@stacksjs/ts-cloud 0.7.108 → 0.7.110

package/dist/{chunk-fmt40tpw.js → chunk-53jatzaw.js}

@@ -1,9 +1,9 @@
 import {
   buildAndPushServerlessImage
-} from "./chunk-3g4r09dd.js";
+} from "./chunk-wmbep3b5.js";
 import"./chunk-50jpda9q.js";
-import"./chunk-c6db5m63.js";
 import"./chunk-zqtpg06c.js";
+import"./chunk-t2s3gdq6.js";
 import"./chunk-v0bahtg2.js";
 export {
   buildAndPushServerlessImage

package/dist/{chunk-ef2dwfrg.js → chunk-8kh577qh.js}

@@ -8,12 +8,12 @@ import {
   UnifiedDnsValidator,
   createDnsProvider
 } from "./chunk-gttvakpv.js";
-import {
-  CloudFormationClient
-} from "./chunk-4cjrg98a.js";
 import {
   Route53Client
 } from "./chunk-32e7ya18.js";
+import {
+  CloudFormationClient
+} from "./chunk-4cjrg98a.js";
 import {
   S3Client
 } from "./chunk-wj3s95p9.js";
@@ -815,7 +815,7 @@ async function deployStaticSiteWithExternalDnsFull(config) {
     }
   }
   onProgress?.("upload", "Uploading files to S3...");
-  const { uploadStaticFiles } = await import("./chunk-s9c2x5jv.js");
+  const { uploadStaticFiles } = await import("./chunk-9v2pwxv9.js");
   const uploadResult = await uploadStaticFiles({
     sourceDir,
     bucket: infraResult.bucket,
@@ -835,7 +835,7 @@ async function deployStaticSiteWithExternalDnsFull(config) {
   }
   if (infraResult.distributionId && uploadResult.uploaded > 0) {
     onProgress?.("invalidate", "Invalidating CloudFront cache...");
-    const { invalidateCache } = await import("./chunk-s9c2x5jv.js");
+    const { invalidateCache } = await import("./chunk-9v2pwxv9.js");
     await invalidateCache(infraResult.distributionId);
   }
   onProgress?.("complete", "Deployment complete!");

package/dist/{chunk-s9c2x5jv.js → chunk-9v2pwxv9.js}

@@ -5,11 +5,11 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "./chunk-ef2dwfrg.js";
+} from "./chunk-8kh577qh.js";
 import"./chunk-01d86gt1.js";
 import"./chunk-gttvakpv.js";
-import"./chunk-4cjrg98a.js";
 import"./chunk-32e7ya18.js";
+import"./chunk-4cjrg98a.js";
 import"./chunk-wj3s95p9.js";
 import"./chunk-zqtpg06c.js";
 import"./chunk-v0bahtg2.js";

