home-hosted 0.6.5 → 0.6.7

package/dist/cli.js

@@ -22,7 +22,7 @@ import { HTTPException } from "hono/http-exception";
 import { Scalar } from "@scalar/hono-api-reference";
 import http from "node:http";
 import https from "node:https";
-import net from "node:net";
+import net, { isIP } from "node:net";
 import { parseArgs, promisify } from "node:util";
 import { Readable, Writable } from "node:stream";
 import { finished } from "node:stream/promises";
@@ -133,6 +133,7 @@ function aliasesOf(def) {
 function findArg(argsDef, name) {
 	for (const [key, def] of Object.entries(argsDef)) {
 		if (def === void 0) continue;
+		if (def.type === "positional") continue;
 		if ((/* @__PURE__ */ new Set([
 			key,
 			kebab(key),
@@ -152,10 +153,15 @@ function findArg(argsDef, name) {
 */
 function rejectUnknownFlags(argv, argsDef) {
 	if (argsDef === void 0 || Object.keys(argsDef).length === 0) return null;
+	let positionals = Object.values(argsDef).filter((def) => def?.type === "positional").length;
 	for (let index = 0; index < argv.length; index++) {
 		const token = argv[index];
 		if (token === "--") return null;
-		if (!token.startsWith("-") || token.length === 1) return `Unexpected argument '${token}'`;
+		if (!token.startsWith("-") || token.length === 1) {
+			if (positionals === 0) return `Unexpected argument '${token}'`;
+			positionals -= 1;
+			continue;
+		}
 		const body = token.startsWith("--") ? token.slice(2) : token.slice(1);
 		const equals = body.indexOf("=");
 		const name = equals === -1 ? body : body.slice(0, equals);
@@ -300,6 +306,50 @@ var init_runtime = __esmMin((() => {
 	NANNY_COMMAND = "__nanny";
 }));
 //#endregion
+//#region src/helpers/version.ts
+var version_exports = /* @__PURE__ */ __exportAll({
+	appVersion: () => appVersion,
+	versionMismatchNote: () => versionMismatchNote
+});
+/**
+* The running release, read from the package manifest.
+*
+* The caller may be `src/**` under tsx or the built `dist/cli.js`, so the manifest
+* is found by walking up rather than by a fixed relative path. `src/cli.ts` keeps
+* its own read because it may only import node builtins statically.
+*/
+function appVersion() {
+	if (cached !== null) return cached;
+	let dir = path.dirname(fileURLToPath(import.meta.url));
+	for (let depth = 0; depth < 4; depth++) {
+		try {
+			const manifest = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf8"));
+			if (manifest.name === "home-hosted" && typeof manifest.version === "string") {
+				cached = manifest.version;
+				return cached;
+			}
+		} catch {}
+		const parent = path.dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	cached = "0.0.0";
+	return cached;
+}
+/**
+* The one line to add when this CLI and the panel it is talking to are not the same
+* release — which is what a linked checkout, a global install and a project pin
+* produce. `null` when they agree.
+*/
+function versionMismatchNote(panelVersion) {
+	const cli = appVersion();
+	return cli === panelVersion ? null : `note: this CLI is ${cli}, the panel is ${panelVersion}`;
+}
+var cached;
+var init_version = __esmMin((() => {
+	cached = null;
+}));
+//#endregion
 //#region src/helpers/cookies.ts
 function parseCookies(header) {
 	const cookies = {};
@@ -341,7 +391,7 @@ function parseBind(value) {
 	const parsed = bindSchema(value);
 	return parsed instanceof type.errors ? null : parsed;
 }
-var bindSchema, portSchema, onPortConflictSchema, onPortConflictDefaultSchema, restartSchema, httpCheckSchema, resourcesSchema, healthSchema, stopSchema, bootstrapSchema, bootstrapOrNullSchema, logBufferLinesSchema, serverSchema, authSchema, telegramSchema, notificationsSchema, logsSchema, tlsSchema, hostSchema, backupsSchema, controlSchema, defaultsSchema, restartPatchSchema, httpCheckPatchSchema, resourcesPatchSchema, healthPatchSchema, stopPatchSchema, authPatchSchema, telegramPatchSchema, notificationsPatchSchema, hostPatchSchema, backupsPatchSchema, logsPatchSchema, tlsPatchSchema, controlPatchSchema, defaultsPatchSchema, editableFields, serverPatchSchema, serverCreateSchema, nannySpecSchema, nannyExitSchema, nannyStateSchema, settingsPatchSchema, authStatusSchema, tlsStatusSchema, telegramStatusSchema, notificationViewSchema, sessionViewSchema, loginSchema, passwordValueSchema, passwordSchema, serverStatusSchema, healthStateSchema, portStateSchema, logStreamSchema, logLineSchema, historyEventSchema, serverHistorySchema, processResourcesSchema, hostDiskSchema, hostViewSchema, backupFileSchema, backupPathSchema, backupsViewSchema, restoreItemSchema, restorePlanSchema, backupCreateSchema, restoreRequestSchema, serverViewSchema, controlViewSchema, appStateSchema, logQuerySchema, freePortResultSchema, logHistoryQuerySchema, logFileInfoSchema, logServerViewSchema, logServersViewSchema, notificationActionSchema, telegramTokenSchema, apiErrorSchema, uiMetaSchema, uiStatusSchema, tlsUploadSchema, settingsViewSchema, settingsSavedSchema;
+var bindSchema, portSchema, onPortConflictSchema, onPortConflictDefaultSchema, restartSchema, httpCheckSchema, resourcesSchema, healthSchema, stopSchema, bootstrapSchema, bootstrapOrNullSchema, logBufferLinesSchema, serverSchema, authSchema, telegramSchema, notificationsSchema, logsSchema, tlsSchema, hostSchema, ddnsRecordTypeSchema, ddnsAccountSchema, ddnsDomainSchema, ddnsIpv4Schema, ddnsIpv6Schema, ddnsConfigSchema, ddnsRecordStateSchema, ddnsRecordViewSchema, ddnsStatusSchema, ddnsProviderFieldSchema, ddnsProviderInfoSchema, ddnsViewSchema, ddnsCredentialsSchema, backupsSchema, controlSchema, defaultsSchema, restartPatchSchema, httpCheckPatchSchema, resourcesPatchSchema, healthPatchSchema, stopPatchSchema, authPatchSchema, telegramPatchSchema, notificationsPatchSchema, hostPatchSchema, backupsPatchSchema, logsPatchSchema, tlsPatchSchema, controlPatchSchema, defaultsPatchSchema, editableFields, serverPatchSchema, serverCreateSchema, nannySpecSchema, nannyExitSchema, nannyStateSchema, settingsPatchSchema, authStatusSchema, tlsStatusSchema, telegramStatusSchema, notificationViewSchema, sessionViewSchema, loginSchema, passwordValueSchema, passwordSchema, serverStatusSchema, healthStateSchema, portStateSchema, logStreamSchema, logLineSchema, historyEventSchema, serverHistorySchema, processResourcesSchema, hostDiskSchema, hostViewSchema, backupFileSchema, backupPathSchema, backupsViewSchema, restoreItemSchema, restorePlanSchema, backupCreateSchema, restoreRequestSchema, serverViewSchema, controlViewSchema, appStateSchema, logQuerySchema, freePortResultSchema, logHistoryQuerySchema, logFileInfoSchema, logServerViewSchema, logServersViewSchema, notificationActionSchema, telegramTokenSchema, apiErrorSchema, uiMetaSchema, uiStatusSchema, tlsUploadSchema, settingsViewSchema, settingsSavedSchema;
 var init_contracts = __esmMin((() => {
 	bindSchema = type("\"local\" | \"lan\" | /^\\d{1,3}(?:\\.\\d{1,3}){3}$/");
 	portSchema = type("1 <= number.integer <= 65535 | null");
@@ -460,6 +510,8 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		onRecovered: "boolean = false",
 		/** Host vitals breaches (disk, memory, swap, load, temperature). */
 		onHost: "boolean = true",
+		/** Dynamic DNS changes and failures. */
+		onDdns: "boolean = true",
 		/** Per server *and* reason, so a flapping server cannot spam the chat. */
 		cooldownMs: "number >= 0 = 120000"
 	}).onUndeclaredKey("reject");
@@ -483,6 +535,95 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		loadPerCpu: "number >= 0 = 2",
 		tempCelsius: "number >= 0 = 85"
 	}).onUndeclaredKey("reject");
+	ddnsRecordTypeSchema = type.enumerated("A", "AAAA");
+	ddnsAccountSchema = type({
+		id: "/^[a-z0-9][a-z0-9_-]*$/",
+		provider: "string >= 1",
+		label: "string = \"\""
+	}).onUndeclaredKey("reject");
+	ddnsDomainSchema = type({
+		host: "/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)+$/",
+		account: "string >= 1",
+		/** Records to keep current; `A` unless the host needs IPv6 too. */
+		types: ddnsRecordTypeSchema.array().default(() => ["A"]),
+		/**
+		* The registered domain (apex) this host sits in. Only needed where a
+		* provider cannot look it up and the guess is wrong (three-label suffixes).
+		*/
+		zone: "string?",
+		/** Seconds; `1` means "automatic" where the provider supports it. */
+		ttl: "number.integer >= 1?",
+		/** Cloudflare only. */
+		proxied: "boolean?",
+		enabled: "boolean = true"
+	}).onUndeclaredKey("reject");
+	ddnsIpv4Schema = type({
+		enabled: "boolean = true",
+		/** Override the public-IP endpoint; empty uses the built-in list. */
+		url: "string = \"\""
+	}).onUndeclaredKey("reject");
+	ddnsIpv6Schema = type({
+		enabled: "boolean = false",
+		url: "string = \"\""
+	}).onUndeclaredKey("reject");
+	ddnsConfigSchema = type({
+		enabled: "boolean = false",
+		/** How often the public address is re-checked. */
+		intervalMs: "number >= 60000 = 300000",
+		ipv4: ddnsIpv4Schema.default(() => ({})),
+		ipv6: ddnsIpv6Schema.default(() => ({})),
+		/** Default TTL for the records that accept one. */
+		ttl: "number.integer >= 1 = 1",
+		/** Default proxy flag, where the provider has one (Cloudflare). */
+		proxied: "boolean = false",
+		/** Tell Telegram about a change, and about an update that failed. */
+		notify: "boolean = true",
+		accounts: ddnsAccountSchema.array().default(() => []),
+		domains: ddnsDomainSchema.array().default(() => [])
+	}).onUndeclaredKey("reject");
+	ddnsRecordStateSchema = type("\"pending\" | \"ok\" | \"unchanged\" | \"error\" | \"skipped\"");
+	ddnsRecordViewSchema = type({
+		host: "string",
+		account: "string",
+		provider: "string",
+		type: ddnsRecordTypeSchema,
+		ip: "string | null",
+		state: ddnsRecordStateSchema,
+		message: "string | null",
+		updatedAt: "number | null"
+	});
+	ddnsStatusSchema = type({
+		enabled: "boolean",
+		running: "boolean",
+		lastRunAt: "number | null",
+		lastResult: "string | null",
+		ipv4: "string | null",
+		ipv6: "string | null",
+		records: ddnsRecordViewSchema.array()
+	});
+	ddnsProviderFieldSchema = type({
+		key: "string",
+		label: "string",
+		hint: "string = \"\"",
+		optional: "boolean = false"
+	});
+	ddnsProviderInfoSchema = type({
+		id: "string",
+		label: "string",
+		docsUrl: "string",
+		families: ddnsRecordTypeSchema.array(),
+		fields: ddnsProviderFieldSchema.array(),
+		ttl: "boolean",
+		proxied: "boolean"
+	});
+	ddnsViewSchema = type({
+		config: ddnsConfigSchema,
+		status: ddnsStatusSchema,
+		providers: ddnsProviderInfoSchema.array(),
+		/** Account ids whose credentials are stored. */
+		credentials: type("string[]")
+	});
+	ddnsCredentialsSchema = type({ credentials: type("Record<string, string>") }).onUndeclaredKey("reject");
 	backupsSchema = type({
 		enabled: "boolean = true",
 		dir: "string = \".backups\"",
@@ -558,6 +699,7 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		onForcedRestart: "boolean?",
 		onRecovered: "boolean?",
 		onHost: "boolean?",
+		onDdns: "boolean?",
 		cooldownMs: "number >= 0?"
 	}).onUndeclaredKey("reject");
 	notificationsPatchSchema = type({ telegram: telegramPatchSchema.optional() }).onUndeclaredKey("reject");
@@ -712,6 +854,8 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		onRecovered: "boolean",
 		/** Host vitals breaches (disk, memory, swap, load, temperature). */
 		onHost: "boolean",
+		/** Dynamic DNS, when this panel knows about it (optional for an older panel). */
+		onDdns: "boolean?",
 		cooldownMs: "number",
 		/** Last delivery outcome, for the settings page. */
 		lastResult: "string | null",
@@ -893,20 +1037,27 @@ password: passwordValueSchema.optional() }).onUndeclaredKey("reject");
 		tls: tlsStatusSchema
 	});
 	appStateSchema = type({
-		control: controlViewSchema,
-		defaults: defaultsSchema,
-		logs: logsSchema,
-		notifications: notificationViewSchema,
-		host: hostViewSchema,
-		backups: backupsViewSchema,
-		configPath: "string",
-		configError: "string | null",
+		"control": controlViewSchema,
+		"defaults": defaultsSchema,
+		"logs": logsSchema,
+		"notifications": notificationViewSchema,
+		"host": hostViewSchema,
+		"backups": backupsViewSchema,
+		"configPath": "string",
+		"configError": "string | null",
 		/** The directory the panel was started from; relative entry paths use it. */
-		projectDir: "string",
+		"projectDir": "string",
 		/** `HHOSTED_HOME`: every file home-hosted owns lives under here. */
-		dataRoot: "string",
-		logsDir: "string",
-		servers: serverViewSchema.array()
+		"dataRoot": "string",
+		"logsDir": "string",
+		/**
+		* Dynamic DNS state. Optional so a newer UI still frames a state a panel from
+		* before this field served: the app would blank on a required key.
+		*/
+		"ddns?": ddnsStatusSchema,
+		/** The release this panel is running. Optional: an older panel does not send one. */
+		"version?": "string",
+		"servers": serverViewSchema.array()
 	});
 	type({
 		type: "\"hello\" | \"state\" | \"log\" | \"server\"",
@@ -1140,6 +1291,21 @@ function apiTokenRecord(token, now = Date.now()) {
 		updatedAt: now
 	};
 }
+/**
+* Only account → string map → string survives; a hand-edited file with a number
+* or a nested object in there reads as "no credentials" instead of throwing.
+*/
+function readDdnsCredentials(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return {};
+	const out = {};
+	for (const [accountId, fields] of Object.entries(value)) {
+		if (typeof fields !== "object" || fields === null || Array.isArray(fields)) continue;
+		const record = {};
+		for (const [key, field] of Object.entries(fields)) if (typeof field === "string" && field.length > 0) record[key] = field;
+		if (Object.keys(record).length > 0) out[accountId] = record;
+	}
+	return out;
+}
 var COST, KEYLEN, SALT_BYTES, API_TOKEN_BYTES, API_TOKEN_HINT_CHARS, SecretsStore;
 var init_secrets = __esmMin((() => {
 	init_atomic();
@@ -1250,12 +1416,38 @@ var init_secrets = __esmMin((() => {
 				telegram: trimmed.length > 0 ? { botToken: trimmed } : null
 			});
 		}
+		getDdnsCredentials(accountId) {
+			return this.load().ddns[accountId] ?? null;
+		}
+		get ddnsAccountIds() {
+			return Object.keys(this.load().ddns);
+		}
+		/** An empty field is dropped, so clearing every field forgets the account. */
+		setDdnsCredentials(accountId, credentials) {
+			const entries = Object.entries(credentials).map(([key, value]) => [key, value.trim()]).filter(([, value]) => value.length > 0);
+			const ddns = { ...this.load().ddns };
+			if (entries.length === 0) delete ddns[accountId];
+			else ddns[accountId] = Object.fromEntries(entries);
+			this.save({
+				...this.load(),
+				ddns
+			});
+		}
+		clearDdnsCredentials(accountId) {
+			const ddns = { ...this.load().ddns };
+			delete ddns[accountId];
+			this.save({
+				...this.load(),
+				ddns
+			});
+		}
 		read() {
 			if (!fs.existsSync(this.file)) return {
 				version: 3,
 				password: null,
 				apiToken: null,
-				telegram: null
+				telegram: null,
+				ddns: {}
 			};
 			try {
 				const parsed = JSON.parse(fs.readFileSync(this.file, "utf8"));
@@ -1263,14 +1455,16 @@ var init_secrets = __esmMin((() => {
 					version: 3,
 					password: parsed?.password ?? null,
 					apiToken: parsed?.apiToken?.hash ? parsed.apiToken : null,
-					telegram: parsed?.telegram?.botToken ? { botToken: parsed.telegram.botToken } : null
+					telegram: parsed?.telegram?.botToken ? { botToken: parsed.telegram.botToken } : null,
+					ddns: readDdnsCredentials(parsed?.ddns)
 				};
 			} catch {
 				return {
 					version: 3,
 					password: null,
 					apiToken: null,
-					telegram: null
+					telegram: null,
+					ddns: {}
 				};
 			}
 		}
@@ -1814,6 +2008,7 @@ var paths_exports = /* @__PURE__ */ __exportAll({
 	daemonLogPath: () => daemonLogPath,
 	dataRoot: () => dataRoot,
 	defaultConfigPath: () => defaultConfigPath,
+	defaultDdnsStatePath: () => defaultDdnsStatePath,
 	defaultHistoryPath: () => defaultHistoryPath,
 	defaultLogsDir: () => defaultLogsDir,
 	defaultNannyDir: () => defaultNannyDir,
@@ -1854,7 +2049,7 @@ function resolveUserPath(target, base = projectDir) {
 	else if (value.startsWith("~/") || value.startsWith("~\\")) value = path.join(os.homedir(), value.slice(2));
 	return path.isAbsolute(value) ? value : path.resolve(base, value);
 }
-var dataRoot, projectDir, defaultConfigPath, configSchemaPath, defaultSecretsPath, defaultLogsDir, defaultHistoryPath, defaultTlsDir, defaultNannyDir, runtimePath, daemonLogPath;
+var dataRoot, projectDir, defaultConfigPath, configSchemaPath, defaultSecretsPath, defaultLogsDir, defaultHistoryPath, defaultTlsDir, defaultNannyDir, defaultDdnsStatePath, runtimePath, daemonLogPath;
 var init_paths = __esmMin((() => {
 	dataRoot = resolveDataRoot();
 	projectDir = resolveProjectDir();
@@ -1865,6 +2060,7 @@ var init_paths = __esmMin((() => {
 	defaultHistoryPath = path.join(dataRoot, ".logs", "history.json");
 	defaultTlsDir = path.join(dataRoot, ".tls");
 	defaultNannyDir = path.join(dataRoot, ".state");
+	defaultDdnsStatePath = path.join(dataRoot, ".state", "ddns.json");
 	runtimePath = path.join(dataRoot, "run.json");
 	daemonLogPath = path.join(dataRoot, ".logs", "home-hosted.log");
 }));
@@ -1929,16 +2125,19 @@ function buildAppState(deps) {
 		notifications: { telegram: deps.notifications.status() },
 		host: buildHostView(deps.hostMonitor),
 		backups: buildBackupsView(deps.store, deps.backups),
+		ddns: deps.ddns.view,
 		configPath: deps.store.path,
 		configError: deps.store.configError,
 		projectDir,
 		dataRoot,
 		logsDir: deps.logsDir,
+		version: appVersion(),
 		servers: deps.views
 	};
 }
 var init_state$1 = __esmMin((() => {
 	init_paths();
+	init_version();
 	init_exposure();
 }));
 //#endregion
@@ -2108,6 +2307,14 @@ var init_backups$1 = __esmMin((() => {
 	nameParam = type({ name: "string >= 1" });
 }));
 //#endregion
+//#region src/helpers/action-result.ts
+/** Unknown ids are 404; a server that exists but cannot act is a 409. */
+function statusForAction(result) {
+	if (result.ok) return 200;
+	return result.error?.startsWith("unknown server") ? 404 : 409;
+}
+var init_action_result = __esmMin((() => {}));
+//#endregion
 //#region src/helpers/deferred.ts
 /**
 * Runs a task after the current response has been written.
@@ -2126,754 +2333,315 @@ var init_deferred = __esmMin((() => {}));
 //#endregion
 //#region src/api/control.ts
 /**
-* The local control channel used by `home-hosted down`.
+* The local control channel used by `home-hosted down` and `home-hosted start|stop`.
 *
 * It is deliberately outside `/api` (so no session is needed) and guarded by a
 * token that only the owner of `run.json` can read, plus a loopback check: a
 * different local user, or anyone on the network, gets nothing.
 */
 function createControlRoute(deps) {
-	return appFactory.createApp().post("/shutdown", describeRoute({
-		tags: ["panel"],
-		summary: "Stop the panel and everything it supervises (local token required)",
-		responses: {
-			200: { description: "Stopping" },
-			403: { description: "Bad token, or not a local caller" }
-		}
-	}), (c) => {
+	/** The one place the local channel's credentials are read. */
+	function assertLocalCall(c, action) {
 		const token = c.req.header("x-home-hosted-token");
 		if (token === void 0 || token !== deps.runtimeToken) throw new DetailedError("invalid token", {
 			statusCode: 403,
 			code: "INVALID_TOKEN"
 		});
-		if (!isLoopbackRequest(c)) throw new DetailedError("only this machine may stop the control panel", {
+		if (!isLoopbackRequest(c)) throw new DetailedError(`only this machine may ${action}`, {
 			statusCode: 403,
 			code: "NOT_LOOPBACK"
 		});
+	}
+	return appFactory.createApp().post("/shutdown", describeRoute({
+		tags: ["panel"],
+		summary: "Stop the panel and everything it supervises (local token required)",
+		responses: {
+			200: { description: "Stopping" },
+			403: { description: "Bad token, or not a local caller" }
+		}
+	}), (c) => {
+		assertLocalCall(c, "stop the control panel");
 		afterResponse(deps.onShutdown, (error) => logger.error("shutdown failed", error));
 		return c.json({ ok: true });
+	}).post("/servers/:id/start", describeRoute({
+		tags: ["panel"],
+		summary: "Start one server, without a session (local token required)",
+		responses: {
+			200: { description: "Started" },
+			403: { description: "Bad token, or not a local caller" },
+			404: { description: "No such server" }
+		}
+	}), async (c) => {
+		assertLocalCall(c, "start or stop a server");
+		const result = await deps.supervisor.start(c.req.param("id"));
+		return c.json(result, statusForAction(result));
+	}).post("/servers/:id/stop", describeRoute({
+		tags: ["panel"],
+		summary: "Stop one server, without a session (local token required)",
+		responses: {
+			200: { description: "Stopped" },
+			403: { description: "Bad token, or not a local caller" },
+			404: { description: "No such server" }
+		}
+	}), async (c) => {
+		assertLocalCall(c, "start or stop a server");
+		const result = await deps.supervisor.stop(c.req.param("id"));
+		return c.json(result, statusForAction(result));
 	});
 }
 var init_control = __esmMin((() => {
+	init_action_result();
 	init_deferred();
 	init_factory();
 	init_logger();
 	init_loopback();
 }));
 //#endregion
-//#region src/api/events.ts
-/**
-* One SSE stream per subscriber. Pass `?serverId=<id>` to receive only that
-* server's messages; the first frame always carries the full state snapshot.
-*/
-function createEventsRoute(deps) {
-	return appFactory.createApp().get("/events", describeRoute({
-		tags: ["panel"],
-		summary: "Panel state and log frames as server-sent events",
-		responses: { 200: { description: "text/event-stream" } }
-	}), validate("query", eventsQuery), (c) => {
-		const query = c.req.valid("query");
-		const serverId = query.serverId ?? null;
-		const logOnly = query.logs !== "0";
-		return streamSSE(c, async (stream) => {
-			let pending = 0;
-			let queue = Promise.resolve();
-			let closed = false;
-			const send = (message) => {
-				if (closed) return queue;
-				if (message.type === "log" && pending > MAX_PENDING_WRITES$1) return queue;
-				pending += 1;
-				queue = queue.then(() => stream.writeSSE({
-					event: message.type,
-					data: JSON.stringify(message)
-				})).catch(() => {
-					closed = true;
-				}).finally(() => {
-					pending -= 1;
-				});
-				return queue;
-			};
-			const unsubscribe = deps.hub.subscribe(serverId, (message) => {
-				if (!logOnly && message.type === "log") return;
-				send(message);
-			});
-			stream.onAbort(() => {
-				closed = true;
-				unsubscribe();
-			});
-			await send({
-				type: "hello",
-				ts: Date.now(),
-				state: deps.supervisor.getState()
-			});
-			while (true) {
-				await stream.sleep(PING_INTERVAL_MS);
-				if (closed) break;
-				await stream.writeSSE({
-					event: "ping",
-					data: String(Date.now())
-				});
-			}
-		});
-	});
+//#region src/config/migrations.ts
+/** What would have to run to bring `from` up to `to`. */
+function planConfigMigrations(from, options = {}) {
+	const to = options.to ?? 1;
+	return {
+		from,
+		to,
+		steps: (options.migrations ?? configMigrations).filter((migration) => migration.to > from && migration.to <= to).sort((a, b) => a.to - b.to),
+		tooNew: from > to
+	};
 }
-var MAX_PENDING_WRITES$1, PING_INTERVAL_MS, eventsQuery;
-var init_events$1 = __esmMin((() => {
-	init_factory();
-	init_validator();
-	MAX_PENDING_WRITES$1 = 200;
-	PING_INTERVAL_MS = 15e3;
-	eventsQuery = type({
-		/** Only this server's frames. */
-		"serverId?": "string",
-		/** `logs=0` drops log frames; the first frame is always the full state. */
-		"logs?": "string"
-	});
+/** Applies the plan in order; the caller owns writing the result. */
+function applyConfigMigrations(config, from, options = {}) {
+	const { steps } = planConfigMigrations(from, options);
+	let current = config;
+	for (const step of steps) current = step.apply(current);
+	return {
+		config: current,
+		applied: steps
+	};
+}
+var configMigrations;
+var init_migrations = __esmMin((() => {
+	configMigrations = [];
 }));
 //#endregion
-//#region src/api/health.ts
+//#region src/config/schema.ts
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 /**
-* Liveness for external monitors. Mounted outside `/api`, so it answers without a
-* session: it reports whether the panel itself is serving, and 503 when an
-* autostart server has crashed. Server details are only included for an
-* authenticated caller.
+* Resolves one entry against the panel's server defaults. A group (`restart`,
+* `health`, `health.http`, `stop`) merges key by key, so an entry that decides one
+* member does not silently fall back to the *schema* default for the others — which
+* is the whole point of the panel having defaults at all.
 */
-function createHealthRoute(deps) {
-	return appFactory.createApp().get("/healthz", describeRoute({
-		tags: ["panel"],
-		summary: "Liveness for monitors — no session required",
-		responses: {
-			200: {
-				description: "Serving",
-				content: jsonBody(type({
-					"status": "\"ok\" | \"degraded\"",
-					"uptimeMs": "number",
-					"servers?": type({
-						total: "number",
-						running: "number",
-						crashed: "number",
-						unhealthy: "number"
-					}),
-					"hostAlerts?": "string[]"
-				}))
-			},
-			503: { description: "An autostart server has crashed" }
-		}
-	}), (c) => {
-		const state = deps.supervisor.getState();
-		const broken = state.servers.filter((server) => server.config.autostart && server.status === "crashed");
-		const authenticated = requestIdentity(c, deps.auth).authenticated;
-		return c.json({
-			status: broken.length > 0 ? "degraded" : "ok",
-			uptimeMs: Math.round(process.uptime() * 1e3),
-			...authenticated ? {
-				servers: {
-					total: state.servers.length,
-					running: state.servers.filter((server) => server.status === "running").length,
-					crashed: state.servers.filter((server) => server.status === "crashed").length,
-					unhealthy: state.servers.filter((server) => server.health === "unhealthy").length
-				},
-				hostAlerts: state.host.alerts
-			} : {}
-		}, broken.length > 0 ? 503 : 200);
-	});
+function mergeDefaults(defaults, entry) {
+	const merged = { ...entry };
+	for (const [key, value] of Object.entries(defaults)) {
+		const current = merged[key];
+		if (current === void 0) merged[key] = value;
+		else if (isRecord$2(value) && isRecord$2(current)) merged[key] = mergeDefaults(value, current);
+	}
+	return merged;
 }
-var init_health = __esmMin((() => {
-	init_factory();
-	init_openapi$1();
-	init_auth();
+var metaSchema, configSchema, CONFIG_KEYS;
+var init_schema = __esmMin((() => {
+	init_contracts();
+	metaSchema = type({
+		writtenBy: "string = \"\"",
+		schema: "number.integer >= 1 = 1"
+	}).onUndeclaredKey("reject");
+	configSchema = type({
+		$schema: "string?",
+		meta: metaSchema.optional(),
+		control: controlSchema.default(() => ({})),
+		defaults: defaultsSchema.default(() => ({})),
+		logs: logsSchema.default(() => ({})),
+		notifications: notificationsSchema.default(() => ({})),
+		host: hostSchema.default(() => ({})),
+		backups: backupsSchema.default(() => ({})),
+		ddns: ddnsConfigSchema.default(() => ({})),
+		servers: serverSchema.array().default(() => [])
+	}).onUndeclaredKey("reject");
+	CONFIG_KEYS = [
+		"$schema",
+		"meta",
+		"control",
+		"defaults",
+		"logs",
+		"notifications",
+		"host",
+		"backups",
+		"ddns",
+		"servers"
+	];
 }));
 //#endregion
-//#region src/api/logs.ts
-function unknownServer$1(id) {
-	return new DetailedError(`unknown server "${id}"`, {
-		statusCode: 404,
-		code: "UNKNOWN_SERVER"
-	});
+//#region src/config/parse.ts
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function createLogsRoute(deps) {
-	return appFactory.createApp().get("/logs", describeRoute({
-		tags: ["logs"],
-		summary: "Every server with its on-disk log files",
-		responses: { 200: {
-			description: "Log sources",
-			content: jsonBody(logServersViewSchema)
-		} }
-	}), (c) => c.json({ servers: deps.supervisor.views().map((server) => ({
-		serverId: server.id,
-		label: server.config.label ?? server.id,
-		status: server.status,
-		...deps.logFiles.info(server.id)
-	})) })).get("/logs/:id", describeRoute({
-		tags: ["logs"],
-		summary: "Persisted log lines, with search and a stream filter",
-		responses: {
-			200: { description: "Lines" },
-			404: ERROR_RESPONSES[404]
-		}
-	}), validate("param", idParam$1), validate("query", logHistoryQuerySchema), (c) => {
-		const { id } = c.req.valid("param");
-		if (!deps.store.getServer(id)) throw unknownServer$1(id);
-		const query = c.req.valid("query");
-		const requested = query.tail === void 0 ? DEFAULT_TAIL : Number.parseInt(query.tail, 10);
-		const tail = Number.isNaN(requested) ? DEFAULT_TAIL : Math.min(Math.max(requested, MIN_TAIL), MAX_TAIL);
-		const info = deps.logFiles.info(id);
-		const search = query.search?.trim() ?? "";
-		const window = search.length > 0 ? Math.max(tail, MAX_TAIL) : tail;
-		let lines = deps.logFiles.readTail(id, window);
-		if (query.stream !== void 0 && query.stream.length > 0) lines = lines.filter((line) => line.stream === query.stream);
-		if (search.length > 0) {
-			const needle = search.toLowerCase();
-			lines = lines.filter((line) => line.text.toLowerCase().includes(needle));
-		}
-		return c.json({
-			serverId: id,
-			enabled: info.enabled,
-			sizeBytes: info.sizeBytes,
-			files: info.files.map((file) => file.name),
-			searched: search.length > 0 ? window : null,
-			lines: lines.slice(-tail)
-		});
-	}).get("/logs/:id/download", describeRoute({
-		tags: ["logs"],
-		summary: "Download one rotated log file",
-		responses: {
-			200: { description: "application/x-ndjson" },
-			404: ERROR_RESPONSES[404]
-		}
-	}), validate("param", idParam$1), validate("query", downloadQuery), (c) => {
-		const { id } = c.req.valid("param");
-		if (!deps.store.getServer(id)) throw unknownServer$1(id);
-		const requested = c.req.valid("query").file ?? `${id}.log`;
-		if (!deps.logFiles.info(id).files.map((file) => file.name).includes(requested)) throw new DetailedError("unknown log file", {
-			statusCode: 404,
-			code: "UNKNOWN_LOG_FILE"
-		});
-		const file = path.join(deps.logFiles.directory, requested);
-		const body = fs.readFileSync(file);
-		return c.body(body, 200, {
-			"Content-Type": "application/x-ndjson; charset=utf-8",
-			"Content-Length": String(body.byteLength),
-			"Content-Disposition": `attachment; filename="${requested}"`
-		});
-	}).delete("/logs/:id", describeRoute({
-		tags: ["logs"],
-		summary: "Delete the persisted logs of one server",
-		responses: {
-			200: { description: "Cleared" },
-			404: ERROR_RESPONSES[404]
-		}
-	}), validate("param", idParam$1), (c) => {
-		const { id } = c.req.valid("param");
-		if (!deps.store.getServer(id)) throw unknownServer$1(id);
-		deps.logFiles.clear(id);
-		return c.json({ ok: true });
-	});
+function deleteAtPath(root, path) {
+	let node = root;
+	for (const key of path.slice(0, -1)) {
+		node = Array.isArray(node) ? node[Number(key)] : isRecord$1(node) ? node[key] : void 0;
+		if (node === void 0) return;
+	}
+	const last = path[path.length - 1];
+	if (last === void 0) return;
+	if (isRecord$1(node)) delete node[String(last)];
+	else if (Array.isArray(node) && typeof last === "number") node.splice(last, 1);
 }
-var MIN_TAIL, MAX_TAIL, DEFAULT_TAIL, idParam$1, downloadQuery;
-var init_logs = __esmMin((() => {
-	init_factory();
-	init_openapi$1();
-	init_validator();
-	init_contracts();
-	MIN_TAIL = 50;
-	MAX_TAIL = 5e3;
-	DEFAULT_TAIL = 500;
-	idParam$1 = type({ id: "string >= 1" });
-	downloadQuery = type({ "file?": "string" });
-}));
-//#endregion
-//#region src/api/metrics.ts
 /**
-* Prometheus text for whatever wants to scrape the panel (Beszel, Grafana,
-* `curl`). Lives under `/api`, so it needs a session like every other route.
+* Validates one object against one schema, tolerating keys the schema does not
+* know: a config written by a newer release has to keep working here, and losing
+* the *whole group* to schema defaults would silently reset the listener port,
+* the bind and the auth policy over a single unrecognized key.
+*
+* Only unrecognized keys are dropped, and each one is reported. Anything else is
+* a real problem, returned for the caller to refuse on.
