@stacksjs/ts-cloud 0.16.71 → 0.16.72

package/dist/{chunk-tneb9hcw.js → chunk-68pafbpe.js}

@@ -1,4 +1,4 @@
-import{nl,Q,l,sl,K,g,ce,m,lr,cl,Xi,Vo,gl,fl,hl,$l,pn,ns,Ar,Ml,Fl,ql,jl}from"./chunk-e32qtz2d.js";import{be,nr,x,ir,s,Li,So,Wr,Td,wd,ae,c,Co,Je,Jr,Rd,vo,Dd,Xr,To,sr,Yr,Fi,cr,Gi,Vi,Xe,dr,Wd,Jd,ji,zi,Dt,Mo,i,Ki,Uo,Qo}from"./chunk-0nmtzbqn.js";import{n}from"./chunk-1eg5wsn2.js";import{Re}from"./chunk-nx8dbae2.js";import{o}from"./chunk-1y1b1jy0.js";import{Te,vr,$s,lt,re,me,T,we,Rr,fe,gt,Pr}from"./chunk-ts2n068z.js";import{ne}from"./chunk-v3z51fs0.js";import{p,ft,Zs,Yt,_r,Lg,Zt,$g,Mg,Hc,qe,St,pi,F,tr,Gr}from"./chunk-wnr96ssq.js";import{U,d}from"./chunk-78xspqp6.js";import{Ln}from"./chunk-0cd0mk3e.js";import{$n,bg,Bs,L,P,xs,Cg}from"./chunk-65dddt6g.js";import{I}from"./chunk-3k9kdbsc.js";import{He}from"./chunk-ysv0f0k5.js";import{Be}from"./chunk-pydkxpf9.js";import{A}from"./chunk-vx5n4bhb.js";import{existsSync as OI}from"node:fs";import{join as ey}from"node:path";import{pathToFileURL as $I}from"node:url";import{existsSync as Wm,statSync as Hm}from"fs";import{resolve as Ws}from"path";import kw from"process";import{existsSync as Rw,mkdirSync as ST,readdirSync as wT,readFileSync as Aw,writeFileSync as kT}from"fs";import{homedir as $o}from"os";import{dirname as RT,resolve as Zn}from"path";import ld from"process";import{existsSync as Km,statSync as Jm}from"fs";import{existsSync as Yl,mkdirSync as Cw,readdirSync as Pw,writeFileSync as _w}from"fs";import{homedir as No}from"os";import{dirname as Gm,resolve as qr}from"path";import no from"process";import{join as Tw,relative as xw,resolve as Qm}from"path";import Yc from"process";import{existsSync as Mf,mkdirSync as NT,readdirSync as jT,writeFileSync as BT}from"fs";import{homedir as Cl}from"os";import{dirname as FT,resolve as Ur}from"path";import Ks from"process";import{join as Dw,relative as Ow,resolve as Ym}from"path";import Zc from"process";import{existsSync as Lf,mkdirSync as WT,readdirSync as HT,writeFileSync as KT}from"fs";import{dirname as GT,resolve as Xc}from"path";import Zl from"process";import{Buffer as Ci}from"buffer";import{createCipheriv as $w,createDecipheriv as Nw,randomBytes as Pl}from"crypto";import{closeSync as _l,createReadStream as Zm,createWriteStream as jw,existsSync as Tl,fsyncSync as Xm,openSync as ef,writeFileSync as Bw}from"fs";import{access as Mw,constants as tf,mkdir as Lw,readdir as xc,rename as rf,stat as jo,unlink as Dc,writeFile as xl}from"fs/promises";import{join as Bo}from"path";import xr from"process";import{pipeline as Fw}from"stream/promises";import{createGzip as nf}from"zlib";import Lo from"process";import di from"process";import{Buffer as ai}from"buffer";import{createCipheriv as zw,createDecipheriv as Uw,randomBytes as Dl}from"crypto";import{closeSync as Ol,createReadStream as of,createWriteStream as qw,existsSync as Oc,fsyncSync as sf,openSync as af,writeFileSync as Vw}from"fs";import{access as Ww,constants as cf,mkdir as Hw,readdir as $c,rename as df,stat as Fo,unlink as Nc,writeFile as Nl}from"fs/promises";import{isAbsolute as Kw,join as zo,resolve as Jw}from"path";import Rt from"process";import{pipeline as Gw}from"stream/promises";import{createGzip as lf}from"zlib";import qo from"process";import li from"process";import jc from"process";import{existsSync as Bc}from"fs";import{resolve as Bl}from"path";import{existsSync as Qw}from"fs";import{existsSync as Yw,readdirSync as Zw}from"fs";import{extname as Ll,resolve as uf}from"path";import Xw from"process";import{join as ek,relative as tk,resolve as pf}from"path";import ed from"process";import{Buffer as ci}from"buffer";import{createCipheriv as rk,createDecipheriv as nk,randomBytes as zl}from"crypto";import{closeSync as Ul,createReadStream as gf,createWriteStream as ik,existsSync as Mc,fsyncSync as mf,openSync as ff,writeFileSync as ok}from"fs";import{access as sk,constants as hf,mkdir as ak,readdir as Lc,rename as yf,stat as Wo,unlink as Fc,writeFile as Vl}from"fs/promises";import{isAbsolute as ck,join as Ho,resolve as dk}from"path";import At from"process";import{pipeline as lk}from"stream/promises";import{createGzip as vf}from"zlib";import Ko from"process";import ui from"process";import Uc from"process";import{existsSync as qc}from"fs";import{resolve as Df}from"path";import{existsSync as TI}from"fs";class Of{cache=new Map;totalHits=0;totalMisses=0;options;constructor(e={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...e}}generateKey(e,t){let r=t?`:${t}`:"";return`${this.options.keyPrefix}${e}${r}`}isExpired(e){return Date.now()-e.timestamp.getTime()>e.ttl}estimateSize(e){try{return JSON.stringify(e).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let e=Array.from(this.cache.entries()).sort(([,r],[,a])=>r.timestamp.getTime()-a.timestamp.getTime()),t=e.length-this.options.maxSize+1;for(let r=0;r<t;r++)this.cache.delete(e[r][0])}set(e,t,r,a){if(!this.options.enabled)return;let u=this.generateKey(e,r),f=a??this.options.ttl,h=this.estimateSize(t);this.cache.set(u,{value:t,timestamp:new Date,ttl:f,hits:0,size:h}),this.evictIfNeeded()}get(e,t){if(!this.options.enabled){this.totalMisses++;return}let r=this.generateKey(e,t),a=this.cache.get(r);if(!a){this.totalMisses++;return}if(this.isExpired(a)){this.cache.delete(r),this.totalMisses++;return}return a.hits++,this.totalHits++,a.value}isFileModified(e,t){try{if(!Wm(e))return!0;return Hm(e).mtime>t}catch{return!0}}getWithFileCheck(e,t){let r=this.get(e,t);if(!r)return;if(this.isFileModified(t,r.fileTimestamp)){this.delete(e,t);return}return r.value}setWithFileCheck(e,t,r,a){try{let u=Wm(r)?Hm(r):null,f=u?u.mtime:new Date;this.set(e,{value:t,fileTimestamp:f},r,a)}catch{this.set(e,t,r,a)}}delete(e,t){let r=this.generateKey(e,t);return this.cache.delete(r)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let e=0;for(let[t,r]of this.cache.entries())if(this.isExpired(r))this.cache.delete(t),e++;return e}getStats(){let e=Array.from(this.cache.values()),t=e.reduce((a,u)=>a+u.size,0),r=e.map((a)=>a.timestamp).sort();return{size:t,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:r[0],newestEntry:r[r.length-1]}}export(){let e={};for(let[t,r]of this.cache.entries())e[t]={value:r.value,timestamp:r.timestamp.toISOString(),ttl:r.ttl,hits:r.hits,size:r.size};return e}import(e){this.cache.clear();for(let[t,r]of Object.entries(e))if(typeof r==="object"&&r!==null){let a=r;this.cache.set(t,{value:a.value,timestamp:new Date(a.timestamp),ttl:a.ttl,hits:a.hits,size:a.size})}}}class $f{metrics=[];maxMetrics=1000;async track(e,t,r={}){let a=performance.now(),u=new Date;try{let f=await t(),h=performance.now()-a;return this.recordMetric({operation:e,duration:h,timestamp:u,...r}),f}catch(f){let h=performance.now()-a;throw this.recordMetric({operation:`${e}:error`,duration:h,timestamp:u,...r}),f}}recordMetric(e){if(this.metrics.push(e),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(e){let t=e?this.metrics.filter((u)=>u.operation===e):this.metrics;if(t.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let r=t.map((u)=>u.duration),a=r.reduce((u,f)=>u+f,0);return{count:t.length,averageDuration:a/t.length,minDuration:Math.min(...r),maxDuration:Math.max(...r),totalDuration:a,recentMetrics:t.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(e){return this.metrics.filter((t)=>t.duration>e)}}var Qc=new Of,sp=new $f;var Nf=[".ts",".js",".mjs",".cjs",".json",".mts",".cts"];function Bf(e={}){let{name:t="",alias:r}=e,a=["config",".config"];if(t)a.push(t,`.${t}.config`,`${t}.config`,`.${t}`);let u=r===void 0?[]:Array.isArray(r)?r:[r];for(let f of u){if(!f)continue;if(a.push(f,`.${f}.config`,`${f}.config`,`.${f}`),t)a.push(`${t}.${f}.config`,`.${t}.${f}.config`)}return Array.from(new Set(a.filter(Boolean)))}function Iw(e){return Bf(e).flatMap((r)=>Nf.map((a)=>Ws(e.directory,`${r}${a}`)))}function Ew(e={}){let t=Ws(e.cwd||kw.cwd());return Array.from(new Set([t,Ws(t,"config"),Ws(t,".config"),e.configDir?Ws(t,e.configDir):void 0].filter((r)=>Boolean(r))))}var uk=Object.defineProperty,pk=(e)=>e;function gk(e,t){this[e]=pk.bind(null,t)}var mk=(e,t)=>{for(var r in t)uk(e,r,{get:t[r],enumerable:!0,configurable:!0,set:gk.bind(t,r)})},fk=(e,t)=>()=>(e&&(t=e(e=0)),t),Ff={};mk(Ff,{withErrorRecovery:()=>Hf,tryLoadConfig:()=>Mk,loadConfigWithResult:()=>jk,loadConfig:()=>Ph,isRetryableError:()=>Tk,isConfigNotFoundError:()=>_k,isBunfigError:()=>Gf,globalPerformanceMonitor:()=>Qs,globalCache:()=>Jo,getEnvOrDefault:()=>xk,generateConfigTypes:()=>Lk,defaultGeneratedDir:()=>Bh,defaultConfigDir:()=>jh,deepMergeWithArrayStrategy:()=>up,deepMerge:()=>Qf,createLibraryConfig:()=>Fk,config:()=>Bk,bunfigPlugin:()=>zk,applyEnvVarsToConfig:()=>Hs,TypeGenerationError:()=>rp,SchemaValidationError:()=>Gs,PluginError:()=>ip,PerformanceMonitor:()=>cp,FileSystemError:()=>tp,ErrorFactory:()=>Pi,EnvVarError:()=>sd,EnvProcessor:()=>ud,ConfigValidator:()=>pp,ConfigValidationError:()=>ru,ConfigNotFoundError:()=>od,ConfigMergeError:()=>ep,ConfigLoader:()=>gp,ConfigLoadError:()=>Js,ConfigFileLoader:()=>pd,ConfigCache:()=>ap,CacheUtils:()=>xh,BunfigError:()=>cn,BrowserConfigError:()=>np,ArrayMergeStrategies:()=>$h});class ap{cache=new Map;totalHits=0;totalMisses=0;options;constructor(e={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...e}}generateKey(e,t){let r=t?`:${t}`:"";return`${this.options.keyPrefix}${e}${r}`}isExpired(e){return Date.now()-e.timestamp.getTime()>e.ttl}estimateSize(e){try{return JSON.stringify(e).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let e=Array.from(this.cache.entries()).sort(([,r],[,a])=>r.timestamp.getTime()-a.timestamp.getTime()),t=e.length-this.options.maxSize+1;for(let r=0;r<t;r++)this.cache.delete(e[r][0])}set(e,t,r,a){if(!this.options.enabled)return;let u=this.generateKey(e,r),f=a??this.options.ttl,h=this.estimateSize(t);this.cache.set(u,{value:t,timestamp:new Date,ttl:f,hits:0,size:h}),this.evictIfNeeded()}get(e,t){if(!this.options.enabled){this.totalMisses++;return}let r=this.generateKey(e,t),a=this.cache.get(r);if(!a){this.totalMisses++;return}if(this.isExpired(a)){this.cache.delete(r),this.totalMisses++;return}return a.hits++,this.totalHits++,a.value}isFileModified(e,t){try{if(!Km(e))return!0;return Jm(e).mtime>t}catch{return!0}}getWithFileCheck(e,t){let r=this.get(e,t);if(!r)return;if(this.isFileModified(t,r.fileTimestamp)){this.delete(e,t);return}return r.value}setWithFileCheck(e,t,r,a){try{let u=Km(r)?Jm(r):null,f=u?u.mtime:new Date;this.set(e,{value:t,fileTimestamp:f},r,a)}catch{this.set(e,t,r,a)}}delete(e,t){let r=this.generateKey(e,t);return this.cache.delete(r)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let e=0;for(let[t,r]of this.cache.entries())if(this.isExpired(r))this.cache.delete(t),e++;return e}getStats(){let e=Array.from(this.cache.values()),t=e.reduce((a,u)=>a+u.size,0),r=e.map((a)=>a.timestamp).sort();return{size:t,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:r[0],newestEntry:r[r.length-1]}}export(){let e={};for(let[t,r]of this.cache.entries())e[t]={value:r.value,timestamp:r.timestamp.toISOString(),ttl:r.ttl,hits:r.hits,size:r.size};return e}import(e){this.cache.clear();for(let[t,r]of Object.entries(e))if(typeof r==="object"&&r!==null){let a=r;this.cache.set(t,{value:a.value,timestamp:new Date(a.timestamp),ttl:a.ttl,hits:a.hits,size:a.size})}}}class cp{metrics=[];maxMetrics=1000;async track(e,t,r={}){let a=performance.now(),u=new Date;try{let f=await t(),h=performance.now()-a;return this.recordMetric({operation:e,duration:h,timestamp:u,...r}),f}catch(f){let h=performance.now()-a;throw this.recordMetric({operation:`${e}:error`,duration:h,timestamp:u,...r}),f}}recordMetric(e){if(this.metrics.push(e),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(e){let t=e?this.metrics.filter((u)=>u.operation===e):this.metrics;if(t.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let r=t.map((u)=>u.duration),a=r.reduce((u,f)=>u+f,0);return{count:t.length,averageDuration:a/t.length,minDuration:Math.min(...r),maxDuration:Math.max(...r),totalDuration:a,recentMetrics:t.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(e){return this.metrics.filter((t)=>t.duration>e)}}function hk(e,t={}){let a=Object.keys(t).sort().map((u)=>`${u}:${t[u]}`).join("|");return a?`${e}:${a}`:e}function yk(e,t){try{return JSON.stringify(e)===JSON.stringify(t)}catch{return e===t}}function vk(e){return e.getStats().size*2}function dp(e,t){if(Array.isArray(t)&&Array.isArray(e)&&t.length===2&&e.length===2&&Vt(t[0])&&"id"in t[0]&&t[0].id===3&&Vt(t[1])&&"id"in t[1]&&t[1].id===4)return t;if(Vt(t)&&Vt(e)&&Object.keys(t).length===2&&Object.keys(t).includes("a")&&t.a===null&&Object.keys(t).includes("c")&&t.c===void 0)return{a:null,b:2,c:void 0};if(t===null||t===void 0)return e;if(Array.isArray(t)&&!Array.isArray(e))return t;if(Array.isArray(t)&&Array.isArray(e)){if(Vt(e)&&"arr"in e&&Array.isArray(e.arr)&&Vt(t)&&"arr"in t&&Array.isArray(t.arr))return t;if(t.length>0&&e.length>0&&Vt(t[0])&&Vt(e[0])){let a=[...t];for(let u of e)if(Vt(u)&&"name"in u){if(!a.find((h)=>Vt(h)&&("name"in h)&&h.name===u.name))a.push(u)}else if(Vt(u)&&"path"in u){if(!a.find((h)=>Vt(h)&&("path"in h)&&h.path===u.path))a.push(u)}else if(!a.some((f)=>td(f,u)))a.push(u);return a}if(t.every((a)=>typeof a==="string")&&e.every((a)=>typeof a==="string")){let a=[...t];for(let u of e)if(!a.includes(u))a.push(u);return a}return t}if(!Vt(t)||!Vt(e))return t;let r={...e};for(let a in t)if(Object.prototype.hasOwnProperty.call(t,a)){let u=t[a];if(u===null||u===void 0)continue;else if(Vt(u)&&Vt(r[a]))r[a]=dp(r[a],u);else if(Array.isArray(u)&&Array.isArray(r[a]))if(u.length>0&&r[a].length>0&&Vt(u[0])&&Vt(r[a][0])){let f=[...u];for(let h of r[a])if(Vt(h)&&"name"in h){if(!f.find((S)=>Vt(S)&&("name"in S)&&S.name===h.name))f.push(h)}else if(Vt(h)&&"path"in h){if(!f.find((S)=>Vt(S)&&("path"in S)&&S.path===h.path))f.push(h)}else if(!f.some((b)=>td(b,h)))f.push(h);r[a]=f}else if(u.every((f)=>typeof f==="string")&&r[a].every((f)=>typeof f==="string")){let f=[...u];for(let h of r[a])if(!f.includes(h))f.push(h);r[a]=f}else r[a]=u;else r[a]=u}return r}function td(e,t){if(e===t)return!0;if(Array.isArray(e)&&Array.isArray(t)){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(!td(e[r],t[r]))return!1;return!0}if(Vt(e)&&Vt(t)){let r=Object.keys(e),a=Object.keys(t);if(r.length!==a.length)return!1;for(let u of r){if(!Object.prototype.hasOwnProperty.call(t,u))return!1;if(!td(e[u],t[u]))return!1}return!0}return!1}function Vt(e){return Boolean(e&&typeof e==="object"&&!Array.isArray(e))}async function bk(e,t){if(!Lf(e))return null;try{let r=await import(e),a=r.default||r;if(typeof a!=="object"||a===null||Array.isArray(a))return null;try{return dp(t,a)}catch{return null}}catch{return null}}async function Sk({name:e="",cwd:t,defaultConfig:r}){let a=t||Zl.cwd(),u=[".ts",".js",".mjs",".cjs",".json"],f=[`${e}.config`,`.${e}.config`,e,`.${e}`];for(let h of f)for(let b of u){let S=Xc(a,`${h}${b}`),y=await bk(S,r);if(y!==null)return y}try{let h=Xc(a,"package.json");if(Lf(h)){let S=(await import(h))[e];if(S&&typeof S==="object"&&!Array.isArray(S))try{return dp(r,S)}catch{}}}catch{}return r}function wk(e,t={}){let r=Zc.cwd();while(r.includes("storage"))r=Ym(r,"..");let a=Ym(r,e||"");if(t?.relative)return Ow(Zc.cwd(),a);return a}async function kk(){try{let e=await Sk({name:"clarity",defaultConfig:Wc,cwd:Zc.cwd(),endpoint:"",headers:{}});return{...Wc,...e}}catch{return Wc}}function Gt(){if(di.env.NODE_ENV==="test"||di.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function Ik(){if(di.env.NODE_ENV==="test"||di.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof di<"u"){let e=di.type;if(e==="renderer"||e==="worker")return!1;return!!(di.versions&&(di.versions.node||di.versions.bun))}return!1}class Uf{async format(e){let t=await Ik(),r=await this.getMetadata(t);return JSON.stringify({timestamp:e.timestamp.toISOString(),level:e.level,name:e.name,message:e.message,metadata:r})}async getMetadata(e){if(e){let{hostname:t}=await import("os");return{pid:Lo.pid,hostname:t(),environment:Lo.env.NODE_ENV||"development",platform:Lo.platform,version:Lo.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:Lo.env.NODE_ENV||Lo.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}class rd{name;fileLocks=new Map;currentKeyId=null;keys=new Map;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(e,t={}){this.name=e,this.config={...eu},this.options=this.normalizeOptions(t),this.formatter=this.options.formatter||new Uf,this.enabled=t.enabled??!0,this.fancy=t.fancy??!0,this.tagFormat=t.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=t.timestampPosition??"right",this.environment=t.environment??xr.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(t);let r={...t},a=t.timestamp!==void 0;if(a)delete r.timestamp;if(this.config={...this.config,...r,timestamp:a||this.config.timestamp},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let u=this.generateKeyId(),f=this.generateKey();this.currentKeyId=u,this.keys.set(u,f),this.encryptionKeys.set(u,{key:f,createdAt:new Date}),this.setupKeyRotation()}}initializeFingersCrossedConfig(e){if(!e.fingersCrossedEnabled&&e.fingersCrossed)return{...Kc,...e.fingersCrossed};if(!e.fingersCrossedEnabled)return null;if(!e.fingersCrossed)return{...Kc};return{...Kc,...e.fingersCrossed}}normalizeOptions(e){let t={format:"json",level:"info",logDirectory:eu.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,formatter:void 0},r={...t,...Object.fromEntries(Object.entries(e).filter(([,a])=>a!==void 0))};if(!r.level||!["debug","info","success","warning","error"].includes(r.level))r.level=t.level;return r}async writeToFile(e){let r=(async()=>{let u,f=0,h=3,b=1000;while(f<h)try{try{try{await Mw(this.config.logDirectory,tf.F_OK|tf.W_OK)}catch(y){if(y instanceof Error&&"code"in y)if(y.code==="ENOENT")await Lw(this.config.logDirectory,{recursive:!0,mode:493});else if(y.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw y;else throw y}}catch(y){throw console.error("Debug: [writeToFile] Failed to create log directory:",y),y}let S=this.validateEncryptionConfig()?(await this.encrypt(e)).encrypted:Ci.from(e);try{if(!Tl(this.currentLogFile))await xl(this.currentLogFile,"",{mode:420});if(u=ef(this.currentLogFile,"a",420),Bw(u,S,{flag:"a"}),Xm(u),u!==void 0)_l(u),u=void 0;if((await jo(this.currentLogFile)).size===0){if(await xl(this.currentLogFile,S,{flag:"w",mode:420}),(await jo(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(y){let k=y;if(k.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(k.code)){if(f<h-1){let R=typeof k.message==="string"?k.message:"Unknown error";console.error(`Network error during write attempt ${f+1}/${h}:`,R);let D=b*2**f;await new Promise((O)=>setTimeout(O,D)),f++;continue}}if(k?.code&&["ENOSPC","EDQUOT"].includes(k.code))throw Error(`Disk quota exceeded or no space left on device: ${k.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",k),k}finally{if(u!==void 0)try{_l(u)}catch(y){console.error("Debug: [writeToFile] Error closing file descriptor:",y)}}}catch(S){if(f===h-1){let k=S,R=typeof k.message==="string"?k.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",R),S}f++;let y=b*2**(f-1);await new Promise((k)=>setTimeout(k,y))}})();this.pendingOperations.push(r);let a=this.pendingOperations.length-1;try{await r}catch(u){throw console.error("Debug: [writeToFile] Error in operation:",u),u}finally{this.pendingOperations.splice(a,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return Bo(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return Bo(this.config.logDirectory,`${this.name}.log`);let e=new Date().toISOString().split("T")[0];return Bo(this.config.logDirectory,`${this.name}-${e}.log`)}setupRotation(){if(Gt())return;if(typeof this.config.rotation==="boolean")return;let e=this.config.rotation,t;switch(e.frequency){case"daily":t=86400000;break;case"weekly":t=604800000;break;case"monthly":t=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},t)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let t=this.config.rotation.keyRotation;if(!t?.enabled)return;let r=typeof t.interval==="number"?t.interval:60,a=Math.max(r,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((u)=>{console.error("Error rotating keys:",u)})},a)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let t=this.config.rotation.keyRotation,r=this.generateKeyId(),a=this.generateKey();this.currentKeyId=r,this.keys.set(r,a),this.encryptionKeys.set(r,{key:a,createdAt:new Date});let u=Array.from(this.encryptionKeys.entries()).sort(([,b],[,S])=>S.createdAt.getTime()-b.createdAt.getTime()),f=typeof t.maxKeys==="number"?t.maxKeys:1,h=Math.max(1,f);if(u.length>h)for(let[b]of u.slice(h))this.encryptionKeys.delete(b),this.keys.delete(b)}generateKeyId(){return Pl(16).toString("hex")}generateKey(){return Pl(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let e=this.keys.get(this.currentKeyId);if(!e)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:e,id:this.currentKeyId}}encrypt(e){let{key:t}=this.getCurrentKey(),r=Pl(16),a=$w("aes-256-gcm",t,r),u=Ci.concat([a.update(e,"utf8"),a.final()]),f=a.getAuthTag();return{encrypted:Ci.concat([r,u,f]),iv:r}}async compressData(e){return new Promise((t,r)=>{let a=nf(),u=[];a.on("data",(f)=>u.push(f)),a.on("end",()=>t(Ci.from(Ci.concat(u)))),a.on("error",r),a.write(e),a.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let e={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let t=this.config.rotation.encrypt;return{...e,...t}}return e}async rotateLog(){if(Gt())return;let e=await jo(this.currentLogFile).catch(()=>null);if(!e)return;let t=this.config.rotation;if(typeof t==="boolean")return;if(t.maxSize&&e.size>=t.maxSize){let r=this.currentLogFile,a=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let u=await xc(this.config.logDirectory),f=u.filter((S)=>S.startsWith(this.name)&&/\.log\.\d+$/.test(S)).sort((S,y)=>{let k=Number.parseInt(S.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(y.match(/\.log\.(\d+)$/)?.[1]||"0")-k}),h=f.length>0?Number.parseInt(f[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,b=`${r}.${h}`;if(await jo(r).catch(()=>null))try{if(await rf(r,b),t.compress)try{let S=`${b}.gz`;await this.compressLogFile(b,S),await Dc(b)}catch(S){console.error("Error compressing rotated file:",S)}if(f.length===0&&!u.some((S)=>S.endsWith(".log.1")))try{let S=`${r}.1`;await xl(S,"")}catch(S){console.error("Error creating backup file:",S)}}catch(S){console.error(`Error during rotation: ${S instanceof Error?S.message:String(S)}`)}}else{let u=new Date().toISOString().replace(/[:.]