package/dist/chunk-aa2dkn7b.js

@@ -0,0 +1,205 @@
+// src/protection/ddos.ts
+var DEFAULT_DDOS_THRESHOLDS = {
+  newConnectionsPerSecond: 50,
+  concurrentPerSource: 100,
+  synPerSecond: 2000,
+  burst: 100,
+  icmpPerSecond: 5,
+  banSeconds: 600
+};
+function resolveThresholds(config) {
+  return { ...DEFAULT_DDOS_THRESHOLDS, ...config.thresholds };
+}
+var CIDR_PATTERN = /^(?:\d{1,3}\.){3}\d{1,3}(?:\/\d{1,2})?$|^[0-9a-f:]+(?:\/\d{1,3})?$/i;
+function isValidCidr(value) {
+  if (!CIDR_PATTERN.test(value))
+    return false;
+  const [address, prefix] = value.split("/");
+  if (address.includes(":"))
+    return prefix == null || Number(prefix) >= 0 && Number(prefix) <= 128;
+  const octets = address.split(".");
+  if (octets.length !== 4 || octets.some((octet) => Number(octet) > 255 || octet === ""))
+    return false;
+  return prefix == null || Number(prefix) >= 0 && Number(prefix) <= 32;
+}
+function validCidrs(values) {
+  return [...new Set((values ?? []).map((value) => value.trim()).filter(isValidCidr))];
+}
+function validPorts(values) {
+  const ports = (values ?? [80, 443]).filter((port) => Number.isInteger(port) && port >= 1 && port <= 65535);
+  return [...new Set(ports)].sort((a, b) => a - b);
+}
+function sysctlHardening(config = {}) {
+  const thresholds = resolveThresholds(config);
+  return {
+    "net.ipv4.tcp_syncookies": "1",
+    "net.ipv4.tcp_max_syn_backlog": String(Math.max(4096, thresholds.synPerSecond * 4)),
+    "net.ipv4.tcp_synack_retries": "2",
+    "net.ipv4.tcp_abort_on_overflow": "1",
+    "net.ipv4.tcp_fin_timeout": "15",
+    "net.ipv4.tcp_keepalive_time": "300",
+    "net.ipv4.tcp_keepalive_intvl": "30",
+    "net.ipv4.tcp_keepalive_probes": "3",
+    "net.core.somaxconn": "4096",
+    "net.core.netdev_max_backlog": "16384",
+    "net.ipv4.conf.all.rp_filter": "1",
+    "net.ipv4.conf.default.rp_filter": "1",
+    "net.ipv4.conf.all.accept_source_route": "0",
+    "net.ipv4.conf.all.accept_redirects": "0",
+    "net.ipv4.conf.all.send_redirects": "0",
+    "net.ipv6.conf.all.accept_redirects": "0",
+    "net.ipv6.conf.all.accept_source_route": "0",
+    "net.ipv4.icmp_echo_ignore_broadcasts": "1",
+    "net.ipv4.icmp_ignore_bogus_error_responses": "1",
+    "net.netfilter.nf_conntrack_max": "262144",
+    "net.netfilter.nf_conntrack_tcp_timeout_established": "3600"
+  };
+}
+function renderSysctlFile(config = {}) {
+  const lines = [
+    "# Managed by ts-cloud. Edits are overwritten on the next deploy.",
+    "# Network hardening against L3/L4 floods.",
+    ""
+  ];
+  for (const [key, value] of Object.entries(sysctlHardening(config)))
+    lines.push(`${key} = ${value}`);
+  return `${lines.join(`
+`)}
+`;
+}
+function renderNftablesRuleset(config = {}) {
+  const thresholds = resolveThresholds(config);
+  const ports = validPorts(config.ports);
+  const allowlist = validCidrs(config.allowlist);
+  const blocklist = validCidrs(config.blocklist);
+  const verdict = config.monitorOnly ? "counter" : "counter drop";
+  const cdnRanges = config.originProtection?.enabled ? validCidrs(config.originProtection.cdnRanges) : [];
+  const ipv4Allow = allowlist.filter((cidr) => !cidr.includes(":"));
+  const ipv6Allow = allowlist.filter((cidr) => cidr.includes(":"));
+  const ipv4Block = blocklist.filter((cidr) => !cidr.includes(":"));
+  const lines = [
+    "#!/usr/sbin/nft -f",
+    "# Managed by ts-cloud. Edits are overwritten on the next deploy.",
+    "",
+    "table inet ts_cloud_ddos",
+    "delete table inet ts_cloud_ddos",
+    "",
+    "table inet ts_cloud_ddos {",
+    "  # Sources that tripped a limit, with a timeout so a ban self-expires.",
+    `  set banned4 { type ipv4_addr; flags timeout; timeout ${thresholds.banSeconds}s; }`,