 */
-function createMetricsRoute(deps) {
-	return appFactory.createApp().get("/metrics", describeRoute({
-		tags: ["panel"],
-		summary: "Prometheus text for whatever scrapes the panel",
-		responses: { 200: { description: "text/plain; version=0.0.4" } }
-	}), (c) => {
-		const state = deps.supervisor.getState();
-		const lines = [];
-		const metric = (name, help, samples) => {
-			if (samples.length === 0) return;
-			lines.push(`# HELP ${name} ${help}`, `# TYPE ${name} gauge`, ...samples);
+function parseTolerant(value, schema, prefix, unknownKeys) {
+	const candidate = structuredClone(value);
+	for (let pass = 0; pass < 25; pass++) {
+		const parsed = schema(candidate);
+		if (!(parsed instanceof type.errors)) return {
+			value: parsed,
+			error: null
 		};
-		metric("hh_control_up", "Control plane is serving", ["hh_control_up 1"]);
-		metric("hh_servers_total", "Configured servers", [`hh_servers_total ${state.servers.length}`]);
-		metric("hh_server_up", "Server process is running", state.servers.map((server) => `hh_server_up{server="${server.id}"} ${server.status === "running" ? 1 : 0}`));
-		metric("hh_server_restarts_total", "Restarts since the control plane started", state.servers.map((server) => `hh_server_restarts_total{server="${server.id}"} ${server.restarts}`));
-		metric("hh_server_crashes_24h", "Crashes in the last 24 hours", state.servers.map((server) => `hh_server_crashes_24h{server="${server.id}"} ${server.history.crashes}`));
-		metric("hh_server_uptime_ratio_24h", "Share of the last 24 hours the server was up", state.servers.filter((server) => server.history.uptimeRatio !== null).map((server) => `hh_server_uptime_ratio_24h{server="${server.id}"} ${server.history.uptimeRatio.toFixed(4)}`));
-		metric("hh_server_response_ms", "Last health probe latency in milliseconds", state.servers.filter((server) => server.responseMs !== null).map((server) => `hh_server_response_ms{server="${server.id}"} ${server.responseMs}`));
-		metric("hh_server_rss_bytes", "RSS of the server process tree", state.servers.filter((server) => server.resources?.rssBytes != null).map((server) => `hh_server_rss_bytes{server="${server.id}"} ${server.resources.rssBytes}`));
-		metric("hh_server_cpu_percent", "CPU percent of the server process tree", state.servers.filter((server) => server.resources?.cpuPercent != null).map((server) => `hh_server_cpu_percent{server="${server.id}"} ${server.resources.cpuPercent}`));
-		metric("hh_host_disk_used_percent", "Disk usage percent per configured path", state.host.disks.map((disk) => `hh_host_disk_used_percent{mount="${disk.path}"} ${disk.usedPercent.toFixed(2)}`));
-		metric("hh_host_memory_used_percent", "Memory usage percent", [`hh_host_memory_used_percent ${state.host.memoryUsedPercent.toFixed(2)}`]);
-		metric("hh_host_swap_used_percent", "Swap usage percent", [`hh_host_swap_used_percent ${state.host.swapUsedPercent.toFixed(2)}`]);
-		metric("hh_host_load1_per_cpu", "1 minute load average per cpu", [`hh_host_load1_per_cpu ${((state.host.loadAvg[0] ?? 0) / Math.max(1, state.host.cpus)).toFixed(3)}`]);
-		return c.text(`${lines.join("\n")}\n`, 200, { "Content-Type": "text/plain; version=0.0.4; charset=utf-8" });
-	});
-}
-var init_metrics = __esmMin((() => {
-	init_factory();
-}));
-//#endregion
-//#region src/providers/telegram.ts
-function getBot(token) {
-	const cached = bots.get(token);
-	if (cached) return cached;
-	const bot = new Bot(token, { client: { timeoutSeconds: 10 } });
-	bot.api.config.use(autoRetry({
-		maxRetryAttempts: 3,
-		maxDelaySeconds: 20
-	}));
-	bots.set(token, bot);
-	return bot;
-}
-/** Drops cached clients; used when the token changes or the service shuts down. */
-function forgetBots() {
-	bots.clear();
-}
-function escapeHtml(value) {
-	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-}
-function formatTelegramMessage(title, lines) {
-	const body = lines.filter((line) => line.length > 0).map((line) => `• ${escapeHtml(line)}`).join("\n");
-	return `<b>${escapeHtml(title)}</b>${body.length > 0 ? `\n${body}` : ""}`;
-}
-/** Turns a grammY error into something worth showing in the settings page. */
-function describeTelegramError(error) {
-	if (typeof error === "object" && error !== null) {
-		const candidate = error;
-		const description = candidate.description ?? candidate.message;
-		if (description) return `${description}${candidate.error_code === void 0 ? "" : ` (${candidate.error_code})`}${candidate.parameters?.retry_after === void 0 ? "" : `, retry in ${candidate.parameters.retry_after}s`}`;
-	}
-	return error instanceof Error ? error.message : String(error);
-}
-async function sendTelegramMessage(token, chatId, html) {
-	try {
-		await getBot(token).api.sendMessage(chatId, html, {
-			parse_mode: "HTML",
-			link_preview_options: { is_disabled: true }
-		});
-		return { ok: true };
-	} catch (error) {
-		return {
-			ok: false,
-			error: describeTelegramError(error)
-		};
-	}
-}
-async function verifyTelegramToken(token) {
-	try {
-		return {
-			ok: true,
-			username: (await getBot(token).api.getMe()).username
-		};
-	} catch (error) {
-		return {
-			ok: false,
-			error: describeTelegramError(error)
+		const removable = parsed.filter((problem) => problem.problem === UNDECLARED);
+		if (removable.length === 0) return {
+			value: null,
+			error: parsed.summary
+		};
+		if (!isRecord$1(candidate)) return {
+			value: null,
+			error: parsed.summary
 		};
+		for (const problem of removable) {
+			const at = `${prefix}.${problem.path.join(".")}`;
+			if (!unknownKeys.includes(at)) unknownKeys.push(at);
+			deleteAtPath(candidate, problem.path);
+		}
 	}
+	return {
+		value: null,
+		error: "too many unrecognized keys to ignore"
+	};
 }
 /**
-* Recent chats that talked to the bot, so a chat id can be picked instead of
-* hunted down by hand. Telegram only reports chats with pending updates, so the
-* caller is told to message the bot first.
+* Reads a `servers.config.json` from any release. Unrecognized keys are reported
+* and left on disk; blocking problems — including a file this release cannot
+* understand — land in `errors` and leave `config` null.
 */
-async function listTelegramChats(token) {
-	try {
-		const updates = await getBot(token).api.getUpdates({
-			limit: 100,
-			allowed_updates: [
-				"message",
-				"channel_post",
-				"edited_message"
-			]
-		});
-		const chats = /* @__PURE__ */ new Map();
-		for (const update of updates) {
-			const chat = update.message?.chat ?? update.channel_post?.chat ?? update.edited_message?.chat;
-			if (!chat) continue;
-			const title = "title" in chat && chat.title ? chat.title : "username" in chat && chat.username ? `@${chat.username}` : "first_name" in chat && chat.first_name ? chat.first_name : "private chat";
-			chats.set(String(chat.id), {
-				id: chat.id,
-				title
-			});
-		}
-		return {
-			ok: true,
-			chats: [...chats.values()]
-		};
-	} catch (error) {
-		return {
-			ok: false,
-			chats: [],
-			error: describeTelegramError(error)
-		};
+function parseConfig(raw, options = {}) {
+	const unknownKeys = [];
+	const errors = [];
+	const warnings = [];
+	const result = {
+		config: null,
+		errors,
+		unknownKeys,
+		warnings,
+		schemaVersion: 1,
+		writtenBy: null
+	};
+	if (!isRecord$1(raw)) {
+		errors.push("the config must contain a JSON object");
+		return result;
 	}
-}
-var bots;
-var init_telegram = __esmMin((() => {
-	bots = /* @__PURE__ */ new Map();
-}));
-//#endregion
-//#region src/api/notifications.ts
-/**
-* The bot token is written straight to the secrets file and never into
-* `servers.config.json`, so notification *policy* and the *credential* stay
-* separate.
-*/
-function createNotificationsRoute(deps) {
-	return appFactory.createApp().put("/notifications/token", describeRoute({
-		tags: ["notifications"],
-		summary: "Store the Telegram bot token (verified first)",
-		responses: {
-			200: { description: "Stored" },
-			400: ERROR_RESPONSES[400]
-		}
-	}), validate("json", telegramTokenSchema), async (c) => {
-		const { botToken } = c.req.valid("json");
-		const verified = await deps.notifications.verifyToken(botToken);
-		if (!verified.ok) throw new DetailedError(`telegram rejected the token: ${verified.error ?? "unknown error"}`, {
-			statusCode: 400,
-			code: "TELEGRAM_TOKEN_REJECTED"
-		});
-		deps.secrets.setTelegramToken(botToken);
-		forgetBots();
-		return c.json({
-			ok: true,
-			username: verified.username ?? null
-		});
-	}).delete("/notifications/token", describeRoute({
-		tags: ["notifications"],
-		summary: "Forget the Telegram bot token",
-		responses: { 200: { description: "Removed" } }
-	}), (c) => {
-		deps.secrets.setTelegramToken(null);
-		forgetBots();
-		return c.json({ ok: true });
-	}).post("/notifications/test", describeRoute({
-		tags: ["notifications"],
-		summary: "Send a test message",
-		responses: {
-			200: { description: "Sent or refused" },
-			400: ERROR_RESPONSES[400]
+	const meta = isRecord$1(raw.meta) ? raw.meta : null;
+	const schemaVersion = typeof meta?.schema === "number" ? meta.schema : 1;
+	const writtenBy = typeof meta?.writtenBy === "string" && meta.writtenBy.length > 0 ? meta.writtenBy : null;
+	result.schemaVersion = schemaVersion;
+	result.writtenBy = writtenBy;
+	if (schemaVersion > 1) {
+		errors.push(`written by home-hosted ${writtenBy ?? "a newer release"} (config schema ${schemaVersion}); this release understands schema 1`);
+		return result;
+	}
+	const { steps } = planConfigMigrations(schemaVersion, options);
+	if (steps.length > 0) {
+		errors.push(`config schema ${schemaVersion} needs ${steps.length} migration${steps.length === 1 ? "" : "s"} before this release can use it`);
+		return result;
+	}
+	for (const key of Object.keys(raw)) if (!CONFIG_KEYS.includes(key)) unknownKeys.push(key);
+	const groups = {};
+	for (const [name, schema] of GROUPS) {
+		const parsed = parseTolerant(raw[name] ?? {}, schema, name, unknownKeys);
+		if (parsed.error !== null) errors.push(`${name}: ${parsed.error}`);
+		groups[name] = parsed.value ?? schema({});
+	}
+	const defaults = groups.defaults;
+	const servers = [];
+	const seen = /* @__PURE__ */ new Set();
+	(Array.isArray(raw.servers) ? raw.servers : []).forEach((entry, index) => {
+		const label = `servers[${index}]`;
+		const parsed = parseTolerant(isRecord$1(entry) ? mergeDefaults(defaults, entry) : entry, serverSchema, label, unknownKeys);
+		if (parsed.error !== null) {
+			const id = isRecord$1(entry) ? entry.id : void 0;
+			errors.push(`${label}${typeof id === "string" ? ` ("${id}")` : ""}: ${parsed.error}`);
+			return;
 		}
-	}), validate("json", notificationActionSchema), async (c) => {
-		const result = await deps.notifications.sendTest(c.req.valid("json"));
-		if (!result.ok) throw new DetailedError(result.error ?? "the test message failed", {
-			statusCode: 400,
-			code: "TELEGRAM_SEND_FAILED"
-		});
-		return c.json(result);
-	}).post("/notifications/detect-chats", describeRoute({
-		tags: ["notifications"],
-		summary: "List the chats the bot can see",
-		responses: {
-			200: {
-				description: "Chats",
-				content: jsonBody(type({ chats: type({
-					id: "string | number",
-					title: "string"
-				}).array() }))
-			},
-			400: ERROR_RESPONSES[400]
+		const server = parsed.value;
+		if (seen.has(server.id)) {
+			errors.push(`${label}: duplicate id "${server.id}"`);
+			return;
 		}
-	}), validate("json", notificationActionSchema), async (c) => {
-		const result = await deps.notifications.detectChats(c.req.valid("json"));
-		if (!result.ok) throw new DetailedError(result.error ?? "could not list chats", {
-			statusCode: 400,
-			code: "TELEGRAM_LIST_FAILED"
+		seen.add(server.id);
+		servers.push({
+			...server,
+			port: server.port ?? null
 		});
-		return c.json({ chats: result.chats });
 	});
+	warnings.push(...validateDependencies(servers));
+	if (errors.length > 0) return result;
+	result.config = {
+		meta: {
+			writtenBy: writtenBy ?? "",
+			schema: schemaVersion
+		},
+		control: groups.control,
+		defaults,
+		logs: groups.logs,
+		notifications: groups.notifications,
+		host: groups.host,
+		backups: groups.backups,
+		ddns: groups.ddns,
+		servers
+	};
+	return result;
 }
-var init_notifications$1 = __esmMin((() => {
-	init_factory();
-	init_openapi$1();
-	init_validator();
-	init_telegram();
-	init_contracts();
-}));
-//#endregion
-//#region src/config/migrations.ts
-/** What would have to run to bring `from` up to `to`. */
-function planConfigMigrations(from, options = {}) {
-	const to = options.to ?? 1;
-	return {
-		from,
-		to,
-		steps: (options.migrations ?? configMigrations).filter((migration) => migration.to > from && migration.to <= to).sort((a, b) => a.to - b.to),
-		tooNew: from > to
+/** Dangling dependencies and cycles are reported, not fatal: supervision still runs. */
+function validateDependencies(servers) {
+	const ids = new Set(servers.map((server) => server.id));
+	const errors = [];
+	for (const server of servers) for (const dependency of server.dependsOn) if (dependency === server.id) errors.push(`"${server.id}" depends on itself`);
+	else if (!ids.has(dependency)) errors.push(`"${server.id}" depends on unknown server "${dependency}"`);
+	const visiting = /* @__PURE__ */ new Set();
+	const settled = /* @__PURE__ */ new Set();
+	const byId = new Map(servers.map((server) => [server.id, server]));
+	const walk = (id) => {
+		if (settled.has(id)) return;
+		if (visiting.has(id)) {
+			errors.push(`dependency cycle through "${id}"`);
+			return;
+		}
+		visiting.add(id);
+		for (const dependency of byId.get(id)?.dependsOn ?? []) walk(dependency);
+		visiting.delete(id);
+		settled.add(id);
 	};
+	for (const server of servers) walk(server.id);
+	return [...new Set(errors)];
 }
-/** Applies the plan in order; the caller owns writing the result. */
-function applyConfigMigrations(config, from, options = {}) {
-	const { steps } = planConfigMigrations(from, options);
-	let current = config;
-	for (const step of steps) current = step.apply(current);
+/** Adds the stamp every write carries, so the next release can tell what wrote the file. */
+function stampConfig(draft) {
+	const { $schema, meta: _meta, ...rest } = draft;
 	return {
-		config: current,
-		applied: steps
-	};
-}
-var configMigrations;
-var init_migrations = __esmMin((() => {
-	configMigrations = [];
-}));
-//#endregion
-//#region src/config/schema.ts
-function isRecord$2(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/**
-* Resolves one entry against the panel's server defaults. A group (`restart`,
-* `health`, `health.http`, `stop`) merges key by key, so an entry that decides one
-* member does not silently fall back to the *schema* default for the others — which
-* is the whole point of the panel having defaults at all.
-*/
-function mergeDefaults(defaults, entry) {
-	const merged = { ...entry };
-	for (const [key, value] of Object.entries(defaults)) {
-		const current = merged[key];
-		if (current === void 0) merged[key] = value;
-		else if (isRecord$2(value) && isRecord$2(current)) merged[key] = mergeDefaults(value, current);
-	}
-	return merged;
-}
-var metaSchema, configSchema, CONFIG_KEYS;
-var init_schema = __esmMin((() => {
-	init_contracts();
-	metaSchema = type({
-		writtenBy: "string = \"\"",
-		schema: "number.integer >= 1 = 1"
-	}).onUndeclaredKey("reject");
-	configSchema = type({
-		$schema: "string?",
-		meta: metaSchema.optional(),
-		control: controlSchema.default(() => ({})),
-		defaults: defaultsSchema.default(() => ({})),
-		logs: logsSchema.default(() => ({})),
-		notifications: notificationsSchema.default(() => ({})),
-		host: hostSchema.default(() => ({})),
-		backups: backupsSchema.default(() => ({})),
-		servers: serverSchema.array().default(() => [])
-	}).onUndeclaredKey("reject");
-	CONFIG_KEYS = [
-		"$schema",
-		"meta",
-		"control",
-		"defaults",
-		"logs",
-		"notifications",
-		"host",
-		"backups",
-		"servers"
-	];
-}));
-//#endregion
-//#region src/helpers/version.ts
-var version_exports = /* @__PURE__ */ __exportAll({ appVersion: () => appVersion });
-/**
-* The running release, read from the package manifest.
-*
-* The caller may be `src/**` under tsx or the built `dist/cli.js`, so the manifest
-* is found by walking up rather than by a fixed relative path. `src/cli.ts` keeps
-* its own read because it may only import node builtins statically.
-*/
-function appVersion() {
-	if (cached !== null) return cached;
-	let dir = path.dirname(fileURLToPath(import.meta.url));
-	for (let depth = 0; depth < 4; depth++) {
-		try {
-			const manifest = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf8"));
-			if (manifest.name === "home-hosted" && typeof manifest.version === "string") {
-				cached = manifest.version;
-				return cached;
-			}
-		} catch {}
-		const parent = path.dirname(dir);
-		if (parent === dir) break;
-		dir = parent;
-	}
-	cached = "0.0.0";
-	return cached;
-}
-var cached;
-var init_version = __esmMin((() => {
-	cached = null;
-}));
-//#endregion
-//#region src/config/parse.ts
-function isRecord$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function deleteAtPath(root, path) {
-	let node = root;
-	for (const key of path.slice(0, -1)) {
-		node = Array.isArray(node) ? node[Number(key)] : isRecord$1(node) ? node[key] : void 0;
-		if (node === void 0) return;
-	}
-	const last = path[path.length - 1];
-	if (last === void 0) return;
-	if (isRecord$1(node)) delete node[String(last)];
-	else if (Array.isArray(node) && typeof last === "number") node.splice(last, 1);
-}
-/**
-* Validates one object against one schema, tolerating keys the schema does not
-* know: a config written by a newer release has to keep working here, and losing
-* the *whole group* to schema defaults would silently reset the listener port,
-* the bind and the auth policy over a single unrecognized key.
-*
-* Only unrecognized keys are dropped, and each one is reported. Anything else is
-* a real problem, returned for the caller to refuse on.
-*/
-function parseTolerant(value, schema, prefix, unknownKeys) {
-	const candidate = structuredClone(value);
-	for (let pass = 0; pass < 25; pass++) {
-		const parsed = schema(candidate);
-		if (!(parsed instanceof type.errors)) return {
-			value: parsed,
-			error: null
-		};
-		const removable = parsed.filter((problem) => problem.problem === UNDECLARED);
-		if (removable.length === 0) return {
-			value: null,
-			error: parsed.summary
-		};
-		if (!isRecord$1(candidate)) return {
-			value: null,
-			error: parsed.summary
-		};
-		for (const problem of removable) {
-			const at = `${prefix}.${problem.path.join(".")}`;
-			if (!unknownKeys.includes(at)) unknownKeys.push(at);
-			deleteAtPath(candidate, problem.path);
-		}
-	}
-	return {
-		value: null,
-		error: "too many unrecognized keys to ignore"
-	};
-}
-/**
-* Reads a `servers.config.json` from any release. Unrecognized keys are reported
-* and left on disk; blocking problems — including a file this release cannot
-* understand — land in `errors` and leave `config` null.
-*/
-function parseConfig(raw, options = {}) {
-	const unknownKeys = [];
-	const errors = [];
-	const warnings = [];
-	const result = {
-		config: null,
-		errors,
-		unknownKeys,
-		warnings,
-		schemaVersion: 1,
-		writtenBy: null
-	};
-	if (!isRecord$1(raw)) {
-		errors.push("the config must contain a JSON object");
-		return result;
-	}
-	const meta = isRecord$1(raw.meta) ? raw.meta : null;
-	const schemaVersion = typeof meta?.schema === "number" ? meta.schema : 1;
-	const writtenBy = typeof meta?.writtenBy === "string" && meta.writtenBy.length > 0 ? meta.writtenBy : null;
-	result.schemaVersion = schemaVersion;
-	result.writtenBy = writtenBy;
-	if (schemaVersion > 1) {
-		errors.push(`written by home-hosted ${writtenBy ?? "a newer release"} (config schema ${schemaVersion}); this release understands schema 1`);
-		return result;
-	}
-	const { steps } = planConfigMigrations(schemaVersion, options);
-	if (steps.length > 0) {
-		errors.push(`config schema ${schemaVersion} needs ${steps.length} migration${steps.length === 1 ? "" : "s"} before this release can use it`);
-		return result;
-	}
-	for (const key of Object.keys(raw)) if (!CONFIG_KEYS.includes(key)) unknownKeys.push(key);
-	const groups = {};
-	for (const [name, schema] of GROUPS) {
-		const parsed = parseTolerant(raw[name] ?? {}, schema, name, unknownKeys);
-		if (parsed.error !== null) errors.push(`${name}: ${parsed.error}`);
-		groups[name] = parsed.value ?? schema({});
-	}
-	const defaults = groups.defaults;
-	const servers = [];
-	const seen = /* @__PURE__ */ new Set();
-	(Array.isArray(raw.servers) ? raw.servers : []).forEach((entry, index) => {
-		const label = `servers[${index}]`;
-		const parsed = parseTolerant(isRecord$1(entry) ? mergeDefaults(defaults, entry) : entry, serverSchema, label, unknownKeys);
-		if (parsed.error !== null) {
-			const id = isRecord$1(entry) ? entry.id : void 0;
-			errors.push(`${label}${typeof id === "string" ? ` ("${id}")` : ""}: ${parsed.error}`);
-			return;
-		}
-		const server = parsed.value;
-		if (seen.has(server.id)) {
-			errors.push(`${label}: duplicate id "${server.id}"`);
-			return;
-		}
-		seen.add(server.id);
-		servers.push({
-			...server,
-			port: server.port ?? null
-		});
-	});
-	warnings.push(...validateDependencies(servers));
-	if (errors.length > 0) return result;
-	result.config = {
-		meta: {
-			writtenBy: writtenBy ?? "",
-			schema: schemaVersion
-		},
-		control: groups.control,
-		defaults,
-		logs: groups.logs,
-		notifications: groups.notifications,
-		host: groups.host,
-		backups: groups.backups,
-		servers
-	};
-	return result;
-}
-/** Dangling dependencies and cycles are reported, not fatal: supervision still runs. */
-function validateDependencies(servers) {
-	const ids = new Set(servers.map((server) => server.id));
-	const errors = [];
-	for (const server of servers) for (const dependency of server.dependsOn) if (dependency === server.id) errors.push(`"${server.id}" depends on itself`);
-	else if (!ids.has(dependency)) errors.push(`"${server.id}" depends on unknown server "${dependency}"`);
-	const visiting = /* @__PURE__ */ new Set();
-	const settled = /* @__PURE__ */ new Set();
-	const byId = new Map(servers.map((server) => [server.id, server]));
-	const walk = (id) => {
-		if (settled.has(id)) return;
-		if (visiting.has(id)) {
-			errors.push(`dependency cycle through "${id}"`);
-			return;
-		}
-		visiting.add(id);
-		for (const dependency of byId.get(id)?.dependsOn ?? []) walk(dependency);
-		visiting.delete(id);
-		settled.add(id);
-	};
-	for (const server of servers) walk(server.id);
-	return [...new Set(errors)];
-}
-/** Adds the stamp every write carries, so the next release can tell what wrote the file. */
-function stampConfig(draft) {
-	const { $schema, meta: _meta, ...rest } = draft;
-	return {
-		...$schema === void 0 ? {} : { $schema },
-		meta: {
-			writtenBy: appVersion(),
-			schema: 1
-		},
-		...rest
+		...$schema === void 0 ? {} : { $schema },
+		meta: {
+			writtenBy: appVersion(),
+			schema: 1
+		},
+		...rest
 	};
 }
 var GROUPS, UNDECLARED;
@@ -2887,7 +2655,8 @@ var init_parse = __esmMin((() => {
 		["logs", logsSchema],
 		["notifications", notificationsSchema],
 		["host", hostSchema],
-		["backups", backupsSchema]
+		["backups", backupsSchema],
+		["ddns", ddnsConfigSchema]
 	];
 	UNDECLARED = "must be removed";
 }));
@@ -3153,6 +2922,18 @@ var init_store = __esmMin((() => {
 			this.commit(draft);
 			return backups;
 		}
+		/**
+		* The DDNS block is replaced as a whole: its accounts and domains are lists,
+		* and a key-by-key merge would leave a removed account or hostname behind.
+		*/
+		updateDdns(config) {
+			const parsed = ddnsConfigSchema(config);
+			if (parsed instanceof type.errors) throw new ConfigError(`ddns: ${formatErrors(parsed)}`);
+			const draft = structuredClone(this.raw);
+			draft.ddns = parsed;
+			this.commit(draft);
+			return parsed;
+		}
 		updateDefaults(patch) {
 			const draft = structuredClone(this.raw);
 			draft.defaults = { ...draft.defaults ?? {} };
@@ -3201,43 +2982,1754 @@ var init_store = __esmMin((() => {
 			this.apply(stamped);
 			this.notify();
 		}
-		resolveFallback() {
-			const control = controlSchema({});
-			const defaults = defaultsSchema({});
-			if (control instanceof type.errors || defaults instanceof type.errors) throw new ConfigError("internal: default config failed validation");
-			const logs = logsSchema({});
-			const notifications = notificationsSchema({});
-			const host = hostSchema({});
-			const backups = backupsSchema({});
-			if (logs instanceof type.errors || notifications instanceof type.errors || host instanceof type.errors || backups instanceof type.errors) throw new ConfigError("internal: default settings failed validation");
-			return {
-				control,
-				defaults,
-				logs,
-				notifications,
-				host,
-				backups,
-				servers: []
-			};
+		resolveFallback() {
+			const control = controlSchema({});
+			const defaults = defaultsSchema({});
+			if (control instanceof type.errors || defaults instanceof type.errors) throw new ConfigError("internal: default config failed validation");
+			const logs = logsSchema({});
+			const notifications = notificationsSchema({});
+			const host = hostSchema({});
+			const backups = backupsSchema({});
+			const ddns = ddnsConfigSchema({});
+			if (logs instanceof type.errors || notifications instanceof type.errors || host instanceof type.errors || backups instanceof type.errors || ddns instanceof type.errors) throw new ConfigError("internal: default settings failed validation");
+			return {
+				control,
+				defaults,
+				logs,
+				notifications,
+				host,
+				backups,
+				ddns,
+				servers: []
+			};
+		}
+		apply(raw) {
+			this.raw = raw;
+			const parsed = parseConfig(raw);
+			this.error = parsed.errors.length > 0 ? parsed.errors.join("; ") : null;
+			this.schemaVersion = parsed.schemaVersion;
+			this.warnings = [...parsed.warnings, ...parsed.unknownKeys.length === 0 ? [] : [`${path.basename(this.file)} carries ${parsed.unknownKeys.length} unrecognized key(s) this release ignores: ${parsed.unknownKeys.join(", ")}`]];
+			if (parsed.config !== null) this.resolvedConfig = parsed.config;
+			else if (this.resolvedConfig === void 0) this.resolvedConfig = this.resolveFallback();
+		}
+	};
+}));
+//#endregion
+//#region src/providers/ddns/types.ts
+function succeeded(message, changed) {
+	return {
+		ok: true,
+		changed,
+		message
+	};
+}
+function failed(error) {
+	return {
+		ok: false,
+		changed: false,
+		message: error,
+		error
+	};
+}
+/** Missing required credential keys, as a sentence for the settings page. */
+function missingFields(credentials, keys) {
+	const missing = keys.filter((key) => (credentials?.[key] ?? "").trim().length === 0);
+	return missing.length === 0 ? null : `set ${missing.join(", ")}`;
+}
+function basicAuth(user, password) {
+	return `Basic ${Buffer$1.from(`${user}:${password}`, "utf8").toString("base64")}`;
+}
+/** A provider error body is useful, but never worth throwing over. */
+async function errorText(response, limit = 300) {
+	try {
+		const text = (await response.text()).replace(/\s+/g, " ").trim();
+		return text.length === 0 ? `HTTP ${response.status}` : `HTTP ${response.status}: ${text.slice(0, limit)}`;
+	} catch {
+		return `HTTP ${response.status}`;
+	}
+}
+/** `Sub.Domain.COM.` -> `sub.domain.com`; DuckDNS and friends are case-insensitive. */
+function normalizeHost(host) {
+	return host.trim().toLowerCase().replace(NORMALIZE_DOTS, "");
+}
+var NORMALIZE_DOTS;
+var init_types = __esmMin((() => {
+	NORMALIZE_DOTS = /\.$/;
+}));
+//#endregion
+//#region src/providers/ddns/cloudflare.ts
+function authHeaders(credentials) {
+	const token = (credentials.apiToken ?? "").trim();
+	if (token.length > 0) return { Authorization: `Bearer ${token}` };
+	const email = (credentials.email ?? "").trim();
+	const key = (credentials.apiKey ?? "").trim();
+	if (email.length > 0 && key.length > 0) return {
+		"X-Auth-Email": email,
+		"X-Auth-Key": key
+	};
+	return null;
+}
+async function call(path, headers, context, init = {}) {
+	try {
+		const response = await context.fetch(`${API$5}${path}`, {
+			...init,
+			headers: {
+				...headers,
+				"Content-Type": "application/json",
+				...init.headers ?? {}
+			},
+			signal: context.signal
+		});
+		const text = await response.text();
+		let parsed;
+		try {
+			parsed = JSON.parse(text);
+		} catch {
+			return {
+				data: null,
+				status: response.status,
+				error: `cloudflare answered ${response.status}: ${text.slice(0, 200)}`
+			};
+		}
+		if (!response.ok || parsed.success !== true) {
+			const detail = (parsed.errors ?? []).map((entry) => `${entry.code} ${entry.message}`).join("; ");
+			return {
+				data: parsed,
+				status: response.status,
+				error: detail.length > 0 ? detail : `HTTP ${response.status}`
+			};
+		}
+		return {
+			data: parsed,
+			status: response.status,
+			error: null
+		};
+	} catch (error) {
+		return {
+			data: null,
+			status: 0,
+			error: error instanceof Error ? error.message : String(error)
+		};
+	}
+}
+/**
+* Walks the host's parents through `GET /zones?name=`, which is how the
+* reference image resolves a zone without a pasted zone id; the id is cached in
+* the panel's state file, so it usually costs nothing.
+*/
+async function resolveZone(host, headers, context, cached) {
+	if (cached !== void 0) return {
+		id: cached,
+		name: host
+	};
+	const labels = host.split(".");
+	for (let index = 0; index <= labels.length - 2; index++) {
+		const candidate = labels.slice(index).join(".");
+		const { data, error } = await call(`/zones?name=${encodeURIComponent(candidate)}&per_page=1`, headers, context);
+		if (error !== null || data === null) throw new Error(error ?? "could not look up the zone");
+		const zone = data.result[0];
+		if (zone !== void 0) return zone;
+	}
+	return null;
+}
+async function findRecord(zoneId, record, headers, context, cached) {
+	if (cached !== void 0) {
+		const fetched = await call(`/zones/${zoneId}/dns_records/${cached}`, headers, context);
+		if (fetched.error === null && fetched.data !== null) return {
+			record: fetched.data.result,
+			error: null
+		};
+		if (fetched.status !== 404 && fetched.status !== 400) return {
+			record: null,
+			error: fetched.error
+		};
+	}
+	const listed = await call(`/zones/${zoneId}/dns_records?type=${record.type}&name=${encodeURIComponent(record.host)}&per_page=100`, headers, context);
+	if (listed.error !== null) return {
+		record: null,
+		error: listed.error
+	};
+	return {
+		record: (listed.data?.result ?? []).find((entry) => entry.id !== void 0) ?? null,
+		error: null
+	};
+}
+var API$5, cloudflareProvider;
+var init_cloudflare = __esmMin((() => {
+	init_types();
+	API$5 = "https://api.cloudflare.com/client/v4";
+	cloudflareProvider = {
+		id: "cloudflare",
+		label: "Cloudflare",
+		docsUrl: "https://developers.cloudflare.com/api/resources/dns/subresources/records/",
+		families: ["A", "AAAA"],
+		ttl: true,
+		proxied: true,
+		fields: [
+			{
+				key: "apiToken",
+				label: "API token",
+				hint: "Zone → DNS → Edit (plus Zone → Zone → Read) for your zones. Preferred.",
+				optional: true
+			},
+			{
+				key: "email",
+				label: "Account email",
+				hint: "Only for the legacy Global API Key.",
+				optional: true
+			},
+			{
+				key: "apiKey",
+				label: "Global API key",
+				hint: "Legacy; prefer an API token.",
+				optional: true
+			}
+		],
+		validate(credentials) {
+			if (authHeaders(credentials ?? {}) !== null) return null;
+			return missingFields(credentials, ["apiToken"]);
+		},
+		async update(record, context) {
+			const headers = authHeaders(context.credentials);
+			if (headers === null) return failed("cloudflare needs an API token (or the legacy email + global key)");
+			try {
+				const zone = await resolveZone(record.host, headers, context, record.cache?.zoneId);
+				if (zone === null) return failed(`cloudflare does not have a zone for ${record.host}`);
+				const ttl = record.proxied ? 1 : record.ttl;
+				const found = await findRecord(zone.id, record, headers, context, record.cache?.recordId);
+				if (found.error !== null) return failed(found.error);
+				const existing = found.record;
+				if (existing !== null && existing.content === record.ip && existing.ttl === ttl && existing.proxied === record.proxied) return {
+					...succeeded(`already ${record.ip}`, false),
+					cache: {
+						zoneId: zone.id,
+						recordId: existing.id
+					}
+				};
+				const cache = {
+					zoneId: zone.id,
+					recordId: existing?.id
+				};
+				const body = JSON.stringify({
+					type: record.type,
+					name: record.host,
+					content: record.ip,
+					ttl,
+					proxied: record.proxied
+				});
+				const written = existing === null ? await call(`/zones/${zone.id}/dns_records`, headers, context, {
+					method: "POST",
+					body
+				}) : await call(`/zones/${zone.id}/dns_records/${existing.id}`, headers, context, {
+					method: "PATCH",
+					body
+				});
+				if (written.error !== null) return failed(written.error);
+				return {
+					...succeeded(`set ${record.host} ${record.type} to ${record.ip}`, true),
+					cache: {
+						...cache,
+						recordId: written.data?.result?.id ?? existing?.id
+					}
+				};
+			} catch (error) {
+				return failed(error instanceof Error ? error.message : String(error));
+			}
+		}
+	};
+}));
+//#endregion
+//#region src/providers/ddns/dyndns2.ts
+/** The first word of the body is the code; the rest is provider detail. */
+function parseDyndnsReply(body) {
+	const trimmed = body.trim();
+	const separator = trimmed.search(/\s/);
+	if (separator < 0) return {
+		code: trimmed.toLowerCase(),
+		detail: ""
+	};
+	return {
+		code: trimmed.slice(0, separator).toLowerCase(),
+		detail: trimmed.slice(separator).trim()
+	};
+}
+/** Maps a dyndns2 body onto the panel's result shape. */
+function describeDyndnsReply(body, provider) {
+	const { code, detail } = parseDyndnsReply(body);
+	const known = CODES[code];
+	if (known === void 0) return failed(`${provider} answered "${(body.trim() || "an empty body").slice(0, 120)}"`);
+	if (known.ok) return succeeded(`${known.message}${detail.length === 0 ? "" : ` (${detail})`}`, known.changed);
+	return failed(`${known.message}${detail.length === 0 ? "" : `: ${detail}`}`);
+}
+/**
+* A 401/400 with a non-dyndns2 body is still an answer worth quoting; a known
+* code wins, because several of these endpoints report errors with HTTP 200.
+*/
+function describeDyndnsResponse(response, body, provider) {
+	const { code } = parseDyndnsReply(body);
+	if (!response.ok && CODES[code] === void 0) {
+		const text = body.replace(/\s+/g, " ").trim().slice(0, 160);
+		return failed(`${provider} answered HTTP ${response.status}${text.length === 0 ? "" : `: ${text}`}`);
+	}
+	return describeDyndnsReply(body, provider);
+}
+var CODES;
+var init_dyndns2 = __esmMin((() => {
+	init_types();
+	CODES = {
+		"good": {
+			ok: true,
+			changed: true,
+			message: "updated",
+			permanent: false
+		},
+		"nochg": {
+			ok: true,
+			changed: false,
+			message: "already current",
+			permanent: false
+		},
+		"nohost": {
+			ok: false,
+			changed: false,
+			message: "the provider does not know this hostname",
+			permanent: true
+		},
+		"notfqdn": {
+			ok: false,
+			changed: false,
+			message: "the provider wants a fully qualified hostname",
+			permanent: true
+		},
+		"numhost": {
+			ok: false,
+			changed: false,
+			message: "too many hostnames for this provider",
+			permanent: true
+		},
+		"badauth": {
+			ok: false,
+			changed: false,
+			message: "the provider rejected the credentials",
+			permanent: true
+		},
+		"badagent": {
+			ok: false,
+			changed: false,
+			message: "the provider rejected this client (User-Agent)",
+			permanent: true
+		},
+		"!donator": {
+			ok: false,
+			changed: false,
+			message: "this feature needs a paid provider plan",
+			permanent: true
+		},
+		"abuse": {
+			ok: false,
+			changed: false,
+			message: "the provider blocked this account for abuse",
+			permanent: true
+		},
+		"dnserr": {
+			ok: false,
+			changed: false,
+			message: "the provider had a DNS error",
+			permanent: false
+		},
+		"servererror": {
+			ok: false,
+			changed: false,
+			message: "the provider had a server error",
+			permanent: false
+		},
+		"911": {
+			ok: false,
+			changed: false,
+			message: "the provider is down; it asks you to wait about 30 minutes",
+			permanent: false
+		},
+		"unknown": {
+			ok: false,
+			changed: false,
+			message: "the provider answered with an unknown error",
+			permanent: false
+		}
+	};
+}));
+//#endregion
+//#region src/providers/ddns/desec.ts
+var ENDPOINT$6, desecProvider;
+var init_desec = __esmMin((() => {
+	init_dyndns2();
+	init_types();
+	ENDPOINT$6 = "https://update.dedyn.io/";
+	desecProvider = {
+		id: "desec",
+		label: "deSEC",
+		docsUrl: "https://desec.readthedocs.io/en/latest/dyndns/update-api.html",
+		families: ["A", "AAAA"],
+		ttl: false,
+		proxied: false,
+		fields: [{
+			key: "token",
+			label: "API token",
+			hint: "desec.io → Token management; the token must allow the RRset update.",
+			optional: false
+		}],
+		validate(credentials) {
+			return missingFields(credentials, ["token"]);
+		},
+		async update(record, context) {
+			const token = (context.credentials.token ?? "").trim();
+			if (token.length === 0) return failed("desec needs an API token");
+			const family = record.type === "A" ? `myipv4=${encodeURIComponent(record.ip)}` : `myipv6=${encodeURIComponent(record.ip)}`;
+			const url = `${ENDPOINT$6}?hostname=${encodeURIComponent(record.host)}&${family}`;
+			try {
+				const response = await context.fetch(url, {
+					headers: { Authorization: basicAuth(record.host, token) },
+					signal: context.signal
+				});
+				return describeDyndnsResponse(response, await response.text(), "desec");
+			} catch (error) {
+				return failed(error instanceof Error ? error.message : String(error));
+			}
+		}
+	};
+}));
+//#endregion
+//#region src/providers/ddns/zone.ts
+/**
+* Splits a hostname into the zone and the record name, which is what every
+* provider that has no zone lookup needs. `zone` short-circuits the heuristic.
+*/
+function splitHost(host, zone) {
+	const normalized = normalizeHost(host);
+	const override = normalizeHost(zone ?? "");
+	const resolved = override.length > 0 ? override : guessZone(normalized);
+	if (normalized === resolved) return {
+		zone: resolved,
+		name: "@"
+	};
+	return {
+		zone: resolved,
+		name: normalized.endsWith(`.${resolved}`) ? normalized.slice(0, -(resolved.length + 1)) : normalized
+	};
+}
+function guessZone(host) {
+	const labels = host.split(".");
+	if (labels.length <= 2) return host;
+	const lastTwo = labels.slice(-2).join(".");
+	const lastThree = labels.slice(-3).join(".");
+	return MULTI_LABEL_SUFFIXES.has(lastTwo) ? lastThree : lastTwo;
+}
+var MULTI_LABEL_SUFFIXES;
+var init_zone = __esmMin((() => {
+	init_types();
+	MULTI_LABEL_SUFFIXES = /* @__PURE__ */ new Set([
+		"ac.uk",
+		"co.in",
+		"co.jp",
+		"co.ke",
+		"co.kr",
+		"co.nz",
+		"co.uk",
+		"co.za",
+		"com.au",
+		"com.br",
+		"com.cn",
+		"com.hk",
+		"com.mx",
+		"com.sg",
+		"com.tr",
+		"com.tw",
+		"edu.au",
+		"gov.uk",
+		"net.au",
+		"net.uk",
+		"org.au",
+		"org.uk"
+	]);
+}));
+//#endregion
+//#region src/providers/ddns/digitalocean.ts
+function oceanTtl(ttl) {
+	return Math.max(30, ttl);
+}
+var API$4, digitaloceanProvider;
+var init_digitalocean = __esmMin((() => {
+	init_types();
+	init_zone();
+	API$4 = "https://api.digitalocean.com/v2/domains";
+	digitaloceanProvider = {
+		id: "digitalocean",
+		label: "DigitalOcean",
+		docsUrl: "https://docs.digitalocean.com/reference/api/api-reference/#tag/Domain-Records",
+		families: ["A", "AAAA"],
+		ttl: true,
+		proxied: false,
+		fields: [{
+			key: "token",
+			label: "API token",
+			hint: "A personal access token with the `domain` scope.",
+			optional: false
+		}],
+		validate(credentials) {
+			return missingFields(credentials, ["token"]);
+		},
+		async update(record, context) {
+			const { zone, name } = splitHost(record.host, record.zone);
+			const ttl = oceanTtl(record.ttl);
+			const headers = {
+				"Authorization": `Bearer ${(context.credentials.token ?? "").trim()}`,
+				"Content-Type": "application/json"
+			};
+			const collection = `${API$4}/${encodeURIComponent(zone)}/records`;
+			try {
+				const listed = await context.fetch(`${collection}?per_page=200`, {
+					headers,
+					signal: context.signal
+				});
+				if (!listed.ok) return failed(await errorText(listed));
+				const existing = ((await listed.json()).domain_records ?? []).find((entry) => entry.name === name && entry.type === record.type);
+				if (existing !== void 0 && existing.data === record.ip) return succeeded(`already ${record.ip}`, false);
+				const written = existing === void 0 ? await context.fetch(collection, {
+					method: "POST",
+					headers,
+					body: JSON.stringify({
+						type: record.type,
+						name,
+						data: record.ip,
+						ttl
+					}),
+					signal: context.signal
+				}) : await context.fetch(`${collection}/${existing.id}`, {
+					method: "PUT",
+					headers,
+					body: JSON.stringify({
+						type: record.type,
+						name,
+						data: record.ip,
+						ttl
+					}),
+					signal: context.signal
+				});
+				if (!written.ok) return failed(await errorText(written));
+				return succeeded(`set ${record.host} ${record.type} to ${record.ip}`, true);
+			} catch (error) {
+				return failed(error instanceof Error ? error.message : String(error));
+			}
+		}
+	};
+}));
+//#endregion
+//#region src/providers/ddns/duckdns.ts
+/** DuckDNS addresses one subdomain at a time, so the label is the domain. */
+function subdomain(host) {
+	const normalized = host.trim().toLowerCase();
+	return normalized.endsWith(".duckdns.org") ? normalized.slice(0, -12) : normalized;
+}
+var ENDPOINT$5, duckdnsProvider;
+var init_duckdns = __esmMin((() => {
+	init_types();
+	ENDPOINT$5 = "https://www.duckdns.org/update";
+	duckdnsProvider = {
+		id: "duckdns",
+		label: "DuckDNS",
+		docsUrl: "https://www.duckdns.org/spec.jsp",
+		families: ["A", "AAAA"],
+		ttl: false,
+		proxied: false,
+		fields: [{
+			key: "token",
+			label: "Account token",
+			hint: "On duckdns.org after signing in. One token covers every subdomain.",
+			optional: false
+		}],
+		validate(credentials) {
+			return missingFields(credentials, ["token"]);
+		},
+		async update(record, context) {
+			const token = (context.credentials.token ?? "").trim();
+			if (token.length === 0) return failed("duckdns needs the account token");
+			const family = record.type === "A" ? `ip=${encodeURIComponent(record.ip)}` : `ipv6=${encodeURIComponent(record.ip)}`;
+			const url = `${ENDPOINT$5}?domains=${encodeURIComponent(subdomain(record.host))}&token=${encodeURIComponent(token)}&${family}`;
+			try {
+				const response = await context.fetch(url, { signal: context.signal });
+				const body = (await response.text()).trim();
+				if (body.toUpperCase() === "OK") return succeeded(`set ${record.host} ${record.type} to ${record.ip}`, true);
+				return failed(`duckdns answered "${body.slice(0, 120) || `HTTP ${response.status}`}"`);
+			} catch (error) {
+				return failed(error instanceof Error ? error.message : String(error));
+			}
+		}
+	};
+}));
+//#endregion
+//#region src/providers/ddns/dynu.ts
+var ENDPOINT$4, dynuProvider;
+var init_dynu = __esmMin((() => {
+	init_dyndns2();
+	init_types();
+	ENDPOINT$4 = "https://api.dynu.com/nic/update";
+	dynuProvider = {
+		id: "dynu",
+		label: "Dynu",
+		docsUrl: "https://www.dynu.com/DynamicDNS/IP-Update-Protocol",
+		families: ["A", "AAAA"],
+		ttl: false,
+		proxied: false,
+		fields: [{
+			key: "username",
+			label: "Username",
+			hint: "Dynu username; used for HTTP Basic auth.",
+			optional: false
+		}, {
+			key: "password",
+			label: "Password",
+			hint: "Account password, or its SHA-256 hash.",
+			optional: false
+		}],
+		validate(credentials) {
+			return missingFields(credentials, ["username", "password"]);
+		},
+		async update(record, context) {
+			const username = (context.credentials.username ?? "").trim();
+			const password = (context.credentials.password ?? "").trim();
+			if (username.length === 0 || password.length === 0) return failed("dynu needs the username and password");
+			const address = record.type === "A" ? `myip=${encodeURIComponent(record.ip)}` : `myipv6=${encodeURIComponent(record.ip)}`;
+			const url = `${ENDPOINT$4}?hostname=${encodeURIComponent(record.host)}&${address}`;
+			try {
+				const response = await context.fetch(url, {
+					headers: { Authorization: basicAuth(username, password) },
+					signal: context.signal
+				});
+				return describeDyndnsResponse(response, await response.text(), "dynu");
+			} catch (error) {
+				return failed(error instanceof Error ? error.message : String(error));
+			}
+		}
+	};
+}));
+//#endregion
+//#region src/providers/ddns/freedns.ts
+/**
+* FreeDNS credentials *are* a URL: the per-record "Direct URL" hash. Both the
+* bare hash and the whole URL are accepted, because that is what people copy.
+*/
+function updateToken(credentials) {
+	const raw = (credentials.token ?? "").trim();
+	if (raw.length === 0) return "";
+	return (raw.includes("?") ? raw.slice(raw.indexOf("?") + 1) : raw).replace(/^https?:\/\/[^?]*\?/, "");
+}
+var ENDPOINT$3, freednsProvider;
+var init_freedns = __esmMin((() => {
+	init_types();
+	ENDPOINT$3 = "https://freedns.afraid.org/dynamic/update.php";
+	freednsProvider = {
+		id: "freedns",
+		label: "FreeDNS (afraid.org)",
+		docsUrl: "https://freedns.afraid.org/faq/",
+		families: ["A", "AAAA"],
+		ttl: false,
+		proxied: false,
+		fields: [{
+			key: "token",
+			label: "Direct URL",
+			hint: "FreeDNS → Dynamic DNS → the per-record \"Direct URL\". Paste the whole URL or just its hash.",
+			optional: false
+		}],
+		validate(credentials) {
+			return missingFields(credentials, ["token"]);
+		},
+		async update(record, context) {
+			const token = updateToken(context.credentials);
+			if (token.length === 0) return failed("freedns needs the per-record Direct URL");
+			try {
+				const response = await context.fetch(`${ENDPOINT$3}?${token}&address=${encodeURIComponent(record.ip)}`, { signal: context.signal });
+				const body = (await response.text()).trim();
+				if (!response.ok || /^ERROR/i.test(body)) return failed(`freedns answered "${body.slice(0, 160) || `HTTP ${response.status}`}"`);
+				return succeeded(`set ${record.host} ${record.type} to ${record.ip}`, true);
+			} catch (error) {
+				return failed(error instanceof Error ? error.message : String(error));
+			}
+		}
+	};
+}));
+//#endregion
+//#region src/providers/ddns/gandi.ts
+/** Gandi's documented minimum; `1` (automatic) has no meaning here. */
+function gandiTtl(ttl) {
+	return Math.min(2592e3, Math.max(300, ttl));
+}
+/** A Personal Access Token (`pat_…`) is preferred; the legacy API key is still accepted. */
+function authHeader(token) {
+	return token.startsWith("pat_") ? `Bearer ${token}` : `Apikey ${token}`;
+}
+var API$3, gandiProvider;
+var init_gandi = __esmMin((() => {
+	init_types();
+	init_zone();
+	API$3 = "https://api.gandi.net/v5/livedns/domains";
+	gandiProvider = {
+		id: "gandi",
+		label: "Gandi",
+		docsUrl: "https://api.gandi.net/docs/livedns/",
+		families: ["A", "AAAA"],
+		ttl: true,
+		proxied: false,
+		fields: [{
+			key: "token",
+			label: "Personal access token",
+			hint: "A `pat_…` token from admin.gandi.net → Organizations. A legacy API key also works.",
+			optional: false
+		}],
+		validate(credentials) {
+			return missingFields(credentials, ["token"]);
+		},
+		async update(record, context) {
+			const token = (context.credentials.token ?? "").trim();
+			if (token.length === 0) return failed("gandi needs an API token");
+			const { zone, name } = splitHost(record.host, record.zone);
+			const ttl = gandiTtl(record.ttl);
+			const url = `${API$3}/${encodeURIComponent(zone)}/records/${encodeURIComponent(name)}/${record.type}`;
+			const headers = {
+				"Authorization": authHeader(token),
+				"Content-Type": "application/json"
+			};
+			try {
+				const current = await context.fetch(url, {
+					headers,
+					signal: context.signal
+				});
+				if (current.ok) {
+					const body = await current.json();
+					if (body.rrset_values?.length === 1 && body.rrset_values[0] === record.ip) return succeeded(`already ${record.ip}`, false);
+				}
+				const written = await context.fetch(url, {
+					method: "PUT",
+					headers,
+					body: JSON.stringify({
+						rrset_values: [record.ip],
+						rrset_ttl: ttl
+					}),
+					signal: context.signal
+				});
+				if (!written.ok) return failed(await errorText(written));
+				return succeeded(`set ${record.host} ${record.type} to ${record.ip}`, true);
+			} catch (error) {
+				return failed(error instanceof Error ? error.message : String(error));
+			}
+		}
+	};
+}));
+//#endregion
+//#region src/providers/ddns/godaddy.ts
+/** GoDaddy's floor; `1` (automatic) has no meaning here. */
+function godaddyTtl(ttl) {
+	return Math.min(86400, Math.max(600, ttl));
+}
+var API$2, godaddyProvider;
+var init_godaddy = __esmMin((() => {
+	init_types();
+	init_zone();
