@stacksjs/ts-cloud 0.7.63 → 0.7.65

package/dist/{chunk-t092y37p.js → chunk-267f6qd0.js}

@@ -9,7 +9,7 @@ import {
   step,
   success,
   warn
-} from "./chunk-zvk0f89t.js";
+} from "./chunk-28vh1h91.js";
 import {
   AwsBackupClient,
   CloudWatchLogsClient,
@@ -45,7 +45,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-0zbqbrqg.js";
+} from "./chunk-0z7ry8fm.js";
 import {
   artifactKey,
   buildCloudFormationTemplate,
@@ -67,7 +67,7 @@ import {
   resolveStatePath,
   setStateDir,
   statePath
-} from "./chunk-tq46tnxv.js";
+} from "./chunk-ecsyc3p0.js";
 import {
   SSMClient
 } from "./chunk-703nkybg.js";
@@ -8317,7 +8317,7 @@ async function deployServerlessApp(config, environment2, opts = {}) {
   }
   if (imageMode) {
     step("Building + pushing container image");
-    const { buildAndPushServerlessImage } = await import("./chunk-rxhqny6z.js");
+    const { buildAndPushServerlessImage } = await import("./chunk-zcvdzvmz.js");
     const built = await buildAndPushServerlessImage({
       app,
       projectRoot,
@@ -36946,7 +36946,7 @@ var SECRET_PATTERNS = [
   },
   {
     name: "AWS Secret Access Key",
-    pattern: /(?:aws_secret_access_key|aws_secret_key|secret_access_key|secretAccessKey)\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gi,
+    pattern: /(?:aws_secret_access_key|aws_secret_key|secret_access_key|secretAccessKey)['"]?\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gi,
     severity: "critical",
     description: "AWS Secret Access Key detected"
   },
@@ -37289,7 +37289,11 @@ class PreDeployScanner {
         if (this.isLikelyPlaceholder(match[0], contextLine)) {
           continue;
         }
-        if (this.isLowEntropy(match[1] || match[0])) {
+        const candidate2 = match[1] || match[0];
+        if (pattern.name === "AWS Secret Key (Generic)" && /^[a-f0-9]{40}$/i.test(candidate2)) {
+          continue;
+        }
+        if (this.isLowEntropy(candidate2)) {
           continue;
         }
         findings.push({
@@ -38367,28 +38371,183 @@ var PROBED_SERVICES = [
   "meilisearch"
 ];
 var UNKNOWN = "-";
-function metricsScript() {
-  return [
+function sharedBoxProbeScript(projectFilter) {
+  const source = String.raw`
+import { basename, join } from 'node:path'
+import { existsSync, readdirSync, readFileSync, readlinkSync, statSync } from 'node:fs'
+
+const fragmentsRoot = '/etc/rpx/sites.d'
+const certsRoot = '/etc/rpx/certs'
+const projectFilter = ${JSON.stringify(projectFilter ?? "")}
+const configuredRoutes = []
+if (existsSync(fragmentsRoot)) {
+  for (const file of readdirSync(fragmentsRoot).filter(name => name.endsWith('.json')).sort()) {
+    try {
+      const fragment = JSON.parse(readFileSync(join(fragmentsRoot, file), 'utf8'))
+      const project = String(fragment.slug || basename(file, '.json'))
+      if (projectFilter && project !== projectFilter) continue
+      for (const route of Array.isArray(fragment.proxies) ? fragment.proxies : []) {
+        if (!route || !route.to) continue
+        const path = route.path || '/'
+        const staticRoot = typeof route.static === 'string' ? route.static : route.static?.dir
+        const kind = route.redirect ? 'redirect' : staticRoot ? 'static' : 'app'
+        const install = staticRoot || ''
+        const installName = install.match(/^\/var\/www\/(.+?)\/current(?:\/|$)/)?.[1]
+        const siteName = installName?.startsWith(project + '-') ? installName.slice(project.length + 1) : String(route.id || route.to)
+        const href = 'https://' + route.to + (path === '/' ? '' : path)
+        configuredRoutes.push({
+          name: siteName,
+          project,
+          route: path === '/' ? route.to : route.to + path,
+          href,
+          domain: route.to,
+          path,
+          kind,
+          runtime: kind === 'app' ? 'service' : kind,
+          deploy: kind === 'app' ? 'service' : kind === 'static' ? 'server static' : 'redirect',
+          tls: 'https',
+          root: install || (Array.isArray(route.from) ? route.from.join(', ') : route.from || 'gateway'),
+          branch: kind === 'static' ? 'build artifact' : 'main',
+          install,
+        })
+      }
+    }
+    catch {}
+  }
+}
+
+const routes = await Promise.all(configuredRoutes.map(async route => {
+  const started = performance.now()
+  let httpStatus = 0
+  const probe = async (href) => {
+    const response = await fetch(href, {
+      redirect: 'manual',
+      headers: { 'user-agent': 'ts-cloud-monitor/1.0' },
+      signal: AbortSignal.timeout(6000),
+    })
+    const status = response.status
+    await response.body?.cancel()
+    return status
+  }
+  try {
+    httpStatus = await probe(route.href)
+    if (httpStatus === 404 && route.kind === 'app') {
+      const healthHref = route.href.replace(/\/$/, '') + '/health'
+      httpStatus = await probe(healthHref)
+    }
+  }
+  catch {}
+  const responseMs = Math.max(0, Math.round(performance.now() - started))
+  let tlsDaysRemaining
+  const cert = join(certsRoot, route.domain + '.crt')
+  if (existsSync(cert)) {
+    const result = Bun.spawnSync(['openssl', 'x509', '-in', cert, '-noout', '-enddate'])
+    const expiry = result.success ? result.stdout.toString().trim().replace(/^notAfter=/, '') : ''
+    const expiresAt = Date.parse(expiry)
+    if (Number.isFinite(expiresAt)) tlsDaysRemaining = Math.floor((expiresAt - Date.now()) / 86400000)