+    `  set banned6 { type ipv6_addr; flags timeout; timeout ${thresholds.banSeconds}s; }`
+  ];
+  if (ipv4Allow.length > 0)
+    lines.push(`  set allow4 { type ipv4_addr; flags interval; elements = { ${ipv4Allow.join(", ")} } }`);
+  if (ipv6Allow.length > 0)
+    lines.push(`  set allow6 { type ipv6_addr; flags interval; elements = { ${ipv6Allow.join(", ")} } }`);
+  if (ipv4Block.length > 0)
+    lines.push(`  set block4 { type ipv4_addr; flags interval; elements = { ${ipv4Block.join(", ")} } }`);
+  if (cdnRanges.length > 0)
+    lines.push(`  set cdn4 { type ipv4_addr; flags interval; elements = { ${cdnRanges.filter((cidr) => !cidr.includes(":")).join(", ")} } }`);
+  lines.push("", "  chain input {", "    type filter hook input priority -150; policy accept;", "", "    # Established traffic is already paid for; never re-inspect it.", "    ct state established,related accept", "    iif lo accept", "", "    # Invalid packets are never legitimate and are cheap to drop early.", "    ct state invalid counter drop");
+  if (ipv4Allow.length > 0)
+    lines.push("    ip saddr @allow4 accept");
+  if (ipv6Allow.length > 0)
+    lines.push("    ip6 saddr @allow6 accept");
+  if (ipv4Block.length > 0)
+    lines.push("    ip saddr @block4 counter drop");
+  lines.push("    ip saddr @banned4 counter drop", "    ip6 saddr @banned6 counter drop", "");
+  lines.push("    # Nonsense TCP flag combinations: scanners and stack fingerprinting.", "    tcp flags & (fin|syn) == (fin|syn) counter drop", "    tcp flags & (syn|rst) == (syn|rst) counter drop", "    tcp flags & (fin|rst) == (fin|rst) counter drop", "    tcp flags & (fin|ack) == fin counter drop", "    tcp flags & (syn|fin|ack|rst|psh|urg) == 0x0 counter drop", "", `    # Ping stays usable, ping floods do not.`, `    ip protocol icmp icmp type echo-request limit rate ${thresholds.icmpPerSecond}/second burst ${thresholds.burst} packets accept`, "    ip protocol icmp icmp type echo-request counter drop", "");
+  if (ports.length > 0) {
+    const portSet = ports.join(", ");
+    lines.push(`    # Platform-wide SYN ceiling. Above it the kernel falls back to cookies.`, `    tcp dport { ${portSet} } ct state new limit rate ${thresholds.synPerSecond}/second burst ${thresholds.burst} packets accept`, "", `    # Per-source new-connection rate. This is what stops one host hammering.`, `    tcp dport { ${portSet} } ct state new meter conn_rate4 { ip saddr limit rate over ${thresholds.newConnectionsPerSecond}/second burst ${thresholds.burst} packets } add @banned4 { ip saddr } ${verdict}`, `    tcp dport { ${portSet} } ct state new meter conn_rate6 { ip6 saddr limit rate over ${thresholds.newConnectionsPerSecond}/second burst ${thresholds.burst} packets } add @banned6 { ip6 saddr } ${verdict}`, "", `    # Concurrency ceiling per source: the slow-loris defence.`, `    tcp dport { ${portSet} } ct state new meter conn_count4 { ip saddr ct count over ${thresholds.concurrentPerSource} } ${verdict}`, `    tcp dport { ${portSet} } ct state new meter conn_count6 { ip6 saddr ct count over ${thresholds.concurrentPerSource} } ${verdict}`, "");
+    if (cdnRanges.length > 0)
+      lines.push("    # Origin protection: reject traffic that skipped the CDN and came", "    # straight to the box, which is how an attacker bypasses the edge.", `    tcp dport { ${portSet} } ip saddr != @cdn4 counter drop`, "");
+  }
+  lines.push("  }", "}", "");
+  return lines.join(`
+`);
+}
+function renderDdosInstallScript(config = {}) {
+  return `#!/usr/bin/env bash
+# Managed by ts-cloud. Installs L3/L4 flood mitigation.
+set -euo pipefail
+
+if ! command -v nft >/dev/null 2>&1; then
+  export DEBIAN_FRONTEND=noninteractive
+  apt-get update -qq
+  apt-get install -y -qq nftables
+fi
+
+install -d -m 0755 /etc/ts-cloud /etc/nftables.d
+cat > /etc/sysctl.d/90-ts-cloud-ddos.conf <<'SYSCTL_EOF'
+${renderSysctlFile(config)}SYSCTL_EOF
+sysctl --system >/dev/null
+
+cat > /etc/nftables.d/ts-cloud-ddos.nft.new <<'NFT_EOF'
+${renderNftablesRuleset(config)}NFT_EOF
+
+# Syntax-check before applying: a bad ruleset would leave the box unprotected.
+if ! nft -c -f /etc/nftables.d/ts-cloud-ddos.nft.new; then
+  echo "ts-cloud: generated nftables ruleset failed validation, keeping the previous one" >&2
+  rm -f /etc/nftables.d/ts-cloud-ddos.nft.new
+  exit 1
+fi
+
+mv /etc/nftables.d/ts-cloud-ddos.nft.new /etc/nftables.d/ts-cloud-ddos.nft
+nft -f /etc/nftables.d/ts-cloud-ddos.nft
+
+# Applying the ruleset does not survive a reboot on its own: nftables.service
+# loads /etc/nftables.conf, so the file has to be included from there or the box
+# comes back up unprotected and nothing says so.
+touch /etc/nftables.conf
+if ! grep -q 'ts-cloud-ddos.nft' /etc/nftables.conf; then
+  printf '
+include "/etc/nftables.d/ts-cloud-ddos.nft"
+' >> /etc/nftables.conf
+fi
+systemctl enable nftables >/dev/null 2>&1 || true
+echo "ts-cloud: L3/L4 mitigation active"
+`;
+}
+var LEVEL_ORDER = ["off", "monitor", "rate_limit", "challenge", "lockdown"];
+function planMitigation(signals, topSources = []) {
+  const reasons = [];
+  const baseline = Math.max(1, signals.baselineRequestsPerSecond);
+  const ratio = signals.requestsPerSecond / baseline;
+  let levelIndex = 0;
+  const escalate = (next, reason) => {
+    reasons.push(reason);
+    levelIndex = Math.max(levelIndex, LEVEL_ORDER.indexOf(next));
+  };
+  const surging = ratio >= 3;
+  if (surging)
+    escalate("monitor", `Traffic is ${ratio.toFixed(1)}x the baseline.`);
+  const concentrated = signals.topSourceShare >= 0.25;
+  const failing = signals.errorRate >= 0.25;
+  const scripted = (signals.suspiciousAgentShare ?? 0) >= 0.5;
+  const thinlySpread = signals.uniqueSources > 0 && signals.requestsPerSecond / signals.uniqueSources >= 50;
+  if (surging && concentrated)
+    escalate("rate_limit", `One source accounts for ${(signals.topSourceShare * 100).toFixed(0)}% of traffic.`);
+  if (surging && thinlySpread)
+    escalate("rate_limit", "Request rate per unique source is far above what a browser produces.");
+  if (surging && failing)
+    escalate("challenge", `Error rate is ${(signals.errorRate * 100).toFixed(0)}% under load.`);
+  if (surging && scripted)
+    escalate("challenge", "Most requests carry no recognisable browser agent.");
+  if (ratio >= 20 && (concentrated || failing || scripted || thinlySpread))
+    escalate("lockdown", `Traffic is ${ratio.toFixed(0)}x the baseline with attack-shaped characteristics.`);
+  if (!surging && signals.topSourceShare >= 0.6 && signals.requestsPerSecond > baseline)
+    escalate("rate_limit", "A single source dominates traffic without an overall surge.");
+  const level = LEVEL_ORDER[levelIndex];
+  const factor = { off: 1, monitor: 1, rate_limit: 0.5, challenge: 0.25, lockdown: 0.1 }[level];
+  return {
+    level,
+    reasons,
+    rateLimitFactor: factor,
+    challengeEnabled: level === "challenge" || level === "lockdown",
+    staticOnly: level === "lockdown",
+    banCandidates: level === "off" || level === "monitor" ? [] : validCidrs(topSources)
+  };
+}
+function applyMitigationFactor(limit, plan) {
+  return Math.max(1, Math.floor(limit * plan.rateLimitFactor));
+}
+
+export { DEFAULT_DDOS_THRESHOLDS, isValidCidr, sysctlHardening, renderSysctlFile, renderNftablesRuleset, renderDdosInstallScript, planMitigation, applyMitigationFactor };

