@stacksjs/ts-cloud 0.7.63 → 0.7.65

package/dist/{chunk-zvk0f89t.js → chunk-28vh1h91.js}

@@ -8,7 +8,7 @@ import {
   phpRuntimeLayerAssets,
   runPhpBuildHooks,
   sha256
-} from "./chunk-tq46tnxv.js";
+} from "./chunk-ecsyc3p0.js";
 
 // src/deploy/serverless-image.ts
 import { execFileSync } from "node:child_process";

package/dist/{chunk-tq46tnxv.js → chunk-ecsyc3p0.js}

@@ -21928,7 +21928,7 @@ function dashboardHostFor(domain, ownedDomains) {
 function collectDomains(config, environment) {
   const candidates = [];
   const dnsDomain = config.infrastructure?.dns?.domain;
-  if (dnsDomain)
+  if (dnsDomain && !config.cloud?.attachTo)
     candidates.push(dnsDomain);
   if (environment && config.environments?.[environment]?.domain)
     candidates.push(config.environments[environment].domain);
@@ -21997,6 +21997,9 @@ function resolveManagementDashboardSites(config, environment, opts) {
       preStart: ["bun install --production --no-save"],
       start: `bun ${DASHBOARD_ENTRY} dashboard:serve --box --host 127.0.0.1 --port ${port}`,
       port,
+      env: {
+        TS_CLOUD_DASHBOARD_TELEMETRY: config.cloud?.attachTo ? "0" : "1"
+      },
       zeroDowntime: false,
       sharedPaths: [DASHBOARD_STATE_DIR],
       healthCheck: { path: "/login" },

package/dist/{chunk-rxhqny6z.js → chunk-zcvdzvmz.js}

@@ -1,8 +1,8 @@
 import {
   buildAndPushServerlessImage
-} from "./chunk-zvk0f89t.js";
+} from "./chunk-28vh1h91.js";
 import"./chunk-50jpda9q.js";
-import"./chunk-tq46tnxv.js";
+import"./chunk-ecsyc3p0.js";
 import"./chunk-zqtpg06c.js";
 import"./chunk-v0bahtg2.js";
 export {

package/dist/deploy/dashboard-data-server.d.ts

@@ -12,9 +12,33 @@ interface ProbedService {
     enabled?: string;
     since?: string;
 }
+export interface DiscoveredSite {
+    name: string;
+    project: string;
+    route: string;
+    href: string;
+    domain: string;
+    path: string;
+    kind: 'app' | 'static' | 'redirect';
+    runtime: string;
+    deploy: string;
+    tls: 'https';
+    root: string;
+    branch: string;
+    status: 'live' | 'degraded' | 'failed';
+    managedBy?: 'owner' | 'attached';
+    httpStatus: number;
+    responseMs: number;
+    tlsDaysRemaining?: number;
+    checkedAt: string;
+    release?: string;
+    deployedAt?: string;
+}
 export declare function parseBlock(output: string): Record<string, string> & {
     services: ProbedService[];
+    discoveredSites: DiscoveredSite[];
 };
+export declare function mergeDiscoveredSites(configured: Array<Record<string, any>>, discovered: DiscoveredSite[], ownerSlug: string): Array<Record<string, any>>;
 interface ServerLogSource {
     /** journalctl `-u` pattern (a unit name or a glob like `acme-web-queue-*`). */
     pattern: string;
@@ -32,5 +56,7 @@ export declare function parseServerLogs(output: string): Array<Record<string, an
 export declare function parseServerSecurity(output: string): Record<string, any>;
 export declare function parseDeployHistory(output: string, sites?: Record<string, any>): Array<Record<string, any>>;
 export declare function resolveConfigOnlyServerDashboardData(config: CloudConfig, environment: EnvironmentType): Record<string, any>;
-export declare function resolveServerDashboardData(config: CloudConfig, environment: EnvironmentType): Promise<Record<string, any> | null>;
+export declare function resolveServerDashboardData(config: CloudConfig, environment: EnvironmentType, options?: {
+    telemetryOnly?: boolean;
+}): Promise<Record<string, any> | null>;
 export {};

package/dist/deploy/index.js

@@ -32,7 +32,7 @@ import {
   synchronizeDashboardUsers,
   trackDashboardOperation,
   verifyStaticApiOrigin
-} from "../chunk-t092y37p.js";
+} from "../chunk-267f6qd0.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -46,7 +46,7 @@ import {
 } from "../chunk-gcsv7g83.js";
 import {
   buildAndPushServerlessImage
-} from "../chunk-zvk0f89t.js";
+} from "../chunk-28vh1h91.js";
 import"../chunk-ybcz6sxc.js";
 import"../chunk-01d86gt1.js";
 import"../chunk-50jpda9q.js";
@@ -65,8 +65,8 @@ import {
   shipsARelease,
   siteInstallBase,
   validateDeploymentConfig
-} from "../chunk-0zbqbrqg.js";
-import"../chunk-tq46tnxv.js";
+} from "../chunk-0z7ry8fm.js";
+import"../chunk-ecsyc3p0.js";
 import"../chunk-703nkybg.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-hpv68b4a.js";

package/dist/deploy/telemetry-collection.d.ts

@@ -29,6 +29,8 @@ export interface TelemetryCollectionContext {
     config: CloudConfig;
     environment: EnvironmentType;
     force?: boolean;
+    /** Collect host and site metrics without expensive runtime logs or inventory. */
+    lightweight?: boolean;
 }
 export declare function telemetryRecordsFromLog(input: {
     projectId: string;

package/dist/drivers/hetzner/client.d.ts

@@ -10,6 +10,54 @@ export interface HetznerApiErrorBody {
         details?: unknown;
     };
 }
+export declare class HetznerApiError extends Error {
+    readonly status: number;
+    readonly code?: string | undefined;
+    readonly details?: unknown;
+    constructor(message: string, status: number, code?: string | undefined, details?: unknown);
+}
+export declare class HetznerActionError extends Error {
+    readonly action: HetznerAction;
+    constructor(message: string, action: HetznerAction);
+}
+export interface HetznerServerTypeLocation {
+    id: number;
+    name: string;
+    available: boolean;
+    recommended: boolean;
+    deprecation?: unknown;
+}
+export interface HetznerServerTypePrice {
+    location: string;
+    price_hourly: {
+        net: string;
+        gross: string;
+    };
+    price_monthly: {
+        net: string;
+        gross: string;
+    };
+    included_traffic?: number;
+    price_per_tb_traffic?: {
+        net: string;
+        gross: string;
+    };
+}
+export interface HetznerServerType {
+    id?: number;
+    name: string;
+    architecture?: string;
+    cores?: number;
+    cpu_type?: string;
+    category?: string;
+    deprecated?: boolean;
+    description?: string;
+    disk?: number;
+    memory?: number;
+    prices?: HetznerServerTypePrice[];
+    storage_type?: string;
+    locations?: HetznerServerTypeLocation[];
+}
 export interface HetznerServer {
     id: number;
     name: string;
@@ -26,15 +74,24 @@ export interface HetznerServer {
         ip: string;
     }>;
     labels?: Record<string, string>;
-    server_type: {
+    server_type: HetznerServerType;
+    /** Current API shape. */
+    location?: {
+        id?: number;
         name: string;
+        description?: string;
+        city?: string;
+        country?: string;
     };
-    datacenter: {
+    /** Legacy API shape retained for compatibility with recorded fixtures. */
+    datacenter?: {
         name: string;
         location: {
             name: string;
         };
     };
+    primary_disk_size?: number;
+    locked?: boolean;
 }
 export interface HetznerFirewall {
     id: number;
@@ -65,6 +122,15 @@ export interface HetznerAction {
         message: string;
     };
 }
+export type HetznerServerMetricType = 'cpu' | 'disk' | 'network';
+export interface HetznerServerMetrics {
+    start: string;
+    end: string;
+    step: number;
+    time_series: Record<string, {
+        values: Array<[number, string]>;
+    }>;
+}
 export interface CreateServerOptions {
     name: string;
     serverType: string;
@@ -154,6 +220,14 @@ export declare class HetznerClient {
     private requestAll;
     listServers(): Promise<HetznerServer[]>;
     getServer(id: number): Promise<HetznerServer>;
+    getServerMetrics(id: number, options: {
+        types: HetznerServerMetricType[];
+        start: Date;
+        end: Date;
+        step?: number;
+    }): Promise<HetznerServerMetrics>;
+    listServerTypes(name?: string): Promise<HetznerServerType[]>;
+    getServerType(name: string): Promise<HetznerServerType | null>;
     createServer(options: CreateServerOptions): Promise<{
         server: HetznerServer;
         action: HetznerAction;
@@ -183,6 +257,10 @@ export declare class HetznerClient {
     }>): Promise<HetznerAction[]>;
     listSshKeys(): Promise<HetznerSshKey[]>;
     createSshKey(options: CreateSshKeyOptions): Promise<HetznerSshKey>;
+    getAction(actionId: number): Promise<HetznerAction>;
+    shutdownServer(serverId: number): Promise<HetznerAction>;
+    powerOnServer(serverId: number): Promise<HetznerAction>;
+    changeServerType(serverId: number, serverType: string, upgradeDisk: boolean): Promise<HetznerAction>;
     waitForAction(actionId: number, options?: {
         pollIntervalMs?: number;
         maxWaitMs?: number;
@@ -191,6 +269,10 @@ export declare class HetznerClient {
         pollIntervalMs?: number;
         maxWaitMs?: number;
     }): Promise<HetznerServer>;
+    waitForServerStatus(serverId: number, status: string, options?: {
+        pollIntervalMs?: number;
+        maxWaitMs?: number;
+    }): Promise<HetznerServer>;
 }
 /**
  * The Hetzner API token, or a clear error when none is configured.

package/dist/drivers/hetzner/host-optimization.d.ts

@@ -0,0 +1,33 @@
+import type { CloudConfig } from '@ts-cloud/core';
+import type { RemoteExecOptions } from '../shared/remote-exec';
+export interface HetznerHostOptimizationPlan {
+    firewallPorts: number[];
+    monitoring: boolean;
+    autoUpdates: boolean;
+    swapGb: number;
+    sshPasswordAuthentication: false;
+    journalMaxUse: string;
+    journalRetention: string;
+}
+export interface HetznerHostOptimizationReport {
+    firewallActive: boolean;
+    firewallPorts: number[];
+    passwordAuthentication: boolean;
+    rootPasswordLogin: boolean;
+    fail2banActive: boolean;
+    unattendedUpgradesActive: boolean;
+    metricsTimerActive: boolean;
+    metricsSnapshotFresh: boolean;
+    swapBytes: number;
+    journalBytes: number;
+    failedUnits: string[];
+    publicTcpPorts: number[];
+}
+export interface HetznerHostOptimizationOptions extends RemoteExecOptions {
+    host: string;
+}
+export declare function resolveHetznerHostOptimizationPlan(config: CloudConfig): HetznerHostOptimizationPlan;
+export declare function buildHetznerHostOptimizationScript(config: CloudConfig): string[];
+export declare function applyHetznerHostOptimization(config: CloudConfig, options: HetznerHostOptimizationOptions): Promise<void>;
+export declare function collectHetznerHostOptimizationReport(options: HetznerHostOptimizationOptions): Promise<HetznerHostOptimizationReport>;
+export declare function verifyHetznerHostOptimization(plan: HetznerHostOptimizationPlan, report: HetznerHostOptimizationReport): string[];

package/dist/drivers/hetzner/monitoring.d.ts

@@ -0,0 +1,46 @@
+import type { HetznerClient, HetznerServerMetrics } from './client';
+import type { RemoteExecOptions } from '../shared/remote-exec';
+export interface HetznerHostHistoryPoint {
+    timestamp: string;
+    cpuUsedPercent: number;
+    cpuUserPercent: number;
+    cpuSystemPercent: number;
+    cpuIowaitPercent: number;
+    memoryUsedPercent: number;
+    memoryUsedBytes: number;
+    memoryAvailableBytes: number;
+    swapUsedPercent: number;
+    swapUsedBytes: number;
+}
+export interface HetznerProviderMetricPoint {
+    timestamp: string;
+    value: number;
+}
+export interface HetznerServerMonitoring {
+    from: string;
+    to: string;
+    cores: number;
+    host: HetznerHostHistoryPoint[];
+    provider: Record<string, HetznerProviderMetricPoint[]>;
+    summary: {
+        cpuAveragePercent: number | null;
+        cpuPeakPercent: number | null;
+        memoryAveragePercent: number | null;
+        memoryPeakPercent: number | null;
+        memoryMinimumAvailableBytes: number | null;
+        swapPeakPercent: number | null;
+    };
+}
+export declare function parseSadfHostHistory(raw: string, from: Date, to: Date): HetznerHostHistoryPoint[];
+export declare function providerMetricSeries(metrics: HetznerServerMetrics): Record<string, HetznerProviderMetricPoint[]>;
+export declare function collectHetznerServerMonitoring(options: {
+    client: HetznerClient;
+    serverId: number;
+    cores: number;
+    from: Date;
+    to: Date;
+    step?: number;
+    remote: RemoteExecOptions & {
+        host: string;
+    };
+}): Promise<HetznerServerMonitoring>;

package/dist/drivers/hetzner/resize-remote.d.ts

@@ -0,0 +1,38 @@
+import type { RemoteExecOptions } from '../shared/remote-exec';
+import type { HetznerServerType } from './client';
+import type { HetznerResizeVerification } from './resize';
+export interface HetznerRouteProbe {
+    domain: string;
+    ok: boolean;
+    status?: number;
+    error?: string;
+}
+export interface HetznerResizeManifest {
+    capturedAt: string;
+    hostname: string;
+    cpuCores: number;
+    memoryBytes: number;
+    rootSource: string;
+    rootFsType: string;
+    rootDiskBytes: number;
+    rootFilesystemBytes: number;
+    failedUnits: string[];
+    runningServices: string[];
+    releaseLinks: string[];
+    routeFragments: string[];
+    routeIds: string[];
+    routeDomains: string[];
+    persistentData: string[];
+    dataCatalog: string[];
+    routeProbes: HetznerRouteProbe[];
+}
+export interface HetznerRemoteResizeOptions extends RemoteExecOptions {
+    host: string;
+    sshTimeoutMs?: number;
+    routeTimeoutMs?: number;
+}
+export declare function collectHetznerResizeManifest(options: HetznerRemoteResizeOptions): Promise<HetznerResizeManifest>;
+export declare function prepareHetznerResize(options: HetznerRemoteResizeOptions): Promise<HetznerResizeManifest>;
+export declare function verifyHetznerResize(options: HetznerRemoteResizeOptions, target: HetznerServerType, before?: HetznerResizeManifest, context?: {
+    recovered: boolean;
+}): Promise<HetznerResizeVerification>;

package/dist/drivers/hetzner/resize-state.d.ts

@@ -0,0 +1,24 @@
+import type { HetznerResizePhase } from './resize';
+import type { HetznerResizeManifest } from './resize-remote';
+export interface HetznerResizeCheckpoint {
+    schemaVersion: 1;
+    operationId: string;
+    stackName: string;
+    serverId: number;
+    serverName: string;
+    sourceType: string;
+    targetType: string;
+    upgradeDisk: boolean;
+    phase: HetznerResizePhase;
+    status: 'running' | 'waiting-capacity' | 'completed' | 'recovered' | 'failed';
+    attempts: number;
+    startedAt: string;
+    updatedAt: string;
+    manifest?: HetznerResizeManifest;
+    lastError?: string;
+}
+export declare function resizeCheckpointPath(stackName: string): string;
+export declare function resizeLockPath(stackName: string): string;
+export declare function readResizeCheckpoint(stackName: string): Promise<HetznerResizeCheckpoint | null>;
+export declare function writeResizeCheckpoint(checkpoint: HetznerResizeCheckpoint): Promise<void>;
+export declare function acquireResizeLock(stackName: string, staleAfterMs?: number): Promise<() => Promise<void>>;

package/dist/drivers/hetzner/resize.d.ts

@@ -0,0 +1,86 @@
+import type { HetznerAction, HetznerClient, HetznerServer, HetznerServerType } from './client';
+export type HetznerResizePhase = 'planning' | 'waiting-capacity' | 'preflight' | 'shutting-down' | 'resizing' | 'powering-on' | 'verifying' | 'recovering' | 'complete';
+export interface HetznerResizePlan {
+    serverId: number;
+    serverName: string;
+    location: string;
+    currentType: HetznerServerType;
+    targetType: HetznerServerType;
+    capacityAvailable: boolean;
+    alreadyComplete: boolean;
+    upgradeDisk: boolean;
+}
+export interface HetznerResizeVerification {
+    ok: boolean;
+    checks?: Record<string, boolean | number | string>;
+    failures?: string[];
+}
+export interface HetznerResizeHooks<TManifest = unknown> {
+    preflight?: (server: HetznerServer, target: HetznerServerType) => Promise<TManifest> | TManifest;
+    afterBoot?: (server: HetznerServer, target: HetznerServerType, manifest: TManifest | undefined, context: {
+        recovered: boolean;
+    }) => Promise<HetznerResizeVerification> | HetznerResizeVerification;
+    onPhase?: (phase: HetznerResizePhase, detail?: Record<string, unknown>) => Promise<void> | void;
+}
+export interface HetznerResizeClient {
+    getServer(id: number): Promise<HetznerServer>;
+    getServerType(name: string): Promise<HetznerServerType | null>;
+    shutdownServer(id: number): Promise<HetznerAction>;
+    powerOnServer(id: number): Promise<HetznerAction>;
+    changeServerType(id: number, serverType: string, upgradeDisk: boolean): Promise<HetznerAction>;
+    waitForAction(actionId: number, options?: {
+        pollIntervalMs?: number;
+        maxWaitMs?: number;
+    }): Promise<HetznerAction>;
+    waitForServerRunning(serverId: number, options?: {
+        pollIntervalMs?: number;
+        maxWaitMs?: number;
+    }): Promise<HetznerServer>;
+    waitForServerStatus(serverId: number, status: string, options?: {
+        pollIntervalMs?: number;
+        maxWaitMs?: number;
+    }): Promise<HetznerServer>;
+}
+export interface ExecuteHetznerResizeOptions<TManifest = unknown> {
+    client: HetznerResizeClient;
+    serverId: number;
+    targetType: string;
+    upgradeDisk?: boolean;
+    /** Continue a recorded resize after the process stopped with the server off. */
+    resumeFromOff?: boolean;
+    /** Manifest restored from a durable checkpoint when resuming. */
+    manifest?: TManifest;
+    /** Ignore the best-effort stock flag and ask the placement API anyway. */
+    attemptUnavailable?: boolean;
+    hooks?: HetznerResizeHooks<TManifest>;
+    actionPollIntervalMs?: number;
+    actionTimeoutMs?: number;
+    serverPollIntervalMs?: number;
+    serverTimeoutMs?: number;
+}
+export type HetznerResizeResult<TManifest = unknown> = {
+    status: 'waiting-capacity';
+    plan: HetznerResizePlan;
+} | {
+    status: 'already-complete';
+    plan: HetznerResizePlan;
+    verification?: HetznerResizeVerification;
+} | {
+    status: 'completed';
+    plan: HetznerResizePlan;
+    server: HetznerServer;
+    manifest?: TManifest;
+    verification?: HetznerResizeVerification;
+} | {
+    status: 'recovered';
+    plan: HetznerResizePlan;
+    server: HetznerServer;
+    manifest?: TManifest;
+    verification?: HetznerResizeVerification;
+    retryable: boolean;
+    error: string;
+};
+export declare function planHetznerServerResize(client: Pick<HetznerResizeClient, 'getServer' | 'getServerType'>, serverId: number, targetTypeName: string, upgradeDisk?: boolean): Promise<HetznerResizePlan>;
+export declare function isHetznerCapacityError(error: unknown): boolean;
+export declare function executeHetznerServerResize<TManifest = unknown>(options: ExecuteHetznerResizeOptions<TManifest>): Promise<HetznerResizeResult<TManifest>>;
+export type HetznerResizeClientInstance = Pick<HetznerClient, 'getServer' | 'getServerType' | 'shutdownServer' | 'powerOnServer' | 'changeServerType' | 'waitForAction' | 'waitForServerRunning' | 'waitForServerStatus'>;

package/dist/drivers/index.d.ts

@@ -3,6 +3,14 @@ export { AwsDriver } from './aws/driver';
 export { HetznerDriver } from './hetzner/driver';
 export { isBoxMode, LocalBoxDriver } from './local-box/driver';
 export { HetznerClient, normalizeSshPublicKey, resolveHetznerApiToken } from './hetzner/client';
+export { executeHetznerServerResize, isHetznerCapacityError, planHetznerServerResize, } from './hetzner/resize';
+export type { ExecuteHetznerResizeOptions, HetznerResizeHooks, HetznerResizePhase, HetznerResizePlan, HetznerResizeResult, HetznerResizeVerification, } from './hetzner/resize';
+export { collectHetznerResizeManifest, prepareHetznerResize, verifyHetznerResize, } from './hetzner/resize-remote';
+export type { HetznerRemoteResizeOptions, HetznerResizeManifest, HetznerRouteProbe, } from './hetzner/resize-remote';
+export { applyHetznerHostOptimization, buildHetznerHostOptimizationScript, collectHetznerHostOptimizationReport, resolveHetznerHostOptimizationPlan, verifyHetznerHostOptimization, } from './hetzner/host-optimization';
+export type { HetznerHostOptimizationOptions, HetznerHostOptimizationPlan, HetznerHostOptimizationReport, } from './hetzner/host-optimization';
+export { acquireResizeLock, readResizeCheckpoint, resizeCheckpointPath, resizeLockPath, writeResizeCheckpoint, } from './hetzner/resize-state';
+export type { HetznerResizeCheckpoint } from './hetzner/resize-state';
 export { generateUbuntuAppCloudInit, wrapCloudInitUserData } from './hetzner/cloud-init';
 export { ensureFirewall, ensureServer, ensureSshKey, serverPublicIpv4 } from './hetzner/provision';
 export type { EnsuredResource, EnsuredServer, EnsureFirewallOptions, EnsureServerOptions, EnsureSshKeyOptions, } from './hetzner/provision';

package/dist/drivers/index.js

@@ -14,9 +14,12 @@ import {
   RPX_LAUNCHER_PATH,
   RPX_SERVICE_NAME,
   UBUNTU_2404_AMI_PARAM,
+  acquireResizeLock,
+  applyHetznerHostOptimization,
   buildAwsArtifactFetch,
   buildBoxUserData,
   buildCloudFrontOriginConfig,
+  buildHetznerHostOptimizationScript,
   buildHostCleanupScript,
   buildLocalArtifactFetch,
   buildRpxConfig,
@@ -28,6 +31,8 @@ import {
   buildStaticSiteDeployScript,
   buildUbuntuBootstrapScript,
   cloudDrivers,
+  collectHetznerHostOptimizationReport,
+  collectHetznerResizeManifest,
   createBoxProvisioner,
   createCloudDriver,
   deployAllComputeSites,
@@ -36,47 +41,69 @@ import {
   ensureFirewall,
   ensureServer,
   ensureSshKey,
+  executeHetznerServerResize,
   isBoxMode,
+  isHetznerCapacityError,
   normalizeRoutePath,
   normalizeSshPublicKey,
+  planHetznerServerResize,
+  prepareHetznerResize,
+  readResizeCheckpoint,
   releaseTarballTmpPath,
   reloadRpxGateway,
   renderRpxLauncher,
   renewRpxCertificates,
+  resizeCheckpointPath,
+  resizeLockPath,
   resolveExecStart,
   resolveHetznerApiToken,
+  resolveHetznerHostOptimizationPlan,
   scpUpload,
   serverPublicIpv4,
   sshExec,
   sshExecOrThrow,
+  verifyHetznerHostOptimization,
+  verifyHetznerResize,
   waitForCloudInit,
   waitForSsh,
-  wrapCloudInitUserData
-} from "../chunk-0zbqbrqg.js";
-import"../chunk-tq46tnxv.js";
+  wrapCloudInitUserData,
+  writeResizeCheckpoint
+} from "../chunk-0z7ry8fm.js";
+import"../chunk-ecsyc3p0.js";
 import"../chunk-703nkybg.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-wj3s95p9.js";
 import"../chunk-zqtpg06c.js";
 import"../chunk-v0bahtg2.js";
 export {
+  writeResizeCheckpoint,
   wrapCloudInitUserData,
   waitForSsh,
   waitForCloudInit,
+  verifyHetznerResize,
+  verifyHetznerHostOptimization,
   sshExecOrThrow,
   sshExec,
   serverPublicIpv4,
   scpUpload,
+  resolveHetznerHostOptimizationPlan,
   resolveHetznerApiToken,
   resolveExecStart,
+  resizeLockPath,
+  resizeCheckpointPath,
   renewRpxCertificates,
   renderRpxLauncher,
   reloadRpxGateway,
   releaseTarballTmpPath,
+  readResizeCheckpoint,
+  prepareHetznerResize,
+  planHetznerServerResize,
   normalizeSshPublicKey,
   normalizeRoutePath,
+  isHetznerCapacityError,
   isBoxMode,
   buildUbuntuBootstrapScript as generateUbuntuAppCloudInit,
+  executeHetznerServerResize,
   ensureSshKey,
   ensureServer,
   ensureFirewall,
@@ -85,6 +112,8 @@ export {
   deployAllComputeSites,
   createCloudDriver,
   createBoxProvisioner,
+  collectHetznerResizeManifest,
+  collectHetznerHostOptimizationReport,
   cloudDrivers,
   buildStaticSiteDeployScript,
   buildSshArgs,
@@ -95,9 +124,12 @@ export {
   buildRpxConfig,
   buildLocalArtifactFetch,
   buildHostCleanupScript,
+  buildHetznerHostOptimizationScript,
   buildCloudFrontOriginConfig,
   buildBoxUserData,
   buildAwsArtifactFetch,
+  applyHetznerHostOptimization,
+  acquireResizeLock,
   UBUNTU_2404_AMI_PARAM,
   RPX_SERVICE_NAME,
   RPX_LAUNCHER_PATH,

package/dist/drivers/shared/compute-deploy.d.ts

@@ -20,6 +20,13 @@ export interface DeployAllSitesOptions {
     logger?: ComputeDeployLogger;
     /** Project root used to resolve/build the management dashboard UI. Defaults to `process.cwd()`. */
     cwd?: string;
+    /**
+     * Auto-inject the management dashboard when the caller has not already
+     * prepared it. Framework integrations that inject before provisioning must
+     * disable this for narrowed single-site deploys, otherwise the dashboard is
+     * unexpectedly added back to the narrowed site set.
+     */
+    managementDashboard?: boolean;
     /**
      * The FULL site model for regenerating the rpx gateway, distinct from `config`
      * which may be narrowed to a single site for a partial deploy. The rpx gateway
@@ -28,6 +35,14 @@ export interface DeployAllSitesOptions {
      */
     rpxConfig?: CloudConfig;
 }
+/**
+ * Reconcile only the auto-managed dashboard units for one project. Dashboard
+ * host derivation can legitimately change when ownership metadata is fixed;
+ * without this bounded cleanup, the superseded unit remains enabled forever
+ * and can keep crash-looping on its old port. Release data and shared dashboard
+ * state stay on disk for recovery.
+ */
+export declare function buildManagementDashboardServiceReconciliationScript(slug: string, desiredSiteNames: string[]): string[];
 /**
  * Deploy every site that targets the compute server — both dynamic apps
  * (`server` + `start`, run as systemd services) and static sites (`server`

package/dist/drivers/shared/ufw.d.ts

@@ -11,7 +11,9 @@ import type { ComputeFirewallConfig } from '@ts-cloud/core';
 /** Ports always allowed so SSH deploys + web traffic are never locked out. */
 export declare const UFW_BASE_PORTS: readonly number[];
 /**
- * Build the UFW provisioning commands. Idempotent: `ufw allow` is a no-op when
- * a rule already exists, and `--force enable` is safe to re-run.
+ * Build the UFW provisioning commands. The ts-cloud declaration owns the host
+ * firewall, so every reconciliation resets stale/manual rules before applying
+ * the exact desired set. This prevents a removed app port from remaining
+ * publicly reachable forever.
  */
 export declare function buildUfwScript(firewall?: ComputeFirewallConfig): string[];