@stacksjs/ts-cloud 0.7.63 → 0.7.65

package/dist/{chunk-0zbqbrqg.js → chunk-0z7ry8fm.js}

@@ -8,7 +8,7 @@ import {
   resolveProjectStackName,
   resolveStatePath,
   statePath
-} from "./chunk-tq46tnxv.js";
+} from "./chunk-ecsyc3p0.js";
 import {
   EC2Client,
   SSMClient
@@ -346,15 +346,14 @@ function buildAutoUpdatesScript(enabled2 = true) {
     return [];
   return [
     "export DEBIAN_FRONTEND=noninteractive",
-    "apt-get install -y unattended-upgrades",
-    "cat > /etc/apt/apt.conf.d/20auto-upgrades <<'TS_CLOUD_AUTOUPD_EOF'",
+    `dpkg-query -W -f='\${Status}' unattended-upgrades 2>/dev/null | grep -q 'ok installed' || apt-get install -y unattended-upgrades`,
+    `cat > /etc/apt/apt.conf.d/20auto-upgrades <<'TS_CLOUD_AUTOUPD_EOF'`,
     'APT::Periodic::Update-Package-Lists "1";',
     'APT::Periodic::Unattended-Upgrade "1";',
     'APT::Periodic::Download-Upgradeable-Packages "1";',
     'APT::Periodic::AutocleanInterval "7";',
     "TS_CLOUD_AUTOUPD_EOF",
-    "systemctl enable unattended-upgrades 2>/dev/null || true",
-    "systemctl restart unattended-upgrades 2>/dev/null || true"
+    "systemctl enable --now unattended-upgrades 2>/dev/null || true"
   ];
 }
 
@@ -366,11 +365,14 @@ var DEFAULT_MEM_PERCENT = 90;
 var DEFAULT_DISK_PERCENT = 90;
 var SERVICE_PROBES = [
   ["nginx", 80],
+  ["https", 443],
   ["phpFpm", 9074],
   ["mysql", 3306],
   ["postgres", 5432],
   ["redis", 6379],
-  ["meilisearch", 7700]
+  ["meilisearch", 7700],
+  ["typesense", 8108],
+  ["smtp", 25]
 ];
 function resolveMonitoring(monitoring = true) {
   const obj = typeof monitoring === "object" ? monitoring : {};
@@ -389,18 +391,20 @@ function buildMonitoringScript(monitoring = true) {
   const probeLines = SERVICE_PROBES.map(([name, port]) => `SVC_${name.toUpperCase()}=$(probe ${port})`);
   const servicesJson = SERVICE_PROBES.map(([name]) => `"${name}":"$SVC_${name.toUpperCase()}"`).join(",");
   return [
+    "if ! command -v sadf >/dev/null 2>&1; then export DEBIAN_FRONTEND=noninteractive; apt-get update -qq; apt-get install -y -qq sysstat; fi",
+    "systemctl enable --now sysstat.service 2>/dev/null || true",
     "mkdir -p /var/lib/ts-cloud",
-    "cat > /usr/local/bin/ts-cloud-metrics.sh <<'TS_CLOUD_METRICS_EOF'",
+    `cat > /usr/local/bin/ts-cloud-metrics.sh <<'TS_CLOUD_METRICS_EOF'`,
     "#!/bin/bash",
     "set -uo pipefail",
-    "LOAD=$(cut -d' ' -f1 /proc/loadavg)",
+    `LOAD=$(cut -d' ' -f1 /proc/loadavg)`,
     "CPUS=$(nproc)",
-    "MEM_TOTAL=$(free -m | awk '/^Mem:/{print $2}')",
-    "MEM_USED=$(free -m | awk '/^Mem:/{print $3}')",
-    "SWAP_TOTAL=$(free -m | awk '/^Swap:/{print $2}')",
-    "SWAP_USED=$(free -m | awk '/^Swap:/{print $3}')",
+    `MEM_TOTAL=$(free -m | awk '/^Mem:/{print $2}')`,
+    `MEM_USED=$(free -m | awk '/^Mem:/{print $3}')`,
+    `SWAP_TOTAL=$(free -m | awk '/^Swap:/{print $2}')`,
+    `SWAP_USED=$(free -m | awk '/^Swap:/{print $3}')`,
     `DISK_PCT=$(df -P / | awk 'NR==2{gsub("%","",$5); print $5}')`,
-    "UPTIME_SEC=$(cut -d' ' -f1 /proc/uptime | cut -d. -f1)",
+    `UPTIME_SEC=$(cut -d' ' -f1 /proc/uptime | cut -d. -f1)`,
     `RX_BYTES=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{rx+=$3} END{print rx+0}' /proc/net/dev)`,
     `TX_BYTES=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{tx+=$11} END{print tx+0}' /proc/net/dev)`,
     "probe(){ (exec 3<>/dev/tcp/127.0.0.1/$1) 2>/dev/null && echo up || echo down; }",
@@ -427,7 +431,7 @@ function buildMonitoringScript(monitoring = true) {
     "fi",
     "TS_CLOUD_METRICS_EOF",
     "chmod +x /usr/local/bin/ts-cloud-metrics.sh",
-    "cat > /etc/systemd/system/ts-cloud-metrics.service <<'TS_CLOUD_METRICS_SVC_EOF'",
+    `cat > /etc/systemd/system/ts-cloud-metrics.service <<'TS_CLOUD_METRICS_SVC_EOF'`,
     "[Unit]",
     "Description=ts-cloud metrics collector",
     "",
@@ -435,20 +439,22 @@ function buildMonitoringScript(monitoring = true) {
     "Type=oneshot",
     "ExecStart=/usr/local/bin/ts-cloud-metrics.sh",
     "TS_CLOUD_METRICS_SVC_EOF",
-    "cat > /etc/systemd/system/ts-cloud-metrics.timer <<'TS_CLOUD_METRICS_TMR_EOF'",
+    `cat > /etc/systemd/system/ts-cloud-metrics.timer <<'TS_CLOUD_METRICS_TMR_EOF'`,
     "[Unit]",
     "Description=Run ts-cloud metrics collector every minute",
     "",
     "[Timer]",
-    "OnBootSec=60",
-    "OnUnitActiveSec=60",
+    "OnCalendar=*-*-* *:*:00",
+    "AccuracySec=1s",
+    "RandomizedDelaySec=5s",
+    "Persistent=true",
     "",
     "[Install]",
     "WantedBy=timers.target",
     "TS_CLOUD_METRICS_TMR_EOF",
     "systemctl daemon-reload",
-    "systemctl enable ts-cloud-metrics.timer",
-    "systemctl start ts-cloud-metrics.timer"
+    "systemctl enable --now ts-cloud-metrics.timer",
+    "systemctl start ts-cloud-metrics.service"
   ];
 }
 
@@ -1170,6 +1176,7 @@ import { readdirSync, readFileSync } from 'node:fs'
 const dir = ${JSON.stringify(sitesDir)}
 const proxies = []
 const seen = new Set()
+const owners = new Map()
 const suffixes = new Set()
 const guardHosts = new Set()
 let email
@@ -1190,8 +1197,12 @@ for (const f of files) {
   catch (err) { console.error('[rpx-assembler] SKIPPING malformed fragment ' + f + ' — its host(s) will 404 until fixed: ' + err); continue }
   for (const p of frag.proxies ?? []) {
     const key = p.id || (p.to + (p.path ?? ''))
-    if (seen.has(key)) continue
+    if (seen.has(key)) {
+      console.warn('[rpx-assembler] duplicate route ' + key + ' in ' + f + ' ignored; first declared by ' + owners.get(key))
+      continue
+    }
     seen.add(key)
+    owners.set(key, f)
     proxies.push(p)
   }
   for (const s of frag.onDemandTls?.allowedSuffixes ?? []) suffixes.add(s)
@@ -1427,7 +1438,8 @@ function buildUfwScript(firewall = {}) {
   const ports = [...new Set([...UFW_BASE_PORTS, ...firewall.allowedPorts || []])].filter((p) => Number.isInteger(p) && p >= 1 && p <= 65535).sort((a, b) => a - b);
   const lines = [
     "export DEBIAN_FRONTEND=noninteractive",
-    "apt-get install -y ufw",
+    "command -v ufw >/dev/null 2>&1 || apt-get install -y ufw",
+    "ufw --force reset",
     "ufw default deny incoming",
     "ufw default allow outgoing",
     "ufw allow OpenSSH"
@@ -2132,6 +2144,28 @@ function resolveHetznerSettings(config, overrides = {}) {
 // src/drivers/hetzner/client.ts
 var DEFAULT_API_URL = "https://api.hetzner.cloud/v1";
 
+class HetznerApiError extends Error {
+  status;
+  code;
+  details;
+  constructor(message, status, code, details) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.details = details;
+    this.name = "HetznerApiError";
+  }
+}
+
+class HetznerActionError extends Error {
+  action;
+  constructor(message, action) {
+    super(message);
+    this.action = action;
+    this.name = "HetznerActionError";
+  }
+}
+
 class HetznerClient {
   name = "hetzner";
   apiToken;
@@ -2165,7 +2199,7 @@ class HetznerClient {
     if (!response.ok) {
       const message = data.error?.message || response.statusText || "Hetzner API error";
