@stacksjs/ts-cloud 0.5.26 → 0.5.28

package/dist/index.js

@@ -18,8 +18,8 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // ../core/dist/index.js
 import { createRequire as createRequire2 } from "node:module";
-import { existsSync as existsSync11, readdirSync as readdirSync6 } from "node:fs";
-import { join as join7 } from "node:path";
+import { existsSync as existsSync14, readdirSync as readdirSync6 } from "node:fs";
+import { join as join9 } from "node:path";
 import { createHash } from "node:crypto";
 import { readFileSync as readFileSync2, readdirSync as readdirSync22, statSync as statSync3, existsSync as existsSync23, writeFileSync as writeFileSync8, copyFileSync } from "node:fs";
 import { join as join22, basename, dirname as dirname5, extname as extname2 } from "node:path";
@@ -50,7 +50,7 @@ import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { existsSync as existsSync52, mkdirSync as mkdirSync22, mkdtempSync as mkdtempSync3, readdirSync as readdirSync52, readFileSync as readFileSync6, rmSync as rmSync3, statSync as statSync32, writeFileSync as writeFileSync52 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join9, relative as relative22 } from "node:path";
+import { join as join92, relative as relative22 } from "node:path";
 import { execSync as execSync2 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
 import { readdirSync as readdirSync62, readFileSync as readFileSync7, statSync as statSync4 } from "node:fs";
@@ -7693,6 +7693,21 @@ function resolveManagementDashboardSite(config6, environment, opts) {
   const domain = resolveDashboardDomain(config6, environment, opts.domain);
   if (!domain)
     return null;
+  const auth2 = opts.password ? { auth: { username: opts.username || "admin", password: opts.password, realm: opts.realm } } : {};
+  if (opts.live) {
+    const port = opts.port ?? 7676;
+    const site2 = {
+      root: opts.uiRoot,
+      deploy: "server",
+      domain,
+      start: `cloud dashboard:serve --box --host 127.0.0.1 --port ${port}`,
+      port,
+      ssl: { provider: "letsencrypt" },
+      ...opts.build === false || opts.build === undefined ? {} : { build: opts.build },
+      ...auth2
+    };
+    return { name: "dashboard", site: site2 };
+  }
   const site = {
     root: opts.uiRoot,
     deploy: "server",
@@ -7700,7 +7715,7 @@ function resolveManagementDashboardSite(config6, environment, opts) {
     domain,
     ssl: { provider: "letsencrypt" },
     ...opts.build === false || opts.build === undefined ? {} : { build: opts.build },
-    ...opts.password ? { auth: { username: opts.username || "admin", password: opts.password, realm: opts.realm } } : {}
+    ...auth2
   };
   return { name: "dashboard", site };
 }
@@ -26931,7 +26946,7 @@ function laravelServerlessEnvDefaults(opts = {}) {
 }
 function* walk(dir) {
   for (const entry of readdirSync52(dir)) {
-    const full = join9(dir, entry);
+    const full = join92(dir, entry);
     if (statSync32(full).isDirectory())
       yield* walk(full);
     else
@@ -26942,22 +26957,22 @@ function buildPhpRuntimeLayerZip(options = {}) {
   const architecture = options.architecture ?? "x86_64";
   const platform = options.platform ?? (architecture === "arm64" ? "linux/arm64" : "linux/amd64");
   const step = options.onStep ?? (() => {});
-  const stage = mkdtempSync3(join9(tmpdir3(), "tscloud-php-layer-"));
+  const stage = mkdtempSync3(join92(tmpdir3(), "tscloud-php-layer-"));
   const imageTag = "tscloud-php-layer:build";
   try {
-    writeFileSync52(join9(stage, "Dockerfile"), generatePhpLayerDockerfile(options));
+    writeFileSync52(join92(stage, "Dockerfile"), generatePhpLayerDockerfile(options));
     step("Building PHP runtime image (docker)");
     execFileSync2("docker", ["build", "--platform", platform, "-t", imageTag, stage], { stdio: "inherit" });
     step("Extracting /opt/php from image");
     const cid = execFileSync2("docker", ["create", "--platform", platform, imageTag], { encoding: "utf-8" }).trim();
-    const optDir = join9(stage, "opt");
+    const optDir = join92(stage, "opt");
     mkdirSync22(optDir, { recursive: true });
     try {
-      execFileSync2("docker", ["cp", `${cid}:/opt/php`, join9(optDir, "php")], { stdio: "inherit" });
+      execFileSync2("docker", ["cp", `${cid}:/opt/php`, join92(optDir, "php")], { stdio: "inherit" });
     } finally {
       execFileSync2("docker", ["rm", cid], { stdio: "ignore" });
     }
-    if (!existsSync52(join9(optDir, "php", "bin", "php")))
+    if (!existsSync52(join92(optDir, "php", "bin", "php")))
       throw new Error("layer build produced no /opt/php/bin/php");
     const entries = [];
     for (const file of walk(optDir)) {
@@ -29480,12 +29495,12 @@ var init_dist2 = __esm(async () => {
         docsPaths = ["docs", "documentation", "doc"]
       } = options;
       for (const docsPath of docsPaths) {
-        const fullPath = join7(projectRoot, docsPath);
-        if (existsSync11(fullPath)) {
+        const fullPath = join9(projectRoot, docsPath);
+        if (existsSync14(fullPath)) {
           const distPaths = ["dist", "build", ".bunpress/dist", "_site", "out", "public"];
           for (const distPath of distPaths) {
-            const fullDistPath = join7(fullPath, distPath);
-            if (existsSync11(fullDistPath)) {
+            const fullDistPath = join9(fullPath, distPath);
+            if (existsSync14(fullDistPath)) {
               try {
                 const files = readdirSync6(fullDistPath);
                 if (files.length > 0) {
@@ -29602,16 +29617,16 @@ var init_dist2 = __esm(async () => {
       const privatePath = paths.private || "private";
       return {
         web: {
-          exists: existsSync11(join7(projectRoot, webPath)),
-          path: join7(projectRoot, webPath)
+          exists: existsSync14(join9(projectRoot, webPath)),
+          path: join9(projectRoot, webPath)
         },
         docs: {
-          exists: existsSync11(join7(projectRoot, docsPath)),
-          path: join7(projectRoot, docsPath)
+          exists: existsSync14(join9(projectRoot, docsPath)),
+          path: join9(projectRoot, docsPath)
         },
         private: {
-          exists: existsSync11(join7(projectRoot, privatePath)),
-          path: join7(projectRoot, privatePath)
+          exists: existsSync14(join9(projectRoot, privatePath)),
+          path: join9(projectRoot, privatePath)
         }
       };
     }
@@ -47221,7 +47236,7 @@ __export(exports_client, {
   AWSClient: () => AWSClient
 });
 import * as crypto2 from "node:crypto";
-import { existsSync as existsSync14, readFileSync as readFileSync8 } from "node:fs";
+import { existsSync as existsSync16, readFileSync as readFileSync8 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
 import { join as join11 } from "node:path";
 function resolveS3Endpoint(options) {
@@ -47282,7 +47297,7 @@ class AWSClient {
   loadCredentialsFromFile() {
     const profile = process.env.AWS_PROFILE || "default";
     const credentialsPath = process.env.AWS_SHARED_CREDENTIALS_FILE || join11(homedir6(), ".aws", "credentials");
-    if (!existsSync14(credentialsPath)) {
+    if (!existsSync16(credentialsPath)) {
       return null;
     }
     try {
@@ -47781,7 +47796,7 @@ function detectCredentialSource() {
   }
   const profile = process.env.AWS_PROFILE || "default";
   const credentialsPath = process.env.AWS_SHARED_CREDENTIALS_FILE || join11(homedir6(), ".aws", "credentials");
-  if (existsSync14(credentialsPath)) {
+  if (existsSync16(credentialsPath)) {
     return {
       source: "file",
       profile,
@@ -50354,8 +50369,8 @@ class CloudFrontClient {
       returnHeaders: true
     });
     const etag = getResult.headers?.etag || getResult.headers?.ETag || "";
-    const currentConfig = getResult.body?.DistributionConfig || getResult.DistributionConfig;
-    if (!currentConfig) {
+    const currentConfig = getResult.body?.DistributionConfig || (getResult.body?.Enabled !== undefined ? getResult.body : undefined) || getResult.DistributionConfig;
+    if (!currentConfig || currentConfig.Enabled === undefined) {
       throw new Error("Failed to get current distribution config");
     }
     if (customErrorResponses.length === 0) {
@@ -50416,8 +50431,8 @@ class CloudFrontClient {
       returnHeaders: true
     });
     const etag = getResult.headers?.etag || getResult.headers?.ETag || "";
-    const currentConfig = getResult.body?.DistributionConfig || getResult.DistributionConfig;
-    if (!currentConfig) {
+    const currentConfig = getResult.body?.DistributionConfig || (getResult.body?.Enabled !== undefined ? getResult.body : undefined) || getResult.DistributionConfig;
+    if (!currentConfig || currentConfig.Enabled === undefined) {
       throw new Error("Failed to get current distribution config");
     }
     if (aliases && aliases.length > 0) {
@@ -51064,8 +51079,8 @@ ${Object.entries(config6).filter(([k]) => !k.startsWith("@_")).map(([key, val])
       returnHeaders: true
     });
     const etag = getResult.headers?.etag || getResult.headers?.ETag || "";
-    const currentConfig = getResult.body?.DistributionConfig || getResult.DistributionConfig;
-    if (!currentConfig) {
+    const currentConfig = getResult.body?.DistributionConfig || (getResult.body?.Enabled !== undefined ? getResult.body : undefined) || getResult.DistributionConfig;
+    if (!currentConfig || currentConfig.Enabled === undefined) {
       throw new Error("Failed to get current distribution config");
     }
     currentConfig.Enabled = false;
@@ -51125,8 +51140,8 @@ ${Object.entries(config6).filter(([k]) => !k.startsWith("@_")).map(([key, val])
       returnHeaders: true
     });
     const etag = getResult.headers?.etag || getResult.headers?.ETag || "";
-    const currentConfig = getResult.body?.DistributionConfig || getResult.DistributionConfig;
-    if (!currentConfig) {
+    const currentConfig = getResult.body?.DistributionConfig || (getResult.body?.Enabled !== undefined ? getResult.body : undefined) || getResult.DistributionConfig;
+    if (!currentConfig || currentConfig.Enabled === undefined) {
       throw new Error("Failed to get current distribution config");
     }
     let items = [];
@@ -58116,14 +58131,14 @@ __export(exports_serverless_image, {
   buildAndPushServerlessImage: () => buildAndPushServerlessImage
 });
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync4, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "node:fs";
+import { mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync4, rmSync as rmSync6, writeFileSync as writeFileSync11 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { dirname as dirname7, join as join15 } from "node:path";
+import { dirname as dirname7, join as join16 } from "node:path";
 function writeEntries(baseDir, entries) {
   for (const e of entries) {
-    const dest = join15(baseDir, e.name);
-    mkdirSync7(dirname7(dest), { recursive: true });
-    writeFileSync10(dest, e.data, e.mode ? { mode: e.mode } : undefined);
+    const dest = join16(baseDir, e.name);
+    mkdirSync8(dirname7(dest), { recursive: true });
+    writeFileSync11(dest, e.data, e.mode ? { mode: e.mode } : undefined);
   }
 }
 async function buildAndPushServerlessImage(opts) {
@@ -58132,10 +58147,10 @@ async function buildAndPushServerlessImage(opts) {
   const platform = arch === "arm64" ? "linux/arm64" : "linux/amd64";
   const isPhp = app.kind === "php";
   const step2 = opts.onStep ?? (() => {});
-  const stage = mkdtempSync4(join15(tmpdir4(), "tscloud-img-"));
+  const stage = mkdtempSync4(join16(tmpdir4(), "tscloud-img-"));
   try {
-    const appDir = join15(stage, "app");
-    mkdirSync7(appDir, { recursive: true });
+    const appDir = join16(stage, "app");
+    mkdirSync8(appDir, { recursive: true });
     let handlers;
     let contentHash;
     if (isPhp) {
@@ -58143,19 +58158,19 @@ async function buildAndPushServerlessImage(opts) {
       step2("staging application tree");
       const entries = collectPhpAppEntries(projectRoot);
       writeEntries(appDir, entries);
-      writeEntries(join15(stage, "runtime"), phpRuntimeLayerAssets().map((a) => ({ name: a.path, data: a.contents, mode: a.mode })));
+      writeEntries(join16(stage, "runtime"), phpRuntimeLayerAssets().map((a) => ({ name: a.path, data: a.contents, mode: a.mode })));
       const handler8 = app.handlers?.http ?? "public/index.php";
       handlers = { http: handler8, queue: app.handlers?.queue ?? handler8, cli: app.handlers?.cli ?? handler8 };
       contentHash = sha256(entries.map((e) => `${e.name}:${e.data.length}`).join("|"));
     } else {
       step2("bundling application");
       const artifact = await packageServerlessApp({ projectRoot, app, skipBuild: opts.skipBuild, onStep: step2 });
-      writeFileSync10(join15(appDir, "index.mjs"), artifact.bundle);
+      writeFileSync11(join16(appDir, "index.mjs"), artifact.bundle);
       handlers = artifact.handlers;
       contentHash = artifact.sha256;
     }
     const tag = contentHash.slice(0, 16);
-    writeFileSync10(join15(stage, "Dockerfile"), generateAppImageDockerfile({
+    writeFileSync11(join16(stage, "Dockerfile"), generateAppImageDockerfile({
       kind: app.kind ?? "node",
       phpVersion: app.phpVersion,
       architecture: arch
@@ -58184,14 +58199,14 @@ async function buildAndPushServerlessImage(opts) {
     if (!data?.authorizationToken || !data.proxyEndpoint)
       throw new Error("failed to get an ECR authorization token");
     const registry = data.proxyEndpoint.replace(/^https?:\/\//, "");
-    const dockerConfig = join15(stage, ".docker");
-    mkdirSync7(dockerConfig, { recursive: true });
-    writeFileSync10(join15(dockerConfig, "config.json"), JSON.stringify({ auths: { [registry]: { auth: data.authorizationToken } } }));
+    const dockerConfig = join16(stage, ".docker");
+    mkdirSync8(dockerConfig, { recursive: true });
+    writeFileSync11(join16(dockerConfig, "config.json"), JSON.stringify({ auths: { [registry]: { auth: data.authorizationToken } } }));
     execFileSync3("docker", ["push", imageUri], { stdio: "inherit", env: { ...process.env, DOCKER_CONFIG: dockerConfig } });
     info(`Image: ${imageUri}`);
     return { imageUri, tag, handlers };
   } finally {
-    rmSync4(stage, { recursive: true, force: true });
+    rmSync6(stage, { recursive: true, force: true });
   }
 }
 var init_serverless_image = __esm(async () => {
@@ -58200,6 +58215,11 @@ var init_serverless_image = __esm(async () => {
   await init_dist2();
 });
 
+// src/config.ts
+import { existsSync as existsSync11 } from "node:fs";
+import { join as join7 } from "node:path";
+import { pathToFileURL } from "node:url";
+
 // ../../node_modules/bunfig/dist/index.js
 import { existsSync, statSync } from "fs";
 import { existsSync as existsSync13, mkdirSync as mkdirSync4, readdirSync as readdirSync4, readFileSync, writeFileSync as writeFileSync7 } from "fs";
@@ -66891,12 +66911,33 @@ var defaultConfig4 = {
   }
 };
 var _config = null;
+function isDefaultConfig(config5) {
+  return config5.project?.slug === defaultConfig4.project?.slug && Object.keys(config5.environments ?? {}).length === 1 && !!config5.environments?.production;
+}
+async function loadStacksCloudConfig() {
+  const candidates = [
+    join7(process.cwd(), "config", "cloud.ts"),
+    join7(process.cwd(), "config", "cloud.js")
+  ];
+  for (const file of candidates) {
+    if (!existsSync11(file))
+      continue;
+    const mod = await import(`${pathToFileURL(file).href}?t=${Date.now()}`);
+    const config5 = mod.tsCloud ?? mod.default?.tsCloud ?? mod.default ?? mod.cloud ?? mod.config;
+    if (config5)
+      return config5;
+  }
+  return null;
+}
 async function getConfig() {
   if (!_config) {
     _config = await loadConfig6({
       name: "cloud",
       defaultConfig: defaultConfig4
     });
+    if (isDefaultConfig(_config)) {
+      _config = await loadStacksCloudConfig() ?? _config;
+    }
   }
   return _config;
 }
@@ -70411,9 +70452,143 @@ init_cloudformation();
 init_client();
 
 // src/aws/cost-explorer-cache.ts
+import { createHash as createHash9 } from "node:crypto";
+import { existsSync as existsSync17, mkdirSync as mkdirSync7, readdirSync as readdirSync8, readFileSync as readFileSync11, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "node:fs";
+import { homedir as homedir7 } from "node:os";
+import { join as join14 } from "node:path";
+var CACHE_SCHEMA_VERSION = 1;
 var HOUR_MS = 60 * 60 * 1000;
 var DAY_MS = 24 * HOUR_MS;
+var OPEN_PERIOD_TTL_MS = HOUR_MS;
 var CLOSED_PERIOD_TTL_MS = 30 * DAY_MS;
+function cacheRoot() {
+  const xdg = process.env.XDG_CACHE_HOME;
+  return join14(xdg && xdg.trim() ? xdg : join14(homedir7(), ".cache"), "ts-cloud", "cost-explorer");
+}
+function profileDir(profile) {
+  return join14(cacheRoot(), profile ?? "__default__");
+}
+function hashKey(key) {
+  const canonical = {
+    s: key.start,
+    e: key.end,
+    g: key.granularity,
+    m: [...key.metrics].sort(),
+    gb: [...key.groupBy].map((g) => `${g.Type}:${g.Key}`).sort()
+  };
+  return createHash9("sha256").update(JSON.stringify(canonical)).digest("hex").slice(0, 24);
+}
+function isClosedPeriod(start, end) {
+  const endTs = Date.parse(`${end}T00:00:00Z`);
+  if (Number.isNaN(endTs))
+    return false;
+  const now = new Date;
+  const firstOfThisMonth = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1);
+  return endTs <= firstOfThisMonth;
+}
+function ttlForPeriod(key) {
+  return isClosedPeriod(key.start, key.end) ? CLOSED_PERIOD_TTL_MS : OPEN_PERIOD_TTL_MS;
+}
+function loadCache(profile, key) {
+  const file = join14(profileDir(profile), `${hashKey(key)}.json`);
+  if (!existsSync17(file))
+    return null;
+  let entry;
+  try {
+    entry = JSON.parse(readFileSync11(file, "utf-8"));
+  } catch {
+    return null;
+  }
+  if (entry.schema !== CACHE_SCHEMA_VERSION)
+    return null;
+  const ageMs = Date.now() - entry.savedAt;
+  if (ageMs < 0 || ageMs > ttlForPeriod(key))
+    return null;
+  return { response: entry.response, ageSeconds: Math.floor(ageMs / 1000) };
+}
+function saveCache(profile, key, response) {
+  const dir = profileDir(profile);
+  mkdirSync7(dir, { recursive: true });
+  const entry = {
+    schema: CACHE_SCHEMA_VERSION,
+    savedAt: Date.now(),
+    key,
+    response
+  };
+  writeFileSync10(join14(dir, `${hashKey(key)}.json`), JSON.stringify(entry));
+}
+
+// src/aws/cost-explorer.ts
+class CostExplorerClient {
+  client;
+  profile;
+  useCache;
+  lastCacheAgeSeconds = null;
+  constructor(profile, options) {
+    this.profile = profile;
+    this.useCache = options?.useCache ?? true;
+    this.client = new AWSClient(resolveCredentials2(profile));
+  }
+  async getCostByService(params) {
+    const { start, end, granularity = "MONTHLY" } = params;
+    const metrics = ["UnblendedCost"];
+    const groupBy = [{ Type: "DIMENSION", Key: "SERVICE" }];
+    const cacheKey = { start, end, granularity, metrics, groupBy };
+    if (this.useCache) {
+      const hit = loadCache(this.profile, cacheKey);
+      if (hit) {
+        this.lastCacheAgeSeconds = hit.ageSeconds;
+        return hit.response;
+      }
+    }
+    this.lastCacheAgeSeconds = null;
+    const result = await this.client.request({
+      service: "ce",
+      region: "us-east-1",
+      method: "POST",
+      path: "/",
+      headers: {
+        "content-type": "application/x-amz-json-1.1",
+        "x-amz-target": "AWSInsightsIndexService.GetCostAndUsage"
+      },
+      body: JSON.stringify({
+        TimePeriod: { Start: start, End: end },
+        Granularity: granularity,
+        Metrics: metrics,
+        GroupBy: groupBy
+      })
+    });
+    const groups = result?.ResultsByTime?.[0]?.Groups ?? [];
+    const services = groups.map((g) => ({
+      service: g.Keys?.[0] ?? "Unknown",
+      amount: Number.parseFloat(g.Metrics?.UnblendedCost?.Amount ?? "0"),
+      unit: g.Metrics?.UnblendedCost?.Unit ?? "USD"
+    })).filter((g) => g.amount > 0).sort((a, b) => b.amount - a.amount);
+    if (this.useCache) {
+      saveCache(this.profile, cacheKey, services);
+    }
+    return services;
+  }
+  async getDailyTotals(params) {
+    const result = await this.client.request({
+      service: "ce",
+      region: "us-east-1",
+      method: "POST",
+      path: "/",
+      headers: {
+        "content-type": "application/x-amz-json-1.1",
+        "x-amz-target": "AWSInsightsIndexService.GetCostAndUsage"
+      },
+      body: JSON.stringify({
+        TimePeriod: { Start: params.start, End: params.end },
+        Granularity: "DAILY",
+        Metrics: ["UnblendedCost"]
+      })
+    });
+    const byTime = result?.ResultsByTime ?? [];
+    return byTime.map((t) => Number.parseFloat(t.Total?.UnblendedCost?.Amount ?? "0"));
+  }
+}
 // src/aws/ec2.ts
 init_client();
 