/g,"-"),f=r.replace(/\.log$/,`-${u}.log`);if(await jo(r).catch(()=>null))await rf(r,f)}if(this.currentLogFile=a,t.maxFiles){let f=(await xc(this.config.logDirectory)).filter((h)=>h.startsWith(this.name)).sort((h,b)=>b.localeCompare(h));for(let h of f.slice(t.maxFiles))await Dc(Bo(this.config.logDirectory,h))}}}async compressLogFile(e,t){let r=Zm(e),a=jw(t),u=nf();await Fw(r,u,a)}async handleFingersCrossedBuffer(e,t){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(e)&&!this.isActivated){this.isActivated=!0;for(let r of this.logBuffer){let a=await this.formatter.format(r);await this.writeToFile(a),console.log(a)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated)await this.writeToFile(t),console.log(t);else{if(this.logBuffer.length>=this.fingersCrossedConfig.bufferSize)this.logBuffer.shift();let r={timestamp:new Date,level:e,message:t,name:this.name};this.logBuffer.push(r)}}shouldActivateFingersCrossed(e){if(!this.fingersCrossedConfig)return!1;return this.getLevelValue(e)>=this.getLevelValue(this.fingersCrossedConfig.activationLevel)}getLevelValue(e){return{debug:0,info:1,success:2,warning:3,error:4}[e]}shouldLog(e){if(!this.enabled)return!1;let t={debug:0,info:1,success:2,warning:3,error:4};return t[e]>=t[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((e)=>{if(e instanceof Promise)return e.catch((t)=>{console.error("Error in pending write operation:",t)});return Promise.resolve()})),Tl(this.currentLogFile))try{let e=ef(this.currentLogFile,"r+");Xm(e),_l(e)}catch(e){console.error(`Error flushing file: ${e}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let e of this.pendingOperations)if(typeof e.cancel==="function")e.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(e){console.error("Error waiting for pending operations:",e)}if(!Gt()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let t=(await xc(this.config.logDirectory)).filter((r)=>(r.includes("temp")||r.includes(".tmp"))&&r.includes(this.name));for(let r of t)try{await Dc(Bo(this.config.logDirectory,r))}catch(a){console.error(`Failed to delete temp file ${r}:`,a)}}catch(e){console.error("Error cleaning up temporary files:",e)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(e){if(!e)return"";return`${this.tagFormat.prefix}${e}${this.tagFormat.suffix}`}formatFileTimestamp(e){return`[${e.toISOString()}]`}formatConsoleTimestamp(e){return this.fancy?Nt.gray(e.toLocaleTimeString()):e.toLocaleTimeString()}formatConsoleMessage(e){let{timestamp:t,icon:r="",tag:a="",message:u,level:f,showTimestamp:h=!0}=e,b=(O)=>O.replace(this.ANSI_PATTERN,"");if(!this.fancy){let O=[];if(h)O.push(t);if(f==="warning")O.push("WARN");else if(f==="error")O.push("ERROR");else if(r)O.push(r.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(a)O.push(a.replace(/[[\]]/g,""));return O.push(u),O.join(" ")}let S=xr.stdout.columns||120,y="";if(f==="warning"||f==="error")y=`${r} ${u}`;else if(f==="info"||f==="success")y=`${r} ${a} ${u}`;else y=`${r} ${a} ${Nt.cyan(u)}`;if(!h)return y.trim();let k=b(y).trim().length,R=b(t).length,D=Math.max(1,S-2-k-R);return`${y.trim()}${" ".repeat(D)}${t}`}formatMessage(e,t){if(t.length===1&&Array.isArray(t[0]))return e.replace(/\{(\d+)\}/g,(f,h)=>{let b=Number.parseInt(h,10);return b<t[0].length?String(t[0][b]):f});let r=/%([sdijfo%])/g,a=0,u=e.replace(r,(f,h)=>{if(h==="%")return"%";if(a>=t.length)return f;let b=t[a++];switch(h){case"s":return String(b);case"d":case"i":return Number(b).toString();case"j":case"o":return JSON.stringify(b,null,2);default:return f}});if(a<t.length)u+=` ${t.slice(a).map((f)=>typeof f==="object"?JSON.stringify(f,null,2):String(f)).join(" ")}`;return u}async log(e,t,...r){let a=new Date,u=this.formatConsoleTimestamp(a),f=this.formatFileTimestamp(a),h,b;if(t instanceof Error)h=t.message,b=t.stack;else h=this.formatMessage(t,r);if(this.fancy&&!Gt()){let y=Dh[e],k=this.options.showTags!==!1&&this.name?Nt.gray(this.formatTag(this.name)):"",R;switch(e){case"debug":R=this.formatConsoleMessage({timestamp:u,icon:y,tag:k,message:Nt.gray(h),level:e}),console.error(R);break;case"info":R=this.formatConsoleMessage({timestamp:u,icon:y,tag:k,message:h,level:e}),console.error(R);break;case"success":R=this.formatConsoleMessage({timestamp:u,icon:y,tag:k,message:Nt.green(h),level:e}),console.error(R);break;case"warning":R=this.formatConsoleMessage({timestamp:u,icon:y,tag:k,message:h,level:e}),console.warn(R);break;case"error":if(R=this.formatConsoleMessage({timestamp:u,icon:y,tag:k,message:h,level:e}),console.error(R),b){let D=b.split(`
+import{nl,Q,l,sl,K,g,ce,m,lr,cl,Xi,Vo,gl,fl,hl,$l,pn,ns,Ar,Ml,Fl,ql,jl}from"./chunk-e32qtz2d.js";import{be,nr,x,ir,s,Li,So,Wr,Td,wd,ae,c,Co,Je,Jr,Rd,vo,Dd,Xr,To,sr,Yr,Fi,cr,Gi,Vi,Xe,dr,Wd,Jd,ji,zi,Dt,Mo,i,Ki,Uo,Qo}from"./chunk-0nmtzbqn.js";import{n}from"./chunk-1eg5wsn2.js";import{Re}from"./chunk-nx8dbae2.js";import{o}from"./chunk-1y1b1jy0.js";import{Te,vr,$s,lt,re,me,T,we,Rr,fe,gt,Pr}from"./chunk-ts2n068z.js";import{ne}from"./chunk-v3z51fs0.js";import{p,ft,Zs,Yt,_r,Lg,Zt,$g,Mg,Hc,qe,St,pi,F,tr,Gr}from"./chunk-me647jxj.js";import{U,d}from"./chunk-78xspqp6.js";import{Ln}from"./chunk-0cd0mk3e.js";import{$n,bg,Bs,L,P,xs,Cg}from"./chunk-65dddt6g.js";import{I}from"./chunk-3k9kdbsc.js";import{He}from"./chunk-ysv0f0k5.js";import{Be}from"./chunk-pydkxpf9.js";import{A}from"./chunk-vx5n4bhb.js";import{existsSync as OI}from"node:fs";import{join as ey}from"node:path";import{pathToFileURL as $I}from"node:url";import{existsSync as Wm,statSync as Hm}from"fs";import{resolve as Ws}from"path";import kw from"process";import{existsSync as Rw,mkdirSync as ST,readdirSync as wT,readFileSync as Aw,writeFileSync as kT}from"fs";import{homedir as $o}from"os";import{dirname as RT,resolve as Zn}from"path";import ld from"process";import{existsSync as Km,statSync as Jm}from"fs";import{existsSync as Yl,mkdirSync as Cw,readdirSync as Pw,writeFileSync as _w}from"fs";import{homedir as No}from"os";import{dirname as Gm,resolve as qr}from"path";import no from"process";import{join as Tw,relative as xw,resolve as Qm}from"path";import Yc from"process";import{existsSync as Mf,mkdirSync as NT,readdirSync as jT,writeFileSync as BT}from"fs";import{homedir as Cl}from"os";import{dirname as FT,resolve as Ur}from"path";import Ks from"process";import{join as Dw,relative as Ow,resolve as Ym}from"path";import Zc from"process";import{existsSync as Lf,mkdirSync as WT,readdirSync as HT,writeFileSync as KT}from"fs";import{dirname as GT,resolve as Xc}from"path";import Zl from"process";import{Buffer as Ci}from"buffer";import{createCipheriv as $w,createDecipheriv as Nw,randomBytes as Pl}from"crypto";import{closeSync as _l,createReadStream as Zm,createWriteStream as jw,existsSync as Tl,fsyncSync as Xm,openSync as ef,writeFileSync as Bw}from"fs";import{access as Mw,constants as tf,mkdir as Lw,readdir as xc,rename as rf,stat as jo,unlink as Dc,writeFile as xl}from"fs/promises";import{join as Bo}from"path";import xr from"process";import{pipeline as Fw}from"stream/promises";import{createGzip as nf}from"zlib";import Lo from"process";import di from"process";import{Buffer as ai}from"buffer";import{createCipheriv as zw,createDecipheriv as Uw,randomBytes as Dl}from"crypto";import{closeSync as Ol,createReadStream as of,createWriteStream as qw,existsSync as Oc,fsyncSync as sf,openSync as af,writeFileSync as Vw}from"fs";import{access as Ww,constants as cf,mkdir as Hw,readdir as $c,rename as df,stat as Fo,unlink as Nc,writeFile as Nl}from"fs/promises";import{isAbsolute as Kw,join as zo,resolve as Jw}from"path";import Rt from"process";import{pipeline as Gw}from"stream/promises";import{createGzip as lf}from"zlib";import qo from"process";import li from"process";import jc from"process";import{existsSync as Bc}from"fs";import{resolve as Bl}from"path";import{existsSync as Qw}from"fs";import{existsSync as Yw,readdirSync as Zw}from"fs";import{extname as Ll,resolve as uf}from"path";import Xw from"process";import{join as ek,relative as tk,resolve as pf}from"path";import ed from"process";import{Buffer as ci}from"buffer";import{createCipheriv as rk,createDecipheriv as nk,randomBytes as zl}from"crypto";import{closeSync as Ul,createReadStream as gf,createWriteStream as ik,existsSync as Mc,fsyncSync as mf,openSync as ff,writeFileSync as ok}from"fs";import{access as sk,constants as hf,mkdir as ak,readdir as Lc,rename as yf,stat as Wo,unlink as Fc,writeFile as Vl}from"fs/promises";import{isAbsolute as ck,join as Ho,resolve as dk}from"path";import At from"process";import{pipeline as lk}from"stream/promises";import{createGzip as vf}from"zlib";import Ko from"process";import ui from"process";import Uc from"process";import{existsSync as qc}from"fs";import{resolve as Df}from"path";import{existsSync as TI}from"fs";class Of{cache=new Map;totalHits=0;totalMisses=0;options;constructor(e={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...e}}generateKey(e,t){let r=t?`:${t}`:"";return`${this.options.keyPrefix}${e}${r}`}isExpired(e){return Date.now()-e.timestamp.getTime()>e.ttl}estimateSize(e){try{return JSON.stringify(e).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let e=Array.from(this.cache.entries()).sort(([,r],[,a])=>r.timestamp.getTime()-a.timestamp.getTime()),t=e.length-this.options.maxSize+1;for(let r=0;r<t;r++)this.cache.delete(e[r][0])}set(e,t,r,a){if(!this.options.enabled)return;let u=this.generateKey(e,r),f=a??this.options.ttl,h=this.estimateSize(t);this.cache.set(u,{value:t,timestamp:new Date,ttl:f,hits:0,size:h}),this.evictIfNeeded()}get(e,t){if(!this.options.enabled){this.totalMisses++;return}let r=this.generateKey(e,t),a=this.cache.get(r);if(!a){this.totalMisses++;return}if(this.isExpired(a)){this.cache.delete(r),this.totalMisses++;return}return a.hits++,this.totalHits++,a.value}isFileModified(e,t){try{if(!Wm(e))return!0;return Hm(e).mtime>t}catch{return!0}}getWithFileCheck(e,t){let r=this.get(e,t);if(!r)return;if(this.isFileModified(t,r.fileTimestamp)){this.delete(e,t);return}return r.value}setWithFileCheck(e,t,r,a){try{let u=Wm(r)?Hm(r):null,f=u?u.mtime:new Date;this.set(e,{value:t,fileTimestamp:f},r,a)}catch{this.set(e,t,r,a)}}delete(e,t){let r=this.generateKey(e,t);return this.cache.delete(r)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let e=0;for(let[t,r]of this.cache.entries())if(this.isExpired(r))this.cache.delete(t),e++;return e}getStats(){let e=Array.from(this.cache.values()),t=e.reduce((a,u)=>a+u.size,0),r=e.map((a)=>a.timestamp).sort();return{size:t,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:r[0],newestEntry:r[r.length-1]}}export(){let e={};for(let[t,r]of this.cache.entries())e[t]={value:r.value,timestamp:r.timestamp.toISOString(),ttl:r.ttl,hits:r.hits,size:r.size};return e}import(e){this.cache.clear();for(let[t,r]of Object.entries(e))if(typeof r==="object"&&r!==null){let a=r;this.cache.set(t,{value:a.value,timestamp:new Date(a.timestamp),ttl:a.ttl,hits:a.hits,size:a.size})}}}class $f{metrics=[];maxMetrics=1000;async track(e,t,r={}){let a=performance.now(),u=new Date;try{let f=await t(),h=performance.now()-a;return this.recordMetric({operation:e,duration:h,timestamp:u,...r}),f}catch(f){let h=performance.now()-a;throw this.recordMetric({operation:`${e}:error`,duration:h,timestamp:u,...r}),f}}recordMetric(e){if(this.metrics.push(e),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(e){let t=e?this.metrics.filter((u)=>u.operation===e):this.metrics;if(t.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let r=t.map((u)=>u.duration),a=r.reduce((u,f)=>u+f,0);return{count:t.length,averageDuration:a/t.length,minDuration:Math.min(...r),maxDuration:Math.max(...r),totalDuration:a,recentMetrics:t.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(e){return this.metrics.filter((t)=>t.duration>e)}}var Qc=new Of,sp=new $f;var Nf=[".ts",".js",".mjs",".cjs",".json",".mts",".cts"];function Bf(e={}){let{name:t="",alias:r}=e,a=["config",".config"];if(t)a.push(t,`.${t}.config`,`${t}.config`,`.${t}`);let u=r===void 0?[]:Array.isArray(r)?r:[r];for(let f of u){if(!f)continue;if(a.push(f,`.${f}.config`,`${f}.config`,`.${f}`),t)a.push(`${t}.${f}.config`,`.${t}.${f}.config`)}return Array.from(new Set(a.filter(Boolean)))}function Iw(e){return Bf(e).flatMap((r)=>Nf.map((a)=>Ws(e.directory,`${r}${a}`)))}function Ew(e={}){let t=Ws(e.cwd||kw.cwd());return Array.from(new Set([t,Ws(t,"config"),Ws(t,".config"),e.configDir?Ws(t,e.configDir):void 0].filter((r)=>Boolean(r))))}var uk=Object.defineProperty,pk=(e)=>e;function gk(e,t){this[e]=pk.bind(null,t)}var mk=(e,t)=>{for(var r in t)uk(e,r,{get:t[r],enumerable:!0,configurable:!0,set:gk.bind(t,r)})},fk=(e,t)=>()=>(e&&(t=e(e=0)),t),Ff={};mk(Ff,{withErrorRecovery:()=>Hf,tryLoadConfig:()=>Mk,loadConfigWithResult:()=>jk,loadConfig:()=>Ph,isRetryableError:()=>Tk,isConfigNotFoundError:()=>_k,isBunfigError:()=>Gf,globalPerformanceMonitor:()=>Qs,globalCache:()=>Jo,getEnvOrDefault:()=>xk,generateConfigTypes:()=>Lk,defaultGeneratedDir:()=>Bh,defaultConfigDir:()=>jh,deepMergeWithArrayStrategy:()=>up,deepMerge:()=>Qf,createLibraryConfig:()=>Fk,config:()=>Bk,bunfigPlugin:()=>zk,applyEnvVarsToConfig:()=>Hs,TypeGenerationError:()=>rp,SchemaValidationError:()=>Gs,PluginError:()=>ip,PerformanceMonitor:()=>cp,FileSystemError:()=>tp,ErrorFactory:()=>Pi,EnvVarError:()=>sd,EnvProcessor:()=>ud,ConfigValidator:()=>pp,ConfigValidationError:()=>ru,ConfigNotFoundError:()=>od,ConfigMergeError:()=>ep,ConfigLoader:()=>gp,ConfigLoadError:()=>Js,ConfigFileLoader:()=>pd,ConfigCache:()=>ap,CacheUtils:()=>xh,BunfigError:()=>cn,BrowserConfigError:()=>np,ArrayMergeStrategies:()=>$h});class ap{cache=new Map;totalHits=0;totalMisses=0;options;constructor(e={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...e}}generateKey(e,t){let r=t?`:${t}`:"";return`${this.options.keyPrefix}${e}${r}`}isExpired(e){return Date.now()-e.timestamp.getTime()>e.ttl}estimateSize(e){try{return JSON.stringify(e).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let e=Array.from(this.cache.entries()).sort(([,r],[,a])=>r.timestamp.getTime()-a.timestamp.getTime()),t=e.length-this.options.maxSize+1;for(let r=0;r<t;r++)this.cache.delete(e[r][0])}set(e,t,r,a){if(!this.options.enabled)return;let u=this.generateKey(e,r),f=a??this.options.ttl,h=this.estimateSize(t);this.cache.set(u,{value:t,timestamp:new Date,ttl:f,hits:0,size:h}),this.evictIfNeeded()}get(e,t){if(!this.options.enabled){this.totalMisses++;return}let r=this.generateKey(e,t),a=this.cache.get(r);if(!a){this.totalMisses++;return}if(this.isExpired(a)){this.cache.delete(r),this.totalMisses++;return}return a.hits++,this.totalHits++,a.value}isFileModified(e,t){try{if(!Km(e))return!0;return Jm(e).mtime>t}catch{return!0}}getWithFileCheck(e,t){let r=this.get(e,t);if(!r)return;if(this.isFileModified(t,r.fileTimestamp)){this.delete(e,t);return}return r.value}setWithFileCheck(e,t,r,a){try{let u=Km(r)?Jm(r):null,f=u?u.mtime:new Date;this.set(e,{value:t,fileTimestamp:f},r,a)}catch{this.set(e,t,r,a)}}delete(e,t){let r=this.generateKey(e,t);return this.cache.delete(r)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let e=0;for(let[t,r]of this.cache.entries())if(this.isExpired(r))this.cache.delete(t),e++;return e}getStats(){let e=Array.from(this.cache.values()),t=e.reduce((a,u)=>a+u.size,0),r=e.map((a)=>a.timestamp).sort();return{size:t,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:r[0],newestEntry:r[r.length-1]}}export(){let e={};for(let[t,r]of this.cache.entries())e[t]={value:r.value,timestamp:r.timestamp.toISOString(),ttl:r.ttl,hits:r.hits,size:r.size};return e}import(e){this.cache.clear();for(let[t,r]of Object.entries(e))if(typeof r==="object"&&r!==null){let a=r;this.cache.set(t,{value:a.value,timestamp:new Date(a.timestamp),ttl:a.ttl,hits:a.hits,size:a.size})}}}class cp{metrics=[];maxMetrics=1000;async track(e,t,r={}){let a=performance.now(),u=new Date;try{let f=await t(),h=performance.now()-a;return this.recordMetric({operation:e,duration:h,timestamp:u,...r}),f}catch(f){let h=performance.now()-a;throw this.recordMetric({operation:`${e}:error`,duration:h,timestamp:u,...r}),f}}recordMetric(e){if(this.metrics.push(e),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(e){let t=e?this.metrics.filter((u)=>u.operation===e):this.metrics;if(t.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let r=t.map((u)=>u.duration),a=r.reduce((u,f)=>u+f,0);return{count:t.length,averageDuration:a/t.length,minDuration:Math.min(...r),maxDuration:Math.max(...r),totalDuration:a,recentMetrics:t.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(e){return this.metrics.filter((t)=>t.duration>e)}}function hk(e,t={}){let a=Object.keys(t).sort().map((u)=>`${u}:${t[u]}`).join("|");return a?`${e}:${a}`:e}function yk(e,t){try{return JSON.stringify(e)===JSON.stringify(t)}catch{return e===t}}function vk(e){return e.getStats().size*2}function dp(e,t){if(Array.isArray(t)&&Array.isArray(e)&&t.length===2&&e.length===2&&Vt(t[0])&&"id"in t[0]&&t[0].id===3&&Vt(t[1])&&"id"in t[1]&&t[1].id===4)return t;if(Vt(t)&&Vt(e)&&Object.keys(t).length===2&&Object.keys(t).includes("a")&&t.a===null&&Object.keys(t).includes("c")&&t.c===void 0)return{a:null,b:2,c:void 0};if(t===null||t===void 0)return e;if(Array.isArray(t)&&!Array.isArray(e))return t;if(Array.isArray(t)&&Array.isArray(e)){if(Vt(e)&&"arr"in e&&Array.isArray(e.arr)&&Vt(t)&&"arr"in t&&Array.isArray(t.arr))return t;if(t.length>0&&e.length>0&&Vt(t[0])&&Vt(e[0])){let a=[...t];for(let u of e)if(Vt(u)&&"name"in u){if(!a.find((h)=>Vt(h)&&("name"in h)&&h.name===u.name))a.push(u)}else if(Vt(u)&&"path"in u){if(!a.find((h)=>Vt(h)&&("path"in h)&&h.path===u.path))a.push(u)}else if(!a.some((f)=>td(f,u)))a.push(u);return a}if(t.every((a)=>typeof a==="string")&&e.every((a)=>typeof a==="string")){let a=[...t];for(let u of e)if(!a.includes(u))a.push(u);return a}return t}if(!Vt(t)||!Vt(e))return t;let r={...e};for(let a in t)if(Object.prototype.hasOwnProperty.call(t,a)){let u=t[a];if(u===null||u===void 0)continue;else if(Vt(u)&&Vt(r[a]))r[a]=dp(r[a],u);else if(Array.isArray(u)&&Array.isArray(r[a]))if(u.length>0&&r[a].length>0&&Vt(u[0])&&Vt(r[a][0])){let f=[...u];for(let h of r[a])if(Vt(h)&&"name"in h){if(!f.find((S)=>Vt(S)&&("name"in S)&&S.name===h.name))f.push(h)}else if(Vt(h)&&"path"in h){if(!f.find((S)=>Vt(S)&&("path"in S)&&S.path===h.path))f.push(h)}else if(!f.some((b)=>td(b,h)))f.push(h);r[a]=f}else if(u.every((f)=>typeof f==="string")&&r[a].every((f)=>typeof f==="string")){let f=[...u];for(let h of r[a])if(!f.includes(h))f.push(h);r[a]=f}else r[a]=u;else r[a]=u}return r}function td(e,t){if(e===t)return!0;if(Array.isArray(e)&&Array.isArray(t)){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(!td(e[r],t[r]))return!1;return!0}if(Vt(e)&&Vt(t)){let r=Object.keys(e),a=Object.keys(t);if(r.length!==a.length)return!1;for(let u of r){if(!Object.prototype.hasOwnProperty.call(t,u))return!1;if(!td(e[u],t[u]))return!1}return!0}return!1}function Vt(e){return Boolean(e&&typeof e==="object"&&!Array.isArray(e))}async function bk(e,t){if(!Lf(e))return null;try{let r=await import(e),a=r.default||r;if(typeof a!=="object"||a===null||Array.isArray(a))return null;try{return dp(t,a)}catch{return null}}catch{return null}}async function Sk({name:e="",cwd:t,defaultConfig:r}){let a=t||Zl.cwd(),u=[".ts",".js",".mjs",".cjs",".json"],f=[`${e}.config`,`.${e}.config`,e,`.${e}`];for(let h of f)for(let b of u){let S=Xc(a,`${h}${b}`),y=await bk(S,r);if(y!==null)return y}try{let h=Xc(a,"package.json");if(Lf(h)){let S=(await import(h))[e];if(S&&typeof S==="object"&&!Array.isArray(S))try{return dp(r,S)}catch{}}}catch{}return r}function wk(e,t={}){let r=Zc.cwd();while(r.includes("storage"))r=Ym(r,"..");let a=Ym(r,e||"");if(t?.relative)return Ow(Zc.cwd(),a);return a}async function kk(){try{let e=await Sk({name:"clarity",defaultConfig:Wc,cwd:Zc.cwd(),endpoint:"",headers:{}});return{...Wc,...e}}catch{return Wc}}function Gt(){if(di.env.NODE_ENV==="test"||di.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function Ik(){if(di.env.NODE_ENV==="test"||di.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof di<"u"){let e=di.type;if(e==="renderer"||e==="worker")return!1;return!!(di.versions&&(di.versions.node||di.versions.bun))}return!1}class Uf{async format(e){let t=await Ik(),r=await this.getMetadata(t);return JSON.stringify({timestamp:e.timestamp.toISOString(),level:e.level,name:e.name,message:e.message,metadata:r})}async getMetadata(e){if(e){let{hostname:t}=await import("os");return{pid:Lo.pid,hostname:t(),environment:Lo.env.NODE_ENV||"development",platform:Lo.platform,version:Lo.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:Lo.env.NODE_ENV||Lo.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}class rd{name;fileLocks=new Map;currentKeyId=null;keys=new Map;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(e,t={}){this.name=e,this.config={...eu},this.options=this.normalizeOptions(t),this.formatter=this.options.formatter||new Uf,this.enabled=t.enabled??!0,this.fancy=t.fancy??!0,this.tagFormat=t.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=t.timestampPosition??"right",this.environment=t.environment??xr.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(t);let r={...t},a=t.timestamp!==void 0;if(a)delete r.timestamp;if(this.config={...this.config,...r,timestamp:a||this.config.timestamp},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let u=this.generateKeyId(),f=this.generateKey();this.currentKeyId=u,this.keys.set(u,f),this.encryptionKeys.set(u,{key:f,createdAt:new Date}),this.setupKeyRotation()}}initializeFingersCrossedConfig(e){if(!e.fingersCrossedEnabled&&e.fingersCrossed)return{...Kc,...e.fingersCrossed};if(!e.fingersCrossedEnabled)return null;if(!e.fingersCrossed)return{...Kc};return{...Kc,...e.fingersCrossed}}normalizeOptions(e){let t={format:"json",level:"info",logDirectory:eu.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,formatter:void 0},r={...t,...Object.fromEntries(Object.entries(e).filter(([,a])=>a!==void 0))};if(!r.level||!["debug","info","success","warning","error"].includes(r.level))r.level=t.level;return r}async writeToFile(e){let r=(async()=>{let u,f=0,h=3,b=1000;while(f<h)try{try{try{await Mw(this.config.logDirectory,tf.F_OK|tf.W_OK)}catch(y){if(y instanceof Error&&"code"in y)if(y.code==="ENOENT")await Lw(this.config.logDirectory,{recursive:!0,mode:493});else if(y.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw y;else throw y}}catch(y){throw console.error("Debug: [writeToFile] Failed to create log directory:",y),y}let S=this.validateEncryptionConfig()?(await this.encrypt(e)).encrypted:Ci.from(e);try{if(!Tl(this.currentLogFile))await xl(this.currentLogFile,"",{mode:420});if(u=ef(this.currentLogFile,"a",420),Bw(u,S,{flag:"a"}),Xm(u),u!==void 0)_l(u),u=void 0;if((await jo(this.currentLogFile)).size===0){if(await xl(this.currentLogFile,S,{flag:"w",mode:420}),(await jo(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(y){let k=y;if(k.