       const code = data.error?.code ? ` [${data.error.code}]` : "";
-      throw new Error(`Hetzner API ${method} ${path} (${response.status})${code}: ${message}`);
+      throw new HetznerApiError(`Hetzner API ${method} ${path} (${response.status})${code}: ${message}`, response.status, data.error?.code, data.error?.details);
     }
     return data;
   }
@@ -2189,6 +2223,23 @@ class HetznerClient {
     const data = await this.request("GET", `/servers/${id}`);
     return data.server;
   }
+  async getServerMetrics(id, options) {
+    const query = new URLSearchParams({
+      type: options.types.join(","),
+      start: options.start.toISOString(),
+      end: options.end.toISOString(),
+      step: String(Math.max(60, Math.floor(options.step ?? 60)))
+    });
+    const data = await this.request("GET", `/servers/${id}/metrics?${query}`);
+    return data.metrics;
+  }
+  async listServerTypes(name) {
+    const query = name ? `?name=${encodeURIComponent(name)}` : "";
+    return this.requestAll(`/server_types${query}`, "server_types");
+  }
+  async getServerType(name) {
+    return (await this.listServerTypes(name)).find((item) => item.name === name) ?? null;
+  }
   async createServer(options) {
     const data = await this.request("POST", "/servers", {
       name: options.name,
@@ -2300,16 +2351,35 @@ class HetznerClient {
     });
     return data.ssh_key;
   }
+  async getAction(actionId) {
+    const data = await this.request("GET", `/actions/${actionId}`);
+    return data.action;
+  }
+  async shutdownServer(serverId) {
+    const data = await this.request("POST", `/servers/${serverId}/actions/shutdown`, {});
+    return data.action;
+  }
+  async powerOnServer(serverId) {
+    const data = await this.request("POST", `/servers/${serverId}/actions/poweron`, {});
+    return data.action;
+  }
+  async changeServerType(serverId, serverType, upgradeDisk) {
+    const data = await this.request("POST", `/servers/${serverId}/actions/change_type`, {
+      server_type: serverType,
+      upgrade_disk: upgradeDisk
+    });
+    return data.action;
+  }
   async waitForAction(actionId, options) {
     const pollInterval = options?.pollIntervalMs ?? 2000;
     const maxWait = options?.maxWaitMs ?? 300000;
     const start = Date.now();
     while (Date.now() - start < maxWait) {
-      const data = await this.request("GET", `/actions/${actionId}`);
-      if (data.action.status === "success")
-        return data.action;
-      if (data.action.status === "error") {
-        throw new Error(data.action.error?.message || "Hetzner action failed");
+      const action = await this.getAction(actionId);
+      if (action.status === "success")
+        return action;
+      if (action.status === "error") {
+        throw new HetznerActionError(action.error?.message || "Hetzner action failed", action);
       }
       await new Promise((resolve) => setTimeout(resolve, pollInterval));
     }
@@ -2327,6 +2397,18 @@ class HetznerClient {
     }
     throw new Error(`Timed out waiting for server ${serverId} to reach running state`);
   }
+  async waitForServerStatus(serverId, status, options) {
+    const pollInterval = options?.pollIntervalMs ?? 3000;
+    const maxWait = options?.maxWaitMs ?? 600000;
+    const start = Date.now();
+    while (Date.now() - start < maxWait) {
+      const server = await this.getServer(serverId);
+      if (server.status === status)
+        return server;
+      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+    }
+    throw new Error(`Timed out waiting for server ${serverId} to reach ${status} state`);
+  }
 }
 function resolveHetznerApiToken2(configToken, config) {
   const token = resolveHetznerApiToken(configToken, config);
@@ -2499,7 +2581,7 @@ class HetznerDriver {
     }
     const labels = tsCloudLabels(slug, environment, "app");
     const sites = config.sites || {};
-    const sitePorts = this.collectUpstreamPorts(sites);
+    const sitePorts = usesRpxProxy(compute) ? [] : this.collectUpstreamPorts(sites);
     const firewallName = `${slug}-${environment}-app-fw`;
     const { firewall } = await this.ensureFirewall(firewallName, labels, buildHetznerFirewallRules({
       allowSsh: compute.allowSsh !== false,
@@ -3430,43 +3512,179 @@ class CloudDriverFactory {
   }
 }
 var cloudDrivers = new CloudDriverFactory;
-// src/drivers/hetzner/provision.ts
-async function ensureSshKey(client, options) {
-  const body = normalizeSshPublicKey(options.publicKey);
-  const existing = (await client.listSshKeys()).find((k) => normalizeSshPublicKey(k.public_key) === body);
-  if (existing)
-    return { id: existing.id, name: existing.name, created: false };
-  const created = await client.createSshKey({
-    name: options.name,
-    publicKey: options.publicKey.trim(),
-    labels: options.labels
-  });
-  return { id: created.id, name: created.name, created: true };
+// src/drivers/hetzner/resize.ts
+function serverLocation(server) {
+  return server.location?.name ?? server.datacenter?.location.name ?? "unknown";
+}
+function positive(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+function assertCompatibleUpgrade(current, target) {
+  if (current.architecture && target.architecture && current.architecture !== target.architecture) {
+    throw new Error(`Cannot resize ${current.name} (${current.architecture}) to ${target.name} (${target.architecture}) in place.`);
+  }
+  const regressions = [];
+  if (positive(target.cores) < positive(current.cores))
+    regressions.push("CPU");
+  if (positive(target.memory) < positive(current.memory))
+    regressions.push("memory");
+  if (positive(target.disk) < positive(current.disk))
+    regressions.push("disk");
+  if (regressions.length > 0) {
+    throw new Error(`Refusing an in-place downgrade from ${current.name} to ${target.name}: ${regressions.join(", ")} would shrink.`);
+  }
+}
+async function planHetznerServerResize(client, serverId, targetTypeName, upgradeDisk = true) {
+  const [server, targetType] = await Promise.all([
+    client.getServer(serverId),
+    client.getServerType(targetTypeName)
+  ]);
+  if (!targetType)
+    throw new Error(`Hetzner server type ${targetTypeName} was not found.`);
+  const currentType = server.server_type;
+  const alreadyComplete = currentType.name === targetType.name;
+  if (!alreadyComplete)
+    assertCompatibleUpgrade(currentType, targetType);
+  const location = serverLocation(server);
+  const locationState = targetType.locations?.find((item) => item.name === location);
+  return {
+    serverId,
+    serverName: server.name,
+    location,
+    currentType,
+    targetType,
+    capacityAvailable: locationState?.available !== false,
+    alreadyComplete,
+    upgradeDisk
+  };
 }
-async function ensureFirewall(client, options) {
-  const existing = (await client.listFirewalls()).find((f) => f.name === options.name);
-  if (existing) {
-    await client.setFirewallRules(existing.id, options.rules);
-    return { id: existing.id, name: existing.name, created: false };
+function isHetznerCapacityError(error) {
+  if (error instanceof HetznerApiError && error.code === "resource_unavailable")
+    return true;
+  if (error instanceof HetznerActionError) {
+    if (error.action.error?.code === "resource_unavailable")
+      return true;
+    if (/no fitting vhost|placement|free resources/i.test(error.action.error?.message ?? ""))
+      return true;
   }
-  const { firewall } = await client.createFirewall({ name: options.name, rules: options.rules, labels: options.labels });
-  return { id: firewall.id, name: firewall.name, created: true };
+  return /resource_unavailable|no fitting vhost|error during placement|free resources/i.test(error instanceof Error ? error.message : String(error));
 }
-async function ensureServer(client, options) {
-  const { waitForRunning = true, ...createOptions } = options;
-  let server = (await client.listServers()).find((s) => s.name === options.name);
-  const created = !server;
-  if (!server)
-    server = (await client.createServer(createOptions)).server;
-  if (waitForRunning)
-    server = await client.waitForServerRunning(server.id);
-  return { server, created };
+async function phase(hooks, value, detail) {
+  await hooks?.onPhase?.(value, detail);
 }
-function serverPublicIpv4(server) {
-  const ip = server.public_net.ipv4?.ip;
-  if (!ip)
-    throw new Error(`Hetzner server "${server.name}" (#${server.id}) has no public IPv4`);
-  return ip;
+async function waitForAction(client, action, options) {
+  await client.waitForAction(action.id, {
+    pollIntervalMs: options.actionPollIntervalMs,
+    maxWaitMs: options.actionTimeoutMs
+  });
+}
+var ensurePoweredOn = async ({
+  client,
+  hooks,
+  actionPollIntervalMs,
+  actionTimeoutMs,
+  serverPollIntervalMs,
+  serverTimeoutMs
+}, plan, manifest, recovered) => {
+  let server = await client.getServer(plan.serverId);
+  if (server.status !== "running") {
+    await phase(hooks, recovered ? "recovering" : "powering-on", {
+      serverId: plan.serverId
+    });
+    const action = await client.powerOnServer(plan.serverId);
+    await waitForAction(client, action, { actionPollIntervalMs, actionTimeoutMs });
+    server = await client.waitForServerRunning(plan.serverId, {
+      pollIntervalMs: serverPollIntervalMs,
+      maxWaitMs: serverTimeoutMs
+    });
+  }
+  await phase(hooks, "verifying", {
+    serverId: plan.serverId,
+    recovered
+  });
+  const verification = await hooks?.afterBoot?.(server, plan.targetType, manifest, { recovered });
+  return { server, verification };
+};
+async function executeHetznerServerResize(options) {
+  const { client, hooks } = options;
+  const upgradeDisk = options.upgradeDisk ?? true;
+  await phase(hooks, "planning", {
+    serverId: options.serverId,
+    targetType: options.targetType
+  });
+  const plan = await planHetznerServerResize(client, options.serverId, options.targetType, upgradeDisk);
+  let server = await client.getServer(plan.serverId);
+  if (plan.alreadyComplete) {
+    const boot2 = await ensurePoweredOn(options, plan, options.manifest, false);
+    await phase(hooks, "complete", { alreadyComplete: true });
+    return { status: "already-complete", plan, verification: boot2.verification };
+  }
+  if (!plan.capacityAvailable && !options.attemptUnavailable) {
+    await phase(hooks, "waiting-capacity", {
+      location: plan.location,
+      targetType: plan.targetType.name
+    });
+    return { status: "waiting-capacity", plan };
+  }
+  let manifest = options.manifest;
+  if (server.status === "off" && !options.resumeFromOff) {
+    const recovered = await ensurePoweredOn(options, plan, undefined, true);
+    return {
+      status: "recovered",
+      plan,
+      server: recovered.server,
+      verification: recovered.verification,
+      retryable: true,
+      error: "Server was already off without a resumable resize checkpoint; powered it back on."
+    };
+  }
+  if (server.status === "running") {
+    await phase(hooks, "preflight", { serverId: plan.serverId });
+    manifest = await hooks?.preflight?.(server, plan.targetType);
+    await phase(hooks, "shutting-down", { serverId: plan.serverId });
+    const shutdown = await client.shutdownServer(plan.serverId);
+    await waitForAction(client, shutdown, options);
+    server = await client.waitForServerStatus(plan.serverId, "off", {
+      pollIntervalMs: options.serverPollIntervalMs,
+      maxWaitMs: options.serverTimeoutMs
+    });
+  }
+  try {
+    await phase(hooks, "resizing", {
+      serverId: plan.serverId,
+      from: plan.currentType.name,
+      to: plan.targetType.name,
+      upgradeDisk
+    });
+    const change = await client.changeServerType(plan.serverId, plan.targetType.name, upgradeDisk);
+    await waitForAction(client, change, options);
+  } catch (error) {
+    const recovered = await ensurePoweredOn(options, plan, manifest, true);
+    return {
+      status: "recovered",
+      plan,
+      server: recovered.server,
+      manifest,
+      verification: recovered.verification,
+      retryable: isHetznerCapacityError(error),
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+  const boot = await ensurePoweredOn(options, plan, manifest, false);
+  if (boot.verification && !boot.verification.ok) {
+    throw new Error(`Resize completed but verification failed: ${(boot.verification.failures ?? []).join("; ")}`);
+  }
+  await phase(hooks, "complete", {
+    serverId: plan.serverId,
+    targetType: plan.targetType.name
+  });
+  return {
+    status: "completed",
+    plan,
+    server: boot.server,
+    manifest,
+    verification: boot.verification
+  };
 }
 // src/drivers/shared/remote-exec.ts
 function buildSshArgs(options = {}) {
@@ -3528,6 +3746,519 @@ async function waitForCloudInit(host, options = {}) {
   }
   throw new Error(`cloud-init did not finish on ${host} after ${timeoutMs}ms`);
 }
+
+// src/drivers/hetzner/resize-remote.ts
+var INVENTORY_SCRIPT = String.raw`
+const { readdir, readFile, readlink, stat } = await import('node:fs/promises')
+
+const text = (command) => {
+  const result = Bun.spawnSync(['bash', '-lc', command], { stdout: 'pipe', stderr: 'pipe' })
+  return result.exitCode === 0 ? result.stdout.toString().trim() : ''
+}
+const lines = (command) => text(command).split('\n').map(value => value.trim()).filter(Boolean).sort()
+const number = (value) => Number.parseInt(value || '0', 10) || 0
+
+const root = text('findmnt -n -o SOURCE,FSTYPE /').split(/\s+/)
+const rootSource = root[0] || ''
+const rootFsType = root[1] || ''
+const rootParent = text('lsblk -n -o PKNAME ' + rootSource + ' | head -1')
+const rootDiskBytes = number(text('lsblk -b -n -o SIZE /dev/' + rootParent + ' | head -1'))
+const rootFilesystemBytes = number(text("df -B1 --output=size / | tail -1"))
+const memoryBytes = number(text("awk '/MemTotal/{print $2 * 1024}' /proc/meminfo"))
+const allRunningServices = lines("systemctl list-units --type=service --state=running --no-legend --plain | awk '{print $1}'")
+const runningServices = allRunningServices.filter((unit) => {
+  if (/^(containerd|docker|localtunnel|mail|mysql|mariadb|meilisearch|postgresql|redis|rpx-gateway)\b/.test(unit)) return true
+  const source = text('systemctl cat ' + unit + ' 2>/dev/null')
+  return /\/var\/www|\/usr\/local\/bin\/rpx|\/opt\/ts-cloud/.test(source)
+})
+const failedUnits = lines("systemctl --failed --type=service --no-legend --plain | awk '{print $1}'")
+const releaseLinks = []
+for (const path of lines("find /var/www -mindepth 2 -maxdepth 2 -type l -name current -print 2>/dev/null")) {
+  try {
+    releaseLinks.push(path + '=' + await readlink(path))
+  } catch {}
+}
+releaseLinks.sort()
+
+const routeFragments = []
+const routeIds = []
+const routeDomains = new Set()
+for (const path of lines("find /etc/rpx/sites.d -maxdepth 1 -type f -name '*.json' -print 2>/dev/null")) {
+  try {
+    const source = await readFile(path, 'utf8')
+    const digest = new Bun.CryptoHasher('sha256').update(source).digest('hex')
+    routeFragments.push(path + '=' + digest)
+    const value = JSON.parse(source)
+    for (const route of value.proxies || []) {
+      if (typeof route.to === 'string' && route.to) {
+        routeDomains.add(route.to)
+        routeIds.push(path + ':' + (route.id || route.to) + ':' + (route.path || '/'))
+      }
+    }
+  } catch {}
+}
+routeFragments.sort()
+routeIds.sort()
+
+const persistentData = []
+for (const path of ['/var/lib/postgresql', '/var/lib/mysql', '/var/lib/redis', '/var/lib/docker', '/var/mail', '/var/vmail']) {
+  try {
+    const value = await stat(path)
+    if (value.isDirectory()) {
+      const bytes = number(text('du -sx --block-size=1 ' + path + " 2>/dev/null | awk '{print $1}'"))
+      persistentData.push(path + '=' + bytes)
+    }
+  } catch {}
+}
+
+const dataCatalog = []
+for (const database of lines("command -v psql >/dev/null && sudo -u postgres psql -Atqc 'select datname from pg_database where datistemplate = false order by datname' 2>/dev/null || true")) {
+  dataCatalog.push('postgres:' + database)
+}
+for (const database of lines("command -v mysql >/dev/null && mysql -NBe 'show databases' 2>/dev/null || true")) {
+  dataCatalog.push('mysql:' + database)
+}
+for (const volume of lines("command -v docker >/dev/null && docker volume ls --format '{{.Name}}' 2>/dev/null || true")) {
+  dataCatalog.push('docker-volume:' + volume)
+}
+
+console.log(JSON.stringify({
+  capturedAt: new Date().toISOString(),
+  hostname: text('hostname'),
+  cpuCores: number(text('nproc')),
+  memoryBytes,
+  rootSource,
+  rootFsType,
+  rootDiskBytes,
+  rootFilesystemBytes,
+  failedUnits,
+  runningServices,
+  releaseLinks,
+  routeFragments,
+  routeIds,
+  routeDomains: [...routeDomains].sort(),
+  persistentData: persistentData.sort(),
+  dataCatalog: dataCatalog.sort(),
+}))
+`;
+function remoteBunCommand(script) {
+  return `printf %s ${Buffer.from(script).toString("base64")} | base64 -d | bun -`;
+}
+async function collectHostManifest(options) {
+  const raw = await sshExecOrThrow(options.host, remoteBunCommand(INVENTORY_SCRIPT), options);
+  return JSON.parse(raw);
+}
+async function probeRoute(domain, timeoutMs) {
+  let lastError = "";
+  for (let attempt = 1;attempt <= 3; attempt++) {
+    const process2 = Bun.spawn([
+      "curl",
+      "--location",
+      "--silent",
+      "--show-error",
+      "--output",
+      "/dev/null",
+      "--max-time",
+      String(Math.max(1, Math.ceil(timeoutMs / 1000))),
+      "--write-out",
+      "%{http_code}",
+      `https://${domain}/`
+    ], { stdout: "pipe", stderr: "pipe" });
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(process2.stdout).text(),
+      new Response(process2.stderr).text(),
+      process2.exited
+    ]);
+    const status = Number.parseInt(stdout.trim(), 10);
+    if (exitCode === 0 && status > 0)
+      return { domain, ok: status < 500, status };
+    lastError = stderr.trim() || `curl exited ${exitCode}`;
+    if (attempt < 3)
+      await Bun.sleep(500 * attempt);
+  }
+  return { domain, ok: false, error: lastError };
+}
+async function probeRoutes(domains, timeoutMs) {
+  const probes = [];
+  let cursor = 0;
+  const workers = Array.from({ length: Math.min(4, domains.length) }, async () => {
+    for (;; ) {
+      const index = cursor++;
+      const domain = domains[index];
+      if (!domain)
+        return;
+      probes[index] = await probeRoute(domain, timeoutMs);
+    }
+  });
+  await Promise.all(workers);
+  return probes;
+}
+async function collectHetznerResizeManifest(options) {
+  const host = await collectHostManifest(options);
+  const routeProbes = await probeRoutes(host.routeDomains, options.routeTimeoutMs ?? 15000);
+  return { ...host, routeProbes };
+}
+async function prepareHetznerResize(options) {
+  const before = await collectHetznerResizeManifest(options);
+  const unhealthy = before.routeProbes.filter((probe) => !probe.ok);
+  if (before.failedUnits.length > 0) {
+    throw new Error(`Preflight found failed services: ${before.failedUnits.join(", ")}`);
+  }
+  if (unhealthy.length > 0) {
+    throw new Error(`Preflight found unhealthy routes: ${unhealthy.map((probe) => probe.domain).join(", ")}`);
+  }
+  await sshExecOrThrow(options.host, String.raw`systemctl list-units --type=service --state=running --no-legend --plain | awk '{print $1}' | while read -r unit; do if systemctl cat "$unit" 2>/dev/null | grep -Eq '/var/www|/usr/local/bin/rpx|/opt/ts-cloud'; then systemctl enable "$unit" >/dev/null 2>&1 || true; fi; done; systemctl daemon-reload; sync`, options);
+  return before;
+}
+function missing(expected, actual) {
+  const values = new Set(actual);
+  return expected.filter((value) => !values.has(value));
+}
+function targetMemoryBytes(target) {
+  return Math.floor((target.memory ?? 0) * 1024 * 1024 * 1024);
+}
+async function expandRootFilesystem(options) {
+  await sshExecOrThrow(options.host, String.raw`set -e
+root_source="$(findmnt -n -o SOURCE /)"
+root_fs="$(findmnt -n -o FSTYPE /)"
+parent="$(lsblk -n -o PKNAME "$root_source" | head -1)"
+partition="$(lsblk -n -o PARTN "$root_source" | head -1)"
+if [ -n "$parent" ] && [ -n "$partition" ]; then
+  growpart "/dev/$parent" "$partition" || true
+fi
+case "$root_fs" in
+  ext2|ext3|ext4) resize2fs "$root_source" ;;
+  xfs) xfs_growfs / ;;
+  *) echo "Unsupported root filesystem: $root_fs" >&2; exit 1 ;;
+esac`, options);
+}
+async function restoreExpectedServices(options, expected) {
+  const encoded = Buffer.from(expected.join(`
+`)).toString("base64");
+  await sshExecOrThrow(options.host, `printf %s ${encoded} | base64 -d | while read -r unit; do [ -z "$unit" ] || systemctl is-active --quiet "$unit" || systemctl start "$unit"; done`, options);
+}
+async function verifyHetznerResize(options, target, before, context = { recovered: false }) {
+  await waitForSsh(options.host, {
+    ...options,
+    timeoutMs: options.sshTimeoutMs ?? 10 * 60000
+  });
+  if (!context.recovered)
+    await expandRootFilesystem(options);
+  if (before)
+    await restoreExpectedServices(options, before.runningServices);
+  const after = await collectHetznerResizeManifest(options);
+  const failures = [];
+  const missingServices = before ? missing(before.runningServices, after.runningServices) : [];
+  const missingReleases = before ? missing(before.releaseLinks, after.releaseLinks) : [];
+  const changedRoutes = before ? missing(before.routeFragments, after.routeFragments) : [];
+  const missingRouteIds = before ? missing(before.routeIds, after.routeIds) : [];
+  const beforeDataPaths = before?.persistentData.map((value) => value.split("=")[0]) ?? [];
+  const afterDataPaths = after.persistentData.map((value) => value.split("=")[0]);
+  const missingDataPaths = missing(beforeDataPaths, afterDataPaths);
+  const missingDataCatalog = before ? missing(before.dataCatalog, after.dataCatalog) : [];
+  const unhealthyRoutes = after.routeProbes.filter((probe) => !probe.ok);
+  const expectedCores = context.recovered && before ? before.cpuCores : target.cores ?? 0;
+  const expectedMemory = context.recovered && before ? before.memoryBytes : targetMemoryBytes(target);
+  const cpuOk = after.cpuCores >= expectedCores;
+  const memoryOk = after.memoryBytes >= expectedMemory * 0.9;
+  const diskOk = context.recovered || after.rootDiskBytes >= (target.disk ?? 0) * 1e9 * 0.95;
+  if (after.failedUnits.length > 0)
+    failures.push(`Failed services: ${after.failedUnits.join(", ")}`);
+  if (missingServices.length > 0)
+    failures.push(`Services did not return: ${missingServices.join(", ")}`);
+  if (missingReleases.length > 0)
+    failures.push(`Release links changed: ${missingReleases.join(", ")}`);
+  if (changedRoutes.length > 0)
+    failures.push(`Route manifests changed: ${changedRoutes.join(", ")}`);
+  if (missingRouteIds.length > 0)
+    failures.push(`Routes disappeared: ${missingRouteIds.join(", ")}`);
+  if (missingDataPaths.length > 0)
+    failures.push(`Persistent data paths disappeared: ${missingDataPaths.join(", ")}`);
+  if (missingDataCatalog.length > 0)
+    failures.push(`Databases or volumes disappeared: ${missingDataCatalog.join(", ")}`);
+  if (unhealthyRoutes.length > 0)
+    failures.push(`Unhealthy routes: ${unhealthyRoutes.map((probe) => probe.domain).join(", ")}`);
+  if (!cpuOk)
+    failures.push(`Expected at least ${expectedCores} CPU cores, found ${after.cpuCores}`);
+  if (!memoryOk)
+    failures.push(`Expected at least ${expectedMemory} bytes of RAM`);
+  if (!diskOk)
+    failures.push(`Expected approximately ${target.disk ?? 0} GB root disk`);
+  return {
+    ok: failures.length === 0,
+    checks: {
+      cpuCores: after.cpuCores,
+      memoryBytes: after.memoryBytes,
+      rootDiskBytes: after.rootDiskBytes,
+      rootFilesystemBytes: after.rootFilesystemBytes,
+      runningServices: after.runningServices.length,
+      releaseLinks: after.releaseLinks.length,
+      routeFragments: after.routeFragments.length,
+      routes: after.routeIds.length,
+      healthyRoutes: after.routeProbes.filter((probe) => probe.ok).length,
+      persistentDataPaths: after.persistentData.length,
+      databasesAndVolumes: after.dataCatalog.length,
+      failedUnits: after.failedUnits.length
+    },
+    failures
+  };
+}
+// src/drivers/hetzner/host-optimization.ts
+function computeConfig(config) {
+  return config.infrastructure?.compute ?? {};
+}
+function resolveHetznerHostOptimizationPlan(config) {
+  const compute = computeConfig(config);
+  const monitoring = compute.monitoring;
+  const firewallPorts = [...new Set([22, 80, 443, ...compute.firewall?.allowedPorts ?? []])].filter((port) => Number.isInteger(port) && port >= 1 && port <= 65535).sort((a, b) => a - b);
+  return {
+    firewallPorts,
+    monitoring: monitoring !== false && (typeof monitoring !== "object" || monitoring.enabled !== false),
+    autoUpdates: compute.autoUpdates !== false,
+    swapGb: Math.max(0, Math.floor(compute.swapGb ?? 2)),
+    sshPasswordAuthentication: false,
+    journalMaxUse: "256M",
+    journalRetention: "14day"
+  };
+}
+function hardeningScript(plan) {
+  return [
+    "install -d -m 0755 /etc/ssh/sshd_config.d /etc/systemd/journald.conf.d /etc/sysctl.d /etc/fail2ban/jail.d",
+    `cat > /etc/ssh/sshd_config.d/99-ts-cloud-hardening.conf <<'TS_CLOUD_SSH_EOF'`,
+    "# Managed by ts-cloud host optimization.",
+    "PasswordAuthentication no",
+    "KbdInteractiveAuthentication no",
+    "PermitRootLogin prohibit-password",
+    "MaxAuthTries 4",
+    "LoginGraceTime 30",
+    "TS_CLOUD_SSH_EOF",
+    "sshd -t",
+    "systemctl reload ssh",
+    `cat > /etc/systemd/journald.conf.d/99-ts-cloud-retention.conf <<'TS_CLOUD_JOURNAL_EOF'`,
+    "[Journal]",
+    `SystemMaxUse=${plan.journalMaxUse}`,
+    `MaxRetentionSec=${plan.journalRetention}`,
+    "Compress=yes",
+    "TS_CLOUD_JOURNAL_EOF",
+    "systemctl restart systemd-journald",
+    "journalctl --vacuum-size=256M --vacuum-time=14d >/dev/null",
+    `cat > /etc/sysctl.d/99-ts-cloud-production.conf <<'TS_CLOUD_SYSCTL_EOF'`,
+    "# Managed by ts-cloud host optimization.",
+    "vm.swappiness=10",
+    "vm.dirty_background_ratio=5",
+    "vm.dirty_ratio=15",
+    "net.core.somaxconn=4096",
+    "net.ipv4.tcp_max_syn_backlog=4096",
+    "net.ipv4.tcp_fin_timeout=30",
+    "net.ipv4.tcp_keepalive_time=300",
+    "net.ipv4.tcp_keepalive_intvl=30",
+    "net.ipv4.tcp_keepalive_probes=5",
+    "fs.inotify.max_user_watches=524288",
+    "TS_CLOUD_SYSCTL_EOF",
+    "sysctl --system >/dev/null",
+    "export DEBIAN_FRONTEND=noninteractive",
+    "command -v fail2ban-client >/dev/null 2>&1 || apt-get install -y fail2ban",
+    `cat > /etc/fail2ban/jail.d/99-ts-cloud-sshd.conf <<'TS_CLOUD_FAIL2BAN_EOF'`,
+    "[sshd]",
+    "enabled = true",
+    "backend = systemd",
+    "bantime = 1h",
+    "findtime = 10m",
+    "maxretry = 5",
+    "TS_CLOUD_FAIL2BAN_EOF",
+    "systemctl enable --now fail2ban",
+    "systemctl restart fail2ban"
+  ];
+}
+function swapScript(sizeGb) {
+  if (sizeGb === 0)
+    return [];
+  return [
+    `if ! swapon --show=NAME --noheadings 2>/dev/null | grep -qx '/swapfile'; then`,
+    `  if [ ! -f /swapfile ]; then fallocate -l ${sizeGb}G /swapfile || dd if=/dev/zero of=/swapfile bs=1M count=${sizeGb * 1024} status=none; fi`,
+    "  chmod 600 /swapfile",
+    "  mkswap /swapfile >/dev/null",
+    "  swapon /swapfile",
+    "fi",
+    `grep -qE '^/swapfile\\s' /etc/fstab || echo '/swapfile none swap sw 0 0' >> /etc/fstab`
+  ];
+}
+function buildHetznerHostOptimizationScript(config) {
+  const compute = computeConfig(config);
+  const plan = resolveHetznerHostOptimizationPlan(config);
+  const monitoring = compute.monitoring ?? true;
+  const firewall = compute.firewall ?? { enabled: true };
+  return [
+    "set -euo pipefail",
+    ...usesRpxProxy(compute) ? [
+      "systemctl disable --now nginx.service bun-gateway.service ts-cloud-nginx.service 2>/dev/null || true",
+      "systemctl reset-failed nginx.service bun-gateway.service ts-cloud-nginx.service 2>/dev/null || true"
+    ] : [],
+    ...swapScript(plan.swapGb),
+    ...buildAutoUpdatesScript(plan.autoUpdates),
+    ...buildMonitoringScript(monitoring),
+    ...hardeningScript(plan),
+    ...buildUfwScript(firewall),
+    "systemctl daemon-reload",
+    "systemctl reset-failed"
+  ];
+}
+var REPORT_SCRIPT = String.raw`
+const text = (command) => {
+  const result = Bun.spawnSync(['bash', '-lc', command], { stdout: 'pipe', stderr: 'pipe' })
+  return result.stdout.toString().trim()
+}
+const lines = command => text(command).split('\n').map(value => value.trim()).filter(Boolean)
+const number = value => Number.parseInt(value || '0', 10) || 0
+const ssh = Object.fromEntries(lines("sshd -T 2>/dev/null | grep -E '^(passwordauthentication|permitrootlogin) '").map(line => line.split(/\s+/, 2)))
+const firewallPorts = lines("ufw status 2>/dev/null | awk '/ALLOW/{print $1}'")
+  .flatMap(value => value.startsWith('OpenSSH') ? [22] : (value.match(/^\d+/) ? [number(value)] : []))
+const publicTcpPorts = lines("ss -lntH | awk '{print $4}'")
+  .filter(address => !address.startsWith('127.') && !address.startsWith('[::1]'))
+  .flatMap(address => {
+    const match = address.match(/:(\d+)$/)
+    return match ? [number(match[1])] : []
+  })
+const metricsMtime = number(text("stat -c %Y /var/lib/ts-cloud/metrics.json 2>/dev/null"))
+console.log(JSON.stringify({
+  firewallActive: text("ufw status 2>/dev/null | head -1").includes('active'),
+  firewallPorts: [...new Set(firewallPorts)].sort((a, b) => a - b),
+  passwordAuthentication: ssh.passwordauthentication !== 'no',
+  rootPasswordLogin: ssh.permitrootlogin === 'yes',
+  fail2banActive: text('systemctl is-active fail2ban 2>/dev/null') === 'active',
+  unattendedUpgradesActive: text('systemctl is-active unattended-upgrades 2>/dev/null') === 'active',
+  metricsTimerActive: text('systemctl is-active ts-cloud-metrics.timer 2>/dev/null') === 'active',
+  metricsSnapshotFresh: metricsMtime > 0 && Math.floor(Date.now() / 1000) - metricsMtime < 180,
+  swapBytes: number(text("free -b | awk '/^Swap:/{print $2}'")),
+  journalBytes: number(text("journalctl --disk-usage 2>/dev/null | grep -Eo '[0-9.]+[KMG]' | tail -1 | numfmt --from=iec 2>/dev/null")),
+  failedUnits: lines("systemctl --failed --type=service --no-legend --plain | awk '{print $1}'"),
+  publicTcpPorts: [...new Set(publicTcpPorts)].sort((a, b) => a - b),
+}))
+`;
+function remoteBunCommand2(script) {
+  return `printf %s ${Buffer.from(script).toString("base64")} | base64 -d | bun -`;
+}
+async function applyHetznerHostOptimization(config, options) {
+  const script = buildHetznerHostOptimizationScript(config).join(`
+`);
+  const command = `printf %s ${Buffer.from(script).toString("base64")} | base64 -d | bash`;
+  await sshExecOrThrow(options.host, command, options);
+}
+async function collectHetznerHostOptimizationReport(options) {
+  const raw = await sshExecOrThrow(options.host, remoteBunCommand2(REPORT_SCRIPT), options);
+  return JSON.parse(raw);
+}
+function verifyHetznerHostOptimization(plan, report) {
+  const failures = [];
+  const actualPorts = new Set(report.firewallPorts);
+  const missingPorts = plan.firewallPorts.filter((port) => !actualPorts.has(port));
+  const unexpectedPorts = report.firewallPorts.filter((port) => !plan.firewallPorts.includes(port));
+  if (!report.firewallActive)
+    failures.push("UFW is not active");
+  if (missingPorts.length > 0)
+    failures.push(`UFW is missing ports: ${missingPorts.join(", ")}`);
+  if (unexpectedPorts.length > 0)
+    failures.push(`UFW has unexpected ports: ${unexpectedPorts.join(", ")}`);
+  if (report.passwordAuthentication)
+    failures.push("SSH password authentication remains enabled");
+  if (report.rootPasswordLogin)
+    failures.push("SSH root password login remains enabled");
+  if (!report.fail2banActive)
+    failures.push("fail2ban is not active");
+  if (plan.autoUpdates && !report.unattendedUpgradesActive)
+    failures.push("unattended upgrades are not active");
+  if (plan.monitoring && !report.metricsTimerActive)
+    failures.push("metrics timer is not active");
+  if (plan.monitoring && !report.metricsSnapshotFresh)
+    failures.push("metrics snapshot is stale");
+  if (plan.swapGb > 0 && report.swapBytes < plan.swapGb * 1024 ** 3 * 0.9)
+    failures.push("configured swap is missing");
+  if (report.failedUnits.length > 0)
+    failures.push(`failed services: ${report.failedUnits.join(", ")}`);
+  return failures;
+}
+// src/drivers/hetzner/resize-state.ts
+import { mkdir as mkdir2, readFile as readFile2, rename as rename2, rmdir, stat, unlink, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join4 } from "node:path";
+function resizeCheckpointPath(stackName) {
+  return join4(process.cwd(), STATE_DIR, `${stackName}-resize.json`);
+}
+function resizeLockPath(stackName) {
+  return join4(process.cwd(), STATE_DIR, `${stackName}-resize.lock`);
+}
+async function readResizeCheckpoint(stackName) {
+  try {
+    return JSON.parse(await readFile2(resizeCheckpointPath(stackName), "utf8"));
+  } catch {
+    return null;
+  }
+}
+async function writeResizeCheckpoint(checkpoint) {
+  const path = resizeCheckpointPath(checkpoint.stackName);
+  await mkdir2(join4(process.cwd(), STATE_DIR), { recursive: true });
+  const tempPath = `${path}.${process.pid}.tmp`;
+  await writeFile2(tempPath, `${JSON.stringify(checkpoint, null, 2)}
+`, "utf8");
+  await rename2(tempPath, path);
+}
+async function acquireResizeLock(stackName, staleAfterMs = 30 * 60000) {
+  const path = resizeLockPath(stackName);
+  await mkdir2(join4(process.cwd(), STATE_DIR), { recursive: true });
+  try {
+    await mkdir2(path);
+  } catch (error) {
+    const age = Date.now() - (await stat(path)).mtimeMs;
+    if (age <= staleAfterMs) {
+      throw new Error(`Another resize process holds ${path}.`);
+    }
+    await rename2(path, `${path}.stale-${Date.now()}`);
+    await mkdir2(path);
+  }
+  await writeFile2(join4(path, "owner.json"), `${JSON.stringify({ pid: process.pid, acquiredAt: new Date().toISOString() }, null, 2)}
+`, "utf8");
+  return async () => {
+    await unlink(join4(path, "owner.json")).catch(() => {});
+    await rmdir(path).catch(() => {});
+  };
+}
+// src/drivers/hetzner/provision.ts
+async function ensureSshKey(client, options) {
+  const body = normalizeSshPublicKey(options.publicKey);
+  const existing = (await client.listSshKeys()).find((k) => normalizeSshPublicKey(k.public_key) === body);
+  if (existing)
+    return { id: existing.id, name: existing.name, created: false };
+  const created = await client.createSshKey({
+    name: options.name,
+    publicKey: options.publicKey.trim(),
+    labels: options.labels
+  });
+  return { id: created.id, name: created.name, created: true };
+}
+async function ensureFirewall(client, options) {
+  const existing = (await client.listFirewalls()).find((f) => f.name === options.name);
+  if (existing) {