package/dist/{chunk-33sy72r8.js → chunk-d3vx2ekv.js}

@@ -1,14 +1,3 @@
-import {
-  deploymentCoexistenceError,
-  hasManagementDashboardSite,
-  isManagementDashboardSiteName,
-  resolveAppDatabase,
-  resolveCloudProvider,
-  resolveManagementDashboardSites,
-  resolveProjectStackName,
-  resolveStatePath,
-  statePath
-} from "./chunk-c6db5m63.js";
 import {
   EC2Client,
   SSMClient
@@ -19,6 +8,23 @@ import {
 import {
   S3Client
 } from "./chunk-wj3s95p9.js";
+import {
+  renderWafInstallScript
+} from "./chunk-va2yd85b.js";
+import {
+  renderDdosInstallScript
+} from "./chunk-aa2dkn7b.js";
+import {
+  deploymentCoexistenceError,
+  hasManagementDashboardSite,
+  isManagementDashboardSiteName,
+  resolveAppDatabase,
+  resolveCloudProvider,
+  resolveManagementDashboardSites,
+  resolveProjectStackName,
+  resolveStatePath,
+  statePath
+} from "./chunk-t2s3gdq6.js";
 import {
   __require
 } from "./chunk-v0bahtg2.js";
@@ -1926,6 +1932,45 @@ function escapeSed(value) {
   return value.replace(/[.*[\]\\/^$]/g, "\\$&");
 }
 
+// src/drivers/shared/protection.ts
+function runAsScript(name, script) {
+  const path = `/tmp/ts-cloud-${name}.sh`;
+  const marker = `TS_CLOUD_${name.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_EOF`;
+  return [
+    `cat > ${path} <<'${marker}'`,
+    script.replace(/\n$/, ""),
+    marker,
+    `chmod +x ${path}`,
+    `bash ${path} || echo "ts-cloud: ${name} setup did not complete; continuing" >&2`,
+    `rm -f ${path}`
+  ];
+}
+function resolve(setting, fallback) {
+  if (setting === false)
+    return;
+  if (setting === true || setting === undefined)
+    return fallback;
+  return setting;
+}
+var DEFAULT_COMPUTE_DDOS = { enabled: true, ports: [80, 443] };
+var DEFAULT_COMPUTE_WAF = { mode: "detection", paranoiaLevel: 1 };
+function buildDdosScript(setting = true, extraPorts = []) {
+  const config = resolve(setting, DEFAULT_COMPUTE_DDOS);
+  if (!config || config.enabled === false)
+    return [];
+  const ports = [...new Set([...config.ports ?? DEFAULT_COMPUTE_DDOS.ports ?? [], ...extraPorts])].sort((a, b) => a - b);
+  return runAsScript("ddos", renderDdosInstallScript({ ...config, ports }));
+}
+function buildWafScript(setting = true) {
+  const config = resolve(setting, DEFAULT_COMPUTE_WAF);
+  if (!config || config.mode === "off")
+    return [];
+  return runAsScript("waf", renderWafInstallScript(config));
+}
+function buildProtectionScript(protection = {}, extraPorts = []) {
+  return [...buildDdosScript(protection.ddos, extraPorts), ...buildWafScript(protection.waf)];
+}
+
 // src/drivers/shared/ufw.ts
 var UFW_BASE_PORTS = [80, 443];
 function buildUfwScript(firewall = {}) {
@@ -1974,6 +2019,7 @@ function buildComputeProvisionScripts(config) {
     extras.push(...buildServicesProvisionScript(compute.managedServices), ...buildDatabaseSetupScript(appDatabase, compute.managedServices));
   }
   extras.push(...buildUfwScript(compute.firewall ?? (phpBox ? { enabled: true } : { enabled: false })));
+  extras.push(...buildProtectionScript({ ddos: compute.ddos, waf: compute.waf }, compute.firewall?.allowedPorts ?? []));
   extras.push(...buildAutoUpdatesScript(compute.autoUpdates ?? phpBox));
   extras.push(...buildMonitoringScript(compute.monitoring ?? phpBox));
   extras.push(...buildAuthorizedKeysScript(compute.sshKeys));
@@ -2507,7 +2553,7 @@ class AwsDriver {
     const terminalStatuses = new Set(["Success", "Failed", "Cancelled", "TimedOut"]);
     let lastInvocations = [];
     while (Date.now() - startTime < maxWait) {
-      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+      await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
       try {
         const invocations = await ssm.listCommandInvocations({ CommandId: commandId, Details: true });
         lastInvocations = invocations;
@@ -2886,7 +2932,7 @@ class HetznerClient {
     while (Date.now() - start < grace) {
       if ((await this.getServer(serverId)).status === "off")
         return;
-      await new Promise((resolve) => setTimeout(resolve, poll));
+      await new Promise((resolve2) => setTimeout(resolve2, poll));
     }
     const action = await this.powerOffServer(serverId);
     await this.waitForAction(action.id);
@@ -2941,7 +2987,7 @@ class HetznerClient {
       if (action.status === "error") {
         throw new HetznerActionError(action.error?.message || "Hetzner action failed", action);
       }
-      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+      await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
     }
     throw new Error(`Timed out waiting for Hetzner action ${actionId}`);
   }
@@ -2953,7 +2999,7 @@ class HetznerClient {
       const server = await this.getServer(serverId);
       if (server.status === "running")
         return server;
-      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+      await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
     }
     throw new Error(`Timed out waiting for server ${serverId} to reach running state`);
   }
@@ -2965,7 +3011,7 @@ class HetznerClient {
       const server = await this.getServer(serverId);
       if (server.status === status)
         return server;
-      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+      await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
     }
     throw new Error(`Timed out waiting for server ${serverId} to reach ${status} state`);
   }
@@ -3913,7 +3959,7 @@ class HetznerDriver {
     return [...ports].filter((port) => ![80, 443].includes(port));
   }
   async sleep(ms) {
-    await new Promise((resolve) => setTimeout(resolve, ms));
+    await new Promise((resolve2) => setTimeout(resolve2, ms));
   }
   async waitForSshReady(host) {
     const { sshIntervalMs, sshTimeoutMs } = this.bootWait;
@@ -4324,7 +4370,7 @@ async function waitForSsh(host, options = {}) {
     const r = await sshExec(host, "echo ready", options);
     if (r.code === 0 && r.stdout.includes("ready"))
       return;
-    await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+    await new Promise((resolve2) => setTimeout(resolve2, pollIntervalMs));
   }
   throw new Error(`SSH not ready on ${host} after ${timeoutMs}ms`);
 }
@@ -4338,7 +4384,7 @@ async function waitForCloudInit(host, options = {}) {
       return;
     if (r.stdout.includes("status: error"))
       throw new Error(`cloud-init reported an error on ${host}; check /var/log/cloud-init-output.log`);
-    await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+    await new Promise((resolve2) => setTimeout(resolve2, pollIntervalMs));
   }
   throw new Error(`cloud-init did not finish on ${host} after ${timeoutMs}ms`);
 }
@@ -4934,7 +4980,7 @@ class HetznerBoxProvisioner {
         } catch {
           if (i === 9)
             break;
-          await new Promise((resolve) => setTimeout(resolve, 3000));
+          await new Promise((resolve2) => setTimeout(resolve2, 3000));
         }
       }
     }
@@ -4974,7 +5020,7 @@ class AwsBoxProvisioner {
       const instance = await this.ec2.getInstance(instanceId);
       if (instance?.State?.Name === "running" && instance.PublicIpAddress)
         return instance;
-      await new Promise((resolve) => setTimeout(resolve, 5000));
+      await new Promise((resolve2) => setTimeout(resolve2, 5000));
     }
     throw new Error(`EC2 instance ${instanceId} did not reach running with a public IP within ${timeoutMs}ms`);
   }
@@ -5050,7 +5096,7 @@ class AwsBoxProvisioner {
         const current = await this.ec2.getInstance(instance.InstanceId);
         if (!current || current.State?.Name === "terminated")
           break;
-        await new Promise((resolve) => setTimeout(resolve, 5000));
+        await new Promise((resolve2) => setTimeout(resolve2, 5000));
       }
     }
     const groups = await this.ec2.describeSecurityGroups({
@@ -5066,7 +5112,7 @@ class AwsBoxProvisioner {
         } catch {
           if (i === 9)
             break;
-          await new Promise((resolve) => setTimeout(resolve, 3000));
+          await new Promise((resolve2) => setTimeout(resolve2, 3000));
         }
       }
     }
@@ -5501,7 +5547,7 @@ import { execSync as execSync2 } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { chmodSync, copyFileSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync3, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { basename, dirname, isAbsolute, join as join5, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join as join5, resolve as resolve2 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // src/deploy/dashboard-config-module.ts
@@ -5621,7 +5667,7 @@ function stageLiveDashboardRoot(config, cwd, logger) {
     let dependency = resolveDashboardVersion();
     if (dependency.startsWith("file:")) {
       const requested = dependency.slice("file:".length);
-      const source = isAbsolute(requested) ? requested : resolve(cwd, requested);
+      const source = isAbsolute(requested) ? requested : resolve2(cwd, requested);
       if (!existsSync2(source) || !statSync(source).isFile()) {
         dependency = resolvePackagedDashboardVersion();
         logger.warn(`Management dashboard: TS_CLOUD_UI_VERSION points to a missing package file (${source}); using the deploying ts-cloud version ${dependency} instead.`);