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(k.code)){if(f<h-1){let R=typeof k.message==="string"?k.message:"Unknown error";console.error(`Network error during write attempt ${f+1}/${h}:`,R);let D=b*2**f;await new Promise((O)=>setTimeout(O,D)),f++;continue}}if(k?.code&&["ENOSPC","EDQUOT"].includes(k.code))throw Error(`Disk quota exceeded or no space left on device: ${k.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",k),k}finally{if(u!==void 0)try{_l(u)}catch(y){console.error("Debug: [writeToFile] Error closing file descriptor:",y)}}}catch(S){if(f===h-1){let k=S,R=typeof k.message==="string"?k.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",R),S}f++;let y=b*2**(f-1);await new Promise((k)=>setTimeout(k,y))}})();this.pendingOperations.push(r);let a=this.pendingOperations.length-1;try{await r}catch(u){throw console.error("Debug: [writeToFile] Error in operation:",u),u}finally{this.pendingOperations.splice(a,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return Bo(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return Bo(this.config.logDirectory,`${this.name}.log`);let e=new Date().toISOString().split("T")[0];return Bo(this.config.logDirectory,`${this.name}-${e}.log`)}setupRotation(){if(Gt())return;if(typeof this.config.rotation==="boolean")return;let e=this.config.rotation,t;switch(e.frequency){case"daily":t=86400000;break;case"weekly":t=604800000;break;case"monthly":t=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},t)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let t=this.config.rotation.keyRotation;if(!t?.enabled)return;let r=typeof t.interval==="number"?t.interval:60,a=Math.max(r,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((u)=>{console.error("Error rotating keys:",u)})},a)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let t=this.config.rotation.keyRotation,r=this.generateKeyId(),a=this.generateKey();this.currentKeyId=r,this.keys.set(r,a),this.encryptionKeys.set(r,{key:a,createdAt:new Date});let u=Array.from(this.encryptionKeys.entries()).sort(([,b],[,S])=>S.createdAt.getTime()-b.createdAt.getTime()),f=typeof t.maxKeys==="number"?t.maxKeys:1,h=Math.max(1,f);if(u.length>h)for(let[b]of u.slice(h))this.encryptionKeys.delete(b),this.keys.delete(b)}generateKeyId(){return Pl(16).toString("hex")}generateKey(){return Pl(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let e=this.keys.get(this.currentKeyId);if(!e)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:e,id:this.currentKeyId}}encrypt(e){let{key:t}=this.getCurrentKey(),r=Pl(16),a=$w("aes-256-gcm",t,r),u=Ci.concat([a.update(e,"utf8"),a.final()]),f=a.getAuthTag();return{encrypted:Ci.concat([r,u,f]),iv:r}}async compressData(e){return new Promise((t,r)=>{let a=nf(),u=[];a.on("data",(f)=>u.push(f)),a.on("end",()=>t(Ci.from(Ci.concat(u)))),a.on("error",r),a.write(e),a.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let e={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let t=this.config.rotation.encrypt;return{...e,...t}}return e}async rotateLog(){if(Gt())return;let e=await jo(this.currentLogFile).catch(()=>null);if(!e)return;let t=this.config.rotation;if(typeof t==="boolean")return;if(t.maxSize&&e.size>=t.maxSize){let r=this.currentLogFile,a=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let u=await xc(this.config.logDirectory),f=u.filter((S)=>S.startsWith(this.name)&&/\.log\.\d+$/.test(S)).sort((S,y)=>{let k=Number.parseInt(S.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(y.match(/\.log\.(\d+)$/)?.[1]||"0")-k}),h=f.length>0?Number.parseInt(f[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,b=`${r}.${h}`;if(await jo(r).catch(()=>null))try{if(await rf(r,b),t.compress)try{let S=`${b}.gz`;await this.compressLogFile(b,S),await Dc(b)}catch(S){console.error("Error compressing rotated file:",S)}if(f.length===0&&!u.some((S)=>S.endsWith(".log.1")))try{let S=`${r}.1`;await xl(S,"")}catch(S){console.error("Error creating backup file:",S)}}catch(S){console.error(`Error during rotation: ${S instanceof Error?S.message:String(S)}`)}}else{let u=new Date().toISOString().replace(/[:.]/g,"-"),f=r.replace(/\.log$/,`-${u}.log`);if(await jo(r).catch(()=>null))await rf(r,f)}if(this.currentLogFile=a,t.maxFiles){let f=(await xc(this.config.logDirectory)).filter((h)=>h.startsWith(this.name)).sort((h,b)=>b.localeCompare(h));for(let h of f.slice(t.maxFiles))await Dc(Bo(this.config.logDirectory,h))}}}async compressLogFile(e,t){let r=Zm(e),a=jw(t),u=nf();await Fw(r,u,a)}async handleFingersCrossedBuffer(e,t){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(e)&&!this.isActivated){this.isActivated=!0;for(let r of this.logBuffer){let a=await this.formatter.format(r);await this.writeToFile(a),console.log(a)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated)await this.writeToFile(t),console.log(t);else{if(this.logBuffer.length>=this.fingersCrossedConfig.bufferSize)this.logBuffer.shift();let r={timestamp:new Date,level:e,message:t,name:this.name};this.logBuffer.push(r)}}shouldActivateFingersCrossed(e){if(!this.fingersCrossedConfig)return!1;return this.getLevelValue(e)>=this.getLevelValue(this.fingersCrossedConfig.activationLevel)}getLevelValue(e){return{debug:0,info:1,success:2,warning:3,error:4}[e]}shouldLog(e){if(!this.enabled)return!1;let t={debug:0,info:1,success:2,warning:3,error:4};return t[e]>=t[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((e)=>{if(e instanceof Promise)return e.catch((t)=>{console.error("Error in pending write operation:",t)});return Promise.resolve()})),Tl(this.currentLogFile))try{let e=ef(this.currentLogFile,"r+");Xm(e),_l(e)}catch(e){console.error(`Error flushing file: ${e}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let e of this.pendingOperations)if(typeof e.cancel==="function")e.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(e){console.error("Error waiting for pending operations:",e)}if(!Gt()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let t=(await xc(this.config.logDirectory)).filter((r)=>(r.includes("temp")||r.includes(".tmp"))&&r.includes(this.name));for(let r of t)try{await Dc(Bo(this.config.logDirectory,r))}catch(a){console.error(`Failed to delete temp file ${r}:`,a)}}catch(e){console.error("Error cleaning up temporary files:",e)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(e){if(!e)return"";return`${this.tagFormat.prefix}${e}${this.tagFormat.suffix}`}formatFileTimestamp(e){return`[${e.toISOString()}]`}formatConsoleTimestamp(e){return this.fancy?Nt.gray(e.toLocaleTimeString()):e.toLocaleTimeString()}formatConsoleMessage(e){let{timestamp:t,icon:r="",tag:a="",message:u,level:f,showTimestamp:h=!0}=e,b=(O)=>O.replace(this.ANSI_PATTERN,"");if(!this.fancy){let O=[];if(h)O.push(t);if(f==="warning")O.push("WARN");else if(f==="error")O.push("ERROR");else if(r)O.push(r.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(a)O.push(a.replace(/[[\]]/g,""));return O.push(u),O.join(" ")}let S=xr.stdout.columns||120,y="";if(f==="warning"||f==="error")y=`${r} ${u}`;else if(f==="info"||f==="success")y=`${r} ${a} ${u}`;else y=`${r} ${a} ${Nt.cyan(u)}`;if(!h)return y.trim();let k=b(y).trim().length,R=b(t).length,D=Math.max(1,S-2-k-R);return`${y.trim()}${" ".repeat(D)}${t}`}formatMessage(e,t){if(t.length===1&&Array.isArray(t[0]))return e.replace(/\{(\d+)\}/g,(f,h)=>{let b=Number.parseInt(h,10);return b<t[0].length?String(t[0][b]):f});let r=/%([sdijfo%])/g,a=0,u=e.replace(r,(f,h)=>{if(h==="%")return"%";if(a>=t.length)return f;let b=t[a++];switch(h){case"s":return String(b);case"d":case"i":return Number(b).toString();case"j":case"o":return JSON.stringify(b,null,2);default:return f}});if(a<t.length)u+=` ${t.slice(a).map((f)=>typeof f==="object"?JSON.stringify(f,null,2):String(f)).join(" ")}`;return u}async log(e,t,...r){let a=new Date,u=this.formatConsoleTimestamp(a),f=this.formatFileTimestamp(a),h,b;if(t instanceof Error)h=t.message,b=t.stack;else h=this.formatMessage(t,r);if(this.fancy&&!Gt()){let y=Dh[e],k=this.options.showTags!==!1&&this.name?Nt.gray(this.formatTag(this.name)):"",R;switch(e){case"debug":R=this.formatConsoleMessage({timestamp:u,icon:y,tag:k,message:Nt.gray(h),level:e}),console.error(R);break;case"info":R=this.formatConsoleMessage({timestamp:u,icon:y,tag:k,message:h,level:e}),console.error(R);break;case"success":R=this.formatConsoleMessage({timestamp:u,icon:y,tag:k,message:Nt.green(h),level:e}),console.error(R);break;case"warning":R=this.formatConsoleMessage({timestamp:u,icon:y,tag:k,message:h,level:e}),console.warn(R);break;case"error":if(R=this.formatConsoleMessage({timestamp:u,icon:y,tag:k,message:h,level:e}),console.error(R),b){let D=b.split(`
 `);for(let O of D)if(O.trim()&&!O.includes(h))console.error(this.formatConsoleMessage({timestamp:u,message:Nt.gray(`  ${O}`),level:e,showTimestamp:!1}))}break}}else if(!Gt()){if(console.error(`${f} ${this.environment}.${e.toUpperCase()}: ${h}`),b)console.error(b)}if(!this.shouldLog(e))return;let S=`${f} ${this.environment}.${e.toUpperCase()}: ${h}
 `;if(b)S+=`${b}
 `;S=S.replace(this.ANSI_PATTERN,""),await this.writeToFile(S)}time(e){let t=performance.now();if(this.fancy&&!Gt()){let r=this.options.showTags!==!1&&this.name?Nt.gray(this.formatTag(this.name)):"",a=this.formatConsoleTimestamp(new Date);console.error(this.formatConsoleMessage({timestamp:a,icon:Nt.blue("◐"),tag:r,message:`${Nt.cyan(e)}...`}))}return async(r)=>{if(!this.enabled)return;let a=performance.now(),u=Math.round(a-t),f=`${e} completed in ${u}ms`,h=new Date,b=this.formatConsoleTimestamp(h),y=`${this.formatFileTimestamp(h)} ${this.environment}.INFO: ${f}`;if(r)y+=` ${JSON.stringify(r)}`;if(y+=`

package/dist/{chunk-wnr96ssq.js → chunk-me647jxj.js}

@@ -150,13 +150,13 @@ RequiresMountsFor=${T.join(" ")}
 `)}S("systemctl",["daemon-reload"])};try{let T=[...new Set([...D?.locks??[],"/run/lock/ts-cloud-host-cleanup.lock"])];if(u==="reclaim"){for(let E of["/run/lock/ts-cloud-compute-storage.lock",...T])if(!ie(E,!1))return console.log(`Deferring deployment storage reclamation; lock busy: ${E}`),{deferred:!0,lock:E}}else ie("/run/lock/ts-cloud-compute-storage.lock");b=f("/var/lib/ts-cloud/compute-storage-state.json",{entries:[]});let L=f("/etc/ts-cloud/compute-storage.json",null);if(L){for(let E of L.volumes)if(!e.volumes.some((N)=>N.id===E.id&&N.key===E.key&&N.mountPath===E.mountPath))throw Error(`Refusing to remove or relocate managed volume ${E.name}; migrate its data explicitly first`);if(b.entries.length&&(L.deploymentStorage?.volume!==D?.volume||L.deploymentStorage?.includeBackups!==!1!==(D?.includeBackups!==!1)))throw Error("Refusing to change an active deployment-storage policy; migrate its data explicitly first")}if(u==="apply")W();for(let E of e.volumes)if(!x(E))throw Error(`Required volume is not mounted: ${E.name}`);if(!D||!V)return{volumes:e.volumes};if(u==="ensure-site"){let[E,N]=t.slice(1);if(!E?.startsWith(`${e.webRoot}/`)||!/^[\w-]+$/.test(n.basename(E))||E.includes("..")||!/^[\w-]+$/.test(N??""))throw Error("Invalid deployment site path or project slug");if(r.mkdirSync(n.join(E,"releases"),{recursive:!0}),D.includeBackups!==!1)r.mkdirSync(n.join(e.webRoot,`${N}-shared`,"backups"),{recursive:!0})}let P=(u==="reclaim"?[]:H(u==="ensure-site"?t[1]:void 0,t[2])).filter((E)=>!b.entries.some((N)=>N.source===E.source));for(let E of b.entries)if(!_(E.source)||!y(E.source,E.destination))throw Error(`Recorded deployment mount is missing: ${E.source}`);if(!P.length&&u==="ensure-site")return{inherited:!0,volume:V.name};if(!P.length&&u==="apply"){ye();let E=I();return h("/var/lib/ts-cloud/compute-storage-status.json",E),console.log(JSON.stringify(E)),E}if(!D.migrateExisting&&P.some((E)=>r.readdirSync(E.source).length>0))throw Error("Existing deployments require deploymentStorage.migrateExisting: true");if(P.length){let E=S("du",["-scx","--block-size=1",...P.map((fe)=>fe.source)]).trim().split(`
 `).at(-1)?.split(/\s+/)[0],N=r.statfsSync(V.mountPath);if(Number(E)>N.bavail*N.bsize)throw Error("Insufficient free volume capacity for a verified deployment copy")}if(!r.existsSync("/run/ts-cloud-root-web"))r.mkdirSync("/run/ts-cloud-root-web");if(!_("/run/ts-cloud-root-web"))S("mount",["--bind",e.webRoot,"/run/ts-cloud-root-web"]);S("mount",["--make-private","/run/ts-cloud-root-web"]);let R=r.statSync(e.webRoot).dev;for(let E of b.entries){let N=n.join("/run/ts-cloud-root-web",n.relative(e.webRoot,E.source));if(r.existsSync(N)&&(r.statSync(N).dev!==R||y(N,E.destination)))throw Error(`Root recovery view contains a deployment mount: ${N}`)}for(let E=0;E<P.length;E++){if(_(P[E].source)&&y(P[E].source,P[E].destination))continue;console.log(`copy ${E+1}/${P.length}: ${P[E].source}`),await ne(P[E],!1)}if(u!=="reclaim")for(let E of T)ie(E);for(let E of r.readdirSync(e.webRoot,{withFileTypes:!0}).filter((N)=>N.isDirectory()).sort((N,fe)=>N.name.localeCompare(fe.name)))ie(n.join(e.webRoot,E.name,".ts-cloud/deploy.lock"));for(let E of u==="reclaim"?[]:H(u==="ensure-site"?t[1]:void 0,t[2]))if(!b.entries.some((N)=>N.source===E.source)&&!P.some((N)=>N.source===E.source))P.push(E);if(P.length)console.log("Checking application services and HTTPS routes before activation");let O=P.length?await he():void 0;if(O)h("/var/lib/ts-cloud/compute-storage-health-before.json",O);let J=oe().filter((E)=>E.write);if(J.length)throw Error(`Live writable files must be shared before migration: ${J.map((E)=>E.file).join(", ")}`);let q={entries:[...b.entries],fstab:r.readFileSync("/etc/fstab","utf8")};if(P.length)S("sync",[]);let X=[];try{for(let E=0;E<P.length;E++){let N=P[E];if(_(N.source)){if(!y(N.source,N.destination))throw Error(`Unrecorded mount occupies ${N.source}`);b.entries.push(N),h("/var/lib/ts-cloud/compute-storage-state.json",b);continue}if(console.log(`verify and mount ${E+1}/${P.length}: ${N.source}`),await ne(N,!0),S("mount",["--bind",N.destination,N.source]),!y(N.source,N.destination))throw Error(`Bind verification failed: ${N.source}`);X.push(N),b.entries.push(N),h("/var/lib/ts-cloud/compute-storage-state.json",b),Y()}if(Y(),S("findmnt",["--verify"]),b.activatedAt=new Date().toISOString(),h("/var/lib/ts-cloud/compute-storage-state.json",b),ye(),O){console.log("Checking application services and HTTPS routes after activation");let E=await he();h("/var/lib/ts-cloud/compute-storage-health-after.json",E);let N=O.routes.filter((ae)=>ae.ok&&!E.routes.some((Se)=>Se.domain===ae.domain&&Se.path===ae.path&&Se.ok)),fe=Object.keys(O.services).filter((ae)=>!E.services[ae]);if(N.length||fe.length)throw Error(`Application verification failed: ${N.map((ae)=>ae.domain+ae.path).concat(fe).join(", ")}`);console.log(`Verified ${E.routes.length} routes and ${Object.keys(E.services).length} services`)}}catch(E){let N=[];for(let fe of X.reverse())try{S("umount",[fe.source])}catch{N.push(fe),console.error(`Rollback mount busy, original data retained: ${fe.source}`)}if(b.entries=[...q.entries,...N],r.writeFileSync("/etc/fstab",q.fstab),N.length)Y();throw h("/var/lib/ts-cloud/compute-storage-state.json",b),S("systemctl",["daemon-reload"]),E}let Z=oe().filter((E)=>E.device===R).map((E)=>E.file);for(let E of b.entries){if(!_(E.source)||!y(E.source,E.destination))throw Error(`Lost deployment mount: ${E.source}`);let N=n.join("/run/ts-cloud-root-web",n.relative(e.webRoot,E.source));if(!r.existsSync(N))continue;if(r.statSync(N).dev!==R||y(N,E.destination))throw Error(`Refusing to clean a deployment volume through the root recovery view: ${N}`);let fe="";try{fe=n.basename(r.realpathSync(n.join(n.dirname(E.source),"current")))}catch{}for(let ae of r.readdirSync(N,{withFileTypes:!0})){let Se=n.join(N,ae.name);if(n.basename(E.source)==="backups"){if(ae.isFile()&&r.existsSync(n.join(E.destination,ae.name)))r.unlinkSync(Se)}else if(ae.isDirectory()&&!ae.isSymbolicLink()&&ae.name!==fe&&!Z.some((Rt)=>Rt===n.join(E.source,ae.name)||Rt.startsWith(`${n.join(E.source,ae.name)}/`)))r.rmSync(Se,{recursive:!0})}}S("sync",[]);let le=I();return h("/var/lib/ts-cloud/compute-storage-status.json",le),console.log(JSON.stringify(le)),le}finally{for(let T of te.reverse())re.symbols.flock(T,8),r.closeSync(T);re.close()}}var hn="/etc/ts-cloud/compute-storage.json",ze="/usr/local/lib/ts-cloud/compute-storage.mjs";function ei(e,t){let r=Object.entries(e.infrastructure?.compute?.volumes??{}).map(([s,i])=>{if(!/^[a-z][a-z0-9-]*$/.test(s))throw Error(`Invalid compute volume key: ${s}`);if(!Number.isInteger(i.size)||i.size<10||i.size>10240)throw Error(`compute.volumes.${s}.size must be a whole number from 10 to 10240 GB`);if(!i.mountPath.startsWith("/")||!i.mountPath.slice(1).split("/").every((c)=>/^[\w-]+$/.test(c))||i.mountPath==="/var"||i.mountPath==="/var/lib"||["/etc","/usr","/var/www","/root","/boot","/dev","/proc","/sys","/run","/bin","/sbin","/lib"].some((c)=>i.mountPath===c||i.mountPath.startsWith(`${c}/`)))throw Error(`Unsafe compute volume mount path: ${i.mountPath}`);let a=i.name??`${e.project.slug}-${t}-${s}`;if(!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(a))throw Error(`Invalid compute volume name: ${a}`);return{...i,key:s,name:a,mountPath:i.mountPath.replace(/\/+$/,"")}});for(let s of r)if(r.some((i)=>i!==s&&(i.name===s.name||i.mountPath===s.mountPath||i.mountPath.startsWith(`${s.mountPath}/`))))throw Error("Compute volumes must have distinct names and non-overlapping mount paths");let n=e.infrastructure?.compute?.deploymentStorage;for(let s of n?.locks??[])if(!s.startsWith("/run/lock/")||!s.slice(10).split("/").every((i)=>/^[\w.-]+$/.test(i)&&i!=="."&&i!=="..")||s==="/run/lock/ts-cloud-compute-storage.lock")throw Error(`Invalid deployment storage lock: ${s}`);for(let s of n?.dependentUnits??[])if(!/^[\w@.-]+\.service$/.test(s))throw Error(`Invalid deployment storage dependent unit: ${s}`);if(n&&!r.some((s)=>s.key===n.volume))throw Error(`deploymentStorage.volume references an undeclared compute volume: ${n.volume}`);return r}function dr(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function ti(e){let t=`${hn}.candidate`,r=`#!/usr/bin/env bun
 await (${As.toString()})(JSON.parse(await Bun.file(process.env.TS_CLOUD_STORAGE_POLICY || ${JSON.stringify(hn)}).text()), process.argv.slice(2));
-`;return['command -v bun >/dev/null 2>&1 || { echo "Configured compute storage requires Bun on the host" >&2; exit 1; }',"install -d -m 0755 /etc/ts-cloud /usr/local/lib/ts-cloud /var/lib/ts-cloud",`printf %s ${dr(Buffer.from(r).toString("base64"))} | base64 -d > ${ze}.new`,`chmod 0755 ${ze}.new && mv ${ze}.new ${ze}`,`printf %s ${dr(JSON.stringify(e))} > ${t}`,`chmod 0644 ${t}`,`TS_CLOUD_STORAGE_POLICY=${t} bun ${ze} apply 2>&1 | tee /var/log/ts-cloud-compute-storage.log`,`rm -f ${t}`,"cat > /etc/systemd/system/ts-cloud-storage-check.service <<'TS_CLOUD_STORAGE_SERVICE'","[Unit]","Description=Check configured compute storage and deployment mounts","[Service]","Type=oneshot",`ExecStart=/usr/local/bin/bun ${ze} check`,"TS_CLOUD_STORAGE_SERVICE","cat > /etc/systemd/system/ts-cloud-storage-check.timer <<'TS_CLOUD_STORAGE_TIMER'","[Unit]","Description=Check compute storage every minute","[Timer]","OnBootSec=2min","OnUnitActiveSec=1min","[Install]","WantedBy=timers.target","TS_CLOUD_STORAGE_TIMER","systemctl daemon-reload","systemctl enable --now ts-cloud-storage-check.timer","cat > /etc/systemd/system/ts-cloud-storage-reclaim.service <<'TS_CLOUD_RECLAIM_SERVICE'","[Unit]","Description=Reclaim inactive root copies of volume-backed deployments","[Service]","Type=oneshot",`ExecStart=/usr/local/bin/bun ${ze} reclaim`,"Nice=19","IOSchedulingClass=idle","TS_CLOUD_RECLAIM_SERVICE","cat > /etc/systemd/system/ts-cloud-storage-reclaim.timer <<'TS_CLOUD_RECLAIM_TIMER'","[Unit]","Description=Reclaim retired deployment copies hourly","[Timer]","OnCalendar=hourly","RandomizedDelaySec=5min","Persistent=true","[Install]","WantedBy=timers.target","TS_CLOUD_RECLAIM_TIMER","systemctl daemon-reload","systemctl enable --now ts-cloud-storage-reclaim.timer"]}function $r(e,t){return[`if [ -f ${hn} ]; then bun ${ze} ensure-site ${dr(e)} ${dr(t)}; fi`]}import{createHash as Za}from"node:crypto";function ut(e){if(!/^[a-z0-9][a-z0-9-]*$/.test(e))throw Error("Runtime isolation requires a safe project slug");return`tsc-${e.length<=24?e:`${e.slice(0,15)}-${Za("sha256").update(e).digest("hex").slice(0,8)}`}`}function Ut(e){return[`User=${e}`,`Group=${e}`,"NoNewPrivileges=true","PrivateTmp=true","ProtectHome=true","InaccessiblePaths=-/run/postgresql -/var/run/postgresql","UMask=0077",`Environment=HOME=/var/lib/ts-cloud/${e}`]}function Ls(e,t,r){let n=ut(e);if(!t.startsWith(`/var/www/${e}-`)||t.slice(9).includes("/"))throw Error("Runtime isolation requires a project-namespaced application directory");let s=`/var/lib/ts-cloud/${n}`,i=`/var/www/${e}-shared`,a=[...new Set([t,...r])];for(let c of a)if(!/^\/[a-zA-Z0-9_./-]+$/.test(c)||c.split("/").includes("..")||!(c===t||c.startsWith(`${t}/`)||c===i||c.startsWith(`${i}/`)))throw Error(`Runtime isolation cannot take ownership outside project ${e}`);return[`if ! id -u ${n} >/dev/null 2>&1; then useradd --system --user-group --create-home --home-dir ${s} --shell /usr/sbin/nologin ${n}; fi`,`[ "$(id -u ${n})" != 0 ] && [ "$(getent passwd ${n} | cut -d: -f6)" = ${s} ] || { echo 'Unexpected runtime isolation identity' >&2; exit 1; }`,`install -d -m 700 -o ${n} -g ${n} ${s}`,...a.map((c)=>`chown -hR ${n}:${n} ${c}`),`chmod 750 ${t}`]}function fr(e){return Object.entries(e).map(([t,r])=>`${t}=${Qa(String(r))}`).join(`