+  }
+  let release
+  let deployedAt
+  if (route.install) {
+    try {
+      release = basename(readlinkSync(route.install))
+      deployedAt = statSync(route.install).mtime.toISOString()
+    }
+    catch {}
+  }
+  const status = httpStatus === 0 || httpStatus >= 500 ? 'failed' : httpStatus === 404 ? 'degraded' : 'live'
+  const { install, ...site } = route
+  return {
+    ...site,
+    status,
+    httpStatus,
+    responseMs,
+    tlsDaysRemaining,
+    checkedAt: new Date().toISOString(),
+    release,
+    deployedAt,
+  }
+}))
+for (const route of routes) console.log('DISCOVERED_SITE=' + Buffer.from(JSON.stringify(route)).toString('base64'))
+
+const serviceOutput = Bun.spawnSync([
+  'systemctl', 'list-units', '--type=service', '--state=running', '--no-legend', '--plain',
+]).stdout.toString()
+for (const line of serviceOutput.split('\n')) {
+  const unit = line.trim().split(/\s+/)[0]
+  if (!unit) continue
+  const properties = Bun.spawnSync([
+    'systemctl',
+    'show',
+    unit,
+    '--property=WorkingDirectory,ExecStart,MemoryCurrent,UnitFileState,ActiveEnterTimestamp',
+  ]).stdout.toString()
+  const values = Object.fromEntries(properties.split('\n').filter(Boolean).map(value => {
+    const separator = value.indexOf('=')
+    return separator < 0 ? [value, ''] : [value.slice(0, separator), value.slice(separator + 1)]
+  }))
+  if (!/^\/var\/www\/|^\/opt\/ts-cloud\//.test(values.WorkingDirectory || '') && !/\/var\/www\/|\/opt\/ts-cloud\//.test(values.ExecStart || '')) continue
+  console.log([
+    'SVC',
+    unit,
+    'active',
+    values.MemoryCurrent || '0',
+    values.UnitFileState || '-',
+    values.ActiveEnterTimestamp || '-',
+  ].join('='))
+}
+`;
+  return `echo '${Buffer.from(source).toString("base64")}' | base64 -d | bun -`;
+}
+function metricsScript(options = {}) {
+  const commands = [
     "set +e",
     'echo "CPUS=$(nproc 2>/dev/null || echo 1)"',
+    `read TS_TOTAL_1 TS_IDLE_1 <<EOF
+$(awk '/^cpu /{idle=$5+$6; total=0; for(i=2;i<=NF;i++) total+=$i; print total, idle; exit}' /proc/stat 2>/dev/null)
+EOF`,
+    "sleep 0.2",
+    `read TS_TOTAL_2 TS_IDLE_2 <<EOF
+$(awk '/^cpu /{idle=$5+$6; total=0; for(i=2;i<=NF;i++) total+=$i; print total, idle; exit}' /proc/stat 2>/dev/null)
+EOF`,
+    `echo "CPUUSED=$(awk -v t1="$TS_TOTAL_1" -v i1="$TS_IDLE_1" -v t2="$TS_TOTAL_2" -v i2="$TS_IDLE_2" 'BEGIN { dt=t2-t1; di=i2-i1; if (dt>0) printf "%.1f", 100*(dt-di)/dt; else print 0 }')"`,
     `echo "LOAD=$(cut -d' ' -f1 /proc/loadavg 2>/dev/null || echo 0)"`,
+    `echo "LOAD5=$(cut -d' ' -f2 /proc/loadavg 2>/dev/null || echo 0)"`,
+    `echo "LOAD15=$(cut -d' ' -f3 /proc/loadavg 2>/dev/null || echo 0)"`,
     `echo "MEMTOTAL=$(free -m 2>/dev/null | awk '/^Mem:/{print $2}')"`,
     `echo "MEMUSED=$(free -m 2>/dev/null | awk '/^Mem:/{print $3}')"`,
+    `echo "MEMAVAILABLE=$(free -m 2>/dev/null | awk '/^Mem:/{print $7}')"`,
+    `echo "MEMCACHE=$(free -m 2>/dev/null | awk '/^Mem:/{print $6}')"`,
+    `echo "SWAPTOTAL=$(free -m 2>/dev/null | awk '/^Swap:/{print $2}')"`,
+    `echo "SWAPUSED=$(free -m 2>/dev/null | awk '/^Swap:/{print $3}')"`,
     `echo "DISKPCT=$(df -P / 2>/dev/null | awk 'NR==2{gsub("%","",$5);print $5}')"`,
     `echo "DISKUSEDG=$(df -BG / 2>/dev/null | awk 'NR==2{gsub("G","",$3);print $3}')"`,
     `echo "DISKTOTG=$(df -BG / 2>/dev/null | awk 'NR==2{gsub("G","",$2);print $2}')"`,
+    `echo "INODEPCT=$(df -Pi / 2>/dev/null | awk 'NR==2{gsub("%","",$5);print $5}')"`,
+    `echo "NETRX=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{sum+=$3} END{print sum+0}' /proc/net/dev 2>/dev/null)"`,
+    `echo "NETTX=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{sum+=$11} END{print sum+0}' /proc/net/dev 2>/dev/null)"`,
+    `echo "PROCESSES=$(ps -e --no-headers 2>/dev/null | awk 'END{print NR+0}')"`,
     `echo "UPTIME=$(uptime -p 2>/dev/null | sed 's/^up //' || echo unknown)"`,
-    'echo "OS=$(. /etc/os-release 2>/dev/null; echo "$PRETTY_NAME")"',
-    `for s in ${PROBED_SERVICES.join(" ")}; do st=$(systemctl is-active "$s" 2>/dev/null); if [ -n "$st" ] && [ "$st" != "inactive" ] && [ "$st" != "unknown" ]; then mem=$(systemctl show "$s" -p MemoryCurrent --value 2>/dev/null); en=$(systemctl is-enabled "$s" 2>/dev/null); since=$(systemctl show "$s" -p ActiveEnterTimestamp --value 2>/dev/null); echo "SVC=$s=$st=$mem=$en=$since"; fi; done`,
-    "true"
+    `echo "UPTIME_SECONDS=$(cut -d' ' -f1 /proc/uptime 2>/dev/null || echo 0)"`,
+    'echo "OS=$(. /etc/os-release 2>/dev/null; echo "$PRETTY_NAME")"'
   ];
+  if (options.includeServices !== false)
+    commands.push(`for s in ${PROBED_SERVICES.join(" ")}; do st=$(systemctl is-active "$s" 2>/dev/null); if [ -n "$st" ] && [ "$st" != "inactive" ] && [ "$st" != "unknown" ]; then mem=$(systemctl show "$s" -p MemoryCurrent --value 2>/dev/null); en=$(systemctl is-enabled "$s" 2>/dev/null); since=$(systemctl show "$s" -p ActiveEnterTimestamp --value 2>/dev/null); echo "SVC=$s=$st=$mem=$en=$since"; fi; done`);
+  commands.push(sharedBoxProbeScript(options.projectFilter), "true");
+  return commands;
 }
 function parseBlock(output) {
-  const kv = { services: [] };
+  const kv = { services: [], discoveredSites: [] };
   for (const line of output.split(`
 `)) {
     const l = line.trim();
-    if (l.startsWith("SVC=")) {
+    if (l.startsWith("DISCOVERED_SITE=")) {
+      try {
