@stacksjs/ts-cloud 0.7.30 → 0.7.31

package/dist/{chunk-xdd6qvre.js → chunk-0c69nbaa.js}

@@ -2,10 +2,11 @@ import {
   deploymentCoexistenceError,
   hasManagementDashboardSite,
   isManagementDashboardSiteName,
+  resolveAppDatabase,
   resolveCloudProvider,
   resolveManagementDashboardSites,
   resolveProjectStackName
-} from "./chunk-k56wpkhg.js";
+} from "./chunk-stt1z5cx.js";
 import {
   EC2Client,
   SSMClient
@@ -145,7 +146,7 @@ function buildDatabaseSetupScript(database, services = {}) {
       const lines = [];
       for (const db of dbs) {
         if (u.access === "readonly") {
-          lines.push(`GRANT CONNECT ON DATABASE ${pgIdent(db)} TO ${pgIdent(u.username)};`, `\\connect ${pgIdent(db)}`, `GRANT USAGE ON SCHEMA public TO ${pgIdent(u.username)};`, `GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${pgIdent(u.username)};`, `ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO ${pgIdent(u.username)};`, "\\connect postgres");
+          lines.push(`GRANT CONNECT ON DATABASE ${pgIdent(db)} TO ${pgIdent(u.username)};`, `\\connect ${pgIdent(db)}`, `GRANT USAGE ON SCHEMA public TO ${pgIdent(u.username)};`, `GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${pgIdent(u.username)};`, `ALTER DEFAULT PRIVILEGES FOR ROLE ${pgIdent(user)} IN SCHEMA public GRANT SELECT ON TABLES TO ${pgIdent(u.username)};`, "\\connect postgres");
         } else {
           lines.push(`GRANT ALL PRIVILEGES ON DATABASE ${pgIdent(db)} TO ${pgIdent(u.username)};`);
         }
@@ -810,7 +811,9 @@ import { startProxies } from '@stacksjs/rpx'
 
 const config = ${json} as const
 
-await startProxies(config as any)
+// Verbose is the hard default for ts-cloud-installed gateways (RPX_VERBOSE=false
+// opts out) — without it rpx's TLS/routing diagnostics never reach the journal.
+await startProxies({ verbose: process.env.RPX_VERBOSE !== 'false', ...config } as any)
 `;
 }
 function usesRpxProxy(compute) {
@@ -869,6 +872,12 @@ const config = {
   https: true,
   hostsManagement: false,
   cleanup: { hosts: false, certs: false },
+  // Verbose is the hard default for ts-cloud-installed gateways: without it,
+  // rpx's TLS/routing diagnostics (tlsx on-demand 'refused issuance',
+  // 'issuance failed', 'adopted existing on-disk cert') never reach the systemd
+  // journal and a production TLS failure looks like "nothing happens". Silence
+  // it by setting RPX_VERBOSE=false on the systemd unit.
+  verbose: process.env.RPX_VERBOSE !== 'false',
   ...(suffixes.size > 0 ? { onDemandTls: { enabled: true, allowedSuffixes: [...suffixes], email, certsDir } } : {}),
   ...(acmeChallengeWebroot ? { acmeChallengeWebroot } : {}),
   ...(guard ? { originGuard: { header: guard.header, value: guard.value, hosts: [...guardHosts] } } : {}),
@@ -877,14 +886,14 @@ const config = {
 await startProxies(config)
 `;
 }
-function writeFileHeredoc(path, content, delimiter) {
+function writeFileHeredoc(path, content, delimiter, mode = "0644") {
   return [
     `__tsc_tmp="$(mktemp "${path}.XXXXXX")"`,
     `cat > "$__tsc_tmp" <<'${delimiter}'`,
     content,
     delimiter,
     `mv -f "$__tsc_tmp" ${path}`,
-    `chmod 0644 ${path}`
+    `chmod ${mode} ${path}`
   ];
 }
 function certDomainsForConfig(config) {
@@ -986,10 +995,14 @@ function buildRpxProvisionScript(options) {
   return [
     "set -euo pipefail",
     `mkdir -p ${RPX_DIR} ${RPX_SITES_DIR} ${certsDir} ${RPX_INSTALL_DIR}`,
-    `rm -rf ${RPX_INSTALL_DIR}/node_modules ${RPX_INSTALL_DIR}/bun.lock ${RPX_INSTALL_DIR}/package.json`,
-    `(cd ${RPX_INSTALL_DIR} && ${bunBin} add @stacksjs/rpx@${version})`,
+    `rm -rf ${RPX_INSTALL_DIR}.next ${RPX_INSTALL_DIR}.prev`,
+    `mkdir -p ${RPX_INSTALL_DIR}.next`,
+    `(cd ${RPX_INSTALL_DIR}.next && ${bunBin} add @stacksjs/rpx@${version})`,
+    `mv ${RPX_INSTALL_DIR} ${RPX_INSTALL_DIR}.prev`,
+    `mv ${RPX_INSTALL_DIR}.next ${RPX_INSTALL_DIR}`,
+    `rm -rf ${RPX_INSTALL_DIR}.prev`,
     `ln -sfn ${RPX_INSTALL_DIR}/node_modules ${RPX_DIR}/node_modules`,
-    ...writeFileHeredoc(`${RPX_SITES_DIR}/${slug}.json`, fragment, "TS_CLOUD_RPX_FRAGMENT_EOF"),
+    ...writeFileHeredoc(`${RPX_SITES_DIR}/${slug}.json`, fragment, "TS_CLOUD_RPX_FRAGMENT_EOF", "0600"),
     ...writeFileHeredoc(RPX_LAUNCHER_PATH, assembler, "TS_CLOUD_RPX_EOF"),
     ...writeFileHeredoc(`/etc/systemd/system/${RPX_SERVICE_NAME}`, [
       "[Unit]",
@@ -1020,13 +1033,23 @@ function buildRpxProvisionScript(options) {
     ...buildCertManagementCommands(options)
   ];
 }
+function buildRpxFragmentRefreshScript(options) {
+  const slug = (options.slug || "app").replace(/[^a-z0-9._-]+/gi, "-");
+  const fragment = JSON.stringify({ slug, ...options.config }, null, 2);
+  return [
+    "set -euo pipefail",
+    `mkdir -p ${RPX_SITES_DIR}`,
+    ...writeFileHeredoc(`${RPX_SITES_DIR}/${slug}.json`, fragment, "TS_CLOUD_RPX_FRAGMENT_EOF", "0600"),
+    `systemctl restart ${RPX_SERVICE_NAME}`
+  ];
+}
 
 // src/drivers/shared/ufw.ts
 var UFW_BASE_PORTS = [80, 443];