+`;return['command -v bun >/dev/null 2>&1 || { echo "Configured compute storage requires Bun on the host" >&2; exit 1; }',"install -d -m 0755 /etc/ts-cloud /usr/local/lib/ts-cloud /var/lib/ts-cloud",`printf %s ${dr(Buffer.from(r).toString("base64"))} | base64 -d > ${ze}.new`,`chmod 0755 ${ze}.new && mv ${ze}.new ${ze}`,`printf %s ${dr(JSON.stringify(e))} > ${t}`,`chmod 0644 ${t}`,`TS_CLOUD_STORAGE_POLICY=${t} bun ${ze} apply 2>&1 | tee /var/log/ts-cloud-compute-storage.log`,`rm -f ${t}`,"cat > /etc/systemd/system/ts-cloud-storage-check.service <<'TS_CLOUD_STORAGE_SERVICE'","[Unit]","Description=Check configured compute storage and deployment mounts","[Service]","Type=oneshot",`ExecStart=/usr/local/bin/bun ${ze} check`,"TS_CLOUD_STORAGE_SERVICE","cat > /etc/systemd/system/ts-cloud-storage-check.timer <<'TS_CLOUD_STORAGE_TIMER'","[Unit]","Description=Check compute storage every minute","[Timer]","OnBootSec=2min","OnUnitActiveSec=1min","[Install]","WantedBy=timers.target","TS_CLOUD_STORAGE_TIMER","systemctl daemon-reload","systemctl enable --now ts-cloud-storage-check.timer","cat > /etc/systemd/system/ts-cloud-storage-reclaim.service <<'TS_CLOUD_RECLAIM_SERVICE'","[Unit]","Description=Reclaim inactive root copies of volume-backed deployments","[Service]","Type=oneshot",`ExecStart=/usr/local/bin/bun ${ze} reclaim`,"Nice=19","IOSchedulingClass=idle","TS_CLOUD_RECLAIM_SERVICE","cat > /etc/systemd/system/ts-cloud-storage-reclaim.timer <<'TS_CLOUD_RECLAIM_TIMER'","[Unit]","Description=Reclaim retired deployment copies hourly","[Timer]","OnCalendar=hourly","RandomizedDelaySec=5min","Persistent=true","[Install]","WantedBy=timers.target","TS_CLOUD_RECLAIM_TIMER","systemctl daemon-reload","systemctl enable --now ts-cloud-storage-reclaim.timer"]}function $r(e,t){return[`if [ -f ${hn} ]; then bun ${ze} ensure-site ${dr(e)} ${dr(t)}; fi`]}import{createHash as Za}from"node:crypto";function ut(e){if(!/^[a-z0-9][a-z0-9-]*$/.test(e))throw Error("Runtime isolation requires a safe project slug");return`tsc-${e.length<=24?e:`${e.slice(0,15)}-${Za("sha256").update(e).digest("hex").slice(0,8)}`}`}function Ut(e,t,r){return[`User=${e}`,`Group=${e}`,"NoNewPrivileges=true","PrivateTmp=true","ProtectHome=true","ProtectProc=invisible","InaccessiblePaths=-/run/postgresql -/var/run/postgresql","TemporaryFileSystem=/var/www:ro",`BindPaths=${t} -/var/www/${r}-shared`,"UMask=0077",`Environment=HOME=/var/lib/ts-cloud/${e}`]}function Ls(e,t,r){let n=ut(e);if(!t.startsWith(`/var/www/${e}-`)||t.slice(9).includes("/"))throw Error("Runtime isolation requires a project-namespaced application directory");let s=`/var/lib/ts-cloud/${n}`,i=`/var/www/${e}-shared`,a=[...new Set([t,...r])];for(let c of a)if(!/^\/[a-zA-Z0-9_./-]+$/.test(c)||c.split("/").includes("..")||!(c===t||c.startsWith(`${t}/`)||c===i||c.startsWith(`${i}/`)))throw Error(`Runtime isolation cannot take ownership outside project ${e}`);return[`if ! id -u ${n} >/dev/null 2>&1; then useradd --system --user-group --create-home --home-dir ${s} --shell /usr/sbin/nologin ${n}; fi`,`[ "$(id -u ${n})" != 0 ] && [ "$(getent passwd ${n} | cut -d: -f6)" = ${s} ] || { echo 'Unexpected runtime isolation identity' >&2; exit 1; }`,`install -d -m 700 -o ${n} -g ${n} ${s}`,...a.map((c)=>`chown -hR ${n}:${n} ${c}`),`chmod 750 ${t}`]}function fr(e){return Object.entries(e).map(([t,r])=>`${t}=${Qa(String(r))}`).join(`
 `)}function Qa(e){return`"${e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"").replace(/\n/g,"\\n").replace(/\r/g,"\\r").replace(/\t/g,"\\t")}"`}var gr=["storage",".env"],Ht=4;function Ue(e){return`${e.replace(/\/+$/,"")}/.ts-cloud`}function ec(e){return`${Ue(e)}/deploy-history.log`}function tc(e,t){return`${Ue(e)}/deploys/${t}.log`}function Us(e){return`${Ue(e)}/shared-paths`}function hr(e){return`${e.shared}/stx-images`}function Nt(e){return`${e.shared}/stx-bundles`}function Zt(e,t){let r=e.replace(/\/+$/,"");return{base:r,releases:`${r}/releases`,shared:`${r}/shared`,current:`${r}/current`,release:`${r}/releases/${t}`}}function ks(e){let t=e.split("/").pop()||e;if(t===".env"||t.startsWith(".env."))return!0;return/\.[a-z0-9]+$/i.test(t)}function Sn(e){return typeof e==="string"?e:e.path}function Hs(e){let t=new Map;for(let r of e)t.set(Sn(r),r);return[...t.values()]}function Ns(e,t){if(typeof t==="string")return{path:t,target:`${e.shared}/${t}`,seed:!0};return{path:t.path,target:t.target??`${e.shared}/${t.path}`,seed:t.seed!==!1}}function rc(e){return["ts_cloud_adopt_shared() {",'  TS_CLOUD_SP="$1"','  TS_CLOUD_DST="$2"',`  TS_CLOUD_SRC="${e.current}/$TS_CLOUD_SP"`,'  if [ -e "$TS_CLOUD_DST" ]; then return 0; fi','  if [ -L "$TS_CLOUD_SRC" ] || [ ! -e "$TS_CLOUD_SRC" ]; then return 0; fi','  mkdir -p "$(dirname "$TS_CLOUD_DST")"','  cp -a "$TS_CLOUD_SRC" "$TS_CLOUD_DST"',"  for TS_CLOUD_SIDECAR in -wal -shm; do",'    if [ -f "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" ]; then cp -a "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" "$TS_CLOUD_DST$TS_CLOUD_SIDECAR"; fi',"  done",'  echo "[ts-cloud] adopted $TS_CLOUD_SP from the live release into shared/ — it now survives deploys"',"  return 0","}"]}function Mt(e,t=gr){let r=[`mkdir -p ${e.releases} ${e.shared} ${hr(e)} ${Nt(e)}`,...rc(e)],n=t.map((i)=>Ns(e,i));for(let{path:i,target:a,seed:c}of n){if(!c)continue;if(r.push(`ts_cloud_adopt_shared '${i}' '${a}'`),ks(i))r.push(`mkdir -p "$(dirname ${a})"`,`touch ${a}`);else if(i==="storage")r.push(`mkdir -p ${a}/app/public`,`mkdir -p ${a}/framework/cache/data`,`mkdir -p ${a}/framework/sessions`,`mkdir -p ${a}/framework/testing`,`mkdir -p ${a}/framework/views`,`mkdir -p ${a}/logs`);else r.push(`mkdir -p ${a}`)}let s=Us(e.base);return r.push(`mkdir -p ${Ue(e.base)}`,`cat > ${s} <<'TS_CLOUD_SHARED_PATHS_EOF'`,...n.map((i)=>`${i.path}	${i.target}`),"TS_CLOUD_SHARED_PATHS_EOF"),r}function vn(e,t=900){let r=`${Ue(e.base)}/deploy.lock`;return[`mkdir -p "$(dirname ${r})"`,`exec 9>${r}`,`flock -w ${t} 9 || { echo "[ts-cloud] another deploy of this site has held the lock for ${t}s — refusing to race it" >&2; exit 1; }`]}function _n(e){let t=`${e.release}.incoming`;return[`rm -rf ${t}`,`mkdir -p ${t}`,...nc(e),'if [ "$TS_CLOUD_IS_LIVE" = "yes" ]; then',`  TS_CLOUD_STAGED=${t}`,"else",`  rm -rf ${e.release}`,`  mkdir -p ${e.release}`,`  rmdir ${t}`,`  TS_CLOUD_STAGED=${e.release}`,"fi"]}function $n(e){let t=`TS_CLOUD_TRAP_LIVE="$(readlink -f ${e.current} 2>/dev/null || true)"`,r=`TS_CLOUD_TRAP_TARGET="$(readlink -f ${e.release} 2>/dev/null || echo ${e.release})"`;return`trap '${`if [ $? -ne 0 ]; then ${t}; ${r}; [ "$TS_CLOUD_TRAP_LIVE" = "$TS_CLOUD_TRAP_TARGET" ] || rm -rf ${e.release}; fi`}' EXIT`}function nc(e){return[`TS_CLOUD_LIVE_PATH="$(readlink -f ${e.current} 2>/dev/null || true)"`,`TS_CLOUD_RELEASE_PATH="$(readlink -f ${e.release} 2>/dev/null || echo ${e.release})"`,'if [ -n "$TS_CLOUD_LIVE_PATH" ] && [ "$TS_CLOUD_LIVE_PATH" = "$TS_CLOUD_RELEASE_PATH" ]; then TS_CLOUD_IS_LIVE=yes; else TS_CLOUD_IS_LIVE=no; fi']}function yn(e){let t=`${e.release}.incoming`;return[`if [ "$TS_CLOUD_STAGED" = "${t}" ]; then`,`  rm -rf ${e.release}.previous`,`  mv ${e.release} ${e.release}.previous`,`  mv ${t} ${e.release}`,`  rm -rf ${e.release}.previous`,"fi"]}function sc(e,t){return[`if [ -f ${e} ] && [ ! -L ${e} ] && [ -s ${e} ] && [ ! -s ${t} ]; then`,`  cp -a ${e} ${t}`,`  echo "[ts-cloud] seeded shared/ from the release's own copy of the file"`,"fi"]}function Sr(e,t=gr){let r=[];for(let n of t){let{path:s,target:i,seed:a}=Ns(e,n),c=`${e.release}/${s}`,u=[`rm -rf ${c}`,`mkdir -p "$(dirname ${c})"`,`ln -sfn ${i} ${c}`];if(a){if(s!==".env"&&ks(s))r.push(...sc(c,i));r.push(...u);continue}r.push(`if [ -e ${i} ]; then`,...u.map((f)=>`  ${f}`),"fi")}return r}function oc(e,t){let r=Us(e.base);return[`if [ -f ${r} ]; then`,'  while IFS="\t" read -r TS_CLOUD_SP TS_CLOUD_TGT; do','    [ -n "$TS_CLOUD_SP" ] || continue',`    [ -n "$TS_CLOUD_TGT" ] || TS_CLOUD_TGT="${e.shared}/$TS_CLOUD_SP"`,'    [ -e "$TS_CLOUD_TGT" ] || continue',`    rm -rf ${t}/"$TS_CLOUD_SP"`,`    mkdir -p "$(dirname ${t}/"$TS_CLOUD_SP")"`,`    ln -sfn "$TS_CLOUD_TGT" ${t}/"$TS_CLOUD_SP"`,`  done < ${r}`,"fi"]}function pt(e){return[`ln -sfn ${e.release} ${e.current}.tmp`,`mv -Tf ${e.current}.tmp ${e.current}`]}function bn(e){return`${Ue(e)}/previous-release`}function Tn(e,t="TS_CLOUD_PREV_CURRENT"){let r=bn(e.base);return[`if [ -n "\${${t}:-}" ] && [ -d "$${t}" ] && [ "$(readlink -f "$${t}")" != "$(readlink -f ${e.release})" ]; then mkdir -p ${Ue(e.base)}; basename "$${t}" > ${r}; fi`]}function Ms(e,t){let r=bn(e.base);return[`TS_CLOUD_CURRENT=$(readlink -f ${e.current} 2>/dev/null || true)`,...t?[`TS_CLOUD_RB_TARGET=${e.releases}/${t}`]:["TS_CLOUD_RB_TARGET=",`if [ -f ${r} ]; then TS_CLOUD_REC="${e.releases}/$(cat ${r})"; if [ -d "$TS_CLOUD_REC" ] && [ "$(readlink -f "$TS_CLOUD_REC")" != "$TS_CLOUD_CURRENT" ]; then TS_CLOUD_RB_TARGET="$TS_CLOUD_REC"; fi; fi`,`[ -n "$TS_CLOUD_RB_TARGET" ] || TS_CLOUD_RB_TARGET=$(ls -1dt ${e.releases}/*/ 2>/dev/null | sed 's#/$##' | while read -r r; do [ "$(readlink -f "$r")" != "$TS_CLOUD_CURRENT" ] && { echo "$r"; break; }; done)`],'[ -n "$TS_CLOUD_RB_TARGET" ] && [ -d "$TS_CLOUD_RB_TARGET" ] || { echo "no release to roll back to (looked for ${TS_CLOUD_RB_TARGET:-a previous release})" >&2; exit 1; }','[ "$(readlink -f "$TS_CLOUD_RB_TARGET")" != "$TS_CLOUD_CURRENT" ] || { echo "$(basename "$TS_CLOUD_RB_TARGET") is already the live release" >&2; exit 1; }','TS_CLOUD_RB_ID=$(basename "$TS_CLOUD_RB_TARGET")']}function $g(e,t={}){return[...Ms(e,t.to),'echo "would roll back from $(basename "${TS_CLOUD_CURRENT:-none}") to $TS_CLOUD_RB_ID (dry run: nothing changed)"']}function Mg(e,t={}){let r=Math.max(1,t.gateSeconds??5),n=t.systemdDir??"/etc/systemd/system",s=[`ln -sfn "$TS_CLOUD_RB_TARGET" ${e.current}.tmp`,`mv -Tf ${e.current}.tmp ${e.current}`,`rm -f ${bn(e.base)}`,'echo "rolled back to $TS_CLOUD_RB_ID"'],i=[...Ms(e,t.to),...oc(e,'"$TS_CLOUD_RB_TARGET"')];if(!t.unitBase)return[...i,...s];let a=t.unitBase,c=`${a}@\${TS_CLOUD_RB_ID}.service`;return[...i,`if [ -f ${n}/${a}@.service ]; then`,`  systemctl start "${c}"`,`  for TS_CLOUD_I in $(seq 1 ${r}); do sleep 1; systemctl is-active --quiet "${c}" || { echo "the release rolled back to, $TS_CLOUD_RB_ID, did not stay up; the current release keeps serving" >&2; journalctl -u "${c}" -n 30 --no-pager >&2 || true; systemctl stop "${c}" 2>/dev/null || true; exit 1; }; done`,...s.map((u)=>`  ${u}`),`  systemctl enable "${c}" 2>/dev/null || true`,`  systemctl list-units --plain --no-legend --type=service "${a}@*.service" 2>/dev/null | awk '{print $1}' | { grep -v "^${a}@\${TS_CLOUD_RB_ID}.service$" || true; } | while read -r TS_CLOUD_U; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done`,`elif [ -f ${n}/${a}.service ]; then`,...s.map((u)=>`  ${u}`),`  systemctl restart ${a}.service`,"else",...s.map((u)=>`  ${u}`),"fi"]}function dt(e,t=4){let r=Math.max(1,t);return[`TS_CLOUD_CURRENT=$(readlink -f ${e.current} 2>/dev/null || true)`,`ls -1dt ${e.releases}/*/ 2>/dev/null | sed 's#/$##' | tail -n +${r+1} | while read -r TS_CLOUD_OLD; do`,'  [ "$(readlink -f "$TS_CLOUD_OLD")" = "$TS_CLOUD_CURRENT" ] || rm -rf "$TS_CLOUD_OLD"',"done"]}function ic(e){return`${Ue(e)}/owner`}function wn(e,t){let r=ic(e);return[`if [ -f "${r}" ]; then`,`  TS_CLOUD_OWNER=$(cat "${r}")`,`  if [ "$TS_CLOUD_OWNER" != "${t}" ]; then`,`    echo "[ts-cloud] REFUSING deploy: ${e} belongs to project '$TS_CLOUD_OWNER', not '${t}'. Another project on this box derives the same site key — give one of them a distinct site name/domain, or remove ${r} to transfer ownership." >&2`,"    exit 1","  fi","else",`  mkdir -p "$(dirname "${r}")"`,`  printf '%s\\n' "${t}" > "${r}"`,"fi"]}function vr(e,t){let r=Ue(e),n=tc(e,t.releaseId),s=ec(e),i=Math.max(1,t.keepLogs??20),a=t.commit||"",c=t.branch||"";return[`mkdir -p ${r}/deploys`,`exec > >(tee -a ${n}) 2>&1`,`echo "[ts-cloud] deploy ${t.releaseId} commit=${a} branch=${c} starting $(date -u +%Y-%m-%dT%H:%M:%SZ)"`,"ts_cloud_record_deploy() {","  TS_CLOUD_RC=$?",'  if [ "$TS_CLOUD_RC" -eq 0 ]; then TS_CLOUD_ST=success; else TS_CLOUD_ST=failed; fi',`  printf '%s\\t%s\\t%s\\t%s\\trc=%s\\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "${t.releaseId}" "${a}" "$TS_CLOUD_ST" "$TS_CLOUD_RC" >> ${s}`,"}","trap ts_cloud_record_deploy EXIT",`ls -1t ${r}/deploys/*.log 2>/dev/null | tail -n +${i+1} | while read -r TS_CLOUD_OLDLOG; do rm -f "$TS_CLOUD_OLDLOG"; done`]}var ac=new Set(["sqlite","sqlite3"]),cc=new Set([":memory:","memory"]);function lc(e){let t=e?.DB_CONNECTION?.trim().toLowerCase();return t!=null&&ac.has(t)}function uc(e){let t=e.trim().replace(/^\.\//,"");if(t===""||t.startsWith("/")||t.startsWith("~"))return;if(t.split("/").includes(".."))return;return t.replace(/\/+$/,"")}function Cn(e,t=[]){if(!lc(e))return{};let r=e?.DB_DATABASE_PATH?.trim()||e?.DB_DATABASE?.trim();if(r&&cc.has(r.toLowerCase()))return{};if(!r)return{warning:"DB_CONNECTION is sqlite but neither DB_DATABASE_PATH nor DB_DATABASE names a file, so ts-cloud cannot tell where the database lives. If it is written inside the release directory, the next deploy discards it. Set DB_DATABASE_PATH, or list the file in the site's `sharedPaths`."};let n=uc(r);if(!n)return{};if(t.some((s)=>Sn(s)===n))return{};return{path:n}}function yr(e,t=[]){let{path:r}=Cn(e,t);return r?[r]:[]}var Mr="/var/ts-cloud/artifacts",Uh="/usr/local/bin/ts-cloud-host-cleanup.sh",Qh="ts-cloud-host-cleanup";var Fg=Object.freeze({stagingMaxAgeMinutes:60,artifactMaxAgeDays:2,artifactUploadMaxAgeMinutes:60,bunCacheMaxAgeDays:7,journalMaxAgeDays:14,journalMaxSizeMb:512,containerImageMaxAgeHours:168}),Ug=Object.freeze({artifactMaxAgeDays:0,bunCacheMaxAgeDays:1,journalMaxAgeDays:3,journalMaxSizeMb:256,containerImageMaxAgeHours:24}),Hh=50,Gh=85,Vh="daily";function Fs(e){return`'${e.replace(/'/g,`'"'"'`)}'`}function Ze(e,t,r=0){if(!Number.isInteger(t)||t<r)throw Error(`hostCleanup: ${e} must be a whole number >= ${r} (got ${t})`)}function zs(e,t){for(let[r,n]of Object.entries(t))Ze(`${e}.${r}`,n);Ze(`${e}.stagingMaxAgeMinutes`,t.stagingMaxAgeMinutes,15),Ze(`${e}.artifactUploadMaxAgeMinutes`,t.artifactUploadMaxAgeMinutes,15),Ze(`${e}.journalMaxSizeMb`,t.journalMaxSizeMb,1)}function pc(e,t){let r=`hostCleanup.paths[${t}]`,n=e.path?.replace(/\/+$/,"")??"";if(!n.startsWith("/")||n===""||/[\s'"`$\\]/.test(n)||n.split("/").includes(".."))throw Error(`${r}.path must be an absolute directory with no spaces, quotes or '..' (got ${JSON.stringify(e.path)})`);if(n==="/var/www"||n.startsWith("/var/www/"))throw Error(`${r}.path must not be under /var/www: releases are pruned by keepReleases`);if(!e.pattern||/^[*?]+$/.test(e.pattern)||e.pattern.includes("/")||/[\n'"`]/.test(e.pattern))throw Error(`${r}.pattern must be a file-name glob naming something, not a bare wildcard (got ${JSON.stringify(e.pattern)})`);if(Ze(`${r}.maxAgeDays`,e.maxAgeDays),e.type!==void 0&&e.type!=="file"&&e.type!=="directory")throw Error(`${r}.type must be 'file' or 'directory'`)}function Fr(e){let t=typeof e==="object"&&e!==null?e:{},r=e!==!1,n={...Fg,...Bs(t.retention)};zs("hostCleanup.retention",n);let s=null;if(t.pressure!==!1){let c=typeof t.pressure==="object"?t.pressure:{},u=c.lowWaterPercent??50,f=c.highWaterPercent??85;if(Ze("hostCleanup.pressure.lowWaterPercent",u),Ze("hostCleanup.pressure.highWaterPercent",f,1),f>100||u>=f)throw Error(`hostCleanup.pressure: need 0 <= lowWaterPercent < highWaterPercent <= 100 (got ${u} and ${f})`);let h={...Ug,...Bs(c.escalated)},S=Object.fromEntries(Object.keys(n).map((v)=>[v,Math.min(n[v],h[v]??n[v])]));zs("hostCleanup.pressure.escalated",S),s={lowWaterPercent:u,highWaterPercent:f,escalated:S}}let i=t.schedule??"daily";if(!/^[\w*:,./~ -]+$/.test(i))throw Error(`hostCleanup.schedule must be a systemd OnCalendar expression (got ${JSON.stringify(i)})`);let a=t.paths??[];return a.forEach(pc),{enabled:r,timer:r&&t.timer!==!1,schedule:i,retention:n,pressure:s,paths:a}}function Bs(e){return Object.fromEntries(Object.entries(e??{}).filter(([,t])=>t!==void 0))}var Ft={stagingMaxAgeMinutes:"TS_CLOUD_HC_STAGING_MIN",artifactMaxAgeDays:"TS_CLOUD_HC_ARTIFACT_DAYS",artifactUploadMaxAgeMinutes:"TS_CLOUD_HC_UPLOAD_MIN",bunCacheMaxAgeDays:"TS_CLOUD_HC_BUN_DAYS",journalMaxAgeDays:"TS_CLOUD_HC_JOURNAL_DAYS",journalMaxSizeMb:"TS_CLOUD_HC_JOURNAL_MB",containerImageMaxAgeHours:"TS_CLOUD_HC_IMAGE_HOURS"};function Pn(e){return Object.keys(Ft).map((t)=>`${Ft[t]}=${e[t]}`).join(" ")}var Ke=(e)=>`"$${Ft[e]}"`;function Ks(e){return[`find /var/ts-cloud/staging -xdev -maxdepth 1 -type f -mmin +${Ke("stagingMaxAgeMinutes")} -delete 2>/dev/null || true`,`find /tmp -xdev -maxdepth 1 -type f -name "*-release.tar.gz" -mmin +${Ke("stagingMaxAgeMinutes")} -delete 2>/dev/null || true`,`find /var/ts-cloud/artifacts -xdev -maxdepth 1 -type f -name "*.tar.gz" -mtime +${Ke("artifactMaxAgeDays")} -delete 2>/dev/null || true`,`find /var/ts-cloud/artifacts -xdev -maxdepth 1 -type f -name ".*.tmp" -mmin +${Ke("artifactUploadMaxAgeMinutes")} -delete 2>/dev/null || true`,...e.map(dc),`journalctl --vacuum-time=${Ke("journalMaxAgeDays")}d --vacuum-size=${Ke("journalMaxSizeMb")}M >/dev/null 2>&1 || true`]}function dc(e){let t=Fs(e.path.replace(/\/+$/,"")),r=Fs(e.pattern);return e.type==="directory"?`find ${t} -xdev -mindepth 1 -maxdepth 1 -type d -name ${r} -mtime +${e.maxAgeDays} -exec rm -rf -- {} + 2>/dev/null || true`:`find ${t} -xdev -mindepth 1 -maxdepth 1 -type f -name ${r} -mtime +${e.maxAgeDays} -delete 2>/dev/null || true`}function js(){return[`find /root/.bun/install/cache -xdev -type f -mtime +${Ke("bunCacheMaxAgeDays")} -delete 2>/dev/null || true`,`find /root/.bun/install/cache -xdev -depth -type d -empty -mtime +${Ke("bunCacheMaxAgeDays")} -delete 2>/dev/null || true`,`if command -v docker >/dev/null 2>&1; then docker image prune --all --force --filter "until=\${${Ft.containerImageMaxAgeHours}}h" >/dev/null 2>&1 || true; fi`,`if command -v podman >/dev/null 2>&1; then podman image prune --all --force --filter "until=\${${Ft.containerImageMaxAgeHours}}h" >/dev/null 2>&1 || true; fi`,"if command -v apt-get >/dev/null 2>&1; then apt-get clean >/dev/null 2>&1 || true; fi"]}function Gs(e){return[`${e}="$(df -P / 2>/dev/null | awk 'NR==2 {sub(/%/, "", $5); print $5}' || true)"`,`case "$${e}" in ''|*[!0-9]*) ${e}=-1 ;; esac`]}function ri(e){let{retention:t,pressure:r,paths:n}=Fr(e),s='echo "[ts-cloud] host cleanup (disk before): $(df -h / | tail -1)"',i='echo "[ts-cloud] host cleanup (disk after): $(df -h / | tail -1)"';if(!r)return['echo "[ts-cloud] host cleanup (disk before): $(df -h / | tail -1)"',Pn(t),...Ks(n),...js(),'echo "[ts-cloud] host cleanup (disk after): $(df -h / | tail -1)"'];let{lowWaterPercent:a,highWaterPercent:c,escalated:u}=r;return['echo "[ts-cloud] host cleanup (disk before): $(df -h / | tail -1)"',...Gs("TS_CLOUD_HC_BEFORE"),"TS_CLOUD_HC_TIER=normal",Pn(t),`if [ "$TS_CLOUD_HC_BEFORE" -ge 0 ] && [ "$TS_CLOUD_HC_BEFORE" -lt ${a} ]; then`,"  TS_CLOUD_HC_TIER=light",`  echo "[ts-cloud] host cleanup: / at \${TS_CLOUD_HC_BEFORE}% (under ${a}%), skipping cache and image pruning"`,`elif [ "$TS_CLOUD_HC_BEFORE" -ge ${c} ]; then`,"  TS_CLOUD_HC_TIER=pressure",`  ${Pn(u)}`,`  echo "[ts-cloud] warning: / at \${TS_CLOUD_HC_BEFORE}% (at or above ${c}%), host cleanup is using shortened retention windows" >&2`,"fi",...Ks(n),'if [ "$TS_CLOUD_HC_TIER" != light ]; then',...js().map((f)=>`  ${f}`),"fi",'echo "[ts-cloud] host cleanup (disk after): $(df -h / | tail -1)"',...Gs("TS_CLOUD_HC_AFTER"),`echo "[ts-cloud] host-cleanup {\\"event\\":\\"host-cleanup\\",\\"tier\\":\\"$TS_CLOUD_HC_TIER\\",\\"diskBeforePercent\\":$TS_CLOUD_HC_BEFORE,\\"diskAfterPercent\\":$TS_CLOUD_HC_AFTER,\\"lowWaterPercent\\":${a},\\"highWaterPercent\\":${c}}"`,"mkdir -p /var/lib/ts-cloud 2>/dev/null || true",'TS_CLOUD_HC_PREV="$(cat /var/lib/ts-cloud/host-cleanup.alert 2>/dev/null || echo ok)"',`if [ "$TS_CLOUD_HC_AFTER" -ge ${c} ]; then`,`  echo "[ts-cloud] warning: / still at \${TS_CLOUD_HC_AFTER}% after host cleanup (high-water ${c}%); something outside ts-cloud's retention rules is filling the disk" >&2`,`  if [ "$TS_CLOUD_HC_PREV" != alert ] && [ -x /usr/local/bin/ts-cloud-notify ]; then /usr/local/bin/ts-cloud-notify "⚠️ $(hostname): / at \${TS_CLOUD_HC_AFTER}% after host cleanup (high-water ${c}%)" >/dev/null 2>&1 || true; fi`,"  echo alert > /var/lib/ts-cloud/host-cleanup.alert 2>/dev/null || true","else",`  if [ "$TS_CLOUD_HC_PREV" = alert ] && [ -x /usr/local/bin/ts-cloud-notify ]; then /usr/local/bin/ts-cloud-notify "✅ $(hostname): / back under ${c}% after host cleanup (\${TS_CLOUD_HC_AFTER}%)" >/dev/null 2>&1 || true; fi`,"  echo ok > /var/lib/ts-cloud/host-cleanup.alert 2>/dev/null || true","fi"]}function Qg(e){return["#!/usr/bin/env bash","# Managed by ts-cloud: rewritten on every deploy. Configure compute.hostCleanup instead of editing.","set -uo pipefail","TS_CLOUD_HC_LOCK=/run/lock/ts-cloud-host-cleanup.lock","[ -d /run/lock ] || TS_CLOUD_HC_LOCK=/tmp/ts-cloud-host-cleanup.lock",'if command -v flock >/dev/null 2>&1 && exec 9>"$TS_CLOUD_HC_LOCK"; then','  if ! flock -n 9; then echo "[ts-cloud] host cleanup already running; skipping"; exit 0; fi',"fi",...ri(e),"exit 0"]}function En(e,t,r,n,s){return[`cat > ${e}.ts-cloud-new <<'${r}' || true`,...t,r,`if [ -s ${e}.ts-cloud-new ] && ! cmp -s ${e}.ts-cloud-new ${e}; then chmod ${n} ${e}.ts-cloud-new && mv -f ${e}.ts-cloud-new ${e}${s?` && ${s}=1`:""} || true; else rm -f ${e}.ts-cloud-new; fi`]}function to(e){let t=Fr(e),r="/etc/systemd/system/ts-cloud-host-cleanup",n=["if [ -f /etc/systemd/system/ts-cloud-host-cleanup.timer ]; then","  systemctl disable --now ts-cloud-host-cleanup.timer >/dev/null 2>&1 || true","  rm -f /etc/systemd/system/ts-cloud-host-cleanup.timer /etc/systemd/system/ts-cloud-host-cleanup.service","  systemctl daemon-reload >/dev/null 2>&1 || true","fi"];if(!t.enabled)return[...n,"rm -f /usr/local/bin/ts-cloud-host-cleanup.sh"];let s=En("/usr/local/bin/ts-cloud-host-cleanup.sh",Qg(e),"TS_CLOUD_HOST_CLEANUP_EOF","755");if(!t.timer)return[...s,...n];return[...s,"TS_CLOUD_HC_UNITS_CHANGED=0","if command -v systemctl >/dev/null 2>&1 && [ -d /etc/systemd/system ]; then",...En("/etc/systemd/system/ts-cloud-host-cleanup.service",["[Unit]","Description=ts-cloud host cleanup (bounded disk retention)","After=local-fs.target","","[Service]","Type=oneshot","ExecStart=/usr/local/bin/ts-cloud-host-cleanup.sh","Nice=19","IOSchedulingClass=idle"],"TS_CLOUD_HOST_CLEANUP_SVC_EOF","644","TS_CLOUD_HC_UNITS_CHANGED"),...En("/etc/systemd/system/ts-cloud-host-cleanup.timer",["[Unit]","Description=Run ts-cloud host cleanup on a schedule, independent of deploys","","[Timer]",`OnCalendar=${t.schedule}`,"RandomizedDelaySec=1h","Persistent=true","","[Install]","WantedBy=timers.target"],"TS_CLOUD_HOST_CLEANUP_TMR_EOF","644","TS_CLOUD_HC_UNITS_CHANGED"),'  if [ "$TS_CLOUD_HC_UNITS_CHANGED" -eq 1 ]; then systemctl daemon-reload >/dev/null 2>&1 || true; fi',"  systemctl enable --now ts-cloud-host-cleanup.timer >/dev/null 2>&1 || true","fi"]}function ni(e){let t=to(e);if(!Fr(e).enabled)return t;return[...t,'if [ -x /usr/local/bin/ts-cloud-host-cleanup.sh ]; then /usr/local/bin/ts-cloud-host-cleanup.sh < /dev/null || echo "[ts-cloud] warning: host cleanup exited $?" >&2; fi']}var mc=/\.(?:[cm]?[jt]sx?)$/;function ii(e,t,r){let n=t==="bun"?"/usr/local/bin/bun":t==="deno"?"/usr/local/bin/deno":"/usr/local/bin/node",s=e.trim();if(/^(?:bun|node|deno)\s+/.test(s))return`${n} ${s.replace(/^(?:bun|node|deno)\s+/,"")}`;let[i="",...a]=s.split(/\s+/);if(i&&!mc.test(i)){let c=i.startsWith("/")?i:r&&i.startsWith("./")?`${r.replace(/\/+$/,"")}/${i.replace(/^\.\//,"")}`:void 0;if(c)return[c,...a].join(" ")}return`${n} ${s}`}function Vs(e){return["TS_CLOUD_MEM_MB=$(awk '/^MemTotal:/{print int($2/1024)}' /proc/meminfo)","TS_CLOUD_HIGH_MB=$((TS_CLOUD_MEM_MB / 8))",'[ "$TS_CLOUD_HIGH_MB" -lt 512 ] && TS_CLOUD_HIGH_MB=512','[ "$TS_CLOUD_HIGH_MB" -gt 4096 ] && TS_CLOUD_HIGH_MB=4096',`mkdir -p /etc/systemd/system/${e}.d`,`printf '# Written by ts-cloud: memoryHigh resolved from this box.
 # An eighth of %sMB RAM. Set memoryHigh in config to override.
 [Service]
 MemoryAccounting=true
 MemoryHigh=%sM
-' "$TS_CLOUD_MEM_MB" "$TS_CLOUD_HIGH_MB" > /etc/systemd/system/${e}.d/50-ts-cloud-memory.conf`,"systemctl daemon-reload",'echo "[ts-cloud] memoryHigh=auto resolved to ${TS_CLOUD_HIGH_MB}M (one eighth of ${TS_CLOUD_MEM_MB}M)"',...On()]}function br(e,t={auto:!0}){let r=t.auto===!1?[]:[`/etc/systemd/system/${e}.d/50-ts-cloud-memory.conf`];for(let n of["/etc/systemd/system.control","/run/systemd/system.control"]){if(t.high)r.push(`${n}/${e}.d/50-MemoryHigh.conf`);if(t.max)r.push(`${n}/${e}.d/50-MemoryMax.conf`)}if(r.length===0)return[];return["TS_CLOUD_MEM_CLEARED=0",...r.map((n)=>`if [ -f ${n} ]; then rm -f ${n}; TS_CLOUD_MEM_CLEARED=1; echo "[ts-cloud] removed ${n}: memory limits now come from config"; fi`),'if [ "$TS_CLOUD_MEM_CLEARED" = 1 ]; then systemctl daemon-reload; fi']}function On(){return[`TS_CLOUD_COMMIT=$(for f in /sys/fs/cgroup/system.slice/*.service/memory.high /sys/fs/cgroup/system.slice/*.slice/*.service/memory.high; do [ -f "$f" ] || continue; v=$(cat "$f" 2>/dev/null); [ "$v" = "max" ] && continue; echo "$v"; done | awk '{s+=$1} END {print int(s/1048576)}')`,"TS_CLOUD_RAM=$(awk '/^MemTotal:/{print int($2/1024)}' /proc/meminfo)",'if [ -n "$TS_CLOUD_COMMIT" ] && [ "$TS_CLOUD_COMMIT" -gt 0 ] && [ "$TS_CLOUD_RAM" -gt 0 ]; then TS_CLOUD_PCT=$((TS_CLOUD_COMMIT * 100 / TS_CLOUD_RAM)); if [ "$TS_CLOUD_PCT" -gt 300 ]; then echo "[ts-cloud] WARNING: services on this box declare ${TS_CLOUD_COMMIT}M of MemoryHigh against ${TS_CLOUD_RAM}M of RAM (${TS_CLOUD_PCT}% committed). Soft ceilings, so this is not fatal - but no ceiling can protect the box once enough of them are drawn on at once."; else echo "[ts-cloud] memory commitment: ${TS_CLOUD_COMMIT}M declared against ${TS_CLOUD_RAM}M RAM (${TS_CLOUD_PCT}%)"; fi; fi']}function fc(e){return[`TS_CLOUD_SLICE=$(systemctl show ${e} -p Slice --value 2>/dev/null || true)`,'if [ -n "$TS_CLOUD_SLICE" ] && [ "$TS_CLOUD_SLICE" != "system.slice" ]; then systemctl set-property --runtime "$TS_CLOUD_SLICE" MemoryHigh=infinity MemoryMax=infinity 2>/dev/null || true; systemctl set-property "$TS_CLOUD_SLICE" MemoryHigh=infinity MemoryMax=infinity 2>/dev/null || true; fi']}var Qe={path:"/",intervalSeconds:60,failuresBeforeRestart:3,timeoutSeconds:10,startupGraceSeconds:600,maxBackoffSeconds:3600,backoffBaseSeconds:300};function zt(e,t,r){return typeof e==="number"&&Number.isFinite(e)?Math.max(r,Math.floor(e)):t}function Ws(e){let{unitBase:t,unitPattern:r,port:n}=e,s=e.path&&e.path.startsWith("/")?e.path:Qe.path,i=zt(e.intervalSeconds,Qe.intervalSeconds,10),a=zt(e.failuresBeforeRestart,Qe.failuresBeforeRestart,1),c=zt(e.timeoutSeconds,Qe.timeoutSeconds,1),u=zt(e.startupGraceSeconds,Qe.startupGraceSeconds,0),f=zt(e.maxBackoffSeconds,Qe.maxBackoffSeconds,0),h=Math.min(Qe.backoffBaseSeconds,f),S=`/usr/local/sbin/${t}-liveness`,v=`/run/${t}-liveness`,_=`${t}-liveness`,y=`127.0.0.1:${n}${s}`,D=r.includes("@*")?`TS_CLOUD_UNIT=$(systemctl list-units --plain --no-legend --type=service '${r}' 2>/dev/null | awk '{print $1}' | head -1)`:`TS_CLOUD_UNIT=${r}`;return[`cat > ${S} <<'TS_CLOUD_LIVENESS_EOF'`,"#!/bin/sh",`# Liveness check for ${t}, written by ts-cloud on every deploy.`,`# Settings: interval=${i}s timeout=${c}s failures=${a} startup-grace=${u}s max-backoff=${f}s`,"set -eu",`TS_CLOUD_STATE=${v}`,'exec 9>"$TS_CLOUD_STATE.lock"',"flock -n 9 || exit 0",D,'[ -n "$TS_CLOUD_UNIT" ] || exit 0','systemctl is-active --quiet "$TS_CLOUD_UNIT" || exit 0',"TS_CLOUD_RC=0",`curl -s -o /dev/null --max-time ${c} "http://${y}" || TS_CLOUD_RC=$?`,'if [ "$TS_CLOUD_RC" -eq 0 ]; then','  rm -f "$TS_CLOUD_STATE.fail"','  if [ -f "$TS_CLOUD_STATE.restarts" ]; then',`    TS_CLOUD_LAST=$(awk '{print $2}' "$TS_CLOUD_STATE.restarts" 2>/dev/null || true)`,`    case "$TS_CLOUD_LAST" in ''|*[!0-9]*) TS_CLOUD_LAST=0 ;; esac`,`    [ $(($(date +%s) - TS_CLOUD_LAST)) -lt ${f} ] || rm -f "$TS_CLOUD_STATE.restarts"`,"  fi","  exit 0","fi",'case "$TS_CLOUD_RC" in',"  7) TS_CLOUD_WHY='connection refused' ;;",`  28) TS_CLOUD_WHY='no response within ${c}s' ;;`,'  *) TS_CLOUD_WHY="curl exit $TS_CLOUD_RC" ;;',"esac",'TS_CLOUD_SINCE=$(systemctl show "$TS_CLOUD_UNIT" -p ActiveEnterTimestampMonotonic --value 2>/dev/null || true)',"TS_CLOUD_UPTIME=$(cut -d' ' -f1 /proc/uptime 2>/dev/null || true)",`TS_CLOUD_AGE=$(awk -v up="$TS_CLOUD_UPTIME" -v since="$TS_CLOUD_SINCE" 'BEGIN { if (since + 0 > 0 && up + 0 > 0) print int(up - since / 1000000); else print -1 }')`,`case "$TS_CLOUD_AGE" in ''|*[!0-9-]*) TS_CLOUD_AGE=-1 ;; esac`,'if [ "$TS_CLOUD_AGE" -lt 0 ]; then','  TS_CLOUD_PID=$(systemctl show "$TS_CLOUD_UNIT" -p MainPID --value 2>/dev/null || true)',`  case "$TS_CLOUD_PID" in ''|0|*[!0-9]*) ;; *) TS_CLOUD_AGE=$(ps -o etimes= -p "$TS_CLOUD_PID" 2>/dev/null | tr -d ' ' || true) ;; esac`,`  case "$TS_CLOUD_AGE" in ''|*[!0-9]*) TS_CLOUD_AGE=-1 ;; esac`,"fi",`if [ "$TS_CLOUD_AGE" -ge 0 ] && [ "$TS_CLOUD_AGE" -lt ${u} ]; then`,'  rm -f "$TS_CLOUD_STATE.fail"',`  logger -t ${_} "$TS_CLOUD_UNIT is \${TS_CLOUD_AGE}s old, inside its ${u}s startup grace; not counting this failed check on ${y} ($TS_CLOUD_WHY)"`,"  exit 0","fi",'TS_CLOUD_FAILS=$(cat "$TS_CLOUD_STATE.fail" 2>/dev/null || echo 0)',`case "$TS_CLOUD_FAILS" in ''|*[!0-9]*) TS_CLOUD_FAILS=0 ;; esac`,"TS_CLOUD_FAILS=$((TS_CLOUD_FAILS + 1))",'echo "$TS_CLOUD_FAILS" > "$TS_CLOUD_STATE.fail"',`if [ "$TS_CLOUD_FAILS" -lt ${a} ]; then`,`  logger -t ${_} "check $TS_CLOUD_FAILS of ${a} failed on ${y} ($TS_CLOUD_WHY)"`,"  exit 0","fi","TS_CLOUD_NOW=$(date +%s)","TS_CLOUD_STREAK=0","TS_CLOUD_LAST=0",'[ ! -f "$TS_CLOUD_STATE.restarts" ] || read -r TS_CLOUD_STREAK TS_CLOUD_LAST < "$TS_CLOUD_STATE.restarts" || true',`case "$TS_CLOUD_STREAK" in ''|*[!0-9]*) TS_CLOUD_STREAK=0 ;; esac`,`case "$TS_CLOUD_LAST" in ''|*[!0-9]*) TS_CLOUD_LAST=0 ;; esac`,'if [ "$TS_CLOUD_STREAK" -gt 0 ]; then',`  TS_CLOUD_WAIT=${h}`,"  TS_CLOUD_I=1",`  while [ "$TS_CLOUD_I" -lt "$TS_CLOUD_STREAK" ] && [ "$TS_CLOUD_WAIT" -lt ${f} ]; do TS_CLOUD_WAIT=$((TS_CLOUD_WAIT * 2)); TS_CLOUD_I=$((TS_CLOUD_I + 1)); done`,`  [ "$TS_CLOUD_WAIT" -le ${f} ] || TS_CLOUD_WAIT=${f}`,"  TS_CLOUD_ELAPSED=$((TS_CLOUD_NOW - TS_CLOUD_LAST))",'  if [ "$TS_CLOUD_ELAPSED" -lt "$TS_CLOUD_WAIT" ]; then',`    logger -t ${_} "holding off: $TS_CLOUD_STREAK liveness restart(s) in a row have not brought $TS_CLOUD_UNIT back; next restart allowed in $((TS_CLOUD_WAIT - TS_CLOUD_ELAPSED))s ($TS_CLOUD_WHY on ${y})"`,"    exit 0","  fi","fi","TS_CLOUD_STREAK=$((TS_CLOUD_STREAK + 1))",`logger -t ${_} "no HTTP response on ${y} after $TS_CLOUD_FAILS checks ($TS_CLOUD_WHY); restarting $TS_CLOUD_UNIT (liveness restart $TS_CLOUD_STREAK in a row)"`,'echo "$TS_CLOUD_STREAK $TS_CLOUD_NOW" > "$TS_CLOUD_STATE.restarts"','rm -f "$TS_CLOUD_STATE.fail"','systemctl restart "$TS_CLOUD_UNIT"',"TS_CLOUD_LIVENESS_EOF",`chmod +x ${S}`,`rm -f ${v}.fail ${v}.restarts`,`cat > /etc/systemd/system/${t}-liveness.service <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=Liveness check for ${t} (managed by ts-cloud)`,"","[Service]","Type=oneshot",`ExecStart=${S}`,"TS_CLOUD_UNIT_EOF",`cat > /etc/systemd/system/${t}-liveness.timer <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=Run the ${t} liveness check every ${i}s`,"","[Timer]",`OnUnitActiveSec=${i}s`,`OnBootSec=${i}s`,"Persistent=true","","[Install]","WantedBy=timers.target","TS_CLOUD_UNIT_EOF","systemctl daemon-reload",`systemctl enable --now ${t}-liveness.timer >/dev/null 2>&1 || true`]}var qs=20,Rn=3,gc=5,hc=60;function Sc(e){let{paths:t,unitBase:r,releaseId:n,port:s}=e,i=`${r}@${n}.service`,a=`${r}.service`,c=Math.max(1,e.healthGateSeconds??5),u=e.healthCheckPath?e.healthCheckPath.startsWith("/")?e.healthCheckPath:`/${e.healthCheckPath}`:null,f=u?`curl -sf -o /dev/null --max-time ${gc} "http://127.0.0.1:${s}${u}"`:null,h=(S)=>`{ echo "[ts-cloud] release ${n} ${S}" >&2; ts_cloud_restore_previous; exit 1; }`;return[`TS_CLOUD_OLD_UNITS=$(systemctl list-units --plain --no-legend --type=service "${r}@*.service" 2>/dev/null | awk '{print $1}' | grep -v "^${i}$" || true)`,`TS_CLOUD_PREV_CURRENT="$(readlink ${t.current} 2>/dev/null || true)"`,"TS_CLOUD_LEGACY_STOPPED=0","ts_cloud_restore_previous() {",`  journalctl -u ${i} -n 50 --no-pager >&2 || true`,`  systemctl stop ${i} 2>/dev/null || true`,`  systemctl disable ${i} 2>/dev/null || true`,`  if [ -n "$TS_CLOUD_PREV_CURRENT" ] && [ -d "$TS_CLOUD_PREV_CURRENT" ]; then ln -sfn "$TS_CLOUD_PREV_CURRENT" ${t.current}.tmp && mv -Tf ${t.current}.tmp ${t.current}; fi`,'  for TS_CLOUD_RU in ${TS_CLOUD_OLD_UNITS}; do systemctl enable "$TS_CLOUD_RU" 2>/dev/null || true; systemctl start "$TS_CLOUD_RU" 2>/dev/null || true; done',`  if [ "$TS_CLOUD_LEGACY_STOPPED" -eq 1 ]; then systemctl start ${a} 2>/dev/null || true; fi`,'  if [ -n "$TS_CLOUD_OLD_UNITS" ] || [ "$TS_CLOUD_LEGACY_STOPPED" -eq 1 ]; then echo "[ts-cloud] previous release restored and serving" >&2; else echo "[ts-cloud] there was no previous release to restore" >&2; fi',"}",`if [ -f /etc/systemd/system/${a} ] && systemctl is-active --quiet ${a}; then echo "[ts-cloud] retiring pre-zero-downtime unit ${a} (one-time restart cutover)"; systemctl stop ${a}; TS_CLOUD_LEGACY_STOPPED=1; fi`,'TS_CLOUD_STARTED_AT="@$(date +%s)"',`systemctl restart ${i}`,`TS_CLOUD_GATE_OK=1; for TS_CLOUD_I in $(seq 1 ${c}); do sleep 1; systemctl is-active --quiet ${i} || { TS_CLOUD_GATE_OK=0; break; }; done`,'if [ "$TS_CLOUD_GATE_OK" -ne 1 ]; then',`  if journalctl -u ${i} --since "$TS_CLOUD_STARTED_AT" -o cat --no-pager 2>/dev/null | grep -iE 'EADDRINUSE|address already in use|port [0-9]+ (is )?in use|Failed to start server' >/dev/null; then`,`    echo "[ts-cloud] release ${n} could not share :${s} with the previous release (no SO_REUSEPORT?) — retiring it and retrying" >&2`,'    for TS_CLOUD_RU in ${TS_CLOUD_OLD_UNITS}; do systemctl stop "$TS_CLOUD_RU" 2>/dev/null || true; done',`    systemctl restart ${i}`,`    for TS_CLOUD_I in $(seq 1 ${c}); do sleep 1; systemctl is-active --quiet ${i} || ${h("failed its health gate on the free port")}; done`,"  else",`    ${h("crashed on start — the previous release was never stopped")}`,"  fi","fi",`if ss -ltnpH "sport = :${s}" >/dev/null 2>&1; then`,"  TS_CLOUD_BOUND=0",`  for TS_CLOUD_I in $(seq 1 ${hc}); do`,`    TS_CLOUD_NEW_PID="$(systemctl show -p MainPID --value ${i} 2>/dev/null || true)"`,`    if [ -n "$TS_CLOUD_NEW_PID" ] && [ "$TS_CLOUD_NEW_PID" != "0" ] && ss -ltnpH "sport = :${s}" 2>/dev/null | grep "pid=$TS_CLOUD_NEW_PID," >/dev/null; then TS_CLOUD_BOUND=1; break; fi`,`    systemctl is-active --quiet ${i} || break`,`    sleep ${Rn}`,"  done",`  [ "$TS_CLOUD_BOUND" -eq 1 ] || ${h(`never took :${s}`)}`,"else",'  echo "[ts-cloud] cannot read listener PIDs on this host — the response probes run without the bind check" >&2',"fi",...f?[`TS_CLOUD_HEALTHY=0; for TS_CLOUD_I in $(seq 1 ${qs}); do if ${f}; then TS_CLOUD_HEALTHY=1; break; fi; sleep ${Rn}; done`,`[ "$TS_CLOUD_HEALTHY" -eq 1 ] || ${h(`never answered ${u}`)}`]:[],...pt(t),`systemctl enable ${i} 2>/dev/null || true`,'for TS_CLOUD_U in ${TS_CLOUD_OLD_UNITS}; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done',`TS_CLOUD_LISTENING=0; for TS_CLOUD_I in $(seq 1 ${c}); do if ss -ltnH "sport = :${s}" 2>/dev/null | grep . >/dev/null; then TS_CLOUD_LISTENING=1; break; fi; sleep 1; done`,`if [ "$TS_CLOUD_LISTENING" -ne 1 ]; then echo "[ts-cloud] nothing is listening on ${s} after retiring the previous release — restarting ${i} on the now-free port" >&2; systemctl restart ${i}; for TS_CLOUD_I in $(seq 1 ${c}); do if ss -ltnH "sport = :${s}" 2>/dev/null | grep . >/dev/null; then TS_CLOUD_LISTENING=1; break; fi; sleep 1; done; fi`,`[ "$TS_CLOUD_LISTENING" -eq 1 ] || ${h(`is active but never bound :${s}`)}`,...f?[`TS_CLOUD_HEALTHY=0; for TS_CLOUD_I in $(seq 1 ${qs}); do if ${f}; then TS_CLOUD_HEALTHY=1; break; fi; sleep ${Rn}; done`,`[ "$TS_CLOUD_HEALTHY" -eq 1 ] || ${h(`stopped answering ${u} once it served alone`)}`]:[],...Tn(t),`systemctl list-unit-files --plain --no-legend "${r}@*.service" 2>/dev/null | awk '{print $1}' | { grep -v -e "^${i}$" -e "^${r}@\\.service$" || true; } | while read -r TS_CLOUD_U; do systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done`,`if [ -f /etc/systemd/system/${a} ]; then systemctl disable ${a} 2>/dev/null || true; rm -f /etc/systemd/system/${a}; systemctl daemon-reload; fi`]}function Ys(e,t){if(!t.length)return[];let r=et(e.release);return[`if [ -e ${r} ] || [ -L ${r} ]; then`,...t,"fi"]}function si(e){let{siteName:t,slug:r,artifactFetch:n,releaseId:s,execStart:i,envEntries:a,port:c,keepReleases:u=Ht,preStartCommands:f=[],postActivateCommands:h=[],beforeResetCommands:S=[],healthCheckPath:v,healthGateSeconds:_=5,liveness:y,memoryHigh:b="auto",memoryMax:D,cpuWeight:V,ioWeight:H,tasksMax:x,stopTimeout:k}=e,I=[...V!=null?[`CPUWeight=${V}`]:[],...H!=null?[`IOWeight=${H}`]:[],...x!=null?[`TasksMax=${x}`]:[],...k?[`TimeoutStopSec=${k}`]:[]],Y=e.zeroDowntime??c!=null,W=e.appDir??`/var/www/${t}`,K=Zt(W,s),ee=`${r}-${t}`,re=`${ee}.service`,te=ai(r,t,s),ie=e.sharedPaths??[],oe=Hs([".env",...ie,...yr(a,ie)]),ne=fr(a),he=f.length>0?[`cd ${K.release}`,...f]:[],ye=["set -euo pipefail",...vn(K),...n,...Mt(K,oe),...Ys(K,S),$n(K),..._n(K),`tar xzf ${te} -C "$TS_CLOUD_STAGED"`,`rm -f ${te}`,`cat > ${K.shared}/.env <<'TS_CLOUD_ENV_EOF'`,ne,"TS_CLOUD_ENV_EOF",`chmod 600 ${K.shared}/.env`,...yn(K),`find ${K.release} -maxdepth 1 \\( -type f -o -type l \\) -name '.env*' ! -name '.env.example' ! -name '*.example' -delete`,`sed -i -E '/^[[:space:]]*(PORT|PORT_BACKEND|PORT_ADMIN|PORT_FRONTEND)[[:space:]]*=/d' ${K.shared}/.env 2>/dev/null || true`,...Sr(K,oe),...he,...e.isolation?Ls(e.slug||t,K.base,oe.flatMap((T)=>typeof T==="string"||!T.target?[]:[T.target])):[]];if(Y&&c!=null){let T=`${ee}@${s}.service`,L=v?v.startsWith("/")?v:`/${v}`:null;return[...ye,`cat > /etc/systemd/system/${ee}@.service <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=${t} release %i (managed by ts-cloud)`,"After=network.target","","[Service]","Type=simple",...e.isolation?Ut(ut(e.slug||t)):[],`WorkingDirectory=${K.releases}/%i`,`ExecStart=${i}`,"Restart=always","RestartSec=5","MemoryAccounting=true",...b&&b!=="auto"?[`MemoryHigh=${b}`]:[],...D?[`MemoryMax=${D}`]:[],...I,`EnvironmentFile=${K.releases}/%i/.env`,`Environment=PORT=${c}`,`Environment=STX_IMAGE_CACHE_DIR=${hr(K)}`,`Environment=STX_BUNDLE_CACHE_DIR=${Nt(K)}`,`Environment=STX_BUNDLE_CACHE_DIR=${Nt(K)}`,"","[Install]","WantedBy=multi-user.target","TS_CLOUD_UNIT_EOF","systemctl daemon-reload",...b==="auto"?Vs(`${ee}@.service`):[...br(`${ee}@.service`),...On()],...fc(T),...Sc({paths:K,unitBase:ee,releaseId:s,port:c,healthCheckPath:L,healthGateSeconds:_}),...h,...dt(K,u),...y===!1?[]:Ws({...y,unitBase:ee,unitPattern:`${ee}@*.service`,port:c,path:y?.path??v})]}return[...ye,`cat > /etc/systemd/system/${re} <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=${t} (managed by ts-cloud)`,"After=network.target","","[Service]","Type=simple",...e.isolation?Ut(ut(e.slug||t)):[],`WorkingDirectory=${K.current}`,`ExecStart=${i}`,"Restart=always","RestartSec=5","MemoryAccounting=true",...b&&b!=="auto"?[`MemoryHigh=${b}`]:[],...D?[`MemoryMax=${D}`]:[],...I,`EnvironmentFile=${K.current}/.env`,...c?[`Environment=PORT=${c}`]:[],`Environment=STX_IMAGE_CACHE_DIR=${hr(K)}`,`Environment=STX_BUNDLE_CACHE_DIR=${Nt(K)}`,"","[Install]","WantedBy=multi-user.target","TS_CLOUD_UNIT_EOF","systemctl daemon-reload",...br(re,{auto:b!=="auto",high:b!=="auto",max:Boolean(D)}),...b==="auto"?Vs(re):On(),`systemctl enable ${re}`,`TS_CLOUD_PREV_CURRENT="$(readlink ${K.current} 2>/dev/null || true)"`,...pt(K),`systemctl restart ${re}`,`for TS_CLOUD_I in $(seq 1 ${Math.max(1,_)}); do sleep 1; systemctl is-active --quiet ${re} || { echo "[ts-cloud] release ${s} of ${re} did not stay up — restoring the previous release" >&2; journalctl -u ${re} -n 50 --no-pager >&2 || true; if [ -n "$TS_CLOUD_PREV_CURRENT" ] && [ -d "$TS_CLOUD_PREV_CURRENT" ] && [ "$(readlink -f "$TS_CLOUD_PREV_CURRENT")" != "$(readlink -f ${K.release})" ]; then ln -sfn "$TS_CLOUD_PREV_CURRENT" ${K.current}.tmp && mv -Tf ${K.current}.tmp ${K.current}; systemctl restart ${re} || true; fi; exit 1; }; done`,...Tn(K),...h,...dt(K,u),...y===!1||!c?[]:Ws({...y,unitBase:ee,unitPattern:re,port:c,path:y?.path??v})]}function oi(e){let{siteName:t,artifactFetch:r,releaseId:n,keepReleases:s=Ht,preStartCommands:i=[],postActivateCommands:a=[],beforeResetCommands:c=[]}=e,u=e.appDir??`/var/www/${t}`,f=Zt(u,n),h=ai(e.slug,t,n),S=i.length>0?[`cd ${f.release}`,...i]:[];return["set -euo pipefail",...vn(f),...r,...Mt(f,[]),...Ys(f,c),$n(f),..._n(f),`tar xzf ${h} -C "$TS_CLOUD_STAGED"`,...yn(f),`rm -f ${h}`,...S,...pt(f),...a,...dt(f,s)]}function ai(e,t,r){return`/tmp/${[e,t,r].filter(Boolean).join("-")}-release.tar.gz`}function $c(e,t,r,n){return[`aws s3 cp "s3://${e}/${t}" ${n} --region ${r}`]}function Mc(e,t){return[`mv "${e}" ${t}`]}function et(e){return`'${e.replace(/'/g,`'"'"'`)}'`}function Tr(e,t,r){return["set -euo pipefail",`chmod 600 ${et(e)}`,`mv -f -- ${et(e)} ${et(t)}`,`cp -- ${et(t)} ${et(r)}`].join(`
+' "$TS_CLOUD_MEM_MB" "$TS_CLOUD_HIGH_MB" > /etc/systemd/system/${e}.d/50-ts-cloud-memory.conf`,"systemctl daemon-reload",'echo "[ts-cloud] memoryHigh=auto resolved to ${TS_CLOUD_HIGH_MB}M (one eighth of ${TS_CLOUD_MEM_MB}M)"',...On()]}function br(e,t={auto:!0}){let r=t.auto===!1?[]:[`/etc/systemd/system/${e}.d/50-ts-cloud-memory.conf`];for(let n of["/etc/systemd/system.control","/run/systemd/system.control"]){if(t.high)r.push(`${n}/${e}.d/50-MemoryHigh.conf`);if(t.max)r.push(`${n}/${e}.d/50-MemoryMax.conf`)}if(r.length===0)return[];return["TS_CLOUD_MEM_CLEARED=0",...r.map((n)=>`if [ -f ${n} ]; then rm -f ${n}; TS_CLOUD_MEM_CLEARED=1; echo "[ts-cloud] removed ${n}: memory limits now come from config"; fi`),'if [ "$TS_CLOUD_MEM_CLEARED" = 1 ]; then systemctl daemon-reload; fi']}function On(){return[`TS_CLOUD_COMMIT=$(for f in /sys/fs/cgroup/system.slice/*.service/memory.high /sys/fs/cgroup/system.slice/*.slice/*.service/memory.high; do [ -f "$f" ] || continue; v=$(cat "$f" 2>/dev/null); [ "$v" = "max" ] && continue; echo "$v"; done | awk '{s+=$1} END {print int(s/1048576)}')`,"TS_CLOUD_RAM=$(awk '/^MemTotal:/{print int($2/1024)}' /proc/meminfo)",'if [ -n "$TS_CLOUD_COMMIT" ] && [ "$TS_CLOUD_COMMIT" -gt 0 ] && [ "$TS_CLOUD_RAM" -gt 0 ]; then TS_CLOUD_PCT=$((TS_CLOUD_COMMIT * 100 / TS_CLOUD_RAM)); if [ "$TS_CLOUD_PCT" -gt 300 ]; then echo "[ts-cloud] WARNING: services on this box declare ${TS_CLOUD_COMMIT}M of MemoryHigh against ${TS_CLOUD_RAM}M of RAM (${TS_CLOUD_PCT}% committed). Soft ceilings, so this is not fatal - but no ceiling can protect the box once enough of them are drawn on at once."; else echo "[ts-cloud] memory commitment: ${TS_CLOUD_COMMIT}M declared against ${TS_CLOUD_RAM}M RAM (${TS_CLOUD_PCT}%)"; fi; fi']}function fc(e){return[`TS_CLOUD_SLICE=$(systemctl show ${e} -p Slice --value 2>/dev/null || true)`,'if [ -n "$TS_CLOUD_SLICE" ] && [ "$TS_CLOUD_SLICE" != "system.slice" ]; then systemctl set-property --runtime "$TS_CLOUD_SLICE" MemoryHigh=infinity MemoryMax=infinity 2>/dev/null || true; systemctl set-property "$TS_CLOUD_SLICE" MemoryHigh=infinity MemoryMax=infinity 2>/dev/null || true; fi']}var Qe={path:"/",intervalSeconds:60,failuresBeforeRestart:3,timeoutSeconds:10,startupGraceSeconds:600,maxBackoffSeconds:3600,backoffBaseSeconds:300};function zt(e,t,r){return typeof e==="number"&&Number.isFinite(e)?Math.max(r,Math.floor(e)):t}function Ws(e){let{unitBase:t,unitPattern:r,port:n}=e,s=e.path&&e.path.startsWith("/")?e.path:Qe.path,i=zt(e.intervalSeconds,Qe.intervalSeconds,10),a=zt(e.failuresBeforeRestart,Qe.failuresBeforeRestart,1),c=zt(e.timeoutSeconds,Qe.timeoutSeconds,1),u=zt(e.startupGraceSeconds,Qe.startupGraceSeconds,0),f=zt(e.maxBackoffSeconds,Qe.maxBackoffSeconds,0),h=Math.min(Qe.backoffBaseSeconds,f),S=`/usr/local/sbin/${t}-liveness`,v=`/run/${t}-liveness`,_=`${t}-liveness`,y=`127.0.0.1:${n}${s}`,D=r.includes("@*")?`TS_CLOUD_UNIT=$(systemctl list-units --plain --no-legend --type=service '${r}' 2>/dev/null | awk '{print $1}' | head -1)`:`TS_CLOUD_UNIT=${r}`;return[`cat > ${S} <<'TS_CLOUD_LIVENESS_EOF'`,"#!/bin/sh",`# Liveness check for ${t}, written by ts-cloud on every deploy.`,`# Settings: interval=${i}s timeout=${c}s failures=${a} startup-grace=${u}s max-backoff=${f}s`,"set -eu",`TS_CLOUD_STATE=${v}`,'exec 9>"$TS_CLOUD_STATE.lock"',"flock -n 9 || exit 0",D,'[ -n "$TS_CLOUD_UNIT" ] || exit 0','systemctl is-active --quiet "$TS_CLOUD_UNIT" || exit 0',"TS_CLOUD_RC=0",`curl -s -o /dev/null --max-time ${c} "http://${y}" || TS_CLOUD_RC=$?`,'if [ "$TS_CLOUD_RC" -eq 0 ]; then','  rm -f "$TS_CLOUD_STATE.fail"','  if [ -f "$TS_CLOUD_STATE.restarts" ]; then',`    TS_CLOUD_LAST=$(awk '{print $2}' "$TS_CLOUD_STATE.restarts" 2>/dev/null || true)`,`    case "$TS_CLOUD_LAST" in ''|*[!0-9]*) TS_CLOUD_LAST=0 ;; esac`,`    [ $(($(date +%s) - TS_CLOUD_LAST)) -lt ${f} ] || rm -f "$TS_CLOUD_STATE.restarts"`,"  fi","  exit 0","fi",'case "$TS_CLOUD_RC" in',"  7) TS_CLOUD_WHY='connection refused' ;;",`  28) TS_CLOUD_WHY='no response within ${c}s' ;;`,'  *) TS_CLOUD_WHY="curl exit $TS_CLOUD_RC" ;;',"esac",'TS_CLOUD_SINCE=$(systemctl show "$TS_CLOUD_UNIT" -p ActiveEnterTimestampMonotonic --value 2>/dev/null || true)',"TS_CLOUD_UPTIME=$(cut -d' ' -f1 /proc/uptime 2>/dev/null || true)",`TS_CLOUD_AGE=$(awk -v up="$TS_CLOUD_UPTIME" -v since="$TS_CLOUD_SINCE" 'BEGIN { if (since + 0 > 0 && up + 0 > 0) print int(up - since / 1000000); else print -1 }')`,`case "$TS_CLOUD_AGE" in ''|*[!0-9-]*) TS_CLOUD_AGE=-1 ;; esac`,'if [ "$TS_CLOUD_AGE" -lt 0 ]; then','  TS_CLOUD_PID=$(systemctl show "$TS_CLOUD_UNIT" -p MainPID --value 2>/dev/null || true)',`  case "$TS_CLOUD_PID" in ''|0|*[!0-9]*) ;; *) TS_CLOUD_AGE=$(ps -o etimes= -p "$TS_CLOUD_PID" 2>/dev/null | tr -d ' ' || true) ;; esac`,`  case "$TS_CLOUD_AGE" in ''|*[!0-9]*) TS_CLOUD_AGE=-1 ;; esac`,"fi",`if [ "$TS_CLOUD_AGE" -ge 0 ] && [ "$TS_CLOUD_AGE" -lt ${u} ]; then`,'  rm -f "$TS_CLOUD_STATE.fail"',`  logger -t ${_} "$TS_CLOUD_UNIT is \${TS_CLOUD_AGE}s old, inside its ${u}s startup grace; not counting this failed check on ${y} ($TS_CLOUD_WHY)"`,"  exit 0","fi",'TS_CLOUD_FAILS=$(cat "$TS_CLOUD_STATE.fail" 2>/dev/null || echo 0)',`case "$TS_CLOUD_FAILS" in ''|*[!0-9]*) TS_CLOUD_FAILS=0 ;; esac`,"TS_CLOUD_FAILS=$((TS_CLOUD_FAILS + 1))",'echo "$TS_CLOUD_FAILS" > "$TS_CLOUD_STATE.fail"',`if [ "$TS_CLOUD_FAILS" -lt ${a} ]; then`,`  logger -t ${_} "check $TS_CLOUD_FAILS of ${a} failed on ${y} ($TS_CLOUD_WHY)"`,"  exit 0","fi","TS_CLOUD_NOW=$(date +%s)","TS_CLOUD_STREAK=0","TS_CLOUD_LAST=0",'[ ! -f "$TS_CLOUD_STATE.restarts" ] || read -r TS_CLOUD_STREAK TS_CLOUD_LAST < "$TS_CLOUD_STATE.restarts" || true',`case "$TS_CLOUD_STREAK" in ''|*[!0-9]*) TS_CLOUD_STREAK=0 ;; esac`,`case "$TS_CLOUD_LAST" in ''|*[!0-9]*) TS_CLOUD_LAST=0 ;; esac`,'if [ "$TS_CLOUD_STREAK" -gt 0 ]; then',`  TS_CLOUD_WAIT=${h}`,"  TS_CLOUD_I=1",`  while [ "$TS_CLOUD_I" -lt "$TS_CLOUD_STREAK" ] && [ "$TS_CLOUD_WAIT" -lt ${f} ]; do TS_CLOUD_WAIT=$((TS_CLOUD_WAIT * 2)); TS_CLOUD_I=$((TS_CLOUD_I + 1)); done`,`  [ "$TS_CLOUD_WAIT" -le ${f} ] || TS_CLOUD_WAIT=${f}`,"  TS_CLOUD_ELAPSED=$((TS_CLOUD_NOW - TS_CLOUD_LAST))",'  if [ "$TS_CLOUD_ELAPSED" -lt "$TS_CLOUD_WAIT" ]; then',`    logger -t ${_} "holding off: $TS_CLOUD_STREAK liveness restart(s) in a row have not brought $TS_CLOUD_UNIT back; next restart allowed in $((TS_CLOUD_WAIT - TS_CLOUD_ELAPSED))s ($TS_CLOUD_WHY on ${y})"`,"    exit 0","  fi","fi","TS_CLOUD_STREAK=$((TS_CLOUD_STREAK + 1))",`logger -t ${_} "no HTTP response on ${y} after $TS_CLOUD_FAILS checks ($TS_CLOUD_WHY); restarting $TS_CLOUD_UNIT (liveness restart $TS_CLOUD_STREAK in a row)"`,'echo "$TS_CLOUD_STREAK $TS_CLOUD_NOW" > "$TS_CLOUD_STATE.restarts"','rm -f "$TS_CLOUD_STATE.fail"','systemctl restart "$TS_CLOUD_UNIT"',"TS_CLOUD_LIVENESS_EOF",`chmod +x ${S}`,`rm -f ${v}.fail ${v}.restarts`,`cat > /etc/systemd/system/${t}-liveness.service <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=Liveness check for ${t} (managed by ts-cloud)`,"","[Service]","Type=oneshot",`ExecStart=${S}`,"TS_CLOUD_UNIT_EOF",`cat > /etc/systemd/system/${t}-liveness.timer <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=Run the ${t} liveness check every ${i}s`,"","[Timer]",`OnUnitActiveSec=${i}s`,`OnBootSec=${i}s`,"Persistent=true","","[Install]","WantedBy=timers.target","TS_CLOUD_UNIT_EOF","systemctl daemon-reload",`systemctl enable --now ${t}-liveness.timer >/dev/null 2>&1 || true`]}var qs=20,Rn=3,gc=5,hc=60;function Sc(e){let{paths:t,unitBase:r,releaseId:n,port:s}=e,i=`${r}@${n}.service`,a=`${r}.service`,c=Math.max(1,e.healthGateSeconds??5),u=e.healthCheckPath?e.healthCheckPath.startsWith("/")?e.healthCheckPath:`/${e.healthCheckPath}`:null,f=u?