@@ -78946,7 +79121,7 @@ class ApplicationAutoScalingClient {
 init_s3();
 import * as net from "node:net";
 import * as tls from "node:tls";
-import { readFileSync as readFileSync11 } from "node:fs";
+import { readFileSync as readFileSync12 } from "node:fs";
 import * as crypto4 from "node:crypto";
 
 class ImapServer {
@@ -78981,8 +79156,8 @@ class ImapServer {
     });
     if (this.config.tls?.key && this.config.tls?.cert) {
       const tlsOptions = {
-        key: readFileSync11(this.config.tls.key),
-        cert: readFileSync11(this.config.tls.cert)
+        key: readFileSync12(this.config.tls.key),
+        cert: readFileSync12(this.config.tls.cert)
       };
       this.tlsServer = tls.createServer(tlsOptions, (socket) => {
         this.handleConnection(socket);
@@ -79786,8 +79961,8 @@ class ImapServer {
     }
     this.send(session, `${tag} OK Begin TLS negotiation`);
     const tlsOptions = {
-      key: readFileSync11(this.config.tls.key),
-      cert: readFileSync11(this.config.tls.cert),
+      key: readFileSync12(this.config.tls.key),
+      cert: readFileSync12(this.config.tls.cert),
       isServer: true
     };
     const tlsSocket = new tls.TLSSocket(session.socket, tlsOptions);
@@ -80380,7 +80555,7 @@ init_ses();
 init_s3();
 import * as net2 from "node:net";
 import * as tls2 from "node:tls";
-import { readFileSync as readFileSync12 } from "node:fs";
+import { readFileSync as readFileSync13 } from "node:fs";
 import * as crypto5 from "node:crypto";
 
 class SmtpServer {
@@ -80411,8 +80586,8 @@ class SmtpServer {
     });
     if (this.config.tls?.key && this.config.tls?.cert) {
       const tlsOptions = {
-        key: readFileSync12(this.config.tls.key),
-        cert: readFileSync12(this.config.tls.cert)
+        key: readFileSync13(this.config.tls.key),
+        cert: readFileSync13(this.config.tls.cert)
       };
       this.tlsServer = tls2.createServer(tlsOptions, (socket) => {
         this.handleConnection(socket, true);
@@ -80546,8 +80721,8 @@ class SmtpServer {
     }
     this.send(session, "220 Ready to start TLS");
     const tlsOptions = {
-      key: readFileSync12(this.config.tls.key),
-      cert: readFileSync12(this.config.tls.cert),
+      key: readFileSync13(this.config.tls.key),
+      cert: readFileSync13(this.config.tls.cert),
       isServer: true
     };
     const tlsSocket = new tls2.TLSSocket(session.socket, tlsOptions);
@@ -82896,7 +83071,7 @@ function needsRenewal(certPath) {
   }
 }
 // src/ssl/acme-client.ts
-import { createHash as createHash9, createSign, generateKeyPairSync } from "node:crypto";
+import { createHash as createHash10, createSign, generateKeyPairSync } from "node:crypto";
 var ACME_DIRECTORIES = {
   production: "https://acme-v02.api.letsencrypt.org/directory",
   staging: "https://acme-staging-v02.api.letsencrypt.org/directory"
@@ -82966,7 +83141,7 @@ class AcmeClient {
       x: jwk.x,
       y: jwk.y
     });
-    const hash2 = createHash9("sha256").update(canonical).digest();
+    const hash2 = createHash10("sha256").update(canonical).digest();
     return this.base64UrlEncode(hash2);
   }
   base64UrlEncode(data) {
@@ -83079,7 +83254,7 @@ class AcmeClient {
           identifier: `/.well-known/acme-challenge/${c.token}`
         };
       } else {
-        const dnsValue = this.base64UrlEncode(createHash9("sha256").update(keyAuthorization).digest());
+        const dnsValue = this.base64UrlEncode(createHash10("sha256").update(keyAuthorization).digest());
         return {
           type: "dns-01",
           token: c.token,
@@ -83167,6 +83342,8 @@ function resolveSiteDeployTarget(site) {
   return "bucket";
 }
 function resolveSiteKind(site) {
+  if (site.redirect)
+    return "redirect";
   if (isPhpSite(site))
     return "server-php";
   const target = resolveSiteDeployTarget(site);
@@ -83189,6 +83366,24 @@ function validateDeploymentConfig(config6) {
     }
     const target = resolveSiteDeployTarget(site);
     const kind = resolveSiteKind(site);
+    if (kind === "redirect") {
+      if (!site.domain)
+        errors.push(`Site '${name}' is a redirect site but has no \`domain\` to redirect from.`);
+      const to = typeof site.redirect === "string" ? site.redirect : site.redirect?.to;
+      if (!to)
+        errors.push(`Site '${name}' is a redirect site but has no redirect target (\`redirect\` / \`redirect.to\`).`);
+      if (!computeConfigured) {
+        errors.push(`Site '${name}' is a redirect site but no \`infrastructure.compute\` is configured to host the gateway that serves the redirect.`);
+      }
+      const serverOnly = [];
+      if (site.start)
+        serverOnly.push("start");
+      if (site.root)
+        serverOnly.push("root");
+      if (serverOnly.length > 0)
+        warnings.push(`Site '${name}' is a redirect site but also sets ${serverOnly.join(", ")}. These are ignored.`);
+      continue;
+    }
     if (target === "server" && !site.start && !site.root) {
       errors.push(`Site '${name}' sets deploy:'server' but declares neither \`start\` (dynamic app) nor \`root\` (static site to serve). Add one.`);
       continue;
@@ -83245,12 +83440,12 @@ init_static_site_external_dns();
 // src/deploy/static-site-helper.ts
 init_static_site_external_dns();
 import process19 from "node:process";
-import { existsSync as existsSync16 } from "node:fs";
-import { join as join14 } from "node:path";
+import { existsSync as existsSync18 } from "node:fs";
+import { join as join15 } from "node:path";
 async function deploySite(config6) {
   const start = Date.now();
   const sourceDir = config6.sourceDir ?? "dist";
-  if (!existsSync16(join14(sourceDir, "index.html"))) {
+  if (!existsSync18(join15(sourceDir, "index.html"))) {
     return fail(start, `${sourceDir}/ has no index.html — build first.`);
   }
   if (!process19.env.AWS_ACCESS_KEY_ID || !process19.env.AWS_SECRET_ACCESS_KEY) {
@@ -83321,8 +83516,8 @@ function fail(start, message) {
 // src/deploy/serverless-app.ts
 init_cloudformation();
 await init_dist2();
-import { existsSync as existsSync17, readdirSync as readdirSync8, readFileSync as readFileSync13, statSync as statSync5 } from "node:fs";
-import { join as join16, relative as relative6 } from "node:path";
+import { existsSync as existsSync19, readdirSync as readdirSync9, readFileSync as readFileSync14, statSync as statSync5 } from "node:fs";
+import { join as join17, relative as relative6 } from "node:path";
 init_s3();
 init_cli();
 function resolveContext(config6, environment) {
@@ -83461,8 +83656,8 @@ function contentType(file) {
   return map[ext] ?? "application/octet-stream";
 }
 function* walk3(dir) {
-  for (const entry of readdirSync8(dir)) {
-    const full = join16(dir, entry);
+  for (const entry of readdirSync9(dir)) {
+    const full = join17(dir, entry);
     if (statSync5(full).isDirectory())
       yield* walk3(full);
     else
@@ -83478,7 +83673,7 @@ async function uploadAssets(s32, bucket, dir, prefix, includeDotfiles = false) {
     await s32.putObject({
       bucket,
       key: `${prefix}/${rel}`,
-      body: readFileSync13(file),
+      body: readFileSync14(file),
       contentType: contentType(file),
       cacheControl: "public, max-age=31536000, immutable"
     });
@@ -83610,8 +83805,8 @@ async function deployServerlessApp(config6, environment, opts = {}) {
   const outputs = await cfn.getStackOutputs(stackName).catch(() => ({}));
   let assetUrl;
   if (app.assets) {
-    const assetsDir3 = join16(projectRoot, app.assets);
-    if (existsSync17(assetsDir3)) {
+    const assetsDir3 = join17(projectRoot, app.assets);
+    if (existsSync19(assetsDir3)) {
       const cdn = app.assetDomain || outputs.AssetsCdnDomain;
       assetUrl = cdn ? `https://${cdn}/${artifactSha}` : undefined;
       step(`Syncing assets from ${app.assets}`);
@@ -83791,6 +83986,54 @@ async function runRemoteCommand(config6, environment, command) {
     throw new Error(`Command failed: ${res.Payload}`);
   return res.Payload ?? "";
 }
+async function serverlessInfo(config6, environment) {
+  const ctx = resolveContext(config6, environment);
+  const cf = new CloudFormationClient(ctx.region);
+  const lambda2 = new LambdaClient(ctx.region);
+  const s32 = new S3Client2(ctx.region);
+  let stackStatus = "not deployed";
+  const outputs = {};
+  try {
+    const { Stacks } = await cf.describeStacks({ stackName: ctx.stackName });
+    stackStatus = Stacks?.[0]?.StackStatus ?? stackStatus;
+    for (const o of Stacks?.[0]?.Outputs ?? [])
+      if (o.OutputKey)
+        outputs[o.OutputKey] = o.OutputValue ?? "";
+  } catch {}
+  const queues = resolveQueueNames(ctx.app, ctx.slug, environment);
+  const pc = ctx.app.provisionedConcurrency ?? 0;
+  const modes = ["http", "cli", ...queues.length ? ["queue"] : []];
+  const base = `${ctx.slug}-${environment}`;
+  const functions = [];
+  for (const mode of modes) {
+    const name = `${base}-${mode}`;
+    const info2 = { mode, name, version: "$LATEST" };
+    if (pc > 0) {
+      const alias = await lambda2.getAlias(name, "live").catch(() => null);
+      if (alias?.FunctionVersion) {
+        info2.version = alias.FunctionVersion;
+        const pcc = await lambda2.getProvisionedConcurrencyConfig(name, "live").catch(() => null);
+        if (pcc)
+          info2.provisioned = { status: pcc.Status ?? "-", allocated: pcc.AllocatedProvisionedConcurrentExecutions ?? 0, requested: pcc.RequestedProvisionedConcurrentExecutions ?? 0 };
+      }
+    }
+    functions.push(info2);
+  }
+  const release = await readRelease(s32, ctx.artifactBucket, ctx.slug, environment).catch(() => null);
+  return {
+    slug: ctx.slug,
+    environment,
+    region: ctx.region,
+    stackStatus,
+    endpoint: outputs.HttpApiEndpoint,
+    assetUrl: release?.assetUrl,
+    scheduler: ctx.app.scheduler ?? "on",
+    queues,
+    provisionedConcurrency: pc,
+    functions,
+    lastRelease: release ? { sha: release.sha, timestamp: release.timestamp } : undefined
+  };
+}
 
 // src/deploy/index.ts
 await init_serverless_image();
@@ -83802,18 +84045,496 @@ await init_dist2();
 // src/aws/cloudwatch.ts
 init_client();
 
+class CloudWatchClient {
+  client;
+  region;
+  constructor(region = "us-east-1") {
+    this.region = region;
+    this.client = new AWSClient;
+  }
+  async query(params) {
+    const body = new URLSearchParams(buildQueryParams({ Version: "2010-08-01", ...params })).toString();
+    return this.client.request({
+      service: "monitoring",
+      region: this.region,
+      method: "POST",
+      path: "/",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body
+    });
+  }
+  async getMetricStatistics(options) {
+    const params = {
+      Action: "GetMetricStatistics",
+      Namespace: options.Namespace,
+      MetricName: options.MetricName,
+      StartTime: options.StartTime.toISOString(),
+      EndTime: options.EndTime.toISOString(),
+      Period: options.Period
+    };
+    (options.Statistics ?? []).forEach((s, i) => {
+      params[`Statistics.member.${i + 1}`] = s;
+    });
+    (options.ExtendedStatistics ?? []).forEach((s, i) => {
+      params[`ExtendedStatistics.member.${i + 1}`] = s;
+    });
+    (options.Dimensions ?? []).forEach((d, i) => {
+      params[`Dimensions.member.${i + 1}.Name`] = d.Name;
+      params[`Dimensions.member.${i + 1}.Value`] = d.Value;
+    });
+    const result = await this.query(params);
+    const response = result.GetMetricStatisticsResult || result;
+    let points = response?.Datapoints?.member ?? [];
+    if (!Array.isArray(points))
+      points = points ? [points] : [];
+    return points.map((p) => {
+      const percentiles = {};
+      let entries = p.ExtendedStatistics?.entry;
+      if (entries) {
+        if (!Array.isArray(entries))
+          entries = [entries];
+        for (const e of entries)
+          if (e?.key != null)
+            percentiles[e.key] = Number(e.value);
+      }
+      return {
+        Timestamp: p.Timestamp,
+        Sum: p.Sum != null ? Number(p.Sum) : undefined,
+        Average: p.Average != null ? Number(p.Average) : undefined,
+        Maximum: p.Maximum != null ? Number(p.Maximum) : undefined,
+        Minimum: p.Minimum != null ? Number(p.Minimum) : undefined,
+        Percentiles: Object.keys(percentiles).length ? percentiles : undefined,
+        Unit: p.Unit
+      };
+    });
+  }
+  async getMetricSeries(options) {
+    const isPct = /^p\d/.test(options.Stat);
+    const pts = await this.getMetricStatistics({
+      Namespace: options.Namespace,
+      MetricName: options.MetricName,
+      Dimensions: options.Dimensions,
+      StartTime: options.StartTime,
+      EndTime: options.EndTime,
+      Period: options.Period,
+      Statistics: isPct ? [] : [options.Stat],
+      ExtendedStatistics: isPct ? [options.Stat] : []
+    });
+    return pts.slice().sort((a, b) => new Date(a.Timestamp ?? 0).getTime() - new Date(b.Timestamp ?? 0).getTime()).map((p) => isPct ? p.Percentiles?.[options.Stat] ?? 0 : p[options.Stat] ?? 0);
+  }
+  async describeAlarms(options) {
+    const params = { Action: "DescribeAlarms" };
+    if (options?.AlarmNamePrefix)
+      params.AlarmNamePrefix = options.AlarmNamePrefix;
+    if (options?.MaxRecords)
+      params.MaxRecords = options.MaxRecords;
+    const result = await this.query(params);
+    const response = result.DescribeAlarmsResult || result;
+    let alarms = response?.MetricAlarms?.member ?? [];
+    if (!Array.isArray(alarms))
+      alarms = alarms ? [alarms] : [];
+    return alarms.map((a) => ({
+      AlarmName: a.AlarmName,
+      StateValue: a.StateValue,
+      MetricName: a.MetricName,
+      ComparisonOperator: a.ComparisonOperator,
+      Threshold: a.Threshold != null ? Number(a.Threshold) : undefined,
+      Namespace: a.Namespace
+    }));
+  }
+  async putMetricAlarm(options) {
+    const params = {
+      Action: "PutMetricAlarm",
+      AlarmName: options.AlarmName,
+      Namespace: options.Namespace,
+      MetricName: options.MetricName,
+      ComparisonOperator: options.ComparisonOperator,
+      Threshold: options.Threshold,
+      EvaluationPeriods: options.EvaluationPeriods,
+      Period: options.Period,
+      Statistic: options.Statistic
+    };
+    if (options.AlarmDescription)
+      params.AlarmDescription = options.AlarmDescription;
+    (options.Dimensions ?? []).forEach((d, i) => {
+      params[`Dimensions.member.${i + 1}.Name`] = d.Name;
+      params[`Dimensions.member.${i + 1}.Value`] = d.Value;
+    });
+    (options.AlarmActions ?? []).forEach((a, i) => {
+      params[`AlarmActions.member.${i + 1}`] = a;
+    });
+    await this.query(params);
+  }
+}
+
 // src/deploy/dashboard-data.ts
 init_s3();
 
 // src/aws/wafv2.ts
 init_client();
+
+class WAFv2Client {
+  client;
+  region;
+  constructor(region = "us-east-1") {
+    this.region = region;
+    this.client = new AWSClient;
+  }
+  async call(target, body) {
+    return this.client.request({
+      service: "wafv2",
+      region: this.region,
+      method: "POST",
+      path: "/",
+      headers: { "Content-Type": "application/x-amz-json-1.1", "X-Amz-Target": `AWSWAF_20190729.${target}` },
+      body: JSON.stringify(body)
+    });
+  }
+  async listWebACLs(scope = "REGIONAL") {
+    const r = await this.call("ListWebACLs", { Scope: scope, Limit: 100 });
+    return r?.WebACLs ?? [];
+  }
+  async getWebACLRules(name, id, scope = "REGIONAL") {
+    const r = await this.call("GetWebACL", { Name: name, Id: id, Scope: scope });
+    const rules = r?.WebACL?.Rules ?? [];
+    return rules.map((rule) => ({
+      Name: rule.Name,
+      Priority: rule.Priority,
+      Action: rule.Action ? Object.keys(rule.Action)[0] : rule.OverrideAction ? Object.keys(rule.OverrideAction)[0] : "count"
+    }));
+  }
+}
+
+// src/deploy/dashboard-data.ts
+function pad(n) {
+  return String(n).padStart(2, "0");
+}
+function isoDate(d) {
+  return `${d.getUTCFullYear()}-${pad(d.getUTCMonth() + 1)}-${pad(d.getUTCDate())}`;
+}
+function relativeLogTime(ms) {
+  const seconds = Math.max(0, Math.round((Date.now() - ms) / 1000));
+  if (seconds < 60)
+    return `${seconds}s ago`;
+  const minutes = Math.round(seconds / 60);
+  if (minutes < 60)
+    return `${minutes}m ago`;
+  const hours = Math.round(minutes / 60);
+  if (hours < 48)
+    return `${hours}h ago`;
+  return `${Math.round(hours / 24)}d ago`;
+}
+async function lambdaMetric(cw, fn, name, kind, start, end) {
+  const pts = await cw.getMetricStatistics({
+    Namespace: "AWS/Lambda",
+    MetricName: name,
+    Dimensions: [{ Name: "FunctionName", Value: fn }],
+    StartTime: start,
+    EndTime: end,
+    Period: 86400,
+    Statistics: [kind]
+  }).catch(() => []);
+  if (!pts.length)
+    return 0;
+  if (kind === "Sum")
+    return pts.reduce((n, p) => n + (p.Sum ?? 0), 0);
+  if (kind === "Maximum")
+    return Math.max(...pts.map((p) => p.Maximum ?? 0));
+  return pts.reduce((n, p) => n + (p.Average ?? 0), 0) / pts.length;
+}
+async function cwMetric(cw, namespace, name, dims, kind, start, end) {
+  const pts = await cw.getMetricStatistics({ Namespace: namespace, MetricName: name, Dimensions: dims, StartTime: start, EndTime: end, Period: 86400, Statistics: [kind] }).catch(() => []);
+  if (!pts.length)
+    return 0;
+  if (kind === "Sum")
+    return pts.reduce((n, p) => n + (p.Sum ?? 0), 0);
+  if (kind === "Maximum")
+    return Math.max(...pts.map((p) => p.Maximum ?? 0));
+  return pts.reduce((n, p) => n + (p.Average ?? 0), 0) / pts.length;
+}
+async function durationPct(cw, fn, p, start, end) {
+  const pts = await cw.getMetricStatistics({
+    Namespace: "AWS/Lambda",
+    MetricName: "Duration",
+    Dimensions: [{ Name: "FunctionName", Value: fn }],
+    StartTime: start,
+    EndTime: end,
+    Period: 86400,
+    ExtendedStatistics: [p]
+  }).catch(() => []);
+  return Math.round(pts.reduce((n, x) => n + (x.Percentiles?.[p] ?? 0), 0));
+}
+async function resolveDashboardData(config6, environment) {
+  const info2 = await serverlessInfo(config6, environment);
+  const region = info2.region;
+  const cw = new CloudWatchClient(region);
+  const lambda2 = new LambdaClient(region);
+  const logs = new CloudWatchLogsClient(region);
+  const end = new Date;
+  const start = new Date(end.getTime() - 86400000);
+  const app = config6.environments?.[environment]?.app;
+  const out = {};
+  out.app = {
+    name: info2.slug,
+    env: environment,
+    region,
+    runtime: app?.kind === "php" ? `php-${app?.phpVersion ?? "8.3"} (fpm)` : app?.kind ?? "node",
+    url: info2.endpoint ?? "",
+    build: info2.lastRelease?.sha?.slice(0, 7) ?? "—",
+    deployedAt: info2.lastRelease?.timestamp ?? "—"
+  };
+  out.maintenance = { enabled: false };
+  out.scheduler = { enabled: info2.scheduler !== "off", expression: info2.scheduler === "sub-minute" ? "rate(1 minute) · sub-minute" : "rate(1 minute)", lastRun: "—" };
+  let totalInvocations = 0, totalErrors = 0, maxDur = 0;
+  const fns = [];
+  const fnsDetail = [];
+  const serverlessLogs = [];
+  for (const f of info2.functions) {
+    const [invocations, errors, throttles, durAvg, cfg, p50, p95, p99, spark] = await Promise.all([
+      lambdaMetric(cw, f.name, "Invocations", "Sum", start, end),
+      lambdaMetric(cw, f.name, "Errors", "Sum", start, end),
+      lambdaMetric(cw, f.name, "Throttles", "Sum", start, end),
+      lambdaMetric(cw, f.name, "Duration", "Average", start, end),
+      lambda2.getFunction(f.name).catch(() => null),
+      durationPct(cw, f.name, "p50", start, end),
+      durationPct(cw, f.name, "p95", start, end),
+      durationPct(cw, f.name, "p99", start, end),
+      cw.getMetricSeries({ Namespace: "AWS/Lambda", MetricName: "Invocations", Dimensions: [{ Name: "FunctionName", Value: f.name }], StartTime: new Date(end.getTime() - 12 * 3600000), EndTime: end, Period: 3600, Stat: "Sum" }).catch(() => [])
+    ]);
+    totalInvocations += invocations;
+    totalErrors += errors;
+    maxDur = Math.max(maxDur, durAvg);
+    const memory = cfg?.Configuration?.MemorySize ?? 0;
+    const env2 = Object.keys(cfg?.Configuration?.Environment?.Variables ?? {});
+    let recent = [];
+    let maxMem = 0;
+    try {
+      const { events = [] } = await logs.filterLogEvents({ logGroupName: `/aws/lambda/${f.name}`, startTime: start.getTime(), limit: 120 });
+      for (const e of events) {
+        const msg = (e.message ?? "").trim();
+        const mm = /Max Memory Used:\s*(\d+)\s*MB/.exec(msg);
+        if (mm)
+          maxMem = Math.max(maxMem, Number(mm[1]));
+        if (msg && !/^(?:START|END|REPORT|INIT_START)/.test(msg)) {
+          serverlessLogs.push({
+            source: f.mode || f.name,
+            timestamp: new Date(e.timestamp ?? 0).toISOString(),
+            when: relativeLogTime(e.timestamp ?? 0),
+            message: msg.slice(0, 400),
+            level: /error|exception|fatal|panic|traceback/i.test(msg) ? "error" : /warn|warning|timeout|retr(?:y|ies)|throttl/i.test(msg) ? "warn" : "info"
+          });
+        }
+      }
+      recent = events.filter((e) => !/^(?:START|END|REPORT|INIT_START)/.test((e.message ?? "").trim())).slice(-6).map((e) => ({ ts: new Date(e.timestamp ?? 0).toISOString().slice(11, 19), msg: (e.message ?? "").trim().slice(0, 120), err: /error|exception|fatal/i.test(e.message ?? "") }));
+    } catch {}
+    const maxSpark = Math.max(1, ...spark);
+    fns.push({ key: f.mode, name: f.name, version: f.version, memory, timeout: cfg?.Configuration?.Timeout ?? 0, runtime: cfg?.Configuration?.Runtime ?? "provided.al2023", invocations: Math.round(invocations), errors: Math.round(errors), p95: p95 || Math.round(durAvg), status: "active", provisioned: f.provisioned ? `${f.provisioned.allocated}/${f.provisioned.requested}` : undefined });
+    fnsDetail.push({
+      key: f.mode,
+      name: f.name,
+      runtime: cfg?.Configuration?.Runtime ?? "provided.al2023",
+      arch: cfg?.Configuration?.Architectures?.[0] ?? "x86_64",
+      memory,
+      timeout: cfg?.Configuration?.Timeout ?? 0,
+      ephemeral: cfg?.Configuration?.EphemeralStorage?.Size ?? 512,
+      version: f.version,
+      concurrency: app?.concurrency ?? "—",
+      invocations: Math.round(invocations),
+      errors: Math.round(errors),
+      throttles: Math.round(throttles),
+      p50: p50 || Math.round(durAvg),
+      p95: p95 || Math.round(durAvg),
+      p99: p99 || Math.round(durAvg),
+      maxMem,
+      spark: spark.length ? spark.map((v) => Math.round(v / maxSpark * 100)) : [0],
+      env: env2.length ? env2 : ["(none)"],
+      recent: recent.length ? recent : [{ ts: "—", msg: "no recent events", err: false }]
+    });
+  }
+  out.functions = fns;
+  out.functionsDetail = fnsDetail;
+  out.serverlessLogs = serverlessLogs.sort((a, b) => String(b.timestamp).localeCompare(String(a.timestamp))).slice(0, 600);
+  out.serverlessLogsEmptyReason = serverlessLogs.length ? undefined : "No recent function logs were found in CloudWatch for this environment.";
+  const errorRatePct = totalInvocations ? Number((totalErrors / totalInvocations * 100).toFixed(2)) : 0;
+  const concurrency = Math.round(await lambdaMetric(cw, info2.functions[0]?.name ?? "", "ConcurrentExecutions", "Maximum", start, end));
+  out.metrics = { invocations: Math.round(totalInvocations), errorRatePct, p95Ms: Math.round(maxDur), coldStartPct: 0, concurrency, estCostUsd: 0 };
+  try {
+    const sqs2 = new SQSClient(region);
+    const overview = [];
+    const detail = [];
+    let dlqDepth = 0;
+    try {
+      const { QueueUrl } = await sqs2.getQueueUrl(`${info2.slug}-${environment}-dlq`);
+      const { Attributes } = await sqs2.getQueueAttributes(QueueUrl);
+      dlqDepth = Number(Attributes.ApproximateNumberOfMessages ?? 0);
+    } catch {}
+    const resolvedQueues = app ? resolveQueues(app, info2.slug, environment) : [];
+    for (const q of resolvedQueues) {
+      const short = q.name.replace(`${info2.slug}-${environment}-`, "");
+      let visible = 0, inFlight = 0;
+      try {
+        const { QueueUrl } = await sqs2.getQueueUrl(q.name);
+        const { Attributes } = await sqs2.getQueueAttributes(QueueUrl);
+        visible = Number(Attributes.ApproximateNumberOfMessages ?? 0);
+        inFlight = Number(Attributes.ApproximateNumberOfMessagesNotVisible ?? 0);
+      } catch {}
+      const processed = Math.round(await cwMetric(cw, "AWS/SQS", "NumberOfMessagesDeleted", [{ Name: "QueueName", Value: q.name }], "Sum", start, end));
+      overview.push({ name: short, visible, inFlight, processed, dlq: dlqDepth });
+      detail.push({ name: q.name, short, visible, inFlight, delayed: 0, processed, oldestSec: 0, concurrency: q.concurrency ?? app?.queueConcurrency ?? "—", tries: app?.queueTries ?? 3, visTimeout: (app?.queueTimeout ?? 120) * 6, dlq: dlqDepth });
+    }
+    if (overview.length)
+      out.queues = overview;
+    if (detail.length)
+      out.queuesDetail = detail;
+    out.dlqItems = [];
+  } catch {}
+  try {
+    const cf = new CloudFormationClient(region);
+    const { Stacks } = await cf.describeStacks({ stackName: resolveServerlessAppStackName(config6, environment) });
+    const outputs = {};
+    for (const o of Stacks?.[0]?.Outputs ?? [])
+      if (o.OutputKey)
+        outputs[o.OutputKey] = o.OutputValue ?? "";
+    if (app?.database?.connection === "aurora-serverless") {
+      const clusterId = `${info2.slug}-${environment}-db`;
+      const dim4 = [{ Name: "DBClusterIdentifier", Value: clusterId }];
+      const [acu, conns] = await Promise.all([
+        cwMetric(cw, "AWS/RDS", "ServerlessDatabaseCapacity", dim4, "Average", start, end),
+        cwMetric(cw, "AWS/RDS", "DatabaseConnections", dim4, "Maximum", start, end)
+      ]);
+      out.aurora = { id: clusterId, engine: "aurora-mysql", minAcu: app?.database?.minCapacity ?? 0.5, maxAcu: app?.database?.maxCapacity ?? 4, currentAcu: acu ? Number(acu.toFixed(1)) : app?.database?.minCapacity ?? 0.5, database: "app", connections: Math.round(conns), status: outputs.DbEndpoint ? "available" : "creating" };
+      if (app?.rdsProxy)
+        out.proxy = { name: `${info2.slug}-${environment}-proxy`, endpoint: outputs.DbProxyEndpoint ?? "—", pooledConns: Math.round(conns), status: "available" };
+    }
+    if (app?.cache?.driver === "elasticache") {
+      const rgId = `${info2.slug}-${environment}-cache`;
+      const dim4 = [{ Name: "CacheClusterId", Value: `${rgId}-001` }];
+      const [hits, misses] = await Promise.all([
+        cwMetric(cw, "AWS/ElastiCache", "CacheHits", dim4, "Sum", start, end),
+        cwMetric(cw, "AWS/ElastiCache", "CacheMisses", dim4, "Sum", start, end)
+      ]);
+      const hitRate = hits + misses > 0 ? Number((hits / (hits + misses) * 100).toFixed(1)) : 0;
+      out.redis = { id: rgId, node: "cache.t4g.micro", engine: "redis", hitRate, status: outputs.CacheEndpoint ? "available" : "creating" };
+    }
+    if (app?.efs) {
+      let sizeMb = 0;
+      try {
+        if (outputs.EfsFileSystemId) {
+          const efs2 = new EFSClient(region);
+          const { FileSystems } = await efs2.describeFileSystems({ FileSystemId: outputs.EfsFileSystemId });
+          sizeMb = Number(((FileSystems?.[0]?.SizeInBytes?.Value ?? 0) / 1048576).toFixed(1));
+        }
+      } catch {}
+      out.efs = { id: outputs.EfsFileSystemId ?? "efs", mount: "/mnt/local", sizeMb, status: "available" };
+    }
+    out.assetsInfo = outputs.AssetsCdnDomain ? { bucket: outputs.AssetsBucketName ?? `${info2.slug}-${environment}-assets`, cdn: outputs.AssetsCdnDomain, customDomain: app?.assetDomain ?? "—", assetUrl: info2.assetUrl ?? "—", files: 0, sizeMb: 0, cacheHitPct: 0, build: out.app.build } : undefined;
+  } catch {}
+  if (out.assetsInfo) {
+    try {
+      const s32 = new S3Client2(region);
+      const objs = await s32.list({ bucket: out.assetsInfo.bucket, maxKeys: 1000 });
+      out.assetsInfo.files = objs.length;
+      out.assetsInfo.sizeMb = Number((objs.reduce((n, o) => n + (o.Size ?? 0), 0) / 1048576).toFixed(1));
+      out.assetsRecent = objs.slice(0, 8).map((o) => ({ path: `/${o.Key}`, size: `${Math.max(1, Math.round((o.Size ?? 0) / 1024))} KB`, type: o.Key.split(".").pop() ?? "" }));
+    } catch {}
+  }
+  try {
+    if (app?.secrets) {
+      const list = Array.isArray(app.secrets) ? app.secrets.map((s) => ({ key: s.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g, "_"), source: s })) : Object.entries(app.secrets).map(([k, v]) => ({ key: k, source: String(v) }));
+      out.secretsList = list.map((s) => ({ ...s, updated: "—" }));
+    }
+  } catch {}
+  try {
+    const s32 = new S3Client2(region);
+    const bucket = `${info2.slug}-${environment}-deployments`;
+    const hist = await s32.getObjectJson(bucket, `deployments/${info2.slug}/${environment}/history.json`).catch(() => null);
+    if (hist?.records?.length) {
+      out.deploymentsDetail = hist.records.slice(-12).reverse().map((r) => ({ sha: (r.sha ?? "").slice(0, 7), status: r.status ?? "success", when: r.timestamp ?? "—", took: r.took ?? "—", by: r.by ?? "—", version: r.version ?? "—", hooks: r.hooks ?? [] }));
+    }
+  } catch {}
+  out.metricsTotals = { invocations: out.metrics.invocations, errors: Math.round(totalErrors), errorRatePct, p95Ms: out.metrics.p95Ms, throttles: fnsDetail.reduce((n, f) => n + f.throttles, 0), coldStartPct: 0, estCostUsd: 0, concurrency };
+  out.metricsPerFn = fnsDetail.map((f) => ({ key: f.key, invocations: f.invocations, errors: f.errors, throttles: f.throttles, avgMs: f.p50, maxMs: f.p99, costUsd: 0 }));
+  try {
+    out.invSpark = await cw.getMetricSeries({ Namespace: "AWS/Lambda", MetricName: "Invocations", Dimensions: [{ Name: "FunctionName", Value: info2.functions.find((f) => f.mode === "http")?.name ?? "" }], StartTime: new Date(end.getTime() - 24 * 3600000), EndTime: end, Period: 3600, Stat: "Sum" });
+  } catch {}
+  try {
+    const ce = new CostExplorerClient;
+    const now = end;
+    const monthStart = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
+    const prevStart = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth() - 1, 1));
+    const [thisMonth, lastMonth] = await Promise.all([
+      ce.getCostByService({ start: isoDate(monthStart), end: isoDate(now), granularity: "MONTHLY" }).catch(() => []),
+      ce.getCostByService({ start: isoDate(prevStart), end: isoDate(monthStart), granularity: "MONTHLY" }).catch(() => [])
+    ]);
+    if (thisMonth.length) {
+      const mtd = thisMonth.reduce((n, s) => n + s.amount, 0);
+      const lastTotal = lastMonth.reduce((n, s) => n + s.amount, 0);
+      const dayOfMonth = now.getUTCDate();
+      const daysInMonth = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth() + 1, 0)).getUTCDate();
+      out.costSummary = { monthToDateUsd: Number(mtd.toFixed(2)), projectedUsd: Number((mtd / dayOfMonth * daysInMonth).toFixed(2)), lastMonthUsd: Number(lastTotal.toFixed(2)), dailyAvgUsd: Number((mtd / dayOfMonth).toFixed(2)) };
+      out.costServices = thisMonth.filter((s) => s.amount > 0).sort((a, b) => b.amount - a.amount).slice(0, 12).map((s) => ({ name: s.service, usd: Number(s.amount.toFixed(2)), note: "" }));
+      out.metrics.estCostUsd = Number((mtd / dayOfMonth).toFixed(2));
+      out.metricsTotals.estCostUsd = out.metrics.estCostUsd;
+      out.costTrend = await ce.getDailyTotals({ start: isoDate(monthStart), end: isoDate(now) }).catch(() => []);
+      const lambdaCost = thisMonth.find((s) => /lambda/i.test(s.service))?.amount ?? 0;
+      const gbSec = (f) => f.invocations * (f.p50 / 1000) * (f.memory / 1024);
+      const totalGbSec = fnsDetail.reduce((n, f) => n + gbSec(f), 0) || 1;
+      out.costPerFn = fnsDetail.map((f) => ({ key: f.key, requests: f.invocations, gbSec: Math.round(gbSec(f)), usd: Number((lambdaCost * (gbSec(f) / totalGbSec)).toFixed(2)) }));
+    }
+  } catch {}
+  if (app?.firewall) {
+    try {
+      const blocked = await cw.getMetricStatistics({ Namespace: "AWS/WAFV2", MetricName: "BlockedRequests", StartTime: start, EndTime: end, Period: 86400, Statistics: ["Sum"] }).catch(() => []);
+      const allowed = await cw.getMetricStatistics({ Namespace: "AWS/WAFV2", MetricName: "AllowedRequests", StartTime: start, EndTime: end, Period: 86400, Statistics: ["Sum"] }).catch(() => []);
+      out.waf = { enabled: true, scope: "REGIONAL", acl: `${info2.slug}-${environment}-waf`, allowed24h: Math.round(allowed.reduce((n, p) => n + (p.Sum ?? 0), 0)), blocked24h: Math.round(blocked.reduce((n, p) => n + (p.Sum ?? 0), 0)) };
+      try {
+        const waf = new WAFv2Client(region);
+        const acls = await waf.listWebACLs("REGIONAL");
+        const acl = acls.find((a) => a.Name?.includes(`${info2.slug}-${environment}`)) ?? acls[0];
+        if (acl?.Name && acl.Id) {
+          out.waf.acl = acl.Name;
+          const rules = await waf.getWebACLRules(acl.Name, acl.Id, "REGIONAL");
+          if (rules.length)
+            out.wafRules = rules.map((r) => ({ name: r.Name ?? "—", detail: `priority ${r.Priority ?? 0}`, action: r.Action ?? "count", blocked24h: 0 }));
+        }
+      } catch {}
+    } catch {}
+  }
+  if (info2.scheduler !== "off" && app?.kind === "php") {
+    try {
+      const out2 = await runRemoteCommand(config6, environment, "schedule:list");
+      const tasks = [];
+      for (const line of (out2 || "").split(`
+`)) {
+        const m = /^\s*([\d*/,\-\s]+?)\s{2,}(.+?)(?:\s{2,}Next Due.*)?$/.exec(line);
+        if (m && /[*\d]/.test(m[1]) && m[1].trim().split(/\s+/).length === 5)
+          tasks.push({ command: m[2].trim().replace(/^php artisan /, ""), cron: m[1].trim(), desc: "", lastRun: "—", lastStatus: "ok" });
+      }
+      if (tasks.length)
+        out.schedulerTasks = tasks;
+    } catch {}
+  }
+  return out;
+}
+// src/deploy/local-dashboard-server.ts
+import { existsSync as existsSync26, statSync as statSync6 } from "node:fs";
+import { readFile as readFile2, writeFile as writeFile6 } from "node:fs/promises";
+import { mkdtempSync as mkdtempSync6 } from "node:fs";
+import { tmpdir as tmpdir7 } from "node:os";
+import { dirname as dirname9, extname as extname3, join as join23, normalize } from "node:path";
+import { fileURLToPath as fileURLToPath6 } from "node:url";
+
+// src/deploy/dashboard-data-server.ts
+import { existsSync as existsSync24, readFileSync as readFileSync17 } from "node:fs";
+import { join as join21 } from "node:path";
+
 // src/drivers/factory.ts
 await init_dist2();
 
 // src/drivers/aws/driver.ts
 init_cloudformation();
 await init_dist2();
-import { readFileSync as readFileSync14 } from "node:fs";
+import { readFileSync as readFileSync15 } from "node:fs";
 init_s3();
 
 // src/drivers/shared/package-manager.ts
@@ -84671,6 +85392,26 @@ function buildBackupProvisionScript(options) {
     `chmod 644 ${BACKUP_CRON_PATH}`
   ];
 }
+function engineSocket(engine) {
+  return engine === "mariadb" ? "/var/lib/pantry/mariadb/mariadbd.sock" : "/var/lib/pantry/mysql/mysqld.sock";
+}
+function buildBackupRestoreScript(database, options = {}) {
+  if (!database?.name)
+    return [];
+  const name = database.name;
+  const isPg = database.engine === "postgres";
+  const locate = options.from ? `TS_CLOUD_DUMP="${options.from}"` : `TS_CLOUD_DUMP="$(find ${BACKUP_OUTPUT_DIR} -type f -name '*${name}*.sql' -o -type f -name '*${name}*.sql.gz' 2>/dev/null | xargs -r ls -1t 2>/dev/null | head -1)"`;
+  const client2 = isPg ? `psql -h 127.0.0.1 -p ${database.port ?? 5432} -U postgres -d "${name}"` : `mysql --socket=${engineSocket(database.engine)} -u root "${name}"`;
+  return [
+    "set -uo pipefail",
+    'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true',
+    locate,
+    '[ -n "$TS_CLOUD_DUMP" ] && [ -f "$TS_CLOUD_DUMP" ] || { echo "no backup dump found to restore" >&2; exit 1; }',
+    'echo "[ts-cloud] restoring ' + name + ' from $TS_CLOUD_DUMP"',
+    `case "$TS_CLOUD_DUMP" in *.gz) gunzip -c "$TS_CLOUD_DUMP" ;; *) cat "$TS_CLOUD_DUMP" ;; esac | ${client2}`,
+    'echo "restore complete"'
+  ];
+}
 
 // src/drivers/shared/compute-provision.ts
 function buildComputeProvisionScripts(config6) {
@@ -85050,7 +85791,7 @@ class AwsDriver {
     await s32.putObject({
       bucket,
       key: options.remoteKey,
-      body: readFileSync14(options.localPath),
+      body: readFileSync15(options.localPath),
       contentType: "application/gzip"
     });
     return { artifactRef: `s3://${bucket}/${options.remoteKey}` };
@@ -85157,9 +85898,9 @@ class AwsDriver {
 
 // src/drivers/hetzner/driver.ts
 await init_dist2();
-import { existsSync as existsSync18, readFileSync as readFileSync15 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
-import { join as join18 } from "node:path";
+import { existsSync as existsSync20, readFileSync as readFileSync16 } from "node:fs";
+import { homedir as homedir8 } from "node:os";
+import { join as join19 } from "node:path";
 import { execSync as execSync3 } from "node:child_process";
 
 // src/drivers/hetzner/client.ts
@@ -85379,6 +86120,27 @@ runcmd:
 
 // src/drivers/shared/rpx-gateway.ts
 var DEFAULT_RPX_CERTS_DIR = "/etc/rpx/certs";
+var DEFAULT_ACME_WEBROOT = "/var/www/acme-challenge";
+function normalizeSiteRedirect(input) {
+  if (typeof input === "string")
+    return { to: input };
+  const out = { to: input.to };
+  if (input.status != null)
+    out.status = input.status;
+  if (input.preservePath != null)
+    out.preservePath = input.preservePath;
+  return out;
+}
+function resolveRouteAuth(site) {
+  const auth = site.auth;
+  if (!auth || auth.enabled === false || !auth.password)
+    return;
+  return {
+    username: auth.username || "admin",
+    password: auth.password,
+    ...auth.realm ? { realm: auth.realm } : {}
+  };
+}
 function normalizeRoutePath(path) {
   if (!path || path === "/")
     return;
@@ -85405,17 +86167,24 @@ function buildRpxConfig(sites, options) {
       continue;
     const path = normalizeRoutePath(site.path);
     const id = deriveRouteId(site.domain, path);
+    const auth = resolveRouteAuth(site);
+    if (kind === "redirect") {
+      proxies.push({ to: site.domain, path, redirect: normalizeSiteRedirect(site.redirect), id, ...auth ? { auth } : {} });
+      domains.add(site.domain);
+      continue;
+    }
     if (kind === "server-app") {
       if (typeof site.port !== "number")
         continue;
-      proxies.push({ to: site.domain, path, from: `localhost:${site.port}`, id });
+      proxies.push({ to: site.domain, path, from: `localhost:${site.port}`, id, ...auth ? { auth } : {} });
     } else {
       proxies.push({
         to: site.domain,
         path,
-        static: `${wwwRoot}/${name}`,
+        static: `${wwwRoot}/${name}/current`,
         cleanUrls: site.pathRewriteStyle !== "flat",
         spa: site.spa ?? false,
+        ...auth ? { auth } : {},
         id
       });
     }
@@ -85441,6 +86210,9 @@ function buildRpxConfig(sites, options) {
       certsDir
     };
   }
+  if (options.proxy.onDemandTls) {
+    config6.acmeChallengeWebroot = options.proxy.acmeWebroot ?? DEFAULT_ACME_WEBROOT;
+  }
   const cdn = options.proxy.cdn;
   if (cdn?.secret && cdn.frontedHosts.length > 0) {
     config6.originGuard = {
@@ -85451,20 +86223,61 @@ function buildRpxConfig(sites, options) {
   }
   return config6;
 }
-function renderRpxLauncher(config6) {
-  const json = JSON.stringify(config6, null, 2);
-  return `// Generated by ts-cloud — rpx reverse-proxy gateway.
-// Routes are derived from the \`sites\` model on every \`buddy deploy\`.
-import { startProxies } from '@stacksjs/rpx'
-
-const config = ${json} as const
-
-await startProxies(config as any)
-`;
-}
 var RPX_DIR = "/etc/rpx";
+var RPX_INSTALL_DIR = "/opt/rpx-gateway";
 var RPX_LAUNCHER_PATH = "/etc/rpx/gateway.ts";
 var RPX_SERVICE_NAME = "rpx-gateway.service";
+var RPX_SITES_DIR = "/etc/rpx/sites.d";
+function renderRpxAssembler(sitesDir = RPX_SITES_DIR, defaultCertsDir = DEFAULT_RPX_CERTS_DIR) {
+  return `// Generated by ts-cloud — rpx gateway assembler.
+// Merges every app's fragment in ${sitesDir} so independent deploys compose
+// without clobbering each other. Each deploy writes only its own <slug>.json.
+import { startProxies } from '@stacksjs/rpx'
+import { readdirSync, readFileSync } from 'node:fs'
+
+const dir = ${JSON.stringify(sitesDir)}
+const proxies = []
+const seen = new Set()
+const suffixes = new Set()
+const guardHosts = new Set()
+let email
+let certsDir = ${JSON.stringify(defaultCertsDir)}
+let acmeChallengeWebroot
+let guard
+let files = []
+try { files = readdirSync(dir).filter(n => n.endsWith('.json')).sort() } catch {}
+for (const f of files) {
+  let frag
+  try { frag = JSON.parse(readFileSync(dir + '/' + f, 'utf8')) } catch { continue }
+  for (const p of frag.proxies ?? []) {
+    const key = p.id || (p.to + (p.path ?? ''))
+    if (seen.has(key)) continue
+    seen.add(key)
+    proxies.push(p)
+  }
+  for (const s of frag.onDemandTls?.allowedSuffixes ?? []) suffixes.add(s)
+  email ??= frag.onDemandTls?.email
+  if (frag.productionCerts?.certsDir) certsDir = frag.productionCerts.certsDir
+  acmeChallengeWebroot ??= frag.acmeChallengeWebroot
+  if (frag.originGuard) {
+    guard ??= { header: frag.originGuard.header, value: frag.originGuard.value }
+    for (const h of frag.originGuard.hosts ?? []) guardHosts.add(h)
+  }
+}
+const config = {
+  proxies,
+  productionCerts: { certsDir },
+  https: true,
+  hostsManagement: false,
+  cleanup: { hosts: false, certs: false },
+  ...(suffixes.size > 0 ? { onDemandTls: { enabled: true, allowedSuffixes: [...suffixes], email, certsDir } } : {}),
+  ...(acmeChallengeWebroot ? { acmeChallengeWebroot } : {}),
+  ...(guard ? { originGuard: { header: guard.header, value: guard.value, hosts: [...guardHosts] } } : {}),
+}
+
+await startProxies(config)
+`;
+}
 function writeFileHeredoc(path, content, delimiter) {
   return [
     `cat > ${path} <<'${delimiter}'`,
@@ -85472,21 +86285,110 @@ function writeFileHeredoc(path, content, delimiter) {
     delimiter
   ];
 }
+function certDomainsForConfig(config6) {
+  const seen = new Set;
+  for (const r of config6.proxies) {
+    const host = r.to;
+    if (!host || host.startsWith("*") || host.includes(":") || !host.includes("."))
+      continue;
+    seen.add(host);
+  }
+  return [...seen];
+}
+function buildCertManagementCommands(options) {
+  const { config: config6, proxy } = options;
+  const webroot = config6.acmeChallengeWebroot;
+  const domains = certDomainsForConfig(config6);
+  if (!proxy.onDemandTls || !webroot || domains.length === 0)
+    return [];
+  const bunBin = options.bunBin ?? "/usr/local/bin/bun";
+  const version2 = proxy.version ?? "latest";
+  const certsDir = config6.productionCerts.certsDir;
+  const email3 = proxy.onDemandTlsEmail ?? `webmaster@${domains[0]}`;
+  const tlsxCli = `${bunBin} ${RPX_INSTALL_DIR}/node_modules/@stacksjs/tlsx/dist/bin/cli.js`;
+  const csv = domains.join(",");
+  const spaced = domains.join(" ");
+  const slug = (options.slug || "app").replace(/[^a-z0-9._-]+/gi, "-");
+  const renewScriptPath = `${RPX_DIR}/renew-certs-${slug}.sh`;
+  const renewServiceName = `rpx-cert-renew-${slug}.service`;
+  const renewTimerName = `rpx-cert-renew-${slug}.timer`;
+  const renewScript = [
+    "#!/bin/sh",
+    "# Generated by ts-cloud — issue/renew rpx gateway TLS certs via tlsx http-01.",
+    "# The running gateway serves the challenge from $WEBROOT on :80, so this needs",
+    "# no downtime and no DNS credentials. Reloads the gateway only if a cert changed.",
+    "set -u",
+    `CERTS='${certsDir}'`,
+    `WEBROOT='${webroot}'`,
+    `EMAIL='${email3}'`,
+    `TLSX="${tlsxCli}"`,
+    `DOMAINS='${csv}'`,
+    'before=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)',
+    `for d in ${spaced}; do`,
+    '  [ -s "$CERTS/$d.crt" ] || $TLSX acme:issue -d "$d" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --prod --email "$EMAIL" || echo "issue $d failed (non-fatal)"',
+    "done",
+    '$TLSX acme:renew --domains "$DOMAINS" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --days 30 --prod --email "$EMAIL" || echo "renew: some domains failed (non-fatal)"',
+    'rm -f "$CERTS"/*.chain.crt',
+    'after=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)',
+    `[ "$before" = "$after" ] || systemctl restart ${RPX_SERVICE_NAME}`
+  ].join(`
+`);
+  const renewService = [
+    "[Unit]",
+    `Description=Issue/renew rpx gateway TLS certs for ${slug} (tlsx http-01)`,
+    `After=network-online.target ${RPX_SERVICE_NAME}`,
+    "Wants=network-online.target",
+    "",
+    "[Service]",
+    "Type=oneshot",
+    `ExecStart=${renewScriptPath}`
+  ].join(`
+`);
+  const renewTimer = [
+    "[Unit]",
+    `Description=Daily rpx gateway TLS cert issuance/renewal for ${slug}`,
+    "",
+    "[Timer]",
+    "OnCalendar=*-*-* 03:30:00",
+    "RandomizedDelaySec=1h",
+    "Persistent=true",
+    "",
+    "[Install]",
+    "WantedBy=timers.target"
+  ].join(`
+`);
+  return [
+    `mkdir -p ${webroot}`,
+    `(cd ${RPX_INSTALL_DIR} && ${bunBin} add @stacksjs/tlsx@${version2}) || true`,
+    ...writeFileHeredoc(renewScriptPath, renewScript, "TS_CLOUD_RENEW_EOF"),
+    `chmod +x ${renewScriptPath}`,
+    ...writeFileHeredoc(`/etc/systemd/system/${renewServiceName}`, renewService, "TS_CLOUD_RENEW_SVC_EOF"),
+    ...writeFileHeredoc(`/etc/systemd/system/${renewTimerName}`, renewTimer, "TS_CLOUD_RENEW_TIMER_EOF"),
+    "systemctl daemon-reload",
+    `systemctl enable --now ${renewTimerName} || true`,
+    `${renewScriptPath} || true`
+  ];
+}
 function buildRpxProvisionScript(options) {
   const { config: config6, proxy } = options;
   const bunBin = options.bunBin ?? "/usr/local/bin/bun";
   const version2 = proxy.version ?? "latest";
   const certsDir = config6.productionCerts.certsDir;
-  const launcher = renderRpxLauncher(config6);
+  const slug = (options.slug || "app").replace(/[^a-z0-9._-]+/gi, "-");
+  const fragment = JSON.stringify({ slug, ...config6 }, null, 2);
+  const assembler = renderRpxAssembler(RPX_SITES_DIR, certsDir);
   const upstreamTimeout = proxy.upstreamTimeout ?? 60;
   const poolEnv = [`Environment=RPX_UPSTREAM_TIMEOUT=${upstreamTimeout}`];
   if (typeof proxy.maxUpstreamConns === "number")
     poolEnv.push(`Environment=RPX_MAX_UPSTREAM_CONNS=${proxy.maxUpstreamConns}`);
   return [
     "set -euo pipefail",
-    `mkdir -p ${RPX_DIR} ${certsDir}`,
-    `mkdir -p /tmp/ts-cloud-rpx-install && (cd /tmp/ts-cloud-rpx-install && ${bunBin} add -g @stacksjs/rpx@${version2})`,
-    ...writeFileHeredoc(RPX_LAUNCHER_PATH, launcher, "TS_CLOUD_RPX_EOF"),
+    `mkdir -p ${RPX_DIR} ${RPX_SITES_DIR} ${certsDir} ${RPX_INSTALL_DIR}`,
+    `rm -rf ${RPX_INSTALL_DIR}/node_modules ${RPX_INSTALL_DIR}/bun.lock ${RPX_INSTALL_DIR}/package.json`,
+    `(cd ${RPX_INSTALL_DIR} && ${bunBin} add @stacksjs/rpx@${version2})`,
+    `ln -sfn ${RPX_INSTALL_DIR}/node_modules ${RPX_DIR}/node_modules`,
+    ...writeFileHeredoc(`${RPX_SITES_DIR}/${slug}.json`, fragment, "TS_CLOUD_RPX_FRAGMENT_EOF"),
+    ...writeFileHeredoc(RPX_LAUNCHER_PATH, assembler, "TS_CLOUD_RPX_EOF"),
     ...writeFileHeredoc(`/etc/systemd/system/${RPX_SERVICE_NAME}`, [
       "[Unit]",
       "Description=rpx reverse-proxy gateway (managed by ts-cloud)",
@@ -85496,6 +86398,7 @@ function buildRpxProvisionScript(options) {
       "[Service]",
       "Type=simple",
       `ExecStart=${bunBin} ${RPX_LAUNCHER_PATH}`,
+      `WorkingDirectory=${RPX_INSTALL_DIR}`,
       `Environment=BUN_INSTALL=/root/.bun`,
       ...poolEnv,
       "Restart=always",
@@ -85511,7 +86414,8 @@ function buildRpxProvisionScript(options) {
     "systemctl disable --now bun-gateway.service 2>/dev/null || true",
     "systemctl disable --now ts-cloud-nginx.service 2>/dev/null || true",
     `systemctl enable ${RPX_SERVICE_NAME}`,
-    `systemctl restart ${RPX_SERVICE_NAME}`
+    `systemctl restart ${RPX_SERVICE_NAME}`,
+    ...buildCertManagementCommands(options)
   ];
 }
 
@@ -85596,10 +86500,10 @@ function matchesTsCloudLabels(labels, slug, environment, role = "app") {
 
 // src/drivers/hetzner/state.ts
 import { mkdir as mkdir4, readFile, writeFile as writeFile4 } from "node:fs/promises";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 var STATE_DIR = ".ts-cloud/state";
 function driverStatePath(stackName) {
-  return join17(process.cwd(), STATE_DIR, `${stackName}.json`);
+  return join18(process.cwd(), STATE_DIR, `${stackName}.json`);
 }
 async function readDriverState(stackName) {
   try {
@@ -85611,7 +86515,7 @@ async function readDriverState(stackName) {
 }
 async function writeDriverState(stackName, state) {
   const path = driverStatePath(stackName);
-  await mkdir4(join17(process.cwd(), STATE_DIR), { recursive: true });
+  await mkdir4(join18(process.cwd(), STATE_DIR), { recursive: true });
   await writeFile4(path, `${JSON.stringify(state, null, 2)}
 `, "utf8");
 }
@@ -85619,7 +86523,7 @@ async function writeDriverState(stackName, state) {
 // src/drivers/hetzner/driver.ts
 var SSH_MAX_BUFFER = 1024 * 1024 * 256;
 function expandHome(path) {
-  return path.startsWith("~/") ? join18(homedir7(), path.slice(2)) : path;
+  return path.startsWith("~/") ? join19(homedir8(), path.slice(2)) : path;
 }
 
 class HetznerDriver {
@@ -85687,6 +86591,7 @@ class HetznerDriver {
     const rpxProvision = compute.proxy?.engine === "rpx" ? buildRpxProvisionScript({
       proxy: compute.proxy,
       config: buildRpxConfig(sites, { proxy: compute.proxy }),
+      slug: config6.project.slug,
       bunBin: compute.runtime === "node" || compute.runtime === "deno" ? undefined : "/usr/local/bin/bun"
     }) : undefined;
     const provision = buildComputeProvisionScripts(config6);
@@ -86049,10 +86954,10 @@ class HetznerDriver {
     };
   }
   async ensureSshKey(slug, environment, labels) {
-    if (!existsSync18(this.sshPublicKeyPath)) {
+    if (!existsSync20(this.sshPublicKeyPath)) {
       throw new Error(`SSH public key not found at ${this.sshPublicKeyPath}. ts-cloud deploys to Hetzner over SSH and needs a public key to authorize on the server. ` + `Generate one (\`ssh-keygen -t ed25519\`) or set hetzner.sshPrivateKeyPath / HCLOUD_SSH_PUBLIC_KEY.`);
     }
-    const publicKey = readFileSync15(this.sshPublicKeyPath, "utf8").trim();
+    const publicKey = readFileSync16(this.sshPublicKeyPath, "utf8").trim();
     const normalized = normalizeSshPublicKey(publicKey);
     const existing = await this.client.listSshKeys();
     const match = existing.find((key) => normalizeSshPublicKey(key.public_key) === normalized);
@@ -86184,8 +87089,53 @@ ${out}`);
   }
 }
 
+// src/drivers/local-box/driver.ts
+class LocalBoxDriver {
+  name = "hetzner";
+  usesCloudFormation = false;
+  async getComputeOutputs() {
+    return { appPublicIp: "127.0.0.1", sshUser: "root" };
+  }
+  async uploadRelease(options) {
+    return { artifactRef: options.localPath };
+  }
+  async findComputeTargets(_options) {
+    return [{ id: "localhost", name: "localhost", publicIp: "127.0.0.1", status: "running" }];
+  }
+  async runRemoteDeploy(options) {
+    const script = options.commands.join(`
+`);
+    try {
+      const proc = Bun.spawn(["bash", "-c", script], { stdout: "pipe", stderr: "pipe", env: process.env });
+      const [output, error2, exitCode] = await Promise.all([
+        new Response(proc.stdout).text(),
+        new Response(proc.stderr).text(),
+        proc.exited
+      ]);
+      return {
+        success: exitCode === 0,
+        instanceCount: 1,
+        perInstance: [{ instanceId: "localhost", status: exitCode === 0 ? "Success" : "Failed", output, error: error2 }]
+      };
+    } catch (err) {
+      return {
+        success: false,
+        instanceCount: 1,
+        perInstance: [{ instanceId: "localhost", status: "Failed", error: err?.message ?? String(err) }],
+        error: err?.message ?? String(err)
+      };
+    }
+  }
+}
+function isBoxMode() {
+  const v = process.env.TS_CLOUD_DASHBOARD_BOX;
+  return v != null && v !== "" && v !== "0" && v.toLowerCase() !== "false";
+}
+
 // src/drivers/factory.ts
 function createCloudDriver(options) {
+  if (isBoxMode())
+    return new LocalBoxDriver;
   const provider = options.provider ?? resolveCloudProvider(options.config);
   switch (provider) {
     case "aws":
@@ -86226,6 +87176,111 @@ function quoteEnvValue(value) {
   return `"${escaped}"`;
 }
 
+// src/drivers/shared/releases.ts
+var DEFAULT_SHARED_PATHS = ["storage", ".env"];
+var DEFAULT_KEEP_RELEASES = 4;
+var DEFAULT_KEEP_DEPLOY_LOGS = 20;
+function deployMetaDir(base) {
+  return `${base.replace(/\/+$/, "")}/.ts-cloud`;
+}
+function deployHistoryPath(base) {
+  return `${deployMetaDir(base)}/deploy-history.log`;
+}
+function deployLogPath(base, releaseId) {
+  return `${deployMetaDir(base)}/deploys/${releaseId}.log`;
+}
+function releasePaths(base, releaseId) {
+  const root = base.replace(/\/+$/, "");
+  return {
+    base: root,
+    releases: `${root}/releases`,
+    shared: `${root}/shared`,
+    current: `${root}/current`,
+    release: `${root}/releases/${releaseId}`
+  };
+}
+function isFileSharedPath(p) {
+  const name = p.split("/").pop() || p;
+  return name.startsWith(".") || /\.[a-z0-9]+$/i.test(name);
+}
+function buildEnsureReleaseLayout(paths, sharedPaths = DEFAULT_SHARED_PATHS) {
+  const lines = [
+    `mkdir -p ${paths.releases} ${paths.shared}`
+  ];
+  for (const p of sharedPaths) {
+    if (isFileSharedPath(p)) {
+      lines.push(`mkdir -p "$(dirname ${paths.shared}/${p})"`, `touch ${paths.shared}/${p}`);
+    } else if (p === "storage") {
+      lines.push(`mkdir -p ${paths.shared}/storage/app/public`, `mkdir -p ${paths.shared}/storage/framework/cache/data`, `mkdir -p ${paths.shared}/storage/framework/sessions`, `mkdir -p ${paths.shared}/storage/framework/testing`, `mkdir -p ${paths.shared}/storage/framework/views`, `mkdir -p ${paths.shared}/storage/logs`);
+    } else {
+      lines.push(`mkdir -p ${paths.shared}/${p}`);
+    }
+  }
+  return lines;
+}
+function buildLinkSharedPaths(paths, sharedPaths = DEFAULT_SHARED_PATHS) {
+  const lines = [];
+  for (const p of sharedPaths) {
+    const target = `${paths.shared}/${p}`;
+    const link = `${paths.release}/${p}`;
+    lines.push(`rm -rf ${link}`, `mkdir -p "$(dirname ${link})"`, `ln -sfn ${target} ${link}`);
+  }
+  return lines;
+}
+function buildActivateRelease(paths) {
+  return [
+    `ln -sfn ${paths.release} ${paths.current}.tmp`,
+    `mv -Tf ${paths.current}.tmp ${paths.current}`
+  ];
+}
+function buildRollbackScript(paths, options = {}) {
+  if (options.to) {
+    const target = `${paths.releases}/${options.to}`;
+    return [
+      `[ -d ${target} ] || { echo "rollback target ${target} not found" >&2; exit 1; }`,
+      `ln -sfn ${target} ${paths.current}.tmp`,
+      `mv -Tf ${paths.current}.tmp ${paths.current}`
+    ];
+  }
+  return [
+    `TS_CLOUD_CURRENT=$(readlink -f ${paths.current} 2>/dev/null || true)`,
+    `TS_CLOUD_PREV=$(ls -1dt ${paths.releases}/*/ 2>/dev/null | sed 's#/$##' | while read -r r; do ` + '[ "$(readlink -f "$r")" != "$TS_CLOUD_CURRENT" ] && { echo "$r"; break; }; done)',
+    '[ -n "$TS_CLOUD_PREV" ] || { echo "no previous release to roll back to" >&2; exit 1; }',
+    `ln -sfn "$TS_CLOUD_PREV" ${paths.current}.tmp`,
+    `mv -Tf ${paths.current}.tmp ${paths.current}`,
+    'echo "rolled back to $TS_CLOUD_PREV"'
+  ];
+}
+function buildPruneReleases(paths, keep = DEFAULT_KEEP_RELEASES) {
+  const n = Math.max(1, keep);
+  return [
+    `TS_CLOUD_CURRENT=$(readlink -f ${paths.current} 2>/dev/null || true)`,
+    `ls -1dt ${paths.releases}/*/ 2>/dev/null | sed 's#/$##' | tail -n +${n + 1} | while read -r TS_CLOUD_OLD; do`,
+    '  [ "$(readlink -f "$TS_CLOUD_OLD")" = "$TS_CLOUD_CURRENT" ] || rm -rf "$TS_CLOUD_OLD"',
+    "done"
+  ];
+}
+function buildDeployHistoryHeader(base, options) {
+  const meta = deployMetaDir(base);
+  const log4 = deployLogPath(base, options.releaseId);
+  const history = deployHistoryPath(base);
+  const keepLogs = Math.max(1, options.keepLogs ?? DEFAULT_KEEP_DEPLOY_LOGS);
+  const commit = options.commit || "";
+  const branch = options.branch || "";
+  return [
+    `mkdir -p ${meta}/deploys`,
+    `exec > >(tee -a ${log4}) 2>&1`,
+    `echo "[ts-cloud] deploy ${options.releaseId} commit=${commit} branch=${branch} starting $(date -u +%Y-%m-%dT%H:%M:%SZ)"`,
+    "ts_cloud_record_deploy() {",
+    "  TS_CLOUD_RC=$?",
+    '  if [ "$TS_CLOUD_RC" -eq 0 ]; then TS_CLOUD_ST=success; else TS_CLOUD_ST=failed; fi',
+    `  printf '%s\\t%s\\t%s\\t%s\\trc=%s\\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "${options.releaseId}" "${commit}" "$TS_CLOUD_ST" "$TS_CLOUD_RC" >> ${history}`,
+    "}",
+    "trap ts_cloud_record_deploy EXIT",
+    `ls -1t ${meta}/deploys/*.log 2>/dev/null | tail -n +${keepLogs + 1} | while read -r TS_CLOUD_OLDLOG; do rm -f "$TS_CLOUD_OLDLOG"; done`
+  ];
+}
+
 // src/drivers/shared/deploy-script.ts
 function resolveExecStart(start, runtime) {
   const bin = runtime === "bun" ? "/usr/local/bin/bun" : runtime === "deno" ? "/usr/local/bin/deno" : "/usr/local/bin/node";
@@ -86237,25 +87292,31 @@ function buildSiteDeployScript(options) {
     siteName,
     slug,
     artifactFetch,
+    releaseId,
     execStart,
     envEntries,
     port,
+    keepReleases = DEFAULT_KEEP_RELEASES,
     preStartCommands = []
   } = options;
-  const appDir = options.appDir ?? `/var/www/${siteName}`;
+  const base = options.appDir ?? `/var/www/${siteName}`;
+  const paths = releasePaths(base, releaseId);
   const serviceName = `${slug}-${siteName}.service`;
+  const sharedPaths = [".env"];
   const envFile = formatEnvFile(envEntries);
-  const preStart = preStartCommands.length > 0 ? [`cd ${appDir}`, ...preStartCommands] : [];
+  const preStart = preStartCommands.length > 0 ? [`cd ${paths.release}`, ...preStartCommands] : [];
   return [
     "set -euo pipefail",
     ...artifactFetch,
-    `mkdir -p ${appDir}`,
-    `find ${appDir} -mindepth 1 -maxdepth 1 ! -name '.env' -exec rm -rf {} +`,
-    `tar xzf /tmp/${siteName}-release.tar.gz -C ${appDir}`,
-    `cat > ${appDir}/.env <<'TS_CLOUD_ENV_EOF'`,
+    ...buildEnsureReleaseLayout(paths, sharedPaths),
+    `rm -rf ${paths.release}`,
+    `mkdir -p ${paths.release}`,
+    `tar xzf /tmp/${siteName}-release.tar.gz -C ${paths.release}`,
+    `cat > ${paths.shared}/.env <<'TS_CLOUD_ENV_EOF'`,
     envFile,
     "TS_CLOUD_ENV_EOF",
-    `chmod 600 ${appDir}/.env`,
+    `chmod 600 ${paths.shared}/.env`,
+    ...buildLinkSharedPaths(paths, sharedPaths),
     ...preStart,
     `cat > /etc/systemd/system/${serviceName} <<'TS_CLOUD_UNIT_EOF'`,
     "[Unit]",
@@ -86264,11 +87325,11 @@ function buildSiteDeployScript(options) {
     "",
     "[Service]",
     "Type=simple",
-    `WorkingDirectory=${appDir}`,
+    `WorkingDirectory=${paths.current}`,
     `ExecStart=${execStart}`,
     "Restart=always",
     "RestartSec=5",
-    `EnvironmentFile=${appDir}/.env`,
+    `EnvironmentFile=${paths.current}/.env`,
     ...port ? [`Environment=PORT=${port}`] : [],
     "",
     "[Install]",
@@ -86276,21 +87337,27 @@ function buildSiteDeployScript(options) {
     "TS_CLOUD_UNIT_EOF",
     "systemctl daemon-reload",
     `systemctl enable ${serviceName}`,
+    ...buildActivateRelease(paths),
     `systemctl restart ${serviceName}`,
-    `systemctl is-active ${serviceName}`
+    `systemctl is-active ${serviceName}`,
+    ...buildPruneReleases(paths, keepReleases)
   ];
 }
 function buildStaticSiteDeployScript(options) {
-  const { siteName, artifactFetch, preStartCommands = [] } = options;
-  const appDir = options.appDir ?? `/var/www/${siteName}`;
-  const preStart = preStartCommands.length > 0 ? [`cd ${appDir}`, ...preStartCommands] : [];
+  const { siteName, artifactFetch, releaseId, keepReleases = DEFAULT_KEEP_RELEASES, preStartCommands = [] } = options;
+  const base = options.appDir ?? `/var/www/${siteName}`;
+  const paths = releasePaths(base, releaseId);
+  const preStart = preStartCommands.length > 0 ? [`cd ${paths.release}`, ...preStartCommands] : [];
   return [
     "set -euo pipefail",
     ...artifactFetch,
-    `mkdir -p ${appDir}`,
-    `find ${appDir} -mindepth 1 -maxdepth 1 -exec rm -rf {} +`,
-    `tar xzf /tmp/${siteName}-release.tar.gz -C ${appDir}`,
-    ...preStart
+    ...buildEnsureReleaseLayout(paths, []),
+    `rm -rf ${paths.release}`,
+    `mkdir -p ${paths.release}`,
+    `tar xzf /tmp/${siteName}-release.tar.gz -C ${paths.release}`,
+    ...preStart,
+    ...buildActivateRelease(paths),
+    ...buildPruneReleases(paths, keepReleases)
   ];
 }
 function buildAwsArtifactFetch(bucket, key, region, siteName) {
@@ -86306,6 +87373,95 @@ function buildLocalArtifactFetch(localPath, siteName) {
 // src/drivers/shared/compute-deploy.ts
 await init_dist2();
 
+// src/deploy/management-dashboard.ts
+await init_dist2();
+import { execSync as execSync5 } from "node:child_process";
+import { existsSync as existsSync21 } from "node:fs";
+import { tmpdir as tmpdir6 } from "node:os";
+import { dirname as dirname8, isAbsolute as isAbsolute5, join as join20 } from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
+var MANAGEMENT_DASHBOARD_SITE = "dashboard";
+var noopLogger = { info: () => {}, warn: () => {} };
+function truthy(v) {
+  return v != null && v !== "" && v !== "0" && v.toLowerCase() !== "false";
+}
+function resolveUiSource(cwd) {
+  if (existsSync21(join20(cwd, "packages", "ui", "pages")) || existsSync21(join20(cwd, "packages", "ui", "package.json"))) {
+    return { uiRoot: "packages/ui/dist", build: "cd packages/ui && bun install && bun run build" };
+  }
+  const here = dirname8(fileURLToPath4(import.meta.url));
+  const candidates = [
+    join20(here, "ui"),
+    join20(here, "..", "ui"),
+    join20(here, "..", "..", "ui"),
+    join20(here, "..", "dist", "ui")
+  ];
+  for (const dir of candidates) {
+    if (existsSync21(join20(dir, "index.html")) || existsSync21(join20(dir, "serverless.html")))
+      return { uiRoot: dir, build: false };
+  }
+  return null;
+}
+function ensureManagementDashboard(config6, options = {}) {
+  const logger4 = options.logger ?? noopLogger;
+  const cwd = options.cwd ?? process.cwd();
+  if (truthy(process.env.TS_CLOUD_UI_DISABLE)) {
+    logger4.info("Management dashboard: skipped (TS_CLOUD_UI_DISABLE set).");
+    return config6;
+  }
+  if (hasManagementDashboardSite(config6))
+    return config6;
+  const ui = resolveUiSource(cwd);
+  if (!ui) {
+    logger4.info("Management dashboard: UI not found (no local ui/ or packaged dist/ui) — skipping auto-deploy.");
+    return config6;
+  }
+  const password = process.env.TS_CLOUD_UI_PASSWORD?.trim() || undefined;
+  const environment = config6.environments && Object.keys(config6.environments)[0];
+  const live = truthy(process.env.TS_CLOUD_UI_LIVE);
+  const port = Number(process.env.TS_CLOUD_UI_PORT) || undefined;
+  const resolved = resolveManagementDashboardSite(config6, environment ?? "production", {
+    uiRoot: ui.uiRoot,
+    build: ui.build,
+    domain: process.env.TS_CLOUD_UI_DOMAIN?.trim() || undefined,
+    username: process.env.TS_CLOUD_UI_USERNAME?.trim() || undefined,
+    password,
+    realm: process.env.TS_CLOUD_UI_REALM?.trim() || undefined,
+    live,
+    port
+  });
+  if (!resolved) {
+    logger4.info("Management dashboard: no domain resolved (set TS_CLOUD_UI_DOMAIN or configure a site domain) — skipping.");
+    return config6;
+  }
+  config6.sites = { ...config6.sites ?? {}, [resolved.name]: resolved.site };
+  logger4.info(`Management dashboard → https://${resolved.site.domain} (${password ? "htpasswd-protected" : "NO AUTH — set TS_CLOUD_UI_PASSWORD"})`);
+  return config6;
+}
+function buildManagementDashboardArtifact(site, options) {
+  if (!site?.root)
+    return null;
+  const cwd = options.cwd ?? process.cwd();
+  const logger4 = options.logger ?? noopLogger;
+  try {
+    if (typeof site.build === "string" && site.build.trim()) {
+      logger4.info(`Management dashboard: building UI (${site.build})`);
+      execSync5(site.build, { cwd, stdio: "inherit" });
+    }
+    const root = isAbsolute5(site.root) ? site.root : join20(cwd, site.root);
+    if (!existsSync21(root)) {
+      logger4.warn(`Management dashboard: build output not found at ${root} — skipping dashboard artifact.`);
+      return null;
+    }
+    const tarball = join20(tmpdir6(), `${options.slug}-${MANAGEMENT_DASHBOARD_SITE}-${options.sha}.tar.gz`);
+    execSync5(`tar czf "${tarball}" -C "${root}" .`, { stdio: "inherit" });
+    return tarball;
+  } catch (error2) {
+    logger4.warn(`Management dashboard: failed to build artifact — ${error2?.message ?? error2}. Skipping dashboard deploy.`);
+    return null;
+  }
+}
+
 // src/drivers/shared/certbot.ts
 function resolveSslProvider(site) {
   if (site.ssl?.provider)
@@ -86427,93 +87583,6 @@ function shellQuote(value) {
   return `'${escaped}'`;
 }
 
-// src/drivers/shared/releases.ts
-var DEFAULT_SHARED_PATHS = ["storage", ".env"];
-var DEFAULT_KEEP_RELEASES = 4;
-var DEFAULT_KEEP_DEPLOY_LOGS = 20;
-function deployMetaDir(base) {
-  return `${base.replace(/\/+$/, "")}/.ts-cloud`;
-}
-function deployHistoryPath(base) {
-  return `${deployMetaDir(base)}/deploy-history.log`;
-}
-function deployLogPath(base, releaseId) {
-  return `${deployMetaDir(base)}/deploys/${releaseId}.log`;
-}
-function releasePaths(base, releaseId) {
-  const root = base.replace(/\/+$/, "");
-  return {
-    base: root,
-    releases: `${root}/releases`,
-    shared: `${root}/shared`,
-    current: `${root}/current`,
-    release: `${root}/releases/${releaseId}`
-  };
-}
-function isFileSharedPath(p) {
-  const name = p.split("/").pop() || p;
-  return name.startsWith(".") || /\.[a-z0-9]+$/i.test(name);
-}
-function buildEnsureReleaseLayout(paths, sharedPaths = DEFAULT_SHARED_PATHS) {
-  const lines = [
-    `mkdir -p ${paths.releases} ${paths.shared}`
-  ];
-  for (const p of sharedPaths) {
-    if (isFileSharedPath(p)) {
-      lines.push(`mkdir -p "$(dirname ${paths.shared}/${p})"`, `touch ${paths.shared}/${p}`);
-    } else if (p === "storage") {
-      lines.push(`mkdir -p ${paths.shared}/storage/app/public`, `mkdir -p ${paths.shared}/storage/framework/cache/data`, `mkdir -p ${paths.shared}/storage/framework/sessions`, `mkdir -p ${paths.shared}/storage/framework/testing`, `mkdir -p ${paths.shared}/storage/framework/views`, `mkdir -p ${paths.shared}/storage/logs`);
-    } else {
-      lines.push(`mkdir -p ${paths.shared}/${p}`);
-    }
-  }
-  return lines;
-}
-function buildLinkSharedPaths(paths, sharedPaths = DEFAULT_SHARED_PATHS) {
-  const lines = [];
-  for (const p of sharedPaths) {
-    const target = `${paths.shared}/${p}`;
-    const link = `${paths.release}/${p}`;
-    lines.push(`rm -rf ${link}`, `mkdir -p "$(dirname ${link})"`, `ln -sfn ${target} ${link}`);
-  }
-  return lines;
-}
-function buildActivateRelease(paths) {
-  return [
-    `ln -sfn ${paths.release} ${paths.current}.tmp`,
-    `mv -Tf ${paths.current}.tmp ${paths.current}`
-  ];
-}
-function buildPruneReleases(paths, keep = DEFAULT_KEEP_RELEASES) {
-  const n = Math.max(1, keep);
-  return [
-    `TS_CLOUD_CURRENT=$(readlink -f ${paths.current} 2>/dev/null || true)`,
-    `ls -1dt ${paths.releases}/*/ 2>/dev/null | sed 's#/$##' | tail -n +${n + 1} | while read -r TS_CLOUD_OLD; do`,
-    '  [ "$(readlink -f "$TS_CLOUD_OLD")" = "$TS_CLOUD_CURRENT" ] || rm -rf "$TS_CLOUD_OLD"',
-    "done"
-  ];
-}
-function buildDeployHistoryHeader(base, options) {
-  const meta = deployMetaDir(base);
-  const log4 = deployLogPath(base, options.releaseId);
-  const history = deployHistoryPath(base);
-  const keepLogs = Math.max(1, options.keepLogs ?? DEFAULT_KEEP_DEPLOY_LOGS);
-  const commit = options.commit || "";
-  const branch = options.branch || "";
-  return [
-    `mkdir -p ${meta}/deploys`,
-    `exec > >(tee -a ${log4}) 2>&1`,
-    `echo "[ts-cloud] deploy ${options.releaseId} commit=${commit} branch=${branch} starting $(date -u +%Y-%m-%dT%H:%M:%SZ)"`,
-    "ts_cloud_record_deploy() {",
-    "  TS_CLOUD_RC=$?",
-    '  if [ "$TS_CLOUD_RC" -eq 0 ]; then TS_CLOUD_ST=success; else TS_CLOUD_ST=failed; fi',
-    `  printf '%s\\t%s\\t%s\\t%s\\trc=%s\\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "${options.releaseId}" "${commit}" "$TS_CLOUD_ST" "$TS_CLOUD_RC" >> ${history}`,
-    "}",
-    "trap ts_cloud_record_deploy EXIT",
-    `ls -1t ${meta}/deploys/*.log 2>/dev/null | tail -n +${keepLogs + 1} | while read -r TS_CLOUD_OLDLOG; do rm -f "$TS_CLOUD_OLDLOG"; done`
-  ];
-}
-
 // src/drivers/shared/laravel-deploy.ts
 var MACRO_CREATE_RELEASE = "$CREATE_RELEASE";
 var MACRO_ACTIVATE_RELEASE = "$ACTIVATE_RELEASE";
@@ -86837,14 +87906,14 @@ function buildPhpFpmPoolScript(options) {
 }
 
 // src/drivers/shared/compute-deploy.ts
-var noopLogger = {
+var noopLogger2 = {
   info: () => {},
   warn: () => {},
   error: () => {},
   step: () => {},
   success: () => {}
 };
-async function deploySiteRelease(driver, options, logger4 = noopLogger) {
+async function deploySiteRelease(driver, options, logger4 = noopLogger2) {
   const {
     config: config6,
     environment,
@@ -86944,11 +88013,13 @@ async function deploySiteRelease(driver, options, logger4 = noopLogger) {
   const baseScript = kind === "server-static" ? buildStaticSiteDeployScript({
     siteName,
     artifactFetch,
+    releaseId: sha,
     preStartCommands: site.preStart
   }) : buildSiteDeployScript({
     siteName,
     slug,
     artifactFetch,
+    releaseId: sha,
     execStart: resolveExecStart(site.start, runtime),
     envEntries: site.env || {},
     port: site.port,
@@ -86961,7 +88032,7 @@ async function deploySiteRelease(driver, options, logger4 = noopLogger) {
     domain: site.domain,
     aliases: site.aliases,
     type: site.type === "spa" ? "spa" : "static",
-    appDir: `/var/www/${siteName}`,
+    appDir: `/var/www/${siteName}/current`,
     webDirectory: "",
     redirects: site.redirects,
     auth: site.auth && site.auth.enabled !== false && site.auth.password ? { username: site.auth.username || "admin", password: site.auth.password, realm: site.auth.realm } : undefined,
@@ -86972,7 +88043,16 @@ async function deploySiteRelease(driver, options, logger4 = noopLogger) {
     security: site.security
   }) : [];
   const staticSsl = wantsNginxStatic ? buildSslScript(site) : [];
-  const remoteScript = [...baseScript, ...staticVhost, ...staticSsl];
+  const remoteScript = [
+    ...buildDeployHistoryHeader(`/var/www/${siteName}`, {
+      releaseId: sha,
+      commit: sha,
+      branch: site.branch ?? "main"
+    }),
+    ...baseScript,
+    ...staticVhost,
+    ...staticSsl
+  ];
   logger4.step(`Deploying to ${targets.length} target(s)...`);
   const result = await driver.runRemoteDeploy({
     targets,
@@ -86999,8 +88079,21 @@ async function deploySiteRelease(driver, options, logger4 = noopLogger) {
   };
 }
 async function deployAllComputeSites(options) {
-  const { config: config6, environment, driver, sha, runtime, tarballForSite, logger: logger4 = noopLogger } = options;
+  const { config: config6, environment, driver, sha, runtime, tarballForSite, logger: logger4 = noopLogger2 } = options;
   const slug = config6.project.slug;
+  const cwd = options.cwd ?? process.cwd();
+  const hadDashboard = hasManagementDashboardSite(config6);
+  ensureManagementDashboard(config6, { cwd, logger: { info: logger4.info, warn: logger4.warn } });
+  const injectedDashboard = !hadDashboard && hasManagementDashboardSite(config6);
+  let dashboardTarball = null;
+  if (injectedDashboard) {
+    dashboardTarball = buildManagementDashboardArtifact(config6.sites?.[MANAGEMENT_DASHBOARD_SITE], { cwd, slug, sha, logger: { info: logger4.info, warn: logger4.warn } });
+    if (!dashboardTarball) {
+      logger4.warn("Management dashboard: no artifact available — skipping dashboard site for this deploy.");
+      if (config6.sites)
+        delete config6.sites[MANAGEMENT_DASHBOARD_SITE];
+    }
+  }
   const sites = config6.sites || {};
   const deployable = Object.entries(sites).filter(([name, site]) => {
     if (!site)
@@ -87010,13 +88103,16 @@ async function deployAllComputeSites(options) {
       logger4.warn(`Site '${name}' targets a bucket — skipping (handled by the static-site path, not compute).`);
       return false;
     }
+    if (kind === "redirect")
+      return false;
     return true;
   });
   if (deployable.length === 0)
     return true;
+  const tarballFor = (siteName) => siteName === MANAGEMENT_DASHBOARD_SITE && dashboardTarball ? dashboardTarball : tarballForSite(siteName);
   for (const [siteName, site] of deployable) {
     logger4.step(`Deploying site: ${siteName}`);
-    const localTarballPath = isPhpSite(site) ? undefined : tarballForSite(siteName);
+    const localTarballPath = isPhpSite(site) ? undefined : tarballFor(siteName);
     const result = await deploySiteRelease(driver, {
       config: config6,
       environment,
@@ -87049,7 +88145,7 @@ async function deployAllComputeSites(options) {
   return true;
 }
 async function reloadRpxGateway(options) {
-  const { config: config6, environment, driver, logger: logger4 = noopLogger } = options;
+  const { config: config6, environment, driver, logger: logger4 = noopLogger2 } = options;
   const proxy = config6.infrastructure?.compute?.proxy;
   if (proxy?.engine !== "rpx")
     return true;
@@ -87069,7 +88165,7 @@ async function reloadRpxGateway(options) {
     return true;
   }
   logger4.step(`Reloading rpx gateway with ${rpxConfig.proxies.length} route(s)...`);
-  const script = buildRpxProvisionScript({ proxy, config: rpxConfig });
+  const script = buildRpxProvisionScript({ proxy, config: rpxConfig, slug: config6.project.slug });
   const result = await driver.runRemoteDeploy({
     targets,
     commands: script,
@@ -87087,6 +88183,2077 @@ async function reloadRpxGateway(options) {
   logger4.success(`rpx gateway reloaded on ${result.instanceCount} target(s)`);
   return true;
 }
+// src/deploy/ssh-config-editor.ts
+import { createHash as createHash11 } from "node:crypto";
+function addSshKeyToCloudConfig(input) {
+  const name = normalizeKeyName(input.name);
+  const publicKey = normalizePublicKey(input.publicKey);
+  const keys = dedupeKeys([...input.existingKeys ?? [], { name, publicKey }]);
+  return updateComputeSshKeys(input.configText, keys);
+}
+function removeSshKeyFromCloudConfig(input) {
+  const name = normalizeKeyName(input.name);
+  const keys = (input.existingKeys ?? []).filter((key) => key.name !== name);
+  if ((input.existingKeys ?? []).length === keys.length)
+    throw new Error(`SSH key '${name}' does not exist in compute.sshKeys`);
+  return updateComputeSshKeys(input.configText, keys);
+}
+function describeSshKeys(keys = []) {
+  return keys.map((key) => ({
+    name: key.name,
+    publicKey: key.publicKey,
+    type: sshKeyType(key.publicKey),
+    fingerprint: sshFingerprint(key.publicKey),
+    added: "configured"
+  }));
+}
+function updateComputeSshKeys(configText, keys) {
+  const compute = findPropertyObject(configText, "compute");
+  const rendered = renderSshKeys(keys);
+  const existing = findPropertyArray(configText, compute.start, compute.end, "sshKeys");
+  if (existing) {
+    let lineStart = existing.propertyStart;
+    while (lineStart > 0 && configText[lineStart - 1] !== `
+` && /\s/.test(configText[lineStart - 1]))
+      lineStart--;
+    return `${configText.slice(0, lineStart)}${rendered}${configText.slice(existing.end + 1)}`;
+  }
+  const before = configText.slice(0, compute.end).trimEnd();
+  const after = configText.slice(compute.end);
+  const sep = before.endsWith(",") || before.endsWith("{") ? "" : ",";
+  return `${before}${sep}
+${rendered},
+    ${after}`;
+}
+function renderSshKeys(keys) {
+  if (keys.length === 0)
+    return "      sshKeys: []";
+  const body = keys.map((key) => [
+    "        {",
+    `          name: '${escapeString(key.name)}',`,
+    `          publicKey: '${escapeString(normalizePublicKey(key.publicKey))}',`,
+    "        },"
+  ].join(`
+`)).join(`
+`);
+  return `      sshKeys: [
+${body}
+      ]`;
+}
+function dedupeKeys(keys) {
+  const seen = new Map;
+  for (const key of keys) {
+    const name = normalizeKeyName(key.name);
+    if (seen.has(name))
+      throw new Error(`SSH key '${name}' already exists in compute.sshKeys`);
+    seen.set(name, { name, publicKey: normalizePublicKey(key.publicKey) });
+  }
+  return [...seen.values()];
+}
+function normalizeKeyName(name) {
+  const normalized = name.trim();
+  if (!/^[\w@.+-]{2,80}$/.test(normalized))
+    throw new Error("SSH key name must be 2-80 characters and use letters, numbers, @, ., +, _, or -.");
+  return normalized;
+}
+function normalizePublicKey(publicKey) {
+  const normalized = publicKey.trim().replace(/\s+/g, " ");
+  const [type, body] = normalized.split(" ");
+  if (!/^(?:ssh-(?:ed25519|rsa)|ecdsa-sha2-nistp(?:256|384|521))$/.test(type ?? "") || !body)
+    throw new Error("Public key must be an OpenSSH public key, e.g. ssh-ed25519 AAAA... name@host.");
+  return normalized;
+}
+function sshKeyType(publicKey) {
+  return publicKey.trim().split(/\s+/)[0] || "ssh";
+}
+function sshFingerprint(publicKey) {
+  const body = publicKey.trim().split(/\s+/)[1];
+  if (!body)
+    return "-";
+  try {
+    return `SHA256:${createHash11("sha256").update(Buffer.from(body, "base64")).digest("base64").replace(/=+$/, "")}`;
+  } catch {
+    return "-";
+  }
+}
+function escapeString(value) {
+  return value.replace(/\\/g, "\\\\").replaceAll(String.fromCharCode(39), "\\'");
+}
+function findPropertyObject(configText, property) {
+  const match = new RegExp(`\\b${property}\\s*:\\s*{`, "g").exec(configText);
+  if (!match)
+    throw new Error(`Could not find ${property}: { ... } in cloud config.`);
+  const start = configText.indexOf("{", match.index);
+  return { propertyStart: match.index, start, end: findMatching(configText, start, "{", "}") };
+}
+function findPropertyArray(configText, start, end, property) {
+  const body = configText.slice(start + 1, end);
+  const match = new RegExp(`\\b${property}\\s*:\\s*\\[`, "g").exec(body);
+  if (!match)
+    return null;
+  const propertyStart = start + 1 + match.index;
+  const arrayStart = configText.indexOf("[", propertyStart);
+  return { propertyStart, start: arrayStart, end: findMatching(configText, arrayStart, "[", "]") };
+}
+function findMatching(text, start, open, close) {
+  let depth = 0;
+  let quote;
+  let escaped = false;
+  let lineComment = false;
+  let blockComment = false;
+  for (let index = start;index < text.length; index++) {
+    const char = text[index];
+    const next = text[index + 1];
+    if (lineComment) {
+      if (char === `
+`)
+        lineComment = false;
+      continue;
+    }
+    if (blockComment) {
+      if (char === "*" && next === "/") {
+        blockComment = false;
+        index++;
+      }
+      continue;
+    }
+    if (quote) {
+      if (escaped) {
+        escaped = false;
+        continue;
+      }
+      if (char === "\\") {
+        escaped = true;
+        continue;
+      }
+      if (char === quote)
+        quote = undefined;
+      continue;
+    }
+    if (char === "/" && next === "/") {
+      lineComment = true;
+      index++;
+      continue;
+    }
+    if (char === "/" && next === "*") {
+      blockComment = true;
+      index++;
+      continue;
+    }
+    if (char === '"' || char === "'" || char === "`") {
+      quote = char;
+      continue;
+    }
+    if (char === open)
+      depth++;
+    if (char === close) {
+      depth--;
+      if (depth === 0)
+        return index;
+    }
+  }
+  throw new Error(`Could not find matching ${close} in cloud config.`);
+}
+
+// src/deploy/dashboard-data-server.ts
+var PROBED_SERVICES = ["rpx-gateway", "nginx", "php8.3-fpm", "php8.2-fpm", "mysql", "mariadb", "postgresql", "redis", "redis-server", "meilisearch"];
+var UNKNOWN = "-";
+function metricsScript() {
+  return [
+    "set +e",
+    'echo "CPUS=$(nproc 2>/dev/null || echo 1)"',
+    `echo "LOAD=$(cut -d' ' -f1 /proc/loadavg 2>/dev/null || echo 0)"`,
+    `echo "MEMTOTAL=$(free -m 2>/dev/null | awk '/^Mem:/{print $2}')"`,
+    `echo "MEMUSED=$(free -m 2>/dev/null | awk '/^Mem:/{print $3}')"`,
+    `echo "DISKPCT=$(df -P / 2>/dev/null | awk 'NR==2{gsub("%","",$5);print $5}')"`,
+    `echo "DISKUSEDG=$(df -BG / 2>/dev/null | awk 'NR==2{gsub("G","",$3);print $3}')"`,
+    `echo "DISKTOTG=$(df -BG / 2>/dev/null | awk 'NR==2{gsub("G","",$2);print $2}')"`,
+    `echo "UPTIME=$(uptime -p 2>/dev/null | sed 's/^up //' || echo unknown)"`,
+    'echo "OS=$(. /etc/os-release 2>/dev/null; echo "$PRETTY_NAME")"',
+    `for s in ${PROBED_SERVICES.join(" ")}; do st=$(systemctl is-active "$s" 2>/dev/null); if [ -n "$st" ] && [ "$st" != "inactive" ] && [ "$st" != "unknown" ]; then mem=$(systemctl show "$s" -p MemoryCurrent --value 2>/dev/null); en=$(systemctl is-enabled "$s" 2>/dev/null); since=$(systemctl show "$s" -p ActiveEnterTimestamp --value 2>/dev/null); echo "SVC=$s=$st=$mem=$en=$since"; fi; done`,
+    "true"
+  ];
+}
+function parseBlock(output) {
+  const kv = { services: [] };
+  for (const line of output.split(`
+`)) {
+    const l = line.trim();
+    if (l.startsWith("SVC=")) {
+      const [, name, status, memBytes, enabled2, since] = /^SVC=([^=]+)=([^=]+)(?:=([^=]*)(?:=([^=]*)(?:=(.*))?)?)?$/.exec(l) ?? [];
+      if (name) {
+        kv.services.push({
+          name,
+          status,
+          memBytes: Number(memBytes || 0),
+          enabled: enabled2 || UNKNOWN,
+          since: since || UNKNOWN
+        });
+      }
+    } else {
+      const eq = l.indexOf("=");
+      if (eq > 0)
+        kv[l.slice(0, eq)] = l.slice(eq + 1);
+    }
+  }
+  return kv;
+}
+function configuredServices(config6) {
+  const compute = config6.infrastructure?.compute;
+  const services = [];
+  if (compute?.webServer === "rpx" || compute?.proxy?.engine === "rpx")
+    services.push({ name: "rpx-gateway", status: "configured" });
+  else if (compute?.webServer === "nginx" || compute?.webServer == null)
+    services.push({ name: "ts-cloud-nginx", status: "configured" });
+  const phpVersions = compute?.php?.versions ?? (compute?.runtime === "php" ? ["8.3"] : []);
+  for (const version2 of phpVersions)
+    services.push({ name: `php${version2}-fpm`, status: "configured" });
+  const managed = compute?.managedServices ?? {};
+  const serviceNames = [
+    ["mysql", "mysql"],
+    ["mariadb", "mariadb"],
+    ["postgres", "postgresql"],
+    ["redis", "redis"],
+    ["memcached", "memcached"],
+    ["meilisearch", "meilisearch"]
+  ];
+  for (const [key, name] of serviceNames) {
+    if (managed[key])
+      services.push({ name, status: "configured" });
+  }
+  return services;
+}
+function configuredBackup(config6) {
+  const backup = config6.infrastructure?.compute?.backups;
+  const enabled2 = !!backup?.enabled;
+  const schedule = backup?.schedule ?? "0 2 * * *";
+  return {
+    enabled: enabled2,
+    schedule,
+    destination: enabled2 ? backup?.bucket ?? "local" : "off",
+    retention: enabled2 ? backup?.retentionCount ?? 5 : 0,
+    last: enabled2 ? "pending first run" : "not configured",
+    size: enabled2 ? UNKNOWN : "0 MB"
+  };
+}
+function configuredProvider(config6) {
+  return config6.infrastructure?.compute?.provider ?? config6.cloud?.provider ?? config6.provider ?? "aws";
+}
+function configuredRegion(config6) {
+  const provider = configuredProvider(config6);
+  if (provider === "hetzner") {
+    return config6.hetzner?.location ?? process.env.HCLOUD_LOCATION ?? process.env.HETZNER_LOCATION ?? "fsn1";
+  }
+  return config6.project.region ?? "us-east-1";
+}
+function loadLocalState(config6, environment) {
+  const statePath = join21(process.cwd(), ".ts-cloud", "state", `${config6.project.slug}-${environment}.json`);
+  if (!existsSync24(statePath))
+    return null;
+  try {
+    return JSON.parse(readFileSync17(statePath, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function configuredWorkers(config6) {
+  const sites = config6.sites ?? {};
+  const workers = [];
+  for (const [siteName, site] of Object.entries(sites)) {
+    const queues = site.queues ?? site.workers;
+    if (Array.isArray(queues)) {
+      for (const queue of queues) {
+        if (typeof queue === "string")
+          workers.push({ name: `${siteName}:${queue}`, site: siteName, processes: 1, status: "configured" });
+        else if (queue?.name)
+          workers.push({ name: `${siteName}:${queue.name}`, site: siteName, processes: queue.processes ?? 1, status: "configured" });
+      }
+    }
+  }
+  return workers;
+}
+function normalizeSitePath(path) {
+  if (!path || path === "")
+    return "/";
+  return path.startsWith("/") ? path : `/${path}`;
+}
+function siteRoute(site) {
+  const path = normalizeSitePath(site.path);
+  if (!site.domain)
+    return { route: "internal" };
+  return {
+    route: path === "/" ? site.domain : `${site.domain}${path}`,
+    href: `https://${site.domain}${path === "/" ? "" : path}`
+  };
+}
+function siteKindLabel(name, site) {
+  const kind = resolveSiteKind(site);
+  const build = String(site.build ?? "").toLowerCase();
+  const start = String(site.start ?? "").toLowerCase();
+  if (name === "main" || start.includes("buddy/src/cli.ts serve"))
+    return "stacks";
+  if (name === "api" || start.includes("/serve/api"))
+    return "api";
+  if (build.includes("buildblog"))
+    return "bunpress blog";
+  if (build.includes("bunpress"))
+    return "bunpress";
+  if (build.includes("site:build") || build.includes("stx"))
+    return "stx static";
+  if (kind === "server-static")
+    return site.spa ? "spa" : "static";
+  if (kind === "server-app")
+    return "app";
+  if (kind === "server-php")
+    return site.type ?? "php";
+  return "bucket";
+}
+function siteRuntime(site) {
+  const kind = resolveSiteKind(site);
+  const command = `${site.start ?? ""} ${site.build ?? ""}`.toLowerCase();
+  if (kind === "server-static")
+    return command.includes("bunpress") || command.includes("bun ") || command.includes("bunx ") ? "static/bun" : "static";
+  if (kind === "server-app")
+    return command.includes("bun") ? "bun" : "node";
+  if (kind === "server-php")
+    return `php ${site.php ?? site.phpVersion ?? "8.3"}`;
+  return "static";
+}
+function siteDeployLabel(site) {
+  const kind = resolveSiteKind(site);
+  if (kind === "server-app")
+    return "service";
+  if (kind === "server-static")
+    return "server static";
+  if (kind === "server-php")
+    return "php release";
+  return "bucket";
+}
+function configuredSites(config6) {
+  const seenRoutes = new Map;
+  return Object.entries(config6.sites ?? {}).map(([name, site]) => {
+    const path = normalizeSitePath(site.path);
+    const { route, href } = siteRoute(site);
+    const routeKey = site.domain ? `${site.domain}${path}` : "";
+    const shadowedBy = routeKey ? seenRoutes.get(routeKey) : undefined;
+    if (routeKey && !shadowedBy)
+      seenRoutes.set(routeKey, name);
+    return {
+      name,
+      route,
+      href,
+      domain: site.domain ?? "internal",
+      path,
+      kind: siteKindLabel(name, site),
+      type: siteKindLabel(name, site),
+      runtime: siteRuntime(site),
+      deploy: siteDeployLabel(site),
+      tls: site.domain ? site.ssl === false ? "http" : "https" : "loopback",
+      ssl: site.domain ? site.ssl !== false : false,
+      status: shadowedBy ? "shadowed" : "live",
+      shadowedBy,
+      lastDeploy: UNKNOWN
+    };
+  });
+}
+function shellSingleQuote(value) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function sedReplacement(value) {
+  return value.replace(/[\\&/]/g, "\\$&");
+}
+function deployHistoryScript(siteNames) {
+  if (siteNames.length === 0)
+    return ["true"];
+  return [
+    "set +e",
+    ...siteNames.map((siteName) => {
+      const historyPath = shellSingleQuote(`/var/www/${siteName}/.ts-cloud/deploy-history.log`);
+      const prefix = sedReplacement(siteName);
+      return `TS_CLOUD_HISTORY=${historyPath}; { [ -f "$TS_CLOUD_HISTORY" ] && tail -n 24 "$TS_CLOUD_HISTORY" | sed "s/^/DEPLOY=${prefix}\\t/"; } || true`;
+    }),
+    "true"
+  ];
+}
+function siteDomains(config6) {
+  return [...new Set(Object.values(config6.sites ?? {}).map((site) => site.domain).filter((domain) => typeof domain === "string" && domain.length > 0))];
+}
+function securityScript(config6) {
+  const domains = siteDomains(config6);
+  return [
+    "set +e",
+    'if command -v ss >/dev/null 2>&1; then ss -H -lntup 2>/dev/null | while read -r proto _state _recv _send local _peer rest; do [ -n "$proto" ] && [ -n "$local" ] && printf "PORT=%s\\t%s\\t%s\\n" "$proto" "$local" "$rest"; done; fi',
+    'if command -v ufw >/dev/null 2>&1; then ufw status numbered 2>/dev/null | sed "s/^/FIREWALL=/"; else echo "FIREWALL=ufw unavailable"; fi',
+    'journalctl _COMM=sshd --no-pager -n 30 -o short-iso 2>/dev/null | sed "s/^/AUTH=/" || true',
+    ...domains.map((domain) => {
+      const quoted = shellSingleQuote(domain);
+      return `TS_CLOUD_DOMAIN=${quoted}; TS_CLOUD_EXPIRY=$(echo | timeout 8 openssl s_client -servername "$TS_CLOUD_DOMAIN" -connect "$TS_CLOUD_DOMAIN:443" 2>/dev/null | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2-); [ -n "$TS_CLOUD_EXPIRY" ] && printf "CERT=%s\\t%s\\n" "$TS_CLOUD_DOMAIN" "$TS_CLOUD_EXPIRY" || printf "CERT=%s\\tunavailable\\n" "$TS_CLOUD_DOMAIN"`;
+    }),
+    "true"
+  ];
+}
+function serverLogSources(config6) {
+  const byLabel = new Map;
+  const add = (pattern, label) => {
+    if (pattern && label && !byLabel.has(label))
+      byLabel.set(label, { pattern, label });
+  };
+  const compute = config6.infrastructure?.compute;
+  const slug = config6.project.slug;
+  if (compute?.webServer === "rpx" || compute?.proxy?.engine === "rpx")
+    add("rpx-gateway", "rpx-gateway");
+  else
+    add("nginx", "nginx");
+  for (const svc of configuredServices(config6))
+    add(svc.name, svc.name);
+  for (const [siteName, site] of Object.entries(config6.sites ?? {})) {
+    if (resolveSiteKind(site) !== "server-app")
+      continue;
+    add(`${slug}-${siteName}`, `${slug}-${siteName}`);
+    if (Array.isArray(site.queues ?? site.workers) && (site.queues ?? site.workers).length)
+      add(`${slug}-${siteName}-queue-*`, `${slug}-${siteName}-queues`);
+    if (Array.isArray(site.daemons) && site.daemons.length)
+      add(`${slug}-${siteName}-daemon-*`, `${slug}-${siteName}-daemons`);
+  }
+  return [...byLabel.values()];
+}
+function serverLogsScript(config6) {
+  const sources = serverLogSources(config6);
+  if (sources.length === 0)
+    return ["true"];
+  return [
+    "set +e",
+    ...sources.map((source) => {
+      const quoted = shellSingleQuote(source.pattern);
+      const prefix = sedReplacement(source.label);
+      return `journalctl -u ${quoted} --no-pager -n 150 -o short-iso 2>/dev/null | sed "s/^/LOG=${prefix}\\t/" || true`;
+    }),
+    `[ -f /var/log/ts-cloud-backup.log ] && tail -n 60 /var/log/ts-cloud-backup.log 2>/dev/null | sed "s/^/LOG=backups\\t/" || true`,
+    "true"
+  ];
+}
+function relativeTime(iso) {
+  const date = new Date(iso);
+  if (Number.isNaN(date.getTime()))
+    return iso || UNKNOWN;
+  const seconds = Math.max(0, Math.round((Date.now() - date.getTime()) / 1000));
+  if (seconds < 60)
+    return `${seconds}s ago`;
+  const minutes = Math.round(seconds / 60);
+  if (minutes < 60)
+    return `${minutes}m ago`;
+  const hours = Math.round(minutes / 60);
+  if (hours < 48)
+    return `${hours}h ago`;
+  const days = Math.round(hours / 24);
+  return `${days}d ago`;
+}
+function inferLogLevel(message) {
+  if (/(?:error|failed|panic|fatal|exception|denied|unhealthy)/i.test(message))
+    return "error";
+  if (/(?:warn|warning|retry|restart|deprecated|timeout)/i.test(message))
+    return "warn";
+  return "info";
+}
+function parseServerLogs(output) {
+  const records = [];
+  for (const rawLine of output.split(`
+`)) {
+    const line = rawLine.trim();
+    if (!line.startsWith("LOG="))
+      continue;
+    const tab = line.indexOf("\t");
+    if (tab < 0)
+      continue;
+    const source = line.slice(4, tab);
+    const raw = line.slice(tab + 1);
+    const match = /^(\d{4}-\d{2}-\d{2}T[^\s]+)\s+(\S+)\s+(.*)$/.exec(raw);
+    const timestamp = match?.[1] ?? "";
+    const host = match?.[2] ?? "";
+    const message = (match?.[3] ?? raw).trim();
+    if (!message)
+      continue;
+    records.push({
+      source,
+      timestamp,
+      when: timestamp ? relativeTime(timestamp) : UNKNOWN,
+      host,
+      message,
+      level: inferLogLevel(message)
+    });
+  }
+  return records.sort((a, b) => String(b.timestamp).localeCompare(String(a.timestamp))).slice(0, 600);
+}
+function listenerExposure(listen) {
+  if (/^(?:127\.|localhost:|\[?::1\]?)/.test(listen))
+    return "loopback";
+  if (/^(?:10\.|192\.168\.|172\.(?:1[6-9]|2\d|3[01])\.|169\.254\.|\[?f[cd][0-9a-f:])/i.test(listen))
+    return "private";
+  return "public";
+}
+function portTone(listen) {
+  const exposure = listenerExposure(listen);
+  if (exposure !== "public")
+    return "ok";
+  if (/:(?:22|80|443)$/.test(listen) || /^\*:(?:22|80|443)$/.test(listen))
+    return "ok";
+  return "warn";
+}
+function certStatus(daysRemaining) {
+  if (daysRemaining == null)
+    return "warn";
+  if (daysRemaining < 8)
+    return "bad";
+  if (daysRemaining < 30)
+    return "warn";
+  return "ok";
+}
+function parseServerSecurity(output) {
+  const ports = [];
+  const firewallLines = [];
+  const authEvents = [];
+  const tlsCertificates = [];
+  for (const rawLine of output.split(`
+`)) {
+    const line = rawLine.trim();
+    if (line.startsWith("PORT=")) {
+      const [proto = "", listen = "", process21 = ""] = line.slice(5).split("\t");
+      if (proto && listen) {
+        ports.push({
+          proto,
+          listen,
+          processName: process21 || UNKNOWN,
+          exposure: listenerExposure(listen),
+          tone: portTone(listen)
+        });
+      }
+    } else if (line.startsWith("FIREWALL=")) {
+      const value = line.slice(9).trim();
+      if (value)
+        firewallLines.push(value);
+    } else if (line.startsWith("AUTH=")) {
+      const raw = line.slice(5);
+      const match = /^(\d{4}-\d{2}-\d{2}T[^\s]+)\s+(\S+)\s+(.*)$/.exec(raw);
+      const message = (match?.[3] ?? raw).trim();
+      if (message) {
+        authEvents.push({
+          timestamp: match?.[1] ?? "",
+          when: match?.[1] ? relativeTime(match[1]) : UNKNOWN,
+          host: match?.[2] ?? "",
+          message,
+          level: inferLogLevel(message)
+        });
+      }
+    } else if (line.startsWith("CERT=")) {
+      const [domain = "", expiresRaw = ""] = line.slice(5).split("\t");
+      if (!domain)
+        continue;
+      const expiresAt = new Date(expiresRaw);
+      const daysRemaining = Number.isNaN(expiresAt.getTime()) ? null : Math.ceil((expiresAt.getTime() - Date.now()) / 86400000);
+      tlsCertificates.push({
+        domain,
+        expires: Number.isNaN(expiresAt.getTime()) ? expiresRaw || UNKNOWN : expiresAt.toISOString().slice(0, 10),
+        daysRemaining,
+        status: certStatus(daysRemaining)
+      });
+    }
+  }
+  const firewallEnabled = firewallLines.some((line) => /Status:\s*active/i.test(line));
+  const firewallUnavailable = firewallLines.some((line) => /unavailable/i.test(line));
+  return {
+    ports: ports.slice(0, 80),
+    firewall: {
+      status: firewallEnabled ? "active" : firewallUnavailable ? "unavailable" : "inactive",
+      summary: firewallEnabled ? "ufw active" : firewallUnavailable ? "ufw unavailable" : "ufw inactive or not configured",
+      rules: firewallLines.filter((line) => line && !/^Status:/i.test(line)).slice(0, 60)
+    },
+    tlsCertificates,
+    authEvents: authEvents.sort((a, b) => String(b.timestamp).localeCompare(String(a.timestamp))).slice(0, 30)
+  };
+}
+function configuredSecurity(config6) {
+  const compute = config6.infrastructure?.compute;
+  const firewall = compute?.firewall ?? {};
+  const allowedPorts = [...new Set([22, 80, 443, ...firewall.allowedPorts ?? []])];
+  const domains = siteDomains(config6);
+  return {
+    ports: allowedPorts.map((port) => ({
+      proto: "tcp",
+      listen: `0.0.0.0:${port}`,
+      processName: "configured firewall",
+      exposure: "public",
+      tone: [22, 80, 443].includes(Number(port)) ? "ok" : "warn"
+    })),
+    firewall: {
+      status: firewall.enabled === false ? "disabled" : "configured",
+      summary: firewall.enabled === false ? "host firewall disabled in config" : "host firewall configured declaratively",
+      rules: allowedPorts.map((port) => `ALLOW ${port}/tcp`)
+    },
+    tlsCertificates: domains.map((domain) => ({
+      domain,
+      expires: UNKNOWN,
+      daysRemaining: null,
+      status: "warn"
+    })),
+    authEvents: []
+  };
+}
+function diagnosticChecks(config6, data) {
+  const security = data.security ?? configuredSecurity(config6);
+  const live = !!data._serverReachable && !data.metricsUnavailable;
+  const sites = data.sites ?? [];
+  const shadowed = sites.filter((site) => site.status === "shadowed");
+  const failedServices = (data.services ?? []).filter((service) => ["failed", "stopped"].includes(service.status));
+  const expiringCerts = (security.tlsCertificates ?? []).filter((cert) => cert.status !== "ok");
+  const sshKeys = data.sshKeys ?? [];
+  return [
+    {
+      name: "Live server probe",
+      status: live ? "pass" : "warn",
+      detail: live ? "Metrics and remote checks are coming from the compute box." : "The dashboard is rendering config/state data until the box probe succeeds."
+    },
+    {
+      name: "Managed services",
+      status: failedServices.length ? "fail" : "pass",
+      detail: failedServices.length ? `${failedServices.length} service(s) need attention.` : `${(data.services ?? []).length} service(s) reported healthy or configured.`
+    },
+    {
+      name: "Route conflicts",
+      status: shadowed.length ? "warn" : "pass",
+      detail: shadowed.length ? `${shadowed.map((site) => site.name).join(", ")} is shadowed by an earlier route.` : `${sites.length} site route(s) are unshadowed.`
+    },
+    {
+      name: "SSH access",
+      status: sshKeys.length ? "pass" : "warn",
+      detail: sshKeys.length ? `${sshKeys.length} declarative authorized key(s) configured.` : "No declarative SSH keys are configured."
+    },
+    {
+      name: "Firewall",
+      status: ["active", "configured"].includes(security.firewall?.status) ? "pass" : "warn",
+      detail: security.firewall?.summary ?? "Firewall status unavailable."
+    },
+    {
+      name: "TLS certificates",
+      status: expiringCerts.length ? "warn" : "pass",
+      detail: expiringCerts.length ? `${expiringCerts.length} certificate(s) need renewal visibility.` : `${(security.tlsCertificates ?? []).length} certificate(s) look healthy.`
+    }
+  ];
+}
+function activityFeed(data) {
+  const activity = [];
+  for (const deploy of data.serverDeploymentsDetail ?? data.serverDeployments ?? []) {
+    activity.push({
+      type: "deploy",
+      tone: deploy.status === "failed" ? "bad" : "ok",
+      title: `${deploy.site} deployed ${deploy.sha}`,
+      detail: `${deploy.branch} · ${deploy.status}`,
+      when: deploy.when,
+      timestamp: deploy.timestamp
+    });
+  }
+  for (const log4 of data.serverLogs ?? []) {
+    if (log4.level === "error" || log4.level === "warn") {
+      activity.push({
+        type: "log",
+        tone: log4.level === "error" ? "bad" : "warn",
+        title: `${log4.source} ${log4.level}`,
+        detail: log4.message,
+        when: log4.when,
+        timestamp: log4.timestamp
+      });
+    }
+  }
+  for (const key of data.sshKeys ?? []) {
+    activity.push({
+      type: "ssh",
+      tone: "ok",
+      title: `${key.name} authorized`,
+      detail: key.fingerprint,
+      when: key.added ?? UNKNOWN,
+      timestamp: ""
+    });
+  }
+  return activity.sort((a, b) => String(b.timestamp).localeCompare(String(a.timestamp))).slice(0, 80);
+}
+function parseDeployHistory(output, sites = {}) {
+  const records = [];
+  for (const rawLine of output.split(`
+`)) {
+    const line = rawLine.trim();
+    if (!line.startsWith("DEPLOY="))
+      continue;
+    const parts = line.split("\t");
+    const site = parts[0]?.replace(/^DEPLOY=/, "") ?? "";
+    const [timestamp, releaseId, commit, status, rcPart] = parts.slice(1);
+    if (!site || !timestamp || !releaseId)
+      continue;
+    const siteConfig = sites[site] ?? {};
+    const kind = resolveSiteKind(siteConfig);
+    const sha = (commit || releaseId).slice(0, 7);
+    records.push({
+      sha,
+      release: releaseId,
+      commit: commit || releaseId,
+      site,
+      branch: siteConfig.branch ?? (kind === "server-static" ? "build artifact" : "main"),
+      status: status || "unknown",
+      when: relativeTime(timestamp),
+      timestamp,
+      took: "-",
+      by: "ts-cloud",
+      rc: rcPart?.replace(/^rc=/, "") ?? "",
+      steps: kind === "server-static" ? ["upload artifact", "publish static files"] : ["upload artifact", "restart service"]
+    });
+  }
+  return records.sort((a, b) => String(b.timestamp).localeCompare(String(a.timestamp)));
+}
+function resolveConfigOnlyServerDashboardData(config6, environment) {
+  const state = loadLocalState(config6, environment);
+  const services = configuredServices(config6);
+  const sites = configuredSites(config6);
+  const diskSize = Math.max(1, Number(config6.infrastructure?.compute?.disk?.size ?? 1));
+  const out = {
+    server: {
+      name: state?.serverName ?? `${config6.project.slug}-${environment}-app`,
+      provider: state?.provider ?? configuredProvider(config6),
+      region: configuredRegion(config6),
+      ip: state?.publicIp ?? UNKNOWN,
+      os: "Linux",
+      uptime: UNKNOWN,
+      probeStatus: "unavailable"
+    },
+    systemMetrics: {
+      load: 0,
+      cpus: Math.max(1, Number(config6.infrastructure?.compute?.instances ?? 1)),
+      memUsedMb: 0,
+      memTotalMb: 0,
+      diskUsedPct: 0,
+      diskUsedGb: 0,
+      diskTotalGb: diskSize
+    },
+    metricsUnavailable: true,
+    services,
+    servicesDetail: services.map((s) => ({ ...s, since: UNKNOWN, memMb: 0, auto: true })),
+    backup: configuredBackup(config6),
+    backupHistory: [],
+    workers: configuredWorkers(config6),
+    serverScheduler: { enabled: false, lastRun: "not configured" },
+    serverDeployments: [],
+    serverDeploymentsDetail: [],
+    deploymentsEmptyReason: "No deployment history has been recorded yet. Future server deploys will write /var/www/<site>/.ts-cloud/deploy-history.log.",
+    serverLogs: [],
+    serverLogsEmptyReason: "Live server logs are unavailable until the dashboard can reach the compute box.",
+    security: configuredSecurity(config6),
+    securityEmptyReason: "Live security checks are unavailable until the dashboard can reach the compute box.",
+    sites,
+    sitesDetail: sites.map((s) => {
+      const site = config6.sites?.[s.name] ?? {};
+      const kind = resolveSiteKind(site);
+      return {
+        ...s,
+        root: kind === "server-static" ? `/var/www/${s.name}` : `/var/www/${s.name}/current`,
+        branch: kind === "server-static" ? "build artifact" : "main",
+        build: site.build,
+        envKeys: Object.keys(site.env ?? site.environment ?? {})
+      };
+    }),
+    sshKeys: describeSshKeys(config6.infrastructure?.compute?.sshKeys ?? []),
+    _serverReachable: false,
+    _metricsStatus: "unavailable"
+  };
+  out.diagnostics = diagnosticChecks(config6, out);
+  out.activity = activityFeed(out);
+  return out;
+}
+async function resolveServerDashboardData(config6, environment) {
+  if (!config6.infrastructure?.compute)
+    return null;
+  let driver = null;
+  try {
+    driver = createCloudDriver({ config: config6 });
+  } catch {
+    driver = null;
+  }
+  let parsed = null;
+  let instanceCount = 0;
+  let targets = [];
+  if (driver)
+    try {
+      targets = await driver.findComputeTargets({ slug: config6.project.slug, environment, role: "app" });
+      instanceCount = targets.length;
+      if (targets.length) {
+        const result = await driver.runRemoteDeploy({
+          targets: [targets[0]],
+          commands: metricsScript(),
+          comment: `ts-cloud dashboard:build ${config6.project.slug}`,
+          tags: { Project: config6.project.slug, Environment: environment, Role: "app" }
+        });
+        const output = result.perInstance?.[0]?.output;
+        if (output)
+          parsed = parseBlock(output);
+      }
+    } catch {}
+  const out = resolveConfigOnlyServerDashboardData(config6, environment);
+  const num = (v, d = 0) => {
+    const n = Number(v);
+    return Number.isFinite(n) ? n : d;
+  };
+  out.server.os = parsed?.OS || out.server.os;
+  out.server.uptime = parsed?.UPTIME || out.server.uptime;
+  if (parsed) {
+    out.server.probeStatus = "live";
+    out.metricsUnavailable = false;
+    out._metricsStatus = "live";
+    out.systemMetrics = {
+      load: num(parsed.LOAD),
+      cpus: num(parsed.CPUS, 1),
+      memUsedMb: num(parsed.MEMUSED),
+      memTotalMb: num(parsed.MEMTOTAL, 1),
+      diskUsedPct: num(parsed.DISKPCT),
+      diskUsedGb: num(parsed.DISKUSEDG),
+      diskTotalGb: num(parsed.DISKTOTG, 1)
+    };
+    if (parsed.services.length) {
+      out.services = parsed.services.map((s) => ({ name: s.name, status: s.status === "active" ? "running" : s.status }));
+      out.servicesDetail = parsed.services.map((s) => ({
+        name: s.name,
+        status: s.status === "active" ? "running" : s.status,
+        since: s.since && s.since !== UNKNOWN ? s.since : out.server.uptime,
+        memMb: Math.max(0, Math.round(Number(s.memBytes ?? 0) / 1024 / 1024)),
+        auto: s.enabled ? !["disabled", "static", "masked"].includes(s.enabled) : true
+      }));
+    }
+  }
+  if (driver && targets.length) {
+    try {
+      const siteNames = Object.keys(config6.sites ?? {});
+      const historyResult = await driver.runRemoteDeploy({
+        targets: [targets[0]],
+        commands: deployHistoryScript(siteNames),
+        comment: `ts-cloud dashboard:deploy-history ${config6.project.slug}`,
+        tags: { Project: config6.project.slug, Environment: environment, Role: "app" }
+      });
+      const historyOutput = historyResult.perInstance?.[0]?.output ?? "";
+      const records = parseDeployHistory(historyOutput, config6.sites);
+      out.serverDeployments = records.slice(0, 5);
+      out.serverDeploymentsDetail = records.slice(0, 50);
+      out.deploymentsEmptyReason = records.length ? undefined : "No deployment history was found on the server yet. Deploy again to populate this timeline.";
+    } catch {
+      out.deploymentsEmptyReason = "Deployment history could not be read from the server.";
+    }
+  } else if (driver && instanceCount === 0) {
+    out.deploymentsEmptyReason = "No app server target was found for this environment.";
+  }
+  if (driver && targets.length) {
+    try {
+      const logsResult = await driver.runRemoteDeploy({
+        targets: [targets[0]],
+        commands: serverLogsScript(config6),
+        comment: `ts-cloud dashboard:server-logs ${config6.project.slug}`,
+        tags: { Project: config6.project.slug, Environment: environment, Role: "app" }
+      });
+      const logsOutput = logsResult.perInstance?.[0]?.output ?? "";
+      const records = parseServerLogs(logsOutput);
+      out.serverLogs = records;
+      out.serverLogsEmptyReason = records.length ? undefined : "No recent journal entries were found for the managed server units.";
+    } catch {
+      out.serverLogsEmptyReason = "Server logs could not be read from the box.";
+    }
+  }
+  if (driver && targets.length) {
+    try {
+      const securityResult = await driver.runRemoteDeploy({
+        targets: [targets[0]],
+        commands: securityScript(config6),
+        comment: `ts-cloud dashboard:security ${config6.project.slug}`,
+        tags: { Project: config6.project.slug, Environment: environment, Role: "app" }
+      });
+      const securityOutput = securityResult.perInstance?.[0]?.output ?? "";
+      const liveSecurity = parseServerSecurity(securityOutput);
+      const declaredSecurity = configuredSecurity(config6);
+      if (!liveSecurity.ports.length)
+        liveSecurity.ports = declaredSecurity.ports;
+      if (!liveSecurity.tlsCertificates.length)
+        liveSecurity.tlsCertificates = declaredSecurity.tlsCertificates;
+      out.security = liveSecurity;
+      out.securityEmptyReason = undefined;
+    } catch {
+      out.securityEmptyReason = "Server security checks could not be read from the box.";
+    }
+  }
+  const sshKeys = config6.infrastructure?.compute?.sshKeys ?? config6.infrastructure?.ssh?.keys ?? config6.infrastructure?.sshKeys;
+  if (Array.isArray(sshKeys) && sshKeys.length) {
+    out.sshKeys = describeSshKeys(sshKeys);
+  }
+  out._serverReachable = instanceCount > 0 && !!parsed;
+  out.diagnostics = diagnosticChecks(config6, out);
+  out.activity = activityFeed(out);
+  return out;
+}
+
+// src/deploy/dashboard-database.ts
+var SOCKETS = {
+  mysql: "/var/lib/pantry/mysql/mysqld.sock",
+  mariadb: "/var/lib/pantry/mariadb/mariadbd.sock"
+};
+function isValidDbIdentifier(value) {
+  return /^[A-Za-z_][A-Za-z0-9_]{0,62}$/.test(value);
+}
+function normalizeEngine(engine) {
+  if (engine === "postgres" || engine === "pgsql")
+    return "postgres";
+  if (engine === "mariadb")
+    return "mariadb";
+  return "mysql";
+}
+function resolveDbEngine(config6) {
+  const compute = config6.infrastructure?.compute;
+  const declared = config6.infrastructure?.appDatabase?.engine;
+  if (declared)
+    return normalizeEngine(declared);
+  const managed = compute?.managedServices ?? {};
+  if (managed.postgres)
+    return "postgres";
+  if (managed.mariadb)
+    return "mariadb";
+  return "mysql";
+}
+var mysqlIdent = (v) => v.replace(/`/g, "``");
+var mysqlLit = (v) => v.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+var pgIdent = (v) => `"${v.replace(/"/g, '""')}"`;
+var pgLit = (v) => `'${v.replace(/'/g, "''")}'`;
+function mysqlExec(engine, sql) {
+  const sock = engine === "mariadb" ? SOCKETS.mariadb : SOCKETS.mysql;
+  return [`mysql --socket=${sock} -u root <<'TS_CLOUD_SQL_EOF'`, ...sql, "TS_CLOUD_SQL_EOF"];
+}
+function pgExec(sql) {
+  return ["psql -h 127.0.0.1 -p 5432 -U postgres -tA <<'TS_CLOUD_PG_EOF'", ...sql, "TS_CLOUD_PG_EOF"];
+}
+function buildListScript(engine) {
+  if (engine === "postgres") {
+    return pgExec([
+      "SELECT 'DB=' || datname FROM pg_database WHERE datistemplate = false;",
+      "SELECT 'USER=' || usename FROM pg_user;"
+    ]);
+  }
+  return mysqlExec(engine, [
+    "SELECT CONCAT('DB=', schema_name) FROM information_schema.schemata WHERE schema_name NOT IN ('information_schema', 'mysql', 'performance_schema', 'sys');",
+    "SELECT DISTINCT CONCAT('USER=', User) FROM mysql.user WHERE User NOT IN ('root', 'mysql.sys', 'mysql.session', 'mysql.infoschema', 'debian-sys-maint');"
+  ]);
+}
+function buildCreateDatabaseScript(engine, name) {
+  if (engine === "postgres") {
+    return pgExec([
+      `SELECT 'CREATE DATABASE ${pgIdent(name)}' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = ${pgLit(name)})\\gexec`
+    ]);
+  }
+  return mysqlExec(engine, [
+    `CREATE DATABASE IF NOT EXISTS \`${mysqlIdent(name)}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`
+  ]);
+}
+function buildCreateUserScript(engine, input) {
+  const { username, password, database, access: access4 } = input;
+  if (engine === "postgres") {
+    const lines2 = [
+      "DO $$ BEGIN",
+      `  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = ${pgLit(username)}) THEN CREATE ROLE ${pgIdent(username)} LOGIN PASSWORD ${pgLit(password)};`,
+      `  ELSE ALTER ROLE ${pgIdent(username)} LOGIN PASSWORD ${pgLit(password)}; END IF;`,
+      "END $$;"
+    ];
+    if (database) {
+      lines2.push(access4 === "readonly" ? `GRANT CONNECT ON DATABASE ${pgIdent(database)} TO ${pgIdent(username)};` : `GRANT ALL PRIVILEGES ON DATABASE ${pgIdent(database)} TO ${pgIdent(username)};`);
+    }
+    return pgExec(lines2);
+  }
+  const priv = access4 === "readonly" ? "SELECT" : "ALL PRIVILEGES";
+  const lines = [
+    `CREATE USER IF NOT EXISTS '${mysqlLit(username)}'@'%' IDENTIFIED BY '${mysqlLit(password)}';`,
+    `CREATE USER IF NOT EXISTS '${mysqlLit(username)}'@'localhost' IDENTIFIED BY '${mysqlLit(password)}';`,
+    `ALTER USER '${mysqlLit(username)}'@'%' IDENTIFIED BY '${mysqlLit(password)}';`,
+    `ALTER USER '${mysqlLit(username)}'@'localhost' IDENTIFIED BY '${mysqlLit(password)}';`
+  ];
+  if (database) {
+    lines.push(`GRANT ${priv} ON \`${mysqlIdent(database)}\`.* TO '${mysqlLit(username)}'@'%';`, `GRANT ${priv} ON \`${mysqlIdent(database)}\`.* TO '${mysqlLit(username)}'@'localhost';`);
+  }
+  lines.push("FLUSH PRIVILEGES;");
+  return mysqlExec(engine, lines);
+}
+function parseDbList(output) {
+  const databases = [];
+  const users = [];
+  for (const rawLine of output.split(`
+`)) {
+    const line = rawLine.trim();
+    if (line.startsWith("DB="))
+      databases.push(line.slice(3));
+    else if (line.startsWith("USER="))
+      users.push(line.slice(5));
+  }
+  return {
+    databases: [...new Set(databases)].filter(Boolean).sort(),
+    users: [...new Set(users)].filter(Boolean).sort()
+  };
+}
+async function runDb(config6, environment, commands, comment) {
+  let driver;
+  try {
+    driver = createCloudDriver({ config: config6 });
+  } catch (error2) {
+    return { ok: false, error: `Could not initialize the cloud driver: ${error2?.message ?? error2}` };
+  }
+  const slug = config6.project.slug;
+  const targets = await driver.findComputeTargets({ slug, environment, role: "app" });
+  if (!targets.length)
+    return { ok: false, error: "No app server target was found for this environment." };
+  const result = await driver.runRemoteDeploy({
+    targets: [targets[0]],
+    commands: ["set -uo pipefail", ...commands],
+    comment,
+    tags: { Project: slug, Environment: environment, Role: "app" }
+  });
+  return { ok: result.success, stdout: result.perInstance?.[0]?.output ?? "", stderr: result.perInstance?.[0]?.error ?? result.error ?? "" };
+}
+async function listDatabases(config6, environment) {
+  const engine = resolveDbEngine(config6);
+  const r = await runDb(config6, environment, buildListScript(engine), "ts-cloud db:list");
+  const parsed = r.ok && r.stdout ? parseDbList(r.stdout) : { databases: [], users: [] };
+  return { ...r, engine, ...parsed };
+}
+async function createDatabase(config6, environment, name) {
+  const engine = resolveDbEngine(config6);
+  return runDb(config6, environment, buildCreateDatabaseScript(engine, name), `ts-cloud db:create ${name}`);
+}
+async function createDatabaseUser(config6, environment, input) {
+  const engine = resolveDbEngine(config6);
+  return runDb(config6, environment, buildCreateUserScript(engine, input), `ts-cloud db:user ${input.username}`);
+}
+
+// src/drivers/shared/compute-ops.ts
+var noopLogger3 = {
+  info: () => {},
+  warn: () => {},
+  error: () => {},
+  step: () => {},
+  success: () => {}
+};
+async function findTargets(ctx) {
+  const targets = await ctx.driver.findComputeTargets({
+    slug: ctx.slug,
+    environment: ctx.environment,
+    role: ctx.role || "app"
+  });
+  return targets;
+}
+async function rollbackComputeSite(ctx, options) {
+  const logger4 = ctx.logger || noopLogger3;
+  const targets = await findTargets(ctx);
+  if (targets.length === 0)
+    return { success: false, error: `No '${ctx.role || "app"}' servers found for ${ctx.slug}/${ctx.environment}.` };
+  const appBase = `/var/www/${options.siteName}`;
+  const paths = releasePaths(appBase, options.to || "unused");
+  const commands = [
+    "set -uo pipefail",
+    ...buildRollbackScript(paths, options.to ? { to: options.to } : {}),
+    `(cd ${PANTRY_PROJECT_DIR} && pantry restart php-fpm) 2>/dev/null || true`,
+    `(cd ${paths.current} && eval "$(cd ${PANTRY_PROJECT_DIR} && pantry env 2>/dev/null)" && php artisan queue:restart) 2>/dev/null || true`
+  ];
+  logger4.step(`Rolling back ${options.siteName}${options.to ? ` to ${options.to}` : " to the previous release"} on ${targets.length} server(s)...`);
+  const result = await ctx.driver.runRemoteDeploy({
+    targets,
+    commands,
+    comment: `ts-cloud rollback ${ctx.slug}/${options.siteName}`,
+    tags: { Project: ctx.slug, Environment: ctx.environment, Role: ctx.role || "app" }
+  });
+  if (!result.success)
+    logger4.error(`Rollback failed: ${result.error || "unknown error"}`);
+  else
+    logger4.success(`Rolled back ${options.siteName}.`);
+  return { success: result.success, error: result.error, perInstance: result.perInstance };
+}
+async function restoreDatabaseBackup(ctx, options) {
+  const logger4 = ctx.logger || noopLogger3;
+  if (!options.database?.name)
+    return { success: false, error: "No appDatabase configured to restore." };
+  const targets = await findTargets(ctx);
+  if (targets.length === 0)
+    return { success: false, error: `No '${ctx.role || "app"}' servers found for ${ctx.slug}/${ctx.environment}.` };
+  logger4.step(`Restoring database '${options.database.name}'${options.from ? ` from ${options.from}` : " from the latest backup"} on ${targets.length} server(s)...`);
+  const result = await ctx.driver.runRemoteDeploy({
+    targets,
+    commands: buildBackupRestoreScript(options.database, { from: options.from }),
+    comment: `ts-cloud db:restore ${ctx.slug}/${options.database.name}`,
+    tags: { Project: ctx.slug, Environment: ctx.environment, Role: ctx.role || "app" }
+  });
+  if (!result.success)
+    logger4.error(`Restore failed: ${result.error || "unknown error"}`);
+  else
+    logger4.success(`Restored ${options.database.name}.`);
+  return { success: result.success, error: result.error, perInstance: result.perInstance };
+}
+
+// src/deploy/dashboard-operations.ts
+var SERVICE_VERBS = ["restart", "reload", "start", "stop", "enable", "disable"];
+var MAX_OUTPUT_BYTES = 64 * 1024;
+function clampOutput(output) {
+  return output.length <= MAX_OUTPUT_BYTES ? output : `${output.slice(0, MAX_OUTPUT_BYTES)}
+
+[output truncated]`;
+}
+function isSafeSystemdUnit(value) {
+  return /^[A-Za-z0-9_.@:-]+$/.test(value);
+}
+function isSafeSiteName(value) {
+  return /^[A-Za-z0-9_-]+$/.test(value);
+}
+function capitalize(value) {
+  return value.charAt(0).toUpperCase() + value.slice(1);
+}
+function buildDashboardOperations(config6, data) {
+  const ops = [];
+  const services = data.servicesDetail ?? data.services ?? [];
+  for (const service of services) {
+    const name = String(service?.name ?? "");
+    if (!name || !isSafeSystemdUnit(name))
+      continue;
+    for (const verb of SERVICE_VERBS) {
+      ops.push({
+        id: `${verb}:${name}`,
+        label: `${capitalize(verb)} ${name}`,
+        group: "service",
+        target: name,
+        mutates: true,
+        confirm: name,
+        danger: verb === "stop" || verb === "disable"
+      });
+    }
+  }
+  for (const [name, site] of Object.entries(config6.sites ?? {})) {
+    if (!site || !isSafeSiteName(name))
+      continue;
+    const kind = resolveSiteKind(site);
+    if (kind === "server-app" || kind === "server-php")
+      ops.push({ id: `rollback:${name}`, label: `Rollback ${name}`, group: "deploy", target: name, mutates: true, confirm: name, danger: true });
+  }
+  const workerSites = new Set;
+  for (const worker of data.workers ?? []) {
+    const site = String(worker?.name ?? "").split(":")[0];
+    if (site && isSafeSiteName(site))
+      workerSites.add(site);
+  }
+  for (const site of workerSites)
+    ops.push({ id: `worker:restart:${site}`, label: `Restart workers (${site})`, group: "worker", target: site, mutates: true, confirm: site });
+  for (const [name, site] of Object.entries(config6.sites ?? {})) {
+    if (!site || !isSafeSiteName(name))
+      continue;
+    if (site.scheduler || site.schedule)
+      ops.push({ id: `scheduler:run:${name}`, label: `Run scheduler (${name})`, group: "scheduler", target: name, mutates: true, confirm: name });
+  }
+  const backups = config6.infrastructure?.compute?.backups;
+  if (backups?.enabled) {
+    ops.push({ id: "backup:run", label: "Run backup now", group: "backup", target: "backup", mutates: true, confirm: "backup" });
+    if (config6.infrastructure?.appDatabase)
+      ops.push({ id: "backup:restore", label: "Restore latest DB backup", group: "backup", target: "database", mutates: true, confirm: "restore", danger: true });
+  }
+  return ops;
+}
+function resolveDashboardOperation(id, config6, data) {
+  return buildDashboardOperations(config6, data).find((op) => op.id === id);
+}
+function serviceCommand(verb, target) {
+  const check = verb === "enable" || verb === "disable" ? `systemctl is-enabled ${target} 2>/dev/null || true` : `systemctl is-active ${target} 2>/dev/null || true`;
+  return ["set -o pipefail", `systemctl ${verb} ${target}`, check];
+}
+function pantryEnvEval() {
+  return `eval "$(cd ${PANTRY_PROJECT_DIR} && pantry env 2>/dev/null)"`;
+}
+function siteArtisanCommand(site, artisan) {
+  const current = `/var/www/${site}/current`;
+  return [
+    "set -uo pipefail",
+    `[ -d ${current} ] || { echo "site ${site} has no current release" >&2; exit 1; }`,
+    `cd ${current} && ${pantryEnvEval()} && php artisan ${artisan}`
+  ];
+}
+function backupRunCommand() {
+  return [
+    "set -uo pipefail",
+    `[ -x ${BACKUP_RUNNER_PATH} ] || { echo "scheduled backups are not provisioned on this server" >&2; exit 1; }`,
+    BACKUP_RUNNER_PATH
+  ];
+}
+function fromComputeOps(id, command, r) {
+  return {
+    operation: id,
+    command,
+    ok: r.success,
+    stdout: clampOutput(r.perInstance?.[0]?.output ?? ""),
+    stderr: clampOutput(r.perInstance?.[0]?.error ?? r.error ?? "")
+  };
+}
+async function runDashboardOperation(config6, environment, operation, options = {}) {
+  const slug = config6.project.slug;
+  let driver;
+  try {
+    driver = createCloudDriver({ config: config6 });
+  } catch (error2) {
+    return { operation: operation.id, ok: false, error: `Could not initialize the cloud driver: ${error2?.message ?? error2}` };
+  }
+  const ctx = { driver, slug, environment, role: "app" };
+  if (operation.group === "deploy") {
+    const to = options.to && /^[A-Za-z0-9._-]+$/.test(options.to) ? options.to : undefined;
+    const r = await rollbackComputeSite(ctx, { siteName: operation.target, to });
+    return fromComputeOps(operation.id, `rollback ${operation.target}${to ? ` → ${to}` : ""}`, r);
+  }
+  if (operation.id === "backup:restore") {
+    const r = await restoreDatabaseBackup(ctx, { database: config6.infrastructure?.appDatabase });
+    return fromComputeOps(operation.id, "db restore", r);
+  }
+  const targets = await driver.findComputeTargets({ slug, environment, role: "app" });
+  if (!targets.length)
+    return { operation: operation.id, ok: false, error: "No app server target was found for this environment." };
+  let commands;
+  let command;
+  if (operation.group === "service") {
+    const [verb, ...rest] = operation.id.split(":");
+    commands = serviceCommand(verb, rest.join(":"));
+    command = `systemctl ${verb} ${operation.target}`;
+  } else if (operation.group === "worker") {
+    commands = siteArtisanCommand(operation.target, "queue:restart");
+    command = `queue:restart (${operation.target})`;
+  } else if (operation.group === "scheduler") {
+    commands = siteArtisanCommand(operation.target, "schedule:run");
+    command = `schedule:run (${operation.target})`;
+  } else if (operation.id === "backup:run") {
+    commands = backupRunCommand();
+    command = "ts-cloud backup";
+  } else {
+    return { operation: operation.id, ok: false, error: "Unknown operation." };
+  }
+  const result = await driver.runRemoteDeploy({
+    targets: [targets[0]],
+    commands,
+    comment: `ts-cloud dashboard:${operation.id}`,
+    tags: { Project: slug, Environment: environment, Role: "app" }
+  });
+  return {
+    operation: operation.id,
+    command,
+    ok: result.success,
+    stdout: clampOutput(result.perInstance?.[0]?.output ?? ""),
+    stderr: clampOutput(result.perInstance?.[0]?.error ?? result.error ?? "")
+  };
+}
+
+// src/deploy/site-config-editor.ts
+function addSiteToCloudConfig(input) {
+  const siteName = normalizeSiteName(input.name);
+  const sitesObject = findSitesObject(input.configText);
+  if (hasSite(input.configText, sitesObject.start, sitesObject.end, siteName)) {
+    throw new Error(`Site '${siteName}' already exists in cloud.config.ts`);
+  }
+  const snippet = renderSiteSnippet({
+    ...input,
+    name: siteName
+  });
+  const before = input.configText.slice(0, sitesObject.end).trimEnd();
+  const after = input.configText.slice(sitesObject.end);
+  const separator = before.endsWith("{") ? `
+` : before.endsWith(",") ? `
+
+` : `,
+
+`;
+  return `${before}${separator}${snippet}
+  ${after}`;
+}
+function removeSiteFromCloudConfig(input) {
+  const name = normalizeSiteName(input.name);
+  const sites = findSitesObject(input.configText);
+  const span = findSiteSpan(input.configText, sites.start, sites.end, name);
+  if (!span)
+    throw new Error(`Site '${name}' does not exist in cloud.config.ts`);
+  const text = input.configText;
+  let start = span.nameStart;
+  while (start > 0 && text[start - 1] !== `
+` && /\s/.test(text[start - 1]))
+    start--;
+  let end = span.end + 1;
+  if (text[end] === ",")
+    end++;
+  while (end < text.length && text[end] !== `
+` && /\s/.test(text[end]))
+    end++;
+  if (text[end] === `
+`)
+    end++;
+  return text.slice(0, start) + text.slice(end);
+}
+function setSitePropertyInCloudConfig(input) {
+  const name = normalizeSiteName(input.siteName);
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(input.key))
+    throw new Error(`Invalid property key '${input.key}'`);
+  const sites = findSitesObject(input.configText);
+  const span = findSiteSpan(input.configText, sites.start, sites.end, name);
+  if (!span)
+    throw new Error(`Site '${name}' does not exist in cloud.config.ts`);
+  const text = input.configText;
+  const braceStart = text.indexOf("{", span.nameStart);
+  const braceEnd = span.end;
+  const body = text.slice(braceStart + 1, braceEnd);
+  const propMatch = new RegExp(`(^|[\\s,{])(${escapeRegExp(input.key)})\\s*:`, "m").exec(body);
+  if (propMatch) {
+    const keyStart = braceStart + 1 + propMatch.index + propMatch[1].length;
+    const colon = text.indexOf(":", keyStart);
+    const valueEnd = scanValueEnd(text, colon + 1, braceEnd);
+    return `${text.slice(0, keyStart)}${input.key}: ${input.valueText}${text.slice(valueEnd)}`;
+  }
+  const before = text.slice(0, braceEnd).trimEnd();
+  const sep = before.endsWith("{") || before.endsWith(",") ? "" : ",";
+  return `${before}${sep}
+      ${input.key}: ${input.valueText},
+    ${text.slice(braceEnd)}`;
+}
+function renderSslValue(ssl) {
+  if (ssl === false)
+    return "false";
+  if (ssl === true)
+    return "true";
+  return `{ provider: '${escapeSingle(ssl.provider || "letsencrypt")}' }`;
+}
+function renderStringValue(value) {
+  return `'${escapeSingle(value)}'`;
+}
+function renderEnvValue(env2) {
+  const entries = Object.entries(env2).filter(([key]) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(key));
+  if (entries.length === 0)
+    return "{}";
+  return `{
+${entries.map(([key, value]) => `        ${key}: '${escapeSingle(String(value))}',`).join(`
+`)}
+      }`;
+}
+function scanValueEnd(text, start, limit) {
+  let i = start;
+  while (i < limit && /\s/.test(text[i]))
+    i++;
+  let depth = 0;
+  let quote;
+  let escaped = false;
+  for (;i < limit; i++) {
+    const c = text[i];
+    if (quote) {
+      if (escaped) {
+        escaped = false;
+        continue;
+      }
+      if (c === "\\") {
+        escaped = true;
+        continue;
+      }
+      if (c === quote)
+        quote = undefined;
+      continue;
+    }
+    if (c === '"' || c === "'" || c === "`") {
+      quote = c;
+      continue;
+    }
+    if (c === "{" || c === "[" || c === "(") {
+      depth++;
+      continue;
+    }
+    if (c === "}" || c === "]" || c === ")") {
+      if (depth === 0)
+        return i;
+      depth--;
+      continue;
+    }
+    if (c === "," && depth === 0)
+      return i;
+  }
+  return limit;
+}
+function findSiteSpan(configText, start, end, siteName) {
+  const body = configText.slice(start + 1, end);
+  const match = new RegExp(`(^|[\\s,{])(${escapeRegExp(siteName)})\\s*:\\s*\\{`, "m").exec(body);
+  if (!match)
+    return null;
+  const nameStart = start + 1 + match.index + match[1].length;
+  const braceStart = configText.indexOf("{", nameStart);
+  return { nameStart, end: findMatchingBrace(configText, braceStart) };
+}
+function renderSiteSnippet(input) {
+  const siteName = normalizeSiteName(input.name);
+  const lines = [`    ${siteName}: {`];
+  pushString(lines, "deploy", input.deploy);
+  pushString(lines, "root", input.root);
+  pushString(lines, "path", input.path);
+  pushString(lines, "domain", input.domain);
+  pushString(lines, "type", input.type);
+  pushString(lines, "build", input.build);
+  pushString(lines, "start", input.start);
+  if (input.port !== undefined)
+    lines.push(`      port: ${input.port},`);
+  pushString(lines, "pathRewriteStyle", input.pathRewriteStyle);
+  if (input.ssl !== undefined) {
+    if (input.ssl === false)
+      lines.push("      ssl: false,");
+    else if (input.ssl === true)
+      lines.push("      ssl: true,");
+    else
+      lines.push(`      ssl: { provider: '${escapeSingle(input.ssl.provider || "letsencrypt")}' },`);
+  }
+  if (input.env && Object.keys(input.env).length > 0) {
+    lines.push("      env: {");
+    for (const [key, value] of Object.entries(input.env)) {
+      if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+        continue;
+      lines.push(`        ${key}: '${escapeSingle(String(value))}',`);
+    }
+    lines.push("      },");
+  }
+  lines.push("    },");
+  return lines.join(`
+`);
+}
+function escapeSingle(value) {
+  return value.replace(/\\/g, "\\\\").replaceAll(String.fromCharCode(39), "\\'");
+}
+function normalizeSiteName(name) {
+  const normalized = name.trim();
+  if (!/^[A-Za-z_$][\w$]*$/.test(normalized)) {
+    throw new Error(`Invalid site name '${name}'. Use a valid JavaScript object key, e.g. docs or marketingSite.`);
+  }
+  return normalized;
+}
+function pushString(lines, key, value) {
+  if (value === undefined || value === "")
+    return;
+  const escaped = value.replace(/\\/g, "\\\\").replaceAll(String.fromCharCode(39), "\\'");
+  lines.push(`      ${key}: '${escaped}',`);
+}
+function findSitesObject(configText) {
+  const sitesMatch = /\bsites\s*:\s*{/g.exec(configText);
+  if (!sitesMatch) {
+    throw new Error("Could not find a top-level sites: { ... } block in cloud.config.ts");
+  }
+  const start = configText.indexOf("{", sitesMatch.index);
+  const end = findMatchingBrace(configText, start);
+  return { start, end };
+}
+function hasSite(configText, start, end, siteName) {
+  const body = configText.slice(start + 1, end);
+  return new RegExp(`(^|[\\s,{])${escapeRegExp(siteName)}\\s*:`, "m").test(body);
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function findMatchingBrace(text, start) {
+  let depth = 0;
+  let quote;
+  let escaped = false;
+  let lineComment = false;
+  let blockComment = false;
+  for (let index = start;index < text.length; index++) {
+    const char = text[index];
+    const next = text[index + 1];
+    if (lineComment) {
+      if (char === `
+`)
+        lineComment = false;
+      continue;
+    }
+    if (blockComment) {
+      if (char === "*" && next === "/") {
+        blockComment = false;
+        index++;
+      }
+      continue;
+    }
+    if (quote) {
+      if (escaped) {
+        escaped = false;
+        continue;
+      }
+      if (char === "\\") {
+        escaped = true;
+        continue;
+      }
+      if (char === quote)
+        quote = undefined;
+      continue;
+    }
+    if (char === "/" && next === "/") {
+      lineComment = true;
+      index++;
+      continue;
+    }
+    if (char === "/" && next === "*") {
+      blockComment = true;
+      index++;
+      continue;
+    }
+    if (char === '"' || char === "'" || char === "`") {
+      quote = char;
+      continue;
+    }
+    if (char === "{")
+      depth++;
+    if (char === "}") {
+      depth--;
+      if (depth === 0)
+        return index;
+    }
+  }
+  throw new Error("Could not find the closing brace for sites: { ... } in cloud.config.ts");
+}
+
+// src/deploy/local-dashboard-server.ts
+var DEFAULT_HOST = "127.0.0.1";
+var DEFAULT_PORT = 7676;
+var MAX_OUTPUT_BYTES2 = 64 * 1024;
+var here = dirname9(fileURLToPath6(import.meta.url));
+var contentTypes = {
+  ".html": "text/html; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".webp": "image/webp",
+  ".ico": "image/x-icon"
+};
+function json(data, status = 200) {
+  return new Response(JSON.stringify(data, null, 2), {
+    status,
+    headers: { "content-type": "application/json; charset=utf-8" }
+  });
+}
+function text(data, status = 200) {
+  return new Response(data, {
+    status,
+    headers: { "content-type": "text/plain; charset=utf-8" }
+  });
+}
+function selectedEnvironment(config6, requested) {
+  if (requested)
+    return requested;
+  const envs = Object.keys(config6.environments ?? {});
+  return envs[0] ?? "production";
+}
+async function loadLocalEnv(cwd) {
+  const candidates = [
+    join23(here, "..", "..", "..", "..", ".env"),
+    join23(cwd, ".env"),
+    join23(cwd, ".env.local"),
+    join23(cwd, ".env.production")
+  ];
+  for (const file of candidates) {
+    if (!existsSync26(file))
+      continue;
+    const text2 = await readFile2(file, "utf8").catch(() => "");
+    for (const line of text2.split(`
+`)) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#") || !trimmed.includes("="))
+        continue;
+      const eq = trimmed.indexOf("=");
+      const key = trimmed.slice(0, eq).trim();
+      let value = trimmed.slice(eq + 1).trim();
+      if (!/^[A-Z_][A-Z0-9_]*$/i.test(key) || process.env[key] != null)
+        continue;
+      if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))
+        value = value.slice(1, -1);
+      process.env[key] = value;
+    }
+  }
+}
+function resolveCloudConfigPath(cwd) {
+  const candidates = [
+    join23(cwd, "config", "cloud.ts"),
+    join23(cwd, "config", "cloud.js"),
+    join23(cwd, "cloud.config.ts"),
+    join23(cwd, "cloud.config.js")
+  ];
+  return candidates.find((file) => existsSync26(file)) ?? null;
+}
+function computeSshKeys(config6) {
+  return config6.infrastructure?.compute?.sshKeys ?? [];
+}
+function replaceComputeSshKeys(config6, keys) {
+  const infrastructure2 = config6.infrastructure ?? (config6.infrastructure = {});
+  const compute = infrastructure2.compute ?? (infrastructure2.compute = {});
+  compute.sshKeys = keys;
+}
+function replaceSiteConfig(config6, name, site) {
+  const sites = config6.sites ?? (config6.sites = {});
+  sites[name] = site;
+}
+async function readJsonBody(req) {
+  return await req.json().catch(() => ({}));
+}
+function resolveDashboardMode(config6) {
+  if (config6.mode === "hybrid")
+    return "hybrid";
+  return config6.infrastructure?.compute ? "server" : "serverless";
+}
+async function resolveLiveDashboardData(config6, environment) {
+  const mode = resolveDashboardMode(config6);
+  const meta = { mode, environment, environments: Object.keys(config6.environments ?? {}) };
+  try {
+    const data = mode === "serverless" ? await resolveDashboardData(config6, environment) : await resolveServerDashboardData(config6, environment);
+    return { ...data ?? {}, ...meta };
+  } catch {
+    return { ...meta };
+  }
+}
+function resolveUiSourceDir(cwd) {
+  const candidates = [
+    join23(cwd, "packages", "ui"),
+    join23(here, "..", "..", "..", "ui"),
+    join23(here, "..", "..", "ui"),
+    join23(here, "..", "ui-src"),
+    join23(here, "..", "..", "ui-src"),
+    join23(here, "..", "..", "dist", "ui-src")
+  ];
+  for (const dir of candidates) {
+    if (existsSync26(join23(dir, "pages")) && existsSync26(join23(dir, "package.json")))
+      return dir;
+  }
+  return null;
+}
+async function buildLiveUi(cwd, data) {
+  const uiDir = resolveUiSourceDir(cwd);
+  if (!uiDir)
+    return null;
+  try {
+    const outDir = mkdtempSync6(join23(tmpdir7(), "ts-cloud-dashboard-"));
+    const localStx = join23(uiDir, "node_modules", ".bin", "stx");
+    const cmd = existsSync26(localStx) ? [localStx, "build", "--pages", "pages", "--out", outDir, "--no-sitemap", "--no-cache"] : ["bunx", "--bun", "@stacksjs/stx", "build", "--pages", "pages", "--out", outDir, "--no-sitemap", "--no-cache"];
+    const proc = Bun.spawn(cmd, {
+      cwd: uiDir,
+      stdout: "pipe",
+      stderr: "pipe",
+      env: {
+        ...process.env,
+        TSCLOUD_DASHBOARD_DATA: JSON.stringify(data)
+      }
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+      proc.exited
+    ]);
+    if (exitCode !== 0) {
+      if (process.env.TSCLOUD_DASHBOARD_VERBOSE)
+        console.warn(`ts-cloud dashboard: live UI build failed; serving the pre-built UI.
+${stdout}
+${stderr}`);
+      return null;
+    }
+    return outDir;
+  } catch (err) {
+    if (process.env.TSCLOUD_DASHBOARD_VERBOSE)
+      console.warn(`ts-cloud dashboard: live UI build errored; serving the pre-built UI. ${err.message}`);
+    return null;
+  }
+}
+function sanitizeCloudConfig(config6) {
+  return {
+    project: {
+      name: config6.project?.name,
+      slug: config6.project?.slug,
+      region: config6.project?.region
+    },
+    provider: config6.provider,
+    environments: Object.keys(config6.environments ?? {}),
+    compute: config6.infrastructure?.compute ? {
+      provider: config6.infrastructure.compute.provider,
+      runtime: config6.infrastructure.compute.runtime,
+      webServer: config6.infrastructure.compute.webServer,
+      proxy: config6.infrastructure.compute.proxy ? {
+        engine: config6.infrastructure.compute.proxy.engine,
+        onDemandTls: config6.infrastructure.compute.proxy.onDemandTls,
+        cdn: !!config6.infrastructure.compute.proxy.cdn
+      } : undefined,
+      managedServices: config6.infrastructure.compute.managedServices,
+      sshKeys: describeSshKeys(computeSshKeys(config6)).map((key) => ({
+        name: key.name,
+        type: key.type,
+        fingerprint: key.fingerprint,
+        added: key.added
+      }))
+    } : undefined,
+    sites: Object.fromEntries(Object.entries(config6.sites ?? {}).map(([name, site]) => [
+      name,
+      {
+        domain: site.domain,
+        path: site.path,
+        type: site.type,
+        deploy: site.deploy,
+        root: site.root,
+        port: site.port,
+        ssl: site.ssl
+      }
+    ]))
+  };
+}
+function dashboardActions(environment) {
+  return [
+    {
+      id: "status",
+      label: "Refresh Cloud Status",
+      description: "Runs the local ts-cloud status checks against configured providers.",
+      command: ["status", "--env", environment],
+      mutates: false
+    },
+    {
+      id: "doctor",
+      label: "Run Doctor",
+      description: "Checks local tooling, credentials, and provider access.",
+      command: ["doctor"],
+      mutates: false
+    },
+    {
+      id: "security-scan",
+      label: "Security Scan",
+      description: "Runs the pre-deploy scanner from this checkout.",
+      command: ["deploy:security-scan", "--source", ".", "--fail-on", "critical"],
+      mutates: false
+    },
+    {
+      id: "deploy",
+      label: "Deploy Environment",
+      description: "Deploys the selected environment from the local checkout.",
+      command: ["deploy", "--env", environment, "--yes"],
+      mutates: true,
+      confirm: "deploy"
+    }
+  ];
+}
+function resolveDashboardAction(id, environment) {
+  return dashboardActions(environment).find((action) => action.id === id);
+}
+function clampOutput2(output) {
+  if (output.length <= MAX_OUTPUT_BYTES2)
+    return output;
+  return `${output.slice(0, MAX_OUTPUT_BYTES2)}
+
+[output truncated]`;
+}
+async function runAction(action, options) {
+  const proc = Bun.spawn([process.execPath, options.cliEntry, ...action.command], {
+    cwd: options.cwd,
+    stdout: "pipe",
+    stderr: "pipe",
+    env: process.env
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited
+  ]);
+  return {
+    action: action.id,
+    command: ["cloud", ...action.command].join(" "),
+    exitCode,
+    ok: exitCode === 0,
+    stdout: clampOutput2(stdout),
+    stderr: clampOutput2(stderr)
+  };
+}
+function staticPath(uiRoot, pathname) {
+  const clean = decodeURIComponent(pathname).replace(/^\/+/, "");
+  const wanted = clean === "" ? "index.html" : clean;
+  const normalized = normalize(wanted);
+  if (normalized.startsWith("..") || normalized.includes("/../"))
+    return null;
+  const base = join23(uiRoot, normalized);
+  if (existsSync26(base) && !statSync6(base).isDirectory())
+    return base;
+  if (!extname3(base) && existsSync26(`${base}.html`))
+    return `${base}.html`;
+  if (!extname3(base) && existsSync26(join23(base, "index.html")))
+    return join23(base, "index.html");
+  return null;
+}
+async function serveStatic(uiRoot, pathname) {
+  const file = staticPath(uiRoot, pathname);
+  if (!file)
+    return text("Not found", 404);
+  if (statSync6(file).isDirectory())
+    return text("Not found", 404);
+  const body = await readFile2(file);
+  const type = contentTypes[extname3(file)] ?? "application/octet-stream";
+  return new Response(body, { headers: { "content-type": type } });
+}
+async function startLocalDashboardServer(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const host = options.host ?? DEFAULT_HOST;
+  const port = options.port ?? DEFAULT_PORT;
+  const cliEntry = options.cliEntry ?? process.argv[1];
+  if (options.box)
+    process.env.TS_CLOUD_DASHBOARD_BOX = "1";
+  await loadLocalEnv(cwd);
+  const config6 = await loadCloudConfig();
+  const availableEnvironments = Object.keys(config6.environments ?? {});
+  let environment = selectedEnvironment(config6, options.environment);
+  let actions = dashboardActions(environment);
+  const configPath = resolveCloudConfigPath(cwd);
+  const initialData = await resolveLiveDashboardData(config6, environment);
+  let latestData = initialData;
+  const liveUiRoot = await buildLiveUi(cwd, initialData);
+  const packagedUi = resolveUiSource(cwd);
+  let activeUiRoot = liveUiRoot ?? packagedUi?.uiRoot;
+  if (!activeUiRoot)
+    throw new Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");
+  const server = Bun.serve({
+    hostname: host,
+    port,
+    async fetch(req) {
+      const url = new URL(req.url);
+      try {
+        if (url.pathname === "/api/health") {
+          return json({
+            ok: true,
+            cwd,
+            environment,
+            environments: availableEnvironments,
+            uiRoot: activeUiRoot,
+            liveData: !!liveUiRoot,
+            localPackage: import.meta.url.includes("/Code/Libraries/ts-cloud/")
+          });
+        }
+        if (url.pathname === "/" && latestData?.mode === "serverless")
+          return new Response(null, { status: 302, headers: { location: "/serverless" } });
+        if (url.pathname === "/api/env" && req.method === "POST") {
+          const body = await readJsonBody(req);
+          const requested = String(body.env ?? "");
+          if (!availableEnvironments.includes(requested))
+            return json({ ok: false, error: `Unknown environment '${requested}'.`, environments: availableEnvironments }, 404);
+          if (requested !== environment) {
+            environment = requested;
+            actions = dashboardActions(environment);
+            latestData = await resolveLiveDashboardData(config6, environment);
+            const rebuilt = await buildLiveUi(cwd, latestData);
+            if (rebuilt)
+              activeUiRoot = rebuilt;
+          }
+          return json({ ok: true, environment, environments: availableEnvironments });
+        }
+        if (url.pathname === "/api/config")
+          return json({ ...sanitizeCloudConfig(config6), environment, environments: availableEnvironments });
+        if (url.pathname === "/api/ssh-keys" && req.method === "GET") {
+          return json({
+            configPath,
+            keys: describeSshKeys(computeSshKeys(config6))
+          });
+        }
+        if (url.pathname === "/api/ssh-keys" && req.method === "POST") {
+          if (!configPath)
+            return json({ ok: false, error: "No cloud config file was found in this checkout." }, 404);
+          const body = await readJsonBody(req);
+          const before = await readFile2(configPath, "utf8");
+          const currentKeys = computeSshKeys(config6);
+          const after = addSshKeyToCloudConfig({
+            configText: before,
+            name: String(body.name ?? ""),
+            publicKey: String(body.publicKey ?? ""),
+            existingKeys: currentKeys
+          });
+          await writeFile6(configPath, after);
+          replaceComputeSshKeys(config6, [...currentKeys, { name: String(body.name ?? "").trim(), publicKey: String(body.publicKey ?? "").trim().replace(/\s+/g, " ") }]);
+          return json({ ok: true, configPath, keys: describeSshKeys(computeSshKeys(config6)) });
+        }
+        if (url.pathname === "/api/ssh-keys" && req.method === "DELETE") {
+          if (!configPath)
+            return json({ ok: false, error: "No cloud config file was found in this checkout." }, 404);
+          const body = await readJsonBody(req);
+          const name = String(body.name ?? url.searchParams.get("name") ?? "");
+          const before = await readFile2(configPath, "utf8");
+          const currentKeys = computeSshKeys(config6);
+          const after = removeSshKeyFromCloudConfig({
+            configText: before,
+            name,
+            existingKeys: currentKeys
+          });
+          await writeFile6(configPath, after);
+          replaceComputeSshKeys(config6, currentKeys.filter((key) => key.name !== name.trim()));
+          return json({ ok: true, configPath, keys: describeSshKeys(computeSshKeys(config6)) });
+        }
+        if (url.pathname === "/api/sites" && req.method === "POST") {
+          if (!configPath)
+            return json({ ok: false, error: "No cloud config file was found in this checkout." }, 404);
+          const body = await readJsonBody(req);
+          const siteName = String(body.name ?? "").trim();
+          const root = String(body.root ?? "").trim();
+          if (!siteName || !root)
+            return json({ ok: false, error: "Site name and root are required." }, 422);
+          const site = {
+            deploy: body.deploy === "bucket" ? "bucket" : "server",
+            root,
+            path: String(body.path ?? "").trim() || undefined,
+            domain: String(body.domain ?? "").trim() || undefined,
+            build: String(body.build ?? "").trim() || undefined,
+            start: String(body.start ?? "").trim() || undefined,
+            port: body.port ? Number(body.port) : undefined,
+            type: String(body.type ?? "").trim() || undefined
+          };
+          if (site.port !== undefined && (!Number.isInteger(site.port) || site.port < 1 || site.port > 65535))
+            return json({ ok: false, error: "Port must be a number between 1 and 65535." }, 422);
+          const before = await readFile2(configPath, "utf8");
+          const after = addSiteToCloudConfig({
+            configText: before,
+            name: siteName,
+            root: site.root,
+            domain: site.domain,
+            path: site.path,
+            deploy: site.deploy,
+            build: site.build,
+            start: site.start,
+            port: site.port,
+            type: site.type
+          });
+          await writeFile6(configPath, after);
+          replaceSiteConfig(config6, siteName, Object.fromEntries(Object.entries(site).filter(([, value]) => value !== undefined)));
+          latestData = await resolveLiveDashboardData(config6, environment);
+          return json({ ok: true, configPath, site: siteName, data: latestData });
+        }
+        if (url.pathname === "/api/sites" && req.method === "DELETE") {
+          if (!configPath)
+            return json({ ok: false, error: "No cloud config file was found in this checkout." }, 404);
+          const body = await readJsonBody(req);
+          const name = String(body.name ?? url.searchParams.get("name") ?? "").trim();
+          if (!name || !config6.sites?.[name])
+            return json({ ok: false, error: `Site '${name}' was not found.` }, 404);
+          const before = await readFile2(configPath, "utf8");
+          await writeFile6(configPath, removeSiteFromCloudConfig({ configText: before, name }));
+          delete config6.sites[name];
+          latestData = await resolveLiveDashboardData(config6, environment);
+          return json({ ok: true, configPath, site: name, data: latestData });
+        }
+        if (url.pathname === "/api/sites" && req.method === "PATCH") {
+          if (!configPath)
+            return json({ ok: false, error: "No cloud config file was found in this checkout." }, 404);
+          const body = await readJsonBody(req);
+          const name = String(body.name ?? "").trim();
+          const existing = config6.sites?.[name];
+          if (!name || !existing)
+            return json({ ok: false, error: `Site '${name}' was not found.` }, 404);
+          if (body.port !== undefined && body.port !== null && body.port !== "" && (!Number.isInteger(Number(body.port)) || Number(body.port) < 1 || Number(body.port) > 65535))
+            return json({ ok: false, error: "Port must be a number between 1 and 65535." }, 422);
+          let text2 = await readFile2(configPath, "utf8");
+          const set = (key, valueText) => {
+            text2 = setSitePropertyInCloudConfig({ configText: text2, siteName: name, key, valueText });
+          };
+          if (body.ssl !== undefined) {
+            set("ssl", renderSslValue(body.ssl));
+            existing.ssl = body.ssl;
+          }
+          if (body.env !== undefined && body.env && typeof body.env === "object") {
+            set("env", renderEnvValue(body.env));
+            existing.env = body.env;
+          }
+          for (const key of ["domain", "path", "build", "start", "type", "root"]) {
+            if (typeof body[key] === "string" && body[key].trim()) {
+              set(key, renderStringValue(String(body[key]).trim()));
+              existing[key] = String(body[key]).trim();
+            }
+          }
+          if (body.port !== undefined && body.port !== null && body.port !== "") {
+            set("port", String(Number(body.port)));
+            existing.port = Number(body.port);
+          }
+          await writeFile6(configPath, text2);
+          latestData = await resolveLiveDashboardData(config6, environment);
+          return json({ ok: true, configPath, site: name, data: latestData });
+        }
+        if (url.pathname === "/api/sites/deploy" && req.method === "POST") {
+          const body = await readJsonBody(req);
+          const name = String(body.name ?? "").trim();
+          if (!name || !config6.sites?.[name])
+            return json({ ok: false, error: `Site '${name}' was not found.` }, 404);
+          if (body.confirm !== name)
+            return json({ ok: false, error: `Type "${name}" to deploy this site.` }, 409);
+          const action = {
+            id: `deploy:${name}`,
+            label: `Deploy ${name}`,
+            description: `Deploy the ${name} site for ${environment}.`,
+            command: ["deploy", "--env", environment, "--site", name, "--yes"],
+            mutates: true
+          };
+          return json(await runAction(action, { cwd, cliEntry }));
+        }
+        if (url.pathname === "/api/actions")
+          return json(actions);
+        if (url.pathname === "/api/server/operations")
+          return json(buildDashboardOperations(config6, latestData));
+        if (url.pathname === "/api/databases" && req.method === "GET")
+          return json(await listDatabases(config6, environment));
+        if (url.pathname === "/api/databases" && req.method === "POST") {
+          const body = await readJsonBody(req);
+          const name = String(body.name ?? "").trim();
+          if (!isValidDbIdentifier(name))
+            return json({ ok: false, error: "Database name must be a valid identifier (letters, numbers, underscore; not starting with a digit)." }, 422);
+          return json({ ...await createDatabase(config6, environment, name), name });
+        }
+        if (url.pathname === "/api/databases/users" && req.method === "POST") {
+          const body = await readJsonBody(req);
+          const username = String(body.username ?? "").trim();
+          const password = String(body.password ?? "");
+          const database = String(body.database ?? "").trim() || undefined;
+          const access4 = body.access === "readonly" ? "readonly" : "all";
+          if (!isValidDbIdentifier(username))
+            return json({ ok: false, error: "Username must be a valid identifier." }, 422);
+          if (!password)
+            return json({ ok: false, error: "Password is required." }, 422);
+          if (database && !isValidDbIdentifier(database))
+            return json({ ok: false, error: "Database must be a valid identifier." }, 422);
+          return json({ ...await createDatabaseUser(config6, environment, { username, password, database, access: access4 }), username });
+        }
+        if (url.pathname === "/api/dashboard-data") {
+          latestData = await resolveLiveDashboardData(config6, environment);
+          return json(latestData);
+        }
+        if (url.pathname === "/api/actions/run" && req.method === "POST") {
+          const body = await req.json().catch(() => ({}));
+          const action = body.action ? resolveDashboardAction(body.action, environment) : undefined;
+          if (!action)
+            return json({ ok: false, error: "Unknown dashboard action." }, 404);
+          if (action.mutates && body.confirm !== action.confirm)
+            return json({ ok: false, error: `Type "${action.confirm}" to run this action.` }, 409);
+          return json(await runAction(action, { cwd, cliEntry }));
+        }
+        if (url.pathname === "/api/server/operations/run" && req.method === "POST") {
+          const body = await req.json().catch(() => ({}));
+          const operation = body.operation ? resolveDashboardOperation(body.operation, config6, latestData) : undefined;
+          if (!operation)
+            return json({ ok: false, error: "Unknown or unavailable server operation." }, 404);
+          if (operation.mutates && body.confirm !== operation.confirm)
+            return json({ ok: false, error: `Type "${operation.confirm}" to run this operation.` }, 409);
+          return json(await runDashboardOperation(config6, environment, operation, { to: body.to }));
+        }
+        const requestedEnv = url.searchParams.get("env");
+        if (requestedEnv && availableEnvironments.includes(requestedEnv) && requestedEnv !== environment) {
+          environment = requestedEnv;
+          actions = dashboardActions(environment);
+          latestData = await resolveLiveDashboardData(config6, environment);
+          const rebuilt = await buildLiveUi(cwd, latestData);
+          if (rebuilt)
+            activeUiRoot = rebuilt;
+        }
+        return serveStatic(activeUiRoot, url.pathname);
+      } catch (error2) {
+        if (options.verbose)
+          console.error(error2);
+        return json({ ok: false, error: error2?.message ?? String(error2) }, 500);
+      }
+    }
+  });
+  return { server, url: `http://${host}:${server.port}/` };
+}
 // src/index.ts
 init_dns();
 init_dist2();
@@ -87120,6 +90287,7 @@ export {
   suggestCommand,
   storageAdvancedManager,
   staticSiteManager,
+  startLocalDashboardServer,
   stackDependencyManager,
   signRequestAsync,
   signRequest,
@@ -87136,6 +90304,7 @@ export {
   secretsManager,
   searchCommands,
   sanitizeName,
+  sanitizeCloudConfig,
   runRemoteCommand,
   runPhpBuildHooks,
   runBuildHooks,
@@ -87164,6 +90333,7 @@ export {
   resolveExecStart,
   resolveDeployBucketName,
   resolveDashboardDomain,
+  resolveDashboardAction,
   resolveCredentials,
   resolveCloudProvider,
   resolveApp,
@@ -87330,6 +90500,7 @@ export {
   defaultLocalConfig,
   defaultConfig4 as defaultConfig,
   databaseUserManager,
+  dashboardActions,
   crossRegionReferenceManager,
   createZip,
   createWordPressPreset,