@synap-core/eve 0.1.0

package/dist/chunk-23XQDB7K.js

@@ -0,0 +1,1773 @@
+import { createRequire as __eveCreateRequire } from 'module'; const require = __eveCreateRequire(import.meta.url);
+import {
+  entityStateManager
+} from "./chunk-5TBV2VHZ.js";
+import {
+  COMPONENTS,
+  resolveComponent,
+  validateBaseDomain
+} from "./chunk-O5WTCVMZ.js";
+import {
+  readEveSecrets,
+  writeEveSecrets
+} from "./chunk-T7GCAJK5.js";
+
+// ../@eve/legs/dist/index.js
+import { execSync, spawnSync } from "child_process";
+import { writeFileSync, readFileSync, existsSync, mkdirSync, readdirSync, chmodSync, unlinkSync } from "fs";
+import { join } from "path";
+import { execSync as execSync2 } from "child_process";
+import { writeFileSync as writeFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
+import { join as join3 } from "path";
+import { execSync as execSync3 } from "child_process";
+import { spawnSync as spawnSync2, execSync as execSync4 } from "child_process";
+import { existsSync as existsSync4 } from "fs";
+import { execSync as execSync5, spawnSync as spawnSync3 } from "child_process";
+import { existsSync as existsSync5, readFileSync as readFileSync3 } from "fs";
+import { execSync as execSync6, spawnSync as spawnSync4 } from "child_process";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "fs";
+import { join as join4 } from "path";
+import { randomBytes } from "crypto";
+import { execFile } from "child_process";
+import { promisify } from "util";
+import { execSync as execSync7, spawnSync as spawnSync5 } from "child_process";
+import { existsSync as existsSync6 } from "fs";
+import { homedir } from "os";
+import { resolve } from "path";
+var HOST_CONFIG_DIR = "/opt/traefik";
+var CONTAINER_DYNAMIC_DIR = "/etc/traefik/dynamic";
+var CONTAINER_ACME_FILE = "/etc/traefik/acme.json";
+function getSynapBackendContainer() {
+  return findComposeContainer("backend");
+}
+function getSynapPodAdminContainer() {
+  return findComposeContainer("pod-admin");
+}
+function findComposeContainer(service) {
+  try {
+    const out = execSync(
+      `docker ps --filter "label=com.docker.compose.project=synap-backend" --filter "label=com.docker.compose.service=${service}" --format "{{.Names}}"`,
+      { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] }
+    ).trim();
+    return out.split("\n")[0]?.trim() || null;
+  } catch {
+    return null;
+  }
+}
+function connectToEveNetwork(containerName, alias) {
+  if (alias) {
+    try {
+      const inspect = execSync(
+        `docker inspect --format "{{json .NetworkSettings.Networks}}" ${containerName}`,
+        { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] }
+      ).trim();
+      const networks = JSON.parse(inspect);
+      const eve = networks["eve-network"];
+      if (eve) {
+        if ((eve.Aliases ?? []).includes(alias)) return;
+        try {
+          execSync(`docker network disconnect eve-network ${containerName}`, {
+            stdio: ["pipe", "pipe", "ignore"]
+          });
+        } catch {
+        }
+      }
+    } catch {
+    }
+  }
+  const aliasArg = alias ? ` --alias ${alias}` : "";
+  try {
+    execSync(`docker network connect${aliasArg} eve-network ${containerName}`, {
+      stdio: ["pipe", "pipe", "ignore"]
+    });
+  } catch {
+  }
+}
+var TRUSTED_PROXY_IPS = [
+  "10.0.0.0/8",
+  "172.16.0.0/12",
+  "192.168.0.0/16",
+  "127.0.0.1/32"
+];
+function buildStaticConfig(ssl, email) {
+  const acmeSection = ssl && email ? `
+certificatesResolvers:
+  letsencrypt:
+    acme:
+      email: ${email}
+      storage: ${CONTAINER_ACME_FILE}
+      tlsChallenge: {}
+` : "";
+  return `# Traefik static config \u2014 generated by Eve
+entryPoints:
+  web:
+    address: ":80"
+  websecure:
+    address: ":443"
+
+providers:
+  file:
+    directory: ${CONTAINER_DYNAMIC_DIR}
+    watch: true
+${acmeSection}
+api:
+  dashboard: true
+  insecure: true
+
+log:
+  level: INFO
+
+accessLog: {}
+`.trimStart();
+}
+function buildProxyModeStaticConfig() {
+  const trustedIps = TRUSTED_PROXY_IPS.map((ip) => `        - "${ip}"`).join("\n");
+  return `# Traefik static config \u2014 generated by Eve (behind-proxy mode)
+# External proxy handles SSL termination. Traefik listens on HTTP only.
+entryPoints:
+  web:
+    address: ":80"
+    forwardedHeaders:
+      trustedIPs:
+${trustedIps}
+
+providers:
+  file:
+    directory: ${CONTAINER_DYNAMIC_DIR}
+    watch: true
+
+api:
+  dashboard: true
+  insecure: true
+
+log:
+  level: INFO
+
+accessLog: {}
+`.trimStart();
+}
+function getDockerHostGateway() {
+  try {
+    const gw = execSync(
+      "docker network inspect eve-network --format '{{range .IPAM.Config}}{{.Gateway}}{{end}}' 2>/dev/null",
+      { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] }
+    ).trim();
+    if (gw) return gw;
+  } catch {
+  }
+  try {
+    const gw = execSync(
+      "docker network inspect bridge --format '{{range .IPAM.Config}}{{.Gateway}}{{end}}' 2>/dev/null",
+      { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] }
+    ).trim();
+    if (gw) return gw;
+  } catch {
+  }
+  return "172.17.0.1";
+}
+function allowDockerToHostPorts(ports) {
+  try {
+    const networks = execSync(
+      "docker network ls --format '{{.Name}}' | grep -E 'eve-network|bridge' | while read net; do docker network inspect $net --format '{{range .IPAM.Config}}{{.Subnet}}{{end}}' 2>/dev/null; done",
+      { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] }
+    ).trim().split("\n").filter(Boolean);
+    for (const cidr of networks) {
+      for (const port of ports) {
+        try {
+          execSync(`ufw allow from ${cidr} to any port ${port} 2>/dev/null`, {
+            stdio: ["pipe", "pipe", "ignore"]
+          });
+        } catch {
+        }
+      }
+    }
+  } catch {
+  }
+}
+var TraefikService = class {
+  configDir;
+  traefikConfigPath;
+  dynamicConfigDir;
+  constructor(configDir = HOST_CONFIG_DIR) {
+    this.configDir = configDir;
+    this.traefikConfigPath = join(configDir, "traefik.yml");
+    this.dynamicConfigDir = join(configDir, "dynamic");
+  }
+  async install() {
+    console.log("Installing Traefik...");
+    if (!existsSync(this.configDir)) mkdirSync(this.configDir, { recursive: true });
+    if (!existsSync(this.dynamicConfigDir)) mkdirSync(this.dynamicConfigDir, { recursive: true });
+    const isDokploy = existsSync("/opt/dokploy");
+    if (isDokploy) {
+      console.log("Detected Dokploy \u2014 using existing Traefik installation");
+      await this.configureDokployTraefik();
+    } else {
+      await this.installStandalone();
+    }
+    console.log("Traefik installation complete");
+  }
+  async installStandalone() {
+    writeFileSync(this.traefikConfigPath, buildStaticConfig(false));
+    console.log("Created Traefik static config");
+    try {
+      execSync("docker network create eve-network", { stdio: "ignore" });
+    } catch {
+    }
+    const acmePath = join(this.configDir, "acme.json");
+    if (!existsSync(acmePath)) {
+      writeFileSync(acmePath, "", { mode: 384 });
+    } else {
+      try {
+        chmodSync(acmePath, 384);
+      } catch {
+      }
+    }
+    spawnSync("docker", ["rm", "-f", "eve-legs-traefik"], { stdio: "ignore" });
+    const result = spawnSync("docker", [
+      "run",
+      "-d",
+      "--name",
+      "eve-legs-traefik",
+      "--restart",
+      "unless-stopped",
+      "-p",
+      "80:80",
+      "-p",
+      "443:443",
+      "-p",
+      "8080:8080",
+      "-v",
+      "/var/run/docker.sock:/var/run/docker.sock:ro",
+      "-v",
+      `${this.configDir}/traefik.yml:/etc/traefik/traefik.yml:ro`,
+      "-v",
+      `${this.dynamicConfigDir}:/etc/traefik/dynamic:ro`,
+      "-v",
+      `${acmePath}:/etc/traefik/acme.json`,
+      "--network",
+      "eve-network",
+      "traefik:v3.0"
+    ], { stdio: "inherit" });
+    if (result.status !== 0) throw new Error(`docker run exited with code ${result.status}`);
+    console.log("Traefik container started");
+  }
+  async configureDokployTraefik() {
+    console.log("Using Dokploy-managed Traefik");
+  }
+  async configureSubdomains(domain, ssl, email, installedComponents, behindProxy = false, customRoutes) {
+    const synapContainer = getSynapBackendContainer();
+    if (synapContainer) {
+      connectToEveNetwork(synapContainer, "eve-brain-synap");
+      console.log(`  Connected ${synapContainer} \u2192 eve-network (alias: eve-brain-synap)`);
+    } else if (!installedComponents || installedComponents.includes("synap")) {
+      console.warn("  Warning: Synap backend container not found \u2014 pod.domain routing will 502 until `eve brain init` is run");
+    }
+    const podAdminContainer = getSynapPodAdminContainer();
+    if (podAdminContainer) {
+      connectToEveNetwork(podAdminContainer, "eve-brain-pod-admin");
+      console.log(`  Connected ${podAdminContainer} \u2192 eve-network (alias: eve-brain-pod-admin)`);
+    }
+    let effectiveInstalled = installedComponents;
+    if (effectiveInstalled && effectiveInstalled.includes("synap") && !effectiveInstalled.includes("pod-admin")) {
+      effectiveInstalled = [...effectiveInstalled, "pod-admin"];
+    }
+    const services = [];
+    const pathRoutes = [];
+    for (const comp of COMPONENTS) {
+      if (!comp.service || !comp.service.subdomain) continue;
+      if (effectiveInstalled && !effectiveInstalled.includes(comp.id)) continue;
+      let containerName = comp.service.containerName;
+      if (comp.id === "synap" && synapContainer) containerName = synapContainer;
+      if (comp.id === "pod-admin" && podAdminContainer) containerName = podAdminContainer;
+      services.push({
+        id: comp.id,
+        subdomain: comp.service.subdomain,
+        upstream: `http://${containerName}:${comp.service.internalPort}`,
+        requires: comp.id
+      });
+      for (const extra of comp.service.additionalSubdomains ?? []) {
+        services.push({
+          id: `${comp.id}-${extra.subdomain}`,
+          subdomain: extra.subdomain,
+          upstream: `http://${containerName}:${extra.internalPort}`,
+          requires: comp.id,
+          priority: 1
+        });
+        for (const proxy of extra.pathProxies ?? []) {
+          pathRoutes.push({
+            id: `${comp.id}-${extra.subdomain}-${proxy.path.replace(/\//g, "")}`,
+            subdomain: extra.subdomain,
+            path: proxy.path,
+            upstream: `http://${containerName}:${proxy.internalPort}`,
+            requires: comp.id
+          });
+        }
+      }
+    }
+    if (customRoutes && customRoutes.length > 0) {
+      allowDockerToHostPorts(customRoutes.map((r) => r.port));
+      for (const route of customRoutes) {
+        const routeDomain = route.domain || domain;
+        const subdomain = route.subdomain;
+        const hostGateway = getDockerHostGateway();
+        const upstream = `http://${hostGateway}:${route.port}`;
+        services.push({
+          id: `custom-${subdomain}`,
+          subdomain,
+          upstream,
+          requires: null,
+          domain: routeDomain
+        });
+        console.log(`  Added custom route: ${subdomain}.${routeDomain} \u2192 ${upstream}`);
+      }
+    }
+    const routersYaml = services.map((s) => {
+      const routeDomain = s.domain || domain;
+      const host = `${s.subdomain}.${routeDomain}`;
+      if (behindProxy) {
+        return `    ${s.id}:
+      rule: "Host(\`${host}\`)"
+` + (s.priority !== void 0 ? `      priority: ${s.priority}
+` : "") + `      entryPoints:
+        - web
+      middlewares:
+        - forward-https
+      service: ${s.id}-svc`;
+      }
+      if (ssl) {
+        return (
+          // HTTP → HTTPS redirect router
+          `    ${s.id}-http:
+      rule: "Host(\`${host}\`)"
+      entryPoints:
+        - web
+      middlewares:
+        - redirect-to-https
+      service: ${s.id}-svc
+    ${s.id}:
+      rule: "Host(\`${host}\`)"
+      entryPoints:
+        - websecure
+      tls:
+        certResolver: letsencrypt
+      service: ${s.id}-svc`
+        );
+      }
+      return `    ${s.id}-http:
+      rule: "Host(\`${host}\`)"
+      entryPoints:
+        - web
+      service: ${s.id}-svc
+    ${s.id}-https:
+      rule: "Host(\`${host}\`)"
+      entryPoints:
+        - websecure
+      tls: {}
+      service: ${s.id}-svc`;
+    }).join("\n");
+    const servicesYaml = services.map(
+      (s) => `    ${s.id}-svc:
+      loadBalancer:
+` + (behindProxy ? `        passHostHeader: true
+` : "") + `        servers:
+          - url: "${s.upstream}"`
+    ).join("\n");
+    const synapRealtimeContainer = findComposeContainer("realtime");
+    const synapService = services.find((s) => s.id === "synap");
+    let realtimeRouterYaml = "";
+    let realtimeServiceYaml = "";
+    if (synapService && synapRealtimeContainer) {
+      connectToEveNetwork(synapRealtimeContainer);
+      const rHost = `${synapService.subdomain}.${domain}`;
+      const rRule = `Host(\`${rHost}\`) && (PathPrefix(\`/socket.io/\`) || PathPrefix(\`/realtime/\`))`;
+      const rUpstream = `http://${synapRealtimeContainer}:4001`;
+      if (behindProxy) {
+        realtimeRouterYaml = `
+    synap-realtime:
+      rule: "${rRule}"
+      priority: 100
+      entryPoints:
+        - web
+      middlewares:
+        - forward-https
+      service: synap-realtime-svc`;
+      } else if (ssl) {
+        realtimeRouterYaml = `
+    synap-realtime-http:
+      rule: "${rRule}"
+      priority: 100
+      entryPoints:
+        - web
+      middlewares:
+        - redirect-to-https
+      service: synap-realtime-svc
+    synap-realtime:
+      rule: "${rRule}"
+      priority: 100
+      entryPoints:
+        - websecure
+      tls:
+        certResolver: letsencrypt
+      service: synap-realtime-svc`;
+      } else {
+        realtimeRouterYaml = `
+    synap-realtime-http:
+      rule: "${rRule}"
+      priority: 100
+      entryPoints:
+        - web
+      service: synap-realtime-svc
+    synap-realtime-https:
+      rule: "${rRule}"
+      priority: 100
+      entryPoints:
+        - websecure
+      tls: {}
+      service: synap-realtime-svc`;
+      }
+      realtimeServiceYaml = `
+    synap-realtime-svc:
+      loadBalancer:
+` + (behindProxy ? `        passHostHeader: true
+` : "") + `        servers:
+          - url: "${rUpstream}"`;
+    }
+    const middlewaresYaml = behindProxy ? `  middlewares:
+    forward-https:
+      headers:
+        customRequestHeaders:
+          X-Forwarded-Proto: "https"
+` : !ssl ? "" : `  middlewares:
+    redirect-to-https:
+      redirectScheme:
+        scheme: https
+        permanent: true
+`;
+    const pathRoutesYaml = pathRoutes.length === 0 ? "" : "\n" + pathRoutes.map((p) => {
+      const host = `${p.subdomain}.${domain}`;
+      if (behindProxy) {
+        return `    ${p.id}:
+      rule: "Host(\`${host}\`) && Path(\`${p.path}\`)"
+      priority: 10
+      entryPoints:
+        - web
+      middlewares:
+        - forward-https
+      service: ${p.id}-svc`;
+      }
+      if (ssl) {
+        return `    ${p.id}:
+      rule: "Host(\`${host}\`) && Path(\`${p.path}\`)"
+      priority: 10
+      entryPoints:
+        - websecure
+      tls:
+        certResolver: letsencrypt
+      service: ${p.id}-svc`;
+      }
+      return `    ${p.id}:
+      rule: "Host(\`${host}\`) && Path(\`${p.path}\`)"
+      priority: 10
+      entryPoints:
+        - web
+      service: ${p.id}-svc`;
+    }).join("\n");
+    const pathServicesYaml = pathRoutes.length === 0 ? "" : "\n" + pathRoutes.map(
+      (p) => `    ${p.id}-svc:
+      loadBalancer:
+` + (behindProxy ? `        passHostHeader: true
+` : "") + `        servers:
+          - url: "${p.upstream}"`
+    ).join("\n");
+    const modeComment = behindProxy ? "behind-proxy" : ssl ? "ssl" : "plain";
+    const dynamicConfig = `# Eve subdomain routes \u2014 generated by \`eve domain set\`
+# Domain: ${domain} | Mode: ${modeComment}
+http:
+${middlewaresYaml}  routers:
+${routersYaml}${realtimeRouterYaml}${pathRoutesYaml}
+  services:
+${servicesYaml}${realtimeServiceYaml}${pathServicesYaml}
+`;
+    if (!existsSync(this.configDir)) mkdirSync(this.configDir, { recursive: true });
+    writeFileSync(this.traefikConfigPath, behindProxy ? buildProxyModeStaticConfig() : buildStaticConfig(ssl, email));
+    if (!existsSync(this.dynamicConfigDir)) mkdirSync(this.dynamicConfigDir, { recursive: true });
+    writeFileSync(join(this.dynamicConfigDir, "eve-routes.yml"), dynamicConfig, "utf-8");
+    try {
+      execSync("docker restart eve-legs-traefik", { stdio: "ignore" });
+      console.log("  Traefik restarted");
+    } catch {
+      console.warn("  Could not restart Traefik automatically \u2014 run: docker restart eve-legs-traefik");
+    }
+  }
+  // ---------------------------------------------------------------------------
+  // Proxy mode
+  // ---------------------------------------------------------------------------
+  /**
+   * Detect whether Traefik is currently running in behind-proxy mode by
+   * checking whether the static config has no `websecure` entrypoint.
+   */
+  getProxyModeStatus() {
+    try {
+      const config = readFileSync(this.traefikConfigPath, "utf-8");
+      const enabled = !config.includes("websecure");
+      const ssl = config.includes("certificatesResolvers");
+      return {
+        enabled,
+        ssl: !enabled && ssl,
+        entrypoints: enabled ? ["web"] : ["web", "websecure"]
+      };
+    } catch {
+      return { enabled: false, ssl: false, entrypoints: [] };
+    }
+  }
+  /**
+   * Switch Traefik to behind-proxy mode:
+   *   - HTTP-only static config (no websecure, no cert resolver, trusted IPs)
+   *   - Dynamic routes without redirects or TLS
+   *   - Recreate container without port 443 binding
+   */
+  async enableProxyMode(domain, installedComponents) {
+    if (!existsSync(this.configDir)) mkdirSync(this.configDir, { recursive: true });
+    if (!existsSync(this.dynamicConfigDir)) mkdirSync(this.dynamicConfigDir, { recursive: true });
+    writeFileSync(this.traefikConfigPath, buildProxyModeStaticConfig());
+    const synapContainer = getSynapBackendContainer();
+    if (synapContainer) connectToEveNetwork(synapContainer, "eve-brain-synap");
+    await this.configureSubdomains(domain, false, void 0, installedComponents, true);
+    const acmePath = join(this.configDir, "acme.json");
+    if (!existsSync(acmePath)) {
+      writeFileSync(acmePath, "", { mode: 384 });
+    } else {
+      try {
+        chmodSync(acmePath, 384);
+      } catch {
+      }
+    }
+    this.recreateTraefikContainer(["80:80", "8080:8080"], acmePath);
+  }
+  /**
+   * Restore standalone mode (Traefik handles its own SSL).
+   */
+  async disableProxyMode(domain, ssl, email, installedComponents) {
+    if (!existsSync(this.configDir)) mkdirSync(this.configDir, { recursive: true });
+    await this.configureSubdomains(domain, ssl, email, installedComponents, false);
+    const acmePath = join(this.configDir, "acme.json");
+    if (!existsSync(acmePath)) {
+      writeFileSync(acmePath, "", { mode: 384 });
+    } else {
+      try {
+        chmodSync(acmePath, 384);
+      } catch {
+      }
+    }
+    this.recreateTraefikContainer(["80:80", "443:443", "8080:8080"], acmePath);
+  }
+  /** Stop + remove + relaunch the Traefik container with the given port bindings. */
+  recreateTraefikContainer(ports, acmePath) {
+    spawnSync("docker", ["rm", "-f", "eve-legs-traefik"], { stdio: "ignore" });
+    const result = spawnSync("docker", [
+      "run",
+      "-d",
+      "--name",
+      "eve-legs-traefik",
+      "--restart",
+      "unless-stopped",
+      ...ports.flatMap((p) => ["-p", p]),
+      "-v",
+      "/var/run/docker.sock:/var/run/docker.sock:ro",
+      "-v",
+      `${this.traefikConfigPath}:/etc/traefik/traefik.yml:ro`,
+      "-v",
+      `${this.dynamicConfigDir}:/etc/traefik/dynamic:ro`,
+      "-v",
+      `${acmePath}:/etc/traefik/acme.json`,
+      "--network",
+      "eve-network",
+      "traefik:v3.0"
+    ], { stdio: "inherit" });
+    if (result.status !== 0) throw new Error(`docker run exited with code ${result.status}`);
+  }
+  // ---------------------------------------------------------------------------
+  // Routes
+  // ---------------------------------------------------------------------------
+  async addRoute(route) {
+    const configFile = join(this.dynamicConfigDir, `${route.path.replace(/\//g, "_")}.yml`);
+    const routeConfig = `http:
+  routers:
+    ${route.path.replace(/[^a-zA-Z0-9]/g, "_")}:
+      rule: "Host(\`${route.domain || "localhost"}\`) && PathPrefix(\`${route.path}\`)"
+      service: ${route.path.replace(/[^a-zA-Z0-9]/g, "_")}
+` + (route.ssl ? `      tls: {}
+` : "") + `  services:
+    ${route.path.replace(/[^a-zA-Z0-9]/g, "_")}:
+      loadBalancer:
+        servers:
+          - url: "${route.target}"
+`;
+    writeFileSync(configFile, routeConfig);
+  }
+  async removeRoute(path) {
+    const configFile = join(this.dynamicConfigDir, `${path.replace(/\//g, "_")}.yml`);
+    if (existsSync(configFile)) writeFileSync(configFile, "");
+  }
+  async configureDomain(domain) {
+    const routes = this.getRoutes();
+    for (const route of routes) await this.addRoute({ ...route, domain });
+  }
+  async enableSSL() {
+    const routes = this.getRoutes();
+    for (const route of routes) {
+      if (route.domain) await this.addRoute({ ...route, ssl: true });
+    }
+  }
+  getRoutes() {
+    try {
+      if (!existsSync(this.dynamicConfigDir)) return [];
+      const files = readdirSafe(this.dynamicConfigDir).filter((f) => f.endsWith(".yml") && f !== "eve-routes.yml");
+      return files.flatMap((file) => {
+        const content = readFileSync(join(this.dynamicConfigDir, file), "utf-8");
+        const pathMatch = content.match(/PathPrefix\(`(.+)`\)/);
+        const urlMatch = content.match(/url: "(.+)"/);
+        if (!pathMatch || !urlMatch) return [];
+        return [{
+          path: pathMatch[1],
+          target: urlMatch[1],
+          domain: content.match(/Host\(`(.+?)`\)/)?.[1],
+          ssl: content.includes("tls:")
+        }];
+      });
+    } catch {
+      return [];
+    }
+  }
+  getStatus() {
+    const installed = existsSync(this.traefikConfigPath);
+    let running = false;
+    try {
+      const out = execSync('docker ps --filter "name=eve-legs-traefik" --format "{{.Names}}"', { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] }).trim();
+      running = out.length > 0;
+    } catch {
+    }
+    const routes = this.getRoutes();
+    const proxyStatus = this.getProxyModeStatus();
+    let domain = routes.find((r) => r.domain)?.domain ?? null;
+    let ssl = routes.some((r) => r.ssl);
+    const eveRoutesPath = join(this.dynamicConfigDir, "eve-routes.yml");
+    if (existsSync(eveRoutesPath)) {
+      try {
+        const content = readFileSync(eveRoutesPath, "utf-8");
+        const hostMatch = content.match(/Host\(`([^`]+)`\)/);
+        if (hostMatch) {
+          const host = hostMatch[1];
+          const parts = host.split(".");
+          domain = parts.length > 2 ? parts.slice(1).join(".") : host;
+        }
+        ssl = content.includes("certResolver:");
+      } catch {
+      }
+    }
+    return {
+      installed,
+      running,
+      domain,
+      ssl,
+      behindProxy: proxyStatus.enabled,
+      routes
+    };
+  }
+  cleanConfig() {
+    if (existsSync(this.dynamicConfigDir)) {
+      for (const file of readdirSafe(this.dynamicConfigDir)) {
+        if (file.endsWith(".yml") || file.endsWith(".yaml")) {
+          try {
+            unlinkSync(join(this.dynamicConfigDir, file));
+          } catch {
+          }
+        }
+      }
+    }
+    if (existsSync(this.traefikConfigPath)) {
+      try {
+        unlinkSync(this.traefikConfigPath);
+      } catch {
+      }
+    }
+  }
+};
+function readdirSafe(dir) {
+  try {
+    return readdirSync(dir);
+  } catch {
+    return [];
+  }
+}
+var TunnelService = class {
+  configDir;
+  constructor(configDir = "/opt/hestia/tunnels") {
+    this.configDir = configDir;
+    if (!existsSync2(this.configDir)) {
+      mkdirSync2(this.configDir, { recursive: true });
+    }
+  }
+  async setupPangolin(config) {
+    console.log("Setting up Pangolin tunnel...");
+    try {
+      execSync2("which pangolin", { stdio: "ignore" });
+      console.log("Pangolin CLI already installed");
+    } catch {
+      console.log("Installing Pangolin CLI...");
+      execSync2("curl -fsSL https://get.pangolin.cloud | sh", { stdio: "inherit" });
+    }
+    const pangolinConfig = {
+      server: config?.server || "pangolin.to",
+      domain: config?.domain,
+      autoUpdate: true
+    };
+    writeFileSync2(
+      join2(this.configDir, "pangolin.json"),
+      JSON.stringify(pangolinConfig, null, 2)
+    );
+    console.log("Pangolin configured successfully");
+  }
+  async setupCloudflare(config) {
+    console.log("Setting up Cloudflare tunnel...");
+    try {
+      execSync2("which cloudflared", { stdio: "ignore" });
+      console.log("cloudflared already installed");
+    } catch {
+      console.log("Installing cloudflared...");
+      execSync2("npm install -g cloudflared", { stdio: "inherit" });
+    }
+    const cfConfig = {
+      tunnel: null,
+      "credentials-file": join2(this.configDir, "cloudflare-credentials.json"),
+      ingress: [
+        {
+          hostname: config?.domain,
+          service: "http://localhost:3000"
+        },
+        {
+          service: "http_status:404"
+        }
+      ]
+    };
+    writeFileSync2(
+      join2(this.configDir, "cloudflare.yml"),
+      JSON.stringify(cfConfig, null, 2)
+    );
+    console.log("Cloudflare tunnel configured");
+  }
+  startTunnel(provider) {
+    console.log(`Starting ${provider} tunnel...`);
+    if (provider === "pangolin") {
+      execSync2("pangolin start", { stdio: "inherit" });
+    } else {
+      execSync2("cloudflared tunnel run", { stdio: "inherit" });
+    }
+  }
+  stopTunnel(provider) {
+    console.log(`Stopping ${provider} tunnel...`);
+    try {
+      if (provider === "pangolin") {
+        execSync2("pkill pangolin", { stdio: "ignore" });
+      } else {
+        execSync2("pkill cloudflared", { stdio: "ignore" });
+      }
+      console.log(`${provider} tunnel stopped`);
+    } catch {
+      console.log(`${provider} tunnel was not running`);
+    }
+  }
+  getConfig() {
+    try {
+      const configPath = join2(this.configDir, "config.json");
+      if (!existsSync2(configPath)) {
+        return null;
+      }
+      return JSON.parse(readFileSync2(configPath, "utf-8"));
+    } catch {
+      return null;
+    }
+  }
+};
+async function runLegsProxySetup(options) {
+  console.log("\u{1F9B5} Setting up Legs (Traefik reverse proxy)...\n");
+  const traefik = options.standalone ? new TraefikService("/opt/eve/traefik") : new TraefikService();
+  console.log("Step 1: Installing Traefik...");
+  await traefik.install();
+  console.log("\nStep 2: Configuring routes...");
+  const organs = [
+    { name: "brain", path: "/brain", port: 3e3 },
+    { name: "heart", path: "/heart", port: 4e3 },
+    { name: "memory", path: "/memory", port: 5432 },
+    { name: "nerves", path: "/nerves", port: 6379 },
+    { name: "eyes", path: "/eyes", port: 8080 },
+    { name: "dna", path: "/dna", port: 9e3 }
+  ];
+  for (const organ of organs) {
+    const target = `http://localhost:${organ.port}`;
+    await traefik.addRoute({
+      path: organ.path,
+      target,
+      domain: options.domain,
+      ssl: false
+    });
+    console.log(`  \u2713 Route: ${organ.path} -> ${target}`);
+  }
+  if (options.tunnel) {
+    const tunnelMode = options.tunnel === "cloudflare_tunnel" ? "cloudflare" : options.tunnel === "pangolin_tunnel" ? "pangolin" : options.tunnel;
+    console.log(`
+Step 3: Setting up ${tunnelMode} tunnel...`);
+    const tunnel = new TunnelService();
+    if (tunnelMode === "pangolin") {
+      await tunnel.setupPangolin({ domain: options.tunnelDomain });
+      console.log("  \u2713 Pangolin tunnel configured");
+    } else if (tunnelMode === "cloudflare") {
+      await tunnel.setupCloudflare({ domain: options.tunnelDomain });
+      console.log("  \u2713 Cloudflare tunnel configured");
+    } else {
+      console.warn(`  \u26A0 Unknown tunnel provider: ${String(options.tunnel)}`);
+    }
+  }
+  if (options.domain) {
+    console.log(`
+Step 4: Configuring domain ${options.domain}...`);
+    await traefik.configureDomain(options.domain);
+    console.log("  \u2713 Domain configured");
+    if (options.ssl) {
+      console.log("\nStep 5: Enabling SSL...");
+      await traefik.enableSSL();
+      console.log("  \u2713 SSL enabled with Let's Encrypt");
+    }
+  }
+  console.log("\n\u2705 Legs setup complete!");
+  console.log("\nYour organs are now accessible at:");
+  const baseUrl = options.domain || "localhost";
+  const protocol = options.ssl ? "https" : "http";
+  for (const organ of organs) {
+    console.log(`  ${protocol}://${baseUrl}${organ.path}`);
+  }
+  if (options.tunnel) {
+    console.log(`
+Tunnel configured with ${options.tunnel}`);
+    if (options.tunnelDomain) {
+      console.log(`External domain: ${options.tunnelDomain}`);
+    }
+  }
+}
+function setupCommand(program) {
+  program.command("setup").description("Setup Traefik reverse proxy for Eve").option("--domain <domain>", "Custom domain for external access").option(
+    "--tunnel <provider>",
+    "Tunnel provider (pangolin, cloudflare, pangolin_tunnel, cloudflare_tunnel)"
+  ).option("--tunnel-domain <domain>", "Domain for tunnel (if using tunnel)").option("--ssl", "Enable SSL/TLS (requires --domain)").option("--standalone", "Install standalone Traefik (not using Dokploy)").action(async (options) => {
+    try {
+      await runLegsProxySetup({
+        domain: options.domain,
+        tunnel: options.tunnel,
+        tunnelDomain: options.tunnelDomain,
+        ssl: Boolean(options.ssl),
+        standalone: Boolean(options.standalone)
+      });
+    } catch (error) {
+      console.error("\n\u274C Setup failed:", error);
+      process.exit(1);
+    }
+  });
+}
+function domainCommand(program) {
+  const domain = program.command("domain").description("Configure Traefik domain and SSL");
+  domain.command("set <domain>").description("Set primary domain for Traefik routes").option("--ssl", "Enable SSL with Let's Encrypt").option("--email <email>", "ACME email for SSL certificate").option("--behind-proxy", "HTTP-only mode: external proxy handles SSL (no port 443, no redirects)").action(async (domainName, options) => {
+    try {
+      const traefik = new TraefikService();
+      if (options.behindProxy && options.ssl) {
+        console.error("--behind-proxy and --ssl are mutually exclusive. The external proxy handles SSL.");
+        process.exit(1);
+      }
+      const domainError = validateBaseDomain(domainName);
+      if (domainError) {
+        console.error(domainError);
+        process.exit(1);
+      }
+      const prior = await readEveSecrets(process.cwd());
+      const explicitMode = options.behindProxy === true || options.ssl === true;
+      const behindProxy = options.behindProxy === true ? true : options.ssl === true ? false : !!prior?.domain?.behindProxy;
+      const ssl = behindProxy ? false : options.ssl === true || !explicitMode && !!prior?.domain?.ssl;
+      const email = options.email ?? prior?.domain?.email;
+      let installedComponents = [];
+      try {
+        installedComponents = await entityStateManager.getInstalledComponents();
+      } catch {
+      }
+      const inheritedNote = !explicitMode ? ` (inherited mode: ${behindProxy ? "behind-proxy" : ssl ? "ssl" : "plain"})` : "";
+      console.log(`Configuring domain: ${domainName}${inheritedNote}`);
+      if (behindProxy) {
+        await traefik.enableProxyMode(domainName, installedComponents);
+        await writeEveSecrets(
+          { domain: { primary: domainName, ssl: false, behindProxy: true, email } },
+          process.cwd()
+        );
+        console.log(`Domain configured: ${domainName} (behind-proxy, HTTP only)`);
+        console.log("External proxy must forward port 80 and handle SSL termination.");
+      } else {
+        await traefik.configureSubdomains(domainName, ssl, email, installedComponents, false);
+        await writeEveSecrets(
+          { domain: { primary: domainName, ssl, email, behindProxy: false } },
+          process.cwd()
+        );
+        const protocol = ssl ? "https" : "http";
+        console.log(`Domain configured: ${domainName}${ssl ? " (SSL)" : ""}`);
+        console.log("\nExample endpoints:");
+        for (const sub of ["pod", "pod-admin", "eve"]) {
+          console.log(`  ${protocol}://${sub}.${domainName}`);
+        }
+      }
+    } catch (error) {
+      console.error("Domain configuration failed:", error instanceof Error ? error.message : error);
+      process.exit(1);
+    }
+  });
+  domain.command("unset").description("Revert domain to localhost").action(async () => {
+    try {
+      const traefik = new TraefikService();
+      await traefik.configureDomain("localhost");
+      console.log("Domain configuration removed (localhost)");
+    } catch (error) {
+      console.error("Failed to unset domain:", error instanceof Error ? error.message : error);
+      process.exit(1);
+    }
+  });
+  domain.command("status").description("Show current domain and route configuration").action(async () => {
+    try {
+      const traefik = new TraefikService();
+      const status = await traefik.getStatus();
+      console.log("Legs (Traefik) configuration:\n");
+      const state = status.installed ? status.running ? "running" : "installed (not running)" : "not installed";
+      console.log(`Status: ${state}`);
+      console.log(`Domain: ${status.domain || "localhost"}`);
+      console.log(`SSL: ${status.ssl ? "enabled" : "disabled"}`);
+      console.log(`
+Routes (${status.routes.length}):`);
+      for (const route of status.routes) {
+        console.log(`  ${route.path} -> ${route.target}`);
+      }
+    } catch (error) {
+      console.error("Failed to get status:", error instanceof Error ? error.message : error);
+      process.exit(1);
+    }
+  });
+}
+var COMPOSE = `services:
+  newt:
+    image: fosrl/newt:latest
+    container_name: eve-legs-newt
+    restart: unless-stopped
+    env_file:
+      - \${NEWT_ENV_FILE}
+    networks:
+      - eve-network
+
+networks:
+  eve-network:
+    external: true
+`.trim();
+function composePath(cwd) {
+  return join3(cwd, ".eve", "legs", "newt-compose.yml");
+}
+function envPath(cwd) {
+  return join3(cwd, ".eve", "legs", "newt.env");
+}
+function writeNewtEnvTemplate(cwd) {
+  const dir = join3(cwd, ".eve", "legs");
+  mkdirSync3(dir, { recursive: true });
+  const p = envPath(cwd);
+  if (!existsSync3(p)) {
+    writeFileSync3(
+      p,
+      [
+        "# Pangolin Newt site connector \u2014 https://docs.pangolin.net/manage/sites/install-site",
+        "PANGOLIN_ENDPOINT=https://your-pangolin-host.example",
+        "NEWT_ID=",
+        "NEWT_SECRET=",
+        "LOG_LEVEL=INFO",
+        "# Optional: Docker discovery (read-only socket)",
+        "# DOCKER_SOCKET=unix:///var/run/docker.sock",
+        ""
+      ].join("\n"),
+      "utf-8"
+    );
+  }
+  return p;
+}
+function newtCommand(program) {
+  const n = program.command("newt").description("Pangolin Newt (site connector) on eve-network \u2014 fosrl/newt");
+  n.command("init").description("Write .eve/legs/newt.env template if missing").action(() => {
+    const cwd = process.cwd();
+    const p = writeNewtEnvTemplate(cwd);
+    console.log(`Newt env template: ${p}
+Edit PANGOLIN_ENDPOINT, NEWT_ID, NEWT_SECRET then run: eve legs newt up`);
+  });
+  n.command("up").description("Start Newt container (requires filled newt.env + eve-network)").action(() => {
+    const cwd = process.cwd();
+    writeNewtEnvTemplate(cwd);
+    const envFile = envPath(cwd);
+    mkdirSync3(join3(cwd, ".eve", "legs"), { recursive: true });
+    writeFileSync3(composePath(cwd), COMPOSE, "utf-8");
+    try {
+      execSync3("docker network create eve-network", { stdio: "ignore" });
+    } catch {
+    }
+    const env = { ...process.env, NEWT_ENV_FILE: envFile };
+    execSync3(`docker compose -f "${composePath(cwd)}" up -d`, { stdio: "inherit", cwd, env });
+    console.log("\nNewt running. See Pangolin dashboard for site status.\n");
+  });
+  n.command("down").description("Stop Newt container").action(() => {
+    const cwd = process.cwd();
+    if (!existsSync3(composePath(cwd))) {
+      console.log("No newt compose. Run: eve legs newt up");
+      return;
+    }
+    execSync3(`docker compose -f "${composePath(cwd)}" down`, { stdio: "inherit", cwd, env: { ...process.env, NEWT_ENV_FILE: envPath(cwd) } });
+  });
+}
+var CONTAINER = "eve-legs-traefik";
+var CONFIG_DIR = "/opt/traefik";
+function reconnectSynapToEveNetwork() {
+  try {
+    const name = execSync4(
+      `docker ps --filter "label=com.docker.compose.project=synap-backend" --filter "label=com.docker.compose.service=backend" --format "{{.Names}}"`,
+      { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] }
+    ).trim().split("\n")[0]?.trim();
+    if (!name) return;
+    try {
+      const inspect = execSync4(
+        `docker inspect --format "{{json .NetworkSettings.Networks}}" ${name}`,
+        { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] }
+      ).trim();
+      const networks = JSON.parse(inspect);
+      const eve = networks["eve-network"];
+      if (eve && (eve.Aliases ?? []).includes("eve-brain-synap")) return;
+      if (eve) {
+        try {
+          execSync4(`docker network disconnect eve-network ${name}`, { stdio: ["pipe", "pipe", "ignore"] });
+        } catch {
+        }
+      }
+    } catch {
+    }
+    try {
+      execSync4(`docker network connect --alias eve-brain-synap eve-network ${name}`, { stdio: ["pipe", "pipe", "ignore"] });
+      console.log(`  Reconnected ${name} \u2192 eve-network (alias: eve-brain-synap)`);
+    } catch {
+    }
+  } catch {
+  }
+}
+function freePort(port) {
+  try {
+    const out = execSync4(
+      `docker ps --format '{{.Names}}\\t{{.Ports}}' | grep ':${port}->'`,
+      { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] }
+    ).trim();
+    for (const line of out.split("\n").filter(Boolean)) {
+      const name = line.split("	")[0]?.trim();
+      if (name && name !== CONTAINER) {
+        console.log(`  Stopping container holding port ${port}: ${name}`);
+        spawnSync2("docker", ["stop", name], { stdio: "inherit" });
+      }
+    }
+  } catch {
+  }
+}
+function restartCommand(program) {
+  program.command("restart").description("Recreate the Traefik container with correct volume mounts").action(() => {
+    if (!existsSync4(`${CONFIG_DIR}/traefik.yml`)) {
+      console.error(`No Traefik config found at ${CONFIG_DIR}/traefik.yml`);
+      console.error("Run: eve domain set <domain> --ssl --email <email> first");
+      process.exit(1);
+    }
+    console.log("Freeing ports 80 / 443...");
+    freePort(80);
+    freePort(443);
+    const acmePath = `${CONFIG_DIR}/acme.json`;
+    if (!existsSync4(acmePath)) {
+      execSync4(`touch ${acmePath} && chmod 600 ${acmePath}`);
+      console.log(`Created ${acmePath} (600)`);
+    } else {
+      execSync4(`chmod 600 ${acmePath}`);
+      console.log(`Fixed permissions on ${acmePath} \u2192 600`);
+    }
+    console.log(`Removing existing ${CONTAINER} container (if any)...`);
+    spawnSync2("docker", ["rm", "-f", CONTAINER], { stdio: "inherit" });
+    console.log("Starting Traefik with correct volume mounts...");
+    const result = spawnSync2("docker", [
+      "run",
+      "-d",
+      "--name",
+      CONTAINER,
+      "--restart",
+      "unless-stopped",
+      "-p",
+      "80:80",
+      "-p",
+      "443:443",
+      "-p",
+      "8080:8080",
+      "-v",
+      "/var/run/docker.sock:/var/run/docker.sock:ro",
+      "-v",
+      `${CONFIG_DIR}/traefik.yml:/etc/traefik/traefik.yml:ro`,
+      "-v",
+      `${CONFIG_DIR}/dynamic:/etc/traefik/dynamic:ro`,
+      "-v",
+      `${acmePath}:/etc/traefik/acme.json`,
+      "--network",
+      "eve-network",
+      "traefik:v3.0"
+    ], { stdio: "inherit" });
+    if (result.status !== 0) {
+      console.error("\nFailed to start Traefik. Containers currently using port 80/443:");
+      spawnSync2("docker", ["ps", "--format", "{{.Names}}	{{.Ports}}"], { stdio: "inherit" });
+      process.exit(1);
+    }
+    reconnectSynapToEveNetwork();
+    console.log("\u2713 Traefik running \u2014 routes are live");
+  });
+}
+var CONTAINER2 = "eve-legs-traefik";
+var CONFIG_DIR2 = "/opt/traefik";
+var API = "http://localhost:8080/api";
+function tryFetch(url) {
+  try {
+    const out = execSync5(`curl -sf "${url}"`, { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] });
+    return JSON.parse(out);
+  } catch {
+    return null;
+  }
+}
+function statusCommand(program) {
+  program.command("status").description("Show Traefik health, routes, and config").option("--logs", "Show last 30 lines of Traefik logs").action((opts) => {
+    console.log("\n\u{1F9BF}  Eve Legs \u2014 Traefik Status\n");
+    let running = false;
+    try {
+      const out = execSync5(
+        `docker ps --filter "name=${CONTAINER2}" --format "{{.Names}}\\t{{.Status}}"`,
+        { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] }
+      ).trim();
+      running = out.includes(CONTAINER2);
+      if (running) {
+        console.log(`  Container:  \u2713 running  (${out.split("	")[1] ?? ""})`);
+      } else {
+        console.log(`  Container:  \u2717 NOT running`);
+      }
+    } catch {
+      console.log(`  Container:  \u2717 docker error`);
+    }
+    const staticExists = existsSync5(`${CONFIG_DIR2}/traefik.yml`);
+    const dynamicExists = existsSync5(`${CONFIG_DIR2}/dynamic/eve-routes.yml`);
+    console.log(`  Static cfg: ${staticExists ? "\u2713" : "\u2717 MISSING"} ${CONFIG_DIR2}/traefik.yml`);
+    console.log(`  Routes cfg: ${dynamicExists ? "\u2713" : "\u2717 MISSING"} ${CONFIG_DIR2}/dynamic/eve-routes.yml`);
+    if (staticExists) {
+      console.log("\n  \u2500\u2500 traefik.yml \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+      console.log(readFileSync3(`${CONFIG_DIR2}/traefik.yml`, "utf-8").split("\n").map((l) => "  " + l).join("\n"));
+    }
+    if (dynamicExists) {
+      console.log("\n  \u2500\u2500 eve-routes.yml \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+      console.log(readFileSync3(`${CONFIG_DIR2}/dynamic/eve-routes.yml`, "utf-8").split("\n").map((l) => "  " + l).join("\n"));
+    }
+    if (running) {
+      console.log("\n  \u2500\u2500 Active routers (Traefik API) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+      const routers = tryFetch(`${API}/http/routers`);
+      if (!routers) {
+        console.log("  Could not reach Traefik API at port 8080 \u2014 is insecure API enabled?");
+      } else if (routers.length === 0) {
+        console.log("  No routers registered yet");
+      } else {
+        for (const r of routers) {
+          const status = r.status === "enabled" ? "\u2713" : "\u2717";
+          console.log(`  ${status} ${r.name}`);
+          console.log(`      Rule:   ${r.rule}`);
+          console.log(`      Entry:  ${(r.entryPoints ?? []).join(", ")}`);
+          console.log(`      Status: ${r.status}`);
+        }
+      }
+      const certs = tryFetch(`${API}/tls/certificates`);
+      if (certs && certs.length > 0) {
+        console.log("\n  \u2500\u2500 TLS Certificates \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+        for (const c of certs) {
+          console.log(`  \u2713 ${c.subject?.commonName}  (expires ${c.notAfter})`);
+        }
+      } else if (certs !== null) {
+        console.log("\n  \u2500\u2500 TLS Certificates \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+        console.log("  No certificates yet \u2014 DNS must propagate before Let's Encrypt can provision");
+      }
+    }
+    if (opts.logs || !running) {
+      console.log("\n  \u2500\u2500 Traefik logs (last 30 lines) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+      spawnSync3("docker", ["logs", "--tail", "30", CONTAINER2], { stdio: "inherit" });
+    }
+    console.log();
+  });
+}
+function proxyModeCommand(program) {
+  const cmd = program.command("proxy-mode").description("Run Traefik behind an external SSL-terminating proxy (Caddy, Nginx, etc.)");
+  cmd.command("enable").description("Switch to behind-proxy mode: HTTP only on port 80, no SSL/redirects").action(async () => {
+    try {
+      const secrets = await readEveSecrets(process.cwd());
+      const domain = secrets?.domain?.primary;
+      if (!domain) {
+        console.error("No domain configured. Run `eve legs domain set <domain>` first.");
+        process.exit(1);
+      }
+      const status = new TraefikService().getProxyModeStatus();
+      if (status.enabled) {
+        console.log("Already in behind-proxy mode.");
+        printProxyInstructions(domain);
+        return;
+      }
+      let installedComponents = [];
+      try {
+        installedComponents = await entityStateManager.getInstalledComponents();
+      } catch {
+      }
+      console.log(`Enabling behind-proxy mode for domain: ${domain}`);
+      const traefik = new TraefikService();
+      await traefik.enableProxyMode(domain, installedComponents);
+      await writeEveSecrets({ domain: { ...secrets?.domain, behindProxy: true } }, process.cwd());
+      console.log("\nBehind-proxy mode enabled.");
+      console.log("Traefik now listens on port 80 only (no port 443, no SSL).\n");
+      printProxyInstructions(domain);
+    } catch (err) {
+      console.error("Failed to enable proxy mode:", err instanceof Error ? err.message : err);
+      process.exit(1);
+    }
+  });
+  cmd.command("disable").description("Restore standalone mode (Traefik handles SSL directly)").option("--ssl", "Re-enable SSL with Let's Encrypt").option("--email <email>", "ACME email address for SSL certificate").action(async (options) => {
+    try {
+      const secrets = await readEveSecrets(process.cwd());
+      const domain = secrets?.domain?.primary;
+      if (!domain) {
+        console.error("No domain configured. Run `eve legs domain set <domain>` first.");
+        process.exit(1);
+      }
+      const status = new TraefikService().getProxyModeStatus();
+      if (!status.enabled) {
+        console.log("Already in standalone mode (not behind a proxy).");
+        return;
+      }
+      const ssl = options.ssl ?? false;
+      const email = options.email ?? secrets?.domain?.email;
+      if (ssl && !email) {
+        console.error("--email <email> is required when using --ssl.");
+        process.exit(1);
+      }
+      let installedComponents = [];
+      try {
+        installedComponents = await entityStateManager.getInstalledComponents();
+      } catch {
+      }
+      console.log(`Restoring standalone mode for domain: ${domain}`);
+      const traefik = new TraefikService();
+      await traefik.disableProxyMode(domain, ssl, email, installedComponents);
+      await writeEveSecrets(
+        { domain: { ...secrets?.domain, ssl, email, behindProxy: false } },
+        process.cwd()
+      );
+      console.log("\nStandalone mode restored.");
+      console.log(`Traefik now listens on ports 80 and 443.`);
+      if (ssl) console.log(`SSL certificates will be obtained via Let's Encrypt for ${domain}.`);
+    } catch (err) {
+      console.error("Failed to disable proxy mode:", err instanceof Error ? err.message : err);
+      process.exit(1);
+    }
+  });
+  cmd.command("status").description("Show current proxy mode configuration").action(async () => {
+    try {
+      const traefik = new TraefikService();
+      const status = traefik.getProxyModeStatus();
+      const secrets = await readEveSecrets(process.cwd());
+      const domain = secrets?.domain?.primary ?? "(not set)";
+      console.log(`
+Traefik mode:    ${status.enabled ? "behind-proxy (HTTP only)" : "standalone (handles SSL)"}`);
+      console.log(`Domain:          ${domain}`);
+      console.log(`SSL:             ${status.ssl ? "enabled (Let's Encrypt)" : "disabled"}`);
+      console.log(`Entrypoints:     ${status.entrypoints.join(", ")}`);
+      console.log(`Port 443:        ${status.enabled ? "not bound (proxy handles it)" : "bound"}`);
+      if (status.enabled) {
+        console.log("\nYour external proxy must:");
+        console.log(`  - Terminate SSL for ${domain} and its subdomains`);
+        console.log("  - Forward requests to http://<this-server>:80");
+        console.log("  - Set X-Forwarded-Proto: https and X-Forwarded-Host headers");
+      }
+      console.log();
+    } catch (err) {
+      console.error("Failed to get proxy mode status:", err instanceof Error ? err.message : err);
+      process.exit(1);
+    }
+  });
+}
+function printProxyInstructions(domain) {
+  console.log("Configure your external proxy to:");
+  console.log(`  1. Terminate SSL for ${domain} and its subdomains (pod.${domain}, etc.)`);
+  console.log("  2. Forward requests to http://<this-server-ip>:80");
+  console.log("  3. Pass these headers:");
+  console.log("       X-Forwarded-For: <client-ip>");
+  console.log("       X-Forwarded-Proto: https");
+  console.log(`       X-Forwarded-Host: <subdomain>.${domain}`);
+  console.log();
+  console.log("Example Caddy config:");
+  console.log(`  ${domain}, *.${domain} {`);
+  console.log(`    reverse_proxy <this-server-ip>:80 {`);
+  console.log(`      header_up X-Forwarded-Host {host}`);
+  console.log(`      header_up X-Forwarded-Proto https`);
+  console.log(`    }`);
+  console.log(`  }`);
+  console.log();
+}
+var GATEWAY_CONTAINER = "eve-inference-gateway";
+var DEFAULT_HOST_PORT = "11435";
+var InferenceGateway = class {
+  baseDir;
+  hostPort;
+  cwd;
+  constructor(cwd = process.cwd(), hostPort = DEFAULT_HOST_PORT) {
+    this.cwd = cwd;
+    this.baseDir = join4(cwd, ".eve", "inference-gateway");
+    this.hostPort = process.env.EVE_INFERENCE_GATEWAY_PORT?.trim() || hostPort;
+  }
+  /**
+   * APR1 hash line for Traefik usersFile (user:hash).
+   *
+   * Pipe the password via stdin instead of passing it as an arg — base64url
+   * passwords starting with `-` were being interpreted by openssl as a flag
+   * ("Unknown option: -LglNqOAY..."). The `-stdin` form is unambiguous.
+   */
+  htpasswdLine(username, plainPassword) {
+    const r = spawnSync4("openssl", ["passwd", "-apr1", "-stdin"], {
+      input: plainPassword + "\n",
+      encoding: "utf-8"
+    });
+    if (r.error || r.status !== 0) {
+      throw new Error(`openssl passwd -apr1 failed: ${r.stderr || r.error?.message || "unknown"}`);
+    }
+    const hash = (r.stdout ?? "").trim();
+    return `${username}:${hash}`;
+  }
+  async ensure(ollamaHost = "http://eve-brain-ollama:11434") {
+    mkdirSync4(join4(this.baseDir, "dynamic"), { recursive: true });
+    const username = "eve";
+    const password = randomBytes(18).toString("base64url").slice(0, 24);
+    const userLine = this.htpasswdLine(username, password);
+    const staticYaml = `
+entryPoints:
+  web:
+    address: ":80"
+
+providers:
+  file:
+    directory: /etc/traefik/dynamic
+    watch: true
+
+log:
+  level: INFO
+`.trim();
+    writeFileSync4(join4(this.baseDir, "dynamic", "ollama-users"), `${userLine}
+`, { mode: 384 });
+    const dynamicYaml = [
+      "http:",
+      "  routers:",
+      "    ollama_api:",
+      "      rule: PathPrefix(`/`)",
+      "      entryPoints:",
+      "        - web",
+      "      service: ollama_svc",
+      "      middlewares:",
+      "        - ollama_auth",
+      "  middlewares:",
+      "    ollama_auth:",
+      "      basicAuth:",
+      "        usersFile: /etc/traefik/dynamic/ollama-users",
+      "  services:",
+      "    ollama_svc:",
+      "      loadBalancer:",
+      "        servers:",
+      `          - url: "${ollamaHost}"`
+    ].join("\n");
+    writeFileSync4(join4(this.baseDir, "traefik.yml"), staticYaml);
+    writeFileSync4(join4(this.baseDir, "dynamic", "ollama.yml"), dynamicYaml);
+    const secretsFile = join4(this.baseDir, "..", "secrets", "ollama-gateway.txt");
+    mkdirSync4(join4(this.baseDir, "..", "secrets"), { recursive: true });
+    const secretBody = `# Eve inference gateway (Basic auth for Ollama)
+URL=http://127.0.0.1:${this.hostPort}
+USER=${username}
+PASS=${password}
+
+Example:
+  curl -u '${username}:${password}' http://127.0.0.1:${this.hostPort}/api/tags
+`;
+    writeFileSync4(secretsFile, secretBody, { mode: 384 });
+    const prevSecrets = await readEveSecrets(this.cwd);
+    await writeEveSecrets(
+      {
+        inference: {
+          ...prevSecrets?.inference ?? {},
+          gatewayUrl: `http://127.0.0.1:${this.hostPort}`,
+          gatewayUser: username,
+          gatewayPass: password,
+          ollamaUrl: prevSecrets?.inference?.ollamaUrl ?? ollamaHost
+        }
+      },
+      this.cwd
+    );
+    try {
+      execSync6("docker network create eve-network", { stdio: "ignore" });
+    } catch {
+    }
+    const running = this.isGatewayRunning();
+    if (!running) {
+      if (this.gatewayContainerExists()) {
+        execSync6(`docker start ${GATEWAY_CONTAINER}`, { stdio: "inherit" });
+      } else {
+        execSync6(
+          [
+            "docker",
+            "run",
+            "-d",
+            "--name",
+            GATEWAY_CONTAINER,
+            "--restart",
+            "unless-stopped",
+            "--network",
+            "eve-network",
+            "-p",
+            `${this.hostPort}:80`,
+            "-v",
+            `${this.baseDir}/traefik.yml:/etc/traefik/traefik.yml:ro`,
+            "-v",
+            `${this.baseDir}/dynamic:/etc/traefik/dynamic:ro`,
+            "traefik:v3.0",
+            "--configFile=/etc/traefik/traefik.yml"
+          ].join(" "),
+          { stdio: "inherit" }
+        );
+      }
+    }
+    return {
+      baseDir: this.baseDir,
+      hostPort: this.hostPort,
+      publicUrl: `http://127.0.0.1:${this.hostPort}`,
+      username,
+      password,
+      secretsFile
+    };
+  }
+  gatewayContainerExists() {
+    try {
+      execSync6(`docker container inspect ${GATEWAY_CONTAINER}`, { stdio: "ignore" });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  isGatewayRunning() {
+    try {
+      const out = execSync6(`docker inspect -f '{{.State.Running}}' ${GATEWAY_CONTAINER}`, {
+        encoding: "utf-8"
+      }).trim();
+      return out === "true";
+    } catch {
+      return false;
+    }
+  }
+};
+async function refreshTraefikRoutes(cwd) {
+  const secrets = await readEveSecrets(cwd ?? process.cwd());
+  const domain = secrets?.domain?.primary;
+  if (!domain) {
+    return { refreshed: false, domain: null, reason: "no domain configured" };
+  }
+  let installedComponents = [];
+  try {
+    installedComponents = await entityStateManager.getInstalledComponents();
+  } catch {
+  }
+  try {
+    const traefik = new TraefikService();
+    await traefik.configureSubdomains(
+      domain,
+      secrets?.domain?.ssl !== false,
+      secrets?.domain?.email,
+      installedComponents,
+      !!secrets?.domain?.behindProxy,
+      secrets?.domain?.customRoutes
+    );
+    return { refreshed: true, domain };
+  } catch (err) {
+    return {
+      refreshed: false,
+      domain,
+      reason: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+var execFileAsync = promisify(execFile);
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+var DOCKER_CALL_TIMEOUT_MS = 4e3;
+async function isContainerRunning(name) {
+  try {
+    const { stdout } = await execFileAsync(
+      "docker",
+      ["ps", "--filter", `name=^${name}$`, "--format", "{{.Names}}"],
+      { timeout: DOCKER_CALL_TIMEOUT_MS }
+    );
+    if (stdout.trim() === name) return true;
+  } catch {
+  }
+  try {
+    const { stdout: ids } = await execFileAsync(
+      "docker",
+      ["ps", "--filter", `network=eve-network`, "--format", "{{.ID}}"],
+      { timeout: DOCKER_CALL_TIMEOUT_MS }
+    );
+    const containerIds = ids.trim().split("\n").filter(Boolean);
+    for (const id of containerIds) {
+      try {
+        const { stdout: aliasJson } = await execFileAsync(
+          "docker",
+          ["inspect", "--format", "{{json .NetworkSettings.Networks}}", id],
+          { timeout: DOCKER_CALL_TIMEOUT_MS }
+        );
+        const networks = JSON.parse(aliasJson.trim());
+        const aliases = networks["eve-network"]?.Aliases ?? [];
+        if (aliases.includes(name)) return true;
+      } catch {
+        continue;
+      }
+    }
+  } catch {
+  }
+  return false;
+}
+async function canReachFromTraefik(host, port, path) {
+  try {
+    const { stdout } = await execFileAsync(
+      "docker",
+      [
+        "exec",
+        "eve-legs-traefik",
+        "sh",
+        "-c",
+        `wget -q -O /dev/null --timeout=3 --server-response http://${host}:${port}${path} 2>&1 | grep "HTTP/" | tail -1 || echo "no-response"`
+      ],
+      { timeout: DOCKER_CALL_TIMEOUT_MS }
+    );
+    const out = stdout.trim();
+    if (out.includes("no-response")) return false;
+    const match = out.match(/HTTP\/\S+\s+(\d{3})/);
+    if (!match) return false;
+    return parseInt(match[1], 10) < 500;
+  } catch {
+    return false;
+  }
+}
+async function verifyComponent(componentId, opts = {}) {
+  const checks = [];
+  let comp;
+  try {
+    comp = resolveComponent(componentId);
+  } catch {
+    return {
+      ok: false,
+      checks: [{ name: "registry", ok: false, detail: `unknown component: ${componentId}` }],
+      summary: `unknown component: ${componentId}`
+    };
+  }
+  if (!comp.service) {
+    return {
+      ok: true,
+      checks: [{ name: "service", ok: true, detail: "no network service to verify" }],
+      summary: `${comp.label} install complete (no network service)`
+    };
+  }
+  const containerName = comp.service.containerName;
+  const containerAttempts = opts.quick ? 1 : 5;
+  const reachableAttempts = opts.quick ? 1 : 4;
+  let running = false;
+  for (let i = 0; i < containerAttempts; i++) {
+    if (await isContainerRunning(containerName)) {
+      running = true;
+      break;
+    }
+    if (i < containerAttempts - 1) await sleep(1500);
+  }
+  checks.push({
+    name: "container",
+    ok: running,
+    detail: running ? `${containerName} is running` : opts.quick ? `${containerName} not in docker ps` : `${containerName} not in docker ps after 7.5s`
+  });
+  if (!running) {
+    return { ok: false, checks, summary: `${comp.label}: container not running` };
+  }
+  if (comp.service.healthPath) {
+    let reachable = false;
+    for (let i = 0; i < reachableAttempts; i++) {
+      if (await canReachFromTraefik(containerName, comp.service.internalPort, comp.service.healthPath)) {
+        reachable = true;
+        break;
+      }
+      if (i < reachableAttempts - 1) await sleep(2e3);
+    }
+    checks.push({
+      name: "reachable",
+      ok: reachable,
+      detail: reachable ? `responded on :${comp.service.internalPort}${comp.service.healthPath}` : opts.quick ? `not responding on :${comp.service.internalPort}${comp.service.healthPath}` : `not responding on :${comp.service.internalPort}${comp.service.healthPath} after 10s`
+    });
+    if (!reachable) {
+      return { ok: false, checks, summary: `${comp.label}: container running but not responding on its port` };
+    }
+  }
+  return { ok: true, checks, summary: `${comp.label}: container running and reachable` };
+}
+var CONTAINER_NAME = "eve-dashboard";
+var IMAGE_TAG = "eve-dashboard:local";
+var INTERNAL_PORT = 3e3;
+var HOST_PORT = 7979;
+function ensureNetwork(name) {
+  try {
+    execSync7(`docker network inspect ${name}`, { stdio: "ignore" });
+  } catch {
+    execSync7(`docker network create ${name}`, { stdio: "inherit" });
+  }
+}
+function ensureEveNetwork() {
+  ensureNetwork("eve-network");
+}
+function imageExists() {
+  try {
+    const out = execSync7(`docker image inspect ${IMAGE_TAG}`, { stdio: ["pipe", "pipe", "ignore"] });
+    return out.length > 0;
+  } catch {
+    return false;
+  }
+}
+function buildImage(workspaceRoot) {
+  const dockerfile = resolve(workspaceRoot, "packages/eve-dashboard/Dockerfile");
+  if (!existsSync6(dockerfile)) {
+    throw new Error(`Dockerfile not found at ${dockerfile}. Are you in the eve workspace root?`);
+  }
+  console.log(`  Building ${IMAGE_TAG} (this takes a minute on first run)...`);
+  const r = spawnSync5(
+    "docker",
+    ["build", "-f", dockerfile, "-t", IMAGE_TAG, workspaceRoot],
+    { stdio: "inherit" }
+  );
+  if (r.status !== 0) throw new Error(`docker build exited with code ${r.status}`);
+}
+function removeContainer() {
+  try {
+    execSync7(`docker rm -f ${CONTAINER_NAME}`, { stdio: "ignore" });
+  } catch {
+  }
+}
+function runContainer(workspaceRoot, secret) {
+  const stateDir = `${homedir()}/.local/share/eve`;
+  const args = [
+    "run",
+    "-d",
+    "--name",
+    CONTAINER_NAME,
+    "--restart",
+    "unless-stopped",
+    "--network",
+    "eve-network",
+    "-p",
+    `${HOST_PORT}:${INTERNAL_PORT}`,
+    "-e",
+    `PORT=${INTERNAL_PORT}`,
+    "-e",
+    `EVE_HOME=${workspaceRoot}`,
+    "-e",
+    `EVE_DASHBOARD_SECRET=${secret}`,
+    // Mounts that mirror what the host CLI would touch.
+    "-v",
+    "/opt:/opt",
+    "-v",
+    `${stateDir}:${stateDir}`,
+    "-v",
+    "/var/run/docker.sock:/var/run/docker.sock",
+    IMAGE_TAG
+  ];
+  const r = spawnSync5("docker", args, { stdio: "inherit" });
+  if (r.status !== 0) throw new Error(`docker run exited with code ${r.status}`);
+}
+function installDashboardContainer(opts) {
+  const workspaceRoot = resolve(opts.workspaceRoot ?? process.cwd());
+  ensureEveNetwork();
+  if (opts.rebuild || !imageExists()) {
+    buildImage(workspaceRoot);
+  }
+  removeContainer();
+  runContainer(workspaceRoot, opts.secret);
+}
+function uninstallDashboardContainer() {
+  removeContainer();
+}
+function dashboardContainerName() {
+  return CONTAINER_NAME;
+}
+function dashboardImageTag() {
+  return IMAGE_TAG;
+}
+function dashboardIsRunning() {
+  try {
+    const out = execSync7(
+      `docker ps --filter "name=^${CONTAINER_NAME}$" --format "{{.Names}}"`,
+      { encoding: "utf-8" }
+    ).trim();
+    return out === CONTAINER_NAME;
+  } catch {
+    return false;
+  }
+}
+function registerLegsCommands(legs) {
+  setupCommand(legs);
+  domainCommand(legs);
+  newtCommand(legs);
+  restartCommand(legs);
+  statusCommand(legs);
+  proxyModeCommand(legs);
+}
+function registerCommands(program) {
+  const legs = program.command("legs").description("Traefik, domains, and tunnels");
+  registerLegsCommands(legs);
+}
+var index_default = {
+  registerLegsCommands,
+  registerCommands
+};
+
+export {
+  TraefikService,
+  TunnelService,
+  runLegsProxySetup,
+  setupCommand,
+  domainCommand,
+  newtCommand,
+  restartCommand,
+  statusCommand,
+  proxyModeCommand,
+  InferenceGateway,
+  refreshTraefikRoutes,
+  verifyComponent,
+  installDashboardContainer,
+  uninstallDashboardContainer,
+  dashboardContainerName,
+  dashboardImageTag,
+  dashboardIsRunning,
+  registerLegsCommands,
+  registerCommands,
+  index_default
+};
+//# sourceMappingURL=chunk-23XQDB7K.js.map