`curl -sf -o /dev/null --max-time ${gc} "http://127.0.0.1:${s}${u}"`:null,h=(S)=>`{ echo "[ts-cloud] release ${n} ${S}" >&2; ts_cloud_restore_previous; exit 1; }`;return[`TS_CLOUD_OLD_UNITS=$(systemctl list-units --plain --no-legend --type=service "${r}@*.service" 2>/dev/null | awk '{print $1}' | grep -v "^${i}$" || true)`,`TS_CLOUD_PREV_CURRENT="$(readlink ${t.current} 2>/dev/null || true)"`,"TS_CLOUD_LEGACY_STOPPED=0","ts_cloud_restore_previous() {",`  journalctl -u ${i} -n 50 --no-pager >&2 || true`,`  systemctl stop ${i} 2>/dev/null || true`,`  systemctl disable ${i} 2>/dev/null || true`,`  if [ -n "$TS_CLOUD_PREV_CURRENT" ] && [ -d "$TS_CLOUD_PREV_CURRENT" ]; then ln -sfn "$TS_CLOUD_PREV_CURRENT" ${t.current}.tmp && mv -Tf ${t.current}.tmp ${t.current}; fi`,'  for TS_CLOUD_RU in ${TS_CLOUD_OLD_UNITS}; do systemctl enable "$TS_CLOUD_RU" 2>/dev/null || true; systemctl start "$TS_CLOUD_RU" 2>/dev/null || true; done',`  if [ "$TS_CLOUD_LEGACY_STOPPED" -eq 1 ]; then systemctl start ${a} 2>/dev/null || true; fi`,'  if [ -n "$TS_CLOUD_OLD_UNITS" ] || [ "$TS_CLOUD_LEGACY_STOPPED" -eq 1 ]; then echo "[ts-cloud] previous release restored and serving" >&2; else echo "[ts-cloud] there was no previous release to restore" >&2; fi',"}",`if [ -f /etc/systemd/system/${a} ] && systemctl is-active --quiet ${a}; then echo "[ts-cloud] retiring pre-zero-downtime unit ${a} (one-time restart cutover)"; systemctl stop ${a}; TS_CLOUD_LEGACY_STOPPED=1; fi`,'TS_CLOUD_STARTED_AT="@$(date +%s)"',`systemctl restart ${i}`,`TS_CLOUD_GATE_OK=1; for TS_CLOUD_I in $(seq 1 ${c}); do sleep 1; systemctl is-active --quiet ${i} || { TS_CLOUD_GATE_OK=0; break; }; done`,'if [ "$TS_CLOUD_GATE_OK" -ne 1 ]; then',`  if journalctl -u ${i} --since "$TS_CLOUD_STARTED_AT" -o cat --no-pager 2>/dev/null | grep -iE 'EADDRINUSE|address already in use|port [0-9]+ (is )?in use|Failed to start server' >/dev/null; then`,`    echo "[ts-cloud] release ${n} could not share :${s} with the previous release (no SO_REUSEPORT?) — retiring it and retrying" >&2`,'    for TS_CLOUD_RU in ${TS_CLOUD_OLD_UNITS}; do systemctl stop "$TS_CLOUD_RU" 2>/dev/null || true; done',`    systemctl restart ${i}`,`    for TS_CLOUD_I in $(seq 1 ${c}); do sleep 1; systemctl is-active --quiet ${i} || ${h("failed its health gate on the free port")}; done`,"  else",`    ${h("crashed on start — the previous release was never stopped")}`,"  fi","fi",`if ss -ltnpH "sport = :${s}" >/dev/null 2>&1; then`,"  TS_CLOUD_BOUND=0",`  for TS_CLOUD_I in $(seq 1 ${hc}); do`,`    TS_CLOUD_NEW_PID="$(systemctl show -p MainPID --value ${i} 2>/dev/null || true)"`,`    if [ -n "$TS_CLOUD_NEW_PID" ] && [ "$TS_CLOUD_NEW_PID" != "0" ] && ss -ltnpH "sport = :${s}" 2>/dev/null | grep "pid=$TS_CLOUD_NEW_PID," >/dev/null; then TS_CLOUD_BOUND=1; break; fi`,`    systemctl is-active --quiet ${i} || break`,`    sleep ${Rn}`,"  done",`  [ "$TS_CLOUD_BOUND" -eq 1 ] || ${h(`never took :${s}`)}`,"else",'  echo "[ts-cloud] cannot read listener PIDs on this host — the response probes run without the bind check" >&2',"fi",...f?[`TS_CLOUD_HEALTHY=0; for TS_CLOUD_I in $(seq 1 ${qs}); do if ${f}; then TS_CLOUD_HEALTHY=1; break; fi; sleep ${Rn}; done`,`[ "$TS_CLOUD_HEALTHY" -eq 1 ] || ${h(`never answered ${u}`)}`]:[],...pt(t),`systemctl enable ${i} 2>/dev/null || true`,'for TS_CLOUD_U in ${TS_CLOUD_OLD_UNITS}; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done',`TS_CLOUD_LISTENING=0; for TS_CLOUD_I in $(seq 1 ${c}); do if ss -ltnH "sport = :${s}" 2>/dev/null | grep . >/dev/null; then TS_CLOUD_LISTENING=1; break; fi; sleep 1; done`,`if [ "$TS_CLOUD_LISTENING" -ne 1 ]; then echo "[ts-cloud] nothing is listening on ${s} after retiring the previous release — restarting ${i} on the now-free port" >&2; systemctl restart ${i}; for TS_CLOUD_I in $(seq 1 ${c}); do if ss -ltnH "sport = :${s}" 2>/dev/null | grep . >/dev/null; then TS_CLOUD_LISTENING=1; break; fi; sleep 1; done; fi`,`[ "$TS_CLOUD_LISTENING" -eq 1 ] || ${h(`is active but never bound :${s}`)}`,...f?[`TS_CLOUD_HEALTHY=0; for TS_CLOUD_I in $(seq 1 ${qs}); do if ${f}; then TS_CLOUD_HEALTHY=1; break; fi; sleep ${Rn}; done`,`[ "$TS_CLOUD_HEALTHY" -eq 1 ] || ${h(`stopped answering ${u} once it served alone`)}`]:[],...Tn(t),`systemctl list-unit-files --plain --no-legend "${r}@*.service" 2>/dev/null | awk '{print $1}' | { grep -v -e "^${i}$" -e "^${r}@\\.service$" || true; } | while read -r TS_CLOUD_U; do systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done`,`if [ -f /etc/systemd/system/${a} ]; then systemctl disable ${a} 2>/dev/null || true; rm -f /etc/systemd/system/${a}; systemctl daemon-reload; fi`]}function Ys(e,t){if(!t.length)return[];let r=et(e.release);return[`if [ -e ${r} ] || [ -L ${r} ]; then`,...t,"fi"]}function si(e){let{siteName:t,slug:r,artifactFetch:n,releaseId:s,execStart:i,envEntries:a,port:c,keepReleases:u=Ht,preStartCommands:f=[],postActivateCommands:h=[],beforeResetCommands:S=[],healthCheckPath:v,healthGateSeconds:_=5,liveness:y,memoryHigh:b="auto",memoryMax:D,cpuWeight:V,ioWeight:H,tasksMax:x,stopTimeout:k}=e,I=[...V!=null?[`CPUWeight=${V}`]:[],...H!=null?[`IOWeight=${H}`]:[],...x!=null?[`TasksMax=${x}`]:[],...k?[`TimeoutStopSec=${k}`]:[]],Y=e.zeroDowntime??c!=null,W=e.appDir??`/var/www/${t}`,K=Zt(W,s),ee=`${r}-${t}`,re=`${ee}.service`,te=ai(r,t,s),ie=e.sharedPaths??[],oe=Hs([".env",...ie,...yr(a,ie)]),ne=fr(a),he=f.length>0?[`cd ${K.release}`,...f]:[],ye=["set -euo pipefail",...vn(K),...n,...Mt(K,oe),...Ys(K,S),$n(K),..._n(K),`tar xzf ${te} -C "$TS_CLOUD_STAGED"`,`rm -f ${te}`,`cat > ${K.shared}/.env <<'TS_CLOUD_ENV_EOF'`,ne,"TS_CLOUD_ENV_EOF",`chmod 600 ${K.shared}/.env`,...yn(K),`find ${K.release} -maxdepth 1 \\( -type f -o -type l \\) -name '.env*' ! -name '.env.example' ! -name '*.example' -delete`,`sed -i -E '/^[[:space:]]*(PORT|PORT_BACKEND|PORT_ADMIN|PORT_FRONTEND)[[:space:]]*=/d' ${K.shared}/.env 2>/dev/null || true`,...Sr(K,oe),...he,...e.isolation?Ls(e.slug||t,K.base,oe.flatMap((T)=>typeof T==="string"||!T.target?[]:[T.target])):[]];if(Y&&c!=null){let T=`${ee}@${s}.service`,L=v?v.startsWith("/")?v:`/${v}`:null;return[...ye,`cat > /etc/systemd/system/${ee}@.service <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=${t} release %i (managed by ts-cloud)`,"After=network.target","","[Service]","Type=simple",...e.isolation?Ut(ut(e.slug||t),K.base,e.slug||t):[],`WorkingDirectory=${K.releases}/%i`,`ExecStart=${i}`,"Restart=always","RestartSec=5","MemoryAccounting=true",...b&&b!=="auto"?[`MemoryHigh=${b}`]:[],...D?[`MemoryMax=${D}`]:[],...I,`EnvironmentFile=${K.releases}/%i/.env`,`Environment=PORT=${c}`,`Environment=STX_IMAGE_CACHE_DIR=${hr(K)}`,`Environment=STX_BUNDLE_CACHE_DIR=${Nt(K)}`,`Environment=STX_BUNDLE_CACHE_DIR=${Nt(K)}`,"","[Install]","WantedBy=multi-user.target","TS_CLOUD_UNIT_EOF","systemctl daemon-reload",...b==="auto"?Vs(`${ee}@.service`):[...br(`${ee}@.service`),...On()],...fc(T),...Sc({paths:K,unitBase:ee,releaseId:s,port:c,healthCheckPath:L,healthGateSeconds:_}),...h,...dt(K,u),...y===!1?[]:Ws({...y,unitBase:ee,unitPattern:`${ee}@*.service`,port:c,path:y?.path??v})]}return[...ye,`cat > /etc/systemd/system/${re} <<'TS_CLOUD_UNIT_EOF'`,"[Unit]",`Description=${t} (managed by ts-cloud)`,"After=network.target","","[Service]","Type=simple",...e.isolation?Ut(ut(e.slug||t),K.base,e.slug||t):[],`WorkingDirectory=${K.current}`,`ExecStart=${i}`,"Restart=always","RestartSec=5","MemoryAccounting=true",...b&&b!=="auto"?[`MemoryHigh=${b}`]:[],...D?[`MemoryMax=${D}`]:[],...I,`EnvironmentFile=${K.current}/.env`,...c?[`Environment=PORT=${c}`]:[],`Environment=STX_IMAGE_CACHE_DIR=${hr(K)}`,`Environment=STX_BUNDLE_CACHE_DIR=${Nt(K)}`,"","[Install]","WantedBy=multi-user.target","TS_CLOUD_UNIT_EOF","systemctl daemon-reload",...br(re,{auto:b!=="auto",high:b!=="auto",max:Boolean(D)}),...b==="auto"?Vs(re):On(),`systemctl enable ${re}`,`TS_CLOUD_PREV_CURRENT="$(readlink ${K.current} 2>/dev/null || true)"`,...pt(K),`systemctl restart ${re}`,`for TS_CLOUD_I in $(seq 1 ${Math.max(1,_)}); do sleep 1; systemctl is-active --quiet ${re} || { echo "[ts-cloud] release ${s} of ${re} did not stay up — restoring the previous release" >&2; journalctl -u ${re} -n 50 --no-pager >&2 || true; if [ -n "$TS_CLOUD_PREV_CURRENT" ] && [ -d "$TS_CLOUD_PREV_CURRENT" ] && [ "$(readlink -f "$TS_CLOUD_PREV_CURRENT")" != "$(readlink -f ${K.release})" ]; then ln -sfn "$TS_CLOUD_PREV_CURRENT" ${K.current}.tmp && mv -Tf ${K.current}.tmp ${K.current}; systemctl restart ${re} || true; fi; exit 1; }; done`,...Tn(K),...h,...dt(K,u),...y===!1||!c?[]:Ws({...y,unitBase:ee,unitPattern:re,port:c,path:y?.path??v})]}function oi(e){let{siteName:t,artifactFetch:r,releaseId:n,keepReleases:s=Ht,preStartCommands:i=[],postActivateCommands:a=[],beforeResetCommands:c=[]}=e,u=e.appDir??`/var/www/${t}`,f=Zt(u,n),h=ai(e.slug,t,n),S=i.length>0?[`cd ${f.release}`,...i]:[];return["set -euo pipefail",...vn(f),...r,...Mt(f,[]),...Ys(f,c),$n(f),..._n(f),`tar xzf ${h} -C "$TS_CLOUD_STAGED"`,...yn(f),`rm -f ${h}`,...S,...pt(f),...a,...dt(f,s)]}function ai(e,t,r){return`/tmp/${[e,t,r].filter(Boolean).join("-")}-release.tar.gz`}function $c(e,t,r,n){return[`aws s3 cp "s3://${e}/${t}" ${n} --region ${r}`]}function Mc(e,t){return[`mv "${e}" ${t}`]}function et(e){return`'${e.replace(/'/g,`'"'"'`)}'`}function Tr(e,t,r){return["set -euo pipefail",`chmod 600 ${et(e)}`,`mv -f -- ${et(e)} ${et(t)}`,`cp -- ${et(t)} ${et(r)}`].join(`
 `)}function wr(e){return`rm -f -- ${et(e)} 2>/dev/null || true`}function Dn(e={}){let t=Math.max(1,e.appServers??e.instances??1),r=!!e.servicesServer||t>1,n=t>1||!!e.server?.loadBalancer;return{appServers:t,loadBalancer:n,dedicatedServices:r,servicesOnApp:!r}}function Xs(e,t){let r={REDIS_HOST:e,MEILISEARCH_HOST:`http://${e}:7700`};if(t?.name){if(r.DB_CONNECTION=t.engine==="postgres"?"pgsql":"mysql",r.DB_HOST=e,r.DB_PORT=String(t.port??(t.engine==="postgres"?5432:3306)),r.DB_DATABASE=t.name,t.username)r.DB_USERNAME=t.username;if(t.password)r.DB_PASSWORD=t.password}return r}function xn(e){let t=e.infrastructure?.compute??{},r=g(e);return[...ir(t.managedServices??{mysql:!0,redis:!0},{bindPrivate:!0}),...at(r,t.managedServices??{mysql:!0}),...Me(!0),...Le(!0),...ct(t.sshKeys),...Xe(e.notifications),...t.backups?.enabled?[...ar({database:r,backups:t.backups})]:[]]}var Bt=["-S","ssh"];function ci(e={},t="ssh"){let r=[];if(e.identityFile)r.push("-i",e.identityFile);if(e.port)r.push(t==="scp"?"-P":"-p",String(e.port));return r.push("-o","StrictHostKeyChecking=no","-o","UserKnownHostsFile=/dev/null","-o","LogLevel=ERROR","-o",`ConnectTimeout=${e.connectTimeoutSec??10}`),r}async function Ur(e,t,r={}){let n=Bun.spawn(["ssh",...ci(r),`${r.user??"root"}@${e}`,t],{stdout:"pipe",stderr:"pipe"}),[s,i]=await Promise.all([new Response(n.stdout).text(),new Response(n.stderr).text()]);return{code:await n.exited,stdout:s,stderr:i}}async function Ie(e,t,r={}){let n=await Ur(e,t,r);if(n.code!==0)throw Error(`ssh \`${t}\` on ${e} failed (${n.code}): ${n.stderr.trim()||n.stdout.trim()}`);return n.stdout}async function Fc(e,t,r,n={}){let s=Bun.spawn(["scp",...Bt,...ci(n,"scp"),...t,`${n.user??"root"}@${e}:${r}`],{stdout:"pipe",stderr:"pipe"}),i=await s.exited;if(i!==0){let a=await new Response(s.stderr).text();throw Error(`scp to ${e}:${r} failed (${i}): ${a.trim()}`)}}async function ht(e,t={}){let r=t.timeoutMs??180000,n=t.pollIntervalMs??5000,s=Date.now();while(Date.now()-s<r){let i=await Ur(e,"echo ready",t);if(i.code===0&&i.stdout.includes("ready"))return;await new Promise((a)=>setTimeout(a,n))}throw Error(`SSH not ready on ${e} after ${r}ms`)}async function Uc(e,t={}){let r=t.timeoutMs??300000,n=t.pollIntervalMs??5000,s=Date.now();while(Date.now()-s<r){let i=await Ur(e,"cloud-init status 2>/dev/null || echo unknown",t);if(i.stdout.includes("status: done"))return;if(i.stdout.includes("status: error"))throw Error(`cloud-init reported an error on ${e}; check /var/log/cloud-init-output.log`);await new Promise((a)=>setTimeout(a,n))}throw Error(`cloud-init did not finish on ${e} after ${r}ms`)}function di(e={}){return["set -e","ts_cloud_script=$(mktemp /tmp/ts-cloud-deploy.XXXXXXXX)",`trap 'rm -f "$ts_cloud_script"' EXIT`,'cat > "$ts_cloud_script"',e.sudo?'sudo -n -H bash "$ts_cloud_script" < /dev/null':'bash "$ts_cloud_script" < /dev/null'].join(`
 `)}var Qc=di();import{homedir as vc}from"node:os";import{join as yc}from"node:path";var Cr={location:"fsn1",image:"ubuntu-24.04",sshUser:"root",sshPrivateKeyPath:"~/.ssh/id_ed25519"};function Pr(e){return e.startsWith("~/")?yc(vc(),e.slice(2)):e}function mt(...e){for(let t of e){let r=process.env[t]?.trim();if(r)return r}return}function gt(...e){for(let t of e){let r=t?.trim();if(r)return r}return}function Kt(e,t){return gt(e,t?.hetzner?.apiToken,mt("HCLOUD_TOKEN","HETZNER_API_TOKEN"))}function Hc(e,t){return gt(t,e?.hetzner?.location,mt("HCLOUD_LOCATION","HETZNER_LOCATION"))??Cr.location}function jt(e,t){let r=e?.infrastructure?.compute;return gt(t,r?.image,e?.hetzner?.image,mt("HCLOUD_IMAGE","HETZNER_IMAGE"))??Cr.image}function bc(e,t){return gt(t,e?.hetzner?.sshUser,mt("HCLOUD_SSH_USER","HETZNER_SSH_USER"))??Cr.sshUser}function Js(e,t){return Pr(gt(t,e?.hetzner?.sshPrivateKeyPath,mt("HCLOUD_SSH_KEY","HETZNER_SSH_KEY"))??Cr.sshPrivateKeyPath)}function Tc(e,t,r){let n=gt(t,e?.hetzner?.sshPublicKeyPath,mt("HCLOUD_SSH_PUBLIC_KEY","HETZNER_SSH_PUBLIC_KEY"));if(n)return Pr(n);return`${r??Js(e)}.pub`}function Qs(e,t={}){let r=Js(e,t.sshPrivateKeyPath);return{apiToken:Kt(t.apiToken,e),location:Hc(e,t.location),image:jt(e,t.image),sshUser:bc(e,t.sshUser),sshPrivateKeyPath:r,sshPublicKeyPath:Tc(e,t.sshPublicKeyPath,r)}}var wc="https://api.hetzner.cloud/v1";class Er extends Error{status;code;details;constructor(e,t,r,n){super(e);this.status=t;this.code=r;this.details=n;this.name="HetznerApiError"}}class Rr extends Error{action;constructor(e,t){super(e);this.action=t;this.name="HetznerActionError"}}function uo(e){return e.map((t)=>({type:"server",server:{id:t.server}}))}class Qr{name="hetzner";apiToken;baseUrl;fetchImpl;constructor(e){this.apiToken=e.apiToken,this.baseUrl=e.baseUrl??wc,this.fetchImpl=e.fetchImpl??fetch}async request(e,t,r){let n=await this.fetchImpl(`${this.baseUrl}${t}`,{method:e,headers:{Authorization:`Bearer ${this.apiToken}`,"Content-Type":"application/json"},body:r===void 0?void 0:JSON.stringify(r)}),s=await n.text(),i;try{i=s?JSON.parse(s):{}}catch{if(!n.ok){let a=s.trim().slice(0,200)||n.statusText||"Hetzner API error";throw Error(`Hetzner API ${e} ${t} (${n.status}): ${a}`)}throw Error(`Hetzner API ${e} ${t}: unexpected non-JSON response`)}if(!n.ok){let a=i.error?.message||n.statusText||"Hetzner API error",c=i.error?.code?` [${i.error.code}]`:"";throw new Er(`Hetzner API ${e} ${t} (${n.status})${c}: ${a}`,n.status,i.error?.code,i.error?.details)}return i}async requestAll(e,t){let r=[],n=1;for(;;){let s=e.includes("?")?"&":"?",i=await this.request("GET",`${e}${s}per_page=50&page=${n}`);r.push(...i[t]??[]);let a=i.meta?.pagination?.next_page;if(!a)return r;n=a}}async listServers(){return this.requestAll("/servers","servers")}async getServer(e){return(await this.request("GET",`/servers/${e}`)).server}async listVolumes(){return this.requestAll("/volumes","volumes")}async getVolume(e){return(await this.request("GET",`/volumes/${e}`)).volume}async createVolume(e){return this.request("POST","/volumes",{...e,automount:!1})}async attachVolume(e,t){return(await this.request("POST",`/volumes/${e}/actions/attach`,{server:t,automount:!1})).action}async resizeVolume(e,t){return(await this.request("POST",`/volumes/${e}/actions/resize`,{size:t})).action}async protectVolume(e,t){return(await this.request("POST",`/volumes/${e}/actions/change_protection`,{delete:t})).action}async getServerMetrics(e,t){let r=new URLSearchParams({type:t.types.join(","),start:t.start.toISOString(),end:t.end.toISOString(),step:String(Math.max(60,Math.floor(t.step??60)))});return(await this.request("GET",`/servers/${e}/metrics?${r}`)).metrics}async listServerTypes(e){let t=e?`?name=${encodeURIComponent(e)}`:"";return this.requestAll(`/server_types${t}`,"server_types")}async getServerType(e){return(await this.listServerTypes(e)).find((t)=>t.name===e)??null}async createServer(e){let t=await this.request("POST","/servers",{name:e.name,server_type:e.serverType,image:e.image,location:e.location,datacenter:e.datacenter,ssh_keys:e.sshKeys,user_data:e.userData,labels:e.labels,firewalls:e.firewalls,networks:e.networks,start_after_create:!0});return{server:t.server,action:t.action}}async listNetworks(){return this.requestAll("/networks","networks")}async createNetwork(e){let t=e.ipRange??"10.0.0.0/16";return(await this.request("POST","/networks",{name:e.name,ip_range:t,subnets:[{type:"cloud",ip_range:t,network_zone:"eu-central"}],labels:e.labels})).network}async deleteNetwork(e){await this.request("DELETE",`/networks/${e}`)}async listLoadBalancers(){return this.requestAll("/load_balancers","load_balancers")}async createLoadBalancer(e){return(await this.request("POST","/load_balancers",{name:e.name,load_balancer_type:e.type??"lb11",location:e.location,network_zone:e.network?void 0:e.networkZone??"eu-central",network:e.network,labels:e.labels,targets:[{type:"label_selector",label_selector:{selector:e.labelSelector},use_private_ip:!!e.network}],services:e.services.map((r)=>({protocol:r.protocol??"tcp",listen_port:r.listenPort,destination_port:r.destinationPort,health_check:{protocol:"http",port:80,interval:15,timeout:10,retries:3,http:{path:"/",status_codes:["2??","3??"]}}}))})).load_balancer}async deleteLoadBalancer(e){await this.request("DELETE",`/load_balancers/${e}`)}async deleteServer(e){return(await this.request("DELETE",`/servers/${e}`)).action}async listFirewalls(){return this.requestAll("/firewalls","firewalls")}async createFirewall(e){let t=await this.request("POST","/firewalls",{name:e.name,rules:e.rules,labels:e.labels,apply_to:e.applyTo?uo(e.applyTo):void 0});return{firewall:t.firewall,actions:t.actions}}async setFirewallRules(e,t){return(await this.request("POST",`/firewalls/${e}/actions/set_rules`,{rules:t})).actions??[]}async deleteFirewall(e){await this.request("DELETE",`/firewalls/${e}`)}async applyFirewallToResources(e,t){return(await this.request("POST",`/firewalls/${e}/actions/apply_to_resources`,{apply_to:uo(t)})).actions}async listSshKeys(){return this.requestAll("/ssh_keys","ssh_keys")}async createSshKey(e){return(await this.request("POST","/ssh_keys",{name:e.name,public_key:e.publicKey,labels:e.labels})).ssh_key}async deleteSshKey(e){await this.request("DELETE",`/ssh_keys/${e}`)}async getAction(e){return(await this.request("GET",`/actions/${e}`)).action}async shutdownServer(e){return(await this.request("POST",`/servers/${e}/actions/shutdown`,{})).action}async powerOnServer(e){return(await this.request("POST",`/servers/${e}/actions/poweron`,{})).action}async changeServerType(e,t,r){return(await this.request("POST",`/servers/${e}/actions/change_type`,{server_type:t,upgrade_disk:r})).action}async powerOffServer(e){return(await this.request("POST",`/servers/${e}/actions/poweroff`,{})).action}async stopServer(e,t){if((await this.getServer(e)).status==="off")return;await this.shutdownServer(e);let n=t?.gracefulWaitMs??120000,s=t?.pollIntervalMs??3000,i=Date.now();while(Date.now()-i<n){if((await this.getServer(e)).status==="off")return;await new Promise((c)=>setTimeout(c,s))}let a=await this.powerOffServer(e);await this.waitForAction(a.id),await this.waitForServerStatus(e,"off")}async renameServer(e,t){return(await this.request("PUT",`/servers/${e}`,{name:t})).server}async listImages(e){let t=e?.type?`?type=${encodeURIComponent(e.type)}`:"";return this.requestAll(`/images${t}`,"images")}async getImage(e){return(await this.request("GET",`/images/${e}`)).image}async createImage(e,t){return this.request("POST",`/servers/${e}/actions/create_image`,{description:t.description,type:t.type??"snapshot",labels:t.labels})}async deleteImage(e){await this.request("DELETE",`/images/${e}`)}async rebuildServer(e,t){return(await this.request("POST",`/servers/${e}/actions/rebuild`,{image:t})).action}async listPrimaryIps(){return this.requestAll("/primary_ips","primary_ips")}async unassignPrimaryIp(e){return(await this.request("POST",`/primary_ips/${e}/actions/unassign`,{})).action}async assignPrimaryIp(e,t){return(await this.request("POST",`/primary_ips/${e}/actions/assign`,{assignee_id:t,assignee_type:"server"})).action}async waitForAction(e,t){let r=t?.pollIntervalMs??2000,n=t?.maxWaitMs??300000,s=Date.now();while(Date.now()-s<n){let i=await this.getAction(e);if(i.status==="success")return i;if(i.status==="error")throw new Rr(i.error?.message||"Hetzner action failed",i);await new Promise((a)=>setTimeout(a,r))}throw Error(`Timed out waiting for Hetzner action ${e}`)}async waitForServerRunning(e,t){let r=t?.pollIntervalMs??3000,n=t?.maxWaitMs??600000,s=Date.now();while(Date.now()-s<n){let i=await this.getServer(e);if(i.status==="running")return i;await new Promise((a)=>setTimeout(a,r))}throw Error(`Timed out waiting for server ${e} to reach running state`)}async waitForServerStatus(e,t,r){let n=r?.pollIntervalMs??3000,s=r?.maxWaitMs??600000,i=Date.now();while(Date.now()-i<s){let a=await this.getServer(e);if(a.status===t)return a;await new Promise((c)=>setTimeout(c,n))}throw Error(`Timed out waiting for server ${e} to reach ${t} state`)}}function Gc(e,t){let r=Kt(e,t);if(!r)throw Error("Hetzner API token required. Set hetzner.apiToken in cloud.config.ts or HCLOUD_TOKEN / HETZNER_API_TOKEN.");return r}function Ve(e){let[t,r]=e.trim().split(/\s+/);return r?`${t} ${r}`:t}function mo(e){if(!e)return"";return e.endsWith(`
 `)?e:`${e}
@@ -442,9 +442,9 @@ console.log(JSON.stringify({
 `)}var id="dashboard";function ao(){return Q("dashboard-credentials.json")}function cu(){return tu(24).toString("base64url")}function sd(e,t,r){let n=process.env.TS_CLOUD_UI_PASSWORD?.trim();if(n)return{password:n,source:"env"};if(Fn(process.env.TS_CLOUD_UI_PUBLIC))return{password:void 0,source:"public"};let s=ao(),i=l(e,"dashboard-credentials.json");try{if(st(i)){let c=JSON.parse(Mo(i,"utf8"));if(c?.password)return{password:c.password,source:"generated"}}}catch{}let a=cu();try{No(zn(i),{recursive:!0}),Mn(i,`${JSON.stringify({username:t,password:a,generatedAt:new Date().toISOString()},null,2)}
 `),ru(i,384),r.info(`Management dashboard: generated a password for '${t}' and saved it to ${s} (read it there — it is not printed). Set TS_CLOUD_UI_PASSWORD to pin your own, or TS_CLOUD_UI_PUBLIC=1 to serve without auth.`)}catch(c){r.warn(`Management dashboard: could not persist the generated password (${c?.message??c}). Using it for this deploy only — pass: ${a}
 This password is now in your deploy log. Set TS_CLOUD_UI_PASSWORD to a value of your own and redeploy once ${s} is writable.`)}return{password:a,source:"generated"}}var Bo={info:()=>{},warn:()=>{}};function Fn(e){return e!=null&&e!==""&&e!=="0"&&e.toLowerCase()!=="false"}function lu(){return Q("dashboard-release")}function Ko(){let e=zn(zo(import.meta.url));for(let t of[ge(e,"..","..","package.json"),ge(e,"..","package.json")])try{let r=JSON.parse(Mo(t,"utf8"));if(r.name==="@stacksjs/ts-cloud"&&r.version)return`^${r.version}`}catch{}return"latest"}function uu(){return process.env.TS_CLOUD_UI_VERSION?.trim()||Ko()}function pu(e,t,r){if(!e?.project?.slug)return r.warn("Management dashboard: the cloud config has no project slug — skipping the live dashboard."),null;let n=l(t,"dashboard-release");try{No(n,{recursive:!0}),Mn(ge(n,"cloud.config.ts"),ko(e));let s=uu();if(s.startsWith("file:")){let a=s.slice(5),c=Fo(a)?a:au(t,a);if(!st(c)||!su(c).isFile())s=Ko(),r.warn(`Management dashboard: TS_CLOUD_UI_VERSION points to a missing package file (${c}); using the deploying ts-cloud version ${s} instead.`);else{let u=iu(c),f=ge(n,u);if(c!==f)nu(c,f);s=`file:./${u}`}}let i={name:"ts-cloud-dashboard",private:!0,type:"module",dependencies:{"@stacksjs/ts-cloud":s}};return Mn(ge(n,"package.json"),`${JSON.stringify(i,null,2)}
-`),lu()}catch(s){return r.warn(`Management dashboard: could not stage the live release (${s?.message??s}) — skipping.`),null}}function tr(e){if(st(ge(e,"packages","ui","pages"))||st(ge(e,"packages","ui","package.json")))return{uiRoot:"packages/ui/dist",build:"cd packages/ui && bun install && bun run build"};let t=zn(zo(import.meta.url)),r=[ge(t,"ui"),ge(t,"..","ui"),ge(t,"..","..","ui"),ge(t,"..","dist","ui")];for(let n of r)if(st(ge(n,"index.html"))||st(ge(n,"serverless.html")))return{uiRoot:n,build:!1};return null}function Ri(e,t={}){let r=t.logger??Bo,n=t.cwd??process.cwd();if(Fn(process.env.TS_CLOUD_UI_DISABLE))return r.info("Management dashboard: skipped (TS_CLOUD_UI_DISABLE set)."),e;if(e.cloud?.attachTo)return r.info(`Management dashboard: ${e.project.slug} is attached to ${e.cloud.attachTo}; the server owner's dashboard monitors every attached project.`),e;if(pr(e))return e;let s=e.environments&&Object.keys(e.environments)[0],i=process.env.TS_CLOUD_UI_DOMAIN?.trim()||void 0,a=Number(process.env.TS_CLOUD_UI_PORT)||void 0,c={...e.sites??{}};if(!Fn(process.env.TS_CLOUD_UI_STATIC)){let _=pu(e,n,r);if(!_)return e;let y=Zi(e,s??"production",{uiRoot:_,build:!1,domain:i,port:a,live:!0});if(y.length===0)return r.info("Management dashboard: no domain resolved (set TS_CLOUD_UI_DOMAIN or configure a site domain) — skipping."),e;for(let{name:b,site:D}of y)c[b]=D,r.info(`Management dashboard → https://${D.domain} (sign in with your ts-cloud account; the first deploy prints an admin password once)`);return e.sites=c,e}let u=tr(n);if(!u)return r.info("Management dashboard: UI not found (no local ui/ or packaged dist/ui) — skipping auto-deploy."),e;let f=process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin",h=sd(n,f,r),S=Zi(e,s??"production",{uiRoot:u.uiRoot,build:u.build,domain:i,username:f,password:h.password,realm:process.env.TS_CLOUD_UI_REALM?.trim()||void 0,live:!1,port:a});if(S.length===0)return r.info("Management dashboard: no domain resolved (set TS_CLOUD_UI_DOMAIN or configure a site domain) — skipping."),e;let v=h.source==="public"?"NO AUTH — TS_CLOUD_UI_PUBLIC is set (dashboard is publicly reachable)":h.source==="env"?"htpasswd-protected (TS_CLOUD_UI_PASSWORD)":`htpasswd-protected (auto-generated — see ${ao()})`;r.warn("Management dashboard: static mode — one shared password, and no per-site collaborators. Unset TS_CLOUD_UI_STATIC for the live dashboard.");for(let{name:_,site:y}of S)c[_]=y,r.info(`Management dashboard → https://${y.domain} (${v})`);return e.sites=c,e}function Bn(e){return Object.keys(e.sites??{}).filter(mr)}function co(e,t){if(!e?.root)return null;let r=t.cwd??process.cwd(),n=t.logger??Bo;try{if(typeof e.build==="string"&&e.build.trim())n.info(`Management dashboard: building UI (${e.build})`),Ho(e.build,{cwd:r,stdio:"inherit"});let s=Fo(e.root)?e.root:ge(r,e.root);if(!st(s))return n.warn(`Management dashboard: build output not found at ${s} — skipping dashboard artifact.`),null;let i=ge(ou(),`${t.slug}-${t.siteName??id}-${t.sha}.tar.gz`);return Ho(`tar czf "${i}" -C "${s}" .`,{stdio:"inherit"}),i}catch(s){return n.warn(`Management dashboard: failed to build artifact — ${s?.message??s}. Skipping dashboard deploy.`),null}}function du(e){let t=e.split("/");if(!/^[a-zA-Z0-9_./-]+$/.test(e)||e.startsWith("/")||t.some((r)=>!r||r==="."||r==="..")||t.at(-1)!=="bun")throw Error("Stacks backgroundBun must select a safe release-relative Bun executable")}function jo(e,t){if(du(t),!/^\/[a-zA-Z0-9_./-]+$/.test(e)||e.split("/").includes(".."))throw Error("Stacks backgroundBun requires a safe absolute release directory");return`${e}/${t}`}var mu=new Set(["laravel","php","statamic","wordpress"]);function Gr(e){if(e.framework)return e.framework;if(e.type&&mu.has(e.type))return"laravel";return"stacks"}var Go=`eval "$(cd ${p} && pantry env 2>/dev/null)"`,fu="/usr/local/bin/bun",Nr={PATH:"/usr/local/bin:/usr/bin:/bin",BUN_INSTALL:"/root/.bun",APP_ENV:"production",NODE_ENV:"production"};function Kn(e){if(e.backgroundBun===void 0)return fu;return jo(e.current,e.backgroundBun)}function gu(e){let t=e.queue??"default",r=[e.sleep,e.tries,e.timeout,e.processes,e.stopWaitSecs];if(typeof t!=="string"||!/^[a-zA-Z0-9_.:,{}/@+-]+$/.test(t||"default")||r.some((n)=>n!==void 0&&(typeof n!=="number"||!Number.isFinite(n))))throw Error("Stacks background queue options require safe queue names and finite numeric values")}var hu="node_modules/@stacksjs/ts-cloud/dist/bin/stacks-scheduler.js",Su="node_modules/@stacksjs/ts-cloud/dist/bin/stacks-queue-worker.js",Vo={id:"stacks",wrapExec:(e)=>e,execEnv:Nr,executionEnvironment:(e)=>{let t=Kn(e);return e.backgroundBun===void 0?Nr:{...Nr,PATH:`${t.slice(0,t.lastIndexOf("/"))}:${Nr.PATH}`,TS_CLOUD_BACKGROUND_BUN:e.backgroundBun}},schedulerMode:"daemon",schedulerCommand:(e)=>`${Kn(e)} ${hu}`,queueWorkerCommand:(e,t)=>{if(t.backgroundBun!==void 0)gu(e);let{current:r}=t,n=[`--queue=${e.queue||"default"}`,`--sleep=${e.sleep??3}`,`--tries=${e.tries??3}`,`--timeout=${e.timeout??60}`];return`${Kn(t)} ${r}/${Su} ${n.join(" ")}`}},vu={id:"laravel",wrapExec:(e)=>`/bin/sh -lc '${Go}; exec ${e}'`,schedulerMode:"cron",schedulerCommand:({current:e})=>`cd ${e} && ${Go} && php artisan schedule:run`,queueWorkerCommand:(e,{current:t})=>{let r=`${t}/artisan`;if(e.horizon)return`php ${r} horizon`;let n=[e.connection||"default",`--queue=${e.queue||"default"}`,`--sleep=${e.sleep??3}`,`--tries=${e.tries??3}`,`--timeout=${e.timeout??60}`,`--memory=${e.memory??128}`];if(e.maxJobs)n.push(`--max-jobs=${e.maxJobs}`);if(e.maxTime)n.push(`--max-time=${e.maxTime}`);return`php ${r} queue:work ${n.join(" ")}`}},_u={stacks:Vo,laravel:vu};function Wo(e){return _u[e]??Vo}function qo(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function $u(e){return`'${e.split("'").join("'\\''")}'`}function Yo(e){return e.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"unnamed"}function Xo(e,t){return`for unit in $(ls /etc/systemd/system/ 2>/dev/null | grep -E '^${qo(e)}-${qo(t)}-((queue|daemon)-.*|scheduler)\\.service$' || true); do`}function Vn(e){return[Xo(e.slug,e.siteName),'  systemctl stop "$unit"',"done"]}function yu(e,t,r){return`${e}-${t}-queue-${r}`}function bu(e,t,r,n){return`${e}-${t}-daemon-${r.name?Yo(r.name):Yo(r.command).slice(0,32)||String(n)}`}function jn(e){let t=["[Unit]",`Description=${e.description}`,"After=network.target","","[Service]","Type=simple",`WorkingDirectory=${e.workingDir}`,...Object.entries(e.environment??{}).map(([r,n])=>`Environment="${r}=${n}"`),`ExecStart=${e.execStart}`,`Restart=${e.restart||"always"}`,"RestartSec=5","MemoryAccounting=true",`MemoryHigh=${e.memoryHigh??"2G"}`,...e.memoryMax?[`MemoryMax=${e.memoryMax}`]:[]];if(e.isolatedUser)t.push(...Ut(e.isolatedUser));else if(e.user)t.push(`User=${e.user}`);if(typeof e.stopWaitSecs==="number")t.push(`TimeoutStopSec=${e.stopWaitSecs}`);return t.push("","[Install]","WantedBy=multi-user.target"),`${t.join(`
+`),lu()}catch(s){return r.warn(`Management dashboard: could not stage the live release (${s?.message??s}) — skipping.`),null}}function tr(e){if(st(ge(e,"packages","ui","pages"))||st(ge(e,"packages","ui","package.json")))return{uiRoot:"packages/ui/dist",build:"cd packages/ui && bun install && bun run build"};let t=zn(zo(import.meta.url)),r=[ge(t,"ui"),ge(t,"..","ui"),ge(t,"..","..","ui"),ge(t,"..","dist","ui")];for(let n of r)if(st(ge(n,"index.html"))||st(ge(n,"serverless.html")))return{uiRoot:n,build:!1};return null}function Ri(e,t={}){let r=t.logger??Bo,n=t.cwd??process.cwd();if(Fn(process.env.TS_CLOUD_UI_DISABLE))return r.info("Management dashboard: skipped (TS_CLOUD_UI_DISABLE set)."),e;if(e.cloud?.attachTo)return r.info(`Management dashboard: ${e.project.slug} is attached to ${e.cloud.attachTo}; the server owner's dashboard monitors every attached project.`),e;if(pr(e))return e;let s=e.environments&&Object.keys(e.environments)[0],i=process.env.TS_CLOUD_UI_DOMAIN?.trim()||void 0,a=Number(process.env.TS_CLOUD_UI_PORT)||void 0,c={...e.sites??{}};if(!Fn(process.env.TS_CLOUD_UI_STATIC)){let _=pu(e,n,r);if(!_)return e;let y=Zi(e,s??"production",{uiRoot:_,build:!1,domain:i,port:a,live:!0});if(y.length===0)return r.info("Management dashboard: no domain resolved (set TS_CLOUD_UI_DOMAIN or configure a site domain) — skipping."),e;for(let{name:b,site:D}of y)c[b]=D,r.info(`Management dashboard → https://${D.domain} (sign in with your ts-cloud account; the first deploy prints an admin password once)`);return e.sites=c,e}let u=tr(n);if(!u)return r.info("Management dashboard: UI not found (no local ui/ or packaged dist/ui) — skipping auto-deploy."),e;let f=process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin",h=sd(n,f,r),S=Zi(e,s??"production",{uiRoot:u.uiRoot,build:u.build,domain:i,username:f,password:h.password,realm:process.env.TS_CLOUD_UI_REALM?.trim()||void 0,live:!1,port:a});if(S.length===0)return r.info("Management dashboard: no domain resolved (set TS_CLOUD_UI_DOMAIN or configure a site domain) — skipping."),e;let v=h.source==="public"?"NO AUTH — TS_CLOUD_UI_PUBLIC is set (dashboard is publicly reachable)":h.source==="env"?"htpasswd-protected (TS_CLOUD_UI_PASSWORD)":`htpasswd-protected (auto-generated — see ${ao()})`;r.warn("Management dashboard: static mode — one shared password, and no per-site collaborators. Unset TS_CLOUD_UI_STATIC for the live dashboard.");for(let{name:_,site:y}of S)c[_]=y,r.info(`Management dashboard → https://${y.domain} (${v})`);return e.sites=c,e}function Bn(e){return Object.keys(e.sites??{}).filter(mr)}function co(e,t){if(!e?.root)return null;let r=t.cwd??process.cwd(),n=t.logger??Bo;try{if(typeof e.build==="string"&&e.build.trim())n.info(`Management dashboard: building UI (${e.build})`),Ho(e.build,{cwd:r,stdio:"inherit"});let s=Fo(e.root)?e.root:ge(r,e.root);if(!st(s))return n.warn(`Management dashboard: build output not found at ${s} — skipping dashboard artifact.`),null;let i=ge(ou(),`${t.slug}-${t.siteName??id}-${t.sha}.tar.gz`);return Ho(`tar czf "${i}" -C "${s}" .`,{stdio:"inherit"}),i}catch(s){return n.warn(`Management dashboard: failed to build artifact — ${s?.message??s}. Skipping dashboard deploy.`),null}}function du(e){let t=e.split("/");if(!/^[a-zA-Z0-9_./-]+$/.test(e)||e.startsWith("/")||t.some((r)=>!r||r==="."||r==="..")||t.at(-1)!=="bun")throw Error("Stacks backgroundBun must select a safe release-relative Bun executable")}function jo(e,t){if(du(t),!/^\/[a-zA-Z0-9_./-]+$/.test(e)||e.split("/").includes(".."))throw Error("Stacks backgroundBun requires a safe absolute release directory");return`${e}/${t}`}var mu=new Set(["laravel","php","statamic","wordpress"]);function Gr(e){if(e.framework)return e.framework;if(e.type&&mu.has(e.type))return"laravel";return"stacks"}var Go=`eval "$(cd ${p} && pantry env 2>/dev/null)"`,fu="/usr/local/bin/bun",Nr={PATH:"/usr/local/bin:/usr/bin:/bin",BUN_INSTALL:"/root/.bun",APP_ENV:"production",NODE_ENV:"production"};function Kn(e){if(e.backgroundBun===void 0)return fu;return jo(e.current,e.backgroundBun)}function gu(e){let t=e.queue??"default",r=[e.sleep,e.tries,e.timeout,e.processes,e.stopWaitSecs];if(typeof t!=="string"||!/^[a-zA-Z0-9_.:,{}/@+-]+$/.test(t||"default")||r.some((n)=>n!==void 0&&(typeof n!=="number"||!Number.isFinite(n))))throw Error("Stacks background queue options require safe queue names and finite numeric values")}var hu="node_modules/@stacksjs/ts-cloud/dist/bin/stacks-scheduler.js",Su="node_modules/@stacksjs/ts-cloud/dist/bin/stacks-queue-worker.js",Vo={id:"stacks",wrapExec:(e)=>e,execEnv:Nr,executionEnvironment:(e)=>{let t=Kn(e);return e.backgroundBun===void 0?Nr:{...Nr,PATH:`${t.slice(0,t.lastIndexOf("/"))}:${Nr.PATH}`,TS_CLOUD_BACKGROUND_BUN:e.backgroundBun}},schedulerMode:"daemon",schedulerCommand:(e)=>`${Kn(e)} ${hu}`,queueWorkerCommand:(e,t)=>{if(t.backgroundBun!==void 0)gu(e);let{current:r}=t,n=[`--queue=${e.queue||"default"}`,`--sleep=${e.sleep??3}`,`--tries=${e.tries??3}`,`--timeout=${e.timeout??60}`];return`${Kn(t)} ${r}/${Su} ${n.join(" ")}`}},vu={id:"laravel",wrapExec:(e)=>`/bin/sh -lc '${Go}; exec ${e}'`,schedulerMode:"cron",schedulerCommand:({current:e})=>`cd ${e} && ${Go} && php artisan schedule:run`,queueWorkerCommand:(e,{current:t})=>{let r=`${t}/artisan`;if(e.horizon)return`php ${r} horizon`;let n=[e.connection||"default",`--queue=${e.queue||"default"}`,`--sleep=${e.sleep??3}`,`--tries=${e.tries??3}`,`--timeout=${e.timeout??60}`,`--memory=${e.memory??128}`];if(e.maxJobs)n.push(`--max-jobs=${e.maxJobs}`);if(e.maxTime)n.push(`--max-time=${e.maxTime}`);return`php ${r} queue:work ${n.join(" ")}`}},_u={stacks:Vo,laravel:vu};function Wo(e){return _u[e]??Vo}function qo(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function $u(e){return`'${e.split("'").join("'\\''")}'`}function Yo(e){return e.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"unnamed"}function Xo(e,t){return`for unit in $(ls /etc/systemd/system/ 2>/dev/null | grep -E '^${qo(e)}-${qo(t)}-((queue|daemon)-.*|scheduler)\\.service$' || true); do`}function Vn(e){return[Xo(e.slug,e.siteName),'  systemctl stop "$unit"',"done"]}function yu(e,t,r){return`${e}-${t}-queue-${r}`}function bu(e,t,r,n){return`${e}-${t}-daemon-${r.name?Yo(r.name):Yo(r.command).slice(0,32)||String(n)}`}function jn(e){let t=["[Unit]",`Description=${e.description}`,"After=network.target","","[Service]","Type=simple",`WorkingDirectory=${e.workingDir}`,...Object.entries(e.environment??{}).map(([r,n])=>`Environment="${r}=${n}"`),`ExecStart=${e.execStart}`,`Restart=${e.restart||"always"}`,"RestartSec=5","MemoryAccounting=true",`MemoryHigh=${e.memoryHigh??"2G"}`,...e.memoryMax?[`MemoryMax=${e.memoryMax}`]:[]];if(e.isolatedUser){if(!e.isolationRoot||!e.isolationSlug)throw Error("Runtime isolation requires its project directory");t.push(...Ut(e.isolatedUser,e.isolationRoot,e.isolationSlug))}else if(e.user)t.push(`User=${e.user}`);if(typeof e.stopWaitSecs==="number")t.push(`TimeoutStopSec=${e.stopWaitSecs}`);return t.push("","[Install]","WantedBy=multi-user.target"),`${t.join(`
 `)}
-`}function Gn(e,t){return[`cat > /etc/systemd/system/${e}.service <<'TS_CLOUD_UNIT_EOF'`,t.replace(/\n$/,""),"TS_CLOUD_UNIT_EOF"]}function Tu(e,t){return`/etc/cron.d/${e}-${t}-scheduler`}function Wn(e){let t=e.site.isolation&&!["laravel","php","statamic","wordpress"].includes(e.site.type||"")?ut(e.slug):void 0,{slug:r,siteName:n,site:s}=e,i=e.appBase??`/var/www/${n}`,a=`${i}/current`,c=Wo(Gr(s)),u=c.id==="stacks"&&s.backgroundBun!==void 0;if(u&&(!e.releaseId||!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/.test(e.releaseId)))throw Error("Stacks backgroundBun requires a safe physical releaseId");let f=u?`${i}/releases/${e.releaseId}`:a,h={current:f,backgroundBun:s.backgroundBun},S=c.executionEnvironment?.(h)??c.execEnv,v=[],_=[];(s.queues||[]).forEach((I,Y)=>{let W=c.wrapExec(c.queueWorkerCommand(I,h)),K=Math.max(1,I.processes??1);for(let ee=0;ee<K;ee++){let re=yu(r,n,_.length);_.push(re),v.push(...Gn(re,jn({description:`${n} queue worker ${Y}.${ee} (managed by ts-cloud)`,workingDir:f,execStart:W,environment:S,isolatedUser:t,stopWaitSecs:I.stopWaitSecs??90})))}}),(s.daemons||[]).forEach((I,Y)=>{if(t&&I.user&&I.user!==t)throw Error("An isolated runtime daemon cannot change its project identity");let W=Math.max(1,I.processes??1);for(let K=0;K<W;K++){let ee=`${bu(r,n,I,Y)}-${K}`;_.push(ee),v.push(...Gn(ee,jn({description:`${n} daemon ${I.name||I.command} (managed by ts-cloud)`,workingDir:I.directory||a,execStart:c.wrapExec(I.command),environment:c.execEnv,restart:I.restart,user:I.user,isolatedUser:t})))}});let D=s.scheduler,V=D===!0||typeof D==="object"&&D!==null,H=`${r}-${n}-scheduler`;if(V&&c.schedulerMode==="daemon"){_.push(H);let I=typeof D==="object"&&D!==null?D:{};v.push(...Gn(H,jn({description:`${n} scheduler (managed by ts-cloud)`,workingDir:f,execStart:c.wrapExec(c.schedulerCommand(h)),environment:S,isolatedUser:t,memoryHigh:I.memoryHigh,memoryMax:I.memoryMax})),...br(`${H}.service`,{auto:!1,high:Boolean(I.memoryHigh),max:Boolean(I.memoryMax)}))}let x=_.map((I)=>`${I}.service`).join(" ");v.push("systemctl daemon-reload",`TS_CLOUD_DESIRED="${x}"`,Xo(r,n),'  case " $TS_CLOUD_DESIRED " in','    *" $unit "*) ;;','    *) systemctl stop "$unit"; systemctl disable "$unit"; rm -f "/etc/systemd/system/$unit" ;;',"  esac","done","systemctl daemon-reload");for(let I of _)v.push(`systemctl enable ${I}.service`,`systemctl restart ${I}.service`);let k=Tu(r,n);if(V&&c.schedulerMode==="cron"){let I=typeof D==="object"&&D!==null?D:void 0,Y=`${c.schedulerCommand(h)} >> /dev/null 2>&1`;if(I?.heartbeatUrl){let K=I.heartbeatMethod||"GET",ee=K==="GET"?"":`-X ${K} `;Y+=` && curl -fsS -m 10 ${ee}${$u(I.heartbeatUrl)} >/dev/null 2>&1`}let W=`* * * * * root ${Y}
+`}function Gn(e,t){return[`cat > /etc/systemd/system/${e}.service <<'TS_CLOUD_UNIT_EOF'`,t.replace(/\n$/,""),"TS_CLOUD_UNIT_EOF"]}function Tu(e,t){return`/etc/cron.d/${e}-${t}-scheduler`}function Wn(e){let t=e.site.isolation&&!["laravel","php","statamic","wordpress"].includes(e.site.type||"")?ut(e.slug):void 0,{slug:r,siteName:n,site:s}=e,i=e.appBase??`/var/www/${n}`,a=`${i}/current`,c=Wo(Gr(s)),u=c.id==="stacks"&&s.backgroundBun!==void 0;if(u&&(!e.releaseId||!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/.test(e.releaseId)))throw Error("Stacks backgroundBun requires a safe physical releaseId");let f=u?`${i}/releases/${e.releaseId}`:a,h={current:f,backgroundBun:s.backgroundBun},S=c.executionEnvironment?.(h)??c.execEnv,v=[],_=[];(s.queues||[]).forEach((I,Y)=>{let W=c.wrapExec(c.queueWorkerCommand(I,h)),K=Math.max(1,I.processes??1);for(let ee=0;ee<K;ee++){let re=yu(r,n,_.length);_.push(re),v.push(...Gn(re,jn({description:`${n} queue worker ${Y}.${ee} (managed by ts-cloud)`,workingDir:f,execStart:W,environment:S,isolatedUser:t,isolationRoot:i,isolationSlug:r,stopWaitSecs:I.stopWaitSecs??90})))}}),(s.daemons||[]).forEach((I,Y)=>{if(t&&I.user&&I.user!==t)throw Error("An isolated runtime daemon cannot change its project identity");let W=Math.max(1,I.processes??1);for(let K=0;K<W;K++){let ee=`${bu(r,n,I,Y)}-${K}`;_.push(ee),v.push(...Gn(ee,jn({description:`${n} daemon ${I.name||I.command} (managed by ts-cloud)`,workingDir:I.directory||a,execStart:c.wrapExec(I.command),environment:c.execEnv,restart:I.restart,user:I.user,isolatedUser:t,isolationRoot:i,isolationSlug:r})))}});let D=s.scheduler,V=D===!0||typeof D==="object"&&D!==null,H=`${r}-${n}-scheduler`;if(V&&c.schedulerMode==="daemon"){_.push(H);let I=typeof D==="object"&&D!==null?D:{};v.push(...Gn(H,jn({description:`${n} scheduler (managed by ts-cloud)`,workingDir:f,execStart:c.wrapExec(c.schedulerCommand(h)),environment:S,isolatedUser:t,isolationRoot:i,isolationSlug:r,memoryHigh:I.memoryHigh,memoryMax:I.memoryMax})),...br(`${H}.service`,{auto:!1,high:Boolean(I.memoryHigh),max:Boolean(I.memoryMax)}))}let x=_.map((I)=>`${I}.service`).join(" ");v.push("systemctl daemon-reload",`TS_CLOUD_DESIRED="${x}"`,Xo(r,n),'  case " $TS_CLOUD_DESIRED " in','    *" $unit "*) ;;','    *) systemctl stop "$unit"; systemctl disable "$unit"; rm -f "/etc/systemd/system/$unit" ;;',"  esac","done","systemctl daemon-reload");for(let I of _)v.push(`systemctl enable ${I}.service`,`systemctl restart ${I}.service`);let k=Tu(r,n);if(V&&c.schedulerMode==="cron"){let I=typeof D==="object"&&D!==null?D:void 0,Y=`${c.schedulerCommand(h)} >> /dev/null 2>&1`;if(I?.heartbeatUrl){let K=I.heartbeatMethod||"GET",ee=K==="GET"?"":`-X ${K} `;Y+=` && curl -fsS -m 10 ${ee}${$u(I.heartbeatUrl)} >/dev/null 2>&1`}let W=`* * * * * root ${Y}
 `.replace(/%/g,"\\%");v.push(`cat > ${k} <<'TS_CLOUD_CRON_EOF'`,W.replace(/\n$/,""),"TS_CLOUD_CRON_EOF",`chmod 644 ${k}`)}else v.push(`rm -f ${k}`);return v}function Jo(e){return!!(e.queues?.length||e.daemons?.length||e.scheduler)}function qn(e){if(e.ssl?.provider)return e.ssl.provider;return e.domain?"letsencrypt":"none"}var Zo={cloudflare:{pkg:"python3-certbot-dns-cloudflare",plugin:"dns-cloudflare"},route53:{pkg:"python3-certbot-dns-route53",plugin:"dns-route53"},digitalocean:{pkg:"python3-certbot-dns-digitalocean",plugin:"dns-digitalocean"},google:{pkg:"python3-certbot-dns-google",plugin:"dns-google"}};function Qo(e){return`/etc/letsencrypt/ts-cloud-${e}.ini`}function wu(e){let t=e?Zo[e.provider]:void 0,r=["certbot","python3-certbot-nginx",...t?[t.pkg]:[]].join(" ");return["export DEBIAN_FRONTEND=noninteractive",t?`apt-get update -y && apt-get install -y ${r}`:`command -v certbot >/dev/null 2>&1 || { apt-get update -y && apt-get install -y ${r}; }`,"mkdir -p /etc/letsencrypt/renewal-hooks/deploy","cat > /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh <<'TS_CLOUD_HOOK_EOF'","#!/bin/sh","systemctl reload ts-cloud-nginx 2>/dev/null || systemctl reload nginx 2>/dev/null || true","TS_CLOUD_HOOK_EOF","chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh","systemctl enable certbot.timer 2>/dev/null || true","systemctl start certbot.timer 2>/dev/null || true"]}function Cu(e){if(!e.credentials||Object.keys(e.credentials).length===0)return[];let t=Qo(e.provider),r=Object.entries(e.credentials).map(([n,s])=>`${n} = ${s}`).join(`
 `);return[`cat > ${t} <<'TS_CLOUD_DNSCREDS_EOF'`,r,"TS_CLOUD_DNSCREDS_EOF",`chmod 600 ${t}`]}function Pu(e){let t=e.dns,r=e.wildcard?[`*.${e.domain}`,e.domain]:[e.domain,...e.aliases||[]].filter(Boolean),n=["certbot","--non-interactive","--agree-tos","--keep-until-expiring"];if(t){let s=Zo[t.provider].plugin;if(n.push(`--${s}`),t.provider!=="route53"&&t.credentials)n.push(`--${s}-credentials ${Qo(t.provider)}`);if(typeof t.propagationSeconds==="number"&&t.provider!=="route53")n.push(`--${s}-propagation-seconds ${t.propagationSeconds}`);n.push("certonly")}else n.push("--nginx",`--nginx-ctl ${Fe}`,e.redirect===!1?"--no-redirect":"--redirect");if(e.email)n.push(`-m ${e.email}`);else n.push("--register-unsafely-without-email");for(let s of r)n.push(`-d ${s}`);return[n.join(" ")]}function Jn(e){if(qn(e)!=="letsencrypt"||!e.domain)return[];let t=e.ssl,r=t?.dns,n=t?.wildcard===!0;if(n&&!r)return[];return[...wu(r),...r?Cu(r):[],...Pu({domain:e.domain,aliases:e.aliases,email:t?.email,wildcard:n,dns:r})]}function _i(e){let{repository:t,releaseDir:r,commit:n}=e,s=t.branch||"main",i=t.url,a=[`rm -rf ${r}`,`mkdir -p ${r}`];if(t.strategy==="tag")if(t.tag)a.push(`git clone -q --depth 1 --branch ${we(t.tag)} ${we(i)} ${r}`),a.push(`printf '%s' ${we(t.tag)} > ${r}/.ts-cloud-tag`);else{let c=t.tagPattern||"v*";a.push(`TS_CLOUD_TAG="$(git ls-remote --tags --refs --sort=-v:refname ${we(i)} ${we(`refs/tags/${c}`)} | head -n1 | sed 's#.*refs/tags/##')"`,`test -n "$TS_CLOUD_TAG" || { echo "no tags matching" ${we(c)} "found in" ${we(i)} >&2; exit 1; }`,`git clone -q --depth 1 --branch "$TS_CLOUD_TAG" ${we(i)} ${r}`,`printf '%s' "$TS_CLOUD_TAG" > ${r}/.ts-cloud-tag`)}else if(n)a.push(`git -C ${r} init -q`,`git -C ${r} remote add origin ${we(i)}`,`git -C ${r} fetch -q --depth 1 origin ${we(n)}`,`git -C ${r} checkout -q FETCH_HEAD`);else a.push(`git clone -q --depth 1 --branch ${we(s)} ${we(i)} ${r}`);return a.push(`git -C ${r} rev-parse HEAD > ${r}/.ts-cloud-sha`),a}function we(e){return`'${e.split("'").join("'\\''")}'`}var zr="$CREATE_RELEASE",Br="$ACTIVATE_RELEASE",Oi="$RESTART_QUEUES",$i="composer install --no-interaction --prefer-dist --optimize-autoloader --no-dev",Eu=["php artisan migrate --force","php artisan config:cache","php artisan route:cache","php artisan view:cache","php artisan event:cache","php artisan storage:link"];function Ru(e){switch(e){case"laravel":case"statamic":return[zr,$i,...Eu,Br,Oi];case"php":case"wordpress":return[zr,`${$i} || true`,Br];case"static":case"spa":return[zr,Br]}}function Ou(e,t){return e.replace(/^php\s+/,`${t} `).replace(/(\s)php\s+artisan\s+/g,`$1${t} artisan `)}function Du(e,t){let r=fr(t);return[`cat > ${e} <<'TS_CLOUD_ENV_EOF'`,r,"TS_CLOUD_ENV_EOF",`chmod 600 ${e}`]}function Pi(e,t,r){return[`cat > ${e} <<'${r}'`,t.replace(/\n$/,""),r,`chmod 600 ${e}`]}function xu(e,t){if(!t)return[];let r=[];if(t.composerAuth){let n=typeof t.composerAuth==="string"?t.composerAuth:JSON.stringify(t.composerAuth,null,2);r.push(...Pi(`${e}/auth.json`,n,"TS_CLOUD_AUTHJSON_EOF"))}if(t.npmrc)r.push(...Pi(`${e}/.npmrc`,t.npmrc,"TS_CLOUD_NPMRC_EOF"));return r}function xi(e){let t=e.healthCheck?.path;if(!t||!e.domain)return[];let n=`http://127.0.0.1${t.startsWith("/")?t:`/${t}`}`;return[`echo "[ts-cloud] health check ${n} (Host: ${e.domain})"`,"TS_CLOUD_HC_OK=0",`for i in $(seq 1 10); do TS_CLOUD_HC=$(curl -s -o /dev/null -w "%{http_code}" -H "Host: ${e.domain}" -m 10 "${n}" 2>/dev/null || echo 000); case "$TS_CLOUD_HC" in 2*|3*) TS_CLOUD_HC_OK=1; break ;; esac; sleep 3; done`,'[ "$TS_CLOUD_HC_OK" = 1 ] && echo "health check passed ($TS_CLOUD_HC)" || { echo "health check FAILED (last=$TS_CLOUD_HC)" >&2; exit 1; }']}function Li(e){let{siteName:t,site:r,releaseId:n,commit:s}=e;if(!r.repository?.url)throw Error(`Site '${t}' is a PHP/git site but has no repository.url to clone`);let i=e.appBase??`/var/www/${t}`,a="php",c=Zt(i,n),u=r.sharedPaths??gr,f=[...u,...yr(r.env,u)],h=r.keepReleases??Ht,S=r.deployScript?.length?r.deployScript:Ru(r.type??"laravel"),v=["set -euo pipefail",'export HOME="${HOME:-/root}"','export COMPOSER_HOME="${COMPOSER_HOME:-/root/.composer}"',"export COMPOSER_ALLOW_SUPERUSER=1",Oe()];if(v.push(...vr(i,{releaseId:n,commit:s,branch:r.repository.branch,keepLogs:h})),v.push(...Mt(c,f)),r.env&&Object.keys(r.env).length>0)v.push(...Du(`${c.shared}/.env`,r.env));for(let _ of S){let y=_.trim();if(y===zr)v.push(..._i({repository:r.repository,releaseDir:c.release,commit:s})),v.push(...Sr(c,f)),v.push(`cd ${c.release}`),v.push(...xu(c.release,r.credentials)),v.push(`chown -R www-data:www-data ${c.shared}/storage 2>/dev/null || true`,`[ -d ${c.release}/bootstrap/cache ] && chown -R www-data:www-data ${c.release}/bootstrap/cache 2>/dev/null || true`,`chmod -R ug+rwX ${c.shared}/storage 2>/dev/null || true`);else if(y===Br)v.push(...pt(c)),v.push(...dt(c,h)),v.push(`(cd ${p} && pantry restart php-fpm) 2>/dev/null || true`);else if(y===Oi)v.push(`${a} artisan queue:restart || true`);else v.push(Ou(_,a))}return v}var Kr={mysql:{port:3306,binaries:["mysqld","mysql"]},mariadb:{port:3306,binaries:["mariadbd","mariadb","mysqld"]},postgres:{port:5432,binaries:["postgres","psql"]},redis:{port:6379,binaries:["redis-server","redis-cli"]},memcached:{port:11211,binaries:["memcached"]},meilisearch:{port:7700,binaries:["meilisearch"]},vitess:{port:15306,binaries:["vtgate"]}},qt="ts-cloud-service:";function Iu(e){return e===!0||typeof e==="object"&&e!=null}function Ui(e){if(!e)return[];return Object.keys(Kr).filter((t)=>Iu(e[t]))}function Hi(e){if(e.length===0)return[];return[Oe(),"ts_cloud_port_open() {",'  if command -v ss >/dev/null 2>&1; then ss -ltn 2>/dev/null | grep -qE "[:.]$1[[:space:]]" && return 0; fi','  if command -v netstat >/dev/null 2>&1; then netstat -ltn 2>/dev/null | grep -qE "[:.]$1[[:space:]]" && return 0; fi',"  (exec 3<>/dev/tcp/127.0.0.1/$1) 2>/dev/null && { exec 3<&- 3>&-; return 0; }","  return 1","}","ts_cloud_probe() {",'  TS_CLOUD_SVC="$1"; TS_CLOUD_PORT="$2"; shift 2','  for TS_CLOUD_BIN in "$@"; do',`    if command -v "$TS_CLOUD_BIN" >/dev/null 2>&1; then echo "${qt}$TS_CLOUD_SVC:present"; return 0; fi`,"  done",`  if ts_cloud_port_open "$TS_CLOUD_PORT"; then echo "${qt}$TS_CLOUD_SVC:present"; return 0; fi`,`  echo "${qt}$TS_CLOUD_SVC:missing"`,"  return 0","}",...e.filter((t)=>Kr[t]).map((t)=>`ts_cloud_probe ${t} ${Kr[t].port} ${Kr[t].binaries.join(" ")}`),"exit 0"]}function Ni(e,t){if(!e)return[];let r=new Map;for(let n of e.split(`
 `)){let s=n.indexOf(qt);if(s===-1)continue;let[i,a]=n.slice(s+qt.length).trim().split(":");if(i)r.set(i,a)}return t.filter((n)=>r.get(n)==="missing")}function Mi(e,t,r){let n=r?` on ${r}`:"",s=e.map((a)=>`managedServices.${a}`).join(", "),i=e.length===1?`no ${e[0]}`:`none of ${e.join(", ")}`;return`This project declares ${s}, but '${t}' has ${i}${n}. Attach mode does not provision services on the owner's box, so nothing will install ${e.length===1?"it":"them"}. Point the app at an external service, or ask the owner of '${t}' to add ${e.length===1?"it":"them"} to their own config and re-provision.`}var Fi="/var/lib/pantry/php-fpm/pool.d",Au=9100,Lu=400;function Wr(e){return(e.toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/^_+|_+$/g,"")||"site").slice(0,28)}function zi(e){return`web_${Wr(e)}`}function Uu(e){let t=Wr(e),r=0;for(let n=0;n<t.length;n++)r=r*31+t.charCodeAt(n)>>>0;return Au+r%Lu}function Qn(e){return`127.0.0.1:${Uu(e)}`}function ku(e){let t=Wr(e.siteName),r=zi(e.siteName),n=e.maxChildren??10;return[`; ts-cloud-managed pool for ${e.siteName} (site isolation)`,`[${t}]`,`user = ${r}`,`group = ${r}`,`listen = ${Qn(e.siteName)}`,"pm = dynamic",`pm.max_children = ${n}`,"pm.start_servers = 2","pm.min_spare_servers = 1","pm.max_spare_servers = 3","pm.max_requests = 500","catch_workers_output = yes",`php_admin_value[open_basedir] = ${e.appBase}:/tmp`,""].join(`

package/dist/deploy/index.js

@@ -1 +1 @@
-import{Dn,Pn,Xu,bs,Yu,Zu,eg,Xa,tg,rg,Ah,ng,v,ig,Cs,Me,sg,og,jS,ag,cg,dg,lg,ug,yh,zS,KS,WS,Sh,Ih,JS,XS,bh,Ch,YS,Es,Cr,Ya,kn,Nn,Er,dt,Ut,vs,Eh,Bn,gg,pg,Za,ws,On,Rs,pc}from"../chunk-tneb9hcw.js";import{mc,_n,Ln,Ds,Ps,ks,Ns,fc,hc}from"../chunk-0cd0mk3e.js";import{Ac}from"../chunk-65dddt6g.js";import"../chunk-ts2n068z.js";import"../chunk-v3z51fs0.js";import"../chunk-nx8dbae2.js";import"../chunk-3k9kdbsc.js";import"../chunk-ysv0f0k5.js";import"../chunk-ms84y9kg.js";import"../chunk-gssa1974.js";import{Ng,Oc,Bg,De,_c,Xn,xg,Lc,id,ao,sd,tr,Ri,co}from"../chunk-wnr96ssq.js";import"../chunk-2dffxn73.js";import"../chunk-pydkxpf9.js";import"../chunk-vx5n4bhb.js";import"../chunk-1y1b1jy0.js";import"../chunk-1eg5wsn2.js";import{vt,wA,hd,xi,Oi,_i,jp}from"../chunk-rkashc9e.js";import{U,jr,zr,Ad,Ao,d,RA,zp,Kp,NI,BI}from"../chunk-78xspqp6.js";import"../chunk-0nmtzbqn.js";import"../chunk-e32qtz2d.js";import"../chunk-928z0h9b.js";export{wA as DEFAULT_SITE_PORT_RANGE,vt as HOST_SITES_DIR,_c as IPV6_EXCLUDED_HOST_LABELS,id as MANAGEMENT_DASHBOARD_SITE,Dn as addSiteToCloudConfig,jp as allocateSitePorts,YS as buildAndPushContainerImage,Ac as buildAndPushServerlessImage,Cr as buildFunctionEnv,Oi as buildHostSitePortsScript,co as buildManagementDashboardArtifact,Ut as buildServerTopology,vs as buildServerlessTopology,Eh as buildTopology,Za as collectEgressMetrics,Ng as collectServerDnsDomains,Ch as createContainerImageDependencies,Sh as createExistingStaticFullStackDependencies,yh as createStaticApiOriginDependencies,On as dashboardActions,ao as dashboardCredentialsFile,sg as dashboardPageRoutes,lg as deleteFailoverReplicaBuckets,fc as deleteStaticSite,JS as deployExistingStaticFullStack,Ya as deployServerlessApp,BI as deployShipsFiles,ug as deploySite,zS as deployStaticApiOrigin,Ps as deployStaticSite,hc as deployStaticSiteFull,_n as deployStaticSiteWithExternalDns,Ln as deployStaticSiteWithExternalDnsFull,gg as egressReportMetrics,v as ensureDashboardActor,ag as ensureFailoverReplicaBuckets,Ri as ensureManagementDashboard,XS as estimateExistingStaticFullStackMonthlyCost,WS as estimateStaticApiOriginMonthlyCost,pg as fetchEgressReport,Ih as generateExistingStaticFullStackTemplate,mc as generateExternalDnsStaticSiteTemplate,Ds as generateStaticSiteTemplate,cg as grantFailoverReplicaAccess,RA as hasComputeConfigured,Ad as hasProxyUpstream,bh as hashContainerContext,Xn as hostAcceptsIpv6,Es as infraEnvFromOutputs,ig as initializeDashboardControlPlane,Ns as invalidateCache,jr as isPhpSite,Xa as isValidHostname,De as normalizePublicIpv6,xi as occupiedHostPorts,_i as parseHostSiteFragments,hd as parseUpstreamPort,xg as reconcileAddressRecords,kn as redeployServerlessApp,Bg as removeAddressRecords,Pn as removeSiteFromCloudConfig,Oc as removeStaleServerAddressRecords,tg as renderAliasesValue,eg as renderEnvValue,rg as renderRedirectsValue,Ah as renderSiteSnippet,Yu as renderSslValue,Zu as renderStringValue,Rs as resolveDashboardAction,sd as resolveDashboardAuth,Bn as resolveDashboardData,og as resolveLegacyDashboardRoute,zr as resolveProxyUpstreams,Ao as resolveSiteDeployTarget,d as resolveSiteKind,tr as resolveUiSource,Nn as rollbackServerlessApp,jS as routesForDashboard,dt as runRemoteCommand,ws as sanitizeCloudConfig,dg as seedFailoverReplicas,ng as setAttachToInCloudConfig,Er as setMaintenance,bs as setSitePropertyInCloudConfig,Kp as shipsARelease,NI as shipsToBucket,U as siteInstallBase,pc as startLocalDashboardServer,Cs as synchronizeDashboardUsers,Me as trackDashboardOperation,Xu as updateSiteInCloudConfig,ks as uploadStaticFiles,zp as validateDeploymentConfig,Lc as verifyAddressRecord,KS as verifyStaticApiOrigin};
+import{Dn,Pn,Xu,bs,Yu,Zu,eg,Xa,tg,rg,Ah,ng,v,ig,Cs,Me,sg,og,jS,ag,cg,dg,lg,ug,yh,zS,KS,WS,Sh,Ih,JS,XS,bh,Ch,YS,Es,Cr,Ya,kn,Nn,Er,dt,Ut,vs,Eh,Bn,gg,pg,Za,ws,On,Rs,pc}from"../chunk-68pafbpe.js";import{mc,_n,Ln,Ds,Ps,ks,Ns,fc,hc}from"../chunk-0cd0mk3e.js";import{Ac}from"../chunk-65dddt6g.js";import"../chunk-ts2n068z.js";import"../chunk-v3z51fs0.js";import"../chunk-nx8dbae2.js";import"../chunk-3k9kdbsc.js";import"../chunk-ysv0f0k5.js";import"../chunk-ms84y9kg.js";import"../chunk-gssa1974.js";import{Ng,Oc,Bg,De,_c,Xn,xg,Lc,id,ao,sd,tr,Ri,co}from"../chunk-me647jxj.js";import"../chunk-2dffxn73.js";import"../chunk-pydkxpf9.js";import"../chunk-vx5n4bhb.js";import"../chunk-1y1b1jy0.js";import"../chunk-1eg5wsn2.js";import{vt,wA,hd,xi,Oi,_i,jp}from"../chunk-rkashc9e.js";import{U,jr,zr,Ad,Ao,d,RA,zp,Kp,NI,BI}from"../chunk-78xspqp6.js";import"../chunk-0nmtzbqn.js";import"../chunk-e32qtz2d.js";import"../chunk-928z0h9b.js";export{wA as DEFAULT_SITE_PORT_RANGE,vt as HOST_SITES_DIR,_c as IPV6_EXCLUDED_HOST_LABELS,id as MANAGEMENT_DASHBOARD_SITE,Dn as addSiteToCloudConfig,jp as allocateSitePorts,YS as buildAndPushContainerImage,Ac as buildAndPushServerlessImage,Cr as buildFunctionEnv,Oi as buildHostSitePortsScript,co as buildManagementDashboardArtifact,Ut as buildServerTopology,vs as buildServerlessTopology,Eh as buildTopology,Za as collectEgressMetrics,Ng as collectServerDnsDomains,Ch as createContainerImageDependencies,Sh as createExistingStaticFullStackDependencies,yh as createStaticApiOriginDependencies,On as dashboardActions,ao as dashboardCredentialsFile,sg as dashboardPageRoutes,lg as deleteFailoverReplicaBuckets,fc as deleteStaticSite,JS as deployExistingStaticFullStack,Ya as deployServerlessApp,BI as deployShipsFiles,ug as deploySite,zS as deployStaticApiOrigin,Ps as deployStaticSite,hc as deployStaticSiteFull,_n as deployStaticSiteWithExternalDns,Ln as deployStaticSiteWithExternalDnsFull,gg as egressReportMetrics,v as ensureDashboardActor,ag as ensureFailoverReplicaBuckets,Ri as ensureManagementDashboard,XS as estimateExistingStaticFullStackMonthlyCost,WS as estimateStaticApiOriginMonthlyCost,pg as fetchEgressReport,Ih as generateExistingStaticFullStackTemplate,mc as generateExternalDnsStaticSiteTemplate,Ds as generateStaticSiteTemplate,cg as grantFailoverReplicaAccess,RA as hasComputeConfigured,Ad as hasProxyUpstream,bh as hashContainerContext,Xn as hostAcceptsIpv6,Es as infraEnvFromOutputs,ig as initializeDashboardControlPlane,Ns as invalidateCache,jr as isPhpSite,Xa as isValidHostname,De as normalizePublicIpv6,xi as occupiedHostPorts,_i as parseHostSiteFragments,hd as parseUpstreamPort,xg as reconcileAddressRecords,kn as redeployServerlessApp,Bg as removeAddressRecords,Pn as removeSiteFromCloudConfig,Oc as removeStaleServerAddressRecords,tg as renderAliasesValue,eg as renderEnvValue,rg as renderRedirectsValue,Ah as renderSiteSnippet,Yu as renderSslValue,Zu as renderStringValue,Rs as resolveDashboardAction,sd as resolveDashboardAuth,Bn as resolveDashboardData,og as resolveLegacyDashboardRoute,zr as resolveProxyUpstreams,Ao as resolveSiteDeployTarget,d as resolveSiteKind,tr as resolveUiSource,Nn as rollbackServerlessApp,jS as routesForDashboard,dt as runRemoteCommand,ws as sanitizeCloudConfig,dg as seedFailoverReplicas,ng as setAttachToInCloudConfig,Er as setMaintenance,bs as setSitePropertyInCloudConfig,Kp as shipsARelease,NI as shipsToBucket,U as siteInstallBase,pc as startLocalDashboardServer,Cs as synchronizeDashboardUsers,Me as trackDashboardOperation,Xu as updateSiteInCloudConfig,ks as uploadStaticFiles,zp as validateDeploymentConfig,Lc as verifyAddressRecord,KS as verifyStaticApiOrigin};

package/dist/drivers/index.js

@@ -1 +1 @@
-import{Yn,Jt,Or,Xt,Zn,M,Lr,ei,ti,$r,Mr,Uh,Qh,Fg,Ug,Hh,Gh,Vh,Fr,ri,Qg,to,ni,ii,si,oi,ai,$c,Mc,ci,Ur,Ie,Fc,ht,Uc,di,Qc,Qr,Gc,Ve,se,er,Hg,li,Vc,qc,jc,zc,At,qe,je,yt,ui,gi,Pe,ro,no,Gg,Vg,Kc,qg,St,pi,Wc,jg,zg,Jc,It,ke,Xc,Kg,Wg,io,mi,bt,Jg,Xg,Yg,Zg,ep,tp,rp,np,ip,fi,hi,Ai,yi,Si,Ii,bi,sp,op,Hr,F,so,ap,cp,dp,Yc,lp,up,qh,jh,zh,Zc,gp,Kh,Wh,Jh,Ci,Ei,vi,Ti,ed,td,wi,rd,Xh,oo,pp,mp,fp,hp,Ap,nd,Yh,lo,od,Di,ad,yp,Sp,Ip,Zh}from"../chunk-wnr96ssq.js";import{go,mo,fo,eA,ld,B,rr,kI,ho,vp,ze,G,Ne}from"../chunk-2dffxn73.js";import"../chunk-pydkxpf9.js";import"../chunk-vx5n4bhb.js";import"../chunk-1y1b1jy0.js";import"../chunk-1eg5wsn2.js";import"../chunk-78xspqp6.js";import"../chunk-e32qtz2d.js";import"../chunk-928z0h9b.js";export{rd as AwsBoxProvisioner,Lr as AwsDriver,dp as BOOT_PARTITION_LABEL,pp as BOX_PANTRY_BIN_DIR,oo as BOX_PANTRY_CLI_DIR,so as CloudDriverFactory,Ug as DEFAULT_HOST_CLEANUP_ESCALATED,Gh as DEFAULT_HOST_CLEANUP_HIGH_WATER_PERCENT,Hh as DEFAULT_HOST_CLEANUP_LOW_WATER_PERCENT,Fg as DEFAULT_HOST_CLEANUP_RETENTION,Vh as DEFAULT_HOST_CLEANUP_SCHEDULE,go as DEFAULT_RPX_CERTS_DIR,cp as FIRST_BOOT_SCRIPT_PATH,Mr as HOST_ARTIFACT_CACHE_DIR,Uh as HOST_CLEANUP_SCRIPT_PATH,Qh as HOST_CLEANUP_UNIT,wi as HetznerBoxProvisioner,Qr as HetznerClient,Pe as HetznerDriver,zc as LEGACY_DRIVER_STATE_DIR,ro as LocalBoxDriver,Sp as MANAGED_CACHE_POLICY_DISABLED,yp as MANAGED_CACHE_POLICY_OPTIMIZED,Ip as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,Wg as RASPBERRY_PI_DEFAULT_SWAP_GB,Qc as REMOTE_SCRIPT_RUNNER,ho as RPX_DIR,vp as RPX_LAUNCHER_PATH,ze as RPX_SERVICE_NAME,Xc as SSH_BOOTSTRAP_MARKER_DIR,ke as SSH_BOOTSTRAP_VERSION,bt as SSH_DEFAULTS,bi as SSH_DEPLOY_STORAGE_PATH,Gg as SSH_INSECURE_HOST_KEY_OPTS,Vg as SSH_KEEPALIVE_OPTS,hi as SSH_PREFLIGHT_SCRIPT,sp as SSH_SKIP_BOOTSTRAP_ENV,Hr as SshDriver,It as SystemSshTransport,ed as UBUNTU_2404_AMI_PARAM,Jh as acquireResizeLock,qh as applyHetznerHostOptimization,gi as applyHetznerVolumes,io as assertArchSupported,op as assertSshComputeConfig,$c as buildAwsArtifactFetch,Ap as buildBoxConvergeScript,mp as buildBoxSandboxConvergeScript,td as buildBoxUserData,Zh as buildCloudFrontOriginConfig,Yc as buildCloudInitFirstBoot,ti as buildComputeStorageInstallScript,$r as buildComputeStorageSiteScript,up as buildHetznerHostOptimizationScript,ni as buildHostCleanupDeployScript,Qg as buildHostCleanupExecutable,to as buildHostCleanupInstallScript,ri as buildHostCleanupScript,Mc as buildLocalArtifactFetch,B as buildRpxConfig,Ne as buildRpxFragmentRefreshScript,rr as buildRpxLbConfig,G as buildRpxProvisionScript,qg as buildScpArgsFor,si as buildSiteDeployScript,ci as buildSshArgs,Kc as buildSshArgsFor,mi as buildSshBootstrapScript,oi as buildStaticSiteDeployScript,ap as cloudDrivers,jh as collectHetznerHostOptimizationReport,Vc as collectHetznerResizeManifest,Xh as createBoxProvisioner,F as createCloudDriver,od as deployAllComputeSites,lo as deploySiteRelease,ld as deriveRouteId,Yn as describeScriptSyntaxError,At as driverStateDir,qe as driverStatePath,Ei as ensureFirewall,vi as ensureServer,Ci as ensureSshKey,yi as evaluatePreflight,li as executeHetznerServerResize,zg as findKnownHostKey,Ii as formatPreflightFindings,Jt as formatSshFailure,fo as gatewayHostnames,M as generateUbuntuAppCloudInit,mo as hasAutoWwwVariant,no as isBoxMode,Hg as isHetznerCapacityError,Zn as isLocalDatabase,jg as knownHostsLine,Wc as knownHostsToken,eA as normalizeRoutePath,Ve as normalizeSshPublicKey,nd as parseBoxReport,Ai as parsePreflightFacts,er as planHetznerServerResize,ui as planHetznerVolumes,Si as preflightFailed,qc as prepareHetznerResize,Yh as provisionBox,je as readDriverState,Kh as readResizeCheckpoint,ai as releaseTarballTmpPath,Di as reloadRpxGateway,di as remoteScriptRunner,hp as renderBoxUnit,fp as renderEnvFile,kI as renderRpxLauncher,ad as renewRpxCertificates,Zc as resizeCheckpointPath,gp as resizeLockPath,ei as resolveComputeVolumes,ii as resolveExecStart,Gc as resolveHetznerApiToken,lp as resolveHetznerHostOptimizationPlan,Fr as resolveHostCleanupConfig,ep as resolveSshHostKeyPolicy,Jg as resolveSshHosts,ip as resolveSshLan,Yg as resolveSshPort,Zg as resolveSshPrivateKeyPath,rp as resolveSshProfile,np as resolveSshPublicIp,fi as resolveSshSettings,tp as resolveSshSudo,Xg as resolveSshUser,pi as scanHostKey,Fc as scpUpload,Ti as serverPublicIpv4,Kg as sshBootstrapMarkerPath,Ur as sshExec,Ie as sshExecOrThrow,St as sshHostKeyFingerprint,Jc as sshKnownHostsPath,Xt as summarizeRemoteFailures,Or as surfaceRemoteNotices,zh as verifyHetznerHostOptimization,jc as verifyHetznerResize,Uc as waitForCloudInit,ht as waitForSsh,se as wrapCloudInitUserData,yt as writeDriverState,Wh as writeResizeCheckpoint};
+import{Yn,Jt,Or,Xt,Zn,M,Lr,ei,ti,$r,Mr,Uh,Qh,Fg,Ug,Hh,Gh,Vh,Fr,ri,Qg,to,ni,ii,si,oi,ai,$c,Mc,ci,Ur,Ie,Fc,ht,Uc,di,Qc,Qr,Gc,Ve,se,er,Hg,li,Vc,qc,jc,zc,At,qe,je,yt,ui,gi,Pe,ro,no,Gg,Vg,Kc,qg,St,pi,Wc,jg,zg,Jc,It,ke,Xc,Kg,Wg,io,mi,bt,Jg,Xg,Yg,Zg,ep,tp,rp,np,ip,fi,hi,Ai,yi,Si,Ii,bi,sp,op,Hr,F,so,ap,cp,dp,Yc,lp,up,qh,jh,zh,Zc,gp,Kh,Wh,Jh,Ci,Ei,vi,Ti,ed,td,wi,rd,Xh,oo,pp,mp,fp,hp,Ap,nd,Yh,lo,od,Di,ad,yp,Sp,Ip,Zh}from"../chunk-me647jxj.js";import{go,mo,fo,eA,ld,B,rr,kI,ho,vp,ze,G,Ne}from"../chunk-2dffxn73.js";import"../chunk-pydkxpf9.js";import"../chunk-vx5n4bhb.js";import"../chunk-1y1b1jy0.js";import"../chunk-1eg5wsn2.js";import"../chunk-78xspqp6.js";import"../chunk-e32qtz2d.js";import"../chunk-928z0h9b.js";export{rd as AwsBoxProvisioner,Lr as AwsDriver,dp as BOOT_PARTITION_LABEL,pp as BOX_PANTRY_BIN_DIR,oo as BOX_PANTRY_CLI_DIR,so as CloudDriverFactory,Ug as DEFAULT_HOST_CLEANUP_ESCALATED,Gh as DEFAULT_HOST_CLEANUP_HIGH_WATER_PERCENT,Hh as DEFAULT_HOST_CLEANUP_LOW_WATER_PERCENT,Fg as DEFAULT_HOST_CLEANUP_RETENTION,Vh as DEFAULT_HOST_CLEANUP_SCHEDULE,go as DEFAULT_RPX_CERTS_DIR,cp as FIRST_BOOT_SCRIPT_PATH,Mr as HOST_ARTIFACT_CACHE_DIR,Uh as HOST_CLEANUP_SCRIPT_PATH,Qh as HOST_CLEANUP_UNIT,wi as HetznerBoxProvisioner,Qr as HetznerClient,Pe as HetznerDriver,zc as LEGACY_DRIVER_STATE_DIR,ro as LocalBoxDriver,Sp as MANAGED_CACHE_POLICY_DISABLED,yp as MANAGED_CACHE_POLICY_OPTIMIZED,Ip as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,Wg as RASPBERRY_PI_DEFAULT_SWAP_GB,Qc as REMOTE_SCRIPT_RUNNER,ho as RPX_DIR,vp as RPX_LAUNCHER_PATH,ze as RPX_SERVICE_NAME,Xc as SSH_BOOTSTRAP_MARKER_DIR,ke as SSH_BOOTSTRAP_VERSION,bt as SSH_DEFAULTS,bi as SSH_DEPLOY_STORAGE_PATH,Gg as SSH_INSECURE_HOST_KEY_OPTS,Vg as SSH_KEEPALIVE_OPTS,hi as SSH_PREFLIGHT_SCRIPT,sp as SSH_SKIP_BOOTSTRAP_ENV,Hr as SshDriver,It as SystemSshTransport,ed as UBUNTU_2404_AMI_PARAM,Jh as acquireResizeLock,qh as applyHetznerHostOptimization,gi as applyHetznerVolumes,io as assertArchSupported,op as assertSshComputeConfig,$c as buildAwsArtifactFetch,Ap as buildBoxConvergeScript,mp as buildBoxSandboxConvergeScript,td as buildBoxUserData,Zh as buildCloudFrontOriginConfig,Yc as buildCloudInitFirstBoot,ti as buildComputeStorageInstallScript,$r as buildComputeStorageSiteScript,up as buildHetznerHostOptimizationScript,ni as buildHostCleanupDeployScript,Qg as buildHostCleanupExecutable,to as buildHostCleanupInstallScript,ri as buildHostCleanupScript,Mc as buildLocalArtifactFetch,B as buildRpxConfig,Ne as buildRpxFragmentRefreshScript,rr as buildRpxLbConfig,G as buildRpxProvisionScript,qg as buildScpArgsFor,si as buildSiteDeployScript,ci as buildSshArgs,Kc as buildSshArgsFor,mi as buildSshBootstrapScript,oi as buildStaticSiteDeployScript,ap as cloudDrivers,jh as collectHetznerHostOptimizationReport,Vc as collectHetznerResizeManifest,Xh as createBoxProvisioner,F as createCloudDriver,od as deployAllComputeSites,lo as deploySiteRelease,ld as deriveRouteId,Yn as describeScriptSyntaxError,At as driverStateDir,qe as driverStatePath,Ei as ensureFirewall,vi as ensureServer,Ci as ensureSshKey,yi as evaluatePreflight,li as executeHetznerServerResize,zg as findKnownHostKey,Ii as formatPreflightFindings,Jt as formatSshFailure,fo as gatewayHostnames,M as generateUbuntuAppCloudInit,mo as hasAutoWwwVariant,no as isBoxMode,Hg as isHetznerCapacityError,Zn as isLocalDatabase,jg as knownHostsLine,Wc as knownHostsToken,eA as normalizeRoutePath,Ve as normalizeSshPublicKey,nd as parseBoxReport,Ai as parsePreflightFacts,er as planHetznerServerResize,ui as planHetznerVolumes,Si as preflightFailed,qc as prepareHetznerResize,Yh as provisionBox,je as readDriverState,Kh as readResizeCheckpoint,ai as releaseTarballTmpPath,Di as reloadRpxGateway,di as remoteScriptRunner,hp as renderBoxUnit,fp as renderEnvFile,kI as renderRpxLauncher,ad as renewRpxCertificates,Zc as resizeCheckpointPath,gp as resizeLockPath,ei as resolveComputeVolumes,ii as resolveExecStart,Gc as resolveHetznerApiToken,lp as resolveHetznerHostOptimizationPlan,Fr as resolveHostCleanupConfig,ep as resolveSshHostKeyPolicy,Jg as resolveSshHosts,ip as resolveSshLan,Yg as resolveSshPort,Zg as resolveSshPrivateKeyPath,rp as resolveSshProfile,np as resolveSshPublicIp,fi as resolveSshSettings,tp as resolveSshSudo,Xg as resolveSshUser,pi as scanHostKey,Fc as scpUpload,Ti as serverPublicIpv4,Kg as sshBootstrapMarkerPath,Ur as sshExec,Ie as sshExecOrThrow,St as sshHostKeyFingerprint,Jc as sshKnownHostsPath,Xt as summarizeRemoteFailures,Or as surfaceRemoteNotices,zh as verifyHetznerHostOptimization,jc as verifyHetznerResize,Uc as waitForCloudInit,ht as waitForSsh,se as wrapCloudInitUserData,yt as writeDriverState,Wh as writeResizeCheckpoint};

package/dist/drivers/shared/runtime-isolation.d.ts

@@ -1,5 +1,5 @@
 /** One unprivileged identity per project; its web/API/workers may share that project's data. */
 export declare function runtimeIsolationUser(slug: string): string;
-export declare function runtimeIsolationDirectives(user: string): string[];
+export declare function runtimeIsolationDirectives(user: string, base: string, slug: string): string[];
 /** Only take ownership of this project's release and explicitly shared project data. */
 export declare function runtimeIsolationSetup(slug: string, base: string, targets: readonly string[]): string[];