+        const site = JSON.parse(Buffer.from(l.slice("DISCOVERED_SITE=".length), "base64").toString("utf8"));
+        if (site?.domain && site?.route)
+          kv.discoveredSites.push(site);
+      } catch {}
+    } else if (l.startsWith("SVC=")) {
       const [, name, status, memBytes, enabled, since] = /^SVC=([^=]+)=([^=]+)(?:=([^=]*)(?:=([^=]*)(?:=(.*))?)?)?$/.exec(l) ?? [];
       if (name) {
         kv.services.push({
@@ -38574,6 +38733,30 @@ function configuredSites(config6) {
     };
   });
 }
+function mergeDiscoveredSites(configured, discovered, ownerSlug) {
+  const routes = new Map(configured.map((site) => [String(site.route), { ...site, project: ownerSlug, managedBy: "owner" }]));
+  for (const site of discovered) {
+    const current = routes.get(site.route);
+    const name = current?.name ?? `${site.project}:${site.name}`;
+    routes.set(site.route, {
+      ...current,
+      ...site,
+      name,
+      kind: current?.kind ?? site.kind,
+      type: current?.type ?? site.kind,
+      runtime: current?.runtime ?? site.runtime,
+      deploy: current?.deploy ?? site.deploy,
+      root: current?.root ?? site.root,
+      branch: current?.branch ?? site.branch,
+      managedBy: site.project === ownerSlug ? "owner" : "attached"
+    });
+  }
+  return [...routes.values()].sort((a, b) => {
+    if (a.managedBy !== b.managedBy)
+      return a.managedBy === "owner" ? -1 : 1;
+    return String(a.route).localeCompare(String(b.route));
+  });
+}
 function shellSingleQuote(value2) {
   return `'${value2.replaceAll("'", "'\\''")}'`;
 }
@@ -38944,12 +39127,24 @@ function resolveConfigOnlyServerDashboardData(config6, environment2) {
     },
     systemMetrics: {
       load: 0,
+      load5: 0,
+      load15: 0,
+      cpuUsedPct: 0,
       cpus: Math.max(1, Number(config6.infrastructure?.compute?.instances ?? 1)),
       memUsedMb: 0,
       memTotalMb: 0,
+      memAvailableMb: 0,
+      memCacheMb: 0,
+      swapUsedMb: 0,
+      swapTotalMb: 0,
       diskUsedPct: 0,
       diskUsedGb: 0,
-      diskTotalGb: diskSize
+      diskTotalGb: diskSize,
+      inodeUsedPct: 0,
+      networkRxBytes: 0,
+      networkTxBytes: 0,
+      processes: 0,
+      uptimeSeconds: 0
     },
     metricsUnavailable: true,
     services,
@@ -38980,6 +39175,7 @@ function resolveConfigOnlyServerDashboardData(config6, environment2) {
         envKeys: Object.keys(site.env ?? site.environment ?? {})
       };
     }),
+    siteHealth: [],
     sshKeys: describeSshKeys(config6.infrastructure?.compute?.sshKeys ?? []),
     _serverReachable: false,
     _metricsStatus: "unavailable"
@@ -38988,7 +39184,7 @@ function resolveConfigOnlyServerDashboardData(config6, environment2) {
   out.activity = activityFeed(out);
   return out;
 }
-async function resolveServerDashboardData(config6, environment2) {
+async function resolveServerDashboardData(config6, environment2, options = {}) {
   if (!config6.infrastructure?.compute)
     return null;
   let driver = null;
@@ -39007,7 +39203,10 @@ async function resolveServerDashboardData(config6, environment2) {
       if (targets.length) {
         const result2 = await driver.runRemoteDeploy({
           targets: [targets[0]],
-          commands: metricsScript(),
+          commands: metricsScript({
+            includeServices: !options.telemetryOnly,
+            projectFilter: config6.cloud?.attachTo ? config6.project.slug : undefined
+          }),
           comment: `ts-cloud dashboard:build ${config6.project.slug}`,
           tags: { Project: config6.project.slug, Environment: environment2, Role: "app" }
         });
@@ -39029,19 +39228,32 @@ async function resolveServerDashboardData(config6, environment2) {
     out._metricsStatus = "live";
     out.systemMetrics = {
       load: num(parsed.LOAD),
+      load5: num(parsed.LOAD5),
+      load15: num(parsed.LOAD15),
+      cpuUsedPct: num(parsed.CPUUSED),
       cpus: num(parsed.CPUS, 1),
       memUsedMb: num(parsed.MEMUSED),
       memTotalMb: num(parsed.MEMTOTAL, 1),
+      memAvailableMb: num(parsed.MEMAVAILABLE),
+      memCacheMb: num(parsed.MEMCACHE),
+      swapUsedMb: num(parsed.SWAPUSED),
+      swapTotalMb: num(parsed.SWAPTOTAL),
       diskUsedPct: num(parsed.DISKPCT),
       diskUsedGb: num(parsed.DISKUSEDG),
-      diskTotalGb: num(parsed.DISKTOTG, 1)
+      diskTotalGb: num(parsed.DISKTOTG, 1),
+      inodeUsedPct: num(parsed.INODEPCT),
+      networkRxBytes: num(parsed.NETRX),
+      networkTxBytes: num(parsed.NETTX),
+      processes: num(parsed.PROCESSES),
+      uptimeSeconds: num(parsed.UPTIME_SECONDS)
     };
     if (parsed.services.length) {
-      out.services = parsed.services.map((s) => ({
+      const services = [...new Map(parsed.services.map((service16) => [service16.name, service16])).values()];
+      out.services = services.map((s) => ({
         name: s.name,
         status: s.status === "active" ? "running" : s.status
       }));
-      out.servicesDetail = parsed.services.map((s) => ({
+      out.servicesDetail = services.map((s) => ({
         name: s.name,
         status: s.status === "active" ? "running" : s.status,
         since: s.since && s.since !== UNKNOWN ? s.since : out.server.uptime,
@@ -39049,64 +39261,100 @@ async function resolveServerDashboardData(config6, environment2) {
         auto: s.enabled ? !["disabled", "static", "masked"].includes(s.enabled) : true
       }));
     }
-  }
-  if (driver && targets.length) {
-    try {
-      const siteNames = Object.keys(config6.sites ?? {});
-      const historyResult = await driver.runRemoteDeploy({
-        targets: [targets[0]],
-        commands: deployHistoryScript(siteNames, config6.project.slug),
-        comment: `ts-cloud dashboard:deploy-history ${config6.project.slug}`,
-        tags: { Project: config6.project.slug, Environment: environment2, Role: "app" }
-      });
-      const historyOutput = historyResult.perInstance?.[0]?.output ?? "";
-      const records = parseDeployHistory(historyOutput, config6.sites);
-      out.serverDeployments = records.slice(0, 5);
-      out.serverDeploymentsDetail = records.slice(0, 50);
-      out.deploymentsEmptyReason = records.length ? undefined : "No deployment history was found on the server yet. Deploy again to populate this timeline.";
-    } catch {
-      out.deploymentsEmptyReason = "Deployment history could not be read from the server.";
+    if (parsed.discoveredSites.length) {
+      out.sitesDetail = mergeDiscoveredSites(out.sitesDetail, parsed.discoveredSites, config6.project.slug);
+      out.sites = out.sitesDetail.map((site) => ({
+        name: site.name,
+        project: site.project,
+        managedBy: site.managedBy,
+        route: site.route,
+        href: site.href,
+        domain: site.domain,
+        path: site.path,
+        kind: site.kind,
+        type: site.type,
+        runtime: site.runtime,
+        deploy: site.deploy,
+        tls: site.tls,
+        status: site.status,
+        httpStatus: site.httpStatus,
+        responseMs: site.responseMs,
+        tlsDaysRemaining: site.tlsDaysRemaining,
+        checkedAt: site.checkedAt
+      }));
+      out.siteHealth = out.sitesDetail.map((site) => ({
+        name: site.name,
+        project: site.project,
+        route: site.route,
+        status: site.status,
+        httpStatus: site.httpStatus,
+        responseMs: site.responseMs,
+        tlsDaysRemaining: site.tlsDaysRemaining,
+        checkedAt: site.checkedAt
+      }));
     }
+  }
+  if (driver && targets.length && !options.telemetryOnly) {
+    await Promise.all([
+      (async () => {
+        try {
+          const siteNames = Object.keys(config6.sites ?? {});
+          const historyResult = await driver.runRemoteDeploy({
+            targets: [targets[0]],
+            commands: deployHistoryScript(siteNames, config6.project.slug),
+            comment: `ts-cloud dashboard:deploy-history ${config6.project.slug}`,
+            tags: { Project: config6.project.slug, Environment: environment2, Role: "app" }
+          });
+          const historyOutput = historyResult.perInstance?.[0]?.output ?? "";
+          const records = parseDeployHistory(historyOutput, config6.sites);
+          out.serverDeployments = records.slice(0, 5);
+          out.serverDeploymentsDetail = records.slice(0, 50);
+          out.deploymentsEmptyReason = records.length ? undefined : "No deployment history was found on the server yet. Deploy again to populate this timeline.";
+        } catch {
+          out.deploymentsEmptyReason = "Deployment history could not be read from the server.";
+        }
+      })(),
+      (async () => {
+        try {
+          const logsResult = await driver.runRemoteDeploy({
+            targets: [targets[0]],
+            commands: serverLogsScript(config6),
+            comment: `ts-cloud dashboard:server-logs ${config6.project.slug}`,
+            tags: { Project: config6.project.slug, Environment: environment2, Role: "app" }
+          });
+          const logsOutput = logsResult.perInstance?.[0]?.output ?? "";
+          const records = parseServerLogs(logsOutput);
+          out.serverLogs = records;
+          out.serverLogsEmptyReason = records.length ? undefined : "No recent journal entries were found for the managed server units.";
+        } catch {
+          out.serverLogsEmptyReason = "Server logs could not be read from the box.";
+        }
+      })(),
+      (async () => {
+        try {
+          const securityResult = await driver.runRemoteDeploy({
+            targets: [targets[0]],
+            commands: securityScript(config6),
+            comment: `ts-cloud dashboard:security ${config6.project.slug}`,
+            tags: { Project: config6.project.slug, Environment: environment2, Role: "app" }
+          });
+          const securityOutput = securityResult.perInstance?.[0]?.output ?? "";
+          const liveSecurity = parseServerSecurity(securityOutput);
+          const declaredSecurity = configuredSecurity(config6);
+          if (!liveSecurity.ports.length)
+            liveSecurity.ports = declaredSecurity.ports;
+          if (!liveSecurity.tlsCertificates.length)
+            liveSecurity.tlsCertificates = declaredSecurity.tlsCertificates;
+          out.security = liveSecurity;
+          out.securityEmptyReason = undefined;
+        } catch {
+          out.securityEmptyReason = "Server security checks could not be read from the box.";
+        }
+      })()
+    ]);
   } else if (driver && instanceCount === 0) {
     out.deploymentsEmptyReason = "No app server target was found for this environment.";
   }
-  if (driver && targets.length) {
-    try {
-      const logsResult = await driver.runRemoteDeploy({
-        targets: [targets[0]],
-        commands: serverLogsScript(config6),
-        comment: `ts-cloud dashboard:server-logs ${config6.project.slug}`,
-        tags: { Project: config6.project.slug, Environment: environment2, Role: "app" }
-      });
-      const logsOutput = logsResult.perInstance?.[0]?.output ?? "";
-      const records = parseServerLogs(logsOutput);
-      out.serverLogs = records;
-      out.serverLogsEmptyReason = records.length ? undefined : "No recent journal entries were found for the managed server units.";
-    } catch {
-      out.serverLogsEmptyReason = "Server logs could not be read from the box.";
-    }
-  }
-  if (driver && targets.length) {
-    try {
-      const securityResult = await driver.runRemoteDeploy({
-        targets: [targets[0]],
-        commands: securityScript(config6),
-        comment: `ts-cloud dashboard:security ${config6.project.slug}`,
-        tags: { Project: config6.project.slug, Environment: environment2, Role: "app" }
-      });
-      const securityOutput = securityResult.perInstance?.[0]?.output ?? "";
-      const liveSecurity = parseServerSecurity(securityOutput);
-      const declaredSecurity = configuredSecurity(config6);
-      if (!liveSecurity.ports.length)
-        liveSecurity.ports = declaredSecurity.ports;
-      if (!liveSecurity.tlsCertificates.length)
-        liveSecurity.tlsCertificates = declaredSecurity.tlsCertificates;
-      out.security = liveSecurity;
-      out.securityEmptyReason = undefined;
-    } catch {
-      out.securityEmptyReason = "Server security checks could not be read from the box.";
-    }
-  }
   const sshKeys = config6.infrastructure?.compute?.sshKeys ?? config6.infrastructure?.ssh?.keys ?? config6.infrastructure?.sshKeys;
   if (Array.isArray(sshKeys) && sshKeys.length) {
     out.sshKeys = describeSshKeys(sshKeys);
@@ -41982,7 +42230,9 @@ async function collectNow(context) {
   const scope2 = { projectId: context.projectId, environmentId: context.environmentId };
   const mode = resolveDeploymentMode(context.config);
   try {
-    const data = (mode === "serverless" ? await resolveDashboardData(context.config, context.environment) : await resolveServerDashboardData(context.config, context.environment)) ?? {};
+    const data = (mode === "serverless" ? await resolveDashboardData(context.config, context.environment) : await resolveServerDashboardData(context.config, context.environment, {
+      telemetryOnly: context.lightweight
+    })) ?? {};
     if (mode === "serverless") {
       for (const fn of data.functionsDetail ?? []) {
         const resourceId = resourceBySlug(context.controlPlane, context.projectId, context.environmentId, fn.key);
@@ -42151,14 +42401,30 @@ async function collectNow(context) {
       if (data.metricsUnavailable || !metrics)
         errors.push({ source: "host", message: "The host metrics probe is unavailable." });
       else {
+        const memoryUsedPercent = Number(metrics.memTotalMb) > 0 ? Number(metrics.memUsedMb) / Number(metrics.memTotalMb) * 100 : 0;
+        const swapUsedPercent = Number(metrics.swapTotalMb) > 0 ? Number(metrics.swapUsedMb) / Number(metrics.swapTotalMb) * 100 : 0;
         const values = [
           ["host.load", Number(metrics.load), "load"],
+          ["host.load.5m", Number(metrics.load5), "load"],
+          ["host.load.15m", Number(metrics.load15), "load"],
           ["host.cpu.capacity", Number(metrics.cpus), "count"],
+          ["host.cpu.used_percent", Number(metrics.cpuUsedPct), "percent"],
           ["host.memory.used", Number(metrics.memUsedMb) * 1024 * 1024, "bytes"],
           ["host.memory.total", Number(metrics.memTotalMb) * 1024 * 1024, "bytes"],
+          ["host.memory.available", Number(metrics.memAvailableMb) * 1024 * 1024, "bytes"],
+          ["host.memory.cache", Number(metrics.memCacheMb) * 1024 * 1024, "bytes"],
+          ["host.memory.used_percent", memoryUsedPercent, "percent"],
+          ["host.swap.used", Number(metrics.swapUsedMb) * 1024 * 1024, "bytes"],
+          ["host.swap.total", Number(metrics.swapTotalMb) * 1024 * 1024, "bytes"],
+          ["host.swap.used_percent", swapUsedPercent, "percent"],
           ["host.disk.used_percent", Number(metrics.diskUsedPct), "percent"],
           ["host.disk.used", Number(metrics.diskUsedGb) * 1024 ** 3, "bytes"],
-          ["host.disk.total", Number(metrics.diskTotalGb) * 1024 ** 3, "bytes"]
+          ["host.disk.total", Number(metrics.diskTotalGb) * 1024 ** 3, "bytes"],
+          ["host.disk.inode_used_percent", Number(metrics.inodeUsedPct), "percent"],
+          ["host.network.rx", Number(metrics.networkRxBytes), "bytes"],
+          ["host.network.tx", Number(metrics.networkTxBytes), "bytes"],
+          ["host.processes", Number(metrics.processes), "count"],
+          ["host.uptime", Number(metrics.uptimeSeconds), "seconds"]
         ];
         for (const [name, value2, unit] of values)
           if (Number.isFinite(value2))
@@ -42172,6 +42438,43 @@ async function collectNow(context) {
               value: value2,
               unit
             });
+        for (const site of data.siteHealth ?? []) {
+          const project = String(site.project ?? context.config.project.slug);
+          const displayName = String(site.name);
+          const siteName = displayName.startsWith(`${project}:`) ? displayName.slice(project.length + 1) : displayName;
+          const source = `site:${project}:${siteName}`;
+          const resourceId = resourceBySlug(context.controlPlane, context.projectId, context.environmentId, displayName);
+          const base = {
+            ...scope2,
+            resourceId,
+            source,
+            timestamp: site.checkedAt || now.toISOString(),
+            host: site.route,
+            attributes: {
+              project,
+              site: siteName,
+              route: String(site.route),
+              status: String(site.status)
+            }
+          };
+          const siteValues = [
+            ["site.health.up", site.status === "live" ? 1 : 0, "boolean"],
+            ["site.http.status", Number(site.httpStatus), "status"],
+            ["site.response.time", Number(site.responseMs), "ms"]
+          ];
+          if (site.tlsDaysRemaining != null)
+            siteValues.push(["site.tls.days_remaining", Number(site.tlsDaysRemaining), "days"]);
+          for (const [name, value2, unit] of siteValues)
+            if (Number.isFinite(value2))
+              records.push({
+                ...base,
+                id: id(source, name, base.timestamp),
+                kind: "metric",
+                name,
+                value: value2,
+                unit
+              });
+        }
       }
     }
   } catch (error2) {
@@ -42180,73 +42483,74 @@ async function collectNow(context) {
       message: error2 instanceof Error ? error2.message : String(error2)
     });
   }
-  try {
-    const inventory2 = await resolveRuntimeInventory(context.config, context.environment);
-    const runtime3 = new RuntimeOperationService(context.config, context.environment, {
-      inventory: async () => inventory2
-    });
-    for (const workload of inventory2.workloads) {
-      const resourceId = resourceBySlug(context.controlPlane, context.projectId, context.environmentId, workload.links.service);
-      const base = {
-        ...scope2,
-        resourceId,
-        source: `runtime:${workload.provider}`,
-        timestamp: now.toISOString(),
-        workloadId: workload.id,
-        releaseId: workload.links.release,
-        attributes: { status: workload.status, provider: workload.provider, service: workload.links.service ?? "" }
-      };
-      records.push({
-        ...base,
-        id: id(workload.id, "health", now.toISOString()),
-        kind: "metric",
-        name: "health.up",
-        value: workload.status === "running" ? 1 : 0,
-        unit: "boolean"
-      });
-      records.push({
-        ...base,
-        id: id(workload.id, "restarts", now.toISOString()),
-        kind: "metric",
-        name: "saturation.restarts",
-        value: workload.restartCount ?? 0,
-        unit: "count"
+  if (!context.lightweight)
+    try {
+      const inventory2 = await resolveRuntimeInventory(context.config, context.environment);
+      const runtime3 = new RuntimeOperationService(context.config, context.environment, {
+        inventory: async () => inventory2
       });
-      if (workload.resources?.memoryBytes != null)
+      for (const workload of inventory2.workloads) {
+        const resourceId = resourceBySlug(context.controlPlane, context.projectId, context.environmentId, workload.links.service);
+        const base = {
+          ...scope2,
+          resourceId,
+          source: `runtime:${workload.provider}`,
+          timestamp: now.toISOString(),
+          workloadId: workload.id,
+          releaseId: workload.links.release,
+          attributes: { status: workload.status, provider: workload.provider, service: workload.links.service ?? "" }
+        };
         records.push({
           ...base,
-          id: id(workload.id, "memory", now.toISOString()),
+          id: id(workload.id, "health", now.toISOString()),
           kind: "metric",
-          name: "runtime.memory.used",
-          value: workload.resources.memoryBytes,
-          unit: "bytes"
+          name: "health.up",
+          value: workload.status === "running" ? 1 : 0,
+          unit: "boolean"
         });
-      if (!workload.capabilities.logs.supported)
-        continue;
-      try {
-        const result2 = await runtime3.logs(workload.id, { limit: 100, since: new Date(now.getTime() - 5 * 60000) });
-        for (const line of result2.lines)
-          records.push(...telemetryRecordsFromLog({
-            ...scope2,
-            resourceId,
-            source: `runtime:${workload.provider}`,
-            name: `${workload.links.service ?? workload.name}.log`,
-            timestamp: line.timestamp,
-            message: line.message,
-            workloadId: workload.id
-          }));
-      } catch (error2) {
-        errors.push({
-          source: `runtime:${workload.provider}`,
-          message: error2 instanceof Error ? error2.message : String(error2)
+        records.push({
+          ...base,
+          id: id(workload.id, "restarts", now.toISOString()),
+          kind: "metric",
+          name: "saturation.restarts",
+          value: workload.restartCount ?? 0,
+          unit: "count"
         });
+        if (workload.resources?.memoryBytes != null)
+          records.push({
+            ...base,
+            id: id(workload.id, "memory", now.toISOString()),
+            kind: "metric",
+            name: "runtime.memory.used",
+            value: workload.resources.memoryBytes,
+            unit: "bytes"
+          });
+        if (!workload.capabilities.logs.supported)
+          continue;
+        try {
+          const result2 = await runtime3.logs(workload.id, { limit: 100, since: new Date(now.getTime() - 5 * 60000) });
+          for (const line of result2.lines)
+            records.push(...telemetryRecordsFromLog({
+              ...scope2,
+              resourceId,
+              source: `runtime:${workload.provider}`,
+              name: `${workload.links.service ?? workload.name}.log`,
+              timestamp: line.timestamp,
+              message: line.message,
+              workloadId: workload.id
+            }));
+        } catch (error2) {
+          errors.push({
+            source: `runtime:${workload.provider}`,
+            message: error2 instanceof Error ? error2.message : String(error2)
+          });
+        }
       }
+      for (const source of inventory2.sources.filter((source2) => source2.status !== "fresh"))
+        errors.push({ source: source.id, message: source.message ?? `Runtime source is ${source.status}.` });
+    } catch (error2) {
+      errors.push({ source: "runtime", message: error2 instanceof Error ? error2.message : String(error2) });
     }
-    for (const source of inventory2.sources.filter((source2) => source2.status !== "fresh"))
-      errors.push({ source: source.id, message: source.message ?? `Runtime source is ${source.status}.` });
-  } catch (error2) {
-    errors.push({ source: "runtime", message: error2 instanceof Error ? error2.message : String(error2) });
-  }
   for (const event of context.controlPlane.listEvents({ projectId: context.projectId, limit: 1000 })) {
     const payload2 = event.payload;
     records.push({
@@ -42293,8 +42597,9 @@ async function collectNow(context) {
 }
 async function collectDashboardTelemetry(context) {
   const key2 = `${context.projectId}:${context.environmentId ?? "all"}:${context.environment}`;
+  const tieredKey = `${key2}:${context.lightweight ? "lightweight" : "full"}`;
   const ttl = resolveDeploymentMode(context.config) === "serverless" ? 5 * 60000 : 60000;
-  const result2 = await collectionCache.getOrCreate(key2, ttl, !!context.force, () => collectNow(context));
+  const result2 = await collectionCache.getOrCreate(tieredKey, ttl, !!context.force, () => collectNow(context));
   return { ...result2.value, cached: result2.cached };
 }
 function invalidateDashboardTelemetryCache(projectId) {
@@ -42634,7 +42939,23 @@ function isTrustedMutationRequest(req) {
   if (site === "cross-site")
     return false;
   const origin = req.headers.get("origin");
-  return !origin || origin === new URL(req.url).origin;
+  if (!origin)
+    return true;
+  const requestUrl = new URL(req.url);
+  if (origin === requestUrl.origin)
+    return true;
+  if (site !== "same-origin")
+    return false;
+  try {
+    const originUrl = new URL(origin);
+    const forwardedHost = (req.headers.get("x-forwarded-host") ?? req.headers.get("host") ?? requestUrl.host).split(",")[0].trim();
+    const forwardedProto = req.headers.get("x-forwarded-proto")?.split(",")[0]?.trim();
+    if (!/^[A-Za-z0-9.-]+(?::\d{1,5})?$/.test(forwardedHost) || originUrl.host !== forwardedHost)
+      return false;
+    return !forwardedProto || originUrl.protocol === `${forwardedProto}:`;
+  } catch {
+    return false;
+  }
 }
 var ORGANIZATION_ROLES = new Set(["owner", "admin", "deployer", "operator", "viewer", "auditor"]);
 var AUTHORIZATION_SCOPES = new Set(["organization", "project", "environment", "resource"]);
@@ -43109,7 +43430,52 @@ async function startLocalDashboardServer(options = {}) {
   const configPath = resolveCloudConfigPath(cwd);
   const initialData = await resolveLiveDashboardData(config6, defaultEnvironment);
   const latestDataByEnvironment = new Map([[defaultEnvironment, initialData]]);
+  const liveDataRefreshesByEnvironment = new Map;
+  const refreshLatestDashboardData = (environment2) => {
+    const running = liveDataRefreshesByEnvironment.get(environment2);
+    if (running)
+      return running;
+    const refresh = resolveLiveDashboardData(config6, environment2).then((data) => {
+      const previous = latestDataByEnvironment.get(environment2);
+      latestDataByEnvironment.set(environment2, data);
+      if (previous?._serverReachable !== data._serverReachable || previous?._metricsStatus !== data._metricsStatus || (previous?.sitesDetail?.length ?? 0) !== (data.sitesDetail?.length ?? 0))
+        clearUiCache();
+      return data;
+    }).finally(() => liveDataRefreshesByEnvironment.delete(environment2));
+    liveDataRefreshesByEnvironment.set(environment2, refresh);
+    return refresh;
+  };
   const packagedUi = resolveUiSource(cwd);
+  const telemetryPreference = process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();
+  const backgroundTelemetryEnabled = options.box && telemetryPreference !== "0" && (telemetryPreference === "1" || !config6.cloud?.attachTo);
+  if (backgroundTelemetryEnabled) {
+    let telemetryCollectionRunning = false;
+    const collectHostHistory = async () => {
+      if (telemetryCollectionRunning)
+        return;
+      telemetryCollectionRunning = true;
+      try {
+        const environmentRecord = controlPlane.environments.get(defaultEnvironment);
+        await collectDashboardTelemetry({
+          controlPlane: controlPlane.store,
+          projectId: controlPlane.project.id,
+          environmentId: environmentRecord?.id,
+          config: config6,
+          environment: defaultEnvironment,
+          force: true,
+          lightweight: true
+        });
+      } catch (error2) {
+        if (options.verbose)
+          console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${error2 instanceof Error ? error2.message : String(error2)}`);
+      } finally {
+        telemetryCollectionRunning = false;
+      }
+    };
+    collectHostHistory();
+    const telemetryTimer = setInterval(() => void collectHostHistory(), 60000);
+    telemetryTimer.unref?.();
+  }
   const uiCache = new Map;
   const uiBuilds = new Map;
   const ownedUiRoots = new Set;
@@ -43683,6 +44049,7 @@ async function startLocalDashboardServer(options = {}) {
   const server = Bun.serve({
     hostname: host2,
     port,
+    idleTimeout: 30,
     websocket: {
       open(ws) {
         if (!terminalEnabled) {
@@ -43727,8 +44094,7 @@ async function startLocalDashboardServer(options = {}) {
         const environment2 = resolveDashboardEnvironment(availableEnvironments, defaultEnvironment, requestedEnvironment);
         let latestData = latestDataByEnvironment.get(environment2);
         if (!latestData) {
-          latestData = await resolveLiveDashboardData(config6, environment2);
-          latestDataByEnvironment.set(environment2, latestData);
+          latestData = await refreshLatestDashboardData(environment2);
         }
         try {
           if (!isTrustedMutationRequest(req))
@@ -47021,10 +47387,22 @@ This replacement link expires ${created.invitation.expiresAt} and can be used on
               environmentId: environmentRecord?.id,
               config: config6,
               environment: environment2,
-              force
+              force,
+              lightweight: !force
             });
+            const collectionSnapshot = () => {
+              const saved = controlPlane.store.getSetting(`telemetry.collection:${controlPlane.project.id}:${environmentRecord?.id ?? "all"}`) ?? {};
+              return {
+                generatedAt: String(saved.generatedAt ?? new Date().toISOString()),
+                cached: true,
+                statuses: Array.isArray(saved.statuses) ? saved.statuses : [],
+                errors: Array.isArray(saved.errors) ? saved.errors : [],
+                policy: saved.policy ?? loadTelemetryPolicy(controlPlane.store, controlPlane.project.id)
+              };
+            };
             if (url.pathname === "/api/telemetry/status" && req.method === "GET") {
-              const collection2 = await collect(false);
+              collect(false);
+              const collection2 = collectionSnapshot();
               const scopedStatuses = environmentWide ? collection2.statuses : telemetry2.status(controlPlane.project.id, environmentRecord?.id, collection2.policy.rawDays, collection2.policy.samplingRate, readableResources.map((resource2) => resource2.id));
               const estimatedMonthlyBytes = scopedStatuses.reduce((sum, source) => sum + source.estimatedDailyBytes * 30, 0);
               return json15({
@@ -47053,7 +47431,8 @@ This replacement link expires ${created.invitation.expiresAt} and can be used on
               return json15({ ok: true, policy: policy3 });
             }
             if (url.pathname === "/api/telemetry/query" && req.method === "GET") {
-              const collection2 = await collect(false);
+              collect(false);
+              const collection2 = collectionSnapshot();
               return json15({
                 ok: true,
                 collection: { generatedAt: collection2.generatedAt, cached: collection2.cached },
@@ -47061,7 +47440,7 @@ This replacement link expires ${created.invitation.expiresAt} and can be used on
               });
             }
             if (url.pathname === "/api/telemetry/tail" && req.method === "GET") {
-              await collect(false);
+              collect(false);
               const encoder = new TextEncoder;
               const initialTo = new Date;
               const baseQuery = queryFrom({
@@ -47142,7 +47521,8 @@ data: ${JSON.stringify({ cursor: position, at: new Date().toISOString() })}
               });
             }
             if (url.pathname === "/api/telemetry/series" && req.method === "GET") {
-              const collection2 = await collect(false);
+              collect(false);
+              const collection2 = collectionSnapshot();
               const aggregation = ["sum", "avg", "min", "max", "count", "p50", "p90", "p95", "p99"].includes(String(urlInput.aggregation)) ? urlInput.aggregation : "avg";
               const query = queryFrom({ ...urlInput, kinds: "metric", limit: 5000 });
               const series = telemetry2.series({
@@ -48363,8 +48743,8 @@ data: ${JSON.stringify({ cursor: position, at: new Date().toISOString() })}
             });
           }
           if (url.pathname === "/api/dashboard-data") {
-            latestData = await resolveLiveDashboardData(config6, environment2);
-            latestDataByEnvironment.set(environment2, latestData);
+            latestData = latestDataByEnvironment.get(environment2) ?? await refreshLatestDashboardData(environment2);
+            refreshLatestDashboardData(environment2);
             return json15(scopeDashboardData(latestData, { user: scopedUser, slug: config6.project.slug }));
           }
           if (url.pathname === "/api/users" && req.method === "GET")