+    await client.setFirewallRules(existing.id, options.rules);
+    return { id: existing.id, name: existing.name, created: false };
+  }
+  const { firewall } = await client.createFirewall({ name: options.name, rules: options.rules, labels: options.labels });
+  return { id: firewall.id, name: firewall.name, created: true };
+}
+async function ensureServer(client, options) {
+  const { waitForRunning = true, ...createOptions } = options;
+  let server = (await client.listServers()).find((s) => s.name === options.name);
+  const created = !server;
+  if (!server)
+    server = (await client.createServer(createOptions)).server;
+  if (waitForRunning)
+    server = await client.waitForServerRunning(server.id);
+  return { server, created };
+}
+function serverPublicIpv4(server) {
+  const ip = server.public_net.ipv4?.ip;
+  if (!ip)
+    throw new Error(`Hetzner server "${server.name}" (#${server.id}) has no public IPv4`);
+  return ip;
+}
 // src/drivers/shared/box-provision.ts
 var UBUNTU_2404_AMI_PARAM = "/aws/service/canonical/ubuntu/server/24.04/stable/current/amd64/hvm/ebs-gp3/ami-id";
 function buildBoxUserData(spec) {
@@ -4098,16 +4829,16 @@ function buildHostCleanupScript() {
   ];
 }
 // src/drivers/shared/compute-deploy.ts
-import { copyFileSync } from "node:fs";
+import { copyFileSync as copyFileSync2 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 
 // src/deploy/management-dashboard.ts
 import { execSync as execSync2 } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { chmodSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync3, writeFileSync } from "node:fs";
+import { chmodSync, copyFileSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync3, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname, isAbsolute, join as join4 } from "node:path";
+import { basename, dirname, isAbsolute, join as join5, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // src/deploy/dashboard-config-module.ts
@@ -4199,7 +4930,7 @@ function resolveDashboardVersion() {
   if (explicit)
     return explicit;
   const here = dirname(fileURLToPath(import.meta.url));
-  for (const candidate of [join4(here, "..", "..", "package.json"), join4(here, "..", "package.json")]) {
+  for (const candidate of [join5(here, "..", "..", "package.json"), join5(here, "..", "package.json")]) {
     try {
       const pkg = JSON.parse(readFileSync3(candidate, "utf8"));
       if (pkg.name === "@stacksjs/ts-cloud" && pkg.version)
@@ -4216,14 +4947,27 @@ function stageLiveDashboardRoot(config, cwd, logger) {
   const stage = resolveStatePath(cwd, "dashboard-release");
   try {
     mkdirSync(stage, { recursive: true });
-    writeFileSync(join4(stage, "cloud.config.ts"), serializeDashboardConfig(config));
+    writeFileSync(join5(stage, "cloud.config.ts"), serializeDashboardConfig(config));
+    let dependency = resolveDashboardVersion();
+    if (dependency.startsWith("file:")) {
+      const requested = dependency.slice("file:".length);
+      const source = isAbsolute(requested) ? requested : resolve(cwd, requested);
+      if (!existsSync2(source) || !statSync(source).isFile()) {
+        throw new Error(`TS_CLOUD_UI_VERSION points to a missing package file: ${source}`);
+      }
+      const name = basename(source);
+      const destination = join5(stage, name);
+      if (source !== destination)
+        copyFileSync(source, destination);
+      dependency = `file:./${name}`;
+    }
     const pkg = {
       name: "ts-cloud-dashboard",
       private: true,
       type: "module",
-      dependencies: { "@stacksjs/ts-cloud": resolveDashboardVersion() }
+      dependencies: { "@stacksjs/ts-cloud": dependency }
     };
-    writeFileSync(join4(stage, "package.json"), `${JSON.stringify(pkg, null, 2)}
+    writeFileSync(join5(stage, "package.json"), `${JSON.stringify(pkg, null, 2)}
 `);
     return liveStageDir();
   } catch (error) {
@@ -4232,18 +4976,18 @@ function stageLiveDashboardRoot(config, cwd, logger) {
   }
 }
 function resolveUiSource(cwd) {
-  if (existsSync2(join4(cwd, "packages", "ui", "pages")) || existsSync2(join4(cwd, "packages", "ui", "package.json"))) {
+  if (existsSync2(join5(cwd, "packages", "ui", "pages")) || existsSync2(join5(cwd, "packages", "ui", "package.json"))) {
     return { uiRoot: "packages/ui/dist", build: "cd packages/ui && bun install && bun run build" };
   }
   const here = dirname(fileURLToPath(import.meta.url));
   const candidates = [
-    join4(here, "ui"),
-    join4(here, "..", "ui"),
-    join4(here, "..", "..", "ui"),
-    join4(here, "..", "dist", "ui")
+    join5(here, "ui"),
+    join5(here, "..", "ui"),
+    join5(here, "..", "..", "ui"),
+    join5(here, "..", "dist", "ui")
   ];
   for (const dir of candidates) {
-    if (existsSync2(join4(dir, "index.html")) || existsSync2(join4(dir, "serverless.html")))
+    if (existsSync2(join5(dir, "index.html")) || existsSync2(join5(dir, "serverless.html")))
       return { uiRoot: dir, build: false };
   }
   return null;
@@ -4326,12 +5070,12 @@ function buildManagementDashboardArtifact(site, options) {
       logger.info(`Management dashboard: building UI (${site.build})`);
       execSync2(site.build, { cwd, stdio: "inherit" });
     }
-    const root = isAbsolute(site.root) ? site.root : join4(cwd, site.root);
+    const root = isAbsolute(site.root) ? site.root : join5(cwd, site.root);
     if (!existsSync2(root)) {
       logger.warn(`Management dashboard: build output not found at ${root} — skipping dashboard artifact.`);
       return null;
     }
-    const tarball = join4(tmpdir(), `${options.slug}-${options.siteName ?? MANAGEMENT_DASHBOARD_SITE}-${options.sha}.tar.gz`);
+    const tarball = join5(tmpdir(), `${options.slug}-${options.siteName ?? MANAGEMENT_DASHBOARD_SITE}-${options.sha}.tar.gz`);
     execSync2(`tar czf "${tarball}" -C "${root}" .`, { stdio: "inherit" });
     return tarball;
   } catch (error) {
@@ -4839,10 +5583,11 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
     return { success: false, error: hint };
   }
   const dbEnv = outputs.servicesPrivateIp ? buildFleetServicesEnv(outputs.servicesPrivateIp, resolveAppDatabase(config)) : buildManagedDbEnv(resolveAppDatabase(config));
-  const envWithServices = Object.keys(dbEnv).length > 0 ? { ...dbEnv, ...site.env || {} } : site.env || {};
+  const compute = config.infrastructure?.compute;
+  const proxyEnv = usesRpxProxy(compute) ? { HOST: "127.0.0.1" } : {};
+  const envWithServices = { ...dbEnv, ...proxyEnv, ...site.env || {} };
   if (isPhpSite(site)) {
-    const compute2 = config.infrastructure?.compute;
-    const phpVersion = site.phpVersion ?? compute2?.php?.default ?? compute2?.php?.versions?.[0];
+    const phpVersion = site.phpVersion ?? compute?.php?.default ?? compute?.php?.versions?.[0];
     const appBase2 = siteInstallBase(slug, siteName);
     const siteWithEnv = Object.keys(dbEnv).length > 0 ? { ...site, env: envWithServices } : site;
     const deployScript = buildLaravelDeployScript({
@@ -4852,7 +5597,7 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
       appBase: appBase2,
       defaultPhpVersion: phpVersion
     });
-    const useNginx = !usesRpxProxy(compute2);
+    const useNginx = !usesRpxProxy(compute);
     const sslProvider = resolveSslProvider(site);
     const customCert = sslProvider === "custom" && site.ssl?.certPath && site.ssl?.keyPath ? { certPath: site.ssl.certPath, keyPath: site.ssl.keyPath } : undefined;
     const poolScript = site.isolation ? buildPhpFpmPoolScript({ siteName, appBase: appBase2 }) : [];
@@ -4868,7 +5613,7 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
       redirects: site.redirects,
       ssl: customCert,
       auth: site.auth && site.auth.enabled !== false && site.auth.password ? { username: site.auth.username || "admin", password: site.auth.password, realm: site.auth.realm } : undefined,
-      serverSnippet: resolveNginxSnippet(site.nginx, compute2?.nginxTemplates),
+      serverSnippet: resolveNginxSnippet(site.nginx, compute?.nginxTemplates),
       clientMaxBodySize: site.nginx?.clientMaxBodySize,
       hsts: site.ssl?.hsts,
       tlsProtocols: site.ssl?.tlsProtocols,
@@ -4944,7 +5689,6 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
     zeroDowntime: site.zeroDowntime !== false,
     healthCheckPath: site.healthCheck?.path
   });
-  const compute = config.infrastructure?.compute;
   const wantsNginxStatic = kind === "server-static" && !usesRpxProxy(compute) && !!site.domain;
   const staticVhost = wantsNginxStatic ? buildNginxVhostScript({
     siteName,
@@ -5001,6 +5745,58 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
     perInstance: result.perInstance
   };
 }
+function shellSingleQuote(value) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function buildManagementDashboardServiceReconciliationScript(slug, desiredSiteNames) {
+  const prefix = `${slug}-dashboard-`;
+  const desiredUnits = desiredSiteNames.map((siteName) => `${slug}-${siteName}.service`);
+  return [
+    "set -euo pipefail",
+    `TS_CLOUD_DASHBOARD_PREFIX=${shellSingleQuote(prefix)}`,
+    `TS_CLOUD_DASHBOARD_DESIRED=${shellSingleQuote(` ${desiredUnits.join(" ")} `)}`,
+    "for TS_CLOUD_UNIT_FILE in /etc/systemd/system/*.service; do",
+    '  [ -e "$TS_CLOUD_UNIT_FILE" ] || continue',
+    '  TS_CLOUD_UNIT=$(basename "$TS_CLOUD_UNIT_FILE")',
+    '  case "$TS_CLOUD_UNIT" in',
+    '    "$TS_CLOUD_DASHBOARD_PREFIX"*.service)',
+    '      case "$TS_CLOUD_DASHBOARD_DESIRED" in',
+    '        *" $TS_CLOUD_UNIT "*) ;;',
+    "        *)",
+    '          systemctl disable --now "$TS_CLOUD_UNIT" 2>/dev/null || true',
+    '          rm -f "$TS_CLOUD_UNIT_FILE"',
+    "          ;;",
+    "      esac",
+    "      ;;",
+    "  esac",
+    "done",
+    "systemctl daemon-reload",
+    "systemctl reset-failed"
+  ];
+}
+async function reconcileManagementDashboardServices(driver, options, desiredSiteNames, logger) {
+  const { config, environment } = options;
+  const slug = config.project.slug;
+  const stackName = resolveProjectStackName(config, environment);
+  const targets = await driver.findComputeTargets({ slug, environment, role: "app", stackName });
+  if (targets.length === 0)
+    return true;
+  const result = await driver.runRemoteDeploy({
+    targets,
+    commands: buildManagementDashboardServiceReconciliationScript(slug, desiredSiteNames),
+    comment: `ts-cloud reconcile management dashboard ${slug}`,
+    tags: {
+      Project: slug,
+      Environment: environment,
+      Role: "app"
+    }
+  });
+  if (!result.success) {
+    logger.error(`Management dashboard reconciliation failed: ${result.error || "unknown error"}`);
+    return false;
+  }
+  return true;
+}
 async function ensureAttachModeDatabase(driver, options, logger) {
   const { config, environment } = options;
   if (!config.cloud?.attachTo)
@@ -5043,11 +5839,15 @@ async function deployAllComputeSites(options) {
   const { config, environment, driver, sha, runtime, tarballForSite, logger = noopLogger2 } = options;
   const slug = config.project.slug;
   const cwd = options.cwd ?? process.cwd();
+  const autoDashboard = options.managementDashboard !== false;
   const hadDashboard = hasManagementDashboardSite(config);
-  ensureManagementDashboard(config, { cwd, logger: { info: logger.info, warn: logger.warn } });
-  const injectedDashboardSites = hadDashboard ? [] : managementDashboardSiteNames(config);
-  if (options.rpxConfig && options.rpxConfig !== config && !hasManagementDashboardSite(options.rpxConfig))
+  if (autoDashboard)
+    ensureManagementDashboard(config, { cwd, logger: { info: logger.info, warn: logger.warn } });
+  const injectedDashboardSites = !autoDashboard || hadDashboard ? [] : managementDashboardSiteNames(config);
+  if (autoDashboard && options.rpxConfig && options.rpxConfig !== config && !hasManagementDashboardSite(options.rpxConfig))
     ensureManagementDashboard(options.rpxConfig, { cwd, logger: { info: () => {}, warn: () => {} } });
+  if (autoDashboard && !await reconcileManagementDashboardServices(driver, options, managementDashboardSiteNames(config), logger))
+    return false;
   let dashboardTarball = null;
   const dashboardTarballBySite = new Map;
   if (injectedDashboardSites.length > 0) {
@@ -5071,8 +5871,8 @@ async function deployAllComputeSites(options) {
           continue;
         }
         try {
-          const copy = join5(tmpdir2(), `${slug}-${name}-${sha}.tar.gz`);
-          copyFileSync(dashboardTarball, copy);
+          const copy = join6(tmpdir2(), `${slug}-${name}-${sha}.tar.gz`);
+          copyFileSync2(dashboardTarball, copy);
           dashboardTarballBySite.set(name, copy);
         } catch {
           dashboardTarballBySite.set(name, dashboardTarball);
@@ -5339,4 +6139,4 @@ function buildCloudFrontOriginConfig(options) {
     CustomErrorResponses: { Quantity: 0 }
   };
 }
-export { PANTRY_PROJECT_DIR, pgAdminCommand, BACKUP_RUNNER_PATH, buildBackupRestoreScript, siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, shipsARelease, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, dashboardCredentialsFile, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };
+export { PANTRY_PROJECT_DIR, pgAdminCommand, BACKUP_RUNNER_PATH, buildBackupRestoreScript, siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, shipsARelease, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, planHetznerServerResize, isHetznerCapacityError, executeHetznerServerResize, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, collectHetznerResizeManifest, prepareHetznerResize, verifyHetznerResize, resolveHetznerHostOptimizationPlan, buildHetznerHostOptimizationScript, applyHetznerHostOptimization, collectHetznerHostOptimizationReport, verifyHetznerHostOptimization, resizeCheckpointPath, resizeLockPath, readResizeCheckpoint, writeResizeCheckpoint, acquireResizeLock, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, dashboardCredentialsFile, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };