@stacksjs/ts-cloud 0.5.34 → 0.6.0

package/dist/index.js

@@ -697,6 +697,30 @@ function isNodeCryptoAvailable() {
 function isWebCryptoAvailable() {
   return typeof crypto !== "undefined" && typeof crypto.subtle !== "undefined";
 }
+function detectDeploymentTargets(config6) {
+  const server = config6.infrastructure?.compute != null;
+  const serverless = Object.values(config6.environments ?? {}).some((env) => env?.app != null);
+  return { server, serverless };
+}
+function resolveDeploymentMode(config6) {
+  if (config6.mode === "server" || config6.mode === "serverless")
+    return config6.mode;
+  const { serverless } = detectDeploymentTargets(config6);
+  return serverless ? "serverless" : "server";
+}
+function deploymentCoexistenceError(config6) {
+  const { server, serverless } = detectDeploymentTargets(config6);
+  if (server && serverless) {
+    return "A project cannot be both a server and a serverless deployment. " + "Found `infrastructure.compute` (server) AND `environments.<env>.app` (serverless Lambda). " + "Keep one: remove `infrastructure.compute` for a serverless app, or remove `environments.<env>.app` for a server.";
+  }
+  if (config6.mode === "server" && serverless && !server) {
+    return "Config sets `mode: 'server'` but declares a serverless app (`environments.<env>.app`). " + "Remove the app or change the mode.";
+  }
+  if (config6.mode === "serverless" && server && !serverless) {
+    return "Config sets `mode: 'serverless'` but declares a server (`infrastructure.compute`). " + "Remove the compute block or change the mode.";
+  }
+  return null;
+}
 function resolveCloudProvider(config6) {
   if (config6.cloud?.provider)
     return config6.cloud.provider;
@@ -6052,7 +6076,7 @@ function createFullStackAppPreset(options) {
       slug,
       region: "us-east-1"
     },
-    mode: "hybrid",
+    mode: "server",
     environments: {
       production: {
         type: "production",
@@ -9729,8 +9753,8 @@ function validateAgainstSchema(config6) {
   if (config6.project?.region && !validRegions.includes(config6.project.region)) {
     errors.push(`Invalid region: ${config6.project.region}. Must be one of: ${validRegions.join(", ")}`);
   }
-  if (config6.mode && !["server", "serverless", "hybrid"].includes(config6.mode)) {
-    errors.push("Invalid mode: must be one of server, serverless, or hybrid");
+  if (config6.mode && !["server", "serverless"].includes(config6.mode)) {
+    errors.push("Invalid mode: must be one of server or serverless");
   }
   return {
     valid: errors.length === 0,
@@ -42108,9 +42132,8 @@ Details:`;
       },
       mode: {
         type: "string",
-        description: "Deployment mode",
-        enum: ["server", "serverless", "hybrid"],
-        default: "serverless"
+        description: "Deployment mode (server and serverless are mutually exclusive; auto-detected when omitted)",
+        enum: ["server", "serverless"]
       },
       environments: {
         type: "object",
@@ -55774,6 +55797,11 @@ var init_email = __esm(() => {
 });
 
 // src/aws/rds.ts
+var exports_rds = {};
+__export(exports_rds, {
+  RDSClient: () => RDSClient
+});
+
 class RDSClient {
   client;
   region;
@@ -83323,6 +83351,7 @@ class AcmeClient {
   }
 }
 // src/deploy/site-target.ts
+await init_dist2();
 var PHP_SITE_TYPES = new Set([
   "laravel",
   "php",
@@ -83359,6 +83388,9 @@ function validateDeploymentConfig(config6) {
   const warnings = [];
   const sites = config6.sites || {};
   const computeConfigured = hasComputeConfigured(config6);
+  const coexistence = deploymentCoexistenceError(config6);
+  if (coexistence)
+    errors.push(coexistence);
   const portOwners = new Map;
   for (const [name, site] of Object.entries(sites)) {
     if (!site) {
@@ -84034,6 +84066,24 @@ async function serverlessInfo(config6, environment) {
     lastRelease: release ? { sha: release.sha, timestamp: release.timestamp } : undefined
   };
 }
+function serverlessClusterId(slug, environment) {
+  return `${slug}-${environment}-db`;
+}
+async function scaleServerlessDatabase(config6, environment, minCapacity, maxCapacity) {
+  const ctx = resolveContext(config6, environment);
+  if (ctx.app.database?.connection !== "aurora-serverless")
+    throw new Error("No Aurora Serverless v2 database is configured for this environment.");
+  const { RDSClient: RDSClient2 } = await Promise.resolve().then(() => (init_rds(), exports_rds));
+  const rds2 = new RDSClient2(ctx.region);
+  const id = serverlessClusterId(ctx.slug, environment);
+  step(`Scaling ${id} → ${minCapacity}–${maxCapacity} ACUs`);
+  await rds2.modifyDBCluster({
+    DBClusterIdentifier: id,
+    ServerlessV2ScalingConfiguration: { MinCapacity: minCapacity, MaxCapacity: maxCapacity },
+    ApplyImmediately: true
+  });
+  success(`Scaling applied to ${id} (takes effect shortly).`);
+}
 
 // src/deploy/index.ts
 await init_serverless_image();
@@ -84165,6 +84215,15 @@ class CloudWatchClient {
     });
     await this.query(params);
   }
+  async deleteAlarms(alarmNames) {
+    if (!alarmNames.length)
+      return;
+    const params = { Action: "DeleteAlarms" };
+    alarmNames.forEach((name, i) => {
+      params[`AlarmNames.member.${i + 1}`] = name;
+    });
+    await this.query(params);
+  }
 }
 
 // src/deploy/dashboard-data.ts
@@ -84500,6 +84559,17 @@ async function resolveDashboardData(config6, environment) {
       } catch {}
     } catch {}
   }
+  const dataServices = [];
+  if (out.aurora)
+    dataServices.push({ name: "Aurora Serverless v2", detail: `${out.aurora.id} · ${out.aurora.minAcu}-${out.aurora.maxAcu} ACU`, status: out.aurora.status });
+  if (out.proxy)
+    dataServices.push({ name: "RDS Proxy", detail: out.proxy.name, status: out.proxy.status });
+  if (out.redis)
+    dataServices.push({ name: `ElastiCache (${out.redis.engine})`, detail: `${out.redis.node} · ${out.redis.hitRate}% hit rate`, status: out.redis.status });
+  if (out.efs)
+    dataServices.push({ name: "EFS", detail: `${out.efs.mount} · ${out.efs.sizeMb} MB`, status: out.efs.status });
+  if (dataServices.length)
+    out.dataServices = dataServices;
   if (info2.scheduler !== "off" && app?.kind === "php") {
     try {
       const out2 = await runRemoteCommand(config6, environment, "schedule:list");
@@ -84517,6 +84587,7 @@ async function resolveDashboardData(config6, environment) {
   return out;
 }
 // src/deploy/local-dashboard-server.ts
+await init_dist2();
 import { existsSync as existsSync26, statSync as statSync6 } from "node:fs";
 import { readFile as readFile2, writeFile as writeFile6 } from "node:fs/promises";
 import { mkdtempSync as mkdtempSync6 } from "node:fs";
@@ -84525,7 +84596,7 @@ import { dirname as dirname9, extname as extname3, join as join23, normalize } f
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 
 // src/deploy/dashboard-data-server.ts
-import { existsSync as existsSync24, readFileSync as readFileSync17 } from "node:fs";
+import { existsSync as existsSync24, readFileSync as readFileSync18 } from "node:fs";
 import { join as join21 } from "node:path";
 
 // src/drivers/factory.ts
@@ -85507,6 +85578,11 @@ ${servicesProvision.join(`
     }
     if (runtime === "bun") {
       script += `
+# cloud-init runs this with \`set -u\` and NO $HOME set. bun's install.sh
+# dereferences $HOME even when BUN_INSTALL is set, so without this the install
+# aborts with "HOME: unbound variable" and /usr/local/bin/bun never appears —
+# breaking a from-scratch provision (adopting an existing box masked it).
+export HOME="\${HOME:-/root}"
 export BUN_INSTALL="/root/.bun"
 curl -fsSL https://bun.sh/install | bash${runtimeVersion === "latest" ? "" : ` -s "bun-v${runtimeVersion}"`}
 ln -sf /root/.bun/bin/bun /usr/local/bin/bun
@@ -87396,11 +87472,42 @@ await init_dist2();
 // src/deploy/management-dashboard.ts
 await init_dist2();
 import { execSync as execSync5 } from "node:child_process";
-import { existsSync as existsSync21 } from "node:fs";
+import { randomBytes as randomBytes6 } from "node:crypto";
+import { chmodSync, existsSync as existsSync21, mkdirSync as mkdirSync9, readFileSync as readFileSync17, writeFileSync as writeFileSync12 } from "node:fs";
 import { tmpdir as tmpdir6 } from "node:os";
 import { dirname as dirname8, isAbsolute as isAbsolute5, join as join20 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 var MANAGEMENT_DASHBOARD_SITE = "dashboard";
+var DASHBOARD_CREDENTIALS_FILE = join20(".ts-cloud", "dashboard-credentials.json");
+function generatePassword() {
+  return randomBytes6(24).toString("base64url");
+}
+function resolveDashboardAuth(cwd, username, logger4) {
+  const explicit = process.env.TS_CLOUD_UI_PASSWORD?.trim();
+  if (explicit)
+    return { password: explicit, source: "env" };
+  if (truthy(process.env.TS_CLOUD_UI_PUBLIC))
+    return { password: undefined, source: "public" };
+  const file = join20(cwd, DASHBOARD_CREDENTIALS_FILE);
+  try {
+    if (existsSync21(file)) {
+      const saved = JSON.parse(readFileSync17(file, "utf8"));
+      if (saved?.password)
+        return { password: saved.password, source: "generated" };
+    }
+  } catch {}
+  const password = generatePassword();
+  try {
+    mkdirSync9(dirname8(file), { recursive: true });
+    writeFileSync12(file, `${JSON.stringify({ username, password, generatedAt: new Date().toISOString() }, null, 2)}
+`);
+    chmodSync(file, 384);
+    logger4.info(`Management dashboard: generated a password and saved it to ${DASHBOARD_CREDENTIALS_FILE} (user: ${username}, pass: ${password}). Set TS_CLOUD_UI_PASSWORD to pin your own, or TS_CLOUD_UI_PUBLIC=1 to serve without auth.`);
+  } catch (error2) {
+    logger4.warn(`Management dashboard: could not persist the generated password (${error2?.message ?? error2}). Using it for this deploy only — pass: ${password}`);
+  }
+  return { password, source: "generated" };
+}
 var noopLogger = { info: () => {}, warn: () => {} };
 function truthy(v) {
   return v != null && v !== "" && v !== "0" && v.toLowerCase() !== "false";
@@ -87436,7 +87543,8 @@ function ensureManagementDashboard(config6, options = {}) {
     logger4.info("Management dashboard: UI not found (no local ui/ or packaged dist/ui) — skipping auto-deploy.");
     return config6;
   }
-  const password = process.env.TS_CLOUD_UI_PASSWORD?.trim() || undefined;
+  const username = process.env.TS_CLOUD_UI_USERNAME?.trim() || "admin";
+  const auth = resolveDashboardAuth(cwd, username, logger4);
   const environment = config6.environments && Object.keys(config6.environments)[0];
   const live = truthy(process.env.TS_CLOUD_UI_LIVE);
   const port = Number(process.env.TS_CLOUD_UI_PORT) || undefined;
@@ -87444,8 +87552,8 @@ function ensureManagementDashboard(config6, options = {}) {
     uiRoot: ui.uiRoot,
     build: ui.build,
     domain: process.env.TS_CLOUD_UI_DOMAIN?.trim() || undefined,
-    username: process.env.TS_CLOUD_UI_USERNAME?.trim() || undefined,
-    password,
+    username,
+    password: auth.password,
     realm: process.env.TS_CLOUD_UI_REALM?.trim() || undefined,
     live,
     port
@@ -87455,7 +87563,8 @@ function ensureManagementDashboard(config6, options = {}) {
     return config6;
   }
   config6.sites = { ...config6.sites ?? {}, [resolved.name]: resolved.site };
-  logger4.info(`Management dashboard → https://${resolved.site.domain} (${password ? "htpasswd-protected" : "NO AUTH — set TS_CLOUD_UI_PASSWORD"})`);
+  const authNote = auth.source === "public" ? "NO AUTH — TS_CLOUD_UI_PUBLIC is set (dashboard is publicly reachable)" : auth.source === "env" ? "htpasswd-protected (TS_CLOUD_UI_PASSWORD)" : `htpasswd-protected (auto-generated — see ${DASHBOARD_CREDENTIALS_FILE})`;
+  logger4.info(`Management dashboard → https://${resolved.site.domain} (${authNote})`);
   return config6;
 }
 function buildManagementDashboardArtifact(site, options) {
@@ -88525,7 +88634,7 @@ function loadLocalState(config6, environment) {
   if (!existsSync24(statePath))
     return null;
   try {
-    return JSON.parse(readFileSync17(statePath, "utf8"));
+    return JSON.parse(readFileSync18(statePath, "utf8"));
   } catch {
     return null;
   }
@@ -89034,6 +89143,9 @@ function resolveConfigOnlyServerDashboardData(config6, environment) {
         root: kind === "server-static" ? `/var/www/${s.name}` : `/var/www/${s.name}/current`,
         branch: kind === "server-static" ? "build artifact" : "main",
         build: site.build,
+        php: site.php ?? site.phpVersion,
+        aliases: Array.isArray(site.aliases) ? site.aliases : [],
+        redirects: site.redirects && typeof site.redirects === "object" ? site.redirects : {},
         envKeys: Object.keys(site.env ?? site.environment ?? {})
       };
     }),
@@ -89307,6 +89419,45 @@ async function createDatabaseUser(config6, environment, input) {
   const engine = resolveDbEngine(config6);
   return runDb(config6, environment, buildCreateUserScript(engine, input), `ts-cloud db:user ${input.username}`);
 }
+var DB_BACKUP_DIR = "/var/backups/ts-cloud/databases";
+function buildBackupScript(engine, name, destDir = DB_BACKUP_DIR) {
+  const file = `${destDir}/${name}-$(date +%Y%m%d-%H%M%S).sql.gz`;
+  const mkdir5 = `mkdir -p ${destDir}`;
+  if (engine === "postgres")
+    return [mkdir5, `pg_dump -h 127.0.0.1 -p 5432 -U postgres ${name} | gzip > "${file}"`, `echo "BACKUP=${file}"`, `ls -l "${file}"`];
+  const sock = engine === "mariadb" ? SOCKETS.mariadb : SOCKETS.mysql;
+  return [mkdir5, `mysqldump --socket=${sock} -u root ${name} | gzip > "${file}"`, `echo "BACKUP=${file}"`, `ls -l "${file}"`];
+}
+function buildListBackupsScript(destDir = DB_BACKUP_DIR) {
+  return [`ls -1t ${destDir}/*.sql.gz 2>/dev/null | head -50 | sed 's|^|BACKUP=|' || true`];
+}
+function parseBackups(output) {
+  const out = [];
+  for (const rawLine of output.split(`
+`)) {
+    const line = rawLine.trim();
+    if (!line.startsWith("BACKUP="))
+      continue;
+    const file = line.slice(7);
+    const base = file.split("/").pop() ?? file;
+    const database = base.replace(/-\d{8}-\d{6}\.sql\.gz$/, "");
+    if (file)
+      out.push({ file, database });
+  }
+  return out;
+}
+async function backupDatabase(config6, environment, name) {
+  if (!isValidDbIdentifier(name))
+    return { ok: false, error: "Database name must be a valid identifier.", database: name };
+  const engine = resolveDbEngine(config6);
+  const r = await runDb(config6, environment, buildBackupScript(engine, name), `ts-cloud db:backup ${name}`);
+  return { ...r, database: name };
+}
+async function listDatabaseBackups(config6, environment) {
+  const r = await runDb(config6, environment, buildListBackupsScript(), "ts-cloud db:backups");
+  const backups = r.ok && r.stdout ? parseBackups(r.stdout) : [];
+  return { ...r, backups };
+}
 
 // src/drivers/shared/compute-ops.ts
 var noopLogger3 = {
@@ -89425,8 +89576,17 @@ function buildDashboardOperations(config6, data) {
   for (const [name, site] of Object.entries(config6.sites ?? {})) {
     if (!site || !isSafeSiteName(name))
       continue;
-    if (site.scheduler || site.schedule)
-      ops.push({ id: `scheduler:run:${name}`, label: `Run scheduler (${name})`, group: "scheduler", target: name, mutates: true, confirm: name });
+    if (site.scheduler || site.schedule) {
+      const laravel = resolveSiteFramework(site) === "laravel";
+      ops.push({
+        id: `scheduler:run:${name}`,
+        label: `${laravel ? "Run" : "Restart"} scheduler (${name})`,
+        group: "scheduler",
+        target: name,
+        mutates: true,
+        confirm: name
+      });
+    }
   }
   const backups = config6.infrastructure?.compute?.backups;
   if (backups?.enabled) {
@@ -89454,6 +89614,28 @@ function siteArtisanCommand(site, artisan) {
     `cd ${current} && ${pantryEnvEval()} && php artisan ${artisan}`
   ];
 }
+function workerRestartCommand(framework, slug, site) {
+  if (framework === "laravel")
+    return siteArtisanCommand(site, "queue:restart");
+  const pattern = `${slug}-${site}-queue-*.service`;
+  return [
+    "set -uo pipefail",
+    `units=$(systemctl list-units --type=service --all --no-legend '${pattern}' 2>/dev/null | awk '{print $1}')`,
+    `[ -n "$units" ] || { echo "no queue-worker units found for ${site} (${pattern})" >&2; exit 1; }`,
+    "systemctl restart $units",
+    `systemctl --no-legend --type=service list-units '${pattern}' 2>/dev/null || true`
+  ];
+}
+function schedulerRunCommand(framework, slug, site) {
+  if (framework === "laravel")
+    return siteArtisanCommand(site, "schedule:run");
+  const unit = `${slug}-${site}-scheduler.service`;
+  return [
+    "set -uo pipefail",
+    `systemctl restart ${unit}`,
+    `systemctl is-active ${unit} 2>/dev/null || true`
+  ];
+}
 function backupRunCommand() {
   return [
     "set -uo pipefail",
@@ -89498,11 +89680,13 @@ async function runDashboardOperation(config6, environment, operation, options =
     commands = serviceCommand(verb, rest.join(":"));
     command = `systemctl ${verb} ${operation.target}`;
   } else if (operation.group === "worker") {
-    commands = siteArtisanCommand(operation.target, "queue:restart");
-    command = `queue:restart (${operation.target})`;
+    const framework = resolveSiteFramework(config6.sites?.[operation.target] ?? {});
+    commands = workerRestartCommand(framework, slug, operation.target);
+    command = framework === "laravel" ? `queue:restart (${operation.target})` : `restart queue units (${operation.target})`;
   } else if (operation.group === "scheduler") {
-    commands = siteArtisanCommand(operation.target, "schedule:run");
-    command = `schedule:run (${operation.target})`;
+    const framework = resolveSiteFramework(config6.sites?.[operation.target] ?? {});
+    commands = schedulerRunCommand(framework, slug, operation.target);
+    command = framework === "laravel" ? `schedule:run (${operation.target})` : `restart scheduler (${operation.target})`;
   } else if (operation.id === "backup:run") {
     commands = backupRunCommand();
     command = "ts-cloud backup";
@@ -89523,6 +89707,519 @@ async function runDashboardOperation(config6, environment, operation, options =
     stderr: clampOutput(result.perInstance?.[0]?.error ?? result.error ?? "")
   };
 }
+async function runServerShellCommand(config6, environment, command) {
+  const trimmed = command.trim();
+  if (!trimmed)
+    return { operation: "command", ok: false, error: "A command is required." };
+  let driver;
+  try {
+    driver = createCloudDriver({ config: config6 });
+  } catch (error2) {
+    return { operation: "command", ok: false, error: `Could not initialize the cloud driver: ${error2?.message ?? error2}` };
+  }
+  const slug = config6.project.slug;
+  const targets = await driver.findComputeTargets({ slug, environment, role: "app" });
+  if (!targets.length)
+    return { operation: "command", ok: false, error: "No app server target was found for this environment." };
+  const result = await driver.runRemoteDeploy({
+    targets: [targets[0]],
+    commands: ["set -o pipefail", trimmed],
+    comment: "ts-cloud dashboard:command",
+    tags: { Project: slug, Environment: environment, Role: "app" }
+  });
+  return {
+    operation: "command",
+    command: trimmed,
+    ok: result.success,
+    stdout: clampOutput(result.perInstance?.[0]?.output ?? ""),
+    stderr: clampOutput(result.perInstance?.[0]?.error ?? result.error ?? "")
+  };
+}
+
+// src/deploy/firewall-config-editor.ts
+var ALWAYS_OPEN = new Set([22, 80, 443]);
+function isValidPort(port) {
+  return Number.isInteger(port) && port >= 1 && port <= 65535;
+}
+function normalizePorts(ports) {
+  return [...new Set(ports.filter((p) => isValidPort(p) && !ALWAYS_OPEN.has(p)))].sort((a, b) => a - b);
+}
+function addFirewallPort(configText, port, existing = []) {
+  if (!isValidPort(port))
+    throw new Error("Port must be an integer between 1 and 65535.");
+  if (ALWAYS_OPEN.has(port))
+    throw new Error(`Port ${port} (SSH/HTTP/HTTPS) is always open and is not managed here.`);
+  return setFirewallPorts({ configText, ports: normalizePorts([...existing, port]) });
+}
+function removeFirewallPort(configText, port, existing = []) {
+  return setFirewallPorts({ configText, ports: normalizePorts(existing.filter((p) => p !== port)) });
+}
+function findBlock(text, start, end, keyword, open) {
+  const body = text.slice(start, end);
+  const match = new RegExp(`\\b${keyword}\\s*:\\s*\\${open}`).exec(body);
+  if (!match)
+    return null;
+  const propStart = start + match.index;
+  const openIdx = text.indexOf(open, propStart);
+  return { propStart, open: openIdx, close: findMatching(text, openIdx, open, open === "{" ? "}" : "]") };
+}
+function renderPortsArray(ports) {
+  return `allowedPorts: [${ports.join(", ")}]`;
+}
+function setFirewallPorts(input) {
+  const { configText } = input;
+  const ports = normalizePorts(input.ports);
+  const computeMatch = /\bcompute\s*:\s*{/.exec(configText);
+  if (!computeMatch)
+    throw new Error("Could not find infrastructure.compute in the cloud config.");
+  const computeOpen = configText.indexOf("{", computeMatch.index);
+  const computeClose = findMatching(configText, computeOpen, "{", "}");
+  const firewall = findBlock(configText, computeOpen + 1, computeClose, "firewall", "{");
+  if (firewall) {
+    const portsArr = findBlock(configText, firewall.open + 1, firewall.close, "allowedPorts", "[");
+    if (portsArr) {
+      let lineStart = portsArr.propStart;
+      while (lineStart > 0 && configText[lineStart - 1] !== `
+` && /\s/.test(configText[lineStart - 1]))
+        lineStart--;
+      const indent = configText.slice(lineStart, portsArr.propStart);
+      return `${configText.slice(0, lineStart)}${indent}${renderPortsArray(ports)}${configText.slice(portsArr.close + 1)}`;
+    }
+    const before2 = configText.slice(0, firewall.close).trimEnd();
+    const after2 = configText.slice(firewall.close);
+    const sep2 = before2.endsWith(",") || before2.endsWith("{") ? "" : ",";
+    return `${before2}${sep2}
+        ${renderPortsArray(ports)},
+      ${after2}`;
+  }
+  const before = configText.slice(0, computeClose).trimEnd();
+  const after = configText.slice(computeClose);
+  const sep = before.endsWith(",") || before.endsWith("{") ? "" : ",";
+  return `${before}${sep}
+      firewall: {
+        enabled: true,
+        ${renderPortsArray(ports)},
+      },
+    ${after}`;
+}
+
+// src/deploy/serverless-operations.ts
+init_cloudformation();
+init_cloudfront();
+await init_dist2();
+
+// src/aws/xray.ts
+init_client();
+
+class XRayClient {
+  client;
+  region;
+  constructor(region = "us-east-1") {
+    this.region = region;
+    this.client = new AWSClient;
+  }
+  async getTraceSummaries(options) {
+    const body = {
+      StartTime: Math.floor(options.startTime.getTime() / 1000),
+      EndTime: Math.floor(options.endTime.getTime() / 1000),
+      TimeRangeType: "Event",
+      Sampling: false
+    };
+    if (options.filterExpression)
+      body.FilterExpression = options.filterExpression;
+    if (options.nextToken)
+      body.NextToken = options.nextToken;
+    const res = await this.client.request({
+      service: "xray",
+      region: this.region,
+      method: "POST",
+      path: "/TraceSummaries",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    return { summaries: res?.TraceSummaries ?? [], nextToken: res?.NextToken };
+  }
+  async batchGetTraces(traceIds) {
+    if (!traceIds.length)
+      return [];
+    const res = await this.client.request({
+      service: "xray",
+      region: this.region,
+      method: "POST",
+      path: "/Traces",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ TraceIds: traceIds.slice(0, 5) })
+    });
+    return res?.Traces ?? [];
+  }
+}
+
+// src/deploy/serverless-operations.ts
+var MAX_OUTPUT_BYTES2 = 64 * 1024;
+function clampOutput2(output) {
+  return output.length <= MAX_OUTPUT_BYTES2 ? output : `${output.slice(0, MAX_OUTPUT_BYTES2)}
+
+[output truncated]`;
+}
+function serverlessApp(config6, environment) {
+  return config6.environments?.[environment]?.app;
+}
+function buildServerlessOperations(config6, environment, data) {
+  const ops = [];
+  const app = serverlessApp(config6, environment);
+  ops.push({ id: "redeploy", label: "Redeploy current build", group: "deploy", target: "app", mutates: true, confirm: "redeploy" });
+  ops.push({ id: "rollback", label: "Roll back to previous build", group: "deploy", target: "app", mutates: true, confirm: "rollback", danger: true });
+  const maint = data.maintenance?.enabled;
+  if (maint !== true)
+    ops.push({ id: "maintenance:on", label: "Enable maintenance mode", group: "maintenance", target: "app", mutates: true, confirm: "maintenance", danger: true });
+  if (maint !== false)
+    ops.push({ id: "maintenance:off", label: "Disable maintenance mode", group: "maintenance", target: "app", mutates: true, confirm: "live" });
+  if (app?.assets || data.assetsInfo)
+    ops.push({ id: "assets:invalidate", label: "Invalidate CDN cache", group: "assets", target: "assets", mutates: true, confirm: "invalidate" });
+  if (app?.database?.connection === "aurora-serverless") {
+    ops.push({
+      id: "db:scale",
+      label: "Scale Aurora capacity",
+      group: "database",
+      target: "database",
+      mutates: true,
+      confirm: "scale",
+      inputs: [
+        { name: "min", label: "Min ACUs", placeholder: String(app.database.minCapacity ?? 0.5) },
+        { name: "max", label: "Max ACUs", placeholder: String(app.database.maxCapacity ?? 4) }
+      ]
+    });
+  }
+  for (const q of data.queues ?? []) {
+    const short = String(q?.name ?? "").trim();
+    if (short && /^[A-Za-z0-9_-]+$/.test(short))
+      ops.push({ id: `queue:purge:${short}`, label: `Purge queue (${short})`, group: "queue", target: short, mutates: true, confirm: short, danger: true });
+  }
+  return ops;
+}
+function resolveServerlessOperation(id, config6, environment, data) {
+  return buildServerlessOperations(config6, environment, data).find((op) => op.id === id);
+}
+async function assetsDistributionId(config6, environment, region) {
+  try {
+    const cf = new CloudFormationClient(region);
+    const { Stacks } = await cf.describeStacks({ stackName: resolveServerlessAppStackName(config6, environment) });
+    const outputs = {};
+    for (const o of Stacks?.[0]?.Outputs ?? [])
+      if (o.OutputKey)
+        outputs[o.OutputKey] = o.OutputValue ?? "";
+    const domain = outputs.AssetsCdnDomain;
+    if (!domain)
+      return null;
+    const dist = await new CloudFrontClient(region).findDistributionByDomain(domain);
+    return dist?.Id ?? null;
+  } catch {
+    return null;
+  }
+}
+async function runServerlessOperation(config6, environment, operation, options = {}) {
+  try {
+    if (operation.id === "redeploy") {
+      await redeployServerlessApp(config6, environment);
+      return { operation: operation.id, command: "serverless redeploy", ok: true, stdout: "Redeploy complete." };
+    }
+    if (operation.id === "rollback") {
+      await rollbackServerlessApp(config6, environment);
+      return { operation: operation.id, command: "serverless rollback", ok: true, stdout: "Rollback complete." };
+    }
+    if (operation.id === "maintenance:on") {
+      await setMaintenance(config6, environment, true);
+      return { operation: operation.id, command: "maintenance on", ok: true, stdout: "Application is now in maintenance mode." };
+    }
+    if (operation.id === "maintenance:off") {
+      await setMaintenance(config6, environment, false);
+      return { operation: operation.id, command: "maintenance off", ok: true, stdout: "Application is live." };
+    }
+    if (operation.id === "db:scale") {
+      const min = Number(options.min);
+      const max = Number(options.max);
+      if (!Number.isFinite(min) || !Number.isFinite(max) || min <= 0 || max < min)
+        return { operation: operation.id, ok: false, error: "Provide valid Aurora capacities (0 < min ≤ max)." };
+      await scaleServerlessDatabase(config6, environment, min, max);
+      return { operation: operation.id, command: `db:scale ${min}-${max} ACU`, ok: true, stdout: `Scaling applied (${min}-${max} ACUs); takes effect shortly.` };
+    }
+    if (operation.id === "assets:invalidate") {
+      const info2 = await serverlessInfo(config6, environment);
+      const distId = await assetsDistributionId(config6, environment, info2.region);
+      if (!distId)
+        return { operation: operation.id, ok: false, error: "Could not resolve the asset CloudFront distribution for this environment." };
+      const cf = new CloudFrontClient(info2.region);
+      const res = await cf.invalidateAll(distId);
+      return { operation: operation.id, command: `cloudfront invalidate ${distId} /*`, ok: true, stdout: `Invalidation ${res?.Id ?? "created"} for ${distId} (/*).` };
+    }
+    if (operation.group === "queue" && operation.id.startsWith("queue:purge:")) {
+      const short = operation.target;
+      const info2 = await serverlessInfo(config6, environment);
+      const sqs2 = new SQSClient(info2.region);
+      const queueName = `${info2.slug}-${environment}-${short}`;
+      const { QueueUrl } = await sqs2.getQueueUrl(queueName);
+      await sqs2.purgeQueue(QueueUrl);
+      return { operation: operation.id, command: `sqs purge ${queueName}`, ok: true, stdout: `Purged queue ${queueName}.` };
+    }
+    return { operation: operation.id, ok: false, error: "Unknown or unavailable serverless operation." };
+  } catch (error2) {
+    return { operation: operation.id, ok: false, error: clampOutput2(error2?.message ?? String(error2)) };
+  }
+}
+async function runServerlessCommand(config6, environment, command) {
+  const trimmed = command.trim();
+  if (!trimmed)
+    return { operation: "command", ok: false, error: "A command is required." };
+  try {
+    const output = await runRemoteCommand(config6, environment, trimmed);
+    return { operation: "command", command: trimmed, ok: true, stdout: clampOutput2(output || "(no output)") };
+  } catch (error2) {
+    return { operation: "command", command: trimmed, ok: false, error: clampOutput2(error2?.message ?? String(error2)) };
+  }
+}
+var DLQ_UNAVAILABLE = "No dead-letter queue is provisioned for this environment.";
+async function dlqUrl(sqs2, slug, environment) {
+  try {
+    const { QueueUrl } = await sqs2.getQueueUrl(`${slug}-${environment}-dlq`);
+    return QueueUrl;
+  } catch {
+    return null;
+  }
+}
+async function listDlqMessages(config6, environment, max = 10) {
+  try {
+    const info2 = await serverlessInfo(config6, environment);
+    const sqs2 = new SQSClient(info2.region);
+    const url = await dlqUrl(sqs2, info2.slug, environment);
+    if (!url)
+      return { ok: false, messages: [], error: DLQ_UNAVAILABLE };
+    const received = await sqs2.receiveMessages({
+      queueUrl: url,
+      maxMessages: Math.min(10, Math.max(1, max)),
+      waitTimeSeconds: 1,
+      visibilityTimeout: 2
+    });
+    const messages = (received.Messages ?? []).map((m) => ({
+      id: m.MessageId,
+      receiptHandle: m.ReceiptHandle,
+      body: clampOutput2(String(m.Body ?? ""))
+    }));
+    return { ok: true, messages };
+  } catch (error2) {
+    return { ok: false, messages: [], error: clampOutput2(error2?.message ?? String(error2)) };
+  }
+}
+async function redriveDlq(config6, environment, opts = {}) {
+  try {
+    const info2 = await serverlessInfo(config6, environment);
+    const app = serverlessApp(config6, environment);
+    const queues = app ? resolveQueues(app, info2.slug, environment) : [];
+    const shortNames = queues.map((q) => q.name.replace(`${info2.slug}-${environment}-`, ""));
+    const target = opts.targetQueue && shortNames.includes(opts.targetQueue) ? opts.targetQueue : shortNames[0];
+    if (!target)
+      return { operation: "dlq:redrive", ok: false, error: "No source queue is configured to redrive into." };
+    const sqs2 = new SQSClient(info2.region);
+    const dlq = await dlqUrl(sqs2, info2.slug, environment);
+    if (!dlq)
+      return { operation: "dlq:redrive", ok: false, error: DLQ_UNAVAILABLE };
+    const { QueueUrl: targetUrl } = await sqs2.getQueueUrl(`${info2.slug}-${environment}-${target}`);
+    const cap = Math.min(50, Math.max(1, opts.max ?? 10));
+    let moved = 0;
+    while (moved < cap) {
+      const batch2 = await sqs2.receiveMessages({ queueUrl: dlq, maxMessages: Math.min(10, cap - moved), waitTimeSeconds: 1, visibilityTimeout: 30 });
+      const msgs = batch2.Messages ?? [];
+      if (!msgs.length)
+        break;
+      for (const m of msgs) {
+        await sqs2.sendMessage({ queueUrl: targetUrl, messageBody: String(m.Body ?? "") });
+        await sqs2.deleteMessage(dlq, m.ReceiptHandle);
+        moved++;
+      }
+    }
+    return { operation: "dlq:redrive", command: `redrive → ${target}`, ok: true, stdout: `Moved ${moved} message(s) from the DLQ to ${target}.` };
+  } catch (error2) {
+    return { operation: "dlq:redrive", ok: false, error: clampOutput2(error2?.message ?? String(error2)) };
+  }
+}
+async function purgeDlq(config6, environment) {
+  try {
+    const info2 = await serverlessInfo(config6, environment);
+    const sqs2 = new SQSClient(info2.region);
+    const url = await dlqUrl(sqs2, info2.slug, environment);
+    if (!url)
+      return { operation: "dlq:purge", ok: false, error: DLQ_UNAVAILABLE };
+    await sqs2.purgeQueue(url);
+    return { operation: "dlq:purge", command: "sqs purge dlq", ok: true, stdout: "Dead-letter queue purged." };
+  } catch (error2) {
+    return { operation: "dlq:purge", ok: false, error: clampOutput2(error2?.message ?? String(error2)) };
+  }
+}
+function configuredSecretIds(config6, environment) {
+  const app = serverlessApp(config6, environment);
+  if (!app?.secrets)
+    return [];
+  return Array.isArray(app.secrets) ? app.secrets.map((name) => ({ key: name.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g, "_"), secretId: name })) : Object.entries(app.secrets).map(([key, secretId]) => ({ key, secretId: String(secretId) }));
+}
+async function setServerlessSecret(config6, environment, secretId, value) {
+  if (!secretId.trim())
+    return { operation: "secret:set", ok: false, error: "A secret id is required." };
+  try {
+    const info2 = await serverlessInfo(config6, environment);
+    const sm = new SecretsManagerClient(info2.region);
+    try {
+      await sm.putSecretValue({ SecretId: secretId, SecretString: value });
+    } catch {
+      await sm.createSecret({ Name: secretId, SecretString: value });
+    }
+    return { operation: "secret:set", command: `secret set ${secretId}`, ok: true, stdout: `Secret ${secretId} updated. Redeploy to apply it to the functions.` };
+  } catch (error2) {
+    return { operation: "secret:set", ok: false, error: clampOutput2(error2?.message ?? String(error2)) };
+  }
+}
+async function deleteServerlessSecret(config6, environment, secretId) {
+  if (!secretId.trim())
+    return { operation: "secret:delete", ok: false, error: "A secret id is required." };
+  try {
+    const info2 = await serverlessInfo(config6, environment);
+    const sm = new SecretsManagerClient(info2.region);
+    await sm.deleteSecret({ SecretId: secretId, RecoveryWindowInDays: 7 });
+    return { operation: "secret:delete", command: `secret delete ${secretId}`, ok: true, stdout: `Secret ${secretId} scheduled for deletion (recoverable for 7 days).` };
+  } catch (error2) {
+    return { operation: "secret:delete", ok: false, error: clampOutput2(error2?.message ?? String(error2)) };
+  }
+}
+var FUNCTION_MODES = new Set(["http", "queue", "cli"]);
+async function updateFunctionConfig(config6, environment, mode, opts) {
+  if (!FUNCTION_MODES.has(mode))
+    return { operation: "function:config", ok: false, error: `Unknown function mode '${mode}'.` };
+  const memory = opts.memory == null ? undefined : Number(opts.memory);
+  const timeout = opts.timeout == null ? undefined : Number(opts.timeout);
+  if (memory != null && (!Number.isInteger(memory) || memory < 128 || memory > 10240))
+    return { operation: "function:config", ok: false, error: "Memory must be an integer between 128 and 10240 MB." };
+  if (timeout != null && (!Number.isInteger(timeout) || timeout < 1 || timeout > 900))
+    return { operation: "function:config", ok: false, error: "Timeout must be an integer between 1 and 900 seconds." };
+  if (memory == null && timeout == null)
+    return { operation: "function:config", ok: false, error: "Provide a memory and/or timeout value." };
+  try {
+    const info2 = await serverlessInfo(config6, environment);
+    const lambda2 = new LambdaClient(info2.region);
+    const name = `${info2.slug}-${environment}-${mode}`;
+    await lambda2.updateFunctionConfiguration({
+      FunctionName: name,
+      ...memory != null ? { MemorySize: memory } : {},
+      ...timeout != null ? { Timeout: timeout } : {}
+    });
+    const parts = [memory != null ? `${memory} MB` : "", timeout != null ? `${timeout}s` : ""].filter(Boolean).join(", ");
+    return { operation: "function:config", command: `update ${name} (${parts})`, ok: true, stdout: `Updated ${name}: ${parts}.` };
+  } catch (error2) {
+    return { operation: "function:config", ok: false, error: clampOutput2(error2?.message ?? String(error2)) };
+  }
+}
+var ALARM_PRESETS = [
+  { key: "http-errors", label: "HTTP function errors", namespace: "AWS/Lambda", metricName: "Errors", statistic: "Sum", comparison: "GreaterThanThreshold", fnMode: "http", unit: "errors / 5 min" },
+  { key: "http-throttles", label: "HTTP function throttles", namespace: "AWS/Lambda", metricName: "Throttles", statistic: "Sum", comparison: "GreaterThanThreshold", fnMode: "http", unit: "throttles / 5 min" },
+  { key: "http-duration", label: "HTTP function duration (avg)", namespace: "AWS/Lambda", metricName: "Duration", statistic: "Average", comparison: "GreaterThanThreshold", fnMode: "http", unit: "ms" },
+  { key: "http-concurrency", label: "HTTP concurrent executions", namespace: "AWS/Lambda", metricName: "ConcurrentExecutions", statistic: "Maximum", comparison: "GreaterThanThreshold", fnMode: "http", unit: "concurrent" },
+  { key: "queue-errors", label: "Queue function errors", namespace: "AWS/Lambda", metricName: "Errors", statistic: "Sum", comparison: "GreaterThanThreshold", fnMode: "queue", unit: "errors / 5 min" }
+];
+function resolveAlarmPreset(key) {
+  return ALARM_PRESETS.find((p) => p.key === key);
+}
+async function listAlarms(config6, environment) {
+  try {
+    const info2 = await serverlessInfo(config6, environment);
+    const cw = new CloudWatchClient(info2.region);
+    const all = await cw.describeAlarms({ AlarmNamePrefix: `${info2.slug}-${environment}-`, MaxRecords: 100 });
+    return { ok: true, alarms: all, presets: ALARM_PRESETS };
+  } catch (error2) {
+    return { ok: false, alarms: [], presets: ALARM_PRESETS, error: clampOutput2(error2?.message ?? String(error2)) };
+  }
+}
+async function createAlarm(config6, environment, presetKey, threshold) {
+  const preset = resolveAlarmPreset(presetKey);
+  if (!preset)
+    return { operation: "alarm:create", ok: false, error: `Unknown alarm metric '${presetKey}'.` };
+  if (!Number.isFinite(threshold) || threshold < 0)
+    return { operation: "alarm:create", ok: false, error: "Provide a non-negative threshold." };
+  try {
+    const info2 = await serverlessInfo(config6, environment);
+    const cw = new CloudWatchClient(info2.region);
+    const alarmName = `${info2.slug}-${environment}-${preset.key}`;
+    const dims = preset.fnMode ? [{ Name: "FunctionName", Value: `${info2.slug}-${environment}-${preset.fnMode}` }] : [];
+    await cw.putMetricAlarm({
+      AlarmName: alarmName,
+      Namespace: preset.namespace,
+      MetricName: preset.metricName,
+      ComparisonOperator: preset.comparison,
+      Threshold: threshold,
+      EvaluationPeriods: 1,
+      Period: 300,
+      Statistic: preset.statistic,
+      Dimensions: dims,
+      AlarmDescription: `ts-cloud: ${preset.label} > ${threshold} ${preset.unit}`
+    });
+    return { operation: "alarm:create", command: `alarm ${alarmName}`, ok: true, stdout: `Alarm ${alarmName} armed at ${threshold} ${preset.unit}.` };
+  } catch (error2) {
+    return { operation: "alarm:create", ok: false, error: clampOutput2(error2?.message ?? String(error2)) };
+  }
+}
+async function deleteAlarm(config6, environment, alarmName) {
+  try {
+    const info2 = await serverlessInfo(config6, environment);
+    if (!alarmName.startsWith(`${info2.slug}-${environment}-`))
+      return { operation: "alarm:delete", ok: false, error: "Refusing to delete an alarm outside this environment." };
+    const cw = new CloudWatchClient(info2.region);
+    await cw.deleteAlarms([alarmName]);
+    return { operation: "alarm:delete", command: `delete alarm ${alarmName}`, ok: true, stdout: `Alarm ${alarmName} deleted.` };
+  } catch (error2) {
+    return { operation: "alarm:delete", ok: false, error: clampOutput2(error2?.message ?? String(error2)) };
+  }
+}
+function shapeTrace(s) {
+  const status = s.HasFault ? "fault" : s.HasError ? "error" : s.HasThrottle ? "throttle" : "ok";
+  return {
+    id: String(s.Id ?? ""),
+    durationMs: Math.round((s.Duration ?? 0) * 1000),
+    responseMs: Math.round((s.ResponseTime ?? 0) * 1000),
+    status,
+    method: s.Http?.HttpMethod ?? "-",
+    url: s.Http?.HttpURL ?? "-",
+    httpStatus: s.Http?.HttpStatus ?? 0
+  };
+}
+async function listTraces(config6, environment, minutes = 30) {
+  try {
+    const info2 = await serverlessInfo(config6, environment);
+    const xray = new XRayClient(info2.region);
+    const end = new Date;
+    const start = new Date(end.getTime() - Math.min(360, Math.max(1, minutes)) * 60000);
+    const httpFn = `${info2.slug}-${environment}-http`;
+    let res = await xray.getTraceSummaries({ startTime: start, endTime: end, filterExpression: `service("${httpFn}")` });
+    if (!res.summaries.length)
+      res = await xray.getTraceSummaries({ startTime: start, endTime: end });
+    return { ok: true, traces: res.summaries.slice(0, 100).map(shapeTrace) };
+  } catch (error2) {
+    return { ok: false, traces: [], error: clampOutput2(error2?.message ?? String(error2)) };
+  }
+}
+async function controlScheduler(config6, environment, action) {
+  try {
+    const info2 = await serverlessInfo(config6, environment);
+    const ruleName = `${info2.slug}-${environment}-scheduler`;
+    if (action === "run") {
+      const output = await runRemoteCommand(config6, environment, "schedule:run");
+      return { operation: "scheduler:run", command: "schedule:run", ok: true, stdout: clampOutput2(output || "Scheduler run triggered.") };
+    }
+    const eb = new EventBridgeClient(info2.region);
+    if (action === "enable")
+      await eb.enableRule({ Name: ruleName });
+    else
+      await eb.disableRule({ Name: ruleName });
+    return { operation: `scheduler:${action}`, command: `${action} ${ruleName}`, ok: true, stdout: `Scheduler rule ${ruleName} ${action}d.` };
+  } catch (error2) {
+    return { operation: `scheduler:${action}`, ok: false, error: clampOutput2(error2?.message ?? String(error2)) };
+  }
+}
 
 // src/deploy/site-config-editor.ts
 function addSiteToCloudConfig(input) {
@@ -89612,6 +90309,28 @@ ${entries.map(([key, value]) => `        ${key}: '${escapeSingle(String(value))}
 `)}
       }`;
 }
+function isValidHostname(value) {
+  return /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(value.trim());
+}
+function renderAliasesValue(aliases) {
+  const list = [...new Set(aliases.map((a) => a.trim().toLowerCase()).filter(Boolean))];
+  for (const host of list) {
+    if (!isValidHostname(host))
+      throw new Error(`Alias '${host}' is not a valid hostname.`);
+  }
+  if (list.length === 0)
+    return "[]";
+  return `[${list.map((a) => `'${escapeSingle(a)}'`).join(", ")}]`;
+}
+function renderRedirectsValue(redirects) {
+  const entries = Object.entries(redirects).map(([from, to]) => [from.trim(), String(to).trim()]).filter(([from, to]) => from && to);
+  if (entries.length === 0)
+    return "{}";
+  return `{
+${entries.map(([from, to]) => `        '${escapeSingle(from)}': '${escapeSingle(to)}',`).join(`
+`)}
+      }`;
+}
 function scanValueEnd(text, start, limit) {
   let i = start;
   while (i < limit && /\s/.test(text[i]))
@@ -89788,10 +90507,57 @@ function findMatchingBrace(text, start) {
   throw new Error("Could not find the closing brace for sites: { ... } in cloud.config.ts");
 }
 
+// src/deploy/terminal-session.ts
+function createTerminalSession(onData, options = {}) {
+  const shell = options.shell || (process.platform === "win32" ? "powershell.exe" : "bash");
+  const proc = Bun.spawn([shell, "-i"], {
+    stdin: "pipe",
+    stdout: "pipe",
+    stderr: "pipe",
+    cwd: options.cwd,
+    env: { ...process.env, TERM: "xterm-256color", PS1: "\\w $ " }
+  });
+  const decoder = new TextDecoder;
+  const pump = async (stream) => {
+    if (!stream)
+      return;
+    const reader = stream.getReader();
+    try {
+      for (;; ) {
+        const { done, value } = await reader.read();
+        if (done)
+          break;
+        if (value)
+          onData(decoder.decode(value));
+      }
+    } catch {}
+  };
+  pump(proc.stdout);
+  pump(proc.stderr);
+  if (options.onExit)
+    proc.exited.then((code) => options.onExit(code)).catch(() => {});
+  return {
+    write(data) {
+      try {
+        proc.stdin.write(data);
+        proc.stdin.flush();
+      } catch {}
+    },
+    close() {
+      try {
+        proc.stdin.end();
+      } catch {}
+      try {
+        proc.kill();
+      } catch {}
+    }
+  };
+}
+
 // src/deploy/local-dashboard-server.ts
 var DEFAULT_HOST = "127.0.0.1";
 var DEFAULT_PORT = 7676;
-var MAX_OUTPUT_BYTES2 = 64 * 1024;
+var MAX_OUTPUT_BYTES3 = 64 * 1024;
 var here = dirname9(fileURLToPath6(import.meta.url));
 var contentTypes = {
   ".html": "text/html; charset=utf-8",
@@ -89871,16 +90637,20 @@ function replaceSiteConfig(config6, name, site) {
   const sites = config6.sites ?? (config6.sites = {});
   sites[name] = site;
 }
+function computeFirewallPorts(config6) {
+  return normalizePorts(config6.infrastructure?.compute?.firewall?.allowedPorts ?? []);
+}
+function replaceFirewallPorts(config6, ports) {
+  const infra = config6.infrastructure ?? (config6.infrastructure = {});
+  const compute = infra.compute ?? (infra.compute = {});
+  const firewall = compute.firewall ?? (compute.firewall = {});
+  firewall.allowedPorts = ports;
+}
 async function readJsonBody(req) {
   return await req.json().catch(() => ({}));
 }
-function resolveDashboardMode(config6) {
-  if (config6.mode === "hybrid")
-    return "hybrid";
-  return config6.infrastructure?.compute ? "server" : "serverless";
-}
 async function resolveLiveDashboardData(config6, environment) {
-  const mode = resolveDashboardMode(config6);
+  const mode = resolveDeploymentMode(config6);
   const meta = { mode, environment, environments: Object.keys(config6.environments ?? {}) };
   try {
     const data = mode === "serverless" ? await resolveDashboardData(config6, environment) : await resolveServerDashboardData(config6, environment);
@@ -90016,10 +90786,10 @@ function dashboardActions(environment) {
 function resolveDashboardAction(id, environment) {
   return dashboardActions(environment).find((action) => action.id === id);
 }
-function clampOutput2(output) {
-  if (output.length <= MAX_OUTPUT_BYTES2)
+function clampOutput3(output) {
+  if (output.length <= MAX_OUTPUT_BYTES3)
     return output;
-  return `${output.slice(0, MAX_OUTPUT_BYTES2)}
+  return `${output.slice(0, MAX_OUTPUT_BYTES3)}
 
 [output truncated]`;
 }
@@ -90040,8 +90810,8 @@ async function runAction(action, options) {
     command: ["cloud", ...action.command].join(" "),
     exitCode,
     ok: exitCode === 0,
-    stdout: clampOutput2(stdout),
-    stderr: clampOutput2(stderr)
+    stdout: clampOutput3(stdout),
+    stderr: clampOutput3(stderr)
   };
 }
 function staticPath(uiRoot, pathname) {
@@ -90089,12 +90859,49 @@ async function startLocalDashboardServer(options = {}) {
   let activeUiRoot = liveUiRoot ?? packagedUi?.uiRoot;
   if (!activeUiRoot)
     throw new Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");
+  const terminalSessions = new WeakMap;
+  const terminalEnabled = process.env.TS_CLOUD_DASHBOARD_TERMINAL !== "0";
   const server = Bun.serve({
     hostname: host,
     port,
-    async fetch(req) {
+    websocket: {
+      open(ws) {
+        if (!terminalEnabled) {
+          ws.send(`The web terminal is disabled (TS_CLOUD_DASHBOARD_TERMINAL=0).\r
+`);
+          ws.close();
+          return;
+        }
+        const session = createTerminalSession((chunk2) => ws.send(chunk2), {
+          cwd,
+          onExit: () => {
+            try {
+              ws.close();
+            } catch {}
+          }
+        });
+        terminalSessions.set(ws, session);
+        ws.send(`Connected to ${host === "127.0.0.1" ? "localhost" : host} shell. This is a line-oriented shell (no full-screen apps).\r
+`);
+      },
+      message(ws, message) {
+        terminalSessions.get(ws)?.write(typeof message === "string" ? message : new TextDecoder().decode(message));
+      },
+      close(ws) {
+        terminalSessions.get(ws)?.close();
+        terminalSessions.delete(ws);
+      }
+    },
+    async fetch(req, server2) {
       const url = new URL(req.url);
       try {
+        if (url.pathname === "/api/terminal") {
+          if (!terminalEnabled)
+            return json({ ok: false, error: "The web terminal is disabled." }, 403);
+          if (server2.upgrade(req))
+            return;
+          return text("WebSocket upgrade failed", 400);
+        }
         if (url.pathname === "/api/health") {
           return json({
             ok: true,
@@ -90103,6 +90910,7 @@ async function startLocalDashboardServer(options = {}) {
             environments: availableEnvironments,
             uiRoot: activeUiRoot,
             liveData: !!liveUiRoot,
+            terminal: terminalEnabled,
             localPackage: import.meta.url.includes("/Code/Libraries/ts-cloud/")
           });
         }
@@ -90163,6 +90971,42 @@ async function startLocalDashboardServer(options = {}) {
           replaceComputeSshKeys(config6, currentKeys.filter((key) => key.name !== name.trim()));
           return json({ ok: true, configPath, keys: describeSshKeys(computeSshKeys(config6)) });
         }
+        if (url.pathname === "/api/firewall" && req.method === "GET")
+          return json({ configPath, alwaysOpen: [22, 80, 443], ports: computeFirewallPorts(config6) });
+        if (url.pathname === "/api/firewall" && req.method === "POST") {
+          if (!configPath)
+            return json({ ok: false, error: "No cloud config file was found in this checkout." }, 404);
+          const body = await readJsonBody(req);
+          const port2 = Number(body.port);
+          if (!isValidPort(port2))
+            return json({ ok: false, error: "Port must be an integer between 1 and 65535." }, 422);
+          const current = computeFirewallPorts(config6);
+          const before = await readFile2(configPath, "utf8");
+          try {
+            await writeFile6(configPath, addFirewallPort(before, port2, current));
+          } catch (error2) {
+            return json({ ok: false, error: error2?.message ?? String(error2) }, 422);
+          }
+          const ports = normalizePorts([...current, port2]);
+          replaceFirewallPorts(config6, ports);
+          const apply = body.apply === false ? null : await runServerShellCommand(config6, environment, `ufw allow ${port2}/tcp`).catch((e) => ({ ok: false, error: String(e?.message ?? e) }));
+          return json({ ok: true, configPath, ports, apply });
+        }
+        if (url.pathname === "/api/firewall" && req.method === "DELETE") {
+          if (!configPath)
+            return json({ ok: false, error: "No cloud config file was found in this checkout." }, 404);
+          const body = await readJsonBody(req);
+          const port2 = Number(body.port ?? url.searchParams.get("port"));
+          if (!isValidPort(port2))
+            return json({ ok: false, error: "Port must be an integer between 1 and 65535." }, 422);
+          const current = computeFirewallPorts(config6);
+          const before = await readFile2(configPath, "utf8");
+          await writeFile6(configPath, removeFirewallPort(before, port2, current));
+          const ports = normalizePorts(current.filter((p) => p !== port2));
+          replaceFirewallPorts(config6, ports);
+          const apply = body.apply === false ? null : await runServerShellCommand(config6, environment, `ufw delete allow ${port2}/tcp`).catch((e) => ({ ok: false, error: String(e?.message ?? e) }));
+          return json({ ok: true, configPath, ports, apply });
+        }
         if (url.pathname === "/api/sites" && req.method === "POST") {
           if (!configPath)
             return json({ ok: false, error: "No cloud config file was found in this checkout." }, 404);
@@ -90236,7 +91080,16 @@ async function startLocalDashboardServer(options = {}) {
             set("env", renderEnvValue(body.env));
             existing.env = body.env;
           }
-          for (const key of ["domain", "path", "build", "start", "type", "root"]) {
+          if (body.aliases !== undefined && Array.isArray(body.aliases)) {
+            const aliases = body.aliases.map((a) => String(a));
+            set("aliases", renderAliasesValue(aliases));
+            existing.aliases = aliases.map((a) => a.trim().toLowerCase()).filter(Boolean);
+          }
+          if (body.redirects !== undefined && body.redirects && typeof body.redirects === "object") {
+            set("redirects", renderRedirectsValue(body.redirects));
+            existing.redirects = body.redirects;
+          }
+          for (const key of ["domain", "path", "build", "start", "type", "root", "php"]) {
             if (typeof body[key] === "string" && body[key].trim()) {
               set(key, renderStringValue(String(body[key]).trim()));
               existing[key] = String(body[key]).trim();
@@ -90279,6 +91132,17 @@ async function startLocalDashboardServer(options = {}) {
             return json({ ok: false, error: "Database name must be a valid identifier (letters, numbers, underscore; not starting with a digit)." }, 422);
           return json({ ...await createDatabase(config6, environment, name), name });
         }
+        if (url.pathname === "/api/databases/backups" && req.method === "GET")
+          return json(await listDatabaseBackups(config6, environment));
+        if (url.pathname === "/api/databases/backup" && req.method === "POST") {
+          const body = await readJsonBody(req);
+          const name = String(body.database ?? "").trim();
+          if (!isValidDbIdentifier(name))
+            return json({ ok: false, error: "Database name must be a valid identifier." }, 422);
+          if (body.confirm !== name)
+            return json({ ok: false, error: `Type "${name}" to back up this database.` }, 409);
+          return json(await backupDatabase(config6, environment, name));
+        }
         if (url.pathname === "/api/databases/users" && req.method === "POST") {
           const body = await readJsonBody(req);
           const username = String(body.username ?? "").trim();
@@ -90315,6 +91179,108 @@ async function startLocalDashboardServer(options = {}) {
             return json({ ok: false, error: `Type "${operation.confirm}" to run this operation.` }, 409);
           return json(await runDashboardOperation(config6, environment, operation, { to: body.to }));
         }
+        if (url.pathname === "/api/server/command" && req.method === "POST") {
+          const body = await req.json().catch(() => ({}));
+          if (body.confirm !== "run")
+            return json({ ok: false, error: 'Type "run" to execute this command on the server.' }, 409);
+          return json(await runServerShellCommand(config6, environment, String(body.command ?? "")));
+        }
+        if (url.pathname === "/api/serverless/operations")
+          return json(buildServerlessOperations(config6, environment, latestData));
+        if (url.pathname === "/api/serverless/operations/run" && req.method === "POST") {
+          const body = await req.json().catch(() => ({}));
+          const operation = body.operation ? resolveServerlessOperation(body.operation, config6, environment, latestData) : undefined;
+          if (!operation)
+            return json({ ok: false, error: "Unknown or unavailable serverless operation." }, 404);
+          if (operation.mutates && body.confirm !== operation.confirm)
+            return json({ ok: false, error: `Type "${operation.confirm}" to run this operation.` }, 409);
+          const result = await runServerlessOperation(config6, environment, operation, { min: body.min, max: body.max });
+          latestData = await resolveLiveDashboardData(config6, environment);
+          return json(result);
+        }
+        if (url.pathname === "/api/serverless/command" && req.method === "POST") {
+          const body = await req.json().catch(() => ({}));
+          if (body.confirm !== "run")
+            return json({ ok: false, error: 'Type "run" to execute this command.' }, 409);
+          return json(await runServerlessCommand(config6, environment, String(body.command ?? "")));
+        }
+        if (url.pathname === "/api/serverless/dlq" && req.method === "GET") {
+          const max = Number(url.searchParams.get("max")) || 10;
+          return json(await listDlqMessages(config6, environment, max));
+        }
+        if (url.pathname === "/api/serverless/dlq/redrive" && req.method === "POST") {
+          const body = await req.json().catch(() => ({}));
+          if (body.confirm !== "redrive")
+            return json({ ok: false, error: 'Type "redrive" to move messages back onto a source queue.' }, 409);
+          return json(await redriveDlq(config6, environment, { max: body.max, targetQueue: body.targetQueue }));
+        }
+        if (url.pathname === "/api/serverless/dlq/purge" && req.method === "POST") {
+          const body = await req.json().catch(() => ({}));
+          if (body.confirm !== "purge")
+            return json({ ok: false, error: 'Type "purge" to permanently discard every DLQ message.' }, 409);
+          return json(await purgeDlq(config6, environment));
+        }
+        if (url.pathname === "/api/serverless/secrets" && req.method === "GET")
+          return json({ secrets: configuredSecretIds(config6, environment) });
+        if (url.pathname === "/api/serverless/secrets" && req.method === "POST") {
+          const body = await req.json().catch(() => ({}));
+          const secretId = String(body.secretId ?? "").trim();
+          if (!secretId)
+            return json({ ok: false, error: "A secret id is required." }, 422);
+          if (typeof body.value !== "string" || body.value === "")
+            return json({ ok: false, error: "A non-empty value is required." }, 422);
+          return json(await setServerlessSecret(config6, environment, secretId, body.value));
+        }
+        if (url.pathname === "/api/serverless/secrets" && req.method === "DELETE") {
+          const body = await req.json().catch(() => ({}));
+          const secretId = String(body.secretId ?? "").trim();
+          if (!secretId)
+            return json({ ok: false, error: "A secret id is required." }, 422);
+          if (body.confirm !== secretId)
+            return json({ ok: false, error: `Type "${secretId}" to delete this secret.` }, 409);
+          return json(await deleteServerlessSecret(config6, environment, secretId));
+        }
+        if (url.pathname === "/api/serverless/functions/config" && req.method === "POST") {
+          const body = await req.json().catch(() => ({}));
+          const mode = String(body.mode ?? "").trim();
+          if (body.confirm !== mode)
+            return json({ ok: false, error: `Type "${mode}" to update this function.` }, 409);
+          return json(await updateFunctionConfig(config6, environment, mode, { memory: body.memory, timeout: body.timeout }));
+        }
+        if (url.pathname === "/api/serverless/alarms" && req.method === "GET")
+          return json(await listAlarms(config6, environment));
+        if (url.pathname === "/api/serverless/alarms" && req.method === "POST") {
+          const body = await req.json().catch(() => ({}));
+          const preset = String(body.preset ?? "").trim();
+          const threshold = Number(body.threshold);
+          if (!preset)
+            return json({ ok: false, error: "An alarm metric is required." }, 422);
+          if (!Number.isFinite(threshold))
+            return json({ ok: false, error: "A numeric threshold is required." }, 422);
+          return json(await createAlarm(config6, environment, preset, threshold));
+        }
+        if (url.pathname === "/api/serverless/alarms" && req.method === "DELETE") {
+          const body = await req.json().catch(() => ({}));
+          const name = String(body.name ?? "").trim();
+          if (!name)
+            return json({ ok: false, error: "An alarm name is required." }, 422);
+          if (body.confirm !== name)
+            return json({ ok: false, error: `Type "${name}" to delete this alarm.` }, 409);
+          return json(await deleteAlarm(config6, environment, name));
+        }
+        if (url.pathname === "/api/serverless/traces" && req.method === "GET") {
+          const minutes = Number(url.searchParams.get("minutes")) || 30;
+          return json(await listTraces(config6, environment, minutes));
+        }
+        if (url.pathname === "/api/serverless/scheduler" && req.method === "POST") {
+          const body = await req.json().catch(() => ({}));
+          const action = String(body.action ?? "").trim();
+          if (action !== "enable" && action !== "disable" && action !== "run")
+            return json({ ok: false, error: "Unknown scheduler action." }, 422);
+          if (body.confirm !== action)
+            return json({ ok: false, error: `Type "${action}" to ${action} the scheduler.` }, 409);
+          return json(await controlScheduler(config6, environment, action));
+        }
         const requestedEnv = url.searchParams.get("env");
         if (requestedEnv && availableEnvironments.includes(requestedEnv) && requestedEnv !== environment) {
           environment = requestedEnv;
@@ -90393,6 +91359,7 @@ export {
   rollbackServerlessApp,
   responseToResult,
   resourceManagementManager,
+  resolveUiSource,
   resolveStorageBucketName,
   resolveSiteStackName,
   resolveSiteResourceName,
@@ -90411,8 +91378,10 @@ export {
   resolveManagementDashboardSite,
   resolveHetznerApiToken,
   resolveExecStart,
+  resolveDeploymentMode,
   resolveDeployBucketName,
   resolveDashboardDomain,
+  resolveDashboardAuth,
   resolveDashboardAction,
   resolveCredentials,
   resolveCloudProvider,
@@ -90558,6 +91527,7 @@ export {
   fifoQueueManager,
   extendPreset,
   eventToRequest,
+  ensureManagementDashboard,
   emailTemplateManager,
   emailAnalyticsManager,
   drManager,
@@ -90568,6 +91538,8 @@ export {
   detectServiceRegion,
   detectMisconfigurations,
   detectDnsProvider,
+  detectDeploymentTargets,
+  deploymentCoexistenceError,
   deployStaticSiteWithExternalDnsFull,
   deployStaticSiteWithExternalDns,
   deployStaticSiteFull,
@@ -90637,6 +91609,7 @@ export {
   buildPhpRuntimeLayerZip,
   buildOptimizationManager,
   buildNodeRuntimeLayerZip,
+  buildManagementDashboardArtifact,
   buildFunctionEnv,
   buildCloudFormationTemplate,
   buildBunRuntimeLayerZip,
@@ -90744,6 +91717,7 @@ export {
   MigrationManager,
   MetricsManager,
   Messaging,
+  MANAGEMENT_DASHBOARD_SITE,
   MANAGED_NODE_VERSIONS,
   LogsManager,
   LambdaVersionsManager,
@@ -90797,6 +91771,7 @@ export {
   DNS,
   DLQMonitoringManager,
   DEFAULT_SERVICE_LIMITS,
+  DASHBOARD_CREDENTIALS_FILE,
   CrossRegionReferenceManager,
   CredentialError,
   ContainerRegistryManager,