 function buildUfwScript(firewall = {}) {
   if (firewall.enabled === false)
     return [];
-  const ports = [...new Set([...UFW_BASE_PORTS, ...firewall.allowedPorts || []])].filter((p) => p > 0).sort((a, b) => a - b);
+  const ports = [...new Set([...UFW_BASE_PORTS, ...firewall.allowedPorts || []])].filter((p) => Number.isInteger(p) && p >= 1 && p <= 65535).sort((a, b) => a - b);
   const lines = [
     "export DEBIAN_FRONTEND=noninteractive",
     "apt-get install -y ufw",
@@ -1157,25 +1180,23 @@ var BLOCK_BEGIN = "# >>> ts-cloud managed keys >>>";
 var BLOCK_END = "# <<< ts-cloud managed keys <<<";
 var DEFAULT_AUTHORIZED_KEYS = "/root/.ssh/authorized_keys";
 function buildAuthorizedKeysScript(keys = [], options = {}) {
-  if (keys.length === 0)
-    return [];
   const path = options.path ?? DEFAULT_AUTHORIZED_KEYS;
   const dir = path.replace(/\/[^/]*$/, "");
-  const block = [
-    BLOCK_BEGIN,
-    ...keys.map((k) => `${k.publicKey.trim()} ${k.name}`),
-    BLOCK_END
-  ].join(`
-`);
-  return [
+  const lines = [
     `mkdir -p ${dir}`,
     `touch ${path}`,
-    `sed -i '/^${escapeSed(BLOCK_BEGIN)}$/,/^${escapeSed(BLOCK_END)}$/d' ${path}`,
-    `cat >> ${path} <<'TS_CLOUD_KEYS_EOF'`,
-    block,
-    "TS_CLOUD_KEYS_EOF",
-    `chmod 600 ${path}`
+    `sed -i '/^${escapeSed(BLOCK_BEGIN)}$/,/^${escapeSed(BLOCK_END)}$/d' ${path}`
   ];
+  if (keys.length > 0) {
+    const block = [
+      BLOCK_BEGIN,
+      ...keys.map((k) => `${k.publicKey.trim()} ${k.name}`),
+      BLOCK_END
+    ].join(`
+`);
+    lines.push(`cat >> ${path} <<'TS_CLOUD_KEYS_EOF'`, block, "TS_CLOUD_KEYS_EOF", `chmod 600 ${path}`);
+  }
+  return lines;
 }
 function escapeSed(value) {
   return value.replace(/[.*[\]\\/^$]/g, "\\$&");
@@ -1399,11 +1420,12 @@ function buildComputeProvisionScripts(config) {
     ...useNginx ? buildNginxServiceScript() : []
   ] : undefined;
   const extras = [];
+  const appDatabase = resolveAppDatabase(config);
   if (!phpBox && needsPantry)
     extras.push(...pantryBootstrap);
   extras.push(...buildNotifierScript(config.notifications));
   if (compute.managedServices) {
-    extras.push(...buildServicesProvisionScript(compute.managedServices), ...buildDatabaseSetupScript(config.infrastructure?.appDatabase, compute.managedServices));
+    extras.push(...buildServicesProvisionScript(compute.managedServices), ...buildDatabaseSetupScript(appDatabase, compute.managedServices));
   }
   extras.push(...buildUfwScript(compute.firewall ?? (phpBox ? { enabled: true } : { enabled: false })));
   extras.push(...buildAutoUpdatesScript(compute.autoUpdates ?? phpBox));
@@ -1411,7 +1433,7 @@ function buildComputeProvisionScripts(config) {
   extras.push(...buildAuthorizedKeysScript(compute.sshKeys));
   if (compute.backups?.enabled) {
     extras.push(...buildBackupProvisionScript({
-      database: config.infrastructure?.appDatabase,
+      database: appDatabase,
       backups: compute.backups
     }));
   }
@@ -1514,7 +1536,6 @@ ln -sf /root/.deno/bin/deno /usr/local/bin/deno
 mkdir -p /var/www /var/ts-cloud/staging /var/ts-cloud/releases
 `;
   if (caddyfile) {
-    const escaped = caddyfile.replace(/\$/g, "\\$");
     script += `
 ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
 curl -fsSL "https://caddyserver.com/api/download?os=linux&arch=\${ARCH}" -o /usr/local/bin/caddy
@@ -1552,7 +1573,7 @@ WantedBy=multi-user.target
 CADDY_UNIT_EOF
 
 cat > /etc/caddy/Caddyfile <<'CADDY_CONFIG_EOF'
-${escaped}
+${caddyfile}
 CADDY_CONFIG_EOF
 
 systemctl daemon-reload
@@ -1858,7 +1879,7 @@ class AwsDriver {
       if (!sendResult.CommandId) {
         return { success: false, instanceCount: 0, perInstance: [], error: "Failed to send SSM command" };
       }
-      return this.pollSsmCommand(ssm, sendResult.CommandId, options.targets.length);
+      return this.pollSsmCommand(ssm, sendResult.CommandId, options.targets.length, ((options.timeoutSeconds || 600) + 30) * 1000);
     }
     if (!options.tags || Object.keys(options.tags).length === 0) {
       return { success: false, instanceCount: 0, perInstance: [], error: "No targets or tags provided for AWS deploy" };
@@ -1881,9 +1902,8 @@ class AwsDriver {
       error: result.error
     };
   }
-  async pollSsmCommand(ssm, commandId, expectedCount) {
+  async pollSsmCommand(ssm, commandId, expectedCount, maxWait = 600000) {
     const pollInterval = 3000;
-    const maxWait = 600000;
     const startTime = Date.now();
     const terminalStatuses = new Set(["Success", "Failed", "Cancelled", "TimedOut"]);
     let lastInvocations = [];
@@ -2019,9 +2039,21 @@ class HetznerClient {
     }
     return data;
   }
+  async requestAll(path, key) {
+    const items = [];
+    let page = 1;
+    for (;; ) {
+      const sep = path.includes("?") ? "&" : "?";
+      const data = await this.request("GET", `${path}${sep}per_page=50&page=${page}`);
+      items.push(...data[key] ?? []);
+      const next = data.meta?.pagination?.next_page;
+      if (!next)
+        return items;
+      page = next;
+    }
+  }
   async listServers() {
-    const data = await this.request("GET", "/servers");
-    return data.servers;
+    return this.requestAll("/servers", "servers");
   }
   async getServer(id) {
     const data = await this.request("GET", `/servers/${id}`);
@@ -2044,8 +2076,7 @@ class HetznerClient {
     return { server: data.server, action: data.action };
   }
   async listNetworks() {
-    const data = await this.request("GET", "/networks");
-    return data.networks;
+    return this.requestAll("/networks", "networks");
   }
   async createNetwork(options) {
     const ipRange = options.ipRange ?? "10.0.0.0/16";
@@ -2061,8 +2092,7 @@ class HetznerClient {
     await this.request("DELETE", `/networks/${id}`);
   }
   async listLoadBalancers() {
-    const data = await this.request("GET", "/load_balancers");
-    return data.load_balancers;
+    return this.requestAll("/load_balancers", "load_balancers");
   }
   async createLoadBalancer(options) {
     const data = await this.request("POST", "/load_balancers", {
@@ -2097,8 +2127,7 @@ class HetznerClient {
     return data.action;
   }
   async listFirewalls() {
-    const data = await this.request("GET", "/firewalls");
-    return data.firewalls;
+    return this.requestAll("/firewalls", "firewalls");
   }
   async createFirewall(options) {
     const data = await this.request("POST", "/firewalls", {
@@ -2125,8 +2154,7 @@ class HetznerClient {
     return data.actions;
   }
   async listSshKeys() {
-    const data = await this.request("GET", "/ssh_keys");
-    return data.ssh_keys;
+    return this.requestAll("/ssh_keys", "ssh_keys");
   }
   async createSshKey(options) {
     const data = await this.request("POST", "/ssh_keys", {
@@ -2223,6 +2251,19 @@ function buildFleetServicesEnv(servicesPrivateIp, database) {
   }
   return env2;
 }
+function buildFleetServicesBoxProvision(config) {
+  const compute = config.infrastructure?.compute ?? {};
+  const appDatabase = resolveAppDatabase(config);
+  return [
+    ...buildServicesProvisionScript(compute.managedServices ?? { mysql: true, redis: true }, { bindPrivate: true }),
+    ...buildDatabaseSetupScript(appDatabase, compute.managedServices ?? { mysql: true }),
+    ...buildAutoUpdatesScript(true),
+    ...buildMonitoringScript(true),
+    ...buildAuthorizedKeysScript(compute.sshKeys),
+    ...buildNotifierScript(config.notifications),
+    ...compute.backups?.enabled ? [...buildBackupProvisionScript({ database: appDatabase, backups: compute.backups })] : []
+  ];
+}
 
 // src/drivers/hetzner/firewall-rules.ts
 function buildHetznerFirewallRules(config) {
@@ -2274,7 +2315,7 @@ function matchesTsCloudLabels(labels, slug, environment, role = "app") {
 }
 
 // src/drivers/hetzner/state.ts
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { join as join3 } from "node:path";
 var STATE_DIR = "storage/cloud/state";
 function driverStatePath(stackName) {
@@ -2291,8 +2332,10 @@ async function readDriverState(stackName) {
 async function writeDriverState(stackName, state) {
   const path = driverStatePath(stackName);
   await mkdir(join3(process.cwd(), STATE_DIR), { recursive: true });
-  await writeFile(path, `${JSON.stringify(state, null, 2)}
+  const tmp = `${path}.${process.pid}.tmp`;
+  await writeFile(tmp, `${JSON.stringify(state, null, 2)}
 `, "utf8");
+  await rename(tmp, path);
 }
 
 // src/drivers/hetzner/driver.ts
@@ -2300,7 +2343,7 @@ var SSH_MAX_BUFFER = 1024 * 1024 * 256;
 var SSH_ERROR_OUTPUT_LIMIT = 8000;
 function sshErrorOutput(value) {
   const output = Buffer.isBuffer(value) ? value.toString("utf8") : typeof value === "string" ? value : "";
-  return output.replace(/(^|\n)([A-Z][A-Z0-9_]*=).*$/gm, "$1$2[redacted]").replace(/encrypted:[A-Za-z0-9+/=]+/g, "encrypted:[redacted]").trim().slice(-SSH_ERROR_OUTPUT_LIMIT);
+  return output.replace(/(^|\n)(\s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_]*=).*$/gm, "$1$2[redacted]").replace(/encrypted:[A-Za-z0-9+/=]+/g, "encrypted:[redacted]").trim().slice(-SSH_ERROR_OUTPUT_LIMIT);
 }
 function formatSshFailure(error) {
   const childError = error;
@@ -2358,6 +2401,15 @@ class HetznerDriver {
     if (topology.dedicatedServices || topology.appServers > 1) {
       return phpBox ? this.provisionFleet(options, topology) : this.provisionBunFleet(options, topology);
     }
+    const labels = tsCloudLabels(slug, environment, "app");
+    const sites = config.sites || {};
+    const sitePorts = this.collectUpstreamPorts(sites);
+    const firewallName = `${slug}-${environment}-app-fw`;
+    const { firewall } = await this.ensureFirewall(firewallName, labels, buildHetznerFirewallRules({
+      allowSsh: compute.allowSsh !== false,
+      sitePorts
+    }));
+    const sshKeyId = await this.ensureSshKey(slug, environment, labels);
     const existing = await readDriverState(stackName);
     if (existing?.serverId) {
       const server2 = await this.tryGetServer(existing.serverId);
@@ -2365,7 +2417,6 @@ class HetznerDriver {
         return this.outputsFromState(existing, server2);
       }
     }
-    const labels = tsCloudLabels(slug, environment, "app");
     const alreadyRunning = await this.findExistingServer(slug, environment, serverName);
     if (alreadyRunning && alreadyRunning.status !== "off") {
       const rehydrated = {
@@ -2380,8 +2431,6 @@ class HetznerDriver {
       await writeDriverState(stackName, rehydrated);
       return this.outputsFromState(rehydrated, alreadyRunning);
     }
-    const sites = config.sites || {};
-    const sitePorts = this.collectUpstreamPorts(sites);
     const rpxProvision = compute.proxy?.engine === "rpx" ? buildRpxProvisionScript({
       proxy: compute.proxy,
       config: buildRpxConfig(sites, { proxy: compute.proxy, slug: config.project.slug }),
@@ -2403,12 +2452,6 @@ class HetznerDriver {
     const userData = wrapCloudInitUserData(bootstrap);
     const serverType = resolveHetznerServerType(compute.size);
     const image = resolveHetznerImage(config);
-    const firewallName = `${slug}-${environment}-app-fw`;
-    const { firewall } = await this.ensureFirewall(firewallName, labels, buildHetznerFirewallRules({
-      allowSsh: compute.allowSsh !== false,
-      sitePorts
-    }));
-    const sshKeyId = await this.ensureSshKey(slug, environment, labels);
     const { server, action } = await this.client.createServer({
       name: serverName,
       serverType,
@@ -2474,13 +2517,7 @@ class HetznerDriver {
       { direction: "in", protocol: "tcp", port: "6379", source_ips: [network.ip_range] },
       { direction: "in", protocol: "tcp", port: "7700", source_ips: [network.ip_range] }
     ]);
-    const servicesProvision = [
-      ...buildServicesProvisionScript(compute.managedServices ?? { mysql: true, redis: true }, { bindPrivate: true }),
-      ...buildDatabaseSetupScript(config.infrastructure?.appDatabase, compute.managedServices ?? { mysql: true }),
-      ...buildAutoUpdatesScript(true),
-      ...buildMonitoringScript(true),
-      ...buildAuthorizedKeysScript(compute.sshKeys)
-    ];
+    const servicesProvision = buildFleetServicesBoxProvision(config);
     const servicesUserData = wrapCloudInitUserData(buildUbuntuBootstrapScript({ runtime: "php", servicesProvision, baked }));
     const all = await this.client.listServers().catch(() => []);
     const newServerIds = [];
@@ -2608,6 +2645,9 @@ class HetznerDriver {
     if (existingState?.lbServerId) {
       const lb = await this.tryGetServer(existingState.lbServerId);
       if (lb && lb.status !== "off") {
+        const rpxProxy = compute.proxy?.engine === "rpx" ? compute.proxy : { engine: "rpx" };
+        const appTargets = await this.findComputeTargets({ slug, environment, role: "app", stackName });
+        this.refreshLbRoutes(lb, sites, appTargets.map((t) => ({ privateIp: t.privateIp, publicIp: t.publicIp })), rpxProxy, slug);
         return {
           appPublicIp: lb.public_net.ipv4?.ip ?? existingState.publicIp,
           loadBalancerIp: lb.public_net.ipv4?.ip ?? existingState.publicIp,
@@ -2638,7 +2678,8 @@ class HetznerDriver {
     let servicesServerId;
     let servicesPrivateIp;
     const wantsServicesBox = !!compute.servicesServer || !!compute.managedServices;
-    if (topology.dedicatedServices && wantsServicesBox) {
+    const dedicatedServicesHere = topology.dedicatedServices && wantsServicesBox;
+    if (dedicatedServicesHere) {
       const { firewall: svcFw } = await this.ensureFirewall(`${slug}-${environment}-services-fw`, tsCloudLabels(slug, environment, "services"), [
         { direction: "in", protocol: "tcp", port: "22", source_ips: ["0.0.0.0/0", "::/0"] },
         { direction: "in", protocol: "tcp", port: "3306", source_ips: [network.ip_range] },
@@ -2646,13 +2687,7 @@ class HetznerDriver {
         { direction: "in", protocol: "tcp", port: "6379", source_ips: [network.ip_range] },
         { direction: "in", protocol: "tcp", port: "7700", source_ips: [network.ip_range] }
       ]);
-      const servicesProvision = [
-        ...buildServicesProvisionScript(compute.managedServices ?? { mysql: true, redis: true }, { bindPrivate: true }),
-        ...buildDatabaseSetupScript(config.infrastructure?.appDatabase, compute.managedServices ?? { mysql: true }),
-        ...buildAutoUpdatesScript(true),
-        ...buildMonitoringScript(true),
-        ...buildAuthorizedKeysScript(compute.sshKeys)
-      ];
+      const servicesProvision = buildFleetServicesBoxProvision(config);
       const servicesUserData = wrapCloudInitUserData(buildUbuntuBootstrapScript({ runtime: "bun", servicesProvision, baked }));
       let svcServer = all.find((s) => matchesTsCloudLabels(s.labels, slug, environment, "services"));
       if (!svcServer) {
@@ -2674,7 +2709,11 @@ class HetznerDriver {
       servicesServerId = svcServer.id;
       servicesPrivateIp = svcServer.private_net?.[0]?.ip ?? (await this.client.getServer(servicesServerId)).private_net?.[0]?.ip;
     }
-    const appProvisionScripts = buildComputeProvisionScripts(config);
+    const appBoxCompute = dedicatedServicesHere ? { ...compute, managedServices: undefined, backups: undefined } : compute;
+    const appProvisionScripts = buildComputeProvisionScripts({
+      ...config,
+      infrastructure: { ...config.infrastructure, compute: appBoxCompute }
+    });
     const appUserData = wrapCloudInitUserData(buildUbuntuBootstrapScript({
       runtime: appProvisionScripts.runtime,
       runtimeVersion: appProvisionScripts.runtimeVersion,
@@ -2729,8 +2768,8 @@ class HetznerDriver {
     let lbIp;
     if (topology.loadBalancer) {
       let lbServer = all.find((s) => matchesTsCloudLabels(s.labels, slug, environment, "lb"));
+      const rpxProxy = compute.proxy?.engine === "rpx" ? compute.proxy : { engine: "rpx" };
       if (!lbServer) {
-        const rpxProxy = compute.proxy?.engine === "rpx" ? compute.proxy : { engine: "rpx" };
         const lbRpxProvision = buildRpxProvisionScript({
           proxy: rpxProxy,
           config: buildRpxLbConfig(sites, appBoxes, { proxy: rpxProxy, slug }),
@@ -2763,6 +2802,8 @@ class HetznerDriver {
             await this.waitForCloudInit(ip);
           }
         }
+      } else {
+        this.refreshLbRoutes(lbServer, sites, appBoxes, rpxProxy, slug);
       }
       lbId = lbServer.id;
       lbIp = lbServer.public_net.ipv4?.ip;
@@ -2862,8 +2903,9 @@ class HetznerDriver {
     const stackName = resolveProjectStackName(options.config, options.environment);
     const state = await readDriverState(stackName);
     if (state?.serverId) {
-      const server = await this.client.getServer(state.serverId);
-      return this.outputsFromState(state, server);
+      const server = await this.tryGetServer(state.serverId);
+      if (server)
+        return this.outputsFromState(state, server);
     }
     if (state?.lbServerId) {
       const lb = await this.tryGetServer(state.lbServerId);
@@ -3008,6 +3050,21 @@ class HetznerDriver {
       return null;
     }
   }
+  refreshLbRoutes(lb, sites, appBoxes, proxy, slug) {
+    const ip = lb.public_net.ipv4?.ip;
+    if (!ip) {
+      console.warn(`[ts-cloud] LB server '${lb.name}' has no public IP — skipping the rpx route refresh; its routes may be stale.`);
+      return;
+    }
+    const routable = appBoxes.filter((box) => box.privateIp || box.publicIp);
+    if (routable.length === 0) {
+      console.warn(`[ts-cloud] No routable app boxes found for LB '${lb.name}' — leaving its current rpx routes untouched.`);
+      return;
+    }
+    const config = buildRpxLbConfig(sites, routable, { proxy, slug });
+    this.sshExec(ip, buildRpxFragmentRefreshScript({ config, slug }).join(`
+`));
+  }
   async findExistingServer(slug, environment, serverName) {
     const servers = await this.client.listServers();
     const exact = servers.find((server) => matchesTsCloudLabels(server.labels, slug, environment, "app") || server.name === serverName);
@@ -3066,12 +3123,12 @@ class HetznerDriver {
     const start = Date.now();
     while (Date.now() - start < cloudInitTimeoutMs) {
       try {
-        const out = this.sshExec(host, "cloud-init status --long 2>/dev/null || cloud-init status 2>/dev/null || echo status:\\ done");
-        if (/status:\s*done/.test(out))
-          return;
+        const out = this.sshExec(host, `if command -v cloud-init >/dev/null 2>&1; then cloud-init status --long 2>/dev/null || true; else echo 'status: done'; fi`);
         if (/status:\s*error/.test(out))
           throw new Error(`cloud-init reported an error on ${host}:
 ${out}`);
+        if (/status:\s*(?:done|degraded)/.test(out))
+          return;
       } catch (err) {
         if (err instanceof Error && /cloud-init reported an error/.test(err.message))
           throw err;
@@ -3164,7 +3221,9 @@ class LocalBoxDriver {
   async uploadRelease(options) {
     return { artifactRef: options.localPath };
   }
-  async findComputeTargets(_options) {
+  async findComputeTargets(options) {
+    if ((options.role || "app") !== "app")
+      return [];
     return [{ id: "localhost", name: "localhost", publicIp: "127.0.0.1", status: "running" }];
   }
   async runRemoteDeploy(options) {
@@ -3500,7 +3559,7 @@ class AwsBoxProvisioner {
       MinCount: 1,
       MaxCount: 1,
       SecurityGroupIds: [groupId],
-      UserData: btoa(buildBoxUserData(spec)),
+      UserData: Buffer.from(buildBoxUserData(spec), "utf8").toString("base64"),
       TagSpecifications: [{ ResourceType: "instance", Tags: tags }]
     });
     const instanceId = result.Instances?.[0]?.InstanceId;
@@ -3717,16 +3776,19 @@ function buildSiteDeployScript(options) {
   const paths = releasePaths(base, releaseId);
   const unitBase = `${slug}-${siteName}`;
   const serviceName = `${unitBase}.service`;
+  const tarball = releaseTarballTmpPath(slug, siteName, releaseId);
   const sharedPaths = [...new Set([".env", ...options.sharedPaths ?? []])];
   const envFile = formatEnvFile(envEntries);
   const preStart = preStartCommands.length > 0 ? [`cd ${paths.release}`, ...preStartCommands] : [];
   const stageRelease = [
     "set -euo pipefail",
+    `trap 'if [ $? -ne 0 ] && [ "$(readlink -f ${paths.current} 2>/dev/null || true)" != "${paths.release}" ]; then rm -rf ${paths.release}; fi' EXIT`,
     ...artifactFetch,
     ...buildEnsureReleaseLayout(paths, sharedPaths),
     `rm -rf ${paths.release}`,
     `mkdir -p ${paths.release}`,
-    `tar xzf /tmp/${siteName}-release.tar.gz -C ${paths.release}`,
+    `tar xzf ${tarball} -C ${paths.release}`,
+    `rm -f ${tarball}`,
     `cat > ${paths.shared}/.env <<'TS_CLOUD_ENV_EOF'`,
     envFile,
     "TS_CLOUD_ENV_EOF",
@@ -3768,7 +3830,7 @@ function buildSiteDeployScript(options) {
       ...buildActivateRelease(paths),
       `systemctl enable ${instance} 2>/dev/null || true`,
       `for TS_CLOUD_U in \${TS_CLOUD_OLD_UNITS}; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done`,
-      `systemctl list-unit-files --plain --no-legend "${unitBase}@*.service" 2>/dev/null | awk '{print $1}' | grep -v "^${instance}$" | while read -r TS_CLOUD_U; do systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done`,
+      `systemctl list-unit-files --plain --no-legend "${unitBase}@*.service" 2>/dev/null | awk '{print $1}' | grep -v -e "^${instance}$" -e "^${unitBase}@\\.service$" | while read -r TS_CLOUD_U; do systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done`,
       `if [ -f /etc/systemd/system/${serviceName} ]; then systemctl disable ${serviceName} 2>/dev/null || true; rm -f /etc/systemd/system/${serviceName}; systemctl daemon-reload; fi`,
       ...buildPruneReleases(paths, keepReleases)
     ];
@@ -3804,27 +3866,34 @@ function buildStaticSiteDeployScript(options) {
   const { siteName, artifactFetch, releaseId, keepReleases = DEFAULT_KEEP_RELEASES, preStartCommands = [] } = options;
   const base = options.appDir ?? `/var/www/${siteName}`;
   const paths = releasePaths(base, releaseId);
+  const tarball = releaseTarballTmpPath(options.slug, siteName, releaseId);
   const preStart = preStartCommands.length > 0 ? [`cd ${paths.release}`, ...preStartCommands] : [];
   return [
     "set -euo pipefail",
+    `trap 'if [ $? -ne 0 ] && [ "$(readlink -f ${paths.current} 2>/dev/null || true)" != "${paths.release}" ]; then rm -rf ${paths.release}; fi' EXIT`,
     ...artifactFetch,
     ...buildEnsureReleaseLayout(paths, []),
     `rm -rf ${paths.release}`,
     `mkdir -p ${paths.release}`,
-    `tar xzf /tmp/${siteName}-release.tar.gz -C ${paths.release}`,
+    `tar xzf ${tarball} -C ${paths.release}`,
+    `rm -f ${tarball}`,
     ...preStart,
     ...buildActivateRelease(paths),
     ...buildPruneReleases(paths, keepReleases)
   ];
 }
-function buildAwsArtifactFetch(bucket, key, region, siteName) {
+function releaseTarballTmpPath(slug, siteName, releaseId) {
+  const parts = [slug, siteName, releaseId].filter(Boolean).join("-");
+  return `/tmp/${parts}-release.tar.gz`;
+}
+function buildAwsArtifactFetch(bucket, key, region, destPath) {
   return [
-    `aws s3 cp "s3://${bucket}/${key}" /tmp/${siteName}-release.tar.gz --region ${region}`
+    `aws s3 cp "s3://${bucket}/${key}" ${destPath} --region ${region}`
   ];
 }
-function buildLocalArtifactFetch(localPath, siteName) {
+function buildLocalArtifactFetch(localPath, destPath) {
   return [
-    `cp "${localPath}" /tmp/${siteName}-release.tar.gz`
+    `cp "${localPath}" ${destPath}`
   ];
 }
 // src/drivers/shared/compute-deploy.ts
@@ -4088,7 +4157,7 @@ function buildCertbotInstallScript(dns) {
     "mkdir -p /etc/letsencrypt/renewal-hooks/deploy",
     "cat > /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh <<'TS_CLOUD_HOOK_EOF'",
     "#!/bin/sh",
-    "systemctl reload nginx",
+    "systemctl reload ts-cloud-nginx 2>/dev/null || systemctl reload nginx 2>/dev/null || true",
     "TS_CLOUD_HOOK_EOF",
     "chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh",
     "systemctl enable certbot.timer 2>/dev/null || true",
@@ -4121,7 +4190,7 @@ function buildCertbotIssueScript(options) {
       args.push(`--${plugin}-propagation-seconds ${dns.propagationSeconds}`);
     args.push("certonly");
   } else {
-    args.push("--nginx", options.redirect === false ? "--no-redirect" : "--redirect");
+    args.push("--nginx", `--nginx-ctl ${NGINX_WRAPPER}`, options.redirect === false ? "--no-redirect" : "--redirect");
   }
   if (options.email)
     args.push(`-m ${options.email}`);
@@ -4165,16 +4234,16 @@ function buildGitCheckoutScript(options) {
   ];
   if (repository.strategy === "tag") {
     if (repository.tag) {
-      lines.push(`git clone -q --depth 1 --branch ${repository.tag} ${url} ${releaseDir}`);
+      lines.push(`git clone -q --depth 1 --branch ${shellQuote(repository.tag)} ${shellQuote(url)} ${releaseDir}`);
       lines.push(`printf '%s' ${shellQuote(repository.tag)} > ${releaseDir}/.ts-cloud-tag`);
     } else {
       const pattern = repository.tagPattern || DEFAULT_TAG_PATTERN;
-      lines.push(`TS_CLOUD_TAG="$(git ls-remote --tags --refs --sort=-v:refname ${url} ${shellQuote(`refs/tags/${pattern}`)} | head -n1 | sed 's#.*refs/tags/##')"`, `test -n "$TS_CLOUD_TAG" || { echo "no tags matching ${pattern} found in ${url}" >&2; exit 1; }`, `git clone -q --depth 1 --branch "$TS_CLOUD_TAG" ${url} ${releaseDir}`, `printf '%s' "$TS_CLOUD_TAG" > ${releaseDir}/.ts-cloud-tag`);
+      lines.push(`TS_CLOUD_TAG="$(git ls-remote --tags --refs --sort=-v:refname ${shellQuote(url)} ${shellQuote(`refs/tags/${pattern}`)} | head -n1 | sed 's#.*refs/tags/##')"`, `test -n "$TS_CLOUD_TAG" || { echo "no tags matching" ${shellQuote(pattern)} "found in" ${shellQuote(url)} >&2; exit 1; }`, `git clone -q --depth 1 --branch "$TS_CLOUD_TAG" ${shellQuote(url)} ${releaseDir}`, `printf '%s' "$TS_CLOUD_TAG" > ${releaseDir}/.ts-cloud-tag`);
     }
   } else if (commit) {
-    lines.push(`git -C ${releaseDir} init -q`, `git -C ${releaseDir} remote add origin ${url}`, `git -C ${releaseDir} fetch -q --depth 1 origin ${commit}`, `git -C ${releaseDir} checkout -q FETCH_HEAD`);
+    lines.push(`git -C ${releaseDir} init -q`, `git -C ${releaseDir} remote add origin ${shellQuote(url)}`, `git -C ${releaseDir} fetch -q --depth 1 origin ${shellQuote(commit)}`, `git -C ${releaseDir} checkout -q FETCH_HEAD`);
   } else {
-    lines.push(`git clone -q --depth 1 --branch ${branch} ${url} ${releaseDir}`);
+    lines.push(`git clone -q --depth 1 --branch ${shellQuote(branch)} ${shellQuote(url)} ${releaseDir}`);
   }
   lines.push(`git -C ${releaseDir} rev-parse HEAD > ${releaseDir}/.ts-cloud-sha`);
   return lines;
@@ -4590,12 +4659,13 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
     const hint = driver.name === "aws" ? `Stack '${stackName}' has no EC2 instances tagged Project=${slug} Environment=${environment} Role=app, and storage/cloud/state/${stackName}.json pins no live instance. For a shared box, record its instanceId there.` : `No Hetzner servers labeled ts-cloud/project=${slug} ts-cloud/environment=${environment} ts-cloud/role=app, and storage/cloud/state/${stackName}.json pins no live server. For a shared box, record its serverId there.`;
     return { success: false, error: hint };
   }
+  const dbEnv = outputs.servicesPrivateIp ? buildFleetServicesEnv(outputs.servicesPrivateIp, resolveAppDatabase(config)) : buildManagedDbEnv(resolveAppDatabase(config));
+  const envWithServices = Object.keys(dbEnv).length > 0 ? { ...dbEnv, ...site.env || {} } : site.env || {};
   if (isPhpSite(site)) {
     const compute2 = config.infrastructure?.compute;
     const phpVersion = site.phpVersion ?? compute2?.php?.default ?? compute2?.php?.versions?.[0];
     const appBase2 = siteInstallBase(slug, siteName);
-    const dbEnv = outputs.servicesPrivateIp ? buildFleetServicesEnv(outputs.servicesPrivateIp, config.infrastructure?.appDatabase) : buildManagedDbEnv(config.infrastructure?.appDatabase);
-    const siteWithEnv = Object.keys(dbEnv).length > 0 ? { ...site, env: { ...dbEnv, ...site.env || {} } } : site;
+    const siteWithEnv = Object.keys(dbEnv).length > 0 ? { ...site, env: envWithServices } : site;
     const deployScript = buildLaravelDeployScript({
       siteName,
       site: siteWithEnv,
@@ -4662,11 +4732,13 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
     remoteKey,
     targets
   });
-  const artifactFetch = driver.name === "aws" ? buildAwsArtifactFetch(outputs.deployBucketName, remoteKey, config.project.region || "us-east-1", siteName) : buildLocalArtifactFetch(uploadResult.artifactRef, siteName);
+  const tarballPath = releaseTarballTmpPath(slug, siteName, sha);
+  const artifactFetch = driver.name === "aws" ? buildAwsArtifactFetch(outputs.deployBucketName, remoteKey, config.project.region || "us-east-1", tarballPath) : buildLocalArtifactFetch(uploadResult.artifactRef, tarballPath);
   const kind = resolveSiteKind(site);
   const appBase = siteInstallBase(slug, siteName);
   const baseScript = kind === "server-static" ? buildStaticSiteDeployScript({
     siteName,
+    slug,
     appDir: appBase,
     artifactFetch,
     releaseId: sha,
@@ -4678,7 +4750,7 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
     artifactFetch,
     releaseId: sha,
     execStart: resolveExecStart(site.start, runtime),
-    envEntries: site.env || {},
+    envEntries: envWithServices,
     port: site.port,
     preStartCommands: site.preStart,
     sharedPaths: site.sharedPaths,
@@ -4708,7 +4780,7 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
     ...buildDeployHistoryHeader(appBase, {
       releaseId: sha,
       commit: sha,
-      branch: site.branch ?? "main"
+      branch: site.repository?.branch ?? "main"
     }),
     ...buildSiteOwnerGuard(appBase, slug),
     ...baseScript,
@@ -4741,6 +4813,44 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
     perInstance: result.perInstance
   };
 }
+async function ensureAttachModeDatabase(driver, options, logger) {
+  const { config, environment } = options;
+  if (!config.cloud?.attachTo)
+    return true;
+  const compute = config.infrastructure?.compute;
+  const database = resolveAppDatabase(config);
+  const commands = buildDatabaseSetupScript(database, compute?.managedServices ?? {});
+  if (commands.length === 0)
+    return true;
+  const slug = config.project.slug;
+  const stackName = resolveProjectStackName(config, environment);
+  const targets = await driver.findComputeTargets({
+    slug,
+    environment,
+    role: "app",
+    stackName
+  });
+  if (targets.length === 0) {
+    return true;
+  }
+  logger.step(`Ensuring database '${database?.name}' + role exist on the shared box...`);
+  const result = await driver.runRemoteDeploy({
+    targets,
+    commands,
+    comment: `ts-cloud ensure database ${slug}/${database?.name}`,
+    tags: {
+      Project: slug,
+      Environment: environment,
+      Role: "app"
+    }
+  });
+  if (!result.success) {
+    logger.error(`Ensuring database '${database?.name}' failed: ${result.error || "unknown error"}`);
+    return false;
+  }
+  logger.success(`Database '${database?.name}' is ready on ${result.instanceCount} target(s)`);
+  return true;
+}
 async function deployAllComputeSites(options) {
   const { config, environment, driver, sha, runtime, tarballForSite, logger = noopLogger2 } = options;
   const slug = config.project.slug;
@@ -4791,6 +4901,8 @@ async function deployAllComputeSites(options) {
   });
   if (deployable.length === 0)
     return true;
+  if (!await ensureAttachModeDatabase(driver, options, logger))
+    return false;
   const tarballFor = (siteName) => dashboardTarballBySite.get(siteName) ?? tarballForSite(siteName);
   for (const [siteName, site] of deployable) {
     logger.step(`Deploying site: ${siteName}`);
@@ -4833,29 +4945,68 @@ async function reloadRpxGateway(options) {
   if (proxy?.engine !== "rpx")
     return true;
   const sites = routeSource.sites || {};
-  const rpxConfig = buildRpxConfig(sites, { proxy, slug: config.project.slug });
+  const slug = config.project.slug;
+  const stackName = resolveProjectStackName(config, environment);
+  const lbTargets = await driver.findComputeTargets({
+    slug,
+    environment,
+    role: "lb",
+    stackName
+  });
+  if (lbTargets.length > 0) {
+    const appTargets = await driver.findComputeTargets({
+      slug,
+      environment,
+      role: "app",
+      stackName
+    });
+    const appBoxes = appTargets.map((t) => ({ privateIp: t.privateIp, publicIp: t.publicIp }));
+    const lbConfig = buildRpxLbConfig(sites, appBoxes, { proxy, slug });
+    if (lbConfig.proxies.length === 0) {
+      logger.warn("rpx gateway: no server sites with a domain to route — skipping gateway reload.");
+      return true;
+    }
+    logger.step(`Reloading the load balancer's rpx gateway with ${lbConfig.proxies.length} route(s)...`);
+    const result2 = await driver.runRemoteDeploy({
+      targets: lbTargets,
+      commands: buildRpxFragmentRefreshScript({ config: lbConfig, slug }),
+      comment: `ts-cloud rpx gateway reload ${slug}`,
+      tags: {
+        Project: slug,
+        Environment: environment,
+        Role: "lb"
+      }
+    });
+    if (!result2.success) {
+      logger.error(`rpx gateway reload failed: ${result2.error || "unknown error"}`);
+      return false;
+    }
+    logger.success(`rpx gateway reloaded on ${result2.instanceCount} load balancer(s)`);
+    return true;
+  }
+  const rpxConfig = buildRpxConfig(sites, { proxy, slug });
   if (rpxConfig.proxies.length === 0) {
     logger.warn("rpx gateway: no server sites with a domain to route — skipping gateway reload.");
     return true;
   }
   const targets = await driver.findComputeTargets({
-    slug: config.project.slug,
+    slug,
     environment,
     role: "app",
-    stackName: resolveProjectStackName(config, environment)
+    stackName
   });
   if (targets.length === 0) {
     logger.warn("rpx gateway: no compute targets found — skipping gateway reload.");
     return true;
   }
   logger.step(`Reloading rpx gateway with ${rpxConfig.proxies.length} route(s)...`);
-  const script = buildRpxProvisionScript({ proxy, config: rpxConfig, slug: config.project.slug });
+  const script = buildRpxProvisionScript({ proxy, config: rpxConfig, slug });
   const result = await driver.runRemoteDeploy({
     targets,
     commands: script,
-    comment: `ts-cloud rpx gateway reload ${config.project.slug}`,
+    comment: `ts-cloud rpx gateway reload ${slug}`,
     tags: {
-      Project: config.project.slug,
+      Project: slug,
       Environment: environment,
       Role: "app"
     }
@@ -4947,4 +5098,4 @@ function buildCloudFrontOriginConfig(options) {
     CustomErrorResponses: { Quantity: 0 }
   };
 }
-export { siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, buildAwsArtifactFetch, buildLocalArtifactFetch, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };
+export { siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };