");if(e.build)i.push("build");if(e.preStart&&e.preStart.length>0)i.push("preStart");if(i.length>0)n.push(`Site '${o}' sets \`proxyTo\`, so ts-cloud ships and supervises nothing for it. ${i.join(", ")} ${i.length===1?"is":"are"} ignored — remove ${i.length===1?"it":"them"}, or drop \`proxyTo\` to let ts-cloud own the service.`);continue}if(h==="server"&&!e.start&&!e.root){r.push(`Site '${o}' sets deploy:'server' but declares neither \`start\` (dynamic app) nor \`root\` (static site to serve). Add one.`);continue}if(c==="server-php"){if(!p)r.push(`Site '${o}' is a PHP site (type:'${e.type}') but no \`infrastructure.compute\` is configured. Add a server (infrastructure.compute) with PHP provisioning.`);if(!e.repository?.url)r.push(`Site '${o}' is a PHP site (type:'${e.type}') but has no \`repository.url\` to clone. PHP sites deploy via git.`)}else if(c==="server-app"){if(!p)r.push(`Site '${o}' deploys to a server (deploy:'server'${e.deploy?"":" inferred from `start`"}) but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`);if(typeof e.port==="number"){let i=s.occupiedPorts?.get(e.port);if(i)r.push(`Site '${o}' wants port ${e.port}, which project '${i}' already serves on this box. Attached projects share one port namespace. Give '${o}' a free port, or let the attach allocate one.`);let u=f.get(e.port);if(u)r.push(`Sites '${u}' and '${o}' both use port ${e.port}. Server apps sharing a box must use distinct ports.`);else f.set(e.port,o)}}else if(c==="server-static"){if(!e.root)r.push(`Site '${o}' is a server static site (deploy:'server', no \`start\`) but has no \`root\` directory to serve.`);if(!p)r.push(`Site '${o}' deploys to a server (deploy:'server') but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`)}else{if(!e.root)r.push(`Site '${o}' deploys to a bucket but has no \`root\` directory to upload.`);let i=[];if(e.start)i.push("start");if(typeof e.port==="number")i.push("port");if(e.preStart&&e.preStart.length>0)i.push("preStart");if(i.length>0)n.push(`Site '${o}' deploys to a bucket but sets server-only field(s): ${i.join(", ")}. These are ignored. Set deploy:'server' to use them.`)}}return{errors:r,warnings:n}}function Bp(t){let s=d(t);return s!=="bucket"&&s!=="redirect"&&s!=="proxy"}function hI(t){return d(t)==="bucket"}function yI(t,s){if(K(t)==="serverless")return!0;let r=Object.entries(t.sites??{}).filter(([,a])=>a!=null),n=s?r.filter(([a])=>a===s):r;if(n.length===0)return!0;return!n.every(([,a])=>{let p=d(a);return p==="redirect"||p==="proxy"})}
 export{U,Gr,Vr,od,oo,d,pA,kp,Bp,hI,yI};

package/dist/{chunk-nnnhq6sx.js → chunk-qcv4twc6.js}

@@ -1,4 +1,4 @@
-import{It,Ti,wi,Ri}from"./chunk-nmnf1ha6.js";function S(t){return t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function Hh(t,e="/var/www"){let n=`${e}/${t}-`;return["set -u",`for TS_CLOUD_DIR in ${n}*; do`,'  [ -d "$TS_CLOUD_DIR" ] || continue','  [ -d "$TS_CLOUD_DIR/releases" ] || continue',`  TS_CLOUD_SITE="\${TS_CLOUD_DIR#${n}}"`,"  TS_CLOUD_ACTIVE=no",`  for TS_CLOUD_UNIT in $(ls /etc/systemd/system/ 2>/dev/null | grep -E "^${S(t)}-$TS_CLOUD_SITE[-@.]" || true); do`,'    systemctl is-active "$TS_CLOUD_UNIT" >/dev/null 2>&1 && TS_CLOUD_ACTIVE=yes',"  done",'  TS_CLOUD_SIZE="$(du -sh "$TS_CLOUD_DIR" 2>/dev/null | cut -f1)"','  echo "site:$TS_CLOUD_SITE:$TS_CLOUD_ACTIVE:${TS_CLOUD_SIZE:-?}"',"done","exit 0"]}function Gh(t){if(!t)return[];let e=[];for(let n of t.split(`
+import{It,Ti,wi,Ri}from"./chunk-x4qye2rc.js";function S(t){return t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function Hh(t,e="/var/www"){let n=`${e}/${t}-`;return["set -u",`for TS_CLOUD_DIR in ${n}*; do`,'  [ -d "$TS_CLOUD_DIR" ] || continue','  [ -d "$TS_CLOUD_DIR/releases" ] || continue',`  TS_CLOUD_SITE="\${TS_CLOUD_DIR#${n}}"`,"  TS_CLOUD_ACTIVE=no",`  for TS_CLOUD_UNIT in $(ls /etc/systemd/system/ 2>/dev/null | grep -E "^${S(t)}-$TS_CLOUD_SITE[-@.]" || true); do`,'    systemctl is-active "$TS_CLOUD_UNIT" >/dev/null 2>&1 && TS_CLOUD_ACTIVE=yes',"  done",'  TS_CLOUD_SIZE="$(du -sh "$TS_CLOUD_DIR" 2>/dev/null | cut -f1)"','  echo "site:$TS_CLOUD_SITE:$TS_CLOUD_ACTIVE:${TS_CLOUD_SIZE:-?}"',"done","exit 0"]}function Gh(t){if(!t)return[];let e=[];for(let n of t.split(`
 `)){let r=n.trim();if(!r.startsWith("site:"))continue;let[,s,o,i]=r.split(":");if(!s||o!=="no")continue;e.push({name:s,size:i||"?"})}return e}function Vh(t,e,n){let r=t.map((o)=>`  ${e}-${o.name} (${o.size})`).join(`
 `),s=t.length===1?"it":"them";return`This server still holds ${t.length} site tree${t.length===1?"":"s"} with nothing running for ${s}:
 ${r}

package/dist/{chunk-nmnf1ha6.js → chunk-x4qye2rc.js}

@@ -1,4 +1,4 @@
-import{d}from"./chunk-cpba1hz2.js";var It="/etc/rpx/sites.d",gA={start:3000,end:3999};function g(t){return t.slug?.trim()||"app"}function sd(t){let r=t.lastIndexOf(":");if(r<0||r===t.length-1)return;let e=t.slice(r+1).trim();if(!/^\d+$/.test(e))return;let n=Number(e);return n>=1&&n<=65535?n:void 0}function Ti(t,r={}){let e=r.ignoreSlug?.trim(),n=new Map;for(let o of t){let c=g(o);if(e&&c===e)continue;for(let a of o.proxies??[]){let f=typeof a.from==="string"?[a.from]:a.from??[];for(let i of f){let u=sd(i);if(u!==void 0&&!n.has(u))n.set(u,c)}}}return n}function wi(t=It){return[`for __tsc_fragment in ${t}/*.json; do`,'  [ -f "$__tsc_fragment" ] || continue',`  base64 < "$__tsc_fragment" | tr -d '\\n'`,"  printf '\\n'","done"].join(`
+import{d}from"./chunk-pz33w7gv.js";var It="/etc/rpx/sites.d",gA={start:3000,end:3999};function g(t){return t.slug?.trim()||"app"}function sd(t){let r=t.lastIndexOf(":");if(r<0||r===t.length-1)return;let e=t.slice(r+1).trim();if(!/^\d+$/.test(e))return;let n=Number(e);return n>=1&&n<=65535?n:void 0}function Ti(t,r={}){let e=r.ignoreSlug?.trim(),n=new Map;for(let o of t){let c=g(o);if(e&&c===e)continue;for(let a of o.proxies??[]){let f=typeof a.from==="string"?[a.from]:a.from??[];for(let i of f){let u=sd(i);if(u!==void 0&&!n.has(u))n.set(u,c)}}}return n}function wi(t=It){return[`for __tsc_fragment in ${t}/*.json; do`,'  [ -f "$__tsc_fragment" ] || continue',`  base64 < "$__tsc_fragment" | tr -d '\\n'`,"  printf '\\n'","done"].join(`
 `)}function Ri(t){let r=[];for(let e of t.split(`
 `)){let n=e.trim();if(!n)continue;try{let o=JSON.parse(Buffer.from(n,"base64").toString("utf8"));if(o&&typeof o==="object"&&!Array.isArray(o))r.push(o)}catch{continue}}return r}function Np(t,r,e=gA){let n=[],o=[],c=new Set(r.keys());for(let[a,f]of Object.entries(t.sites??{})){if(!f||d(f)!=="server-app")continue;let i=typeof f.port==="number"?f.port:void 0,u=Math.max(i??e.start,e.start),p;for(let s=u;s<=e.end;s++)if(!c.has(s)){p=s;break}if(p===void 0){let s=i!==void 0?r.get(i):void 0;o.push(`No free port for site '${a}' in ${e.start}-${e.end}${i!==void 0?` (wanted ${i}${s?`, held by '${s}'`:""})`:""}. Widen the range or free a port on the box.`);continue}c.add(p),n.push({site:a,port:p,declared:i,moved:i!==void 0&&p!==i})}return{allocations:n,errors:o}}
 export{It,gA,sd,Ti,wi,Ri,Np};

package/dist/{chunk-fqgvackc.js → chunk-xgc6hskd.js}

@@ -1,4 +1,4 @@
-import{on,dr}from"./chunk-18h7na1g.js";import{Vr,d}from"./chunk-cpba1hz2.js";import{isIP as L}from"node:net";var to="/etc/rpx/certs",A="/etc/rpx/local-ca",M="rpx-root-ca.crt";function ro(e=A){return`${e.replace(/\/+$/,"")}/${M}`}function no(e){if(e.toLowerCase().endsWith(".local"))return!1;return e.split(".").length===2}function io(e,t={}){let r=new Set;for(let o of Object.values(e)){if(!o?.domain)continue;if(d(o)==="bucket")continue;r.add(o.domain)}let n=new Set;for(let o of Object.values(e)){if(!o?.domain||d(o)==="bucket")continue;for(let u of o.aliases??[]){let i=String(u).trim().toLowerCase();if(i&&i!==o.domain)n.add(i)}}if(t.autoWww!==!1)for(let o of[...r]){if(!no(o))continue;r.add(`www.${o}`)}for(let o of n)r.add(o);return[...r]}var k=["1.1.1.1","8.8.8.8"],I="/var/www/acme-challenge";function W(e){if(typeof e==="string")return{to:e};let t={to:e.to};if(e.status!=null)t.status=e.status;if(e.preservePath!=null)t.preservePath=e.preservePath;return t}function U(e){let t=e.auth;if(!t||t.enabled===!1||!t.password)return;return{username:t.username||"admin",password:t.password,...t.realm?{realm:t.realm}:{}}}function Yc(e){if(!e)return;return e.tls??"local-ca"}function op(e,t){if(e.cloud?.provider!=="ssh")return;let r=e.ssh?.lan;if(!r)return;return{...r.hostname?{hostname:r.hostname}:{},tls:r.tls??"local-ca",...t?{ip:t}:{}}}function ap(e){if(e.cloud?.provider!=="ssh")return;return e.ssh?.profile}function X(e){let t=e.trim().toLowerCase();if(!t||t.startsWith("*")||t.includes(":")||t.includes("/")||t.includes(" "))return!1;if(L(t)!==0)return!1;return t.endsWith(".local")||!t.includes(".")}function F(e,t,r){let n=[],o=new Set,u=(g,a)=>{let p=g.trim().toLowerCase();if(!p||o.has(p))return;o.add(p),n.push({host:p,source:a})},i=t.hostname?.trim(),c=(i||`${r}.local`).toLowerCase();if(u(c,i?"ssh.lan.hostname":`the ssh provider's default LAN name for project "${r}"`),Object.entries(e).some(([g,a])=>!!a&&dr(g)))u(`dashboard.${c}`,"the management dashboard site");for(let[g,a]of Object.entries(e)){if(!a?.domain)continue;if(d(a)==="bucket")continue;if(!X(a.domain))continue;u(a.domain,`site "${g}"`)}return n}function H(e,t){if(!t?.length)return;return t.find((r)=>{let n=(r.startsWith(".")?r.slice(1):r).toLowerCase();return e===n||e.endsWith(`.${n}`)})}function K(e,t){if(!t?.enabled)return;for(let{host:r,source:n}of e){let o=H(r,t.allowedSuffixes);if(!o)continue;throw Error(`The LAN certificate authority and public on-demand TLS both claim "${r}". LAN source: ${n}. Public source: the on-demand TLS allowed suffix "${o}", which is derived from the site domains. A host is either LAN-only, with a certificate signed by the box's own CA, or public, with one issued by Let's Encrypt, never both. Give the LAN a name no site domain covers (ssh.lan.hostname), or take that domain out of the sites this deploy routes.`)}}function V(e){let t=e.split(".");return t.length>=3&&t[0]==="*"&&t.slice(1).every((r)=>/^[a-z0-9-]+$/i.test(r))}function D(e,t={}){let{wildcardCerts:r,...n}=e;return JSON.stringify({...t,...n},null,2)}function Uh(e){if(!e||e==="/")return;let t=`/${e}`.replace(/\/+/g,"/").replace(/\/+$/,"");if(!t.startsWith("/"))t=`/${t}`;return t===""||t==="/"?void 0:t}function Zc(e,t){let n=(t?`${e}${t}`:e).replace(/[^a-zA-Z0-9._-]+/g,"-").replace(/^-+|-+$/g,"").slice(0,128);return n.length>0?n:"rpx"}function Y(e,t){if(!t||t.length===0)return`localhost:${e}`;return t.map((r)=>`${r.privateIp??r.publicIp}:${e}`)}function N(e,t,r){let n=(t.wwwRoot??"/var/www").replace(/\/+$/,""),o=t.slug??"app",u=t.proxy.certsDir??to,i=t.proxy.loadBalancer,c=[],f=new Set,g=new Map;for(let[l,s]of Object.entries(e)){if(!s||!s.domain)continue;let w=d(s);if(w==="bucket")continue;let v=c.length,E=[...new Set((s.aliases??[]).map((m)=>String(m).trim().toLowerCase()).filter((m)=>m&&m!==s.domain))],b=()=>{let m=c.slice(v).filter((h)=>h.to===s.domain);for(let h of E){for(let O of m)c.push({...O,to:h,id:Zc(h,O.path)});if(V(h)){if(!g.has(h))g.set(h,{domain:h,dnsEnvFile:`${n}/${o}-${l}/shared/.env`})}else f.add(h)}},C=Uh(s.path),S=Zc(s.domain,C),y=U(s);if(w==="redirect"){c.push({to:s.domain,path:C,redirect:W(s.redirect),id:S,...y?{auth:y}:{}}),f.add(s.domain),b();continue}if(w==="proxy"){let m=Vr(s);if(m.length===0)continue;let h=m.length===1?m[0]:m;c.push({to:s.domain,path:C,from:h,id:S,...y?{auth:y}:{},...Array.isArray(h)&&i?{loadBalancer:i}:{}}),f.add(s.domain),b();continue}if(w==="server-app"){if(typeof s.port!=="number")continue;let m=Y(s.port,r);c.push({to:s.domain,path:C,from:m,id:S,...y?{auth:y}:{},...Array.isArray(m)&&i?{loadBalancer:i}:{}})}else c.push({to:s.domain,path:C,static:{dir:`${n}/${o}-${l}/current`,spa:s.spa??!1,pathRewriteStyle:s.pathRewriteStyle??"directory"},cleanUrls:s.pathRewriteStyle!=="flat",...y?{auth:y}:{},id:S});f.add(s.domain),b()}if(t.proxy.autoWww!==!1)for(let l of[...f]){if(!no(l))continue;let s=`www.${l}`;if(f.has(s))continue;c.push({to:s,redirect:{to:`https://${l}`},id:Zc(s)}),f.add(s)}c.sort((l,s)=>{if(l.to!==s.to)return l.to.localeCompare(s.to);return(s.path?.length??0)-(l.path?.length??0)});let a={proxies:c,productionCerts:{certsDir:u,certsDirServerNames:[...f,...g.keys()]},https:!0,hostsManagement:!1,cleanup:{hosts:!1,certs:!1},...g.size>0?{wildcardCerts:[...g.values()]}:{}};if(t.proxy.onDemandTls&&f.size>0)a.onDemandTls={enabled:!0,allowedSuffixes:[...f],email:t.proxy.onDemandTlsEmail,certsDir:u,staging:t.proxy.onDemandTlsStaging??!1};if(t.proxy.onDemandTls)a.acmeChallengeWebroot=t.proxy.acmeWebroot??I;let p=t.proxy.cdn,x=p?.frontedHosts?.length?p.frontedHosts:[...f];if(p?.secret&&x.length>0)a.originGuard={header:p.secretHeader??"X-Origin-Verify",value:p.secret,hosts:x};if(t.lan)if(Yc(t.lan)==="off")a.https=!1;else{let l=F(e,t.lan,o);K(l,a.onDemandTls);let s=t.lan.ip&&L(t.lan.ip)!==0?[t.lan.ip]:[];a.localCa={dir:A,hosts:l.map((w)=>w.host),...s.length>0?{ips:s}:{},installTrust:!0}}return a}function B(e,t){return N({...e,...t.mail?on(t.mail):{}},t)}function Xt(e,t,r){return N({...e,...r.mail?on(r.mail):{}},r,t)}function fI(e){return`// Generated by ts-cloud — rpx reverse-proxy gateway.
+import{on,dr}from"./chunk-prtvb2fh.js";import{Vr,d}from"./chunk-pz33w7gv.js";import{isIP as L}from"node:net";var to="/etc/rpx/certs",A="/etc/rpx/local-ca",M="rpx-root-ca.crt";function ro(e=A){return`${e.replace(/\/+$/,"")}/${M}`}function no(e){if(e.toLowerCase().endsWith(".local"))return!1;return e.split(".").length===2}function io(e,t={}){let r=new Set;for(let o of Object.values(e)){if(!o?.domain)continue;if(d(o)==="bucket")continue;r.add(o.domain)}let n=new Set;for(let o of Object.values(e)){if(!o?.domain||d(o)==="bucket")continue;for(let u of o.aliases??[]){let i=String(u).trim().toLowerCase();if(i&&i!==o.domain)n.add(i)}}if(t.autoWww!==!1)for(let o of[...r]){if(!no(o))continue;r.add(`www.${o}`)}for(let o of n)r.add(o);return[...r]}var k=["1.1.1.1","8.8.8.8"],I="/var/www/acme-challenge";function W(e){if(typeof e==="string")return{to:e};let t={to:e.to};if(e.status!=null)t.status=e.status;if(e.preservePath!=null)t.preservePath=e.preservePath;return t}function U(e){let t=e.auth;if(!t||t.enabled===!1||!t.password)return;return{username:t.username||"admin",password:t.password,...t.realm?{realm:t.realm}:{}}}function Yc(e){if(!e)return;return e.tls??"local-ca"}function op(e,t){if(e.cloud?.provider!=="ssh")return;let r=e.ssh?.lan;if(!r)return;return{...r.hostname?{hostname:r.hostname}:{},tls:r.tls??"local-ca",...t?{ip:t}:{}}}function ap(e){if(e.cloud?.provider!=="ssh")return;return e.ssh?.profile}function X(e){let t=e.trim().toLowerCase();if(!t||t.startsWith("*")||t.includes(":")||t.includes("/")||t.includes(" "))return!1;if(L(t)!==0)return!1;return t.endsWith(".local")||!t.includes(".")}function F(e,t,r){let n=[],o=new Set,u=(g,a)=>{let p=g.trim().toLowerCase();if(!p||o.has(p))return;o.add(p),n.push({host:p,source:a})},i=t.hostname?.trim(),c=(i||`${r}.local`).toLowerCase();if(u(c,i?"ssh.lan.hostname":`the ssh provider's default LAN name for project "${r}"`),Object.entries(e).some(([g,a])=>!!a&&dr(g)))u(`dashboard.${c}`,"the management dashboard site");for(let[g,a]of Object.entries(e)){if(!a?.domain)continue;if(d(a)==="bucket")continue;if(!X(a.domain))continue;u(a.domain,`site "${g}"`)}return n}function H(e,t){if(!t?.length)return;return t.find((r)=>{let n=(r.startsWith(".")?r.slice(1):r).toLowerCase();return e===n||e.endsWith(`.${n}`)})}function K(e,t){if(!t?.enabled)return;for(let{host:r,source:n}of e){let o=H(r,t.allowedSuffixes);if(!o)continue;throw Error(`The LAN certificate authority and public on-demand TLS both claim "${r}". LAN source: ${n}. Public source: the on-demand TLS allowed suffix "${o}", which is derived from the site domains. A host is either LAN-only, with a certificate signed by the box's own CA, or public, with one issued by Let's Encrypt, never both. Give the LAN a name no site domain covers (ssh.lan.hostname), or take that domain out of the sites this deploy routes.`)}}function V(e){let t=e.split(".");return t.length>=3&&t[0]==="*"&&t.slice(1).every((r)=>/^[a-z0-9-]+$/i.test(r))}function D(e,t={}){let{wildcardCerts:r,...n}=e;return JSON.stringify({...t,...n},null,2)}function Uh(e){if(!e||e==="/")return;let t=`/${e}`.replace(/\/+/g,"/").replace(/\/+$/,"");if(!t.startsWith("/"))t=`/${t}`;return t===""||t==="/"?void 0:t}function Zc(e,t){let n=(t?`${e}${t}`:e).replace(/[^a-zA-Z0-9._-]+/g,"-").replace(/^-+|-+$/g,"").slice(0,128);return n.length>0?n:"rpx"}function Y(e,t){if(!t||t.length===0)return`localhost:${e}`;return t.map((r)=>`${r.privateIp??r.publicIp}:${e}`)}function N(e,t,r){let n=(t.wwwRoot??"/var/www").replace(/\/+$/,""),o=t.slug??"app",u=t.proxy.certsDir??to,i=t.proxy.loadBalancer,c=[],f=new Set,g=new Map;for(let[l,s]of Object.entries(e)){if(!s||!s.domain)continue;let w=d(s);if(w==="bucket")continue;let v=c.length,E=[...new Set((s.aliases??[]).map((m)=>String(m).trim().toLowerCase()).filter((m)=>m&&m!==s.domain))],b=()=>{let m=c.slice(v).filter((h)=>h.to===s.domain);for(let h of E){for(let O of m)c.push({...O,to:h,id:Zc(h,O.path)});if(V(h)){if(!g.has(h))g.set(h,{domain:h,dnsEnvFile:`${n}/${o}-${l}/shared/.env`})}else f.add(h)}},C=Uh(s.path),S=Zc(s.domain,C),y=U(s);if(w==="redirect"){c.push({to:s.domain,path:C,redirect:W(s.redirect),id:S,...y?{auth:y}:{}}),f.add(s.domain),b();continue}if(w==="proxy"){let m=Vr(s);if(m.length===0)continue;let h=m.length===1?m[0]:m;c.push({to:s.domain,path:C,from:h,id:S,...y?{auth:y}:{},...Array.isArray(h)&&i?{loadBalancer:i}:{}}),f.add(s.domain),b();continue}if(w==="server-app"){if(typeof s.port!=="number")continue;let m=Y(s.port,r);c.push({to:s.domain,path:C,from:m,id:S,...y?{auth:y}:{},...Array.isArray(m)&&i?{loadBalancer:i}:{}})}else c.push({to:s.domain,path:C,static:{dir:`${n}/${o}-${l}/current`,spa:s.spa??!1,pathRewriteStyle:s.pathRewriteStyle??"directory"},cleanUrls:s.pathRewriteStyle!=="flat",...y?{auth:y}:{},id:S});f.add(s.domain),b()}if(t.proxy.autoWww!==!1)for(let l of[...f]){if(!no(l))continue;let s=`www.${l}`;if(f.has(s))continue;c.push({to:s,redirect:{to:`https://${l}`},id:Zc(s)}),f.add(s)}c.sort((l,s)=>{if(l.to!==s.to)return l.to.localeCompare(s.to);return(s.path?.length??0)-(l.path?.length??0)});let a={proxies:c,productionCerts:{certsDir:u,certsDirServerNames:[...f,...g.keys()]},https:!0,hostsManagement:!1,cleanup:{hosts:!1,certs:!1},...g.size>0?{wildcardCerts:[...g.values()]}:{}};if(t.proxy.onDemandTls&&f.size>0)a.onDemandTls={enabled:!0,allowedSuffixes:[...f],email:t.proxy.onDemandTlsEmail,certsDir:u,staging:t.proxy.onDemandTlsStaging??!1};if(t.proxy.onDemandTls)a.acmeChallengeWebroot=t.proxy.acmeWebroot??I;let p=t.proxy.cdn,x=p?.frontedHosts?.length?p.frontedHosts:[...f];if(p?.secret&&x.length>0)a.originGuard={header:p.secretHeader??"X-Origin-Verify",value:p.secret,hosts:x};if(t.lan)if(Yc(t.lan)==="off")a.https=!1;else{let l=F(e,t.lan,o);K(l,a.onDemandTls);let s=t.lan.ip&&L(t.lan.ip)!==0?[t.lan.ip]:[];a.localCa={dir:A,hosts:l.map((w)=>w.host),...s.length>0?{ips:s}:{},installTrust:!0}}return a}function B(e,t){return N({...e,...t.mail?on(t.mail):{}},t)}function Xt(e,t,r){return N({...e,...r.mail?on(r.mail):{}},r,t)}function fI(e){return`// Generated by ts-cloud — rpx reverse-proxy gateway.
 // Routes are derived from the \`sites\` model on every \`buddy deploy\`.
 import { startProxies } from '@stacksjs/rpx'
 

package/dist/deploy/index.js

@@ -1 +1 @@
-import{Tn,wn,Fu,ps,Uu,Qu,Hu,Qa,Gu,Vu,th,qu,E,ju,ms,Me,zu,Ku,BS,Wu,Ju,Xu,Yu,Zu,rh,xS,OS,_S,nh,ih,LS,$S,sh,oh,MS,fs,Ar,Ha,Rn,Dn,yr,ct,Lt,hs,ah,Pn,eg,tg,Ga,ys,kn,Ss,nc}from"../chunk-5hgcr7r2.js";import{ic,Bn,xn,Is,bs,Cs,Es,sc,oc}from"../chunk-8b2mxhcm.js";import{ac}from"../chunk-a8hs75xd.js";import"../chunk-jytama4e.js";import"../chunk-0qgfe5ff.js";import"../chunk-0cz2s19h.js";import"../chunk-qcj3hkba.js";import"../chunk-4abbccq7.js";import"../chunk-m9r0a1v9.js";import"../chunk-jtvw9d4x.js";import{Sg,vc,Ig,De,Tc,Kn,bg,wc,zc,Xs,Kc,Jt,Si,Ys}from"../chunk-85fyadq0.js";import"../chunk-fqgvackc.js";import"../chunk-thdfk76k.js";import"../chunk-zf5wdx6v.js";import"../chunk-j99nkav5.js";import"../chunk-ca191b00.js";import{It,gA,sd,Ti,wi,Ri,Np}from"../chunk-nmnf1ha6.js";import{U,Gr,Vr,od,oo,d,pA,kp,Bp,hI,yI}from"../chunk-cpba1hz2.js";import"../chunk-zbx9yehq.js";import"../chunk-18h7na1g.js";import"../chunk-6m8p1n88.js";export{gA as DEFAULT_SITE_PORT_RANGE,It as HOST_SITES_DIR,Tc as IPV6_EXCLUDED_HOST_LABELS,zc as MANAGEMENT_DASHBOARD_SITE,Tn as addSiteToCloudConfig,Np as allocateSitePorts,MS as buildAndPushContainerImage,ac as buildAndPushServerlessImage,Ar as buildFunctionEnv,wi as buildHostSitePortsScript,Ys as buildManagementDashboardArtifact,Lt as buildServerTopology,hs as buildServerlessTopology,ah as buildTopology,Ga as collectEgressMetrics,Sg as collectServerDnsDomains,oh as createContainerImageDependencies,nh as createExistingStaticFullStackDependencies,rh as createStaticApiOriginDependencies,kn as dashboardActions,Xs as dashboardCredentialsFile,zu as dashboardPageRoutes,Yu as deleteFailoverReplicaBuckets,sc as deleteStaticSite,LS as deployExistingStaticFullStack,Ha as deployServerlessApp,yI as deployShipsFiles,Zu as deploySite,xS as deployStaticApiOrigin,bs as deployStaticSite,oc as deployStaticSiteFull,Bn as deployStaticSiteWithExternalDns,xn as deployStaticSiteWithExternalDnsFull,eg as egressReportMetrics,E as ensureDashboardActor,Wu as ensureFailoverReplicaBuckets,Si as ensureManagementDashboard,$S as estimateExistingStaticFullStackMonthlyCost,_S as estimateStaticApiOriginMonthlyCost,tg as fetchEgressReport,ih as generateExistingStaticFullStackTemplate,ic as generateExternalDnsStaticSiteTemplate,Is as generateStaticSiteTemplate,Ju as grantFailoverReplicaAccess,pA as hasComputeConfigured,od as hasProxyUpstream,sh as hashContainerContext,Kn as hostAcceptsIpv6,fs as infraEnvFromOutputs,ju as initializeDashboardControlPlane,Es as invalidateCache,Gr as isPhpSite,Qa as isValidHostname,De as normalizePublicIpv6,Ti as occupiedHostPorts,Ri as parseHostSiteFragments,sd as parseUpstreamPort,bg as reconcileAddressRecords,Rn as redeployServerlessApp,Ig as removeAddressRecords,wn as removeSiteFromCloudConfig,vc as removeStaleServerAddressRecords,Gu as renderAliasesValue,Hu as renderEnvValue,Vu as renderRedirectsValue,th as renderSiteSnippet,Uu as renderSslValue,Qu as renderStringValue,Ss as resolveDashboardAction,Kc as resolveDashboardAuth,Pn as resolveDashboardData,Ku as resolveLegacyDashboardRoute,Vr as resolveProxyUpstreams,oo as resolveSiteDeployTarget,d as resolveSiteKind,Jt as resolveUiSource,Dn as rollbackServerlessApp,BS as routesForDashboard,ct as runRemoteCommand,ys as sanitizeCloudConfig,Xu as seedFailoverReplicas,qu as setAttachToInCloudConfig,yr as setMaintenance,ps as setSitePropertyInCloudConfig,Bp as shipsARelease,hI as shipsToBucket,U as siteInstallBase,nc as startLocalDashboardServer,ms as synchronizeDashboardUsers,Me as trackDashboardOperation,Fu as updateSiteInCloudConfig,Cs as uploadStaticFiles,kp as validateDeploymentConfig,wc as verifyAddressRecord,OS as verifyStaticApiOrigin};
+import{Tn,wn,Fu,ps,Uu,Qu,Hu,Qa,Gu,Vu,th,qu,E,ju,ms,Me,zu,Ku,BS,Wu,Ju,Xu,Yu,Zu,rh,xS,OS,_S,nh,ih,LS,$S,sh,oh,MS,fs,Ar,Ha,Rn,Dn,yr,ct,Lt,hs,ah,Pn,eg,tg,Ga,ys,kn,Ss,nc}from"../chunk-53kyxata.js";import{ic,Bn,xn,Is,bs,Cs,Es,sc,oc}from"../chunk-8b2mxhcm.js";import{ac}from"../chunk-p101nhg2.js";import"../chunk-jytama4e.js";import"../chunk-0qgfe5ff.js";import"../chunk-0cz2s19h.js";import"../chunk-qcj3hkba.js";import"../chunk-4abbccq7.js";import"../chunk-m9r0a1v9.js";import"../chunk-jtvw9d4x.js";import{Sg,vc,Ig,De,Tc,Kn,bg,wc,zc,Xs,Kc,Jt,Si,Ys}from"../chunk-dw0cvqdr.js";import"../chunk-xgc6hskd.js";import"../chunk-thdfk76k.js";import"../chunk-zf5wdx6v.js";import"../chunk-j99nkav5.js";import"../chunk-ca191b00.js";import{It,gA,sd,Ti,wi,Ri,Np}from"../chunk-x4qye2rc.js";import{U,Gr,Vr,od,oo,d,pA,kp,Bp,hI,yI}from"../chunk-pz33w7gv.js";import"../chunk-6gnmrtp9.js";import"../chunk-prtvb2fh.js";import"../chunk-6m8p1n88.js";export{gA as DEFAULT_SITE_PORT_RANGE,It as HOST_SITES_DIR,Tc as IPV6_EXCLUDED_HOST_LABELS,zc as MANAGEMENT_DASHBOARD_SITE,Tn as addSiteToCloudConfig,Np as allocateSitePorts,MS as buildAndPushContainerImage,ac as buildAndPushServerlessImage,Ar as buildFunctionEnv,wi as buildHostSitePortsScript,Ys as buildManagementDashboardArtifact,Lt as buildServerTopology,hs as buildServerlessTopology,ah as buildTopology,Ga as collectEgressMetrics,Sg as collectServerDnsDomains,oh as createContainerImageDependencies,nh as createExistingStaticFullStackDependencies,rh as createStaticApiOriginDependencies,kn as dashboardActions,Xs as dashboardCredentialsFile,zu as dashboardPageRoutes,Yu as deleteFailoverReplicaBuckets,sc as deleteStaticSite,LS as deployExistingStaticFullStack,Ha as deployServerlessApp,yI as deployShipsFiles,Zu as deploySite,xS as deployStaticApiOrigin,bs as deployStaticSite,oc as deployStaticSiteFull,Bn as deployStaticSiteWithExternalDns,xn as deployStaticSiteWithExternalDnsFull,eg as egressReportMetrics,E as ensureDashboardActor,Wu as ensureFailoverReplicaBuckets,Si as ensureManagementDashboard,$S as estimateExistingStaticFullStackMonthlyCost,_S as estimateStaticApiOriginMonthlyCost,tg as fetchEgressReport,ih as generateExistingStaticFullStackTemplate,ic as generateExternalDnsStaticSiteTemplate,Is as generateStaticSiteTemplate,Ju as grantFailoverReplicaAccess,pA as hasComputeConfigured,od as hasProxyUpstream,sh as hashContainerContext,Kn as hostAcceptsIpv6,fs as infraEnvFromOutputs,ju as initializeDashboardControlPlane,Es as invalidateCache,Gr as isPhpSite,Qa as isValidHostname,De as normalizePublicIpv6,Ti as occupiedHostPorts,Ri as parseHostSiteFragments,sd as parseUpstreamPort,bg as reconcileAddressRecords,Rn as redeployServerlessApp,Ig as removeAddressRecords,wn as removeSiteFromCloudConfig,vc as removeStaleServerAddressRecords,Gu as renderAliasesValue,Hu as renderEnvValue,Vu as renderRedirectsValue,th as renderSiteSnippet,Uu as renderSslValue,Qu as renderStringValue,Ss as resolveDashboardAction,Kc as resolveDashboardAuth,Pn as resolveDashboardData,Ku as resolveLegacyDashboardRoute,Vr as resolveProxyUpstreams,oo as resolveSiteDeployTarget,d as resolveSiteKind,Jt as resolveUiSource,Dn as rollbackServerlessApp,BS as routesForDashboard,ct as runRemoteCommand,ys as sanitizeCloudConfig,Xu as seedFailoverReplicas,qu as setAttachToInCloudConfig,yr as setMaintenance,ps as setSitePropertyInCloudConfig,Bp as shipsARelease,hI as shipsToBucket,U as siteInstallBase,nc as startLocalDashboardServer,ms as synchronizeDashboardUsers,Me as trackDashboardOperation,Fu as updateSiteInCloudConfig,Cs as uploadStaticFiles,kp as validateDeploymentConfig,wc as verifyAddressRecord,OS as verifyStaticApiOrigin};

package/dist/drivers/index.js

@@ -1 +1 @@
-import{Wn,jt,Pr,zt,Jn,M,Br,Xn,xr,Se,Rc,Yn,Dc,Zn,Pc,Or,vh,Th,Rg,Dg,wh,Rh,Dh,_r,ei,Pg,zs,ti,ri,ni,ii,si,Nc,kc,Lr,xc,Ve,se,Oc,mt,qe,je,ft,Pe,Ks,_c,Ng,kg,Lc,Bg,ht,oi,$c,xg,Og,Mc,$r,Ne,Fc,_g,Lg,Ws,ai,At,$g,Mg,Fg,Ug,Qg,Hg,Gg,Vg,qg,ci,di,li,ui,gi,pi,mi,jg,zg,Mr,F,Js,Kg,Wg,Jg,Uc,Xg,Yg,Ph,Qc,Nh,kh,Zg,ep,Bh,xh,Oh,Hc,tp,_h,Lh,$h,fi,hi,Ai,yi,Gc,Vc,qc,jc,Mh,Zs,Wc,Ii,Jc,rp,np,ip,Fh}from"../chunk-85fyadq0.js";import{to,no,io,Uh,Zc,B,Xt,fI,so,cp,ze,G,ke}from"../chunk-fqgvackc.js";import"../chunk-thdfk76k.js";import"../chunk-zf5wdx6v.js";import"../chunk-j99nkav5.js";import"../chunk-ca191b00.js";import"../chunk-cpba1hz2.js";import"../chunk-18h7na1g.js";import"../chunk-6m8p1n88.js";export{jc as AwsBoxProvisioner,Br as AwsDriver,Jg as BOOT_PARTITION_LABEL,Js as CloudDriverFactory,Dg as DEFAULT_HOST_CLEANUP_ESCALATED,Rh as DEFAULT_HOST_CLEANUP_HIGH_WATER_PERCENT,wh as DEFAULT_HOST_CLEANUP_LOW_WATER_PERCENT,Rg as DEFAULT_HOST_CLEANUP_RETENTION,Dh as DEFAULT_HOST_CLEANUP_SCHEDULE,to as DEFAULT_RPX_CERTS_DIR,Wg as FIRST_BOOT_SCRIPT_PATH,Or as HOST_ARTIFACT_CACHE_DIR,vh as HOST_CLEANUP_SCRIPT_PATH,Th as HOST_CLEANUP_UNIT,qc as HetznerBoxProvisioner,Lr as HetznerClient,Pe as HetznerDriver,Oc as LEGACY_DRIVER_STATE_DIR,Ks as LocalBoxDriver,np as MANAGED_CACHE_POLICY_DISABLED,rp as MANAGED_CACHE_POLICY_OPTIMIZED,ip as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,Lg as RASPBERRY_PI_DEFAULT_SWAP_GB,Pc as REMOTE_SCRIPT_RUNNER,so as RPX_DIR,cp as RPX_LAUNCHER_PATH,ze as RPX_SERVICE_NAME,Fc as SSH_BOOTSTRAP_MARKER_DIR,Ne as SSH_BOOTSTRAP_VERSION,At as SSH_DEFAULTS,mi as SSH_DEPLOY_STORAGE_PATH,Ng as SSH_INSECURE_HOST_KEY_OPTS,kg as SSH_KEEPALIVE_OPTS,di as SSH_PREFLIGHT_SCRIPT,jg as SSH_SKIP_BOOTSTRAP_ENV,Mr as SshDriver,$r as SystemSshTransport,Gc as UBUNTU_2404_AMI_PARAM,$h as acquireResizeLock,Bh as applyHetznerHostOptimization,Ws as assertArchSupported,zg as assertSshComputeConfig,Nc as buildAwsArtifactFetch,Vc as buildBoxUserData,Fh as buildCloudFrontOriginConfig,Uc as buildCloudInitFirstBoot,ep as buildHetznerHostOptimizationScript,ti as buildHostCleanupDeployScript,Pg as buildHostCleanupExecutable,zs as buildHostCleanupInstallScript,ei as buildHostCleanupScript,kc as buildLocalArtifactFetch,B as buildRpxConfig,ke as buildRpxFragmentRefreshScript,Xt as buildRpxLbConfig,G as buildRpxProvisionScript,Bg as buildScpArgsFor,ni as buildSiteDeployScript,Xn as buildSshArgs,Lc as buildSshArgsFor,ai as buildSshBootstrapScript,ii as buildStaticSiteDeployScript,Kg as cloudDrivers,xh as collectHetznerHostOptimizationReport,Qc as collectHetznerResizeManifest,Mh as createBoxProvisioner,F as createCloudDriver,Wc as deployAllComputeSites,Zs as deploySiteRelease,Zc as deriveRouteId,Wn as describeScriptSyntaxError,mt as driverStateDir,qe as driverStatePath,hi as ensureFirewall,Ai as ensureServer,fi as ensureSshKey,ui as evaluatePreflight,Ph as executeHetznerServerResize,Og as findKnownHostKey,pi as formatPreflightFindings,jt as formatSshFailure,io as gatewayHostnames,M as generateUbuntuAppCloudInit,no as hasAutoWwwVariant,_c as isBoxMode,Yg as isHetznerCapacityError,Jn as isLocalDatabase,xg as knownHostsLine,$c as knownHostsToken,Uh as normalizeRoutePath,Ve as normalizeSshPublicKey,li as parsePreflightFacts,Xg as planHetznerServerResize,gi as preflightFailed,Nh as prepareHetznerResize,je as readDriverState,_h as readResizeCheckpoint,si as releaseTarballTmpPath,Ii as reloadRpxGateway,Zn as remoteScriptRunner,fI as renderRpxLauncher,Jc as renewRpxCertificates,Hc as resizeCheckpointPath,tp as resizeLockPath,ri as resolveExecStart,xc as resolveHetznerApiToken,Zg as resolveHetznerHostOptimizationPlan,_r as resolveHostCleanupConfig,Qg as resolveSshHostKeyPolicy,$g as resolveSshHosts,qg as resolveSshLan,Fg as resolveSshPort,Ug as resolveSshPrivateKeyPath,Gg as resolveSshProfile,Vg as resolveSshPublicIp,ci as resolveSshSettings,Hg as resolveSshSudo,Mg as resolveSshUser,oi as scanHostKey,Rc as scpUpload,yi as serverPublicIpv4,_g as sshBootstrapMarkerPath,xr as sshExec,Se as sshExecOrThrow,ht as sshHostKeyFingerprint,Mc as sshKnownHostsPath,zt as summarizeRemoteFailures,Pr as surfaceRemoteNotices,Oh as verifyHetznerHostOptimization,kh as verifyHetznerResize,Dc as waitForCloudInit,Yn as waitForSsh,se as wrapCloudInitUserData,ft as writeDriverState,Lh as writeResizeCheckpoint};
+import{Wn,jt,Pr,zt,Jn,M,Br,Xn,xr,Se,Rc,Yn,Dc,Zn,Pc,Or,vh,Th,Rg,Dg,wh,Rh,Dh,_r,ei,Pg,zs,ti,ri,ni,ii,si,Nc,kc,Lr,xc,Ve,se,Oc,mt,qe,je,ft,Pe,Ks,_c,Ng,kg,Lc,Bg,ht,oi,$c,xg,Og,Mc,$r,Ne,Fc,_g,Lg,Ws,ai,At,$g,Mg,Fg,Ug,Qg,Hg,Gg,Vg,qg,ci,di,li,ui,gi,pi,mi,jg,zg,Mr,F,Js,Kg,Wg,Jg,Uc,Xg,Yg,Ph,Qc,Nh,kh,Zg,ep,Bh,xh,Oh,Hc,tp,_h,Lh,$h,fi,hi,Ai,yi,Gc,Vc,qc,jc,Mh,Zs,Wc,Ii,Jc,rp,np,ip,Fh}from"../chunk-dw0cvqdr.js";import{to,no,io,Uh,Zc,B,Xt,fI,so,cp,ze,G,ke}from"../chunk-xgc6hskd.js";import"../chunk-thdfk76k.js";import"../chunk-zf5wdx6v.js";import"../chunk-j99nkav5.js";import"../chunk-ca191b00.js";import"../chunk-pz33w7gv.js";import"../chunk-prtvb2fh.js";import"../chunk-6m8p1n88.js";export{jc as AwsBoxProvisioner,Br as AwsDriver,Jg as BOOT_PARTITION_LABEL,Js as CloudDriverFactory,Dg as DEFAULT_HOST_CLEANUP_ESCALATED,Rh as DEFAULT_HOST_CLEANUP_HIGH_WATER_PERCENT,wh as DEFAULT_HOST_CLEANUP_LOW_WATER_PERCENT,Rg as DEFAULT_HOST_CLEANUP_RETENTION,Dh as DEFAULT_HOST_CLEANUP_SCHEDULE,to as DEFAULT_RPX_CERTS_DIR,Wg as FIRST_BOOT_SCRIPT_PATH,Or as HOST_ARTIFACT_CACHE_DIR,vh as HOST_CLEANUP_SCRIPT_PATH,Th as HOST_CLEANUP_UNIT,qc as HetznerBoxProvisioner,Lr as HetznerClient,Pe as HetznerDriver,Oc as LEGACY_DRIVER_STATE_DIR,Ks as LocalBoxDriver,np as MANAGED_CACHE_POLICY_DISABLED,rp as MANAGED_CACHE_POLICY_OPTIMIZED,ip as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,Lg as RASPBERRY_PI_DEFAULT_SWAP_GB,Pc as REMOTE_SCRIPT_RUNNER,so as RPX_DIR,cp as RPX_LAUNCHER_PATH,ze as RPX_SERVICE_NAME,Fc as SSH_BOOTSTRAP_MARKER_DIR,Ne as SSH_BOOTSTRAP_VERSION,At as SSH_DEFAULTS,mi as SSH_DEPLOY_STORAGE_PATH,Ng as SSH_INSECURE_HOST_KEY_OPTS,kg as SSH_KEEPALIVE_OPTS,di as SSH_PREFLIGHT_SCRIPT,jg as SSH_SKIP_BOOTSTRAP_ENV,Mr as SshDriver,$r as SystemSshTransport,Gc as UBUNTU_2404_AMI_PARAM,$h as acquireResizeLock,Bh as applyHetznerHostOptimization,Ws as assertArchSupported,zg as assertSshComputeConfig,Nc as buildAwsArtifactFetch,Vc as buildBoxUserData,Fh as buildCloudFrontOriginConfig,Uc as buildCloudInitFirstBoot,ep as buildHetznerHostOptimizationScript,ti as buildHostCleanupDeployScript,Pg as buildHostCleanupExecutable,zs as buildHostCleanupInstallScript,ei as buildHostCleanupScript,kc as buildLocalArtifactFetch,B as buildRpxConfig,ke as buildRpxFragmentRefreshScript,Xt as buildRpxLbConfig,G as buildRpxProvisionScript,Bg as buildScpArgsFor,ni as buildSiteDeployScript,Xn as buildSshArgs,Lc as buildSshArgsFor,ai as buildSshBootstrapScript,ii as buildStaticSiteDeployScript,Kg as cloudDrivers,xh as collectHetznerHostOptimizationReport,Qc as collectHetznerResizeManifest,Mh as createBoxProvisioner,F as createCloudDriver,Wc as deployAllComputeSites,Zs as deploySiteRelease,Zc as deriveRouteId,Wn as describeScriptSyntaxError,mt as driverStateDir,qe as driverStatePath,hi as ensureFirewall,Ai as ensureServer,fi as ensureSshKey,ui as evaluatePreflight,Ph as executeHetznerServerResize,Og as findKnownHostKey,pi as formatPreflightFindings,jt as formatSshFailure,io as gatewayHostnames,M as generateUbuntuAppCloudInit,no as hasAutoWwwVariant,_c as isBoxMode,Yg as isHetznerCapacityError,Jn as isLocalDatabase,xg as knownHostsLine,$c as knownHostsToken,Uh as normalizeRoutePath,Ve as normalizeSshPublicKey,li as parsePreflightFacts,Xg as planHetznerServerResize,gi as preflightFailed,Nh as prepareHetznerResize,je as readDriverState,_h as readResizeCheckpoint,si as releaseTarballTmpPath,Ii as reloadRpxGateway,Zn as remoteScriptRunner,fI as renderRpxLauncher,Jc as renewRpxCertificates,Hc as resizeCheckpointPath,tp as resizeLockPath,ri as resolveExecStart,xc as resolveHetznerApiToken,Zg as resolveHetznerHostOptimizationPlan,_r as resolveHostCleanupConfig,Qg as resolveSshHostKeyPolicy,$g as resolveSshHosts,qg as resolveSshLan,Fg as resolveSshPort,Ug as resolveSshPrivateKeyPath,Gg as resolveSshProfile,Vg as resolveSshPublicIp,ci as resolveSshSettings,Hg as resolveSshSudo,Mg as resolveSshUser,oi as scanHostKey,Rc as scpUpload,yi as serverPublicIpv4,_g as sshBootstrapMarkerPath,xr as sshExec,Se as sshExecOrThrow,ht as sshHostKeyFingerprint,Mc as sshKnownHostsPath,zt as summarizeRemoteFailures,Pr as surfaceRemoteNotices,Oh as verifyHetznerHostOptimization,kh as verifyHetznerResize,Dc as waitForCloudInit,Yn as waitForSsh,se as wrapCloudInitUserData,ft as writeDriverState,Lh as writeResizeCheckpoint};

package/dist/index.js

@@ -1,4 +1,4 @@
-import{EI,vI,qd,nm,jd,zd,sn,Q,l,Kd,im,K,Wd,g,HA,b,Xe,Hi,on,w,be,Jd,GA,r,t,TI,wI,p,RI,DI,PI,NI,kI,sr,Xd,Gi,VA,BI,xI,xe,Ye,Yd,sm,om,OI,am,cm,dm,Bo,Zd,ce,an,Tt,xo,wt,Ce,qA,el,Oo,lm,um,gm,pm,tl,_I,W,C,jA,zA,mm,a,y,Ze,m,fm,et,J,Rt,LI,hm,X,rl,Oe,or,_o,de,nl,le,KA,Lo,Y,Z,_,Vi,D,ar,Dt,ee,e,cn,$I,Am,il,MI,FI,UI,QI,sl,HI,GI,VI,qI,jI,zI,KI,WI,JI,XI,YI,ZI,WA,JA,XA,YA,ZA,ey,ty,cr,ym,Sm,dr,qi,eb,Im,tb,rb,dn,nb,ib,sb,ob,ab,cb,ry,ny,iy,sy,oy,ji,db,$o,ay,bm,V,cy,tt,Mo,Pt,dy,Cm,ly,uy,gy,Em,q,lb,ub,gb,pb,py,mb,te,fb,hb,Ab,ol,al,my,vm,Tm,yb,Sb,Ib,bb,Cb,fy,cl,Eb,vb,Tb,wb,Rb,hy,Ay,Db,Pb,Nb,kb,Bb,xb,Ob,yy,_b,wm,dl,Lb,$b,Mb,Fb,Rm,Dm,Pm,Ub,ll,Sy,Iy,by,Cy,ul,Ey,Qb,Hb,Gb,Vb,qb,jb,zb,vy,Ty,wy,Ry,Nm,Kb,Wb,Jb,Xb,Yb,Zb,eC,tC,rC,Dy,Py,Ny,ky,nC,iC,km,sC,Bm,xm,Om,_m,oC,aC,cC,dC,_e,zi,lC,uC,gC,pC,mC,fC,hC,AC,By,yC,SC,Lm,$m,IC,bC,xy,CC,EC,vC,TC,wC,RC,DC,PC,NC,kC,BC,xC,OC,_C,LC,$C,MC,FC,UC,QC,HC,gl,Oy,pl,_y,ml,Ly,fl,$y,hl,My,lr,Fy,Al,Uy,Ki,Qy,yl,Hy,Sl,Gy,Mm,GC,Fm,VC,Il,Vy,ur,qy,Um,qC,bl,jy,Qm,jC,Hm,zC,Gm,KC,Cl,zy,Vm,WC,qm,JC,jm,XC,zm,YC,El,Ky,vl,Wy,Km,ZC,Wm,eE,Jm,tE,Xm,rE,Ym,nE,Zm,iE,Tl,Jy,ef,sE,tf,oE,rf,aE,nf,cE,sf,dE,of,lE,af,cf,df,lf,uf,uE,gf,gE,pf,pE,mf,mE,rt,ff,Xy,Fo,wl,ln,Yy,Wi,gr,Rl,Dl,Zy,eS,Pl,hf,Nl,Af,fE,hE,Uo,Qo,Ho,kl,un,Bl,xl,Ji,Go,Vo,yf,tS,rS,nS,AE,Sf,If,yE,iS,bf,sS,oS,aS,SE,Cf,gn,Ol,Ef,IE,cS,qo,jo,_l,vf,bE,Ll,dS,Tf,CE,wf,EE,Rf,vE}from"./chunk-18h7na1g.js";import{$l,N,Ml,zo,lS,Df,uS,gS,pS,mS,fS,hS,AS,yS}from"./chunk-6m8p1n88.js";import{Zo,Pf,ql,CS,es,jl,ea,Nf,kf,mn,ta,zl,it,Kl,Wl,Jl,ts,fn,Bf,st,Xl,ra,na,ia,Yl,Zl,eu,rs,sa,tu,hn,ns,oa,Nt,xf,ru,nu,Of,iu,aa,pr,su,ou,au,cu,ot,_f,du,mr,ca,da,la,is,ss,An,lu,os,ua,ga,yn,uu,Sn,Lf,$f,kt,In,pa,Mf,gu,pu,ma,mu,fu,hu,ES,ue,Au,vS,TS,as,cs,wS,Ee,Ff,Bt,Le,$e,xt,yu,Su,Iu,bu,Uf,Qf,fa,Hf,Gf,ha,Cu,Eu,Vf,ge,qf,vu,ve,Aa,at,Ot,_t,bn,ds,Tu,RS,jf,zf,Kf,Wf,ya,Sa,wu,Ia,Cn,ba,Ru,ls,Du,Ca,Ea,va,Ta,wa,Ra,Da,Pa,Pu,fr,Na,Nu,En,ku,ka,Ba,Bu,hr,xa,Oa,Jf,DS,us,PS,NS,kS,_a,La,xu,Xf,$a,vn,Ou,gs,_u,Lu,$u,Ma,Yf,Fa,Mu,Zf,Ua,eh,Tn,wn,Fu,ps,qu,Wu,Ju,Xu,Yu,Zu,fs,Ar,Ha,Rn,Dn,yr,ct,ch,Va,dh,lh,rg,qa,As,ng,ja,$t,Fe,ig,za,Ka,sg,Wa,Ja,Xa,Ya,og,ag,Nn,Za,ec,tc,rc,cg,ys,kn,Ss,nc}from"./chunk-5hgcr7r2.js";import{U,Vr,od,oo,d,kp,Bp}from"./chunk-cpba1hz2.js";import{It,sd,Ti,wi,Ri,Np}from"./chunk-nmnf1ha6.js";import{Hh,Gh,Vh,up,gp,pp,qh,mp,fp,jh,zh,hp,Kh,Wh,nd,Ap,Jh,Xh,yp,Yh,Zh,eA,tA,rA,nA,iA,vi,id,Sp,Ip,bp,Cp,Ep,vp,Tp,wp,Rp,Dp,Pp,sA,oA,aA,cA,dA,lA,uA}from"./chunk-nnnhq6sx.js";import{Ke,ad,Ie,Yt,cd,x,Zt,bt,dd,ao,mA,xp,ld,s,Di,co,qr,ud,gd,jr,fA,pd,SI,II,lo,bI,CI,md,fd,Pi,uo,ae,c,go,We,zr,hA,AA,hd,yA,po,SA,IA,mo,Ad,Kr,fo,bA,er,yd,Op,tr,Wr,CA,ho,EA,O,vA,Sd,_p,Ao,TA,wA,RA,Id,Ni,yo,bd,rr,Ct,DA,Jr,PA,Cd,Lp,$p,So,Ed,vd,Et,Mp,ki,Td,Io,Xr,Fp,Bi,wd,Rd,xi,Up,Dd,Pd,Nd,kd,bo,Qp,Hp,NA,Gp,Bd,Oi,Vp,qp,Co,Yr,Eo,vo,To,xd,jp,Od,wo,kA,nr,BA,_d,Zr,Ld,xA,$d,zp,_i,en,Ro,Li,Je,OA,Kp,Wp,ir,Md,Fd,Ud,$i,Mi,Fi,_A,LA,vt,Do,$A,tn,Jp,Po,MA,Xp,Yp,Zp,FA,em,tm,UA,i,QA,Ui,No,ko}from"./chunk-zbx9yehq.js";import{n}from"./chunk-ca191b00.js";import{Re,gt,Gn}from"./chunk-0qgfe5ff.js";import{o}from"./chunk-j99nkav5.js";import{Te,ws,Rs,ug,cc,dc,Ds,lc,dt,re,lt,pe,v,we,_n,uc,Ue,gc,Ln,$n,Mn,Mt,Ft,Ut,Un,Ir,pc,br,Cr,ut,Qn,fc,Qt,Er,Hn,Ac,hg,Ag,yc,vr}from"./chunk-jytama4e.js";import{pt,he,Ge,yg,Ht,Ic,bc,Gt,H,Vn,Vt,qt,qn,Bs,xs,Tr,wr,jn,Rr,Os,_s,Ls,$s,ie,Ms,Fs,Us,Qs,Ae,Hs,Gs,Vs,k,Cc,zn,Ec,ye,Dr}from"./chunk-m9r0a1v9.js";import{ne}from"./chunk-4abbccq7.js";import{Sg,vc,Ig,De,Tc,Kn,bg,wc,Cg,Eg,Eh,Jn,js,M,Br,Xn,xr,Se,Rc,Yn,Dc,_r,ei,zs,ti,ri,ni,ii,Lr,xc,Ve,se,qe,je,ft,Pe,$r,Ne,ai,ci,di,li,ui,gi,pi,Mr,F,Js,Kg,Uc,fi,hi,Ai,yi,zc,Xs,Kc,Jt,Si,Ys,Zs,Wc,Ii,Jc}from"./chunk-85fyadq0.js";import{to,no,io,B,ke}from"./chunk-fqgvackc.js";import{Fl,Ko,Xi,Yi,Wo,Ul,Ql,Zi,Jo,Xo,Gl,Vl,Yo}from"./chunk-ffyx50xx.js";import{ic,Bn,xn,Is,bs,Cs,Es,sc,oc}from"./chunk-8b2mxhcm.js";import{ac}from"./chunk-a8hs75xd.js";import{Sc,Qe,S}from"./chunk-0cz2s19h.js";import{He}from"./chunk-qcj3hkba.js";import{I}from"./chunk-jtvw9d4x.js";import{oe,bi,eo,Xc,Ci,sp}from"./chunk-r5mk071y.js";import{Ur,Be}from"./chunk-thdfk76k.js";import{h}from"./chunk-zf5wdx6v.js";import{Qd,rn,Hd,Gd,Vd,Qi,rm,nn}from"./chunk-3ncnrrvm.js";import{SS,nt}from"./chunk-erfh93dq.js";var Uh="https://api.machines.dev/v1";class Ws extends Error{status;path;constructor(u,f,R){super(u);this.status=f;this.path=R;this.name="FlyApiError"}}function Qc(u){let f=u.ip.includes(":");if(f&&u.ip.startsWith("fdaa:"))return"private_v6";if(u.shared)return"shared_v4";return f?"v6":"v4"}class mg{token;fetch;constructor(u){if(!u.token)throw Error("Fly.io needs an API token: set FLY_API_TOKEN (`fly tokens create deploy` makes one scoped to an app).");this.token=u.token,this.fetch=u.fetch??fetch}async rest(u,f,R={}){let A=new URL(`https://api.machines.dev/v1${f}`);for(let[L,z]of Object.entries(R.query??{}))A.searchParams.set(L,z);let T=await this.fetch(A,{method:u,headers:{Authorization:`Bearer ${this.token}`,...R.body!==void 0?{"Content-Type":"application/json"}:{},...R.headers},body:R.body===void 0?void 0:JSON.stringify(R.body)});if(T.status===404&&R.notFound==="null")return null;let E=await T.text(),P=E?gg(E):void 0;if(!T.ok){let L=typeof P==="object"&&P&&"error"in P?String(P.error):E||T.statusText;throw new Ws(`Fly.io ${u} ${f} failed (${T.status}): ${L}`,T.status,f)}return P}getApp(u){return this.rest("GET",`/apps/${encodeURIComponent(u)}`,{notFound:"null"})}createApp(u,f){return this.rest("POST","/apps",{body:{app_name:u,org_slug:f}})}async listMachines(u){return await this.rest("GET",`/apps/${encodeURIComponent(u)}/machines`)??[]}createMachine(u,f){return this.rest("POST",`/apps/${encodeURIComponent(u)}/machines`,{body:f})}updateMachine(u,f,R,A){return this.rest("POST",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(f)}`,{body:R,headers:{"fly-machine-lease-nonce":A}})}async acquireLease(u,f,R=120){let T=(await this.rest("POST",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(f)}/lease`,{body:{ttl:R}})).data?.nonce;if(!T)throw new Ws(`Fly.io gave no lease nonce for Machine ${f}`,200,`/machines/${f}/lease`);return T}async releaseLease(u,f,R){await this.rest("DELETE",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(f)}/lease`,{headers:{"fly-machine-lease-nonce":R}})}async waitForState(u,f,R,A={}){await this.rest("GET",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(f)}/wait`,{query:{state:R,timeout:String(A.timeoutSeconds??60),...A.instanceId?{instance_id:A.instanceId}:{}}})}async listVolumes(u){return await this.rest("GET",`/apps/${encodeURIComponent(u)}/volumes`)??[]}createVolume(u,f){return this.rest("POST",`/apps/${encodeURIComponent(u)}/volumes`,{body:{...f,encrypted:!0}})}async setSecrets(u,f){return(await this.rest("POST",`/apps/${encodeURIComponent(u)}/secrets`,{body:{values:f}})).version}async listIpAssignments(u){return(await this.rest("GET",`/apps/${encodeURIComponent(u)}/ip_assignments`)).ips??[]}async assignIp(u,f){let R=await this.rest("POST",`/apps/${encodeURIComponent(u)}/ip_assignments`,{body:{type:f}});if(!R.ip)throw new Ws(`Fly.io assigned no ${f} address to ${u}`,200,`/apps/${u}/ip_assignments`);return{ip:R.ip,shared:R.shared??f==="shared_v4",region:R.region}}async requestCertificate(u,f){return this.rest("POST",`/apps/${encodeURIComponent(u)}/certificates/acme`,{body:{hostname:f}})}}function gg(u){try{return JSON.parse(u)}catch{return}}var Lc="ts-cloud-role";function $S(u,f){let R=u.fly??{},A=R.app??`${u.project.slug}-${f.environment}`;if(!/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/.test(A))throw Error(`"${A}" is not a valid Fly app name: lowercase letters, digits and dashes, 3 to 63 characters.`);let T=R.internalPort??3000,E=R.count??1;if(!Number.isInteger(E)||E<1)throw Error(`fly.count must be a whole number of at least 1, got ${E}.`);return{app:A,org:R.org??"personal",image:f.image,regions:R.regions?.length?R.regions:["iad"],count:E,internalPort:T,healthPath:R.healthPath??"/",vm:{cpuKind:R.vm?.cpuKind??"shared",cpus:R.vm?.cpus??1,memoryMb:R.vm?.memoryMb??512},...R.volume?{volume:{name:R.volume.name??"data",sizeGb:R.volume.sizeGb,path:R.volume.path}}:{},autoStop:R.autoStop??!1,env:{...f.env,PORT:String(T)},secrets:f.secrets??{},hostnames:R.hostnames??[],release:f.release}}function fg(u){return{image:u.image,env:u.env,guest:{cpu_kind:u.vm.cpuKind,cpus:u.vm.cpus,memory_mb:u.vm.memoryMb},services:[{protocol:"tcp",internal_port:u.internalPort,ports:[{port:80,handlers:["http"],force_https:!0},{port:443,handlers:["tls","http"]}],autostop:u.autoStop?"stop":"off",autostart:!0,...u.autoStop?{min_machines_running:0}:{},checks:[{type:"http",method:"GET",path:u.healthPath,interval:"15s",timeout:"5s",grace_period:"10s"}]}],restart:{policy:"on-failure",max_retries:10},metadata:{[Lc]:"app","ts-cloud-release":u.release}}}async function IS(u,f,R=()=>{}){let A=!1;if(!await u.getApp(f.app))R(`Creating Fly app ${f.app} in ${f.org}`),await u.createApp(f.app,f.org),A=!0;let T;if(Object.keys(f.secrets).length>0)T=await u.setSecrets(f.app,f.secrets),R(`Set ${Object.keys(f.secrets).length} secret(s) (version ${T})`);let E=await u.listIpAssignments(f.app),P=new Set(E.map(Qc));if(!P.has("v6"))E.push(await u.assignIp(f.app,"v6")),R("Assigned a dedicated IPv6");if(!P.has("v4")&&!P.has("shared_v4"))E.push(await u.assignIp(f.app,"shared_v4")),R("Assigned a shared IPv4");let L=fg(f),z=(await u.listMachines(f.app)).filter((Me)=>{let ze=Me.config?.metadata??{};if(ze[Lc])return ze[Lc]==="app";return!ze.fly_process_group||ze.fly_process_group==="app"}),fe=f.volume?await u.listVolumes(f.app):[],me=[],At=[],Lt=new Set;for(let Me of f.regions){let ze=z.filter((j)=>j.region===Me).sort((j,yt)=>j.id.localeCompare(yt.id));for(let j=0;j<f.count;j++){let yt=ze[j];if(yt){Lt.add(yt.id),await Rg(u,f.app,yt,L,T),At.push(yt.id),R(`Updated ${yt.id} (${Me}) to ${f.image}`);continue}let G=f.volume?[{volume:(await Tg(u,f,Me,fe)).id,path:f.volume.path}]:void 0,ht=await u.createMachine(f.app,{region:Me,name:`${f.app}-${Me}-${j+1}`,config:{...L,...G?{mounts:G}:{}},...T!==void 0?{min_secrets_version:T}:{}});await u.waitForState(f.app,ht.id,"started",{instanceId:ht.instance_id}),me.push(ht.id),R(`Created ${ht.id} in ${Me}`)}}let mt=[];for(let Me of f.hostnames)mt.push(await u.requestCertificate(f.app,Me));return{app:f.app,url:`https://${f.app}.fly.dev`,createdApp:A,created:me,updated:At,untouched:z.filter((Me)=>!Lt.has(Me.id)).map((Me)=>Me.id),ips:E,certificates:mt}}async function Rg(u,f,R,A,T){let E=await u.acquireLease(f,R.id);try{let P=await u.updateMachine(f,R.id,{config:{...A,...R.config?.mounts?.length?{mounts:R.config.mounts}:{}},...T!==void 0?{min_secrets_version:T}:{}},E);await u.waitForState(f,R.id,"started",{instanceId:P.instance_id})}finally{await u.releaseLease(f,R.id,E)}}async function Tg(u,f,R,A){let T=A.find((P)=>P.region===R&&P.name===f.volume.name&&!P.attached_machine_id);if(T)return T.attached_machine_id="pending",T;let E=await u.createVolume(f.app,{name:f.volume.name,region:R,size_gb:f.volume.sizeGb});return A.push({...E,attached_machine_id:"pending"}),E}import{createHmac as Hl,createSign as Pg,timingSafeEqual as $g}from"node:crypto";function ro(u){let f=u instanceof Date?u.getTime():u;if(!Number.isFinite(f))throw TypeError("Media access timestamp must be finite");return Math.floor(f/1000)}function Vu(u){return Buffer.from(u).toString("base64").replaceAll("+","-").replaceAll("=","_").replaceAll("/","~")}function wg(u){return Buffer.from(u).toString("base64url")}function zu(u,f=!1){if(!u||/[\r\n]/.test(u))throw TypeError("Media resource is invalid");let R=f?u.replaceAll("*","wildcard"):u,A=new URL(R);if(!["http:","https:"].includes(A.protocol))throw TypeError("Media resource must use HTTP or HTTPS");if(!f&&u.includes("*"))throw TypeError("Canned policies cannot contain wildcards")}function Hu(u,f){let R=Pg("RSA-SHA1");return R.update(u),R.end(),Vu(R.sign(f))}function Uu(u){zu(u.resource,!0);let R={DateLessThan:{"AWS:EpochTime":ro(u.expiresAt)}};if(u.activeAt!==void 0)R.DateGreaterThan={"AWS:EpochTime":ro(u.activeAt)};if(u.ipAddress)R.IpAddress={"AWS:SourceIp":u.ipAddress};return JSON.stringify({Statement:[{Resource:u.resource,Condition:R}]})}function MS(u,f,R){zu(u);let A=ro(f),T=u.includes("?")?"&":"?",E=Uu({resource:u,expiresAt:f}),P=Hu(E,R.privateKey);return`${u}${T}Expires=${A}&Signature=${encodeURIComponent(P)}&Key-Pair-Id=${encodeURIComponent(R.keyPairId)}`}function BS(u,f){let R=Uu(u);return{"CloudFront-Key-Pair-Id":f.keyPairId,"CloudFront-Policy":Vu(Buffer.from(R)),"CloudFront-Signature":Hu(R,f.privateKey)}}function WS(u){if(!u.resource||/[\r\n]/.test(u.resource))throw TypeError("Media resource is invalid");let f=wg(Buffer.from(JSON.stringify({resource:u.resource,expiresAt:ro(u.expiresAt),...u.keyId?{keyId:u.keyId}:{},...u.audience?{audience:u.audience}:{}}))),R=Hl("sha256",u.secret).update(f).digest("base64url");return`${f}.${R}`}function VS(u,f){let[R,A,T]=u.split(".");if(!R||!A||T)return null;let E=Hl("sha256",f.secret).update(R).digest(),P;try{P=Buffer.from(A,"base64url")}catch{return null}if(E.length!==P.length||!$g(E,P))return null;try{let L=JSON.parse(Buffer.from(R,"base64url").toString("utf8")),z=ro(f.now??Date.now());if(!L.resource||!Number.isSafeInteger(L.expiresAt)||L.expiresAt<=z)return null;if(f.resource&&L.resource!==f.resource)return null;if(f.audience&&L.audience!==f.audience)return null;return L}catch{return null}}function zS(u,f=!1){let R=new URL(u,"https://media.invalid").pathname.toLowerCase(),A=/\.(?:m3u8|mpd|vtt|json)$/.test(R),T=/\.(?:key|license)$/.test(R)||R.includes("/keys/")||R.includes("/licenses/");return{"Accept-Ranges":"bytes","Cache-Control":f&&(A||T)?"private, no-store":A?"public, max-age=5, s-maxage=30, stale-while-revalidate=30":"public, max-age=31536000, immutable","Cross-Origin-Resource-Policy":"cross-origin","X-Content-Type-Options":"nosniff"}}function HS(u){if(!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(u.bucket))throw TypeError("Media bucket is invalid");if(!/^[a-z0-9-]+$/.test(u.region))throw TypeError("Media bucket region is invalid");let f=u.prefix?`/${u.prefix.replace(/^\/+|\/+$/g,"")}`:"",R=u.protected??!1,A="public, max-age=31536000, immutable",T=R?"private, no-store":"public, max-age=5, s-maxage=30, stale-while-revalidate=30";return{originDomain:`${u.bucket}.s3.${u.region}.amazonaws.com`,originPath:f,domain:u.domain,trustedKeyGroupIds:[...new Set(u.trustedKeyGroupIds??[])],behaviors:[{pathPattern:"*.m3u8",cacheControl:T,compress:!0,signed:R},{pathPattern:"*.mpd",cacheControl:T,compress:!0,signed:R},{pathPattern:"*.vtt",cacheControl:T,compress:!0,signed:R},{pathPattern:"*",cacheControl:A,compress:!1,signed:R}],responseHeaders:{"Access-Control-Allow-Headers":"Range, If-Range","Access-Control-Allow-Methods":"GET, HEAD, OPTIONS","Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":"Accept-Ranges, Content-Length, Content-Range, ETag","X-Content-Type-Options":"nosniff"}}}class Dg{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;storageFailoverReplicas=[];constructor(u){this.config=u.config,this.environment=u.environment,this.builder=new Jd(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let f=this.config.environments[this.environment]?.infrastructure;if(!f)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...f,compute:{...this.config.infrastructure?.compute,...f.compute},storage:{...this.config.infrastructure?.storage,...f.storage},functions:{...this.config.infrastructure?.functions,...f.functions},servers:{...this.config.infrastructure?.servers,...f.servers},databases:{...this.config.infrastructure?.databases,...f.databases},cdn:{...this.config.infrastructure?.cdn,...f.cdn},sftp:f.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...f.queues},redirects:{...this.config.infrastructure?.redirects,...f.redirects},realtime:{...this.config.infrastructure?.realtime,...f.realtime},cache:{...this.config.infrastructure?.cache,...f.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...f.fileSystem},email:{...this.config.infrastructure?.email,...f.email},search:{...this.config.infrastructure?.search,...f.search},ai:{...this.config.infrastructure?.ai,...f.ai}}}}shouldDeploy(u){if(u.environments&&!u.environments.includes(this.environment))return!1;if(u.requiresFeatures){let f=this.config.features||{};if(!u.requiresFeatures.every((A)=>f[A]===!0))return!1}if(u.regions){let f=this.config.environments[this.environment]?.region||this.config.project.region;if(!u.regions.includes(f))return!1}if(u.condition&&typeof u.condition==="function")return u.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let u=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,f=Number(u||3008);return Number.isFinite(f)&&f>0?f:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(u,f){return u==="public"||f.routeCompute===!0}storageBucketName(u,f,R){return this.mergedConfig.infrastructure?.storage?.[R]?.bucket??`${u}-${f}-${R}`}fileSystemLogicalId(u,f,R){return t(r({slug:`${u}-${R}`,environment:f,resourceType:"efs"}))}resolveSftpStorage(u,f,R){let A=u.storage;if(A?.type==="efs"&&A.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[A.fileSystem])throw Error(`sftp: storage.fileSystem "${A.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(f,R,A.fileSystem)},posixProfile:A.posixProfile}}if(A?.type==="s3"&&A.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[A.storageBucket])throw Error(`sftp: storage.storageBucket "${A.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(f,R,A.storageBucket)}}return}resolveComputeCachePathPatterns(u){if(u&&u.length>0)return u;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(u,f){return{PathPattern:u,TargetOriginId:f,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(u,f,R,A,T,E){let P=this.serverEipLogicalIds.get("app"),L=this.serverEipLogicalIds.get("appInstance");if(!P)return;let z=`EC2-${A}-${T}-api`,fe=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",me=fe==="us-east-1"?".compute-1.amazonaws.com":`.${fe}.compute.amazonaws.com`,At={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:P}]}]},me]]},Lt=this.resolveApiOriginPort();if(u.push({Id:z,DomainName:At,CustomOriginConfig:{HTTPPort:Lt,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),R.push(P),L)R.push(L);for(let mt of E)f.push(this.createComputeCacheBehavior(mt,z))}buildCaddyfile(u){let f=u.filter(([,T])=>typeof T.domain==="string"&&T.domain&&typeof T.port==="number");if(f.length===0)return;let R=new Map;for(let[,T]of f){let E=R.get(T.domain)??[];E.push({port:T.port,path:T.path}),R.set(T.domain,E)}let A=[];for(let[T,E]of R){let L=[...E].sort((z,fe)=>{let me=!z.path||z.path==="/",At=!fe.path||fe.path==="/";if(me&&!At)return 1;if(!me&&At)return-1;return(fe.path?.length??0)-(z.path?.length??0)}).map((z)=>{let fe=!z.path||z.path==="/",me=`reverse_proxy localhost:${z.port}`;return fe?`  handle {
+import{EI,vI,qd,nm,jd,zd,sn,Q,l,Kd,im,K,Wd,g,HA,b,Xe,Hi,on,w,be,Jd,GA,r,t,TI,wI,p,RI,DI,PI,NI,kI,sr,Xd,Gi,VA,BI,xI,xe,Ye,Yd,sm,om,OI,am,cm,dm,Bo,Zd,ce,an,Tt,xo,wt,Ce,qA,el,Oo,lm,um,gm,pm,tl,_I,W,C,jA,zA,mm,a,y,Ze,m,fm,et,J,Rt,LI,hm,X,rl,Oe,or,_o,de,nl,le,KA,Lo,Y,Z,_,Vi,D,ar,Dt,ee,e,cn,$I,Am,il,MI,FI,UI,QI,sl,HI,GI,VI,qI,jI,zI,KI,WI,JI,XI,YI,ZI,WA,JA,XA,YA,ZA,ey,ty,cr,ym,Sm,dr,qi,eb,Im,tb,rb,dn,nb,ib,sb,ob,ab,cb,ry,ny,iy,sy,oy,ji,db,$o,ay,bm,V,cy,tt,Mo,Pt,dy,Cm,ly,uy,gy,Em,q,lb,ub,gb,pb,py,mb,te,fb,hb,Ab,ol,al,my,vm,Tm,yb,Sb,Ib,bb,Cb,fy,cl,Eb,vb,Tb,wb,Rb,hy,Ay,Db,Pb,Nb,kb,Bb,xb,Ob,yy,_b,wm,dl,Lb,$b,Mb,Fb,Rm,Dm,Pm,Ub,ll,Sy,Iy,by,Cy,ul,Ey,Qb,Hb,Gb,Vb,qb,jb,zb,vy,Ty,wy,Ry,Nm,Kb,Wb,Jb,Xb,Yb,Zb,eC,tC,rC,Dy,Py,Ny,ky,nC,iC,km,sC,Bm,xm,Om,_m,oC,aC,cC,dC,_e,zi,lC,uC,gC,pC,mC,fC,hC,AC,By,yC,SC,Lm,$m,IC,bC,xy,CC,EC,vC,TC,wC,RC,DC,PC,NC,kC,BC,xC,OC,_C,LC,$C,MC,FC,UC,QC,HC,gl,Oy,pl,_y,ml,Ly,fl,$y,hl,My,lr,Fy,Al,Uy,Ki,Qy,yl,Hy,Sl,Gy,Mm,GC,Fm,VC,Il,Vy,ur,qy,Um,qC,bl,jy,Qm,jC,Hm,zC,Gm,KC,Cl,zy,Vm,WC,qm,JC,jm,XC,zm,YC,El,Ky,vl,Wy,Km,ZC,Wm,eE,Jm,tE,Xm,rE,Ym,nE,Zm,iE,Tl,Jy,ef,sE,tf,oE,rf,aE,nf,cE,sf,dE,of,lE,af,cf,df,lf,uf,uE,gf,gE,pf,pE,mf,mE,rt,ff,Xy,Fo,wl,ln,Yy,Wi,gr,Rl,Dl,Zy,eS,Pl,hf,Nl,Af,fE,hE,Uo,Qo,Ho,kl,un,Bl,xl,Ji,Go,Vo,yf,tS,rS,nS,AE,Sf,If,yE,iS,bf,sS,oS,aS,SE,Cf,gn,Ol,Ef,IE,cS,qo,jo,_l,vf,bE,Ll,dS,Tf,CE,wf,EE,Rf,vE}from"./chunk-prtvb2fh.js";import{$l,N,Ml,zo,lS,Df,uS,gS,pS,mS,fS,hS,AS,yS}from"./chunk-6m8p1n88.js";import{Zo,Pf,ql,CS,es,jl,ea,Nf,kf,mn,ta,zl,it,Kl,Wl,Jl,ts,fn,Bf,st,Xl,ra,na,ia,Yl,Zl,eu,rs,sa,tu,hn,ns,oa,Nt,xf,ru,nu,Of,iu,aa,pr,su,ou,au,cu,ot,_f,du,mr,ca,da,la,is,ss,An,lu,os,ua,ga,yn,uu,Sn,Lf,$f,kt,In,pa,Mf,gu,pu,ma,mu,fu,hu,ES,ue,Au,vS,TS,as,cs,wS,Ee,Ff,Bt,Le,$e,xt,yu,Su,Iu,bu,Uf,Qf,fa,Hf,Gf,ha,Cu,Eu,Vf,ge,qf,vu,ve,Aa,at,Ot,_t,bn,ds,Tu,RS,jf,zf,Kf,Wf,ya,Sa,wu,Ia,Cn,ba,Ru,ls,Du,Ca,Ea,va,Ta,wa,Ra,Da,Pa,Pu,fr,Na,Nu,En,ku,ka,Ba,Bu,hr,xa,Oa,Jf,DS,us,PS,NS,kS,_a,La,xu,Xf,$a,vn,Ou,gs,_u,Lu,$u,Ma,Yf,Fa,Mu,Zf,Ua,eh,Tn,wn,Fu,ps,qu,Wu,Ju,Xu,Yu,Zu,fs,Ar,Ha,Rn,Dn,yr,ct,ch,Va,dh,lh,rg,qa,As,ng,ja,$t,Fe,ig,za,Ka,sg,Wa,Ja,Xa,Ya,og,ag,Nn,Za,ec,tc,rc,cg,ys,kn,Ss,nc}from"./chunk-53kyxata.js";import{U,Vr,od,oo,d,kp,Bp}from"./chunk-pz33w7gv.js";import{It,sd,Ti,wi,Ri,Np}from"./chunk-x4qye2rc.js";import{Hh,Gh,Vh,up,gp,pp,qh,mp,fp,jh,zh,hp,Kh,Wh,nd,Ap,Jh,Xh,yp,Yh,Zh,eA,tA,rA,nA,iA,vi,id,Sp,Ip,bp,Cp,Ep,vp,Tp,wp,Rp,Dp,Pp,sA,oA,aA,cA,dA,lA,uA}from"./chunk-qcv4twc6.js";import{Ke,ad,Ie,Yt,cd,x,Zt,bt,dd,ao,mA,xp,ld,s,Di,co,qr,ud,gd,jr,fA,pd,SI,II,lo,bI,CI,md,fd,Pi,uo,ae,c,go,We,zr,hA,AA,hd,yA,po,SA,IA,mo,Ad,Kr,fo,bA,er,yd,Op,tr,Wr,CA,ho,EA,O,vA,Sd,_p,Ao,TA,wA,RA,Id,Ni,yo,bd,rr,Ct,DA,Jr,PA,Cd,Lp,$p,So,Ed,vd,Et,Mp,ki,Td,Io,Xr,Fp,Bi,wd,Rd,xi,Up,Dd,Pd,Nd,kd,bo,Qp,Hp,NA,Gp,Bd,Oi,Vp,qp,Co,Yr,Eo,vo,To,xd,jp,Od,wo,kA,nr,BA,_d,Zr,Ld,xA,$d,zp,_i,en,Ro,Li,Je,OA,Kp,Wp,ir,Md,Fd,Ud,$i,Mi,Fi,_A,LA,vt,Do,$A,tn,Jp,Po,MA,Xp,Yp,Zp,FA,em,tm,UA,i,QA,Ui,No,ko}from"./chunk-6gnmrtp9.js";import{n}from"./chunk-ca191b00.js";import{Re,gt,Gn}from"./chunk-0qgfe5ff.js";import{o}from"./chunk-j99nkav5.js";import{Te,ws,Rs,ug,cc,dc,Ds,lc,dt,re,lt,pe,v,we,_n,uc,Ue,gc,Ln,$n,Mn,Mt,Ft,Ut,Un,Ir,pc,br,Cr,ut,Qn,fc,Qt,Er,Hn,Ac,hg,Ag,yc,vr}from"./chunk-jytama4e.js";import{pt,he,Ge,yg,Ht,Ic,bc,Gt,H,Vn,Vt,qt,qn,Bs,xs,Tr,wr,jn,Rr,Os,_s,Ls,$s,ie,Ms,Fs,Us,Qs,Ae,Hs,Gs,Vs,k,Cc,zn,Ec,ye,Dr}from"./chunk-m9r0a1v9.js";import{ne}from"./chunk-4abbccq7.js";import{Sg,vc,Ig,De,Tc,Kn,bg,wc,Cg,Eg,Eh,Jn,js,M,Br,Xn,xr,Se,Rc,Yn,Dc,_r,ei,zs,ti,ri,ni,ii,Lr,xc,Ve,se,qe,je,ft,Pe,$r,Ne,ai,ci,di,li,ui,gi,pi,Mr,F,Js,Kg,Uc,fi,hi,Ai,yi,zc,Xs,Kc,Jt,Si,Ys,Zs,Wc,Ii,Jc}from"./chunk-dw0cvqdr.js";import{to,no,io,B,ke}from"./chunk-xgc6hskd.js";import{Fl,Ko,Xi,Yi,Wo,Ul,Ql,Zi,Jo,Xo,Gl,Vl,Yo}from"./chunk-ffyx50xx.js";import{ic,Bn,xn,Is,bs,Cs,Es,sc,oc}from"./chunk-8b2mxhcm.js";import{ac}from"./chunk-p101nhg2.js";import{Sc,Qe,S}from"./chunk-0cz2s19h.js";import{He}from"./chunk-qcj3hkba.js";import{I}from"./chunk-jtvw9d4x.js";import{oe,bi,eo,Xc,Ci,sp}from"./chunk-r5mk071y.js";import{Ur,Be}from"./chunk-thdfk76k.js";import{h}from"./chunk-zf5wdx6v.js";import{Qd,rn,Hd,Gd,Vd,Qi,rm,nn}from"./chunk-3ncnrrvm.js";import{SS,nt}from"./chunk-erfh93dq.js";var Uh="https://api.machines.dev/v1";class Ws extends Error{status;path;constructor(u,f,R){super(u);this.status=f;this.path=R;this.name="FlyApiError"}}function Qc(u){let f=u.ip.includes(":");if(f&&u.ip.startsWith("fdaa:"))return"private_v6";if(u.shared)return"shared_v4";return f?"v6":"v4"}class mg{token;fetch;constructor(u){if(!u.token)throw Error("Fly.io needs an API token: set FLY_API_TOKEN (`fly tokens create deploy` makes one scoped to an app).");this.token=u.token,this.fetch=u.fetch??fetch}async rest(u,f,R={}){let A=new URL(`https://api.machines.dev/v1${f}`);for(let[L,z]of Object.entries(R.query??{}))A.searchParams.set(L,z);let T=await this.fetch(A,{method:u,headers:{Authorization:`Bearer ${this.token}`,...R.body!==void 0?{"Content-Type":"application/json"}:{},...R.headers},body:R.body===void 0?void 0:JSON.stringify(R.body)});if(T.status===404&&R.notFound==="null")return null;let E=await T.text(),P=E?gg(E):void 0;if(!T.ok){let L=typeof P==="object"&&P&&"error"in P?String(P.error):E||T.statusText;throw new Ws(`Fly.io ${u} ${f} failed (${T.status}): ${L}`,T.status,f)}return P}getApp(u){return this.rest("GET",`/apps/${encodeURIComponent(u)}`,{notFound:"null"})}createApp(u,f){return this.rest("POST","/apps",{body:{app_name:u,org_slug:f}})}async listMachines(u){return await this.rest("GET",`/apps/${encodeURIComponent(u)}/machines`)??[]}createMachine(u,f){return this.rest("POST",`/apps/${encodeURIComponent(u)}/machines`,{body:f})}updateMachine(u,f,R,A){return this.rest("POST",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(f)}`,{body:R,headers:{"fly-machine-lease-nonce":A}})}async acquireLease(u,f,R=120){let T=(await this.rest("POST",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(f)}/lease`,{body:{ttl:R}})).data?.nonce;if(!T)throw new Ws(`Fly.io gave no lease nonce for Machine ${f}`,200,`/machines/${f}/lease`);return T}async releaseLease(u,f,R){await this.rest("DELETE",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(f)}/lease`,{headers:{"fly-machine-lease-nonce":R}})}async waitForState(u,f,R,A={}){await this.rest("GET",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(f)}/wait`,{query:{state:R,timeout:String(A.timeoutSeconds??60),...A.instanceId?{instance_id:A.instanceId}:{}}})}async listVolumes(u){return await this.rest("GET",`/apps/${encodeURIComponent(u)}/volumes`)??[]}createVolume(u,f){return this.rest("POST",`/apps/${encodeURIComponent(u)}/volumes`,{body:{...f,encrypted:!0}})}async setSecrets(u,f){return(await this.rest("POST",`/apps/${encodeURIComponent(u)}/secrets`,{body:{values:f}})).version}async listIpAssignments(u){return(await this.rest("GET",`/apps/${encodeURIComponent(u)}/ip_assignments`)).ips??[]}async assignIp(u,f){let R=await this.rest("POST",`/apps/${encodeURIComponent(u)}/ip_assignments`,{body:{type:f}});if(!R.ip)throw new Ws(`Fly.io assigned no ${f} address to ${u}`,200,`/apps/${u}/ip_assignments`);return{ip:R.ip,shared:R.shared??f==="shared_v4",region:R.region}}async requestCertificate(u,f){return this.rest("POST",`/apps/${encodeURIComponent(u)}/certificates/acme`,{body:{hostname:f}})}}function gg(u){try{return JSON.parse(u)}catch{return}}var Lc="ts-cloud-role";function $S(u,f){let R=u.fly??{},A=R.app??`${u.project.slug}-${f.environment}`;if(!/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/.test(A))throw Error(`"${A}" is not a valid Fly app name: lowercase letters, digits and dashes, 3 to 63 characters.`);let T=R.internalPort??3000,E=R.count??1;if(!Number.isInteger(E)||E<1)throw Error(`fly.count must be a whole number of at least 1, got ${E}.`);return{app:A,org:R.org??"personal",image:f.image,regions:R.regions?.length?R.regions:["iad"],count:E,internalPort:T,healthPath:R.healthPath??"/",vm:{cpuKind:R.vm?.cpuKind??"shared",cpus:R.vm?.cpus??1,memoryMb:R.vm?.memoryMb??512},...R.volume?{volume:{name:R.volume.name??"data",sizeGb:R.volume.sizeGb,path:R.volume.path}}:{},autoStop:R.autoStop??!1,env:{...f.env,PORT:String(T)},secrets:f.secrets??{},hostnames:R.hostnames??[],release:f.release}}function fg(u){return{image:u.image,env:u.env,guest:{cpu_kind:u.vm.cpuKind,cpus:u.vm.cpus,memory_mb:u.vm.memoryMb},services:[{protocol:"tcp",internal_port:u.internalPort,ports:[{port:80,handlers:["http"],force_https:!0},{port:443,handlers:["tls","http"]}],autostop:u.autoStop?"stop":"off",autostart:!0,...u.autoStop?{min_machines_running:0}:{},checks:[{type:"http",method:"GET",path:u.healthPath,interval:"15s",timeout:"5s",grace_period:"10s"}]}],restart:{policy:"on-failure",max_retries:10},metadata:{[Lc]:"app","ts-cloud-release":u.release}}}async function IS(u,f,R=()=>{}){let A=!1;if(!await u.getApp(f.app))R(`Creating Fly app ${f.app} in ${f.org}`),await u.createApp(f.app,f.org),A=!0;let T;if(Object.keys(f.secrets).length>0)T=await u.setSecrets(f.app,f.secrets),R(`Set ${Object.keys(f.secrets).length} secret(s) (version ${T})`);let E=await u.listIpAssignments(f.app),P=new Set(E.map(Qc));if(!P.has("v6"))E.push(await u.assignIp(f.app,"v6")),R("Assigned a dedicated IPv6");if(!P.has("v4")&&!P.has("shared_v4"))E.push(await u.assignIp(f.app,"shared_v4")),R("Assigned a shared IPv4");let L=fg(f),z=(await u.listMachines(f.app)).filter((Me)=>{let ze=Me.config?.metadata??{};if(ze[Lc])return ze[Lc]==="app";return!ze.fly_process_group||ze.fly_process_group==="app"}),fe=f.volume?await u.listVolumes(f.app):[],me=[],At=[],Lt=new Set;for(let Me of f.regions){let ze=z.filter((j)=>j.region===Me).sort((j,yt)=>j.id.localeCompare(yt.id));for(let j=0;j<f.count;j++){let yt=ze[j];if(yt){Lt.add(yt.id),await Rg(u,f.app,yt,L,T),At.push(yt.id),R(`Updated ${yt.id} (${Me}) to ${f.image}`);continue}let G=f.volume?[{volume:(await Tg(u,f,Me,fe)).id,path:f.volume.path}]:void 0,ht=await u.createMachine(f.app,{region:Me,name:`${f.app}-${Me}-${j+1}`,config:{...L,...G?{mounts:G}:{}},...T!==void 0?{min_secrets_version:T}:{}});await u.waitForState(f.app,ht.id,"started",{instanceId:ht.instance_id}),me.push(ht.id),R(`Created ${ht.id} in ${Me}`)}}let mt=[];for(let Me of f.hostnames)mt.push(await u.requestCertificate(f.app,Me));return{app:f.app,url:`https://${f.app}.fly.dev`,createdApp:A,created:me,updated:At,untouched:z.filter((Me)=>!Lt.has(Me.id)).map((Me)=>Me.id),ips:E,certificates:mt}}async function Rg(u,f,R,A,T){let E=await u.acquireLease(f,R.id);try{let P=await u.updateMachine(f,R.id,{config:{...A,...R.config?.mounts?.length?{mounts:R.config.mounts}:{}},...T!==void 0?{min_secrets_version:T}:{}},E);await u.waitForState(f,R.id,"started",{instanceId:P.instance_id})}finally{await u.releaseLease(f,R.id,E)}}async function Tg(u,f,R,A){let T=A.find((P)=>P.region===R&&P.name===f.volume.name&&!P.attached_machine_id);if(T)return T.attached_machine_id="pending",T;let E=await u.createVolume(f.app,{name:f.volume.name,region:R,size_gb:f.volume.sizeGb});return A.push({...E,attached_machine_id:"pending"}),E}import{createHmac as Hl,createSign as Pg,timingSafeEqual as $g}from"node:crypto";function ro(u){let f=u instanceof Date?u.getTime():u;if(!Number.isFinite(f))throw TypeError("Media access timestamp must be finite");return Math.floor(f/1000)}function Vu(u){return Buffer.from(u).toString("base64").replaceAll("+","-").replaceAll("=","_").replaceAll("/","~")}function wg(u){return Buffer.from(u).toString("base64url")}function zu(u,f=!1){if(!u||/[\r\n]/.test(u))throw TypeError("Media resource is invalid");let R=f?u.replaceAll("*","wildcard"):u,A=new URL(R);if(!["http:","https:"].includes(A.protocol))throw TypeError("Media resource must use HTTP or HTTPS");if(!f&&u.includes("*"))throw TypeError("Canned policies cannot contain wildcards")}function Hu(u,f){let R=Pg("RSA-SHA1");return R.update(u),R.end(),Vu(R.sign(f))}function Uu(u){zu(u.resource,!0);let R={DateLessThan:{"AWS:EpochTime":ro(u.expiresAt)}};if(u.activeAt!==void 0)R.DateGreaterThan={"AWS:EpochTime":ro(u.activeAt)};if(u.ipAddress)R.IpAddress={"AWS:SourceIp":u.ipAddress};return JSON.stringify({Statement:[{Resource:u.resource,Condition:R}]})}function MS(u,f,R){zu(u);let A=ro(f),T=u.includes("?")?"&":"?",E=Uu({resource:u,expiresAt:f}),P=Hu(E,R.privateKey);return`${u}${T}Expires=${A}&Signature=${encodeURIComponent(P)}&Key-Pair-Id=${encodeURIComponent(R.keyPairId)}`}function BS(u,f){let R=Uu(u);return{"CloudFront-Key-Pair-Id":f.keyPairId,"CloudFront-Policy":Vu(Buffer.from(R)),"CloudFront-Signature":Hu(R,f.privateKey)}}function WS(u){if(!u.resource||/[\r\n]/.test(u.resource))throw TypeError("Media resource is invalid");let f=wg(Buffer.from(JSON.stringify({resource:u.resource,expiresAt:ro(u.expiresAt),...u.keyId?{keyId:u.keyId}:{},...u.audience?{audience:u.audience}:{}}))),R=Hl("sha256",u.secret).update(f).digest("base64url");return`${f}.${R}`}function VS(u,f){let[R,A,T]=u.split(".");if(!R||!A||T)return null;let E=Hl("sha256",f.secret).update(R).digest(),P;try{P=Buffer.from(A,"base64url")}catch{return null}if(E.length!==P.length||!$g(E,P))return null;try{let L=JSON.parse(Buffer.from(R,"base64url").toString("utf8")),z=ro(f.now??Date.now());if(!L.resource||!Number.isSafeInteger(L.expiresAt)||L.expiresAt<=z)return null;if(f.resource&&L.resource!==f.resource)return null;if(f.audience&&L.audience!==f.audience)return null;return L}catch{return null}}function zS(u,f=!1){let R=new URL(u,"https://media.invalid").pathname.toLowerCase(),A=/\.(?:m3u8|mpd|vtt|json)$/.test(R),T=/\.(?:key|license)$/.test(R)||R.includes("/keys/")||R.includes("/licenses/");return{"Accept-Ranges":"bytes","Cache-Control":f&&(A||T)?"private, no-store":A?"public, max-age=5, s-maxage=30, stale-while-revalidate=30":"public, max-age=31536000, immutable","Cross-Origin-Resource-Policy":"cross-origin","X-Content-Type-Options":"nosniff"}}function HS(u){if(!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(u.bucket))throw TypeError("Media bucket is invalid");if(!/^[a-z0-9-]+$/.test(u.region))throw TypeError("Media bucket region is invalid");let f=u.prefix?`/${u.prefix.replace(/^\/+|\/+$/g,"")}`:"",R=u.protected??!1,A="public, max-age=31536000, immutable",T=R?"private, no-store":"public, max-age=5, s-maxage=30, stale-while-revalidate=30";return{originDomain:`${u.bucket}.s3.${u.region}.amazonaws.com`,originPath:f,domain:u.domain,trustedKeyGroupIds:[...new Set(u.trustedKeyGroupIds??[])],behaviors:[{pathPattern:"*.m3u8",cacheControl:T,compress:!0,signed:R},{pathPattern:"*.mpd",cacheControl:T,compress:!0,signed:R},{pathPattern:"*.vtt",cacheControl:T,compress:!0,signed:R},{pathPattern:"*",cacheControl:A,compress:!1,signed:R}],responseHeaders:{"Access-Control-Allow-Headers":"Range, If-Range","Access-Control-Allow-Methods":"GET, HEAD, OPTIONS","Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":"Accept-Ranges, Content-Length, Content-Range, ETag","X-Content-Type-Options":"nosniff"}}}class Dg{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;storageFailoverReplicas=[];constructor(u){this.config=u.config,this.environment=u.environment,this.builder=new Jd(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let f=this.config.environments[this.environment]?.infrastructure;if(!f)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...f,compute:{...this.config.infrastructure?.compute,...f.compute},storage:{...this.config.infrastructure?.storage,...f.storage},functions:{...this.config.infrastructure?.functions,...f.functions},servers:{...this.config.infrastructure?.servers,...f.servers},databases:{...this.config.infrastructure?.databases,...f.databases},cdn:{...this.config.infrastructure?.cdn,...f.cdn},sftp:f.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...f.queues},redirects:{...this.config.infrastructure?.redirects,...f.redirects},realtime:{...this.config.infrastructure?.realtime,...f.realtime},cache:{...this.config.infrastructure?.cache,...f.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...f.fileSystem},email:{...this.config.infrastructure?.email,...f.email},search:{...this.config.infrastructure?.search,...f.search},ai:{...this.config.infrastructure?.ai,...f.ai}}}}shouldDeploy(u){if(u.environments&&!u.environments.includes(this.environment))return!1;if(u.requiresFeatures){let f=this.config.features||{};if(!u.requiresFeatures.every((A)=>f[A]===!0))return!1}if(u.regions){let f=this.config.environments[this.environment]?.region||this.config.project.region;if(!u.regions.includes(f))return!1}if(u.condition&&typeof u.condition==="function")return u.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let u=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,f=Number(u||3008);return Number.isFinite(f)&&f>0?f:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(u,f){return u==="public"||f.routeCompute===!0}storageBucketName(u,f,R){return this.mergedConfig.infrastructure?.storage?.[R]?.bucket??`${u}-${f}-${R}`}fileSystemLogicalId(u,f,R){return t(r({slug:`${u}-${R}`,environment:f,resourceType:"efs"}))}resolveSftpStorage(u,f,R){let A=u.storage;if(A?.type==="efs"&&A.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[A.fileSystem])throw Error(`sftp: storage.fileSystem "${A.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(f,R,A.fileSystem)},posixProfile:A.posixProfile}}if(A?.type==="s3"&&A.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[A.storageBucket])throw Error(`sftp: storage.storageBucket "${A.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(f,R,A.storageBucket)}}return}resolveComputeCachePathPatterns(u){if(u&&u.length>0)return u;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(u,f){return{PathPattern:u,TargetOriginId:f,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(u,f,R,A,T,E){let P=this.serverEipLogicalIds.get("app"),L=this.serverEipLogicalIds.get("appInstance");if(!P)return;let z=`EC2-${A}-${T}-api`,fe=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",me=fe==="us-east-1"?".compute-1.amazonaws.com":`.${fe}.compute.amazonaws.com`,At={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:P}]}]},me]]},Lt=this.resolveApiOriginPort();if(u.push({Id:z,DomainName:At,CustomOriginConfig:{HTTPPort:Lt,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),R.push(P),L)R.push(L);for(let mt of E)f.push(this.createComputeCacheBehavior(mt,z))}buildCaddyfile(u){let f=u.filter(([,T])=>typeof T.domain==="string"&&T.domain&&typeof T.port==="number");if(f.length===0)return;let R=new Map;for(let[,T]of f){let E=R.get(T.domain)??[];E.push({port:T.port,path:T.path}),R.set(T.domain,E)}let A=[];for(let[T,E]of R){let L=[...E].sort((z,fe)=>{let me=!z.path||z.path==="/",At=!fe.path||fe.path==="/";if(me&&!At)return 1;if(!me&&At)return-1;return(fe.path?.length??0)-(z.path?.length??0)}).map((z)=>{let fe=!z.path||z.path==="/",me=`reverse_proxy localhost:${z.port}`;return fe?`  handle {
     ${me}
   }`:`  handle ${z.path} {
     ${me}

package/dist/mail/index.js

@@ -1,3 +1,3 @@
-import{b,Xe,Hi,on,w}from"../chunk-18h7na1g.js";import"../chunk-6m8p1n88.js";import"../chunk-cpba1hz2.js";import{B,R,yt,G}from"../chunk-fqgvackc.js";function a(i){return`'${i.replace(/'/g,"'\\''")}'`}function p(i,e="/etc/mail/mail.env",r="/usr/local/bin/bun"){let t={SMTP_ENABLE_WEBMAIL:String(i.webmail.enabled),SMTP_WEBMAIL_PORT:String(i.webmail.port),SMTP_WEBMAIL_TLS:String(i.webmail.tls),SMTP_WEBMAIL_SECURE_COOKIES:String(i.webmail.secureCookies)},s="const fs=require('node:fs');const path=process.argv[1];const settings=JSON.parse(process.argv[2]);const before=fs.readFileSync(path,'utf8');const lines=before.split(/\\r?\\n/).filter(line=>line!==''&&!Object.hasOwn(settings,line.split('=',1)[0]));const after=lines.concat(Object.entries(settings).map(([key,value])=>key+'='+value)).join('\\n')+'\\n';if(after===before){console.log('unchanged')}else{const stat=fs.statSync(path);const backup=path+'.bak-webmail';fs.copyFileSync(path,backup);fs.chmodSync(backup,stat.mode&511);fs.chownSync(backup,stat.uid,stat.gid);const temporary=path+'.webmail-'+process.pid;fs.writeFileSync(temporary,after,{mode:stat.mode&511});fs.chownSync(temporary,stat.uid,stat.gid);fs.renameSync(temporary,path);console.log('changed')}";return`${a(r)} --eval ${a("const fs=require('node:fs');const path=process.argv[1];const settings=JSON.parse(process.argv[2]);const before=fs.readFileSync(path,'utf8');const lines=before.split(/\\r?\\n/).filter(line=>line!==''&&!Object.hasOwn(settings,line.split('=',1)[0]));const after=lines.concat(Object.entries(settings).map(([key,value])=>key+'='+value)).join('\\n')+'\\n';if(after===before){console.log('unchanged')}else{const stat=fs.statSync(path);const backup=path+'.bak-webmail';fs.copyFileSync(path,backup);fs.chmodSync(backup,stat.mode&511);fs.chownSync(backup,stat.uid,stat.gid);const temporary=path+'.webmail-'+process.pid;fs.writeFileSync(temporary,after,{mode:stat.mode&511});fs.chownSync(temporary,stat.uid,stat.gid);fs.renameSync(temporary,path);console.log('changed')}")} ${a(e)} ${a(JSON.stringify(t))}`}function h(i,e){let r=e.environment??"production",t=b(i,{environment:r});if(!t.enabled||!t.webmail.enabled)return"";if(!t.webmail.domain)throw Error("Mail webmail deployment needs a hostname; set mail.webmail.domain or use compute provisioning for a local catcher");if(t.webmail.tls)throw Error("Gateway webmail uses loopback HTTP: set mail.webmail.tls to false, or domain to false for a direct TLS listener");let s=w(i,{environment:r}),l=e.slug??i.project.slug,n=e.bunBin??"/usr/local/bin/bun",o=e.envFile??"/etc/mail/mail.env",c=e.service??"mail.service",m=e.healthPath??"/login";if(!/^[a-z0-9@._-]+$/i.test(c)||c.startsWith("-"))throw Error("Invalid mail service unit");if(!o.startsWith("/")||!m.startsWith("/")||/[\r\n]/.test(o+m))throw Error("Mail environment path must be absolute and health path must start with /");let g=B({},{proxy:s,slug:l,mail:t}),d=e.gateway!=="provision",u=["set -euo pipefail",`test -f ${a(o)}`,...d?[`test -x ${yt}`,`test -d ${R}/node_modules/@stacksjs/rpx`,...s.onDemandTls?[`test -f ${R}/node_modules/@stacksjs/tlsx/dist/bin/cli.js`]:[]]:[],`__tsc_mail_changed="$(${p(t,o,n)})"`,`if [ "$__tsc_mail_changed" = changed ] || ! systemctl is-active --quiet ${a(c)}; then systemctl restart ${a(c)}; fi`,`curl --fail --silent --show-error --retry 30 --retry-all-errors --retry-delay 1 --max-time 5 ${a(`http://127.0.0.1:${t.webmail.port}${m}`)} >/dev/null`,...G({config:g,proxy:s,slug:l,bunBin:n,tenant:d})];if(e.verify!==!1)for(let f of[t.webmail.domain,...t.webmail.aliases])u.push(`__tsc_mail_status="$(curl --fail --silent --show-error --retry 10 --retry-connrefused --retry-delay 3 --max-time 15 --output /dev/null --write-out '%{http_code}' ${a(`https://${f}${m}`)})"`,`if [ "$__tsc_mail_status" != 200 ]; then echo ${a(`ts-cloud: webmail verification failed for ${f}`)} >&2; exit 1; fi`);return u.push(`echo ${a(`[ts-cloud] Webmail deployed: ${[t.webmail.domain,...t.webmail.aliases].join(", ")}`)}`),`${u.join(`
+import{b,Xe,Hi,on,w}from"../chunk-prtvb2fh.js";import"../chunk-6m8p1n88.js";import"../chunk-pz33w7gv.js";import{B,R,yt,G}from"../chunk-xgc6hskd.js";function a(t){return`'${t.replace(/'/g,"'\\''")}'`}function h(t,e="/etc/mail/mail.env",r="/usr/local/bin/bun"){let i={SMTP_ENABLE_WEBMAIL:String(t.webmail.enabled),SMTP_WEBMAIL_PORT:String(t.webmail.port),SMTP_WEBMAIL_TLS:String(t.webmail.tls),SMTP_WEBMAIL_SECURE_COOKIES:String(t.webmail.secureCookies),SMTP_WEBMAIL_ATTACHMENT_MAX_FILE:String(t.webmail.attachmentMaxFileBytes),SMTP_WEBMAIL_ATTACHMENT_MAX_TOTAL:String(t.webmail.attachmentMaxTotalBytes),SMTP_WEBMAIL_ATTACHMENT_MAX_COUNT:String(t.webmail.attachmentMaxCount),SMTP_WEBMAIL_UNDO_SEND_SECONDS:String(t.webmail.undoSendSeconds)},n="const fs=require('node:fs');const path=process.argv[1];const settings=JSON.parse(process.argv[2]);const before=fs.readFileSync(path,'utf8');const lines=before.split(/\\r?\\n/).filter(line=>line!==''&&!Object.hasOwn(settings,line.split('=',1)[0]));const after=lines.concat(Object.entries(settings).map(([key,value])=>key+'='+value)).join('\\n')+'\\n';if(after===before){console.log('unchanged')}else{const stat=fs.statSync(path);const backup=path+'.bak-webmail';fs.copyFileSync(path,backup);fs.chmodSync(backup,stat.mode&511);fs.chownSync(backup,stat.uid,stat.gid);const temporary=path+'.webmail-'+process.pid;fs.writeFileSync(temporary,after,{mode:stat.mode&511});fs.chownSync(temporary,stat.uid,stat.gid);fs.renameSync(temporary,path);console.log('changed')}";return`${a(r)} --eval ${a("const fs=require('node:fs');const path=process.argv[1];const settings=JSON.parse(process.argv[2]);const before=fs.readFileSync(path,'utf8');const lines=before.split(/\\r?\\n/).filter(line=>line!==''&&!Object.hasOwn(settings,line.split('=',1)[0]));const after=lines.concat(Object.entries(settings).map(([key,value])=>key+'='+value)).join('\\n')+'\\n';if(after===before){console.log('unchanged')}else{const stat=fs.statSync(path);const backup=path+'.bak-webmail';fs.copyFileSync(path,backup);fs.chmodSync(backup,stat.mode&511);fs.chownSync(backup,stat.uid,stat.gid);const temporary=path+'.webmail-'+process.pid;fs.writeFileSync(temporary,after,{mode:stat.mode&511});fs.chownSync(temporary,stat.uid,stat.gid);fs.renameSync(temporary,path);console.log('changed')}")} ${a(e)} ${a(JSON.stringify(i))}`}function p(t,e){let r=e.environment??"production",i=b(t,{environment:r});if(!i.enabled||!i.webmail.enabled)return"";if(!i.webmail.domain)throw Error("Mail webmail deployment needs a hostname; set mail.webmail.domain or use compute provisioning for a local catcher");if(i.webmail.tls)throw Error("Gateway webmail uses loopback HTTP: set mail.webmail.tls to false, or domain to false for a direct TLS listener");let n=w(t,{environment:r}),l=e.slug??t.project.slug,s=e.bunBin??"/usr/local/bin/bun",o=e.envFile??"/etc/mail/mail.env",c=e.service??"mail.service",m=e.healthPath??"/login";if(!/^[a-z0-9@._-]+$/i.test(c)||c.startsWith("-"))throw Error("Invalid mail service unit");if(!o.startsWith("/")||!m.startsWith("/")||/[\r\n]/.test(o+m))throw Error("Mail environment path must be absolute and health path must start with /");let g=B({},{proxy:n,slug:l,mail:i}),d=e.gateway!=="provision",u=["set -euo pipefail",`test -f ${a(o)}`,...d?[`test -x ${yt}`,`test -d ${R}/node_modules/@stacksjs/rpx`,...n.onDemandTls?[`test -f ${R}/node_modules/@stacksjs/tlsx/dist/bin/cli.js`]:[]]:[],`__tsc_mail_changed="$(${h(i,o,s)})"`,`if [ "$__tsc_mail_changed" = changed ] || ! systemctl is-active --quiet ${a(c)}; then systemctl restart ${a(c)}; fi`,`curl --fail --silent --show-error --retry 30 --retry-all-errors --retry-delay 1 --max-time 5 ${a(`http://127.0.0.1:${i.webmail.port}${m}`)} >/dev/null`,...G({config:g,proxy:n,slug:l,bunBin:s,tenant:d})];if(e.verify!==!1)for(let f of[i.webmail.domain,...i.webmail.aliases])u.push(`__tsc_mail_status="$(curl --fail --silent --show-error --retry 10 --retry-connrefused --retry-delay 3 --max-time 15 --output /dev/null --write-out '%{http_code}' ${a(`https://${f}${m}`)})"`,`if [ "$__tsc_mail_status" != 200 ]; then echo ${a(`ts-cloud: webmail verification failed for ${f}`)} >&2; exit 1; fi`);return u.push(`echo ${a(`[ts-cloud] Webmail deployed: ${[i.webmail.domain,...i.webmail.aliases].join(", ")}`)}`),`${u.join(`
 `)}
-`}async function y(i,e){let r=h(i,e);if(!r)return;if(!/^(?:[a-z_][a-z0-9._-]*@)?[a-z0-9.:[\]_-]+$/i.test(e.target)||e.target.startsWith("-"))throw Error("Invalid SSH target");let t=["ssh","-T","-o","BatchMode=yes","-o","ConnectTimeout=15",...e.sshKeyPath?["-i",e.sshKeyPath]:[],e.target,"bash","-se"],s=Bun.spawn(t,{stdin:new Blob([r]),stdout:"inherit",stderr:"inherit"}),l=setTimeout(()=>s.kill(),e.timeoutMs??300000);try{let n=await s.exited;if(n!==0)throw Error(`Mail webmail deployment failed (SSH exit ${n})`)}finally{clearTimeout(l)}}export{Hi as buildMailEnv,h as buildMailWebmailDeploymentScript,p as buildMailWebmailEnvPatch,y as deployMailWebmail,Xe as mailFirewallPorts,on as mailWebmailSites,w as resolveMailProxy,b as resolveMailService};
+`}async function y(t,e){let r=p(t,e);if(!r)return;if(!/^(?:[a-z_][a-z0-9._-]*@)?[a-z0-9.:[\]_-]+$/i.test(e.target)||e.target.startsWith("-"))throw Error("Invalid SSH target");let i=["ssh","-T","-o","BatchMode=yes","-o","ConnectTimeout=15",...e.sshKeyPath?["-i",e.sshKeyPath]:[],e.target,"bash","-se"],n=Bun.spawn(i,{stdin:new Blob([r]),stdout:"inherit",stderr:"inherit"}),l=setTimeout(()=>n.kill(),e.timeoutMs??300000);try{let s=await n.exited;if(s!==0)throw Error(`Mail webmail deployment failed (SSH exit ${s})`)}finally{clearTimeout(l)}}export{Hi as buildMailEnv,p as buildMailWebmailDeploymentScript,h as buildMailWebmailEnvPatch,y as deployMailWebmail,Xe as mailFirewallPorts,on as mailWebmailSites,w as resolveMailProxy,b as resolveMailService};

package/dist/operations/index.js

@@ -1 +1 @@
-import{Hh,Gh,Vh,up,gp,pp,qh,mp,fp,jh,zh,hp,Kh,Wh,nd,Ap,Jh,Xh,yp,Yh,Zh,eA,tA,rA,nA,iA,vi,id,Sp,Ip,bp,Cp,Ep,vp,Tp,wp,Rp,Dp,Pp,sA,oA,aA,cA,dA,lA,uA}from"../chunk-nnnhq6sx.js";import"../chunk-nmnf1ha6.js";import"../chunk-cpba1hz2.js";import"../chunk-18h7na1g.js";import"../chunk-6m8p1n88.js";export{gp as ENVIRONMENT_LABEL,up as PROJECT_LABEL,pp as ROLE_LABEL,Xh as applyPlan,rA as attachConflicts,nA as attachIsViable,tA as attachPreconditions,dA as buildCertificatePackScript,oA as buildCertificateStateScript,lA as buildCertificateUnpackScript,Rp as buildDrainSourceScript,Hh as buildDrainedSiteScanScript,wp as buildHealthGateScript,Sp as buildPauseWorkersScript,Ep as buildRestoreScript,Zh as buildSetHostnameScript,Cp as buildSnapshotScript,Dp as buildSourceStateScript,vp as buildTargetStateScript,Ip as buildWorkersStateScript,cA as certificatesMatch,iA as formatAttachPlan,Vh as formatDrainedSiteRefusal,Kh as formatInventory,Jh as formatPlan,aA as parseCertificateState,Gh as parseDrainedSites,Pp as parseSourceDrained,Tp as parseTargetReady,bp as parseWorkersPaused,nd as pendingSteps,Ap as planIsDestructive,Yh as planServerRename,uA as planSiteMove,jh as probeHostRoutes,zh as reconcile,eA as resolveAttachTarget,Wh as resolvePlan,mp as routesFromFragments,vi as siteMoveArchivePath,sA as siteMoveCertArchivePath,id as siteUnitGlob,fp as tenantsOf,qh as toInventoryServer,hp as unaccountedSites,yp as validateServerName};
+import{Hh,Gh,Vh,up,gp,pp,qh,mp,fp,jh,zh,hp,Kh,Wh,nd,Ap,Jh,Xh,yp,Yh,Zh,eA,tA,rA,nA,iA,vi,id,Sp,Ip,bp,Cp,Ep,vp,Tp,wp,Rp,Dp,Pp,sA,oA,aA,cA,dA,lA,uA}from"../chunk-qcv4twc6.js";import"../chunk-x4qye2rc.js";import"../chunk-pz33w7gv.js";import"../chunk-prtvb2fh.js";import"../chunk-6m8p1n88.js";export{gp as ENVIRONMENT_LABEL,up as PROJECT_LABEL,pp as ROLE_LABEL,Xh as applyPlan,rA as attachConflicts,nA as attachIsViable,tA as attachPreconditions,dA as buildCertificatePackScript,oA as buildCertificateStateScript,lA as buildCertificateUnpackScript,Rp as buildDrainSourceScript,Hh as buildDrainedSiteScanScript,wp as buildHealthGateScript,Sp as buildPauseWorkersScript,Ep as buildRestoreScript,Zh as buildSetHostnameScript,Cp as buildSnapshotScript,Dp as buildSourceStateScript,vp as buildTargetStateScript,Ip as buildWorkersStateScript,cA as certificatesMatch,iA as formatAttachPlan,Vh as formatDrainedSiteRefusal,Kh as formatInventory,Jh as formatPlan,aA as parseCertificateState,Gh as parseDrainedSites,Pp as parseSourceDrained,Tp as parseTargetReady,bp as parseWorkersPaused,nd as pendingSteps,Ap as planIsDestructive,Yh as planServerRename,uA as planSiteMove,jh as probeHostRoutes,zh as reconcile,eA as resolveAttachTarget,Wh as resolvePlan,mp as routesFromFragments,vi as siteMoveArchivePath,sA as siteMoveCertArchivePath,id as siteUnitGlob,fp as tenantsOf,qh as toInventoryServer,hp as unaccountedSites,yp as validateServerName};

package/dist/protection/index.js

@@ -1 +1 @@
-import{Fl,Ko,Xi,Yi,Wo,Ul,Ql,Hl,Zi,Jo,Xo,Gl,Vl,Yo,bS}from"../chunk-ffyx50xx.js";import{oe,bi,eo,Xc,Ci,sp}from"../chunk-r5mk071y.js";import{Qd,rn,Hd,Gd,Vd,Qi,rm,nn}from"../chunk-3ncnrrvm.js";import{Uo,Qo,Ho,kl,un,Bl,xl,Ji,Go,Vo}from"../chunk-18h7na1g.js";import"../chunk-6m8p1n88.js";export{Qo as CHAIN_HEADER,Jo as DEFAULT_ATTACK_MODE_HOURS,Qd as DEFAULT_DDOS_THRESHOLDS,un as DEFAULT_RECURSION_LIMITS,Uo as DEPTH_HEADER,Zi as MAX_CONTROL_HOURS,Hl as PROTECTION_SETTING,Xo as ProtectionControlStore,Fl as RATE_LIMIT_KEY_SEPARATOR,Wo as RateLimiter,Ji as RecursionGuard,Ho as TRACE_HEADER,Yo as applyControlsToDdos,Vl as applyControlsToRateLimits,nn as applyMitigationFactor,Ql as defaultRateLimitRules,Gl as describePosture,oe as escapeSecLang,kl as functionFingerprint,Ko as globMatches,eo as globToRegex,xl as inspectInvocation,bi as isSafePattern,rn as isValidCidr,bS as mergeControlsIntoConfig,Bl as parseChain,rm as planMitigation,Go as propagationHeaders,Ul as rateLimitHeaders,Yi as rateLimitKey,Vo as recursionBlockedResponse,Qi as renderDdosInstallScript,Vd as renderNftablesRuleset,Gd as renderSysctlFile,Xc as renderWafConfig,Ci as renderWafInstallScript,Xi as ruleMatches,Hd as sysctlHardening,sp as wafEventTelemetry};
+import{Fl,Ko,Xi,Yi,Wo,Ul,Ql,Hl,Zi,Jo,Xo,Gl,Vl,Yo,bS}from"../chunk-ffyx50xx.js";import{oe,bi,eo,Xc,Ci,sp}from"../chunk-r5mk071y.js";import{Qd,rn,Hd,Gd,Vd,Qi,rm,nn}from"../chunk-3ncnrrvm.js";import{Uo,Qo,Ho,kl,un,Bl,xl,Ji,Go,Vo}from"../chunk-prtvb2fh.js";import"../chunk-6m8p1n88.js";export{Qo as CHAIN_HEADER,Jo as DEFAULT_ATTACK_MODE_HOURS,Qd as DEFAULT_DDOS_THRESHOLDS,un as DEFAULT_RECURSION_LIMITS,Uo as DEPTH_HEADER,Zi as MAX_CONTROL_HOURS,Hl as PROTECTION_SETTING,Xo as ProtectionControlStore,Fl as RATE_LIMIT_KEY_SEPARATOR,Wo as RateLimiter,Ji as RecursionGuard,Ho as TRACE_HEADER,Yo as applyControlsToDdos,Vl as applyControlsToRateLimits,nn as applyMitigationFactor,Ql as defaultRateLimitRules,Gl as describePosture,oe as escapeSecLang,kl as functionFingerprint,Ko as globMatches,eo as globToRegex,xl as inspectInvocation,bi as isSafePattern,rn as isValidCidr,bS as mergeControlsIntoConfig,Bl as parseChain,rm as planMitigation,Go as propagationHeaders,Ul as rateLimitHeaders,Yi as rateLimitKey,Vo as recursionBlockedResponse,Qi as renderDdosInstallScript,Vd as renderNftablesRuleset,Gd as renderSysctlFile,Xc as renderWafConfig,Ci as renderWafInstallScript,Xi as ruleMatches,Hd as sysctlHardening,sp as wafEventTelemetry};

package/dist/spend/index.js

@@ -1 +1 @@
-import{CA,ho,EA,O,vA,Sd,_p,Ao,TA,wA,RA,Id,Ni,yo,bd,rr,Ct,DA,Jr,PA,Cd,Lp,$p,So,Ed,vd,Et,Mp,ki,Td,Io,Xr,Fp,Bi,wd,Rd,xi,Up,Dd,Pd,Nd,kd,bo,Qp,Hp,NA,Gp,Bd,Oi,Vp,qp,Co,Yr,Eo,vo,To,xd,jp,Od,wo,kA,nr,BA,_d,Zr,Ld,xA,$d,zp,$A,tn,Jp,Po,MA,Xp,Yp,Zp,FA,em,tm,UA,No,ko}from"../chunk-zbx9yehq.js";import"../chunk-18h7na1g.js";import"../chunk-6m8p1n88.js";export{Co as AnomalyConfigStore,em as AwsSpendTransport,tm as ComputeSpendTransport,So as CounterTracker,Cd as DEFAULT_METER_MAPPINGS,Id as DEFAULT_PRICE_BOOK,Mp as DEFAULT_THRESHOLDS,Yr as DETECTABLE_SIGNALS,EA as ENFORCEMENT_ACTIONS,xi as ENFORCEMENT_DESCRIPTIONS,O as ENFORCEMENT_SEVERITY,jp as FOCUS_VERSION,ho as METERS,CA as METER_KEYS,vA as MICRO_CENTS,Fp as MIN_PROJECTION_CONFIDENCE,zp as RecordingSpendTransport,Vp as SENSITIVITY_THRESHOLDS,Zp as SPEND_CYCLE_SECONDS,_d as SPEND_GATE_SETTING,MA as SPEND_LEASE_SETTING,vo as SignalSource,Ld as SpendCapError,Zr as SpendGate,Xp as SpendLoopLease,Po as SpendNotificationRouter,Yp as SpendRunner,nr as SpendService,ki as SpendStore,$A as URGENT_SPEND_EVENTS,Up as USER_VISIBLE_ACTIONS,vd as aggregateDeltas,Oi as anomalyOptionsForSignal,xA as assertSpendAllows,Ct as budgetWindow,UA as compositeSpendTransport,$d as createEnforcementHandlers,Gp as detectAnomalies,Bd as detectLatestAnomaly,wd as evaluateBudget,NA as ewma,Lp as findMapping,_p as findPriceEntry,tn as formatCents,Xr as formatTimeToExhaustion,Bi as governingLimitCents,No as handleSpendRequest,Jr as hourBucket,PA as hourBucketsBetween,kd as isOperationAllowed,Ni as isValidTimeZone,xd as lookbackHoursForSignal,bo as median,Qp as medianAbsoluteDeviation,Rd as mergeDecisions,RA as mergePriceBooks,Ed as meterTelemetry,To as optionsForSignal,Io as percentOfLimit,Dd as planEnforcement,DA as previousBudgetWindow,Ao as priceUsage,TA as priceUsageLines,Td as projectSpend,Hp as robustZScore,wA as roundCents,qp as routeMatches,Pd as runEnforcement,Et as scopeKey,Eo as signalDefinition,Jp as spendNotificationText,ko as spendOpenApiPaths,FA as startSpendLoop,kA as streamFocusJsonl,Nd as strongestActiveAction,Sd as tieredMicroCents,wo as toFocusJsonl,Od as toFocusRecords,$p as usageDeltaKey,rr as utcInstantOfLocal,BA as zeroFill,bd as zoneOffsetMs,yo as zonedParts};
+import{CA,ho,EA,O,vA,Sd,_p,Ao,TA,wA,RA,Id,Ni,yo,bd,rr,Ct,DA,Jr,PA,Cd,Lp,$p,So,Ed,vd,Et,Mp,ki,Td,Io,Xr,Fp,Bi,wd,Rd,xi,Up,Dd,Pd,Nd,kd,bo,Qp,Hp,NA,Gp,Bd,Oi,Vp,qp,Co,Yr,Eo,vo,To,xd,jp,Od,wo,kA,nr,BA,_d,Zr,Ld,xA,$d,zp,$A,tn,Jp,Po,MA,Xp,Yp,Zp,FA,em,tm,UA,No,ko}from"../chunk-6gnmrtp9.js";import"../chunk-prtvb2fh.js";import"../chunk-6m8p1n88.js";export{Co as AnomalyConfigStore,em as AwsSpendTransport,tm as ComputeSpendTransport,So as CounterTracker,Cd as DEFAULT_METER_MAPPINGS,Id as DEFAULT_PRICE_BOOK,Mp as DEFAULT_THRESHOLDS,Yr as DETECTABLE_SIGNALS,EA as ENFORCEMENT_ACTIONS,xi as ENFORCEMENT_DESCRIPTIONS,O as ENFORCEMENT_SEVERITY,jp as FOCUS_VERSION,ho as METERS,CA as METER_KEYS,vA as MICRO_CENTS,Fp as MIN_PROJECTION_CONFIDENCE,zp as RecordingSpendTransport,Vp as SENSITIVITY_THRESHOLDS,Zp as SPEND_CYCLE_SECONDS,_d as SPEND_GATE_SETTING,MA as SPEND_LEASE_SETTING,vo as SignalSource,Ld as SpendCapError,Zr as SpendGate,Xp as SpendLoopLease,Po as SpendNotificationRouter,Yp as SpendRunner,nr as SpendService,ki as SpendStore,$A as URGENT_SPEND_EVENTS,Up as USER_VISIBLE_ACTIONS,vd as aggregateDeltas,Oi as anomalyOptionsForSignal,xA as assertSpendAllows,Ct as budgetWindow,UA as compositeSpendTransport,$d as createEnforcementHandlers,Gp as detectAnomalies,Bd as detectLatestAnomaly,wd as evaluateBudget,NA as ewma,Lp as findMapping,_p as findPriceEntry,tn as formatCents,Xr as formatTimeToExhaustion,Bi as governingLimitCents,No as handleSpendRequest,Jr as hourBucket,PA as hourBucketsBetween,kd as isOperationAllowed,Ni as isValidTimeZone,xd as lookbackHoursForSignal,bo as median,Qp as medianAbsoluteDeviation,Rd as mergeDecisions,RA as mergePriceBooks,Ed as meterTelemetry,To as optionsForSignal,Io as percentOfLimit,Dd as planEnforcement,DA as previousBudgetWindow,Ao as priceUsage,TA as priceUsageLines,Td as projectSpend,Hp as robustZScore,wA as roundCents,qp as routeMatches,Pd as runEnforcement,Et as scopeKey,Eo as signalDefinition,Jp as spendNotificationText,ko as spendOpenApiPaths,FA as startSpendLoop,kA as streamFocusJsonl,Nd as strongestActiveAction,Sd as tieredMicroCents,wo as toFocusJsonl,Od as toFocusRecords,$p as usageDeltaKey,rr as utcInstantOfLocal,BA as zeroFill,bd as zoneOffsetMs,yo as zonedParts};

package/dist/ui/404.html

@@ -2,7 +2,7 @@
 <html lang="en" data-theme="dark">
 <head>
   <meta charset="UTF-8">
-  <meta name="stx-build" content="mv2torbcvjujmy">
+  <meta name="stx-build" content="mv33qemz2qhsbp">
 
 <!-- stx SEO Tags -->
 <meta name="title" content="Page not found · ts-cloud">

package/dist/ui/accept-invitation.html

@@ -1,4 +1,4 @@
-<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mv2toc1al7rfnm"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - Accept invitation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.616c25f3.css"></head><body class="auth-page"><main class="auth-card" id="main-content"><a class="brand" href="/"><span class="dot"></span><span>ts-cloud</span></a><div><span class="context-label">Organization invitation</span><h1>Join your team</h1><p>Choose the dashboard username and password you will use after this invitation is accepted.</p></div><form id="accept-invitation-form" class="auth-form"><div class="field-block"><label for="invite-name">Name</label><input id="invite-name" name="name" autocomplete="name" placeholder="Chris Breuer"></div><div class="field-block"><label for="invite-username">Username</label><input id="invite-username" name="username" autocomplete="username" minlength="2" maxlength="32" required></div><div class="field-block"><label for="invite-password">Password</label><input id="invite-password" name="password" type="password" autocomplete="new-password" minlength="12" required><small>At least 12 characters.</small></div><button class="btn" type="submit">Accept invitation</button><div id="invitation-status" class="auth-status" role="status"></div></form><p class="note">If this link expired or was already used, ask an organization owner to resend the invitation.</p></main> <script data-stx-scoped data-stx-run="always">
+<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mv33pxciplf9qj"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - Accept invitation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.616c25f3.css"></head><body class="auth-page"><main class="auth-card" id="main-content"><a class="brand" href="/"><span class="dot"></span><span>ts-cloud</span></a><div><span class="context-label">Organization invitation</span><h1>Join your team</h1><p>Choose the dashboard username and password you will use after this invitation is accepted.</p></div><form id="accept-invitation-form" class="auth-form"><div class="field-block"><label for="invite-name">Name</label><input id="invite-name" name="name" autocomplete="name" placeholder="Chris Breuer"></div><div class="field-block"><label for="invite-username">Username</label><input id="invite-username" name="username" autocomplete="username" minlength="2" maxlength="32" required></div><div class="field-block"><label for="invite-password">Password</label><input id="invite-password" name="password" type="password" autocomplete="new-password" minlength="12" required><small>At least 12 characters.</small></div><button class="btn" type="submit">Accept invitation</button><div id="invitation-status" class="auth-status" role="status"></div></form><p class="note">If this link expired or was already used, ask an organization owner to resend the invitation.</p></main> <script data-stx-scoped data-stx-run="always">
 ;(function() {
   'use strict';
 (() => {

package/dist/ui/access-denied.html

@@ -1,4 +1,4 @@
-<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mv2toc1al7rfnm"><meta name="title" content="Access unavailable · ts-cloud"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="Access unavailable · ts-cloud"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="Access unavailable · ts-cloud"><meta name="twitter:description" content="A website built with stx templating engine"> <script data-stx-runtime src="/_stx/runtime.dbee66d1.js"></script> <meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Access unavailable · ts-cloud</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.906ee17c.css"></head><body data-stx-auto><a data-stx-scope="stx_scope_nav_50" class="skip-link" href="#main-content">Skip to content</a><button class="nav-toggle-button" type="button" aria-label="Open navigation" aria-controls="primary-navigation" aria-expanded="false"><span></span><span></span><span></span></button><button class="nav-scrim" type="button" aria-label="Close navigation"></button><aside class="app-sidebar" id="primary-navigation" aria-label="Primary navigation"><a class="brand" href="/?env=production"><span class="dot"></span><span>ts-cloud</span></a><div class="sidebar-context"><span class="context-label">Project</span><strong>ts-cloud</strong></div><div class="environment-picker" aria-label="Environment"><span class="context-label">Environment</span><details><summary class="environment-current production"><span>PROD</span><strong>production</strong></summary></details></div><button class="command-trigger" type="button" aria-keyshortcuts="Meta+K Control+K"><span>Search resources</span><kbd>⌘ K</kbd></button><div class="nav-groups"><section class="nav-group"><h2>Overview</h2><a class="" href="/?env=production">Dashboard</a><a href="/server/activity?env=production">Activity</a></section><section class="nav-group"><h2>Applications</h2><a class="" href="/server/sites?env=production">Services</a><a class="" href="/server/deployments?env=production">Deployments</a><a class="" href="/server/logs?env=production">Logs</a><a class="" href="/integrations?env=production">Git integrations</a><a class="" href="/applications/new?env=production">Create application</a><a class="" href="/applications/compose?env=production">Compose applications</a></section><section class="nav-group"><h2>Operations</h2><a class="" href="/operations/queue?env=production">Deployment queue</a><a class="" href="/operations/previews?env=production">Preview environments</a><a class="" href="/operations/releases?env=production">Releases & promotion</a><a class="" href="/operations/regions?env=production">Regions & failover</a><a class="" href="/operations/maintenance?env=production">Maintenance & DR</a><a class="" href="/operations/workloads?env=production">Workloads</a><a class="" href="/operations/observability?env=production">Observability</a><a class="" href="/operations/alerts?env=production">Alerts & health</a><a class="" href="/operations/spend?env=production">Spend & budgets</a><a href="/server/metrics?env=production">Metrics</a><a href="/server/services?env=production">Runtime services</a><a class="" href="/operations/jobs?env=production">Workers & schedules</a><a class="" href="/operations/configuration?env=production">Environment &amp; secrets</a><a class="" href="/data/backups?env=production">Backups &amp; recovery</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/actions?env=production">Run operations</a></section><section class="nav-group"><h2>Infrastructure</h2><a class="" href="/infrastructure/topology?env=production">Infrastructure map</a><a class="" href="/data/services?env=production">Data services</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/firewall?env=production">Network & firewall</a><a href="/server/ssh-keys?env=production">SSH keys</a><a class="" href="/server/fleet?env=production">Fleet inventory</a><a class="" href="/server/capacity?env=production">Capacity & placement</a><a href="/security?env=production">Security posture</a><a href="/server/terminal?env=production">Terminal</a></section><section class="nav-group"><h2>Organization</h2><a class="" href="/server/team?env=production">People & access</a><a class="" href="/account/automation?env=production">API & automation</a></section><section class="nav-group"><h2>Account</h2><a class="" href="/account/security?env=production">Sign-in & security</a></section></div><form method="post" action="/api/logout" class="signout"><button type="submit">Sign out</button></form></aside><dialog class="command-palette" aria-labelledby="command-title"><div class="command-search"><span aria-hidden="true">⌕</span><input type="search" placeholder="Search services, domains, deployments…" aria-label="Search resources" autocomplete="off"><button type="button" class="command-close" aria-label="Close search">Esc</button></div><h2 id="command-title" class="sr-only">Search resources and navigation</h2><div class="command-status" role="status">Start typing to search this project.</div><section class="saved-views" aria-labelledby="saved-views-title"><div class="saved-views-heading"><h3 id="saved-views-title">Saved views</h3><form class="save-view-form"><label class="sr-only" for="save-view-name">Saved view name</label><input id="save-view-name" maxlength="64" placeholder="Name this view" autocomplete="off"><button type="submit">Save current filters</button></form></div><div class="saved-view-list"></div></section><form class="tag-result-form"><label for="tag-result-name">Tag selected resource</label><input id="tag-result-name" maxlength="32" placeholder="customer-facing" pattern="[A-Za-z0-9][A-Za-z0-9 -]{0,31}" autocomplete="off"><input class="tag-color" type="color" value="#5a8be0" aria-label="Tag color"><button type="submit">Add tag</button></form><div class="command-results" role="listbox" aria-label="Search results"></div><footer><span>↑ ↓ navigate</span><span>Enter open</span><span>Esc close</span></footer></dialog><div class="context-bar" aria-label="Current scope"><div class="context-path"><div class="context-breadcrumb"><span>ts-cloud</span><i>/</i><strong>production</strong></div><div class="context-filters" aria-label="Active filters"></div></div><span class="scope-safety production">Production scope</span></div> <script data-stx-scoped data-stx-run="always">
+<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mv33pxciplf9qj"><meta name="title" content="Access unavailable · ts-cloud"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="Access unavailable · ts-cloud"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="Access unavailable · ts-cloud"><meta name="twitter:description" content="A website built with stx templating engine"> <script data-stx-runtime src="/_stx/runtime.dbee66d1.js"></script> <meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Access unavailable · ts-cloud</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.906ee17c.css"></head><body data-stx-auto><a data-stx-scope="stx_scope_nav_50" class="skip-link" href="#main-content">Skip to content</a><button class="nav-toggle-button" type="button" aria-label="Open navigation" aria-controls="primary-navigation" aria-expanded="false"><span></span><span></span><span></span></button><button class="nav-scrim" type="button" aria-label="Close navigation"></button><aside class="app-sidebar" id="primary-navigation" aria-label="Primary navigation"><a class="brand" href="/?env=production"><span class="dot"></span><span>ts-cloud</span></a><div class="sidebar-context"><span class="context-label">Project</span><strong>ts-cloud</strong></div><div class="environment-picker" aria-label="Environment"><span class="context-label">Environment</span><details><summary class="environment-current production"><span>PROD</span><strong>production</strong></summary></details></div><button class="command-trigger" type="button" aria-keyshortcuts="Meta+K Control+K"><span>Search resources</span><kbd>⌘ K</kbd></button><div class="nav-groups"><section class="nav-group"><h2>Overview</h2><a class="" href="/?env=production">Dashboard</a><a href="/server/activity?env=production">Activity</a></section><section class="nav-group"><h2>Applications</h2><a class="" href="/server/sites?env=production">Services</a><a class="" href="/server/deployments?env=production">Deployments</a><a class="" href="/server/logs?env=production">Logs</a><a class="" href="/integrations?env=production">Git integrations</a><a class="" href="/applications/new?env=production">Create application</a><a class="" href="/applications/compose?env=production">Compose applications</a></section><section class="nav-group"><h2>Operations</h2><a class="" href="/operations/queue?env=production">Deployment queue</a><a class="" href="/operations/previews?env=production">Preview environments</a><a class="" href="/operations/releases?env=production">Releases & promotion</a><a class="" href="/operations/regions?env=production">Regions & failover</a><a class="" href="/operations/maintenance?env=production">Maintenance & DR</a><a class="" href="/operations/workloads?env=production">Workloads</a><a class="" href="/operations/observability?env=production">Observability</a><a class="" href="/operations/alerts?env=production">Alerts & health</a><a class="" href="/operations/spend?env=production">Spend & budgets</a><a href="/server/metrics?env=production">Metrics</a><a href="/server/services?env=production">Runtime services</a><a class="" href="/operations/jobs?env=production">Workers & schedules</a><a class="" href="/operations/configuration?env=production">Environment &amp; secrets</a><a class="" href="/data/backups?env=production">Backups &amp; recovery</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/actions?env=production">Run operations</a></section><section class="nav-group"><h2>Infrastructure</h2><a class="" href="/infrastructure/topology?env=production">Infrastructure map</a><a class="" href="/data/services?env=production">Data services</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/firewall?env=production">Network & firewall</a><a href="/server/ssh-keys?env=production">SSH keys</a><a class="" href="/server/fleet?env=production">Fleet inventory</a><a class="" href="/server/capacity?env=production">Capacity & placement</a><a href="/security?env=production">Security posture</a><a href="/server/terminal?env=production">Terminal</a></section><section class="nav-group"><h2>Organization</h2><a class="" href="/server/team?env=production">People & access</a><a class="" href="/account/automation?env=production">API & automation</a></section><section class="nav-group"><h2>Account</h2><a class="" href="/account/security?env=production">Sign-in & security</a></section></div><form method="post" action="/api/logout" class="signout"><button type="submit">Sign out</button></form></aside><dialog class="command-palette" aria-labelledby="command-title"><div class="command-search"><span aria-hidden="true">⌕</span><input type="search" placeholder="Search services, domains, deployments…" aria-label="Search resources" autocomplete="off"><button type="button" class="command-close" aria-label="Close search">Esc</button></div><h2 id="command-title" class="sr-only">Search resources and navigation</h2><div class="command-status" role="status">Start typing to search this project.</div><section class="saved-views" aria-labelledby="saved-views-title"><div class="saved-views-heading"><h3 id="saved-views-title">Saved views</h3><form class="save-view-form"><label class="sr-only" for="save-view-name">Saved view name</label><input id="save-view-name" maxlength="64" placeholder="Name this view" autocomplete="off"><button type="submit">Save current filters</button></form></div><div class="saved-view-list"></div></section><form class="tag-result-form"><label for="tag-result-name">Tag selected resource</label><input id="tag-result-name" maxlength="32" placeholder="customer-facing" pattern="[A-Za-z0-9][A-Za-z0-9 -]{0,31}" autocomplete="off"><input class="tag-color" type="color" value="#5a8be0" aria-label="Tag color"><button type="submit">Add tag</button></form><div class="command-results" role="listbox" aria-label="Search results"></div><footer><span>↑ ↓ navigate</span><span>Enter open</span><span>Esc close</span></footer></dialog><div class="context-bar" aria-label="Current scope"><div class="context-path"><div class="context-breadcrumb"><span>ts-cloud</span><i>/</i><strong>production</strong></div><div class="context-filters" aria-label="Active filters"></div></div><span class="scope-safety production">Production scope</span></div> <script data-stx-scoped data-stx-run="always">
 (function() {
   var { batch, computed, configureFetch, defineEmits, defineExpose, definePageMeta, defineProps, defineSlots, defineStore, derived, effect, goBack, goForward, inject, invalidateRoute, isDerived, isSignal, navigate, nextTick, onBeforeMount, onBeforeUnmount, onDestroy, onMount, onMounted, onUnmounted, peek, provide, reactive, ref, refresh, registerStoresClient, setRouteParams, state, untrack, useAsync, useClickOutside, useColorMode, useCookie, useCounter, useDark, useDebounce, useDebouncedValue, useEventListener, useFetch, useFocus, useHead, useId, useInterval, useLocalStorage, useMediaQuery, useMutation, useOptimistic, usePreferredContrast, usePreferredDark, usePreferredLight, usePreferredReducedMotion, useQuery, useReactiveProp, useRef, useRoute, useRouteParam, useRouteParams, useScrollLock, useSearchParams, useSeoMeta, useSessionStorage, useSlots, useStore, useThrottle, useTimeout, useToggle, useWebSocket, watch, watchEffect, watchMultiple, withDefaults } = window.stx;
   var __destroyHooks = [];

package/dist/ui/account/automation.html

@@ -1,5 +1,5 @@
-<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mv2toc1al7rfnm"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"> <script data-stx-runtime src="/_stx/runtime.dbee66d1.js"></script> <meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - API &amp; automation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"> <script data-stx-scoped>
-function __stx_setup_1791662639002_5() {
+<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mv33pxciplf9qj"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"> <script data-stx-runtime src="/_stx/runtime.dbee66d1.js"></script> <meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - API &amp; automation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"> <script data-stx-scoped>
+function __stx_setup_1791679509440_5() {
   const { batch, computed, configureFetch, defineEmits, defineExpose, definePageMeta, defineProps, defineSlots, defineStore, derived, effect, goBack, goForward, inject, invalidateRoute, isDerived, isSignal, navigate, nextTick, onBeforeMount, onBeforeUnmount, onDestroy, onMount, onMounted, onUnmounted, peek, provide, reactive, ref, refresh, registerStoresClient, setRouteParams, state, untrack, useAsync, useClickOutside, useColorMode, useCookie, useCounter, useDark, useDebounce, useDebouncedValue, useEventListener, useFetch, useFocus, useHead, useId, useInterval, useLocalStorage, useMediaQuery, useMutation, useOptimistic, usePreferredContrast, usePreferredDark, usePreferredLight, usePreferredReducedMotion, useQuery, useReactiveProp, useRef, useRoute, useRouteParam, useRouteParams, useScrollLock, useSearchParams, useSeoMeta, useSessionStorage, useSlots, useStore, useThrottle, useTimeout, useToggle, useWebSocket, watch, watchEffect, watchMultiple, withDefaults } = window.stx;
 
 const accounts = state([]);
@@ -189,9 +189,9 @@ onMount(() => {
 
   return { accounts, project, environments, resources, message, messageKind, reveal, accountSlug, accountName, accountRole, accountScopeType, accountScopeId, selectedAccount, tokenName, tokenCapabilities, tokenScopeType, tokenScopeId, tokenExpiry, password, mfaCode, capabilities, setMessage, setScope, scopeLabel, tokenState, toggleCapability, load, selectAccount, stepUp, createAccount, createToken, tokenAction, disableAccount, curlExample, cliExample, copy };
 }
-window.__stx_latestSetup=__stx_setup_1791662639002_5;
-if(window.stx)window.stx._latestSetup=__stx_setup_1791662639002_5;
-</script> <style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.906ee17c.css"></head><body data-stx="__stx_setup_1791662639002_5"><a data-stx-scope="stx_scope_nav_6" class="skip-link" href="#main-content">Skip to content</a><button class="nav-toggle-button" type="button" aria-label="Open navigation" aria-controls="primary-navigation" aria-expanded="false"><span></span><span></span><span></span></button><button class="nav-scrim" type="button" aria-label="Close navigation"></button><aside class="app-sidebar" id="primary-navigation" aria-label="Primary navigation"><a class="brand" href="/?env=production"><span class="dot"></span><span>ts-cloud</span></a><div class="sidebar-context"><span class="context-label">Project</span><strong>ts-cloud</strong></div><div class="environment-picker" aria-label="Environment"><span class="context-label">Environment</span><details><summary class="environment-current production"><span>PROD</span><strong>production</strong></summary></details></div><button class="command-trigger" type="button" aria-keyshortcuts="Meta+K Control+K"><span>Search resources</span><kbd>⌘ K</kbd></button><div class="nav-groups"><section class="nav-group"><h2>Overview</h2><a class="" href="/?env=production">Dashboard</a><a href="/server/activity?env=production">Activity</a></section><section class="nav-group"><h2>Applications</h2><a class="" href="/server/sites?env=production">Services</a><a class="" href="/server/deployments?env=production">Deployments</a><a class="" href="/server/logs?env=production">Logs</a><a class="" href="/integrations?env=production">Git integrations</a><a class="" href="/applications/new?env=production">Create application</a><a class="" href="/applications/compose?env=production">Compose applications</a></section><section class="nav-group"><h2>Operations</h2><a class="" href="/operations/queue?env=production">Deployment queue</a><a class="" href="/operations/previews?env=production">Preview environments</a><a class="" href="/operations/releases?env=production">Releases & promotion</a><a class="" href="/operations/regions?env=production">Regions & failover</a><a class="" href="/operations/maintenance?env=production">Maintenance & DR</a><a class="" href="/operations/workloads?env=production">Workloads</a><a class="" href="/operations/observability?env=production">Observability</a><a class="" href="/operations/alerts?env=production">Alerts & health</a><a class="" href="/operations/spend?env=production">Spend & budgets</a><a href="/server/metrics?env=production">Metrics</a><a href="/server/services?env=production">Runtime services</a><a class="" href="/operations/jobs?env=production">Workers & schedules</a><a class="" href="/operations/configuration?env=production">Environment &amp; secrets</a><a class="" href="/data/backups?env=production">Backups &amp; recovery</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/actions?env=production">Run operations</a></section><section class="nav-group"><h2>Infrastructure</h2><a class="" href="/infrastructure/topology?env=production">Infrastructure map</a><a class="" href="/data/services?env=production">Data services</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/firewall?env=production">Network & firewall</a><a href="/server/ssh-keys?env=production">SSH keys</a><a class="" href="/server/fleet?env=production">Fleet inventory</a><a class="" href="/server/capacity?env=production">Capacity & placement</a><a href="/security?env=production">Security posture</a><a href="/server/terminal?env=production">Terminal</a></section><section class="nav-group"><h2>Organization</h2><a class="" href="/server/team?env=production">People & access</a><a class="active" href="/account/automation?env=production">API & automation</a></section><section class="nav-group"><h2>Account</h2><a class="" href="/account/security?env=production">Sign-in & security</a></section></div><form method="post" action="/api/logout" class="signout"><button type="submit">Sign out</button></form></aside><dialog class="command-palette" aria-labelledby="command-title"><div class="command-search"><span aria-hidden="true">⌕</span><input type="search" placeholder="Search services, domains, deployments…" aria-label="Search resources" autocomplete="off"><button type="button" class="command-close" aria-label="Close search">Esc</button></div><h2 id="command-title" class="sr-only">Search resources and navigation</h2><div class="command-status" role="status">Start typing to search this project.</div><section class="saved-views" aria-labelledby="saved-views-title"><div class="saved-views-heading"><h3 id="saved-views-title">Saved views</h3><form class="save-view-form"><label class="sr-only" for="save-view-name">Saved view name</label><input id="save-view-name" maxlength="64" placeholder="Name this view" autocomplete="off"><button type="submit">Save current filters</button></form></div><div class="saved-view-list"></div></section><form class="tag-result-form"><label for="tag-result-name">Tag selected resource</label><input id="tag-result-name" maxlength="32" placeholder="customer-facing" pattern="[A-Za-z0-9][A-Za-z0-9 -]{0,31}" autocomplete="off"><input class="tag-color" type="color" value="#5a8be0" aria-label="Tag color"><button type="submit">Add tag</button></form><div class="command-results" role="listbox" aria-label="Search results"></div><footer><span>↑ ↓ navigate</span><span>Enter open</span><span>Esc close</span></footer></dialog><div class="context-bar" aria-label="Current scope"><div class="context-path"><div class="context-breadcrumb"><span>ts-cloud</span><i>/</i><strong>production</strong></div><div class="context-filters" aria-label="Active filters"></div></div><span class="scope-safety production">Production scope</span></div> <script data-stx-scoped data-stx-run="always">
+window.__stx_latestSetup=__stx_setup_1791679509440_5;
+if(window.stx)window.stx._latestSetup=__stx_setup_1791679509440_5;
+</script> <style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.906ee17c.css"></head><body data-stx="__stx_setup_1791679509440_5"><a data-stx-scope="stx_scope_nav_7" class="skip-link" href="#main-content">Skip to content</a><button class="nav-toggle-button" type="button" aria-label="Open navigation" aria-controls="primary-navigation" aria-expanded="false"><span></span><span></span><span></span></button><button class="nav-scrim" type="button" aria-label="Close navigation"></button><aside class="app-sidebar" id="primary-navigation" aria-label="Primary navigation"><a class="brand" href="/?env=production"><span class="dot"></span><span>ts-cloud</span></a><div class="sidebar-context"><span class="context-label">Project</span><strong>ts-cloud</strong></div><div class="environment-picker" aria-label="Environment"><span class="context-label">Environment</span><details><summary class="environment-current production"><span>PROD</span><strong>production</strong></summary></details></div><button class="command-trigger" type="button" aria-keyshortcuts="Meta+K Control+K"><span>Search resources</span><kbd>⌘ K</kbd></button><div class="nav-groups"><section class="nav-group"><h2>Overview</h2><a class="" href="/?env=production">Dashboard</a><a href="/server/activity?env=production">Activity</a></section><section class="nav-group"><h2>Applications</h2><a class="" href="/server/sites?env=production">Services</a><a class="" href="/server/deployments?env=production">Deployments</a><a class="" href="/server/logs?env=production">Logs</a><a class="" href="/integrations?env=production">Git integrations</a><a class="" href="/applications/new?env=production">Create application</a><a class="" href="/applications/compose?env=production">Compose applications</a></section><section class="nav-group"><h2>Operations</h2><a class="" href="/operations/queue?env=production">Deployment queue</a><a class="" href="/operations/previews?env=production">Preview environments</a><a class="" href="/operations/releases?env=production">Releases & promotion</a><a class="" href="/operations/regions?env=production">Regions & failover</a><a class="" href="/operations/maintenance?env=production">Maintenance & DR</a><a class="" href="/operations/workloads?env=production">Workloads</a><a class="" href="/operations/observability?env=production">Observability</a><a class="" href="/operations/alerts?env=production">Alerts & health</a><a class="" href="/operations/spend?env=production">Spend & budgets</a><a href="/server/metrics?env=production">Metrics</a><a href="/server/services?env=production">Runtime services</a><a class="" href="/operations/jobs?env=production">Workers & schedules</a><a class="" href="/operations/configuration?env=production">Environment &amp; secrets</a><a class="" href="/data/backups?env=production">Backups &amp; recovery</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/actions?env=production">Run operations</a></section><section class="nav-group"><h2>Infrastructure</h2><a class="" href="/infrastructure/topology?env=production">Infrastructure map</a><a class="" href="/data/services?env=production">Data services</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/firewall?env=production">Network & firewall</a><a href="/server/ssh-keys?env=production">SSH keys</a><a class="" href="/server/fleet?env=production">Fleet inventory</a><a class="" href="/server/capacity?env=production">Capacity & placement</a><a href="/security?env=production">Security posture</a><a href="/server/terminal?env=production">Terminal</a></section><section class="nav-group"><h2>Organization</h2><a class="" href="/server/team?env=production">People & access</a><a class="active" href="/account/automation?env=production">API & automation</a></section><section class="nav-group"><h2>Account</h2><a class="" href="/account/security?env=production">Sign-in & security</a></section></div><form method="post" action="/api/logout" class="signout"><button type="submit">Sign out</button></form></aside><dialog class="command-palette" aria-labelledby="command-title"><div class="command-search"><span aria-hidden="true">⌕</span><input type="search" placeholder="Search services, domains, deployments…" aria-label="Search resources" autocomplete="off"><button type="button" class="command-close" aria-label="Close search">Esc</button></div><h2 id="command-title" class="sr-only">Search resources and navigation</h2><div class="command-status" role="status">Start typing to search this project.</div><section class="saved-views" aria-labelledby="saved-views-title"><div class="saved-views-heading"><h3 id="saved-views-title">Saved views</h3><form class="save-view-form"><label class="sr-only" for="save-view-name">Saved view name</label><input id="save-view-name" maxlength="64" placeholder="Name this view" autocomplete="off"><button type="submit">Save current filters</button></form></div><div class="saved-view-list"></div></section><form class="tag-result-form"><label for="tag-result-name">Tag selected resource</label><input id="tag-result-name" maxlength="32" placeholder="customer-facing" pattern="[A-Za-z0-9][A-Za-z0-9 -]{0,31}" autocomplete="off"><input class="tag-color" type="color" value="#5a8be0" aria-label="Tag color"><button type="submit">Add tag</button></form><div class="command-results" role="listbox" aria-label="Search results"></div><footer><span>↑ ↓ navigate</span><span>Enter open</span><span>Esc close</span></footer></dialog><div class="context-bar" aria-label="Current scope"><div class="context-path"><div class="context-breadcrumb"><span>ts-cloud</span><i>/</i><strong>production</strong></div><div class="context-filters" aria-label="Active filters"></div></div><span class="scope-safety production">Production scope</span></div> <script data-stx-scoped data-stx-run="always">
 (function() {
   var { batch, computed, configureFetch, defineEmits, defineExpose, definePageMeta, defineProps, defineSlots, defineStore, derived, effect, goBack, goForward, inject, invalidateRoute, isDerived, isSignal, navigate, nextTick, onBeforeMount, onBeforeUnmount, onDestroy, onMount, onMounted, onUnmounted, peek, provide, reactive, ref, refresh, registerStoresClient, setRouteParams, state, untrack, useAsync, useClickOutside, useColorMode, useCookie, useCounter, useDark, useDebounce, useDebouncedValue, useEventListener, useFetch, useFocus, useHead, useId, useInterval, useLocalStorage, useMediaQuery, useMutation, useOptimistic, usePreferredContrast, usePreferredDark, usePreferredLight, usePreferredReducedMotion, useQuery, useReactiveProp, useRef, useRoute, useRouteParam, useRouteParams, useScrollLock, useSearchParams, useSeoMeta, useSessionStorage, useSlots, useStore, useThrottle, useTimeout, useToggle, useWebSocket, watch, watchEffect, watchMultiple, withDefaults } = window.stx;
   var __destroyHooks = [];
@@ -542,6 +542,6 @@ if(window.stx)window.stx._latestSetup=__stx_setup_1791662639002_5;
   
   
   try { if (typeof __stxScopeRenames !== 'undefined' && __stxScopeRenames) { for (var __stxRK in __stxScopeRenames) __scopeRegistration[__stxRK] = __stxScopeRenames[__stxRK]; } } catch (e) { /* no renames */ }
-  window.stx._scopes['stx_scope_nav_6'] = __scopeRegistration;
+  window.stx._scopes['stx_scope_nav_7'] = __scopeRegistration;
 })();
 </script> <div class="wrap"><div class="crumbs"><a href="/">Dashboard</a><span class="sep">/</span> Organization <span class="sep">/</span> API &amp; automation</div><header class="page"><div><h1>API &amp; automation</h1><p>Create least-privilege machine identities for CI. Tokens never create browser sessions and cannot access outside their membership and token scope.</p></div><a class="btn ghost" href="/api/v1/openapi.json">OpenAPI 3.1</a></header><div class="automation-message msg" :class="messageKind()" role="status" aria-live="polite" x-cloak>{{ message() }}</div><div class="panel reveal" @show="!!reveal()" x-cloak><div><strong>Copy this token now</strong><span>The raw secret is shown once. Rotation keeps the old token active until you explicitly revoke it.</span></div><code x-cloak>{{ reveal()?.secret }}</code><button class="btn sm" type="button" @click="copy(reveal()?.secret)">Copy token</button><label>curl</label><code x-cloak>{{ curlExample() }}</code><button class="btn ghost sm" type="button" @click="copy(curlExample())">Copy curl</button><label>CLI</label><code x-cloak>{{ cliExample() }}</code><button class="btn ghost sm" type="button" @click="copy(cliExample())">Copy CLI</button><button class="btn danger sm" type="button" @click="reveal.set(null)">I saved it; hide secret</button></div><div class="section"><h2>Service accounts</h2><div class="accounts" x-cloak><template :for="item in accounts()"><article class="account panel" :class="selectedAccount() === item.account.id ? 'selected' : ''" x-cloak><button class="account-main" type="button" @click="selectAccount(item)" x-cloak><span x-cloak><strong x-cloak>{{ item.account.name }}</strong><small x-cloak>{{ item.account.slug }} · {{ item.membership?.roleTemplate }} · {{ scopeLabel(item.membership?.scope) }}</small><small x-cloak>Created {{ new Date(item.account.createdAt).toLocaleDateString() }} by {{ item.createdBy?.displayName || 'offline administrator' }}</small></span><span class="tag" x-cloak>{{ item.account.state }}</span></button><div class="token-list" x-cloak><template :for="token in item.tokens"><div class="token" x-cloak><div x-cloak><strong x-cloak>{{ token.name }}</strong><code x-cloak>{{ token.prefix }}</code><small x-cloak>{{ tokenState(token) }} · created {{ new Date(token.createdAt).toLocaleDateString() }} by {{ token.createdBy?.displayName || 'offline administrator' }} · expires {{ new Date(token.expiresAt).toLocaleDateString() }} · last used {{ token.lastUsedAt ? new Date(token.lastUsedAt).toLocaleString() : 'never' }}</small><small x-cloak>{{ token.capabilities.join(', ') }} · {{ scopeLabel(token.scope) }}</small></div><div class="table-actions"><button class="btn ghost sm" type="button" @show="token.state === 'active'" @click="tokenAction(token, 'rotate')" x-cloak>Rotate</button><button class="btn danger sm" type="button" @show="token.state === 'active'" @click="tokenAction(token, 'revoke')" x-cloak>Revoke</button></div></div></template><div class="compact empty" @show="item.tokens.length === 0" x-cloak><span>No tokens yet.</span></div></div><button class="btn danger sm" type="button" @show="item.account.state === 'active'" @click="disableAccount(item)" x-cloak>Disable account and tokens</button></article></template><div class="compact empty panel" @show="accounts().length === 0" x-cloak><strong>No service accounts</strong><span>Create one for a CI system or external automation.</span></div></div></div><div class="section"><h2>Create service account</h2><div class="panel"><form class="form-grid" @submit.prevent="createAccount()"><div class="field-block"><label for="account-name">Name</label><input id="account-name" :value="accountName()" @input="accountName.set($event.target.value)" placeholder="Production CI" required></div><div class="field-block"><label for="account-slug">Slug</label><input id="account-slug" :value="accountSlug()" @input="accountSlug.set($event.target.value)" pattern="[a-z0-9][a-z0-9-]{1,47}" placeholder="production-ci" required></div><div class="field-block"><label for="account-role">Maximum role</label><select id="account-role" :value="accountRole()" @change="accountRole.set($event.target.value)"><option value="viewer">Viewer</option><option value="auditor">Auditor</option><option value="deployer">Deployer</option><option value="operator">Operator</option><option value="admin">Admin</option></select><small>Service accounts can never be owners.</small></div><div class="field-block"><label for="account-scope">Maximum scope</label><select id="account-scope" :value="accountScopeType()" @change="accountScopeType.set($event.target.value); setScope($event.target.value, accountScopeId)"><option value="organization">Organization</option><option value="project">Current project</option><option value="environment">One environment</option><option value="resource">One service</option></select></div><div class="field-block" @show="accountScopeType() === 'environment'" x-cloak><label for="account-environment">Environment</label><select id="account-environment" :value="accountScopeId()" @change="accountScopeId.set($event.target.value)"><template :for="environment in environments()"><option :value="environment.id">{{ environment.name }}</option></template></select></div><div class="field-block" @show="accountScopeType() === 'resource'" x-cloak><label for="account-resource">Service</label><select id="account-resource" :value="accountScopeId()" @change="accountScopeId.set($event.target.value)"><template :for="resource in resources()"><option :value="resource.id">{{ resource.name }}</option></template></select></div><div class="form-actions"><button class="btn" type="submit">Create service account</button></div></form></div></div><div class="section"><h2>Create API token</h2><div class="panel"><form class="form-grid" @submit.prevent="createToken()"><div class="field-block"><label for="token-account">Service account</label><select id="token-account" :value="selectedAccount()" @change="selectAccount(accounts().find(item => item.account.id === $event.target.value))" required><template :for="item in accounts()"><option :value="item.account.id" :disabled="item.account.state !== 'active'">{{ item.account.name }}</option></template></select></div><div class="field-block"><label for="token-name">Token name</label><input id="token-name" :value="tokenName()" @input="tokenName.set($event.target.value)" required></div><div class="field-block"><label for="token-expiry">Expiry</label><input id="token-expiry" type="date" :value="tokenExpiry()" @input="tokenExpiry.set($event.target.value)"><small>Defaults to 90 days; maximum one year.</small></div><div class="field-block"><label for="token-scope">Token scope</label><select id="token-scope" :value="tokenScopeType()" @change="tokenScopeType.set($event.target.value); setScope($event.target.value, tokenScopeId)"><option value="organization">Organization</option><option value="project">Current project</option><option value="environment">One environment</option><option value="resource">One service</option></select><small>Must be equal to or narrower than the service-account scope.</small></div><div class="field-block" @show="tokenScopeType() === 'environment'" x-cloak><label>Environment</label><select :value="tokenScopeId()" @change="tokenScopeId.set($event.target.value)"><template :for="environment in environments()"><option :value="environment.id">{{ environment.name }}</option></template></select></div><div class="field-block" @show="tokenScopeType() === 'resource'" x-cloak><label>Service</label><select :value="tokenScopeId()" @change="tokenScopeId.set($event.target.value)"><template :for="resource in resources()"><option :value="resource.id">{{ resource.name }}</option></template></select></div><fieldset class="capabilities"><legend>Explicit capabilities</legend><template :for="capability in capabilities"><label class="capability" x-cloak><input type="checkbox" :checked="tokenCapabilities().includes(capability[0])" @change="toggleCapability(capability[0])"><span x-cloak><b x-cloak>{{ capability[0] }}</b><small x-cloak>{{ capability[1] }}</small></span></label></template></fieldset><div class="form-actions"><button class="btn" type="submit" :disabled="!selectedAccount() || tokenCapabilities().length === 0">Create and reveal token</button></div></form></div></div><div class="section"><h2>Confirm sensitive changes</h2><div class="auth-grid panel"><div class="field-block"><label for="automation-password">Your password</label><input id="automation-password" type="password" autocomplete="current-password" :value="password()" @input="password.set($event.target.value)" required></div><div class="field-block"><label for="automation-code">Authenticator or recovery code</label><input id="automation-code" autocomplete="one-time-code" :value="mfaCode()" @input="mfaCode.set($event.target.value)"><small>Required when MFA is enabled. Used only for recent-auth confirmation.</small></div></div></div></div><style> .automation-message{min-height:20px;margin-top:12px}.accounts{display:grid;gap:12px}.account{display:grid;gap:14px}.account.selected{border-color:var(--accent)} .account-main{display:flex;justify-content:space-between;gap:12px;width:100%;text-align:left;background:none;border:0;color:inherit;cursor:pointer}.account-main span:first-child{display:grid;gap:4px}.account-main small,.token small{color:var(--txt3);font-size:12px;line-height:1.5} .token-list{display:grid;gap:10px}.token{display:flex;justify-content:space-between;gap:14px;padding:12px;border:1px solid var(--panel-br);border-radius:10px}.token>div:first-child{display:grid;gap:4px;min-width:0}.token code{color:var(--txt2)} .reveal{display:grid;grid-template-columns:minmax(0,1fr) auto;gap:10px;margin-top:18px;border-color:rgba(53,209,155,.35)}.reveal>div,.reveal>code,.reveal>label{grid-column:1/-1}.reveal>div{display:grid;gap:4px}.reveal span{color:var(--txt2);font-size:12px}.reveal code{padding:10px;background:rgba(0,0,0,.25);border-radius:8px;overflow-wrap:anywhere;user-select:all} .capabilities{grid-column:1/-1;border:1px solid var(--panel-br);border-radius:10px;padding:12px;display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:8px}.capabilities legend{padding:0 6px;color:var(--txt3);font-size:11px;font-weight:800;text-transform:uppercase}.capability{display:flex;gap:9px;align-items:flex-start;padding:9px}.capability input{width:auto;margin-top:3px}.capability span{display:grid;gap:2px}.capability small{color:var(--txt3);font-size:11px}.auth-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px} @media(max-width:700px){.token{display:grid}.reveal,.capabilities,.auth-grid{grid-template-columns:1fr}.reveal>*{grid-column:1}} </style></body></html>