+	API$2 = "https://api.godaddy.com/v1/domains";
+	godaddyProvider = {
+		id: "godaddy",
+		label: "GoDaddy",
+		docsUrl: "https://developer.godaddy.com/doc/endpoint/dns",
+		families: ["A", "AAAA"],
+		ttl: true,
+		proxied: false,
+		fields: [
+			{
+				key: "key",
+				label: "API key",
+				hint: "developer.godaddy.com/keys.",
+				optional: false
+			},
+			{
+				key: "secret",
+				label: "API secret",
+				hint: "Shown once with the key.",
+				optional: false
+			},
+			{
+				key: "baseUrl",
+				label: "API base URL",
+				hint: "Optional; use https://api.ote-godaddy.com to rehearse against the test environment.",
+				optional: true
+			}
+		],
+		validate(credentials) {
+			return missingFields(credentials, ["key", "secret"]);
+		},
+		async update(record, context) {
+			const { zone, name } = splitHost(record.host, record.zone);
+			const ttl = godaddyTtl(record.ttl);
+			const url = `${(context.credentials.baseUrl ?? "").trim() || API$2}/${encodeURIComponent(zone)}/records/${record.type}/${encodeURIComponent(name)}`;
+			const headers = {
+				"Authorization": `sso-key ${context.credentials.key ?? ""}:${context.credentials.secret ?? ""}`,
+				"Content-Type": "application/json"
+			};
+			try {
+				const current = await context.fetch(url, {
+					headers,
+					signal: context.signal
+				});
+				if (current.ok) {
+					const body = await current.json();
+					if (body.length === 1 && body[0]?.data === record.ip) return succeeded(`already ${record.ip}`, false);
+				}
+				const written = await context.fetch(url, {
+					method: "PUT",
+					headers,
+					body: JSON.stringify([{
+						data: record.ip,
+						ttl
+					}]),
+					signal: context.signal
+				});
+				if (!written.ok) return failed(await errorText(written));
+				return succeeded(`set ${record.host} ${record.type} to ${record.ip}`, true);
+			} catch (error) {
+				return failed(error instanceof Error ? error.message : String(error));
+			}
+		}
+	};
+}));
+//#endregion
+//#region src/providers/ddns/henet.ts
+var ENDPOINT$2, henetProvider;
+var init_henet = __esmMin((() => {
+	init_dyndns2();
+	init_types();
+	ENDPOINT$2 = "https://dyn.dns.he.net/nic/update";
+	henetProvider = {
+		id: "henet",
+		label: "Hurricane Electric",
+		docsUrl: "https://dns.he.net/docs.html",
+		families: ["A", "AAAA"],
+		ttl: false,
+		proxied: false,
+		fields: [{
+			key: "key",
+			label: "DDNS key",
+			hint: "dns.he.net → the key shown next to the host when DDNS is enabled.",
+			optional: false
+		}],
+		validate(credentials) {
+			return missingFields(credentials, ["key"]);
+		},
+		async update(record, context) {
+			const key = (context.credentials.key ?? "").trim();
+			if (key.length === 0) return failed("hurricane electric needs the per-host DDNS key");
+			const url = `${ENDPOINT$2}?hostname=${encodeURIComponent(record.host)}&password=${encodeURIComponent(key)}&myip=${encodeURIComponent(record.ip)}`;
+			try {
+				const response = await context.fetch(url, { signal: context.signal });
+				return describeDyndnsResponse(response, await response.text(), "hurricane electric");
+			} catch (error) {
+				return failed(error instanceof Error ? error.message : String(error));
+			}
+		}
+	};
+}));
+//#endregion
+//#region src/providers/ddns/namecheap.ts
+function tag(body, name) {
+	return new RegExp(`<${name}>([\\s\\S]*?)</${name}>`, "i").exec(body)?.[1]?.trim() ?? null;
+}
+var ENDPOINT$1, namecheapProvider;
+var init_namecheap = __esmMin((() => {
+	init_types();
+	init_zone();
+	ENDPOINT$1 = "https://dynamicdns.park-your-domain.com/update";
+	namecheapProvider = {
+		id: "namecheap",
+		label: "Namecheap",
+		docsUrl: "https://www.namecheap.com/support/knowledgebase/article.aspx/29/11/how-to-dynamically-update-the-hosts-ip-with-an-https-request/",
+		families: ["A"],
+		ttl: false,
+		proxied: false,
+		fields: [{
+			key: "password",
+			label: "Dynamic DNS password",
+			hint: "Dashboard → Manage domain → Advanced DNS → Dynamic DNS. Not your account password or API key.",
+			optional: false
+		}],
+		validate(credentials) {
+			return missingFields(credentials, ["password"]);
+		},
+		async update(record, context) {
+			const password = (context.credentials.password ?? "").trim();
+			if (password.length === 0) return failed("namecheap needs the Dynamic DNS password");
+			const { zone, name } = splitHost(record.host, record.zone);
+			const host = name === "@" ? "@" : name;
+			const url = `${ENDPOINT$1}?host=${encodeURIComponent(host)}&domain=${encodeURIComponent(zone)}&password=${encodeURIComponent(password)}&ip=${encodeURIComponent(record.ip)}`;
+			try {
+				const body = await (await context.fetch(url, { signal: context.signal })).text();
+				const errCount = Number.parseInt(tag(body, "ErrCount") ?? "0", 10);
+				const ip = tag(body, "IP");
+				if (errCount > 0) {
+					const first = tag(body, "Err1");
+					return failed(`namecheap rejected the update${first === null ? "" : `: ${first}`}`);
+				}
+				if (ip === null) return failed(`namecheap answered without an IP: ${body.replace(/\s+/g, " ").slice(0, 160)}`);
+				return succeeded(`${host === "@" ? zone : `${host}.${zone}`} now ${ip}`, ip !== record.ip);
+			} catch (error) {
+				return failed(error instanceof Error ? error.message : String(error));
+			}
+		}
+	};
+}));
+//#endregion
+//#region src/providers/ddns/noip.ts
+var ENDPOINT, DEFAULT_AGENT, noipProvider;
+var init_noip = __esmMin((() => {
+	init_dyndns2();
+	init_types();
+	ENDPOINT = "https://dynupdate.no-ip.com/nic/update";
+	DEFAULT_AGENT = "home-hosted/1.0 (+https://github.com/NamesMT/home-hosted)";
+	noipProvider = {
+		id: "noip",
+		label: "No-IP",
+		docsUrl: "https://www.noip.com/integrate/request",
+		families: ["A", "AAAA"],
+		ttl: false,
+		proxied: false,
+		fields: [
+			{
+				key: "username",
+				label: "Email",
+				hint: "Your No-IP account email.",
+				optional: false
+			},
+			{
+				key: "password",
+				label: "Password",
+				hint: "Your No-IP account password.",
+				optional: false
+			},
+			{
+				key: "userAgent",
+				label: "User-Agent override",
+				hint: "No-IP only guarantees updates for recognised clients; set an approved agent here if yours is registered.",
+				optional: true
+			}
+		],
+		validate(credentials) {
+			return missingFields(credentials, ["username", "password"]);
+		},
+		async update(record, context) {
+			const username = (context.credentials.username ?? "").trim();
+			const password = (context.credentials.password ?? "").trim();
+			if (username.length === 0 || password.length === 0) return failed("no-ip needs the account email and password");
+			const address = record.type === "A" ? `myip=${encodeURIComponent(record.ip)}` : `myipv6=${encodeURIComponent(record.ip)}`;
+			const url = `${ENDPOINT}?hostname=${encodeURIComponent(record.host)}&${address}`;
+			try {
+				const response = await context.fetch(url, {
+					headers: {
+						"Authorization": basicAuth(username, password),
+						"User-Agent": (context.credentials.userAgent ?? "").trim() || DEFAULT_AGENT
+					},
+					signal: context.signal
+				});
+				return describeDyndnsResponse(response, await response.text(), "no-ip");
+			} catch (error) {
+				return failed(error instanceof Error ? error.message : String(error));
+			}
+		}
+	};
+}));
+//#endregion
+//#region src/providers/ddns/porkbun.ts
+/** Porkbun's documented floor; `1` (automatic) maps onto it. */
+function porkbunTtl(ttl) {
+	return Math.max(600, ttl);
+}
+async function post(path, context, body) {
+	try {
+		const response = await context.fetch(`${API$1}${path}`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				"X-API-Key": context.credentials.apikey ?? "",
+				"X-Secret-API-Key": context.credentials.secretapikey ?? ""
+			},
+			body: JSON.stringify(body),
+			signal: context.signal
+		});
+		const parsed = JSON.parse(await response.text());
+		if (parsed.status !== "SUCCESS") return {
+			data: parsed,
+			error: parsed.message ?? `HTTP ${response.status}`
+		};
+		return {
+			data: parsed,
+			error: null
+		};
+	} catch (error) {
+		return {
+			data: null,
+			error: error instanceof Error ? error.message : String(error)
+		};
+	}
+}
+var API$1, porkbunProvider;
+var init_porkbun = __esmMin((() => {
+	init_types();
+	init_zone();
+	API$1 = "https://api.porkbun.com/api/json/v3";
+	porkbunProvider = {
+		id: "porkbun",
+		label: "Porkbun",
+		docsUrl: "https://porkbun.com/api/json/v3/documentation",
+		families: ["A", "AAAA"],
+		ttl: true,
+		proxied: false,
+		fields: [{
+			key: "apikey",
+			label: "API key",
+			hint: "porkbun.com/account/api — starts with pk1_.",
+			optional: false
+		}, {
+			key: "secretapikey",
+			label: "Secret API key",
+			hint: "Shown once when the key is created.",
+			optional: false
+		}],
+		validate(credentials) {
+			return missingFields(credentials, ["apikey", "secretapikey"]);
+		},
+		async update(record, context) {
+			const { zone, name: rawName } = splitHost(record.host, record.zone);
+			const name = rawName === "@" ? "" : rawName;
+			const ttl = porkbunTtl(record.ttl);
+			const existing = (await post(`/dns/retrieveByNameType/${encodeURIComponent(zone)}/${record.type}/${encodeURIComponent(name)}`, context, {})).data?.records?.[0];
+			if (existing !== void 0 && existing.content === record.ip && Number.parseInt(existing.ttl, 10) === ttl) return succeeded(`already ${record.ip}`, false);
+			const written = await post(`/dns/editByNameType/${encodeURIComponent(zone)}/${record.type}/${encodeURIComponent(name)}`, context, {
+				content: record.ip,
+				ttl
+			});
+			if (written.error !== null) return failed(written.error);
+			const warnings = written.data?.warnings ?? [];
+			const note = warnings.length > 0 ? ` — porkbun warns: ${warnings.join("; ")}` : "";
+			return succeeded(`set ${record.host} ${record.type} to ${record.ip}${note}`, true);
+		}
+	};
+}));
+//#endregion
+//#region src/providers/ddns/spaceship.ts
+function spaceshipTtl(ttl) {
+	return Math.min(3600, Math.max(60, ttl));
+}
+var API, PAGE_SIZE, spaceshipProvider;
+var init_spaceship = __esmMin((() => {
+	init_types();
+	init_zone();
+	API = "https://spaceship.dev/api/v1/dns/records";
+	PAGE_SIZE = 500;
+	spaceshipProvider = {
+		id: "spaceship",
+		label: "Spaceship",
+		docsUrl: "https://docs.spaceship.dev/",
+		families: ["A", "AAAA"],
+		ttl: true,
+		proxied: false,
+		fields: [{
+			key: "apiKey",
+			label: "API key",
+			hint: "spaceship.com → API Manager; needs the `dnsrecords:read`/`write` scopes.",
+			optional: false
+		}, {
+			key: "apiSecret",
+			label: "API secret",
+			hint: "Shown once with the key.",
+			optional: false
+		}],
+		validate(credentials) {
+			return missingFields(credentials, ["apiKey", "apiSecret"]);
+		},
+		async update(record, context) {
+			const { zone, name } = splitHost(record.host, record.zone);
+			const headers = {
+				"X-API-Key": (context.credentials.apiKey ?? "").trim(),
+				"X-API-Secret": (context.credentials.apiSecret ?? "").trim(),
+				"Content-Type": "application/json"
+			};
+			try {
+				let found;
+				for (let skip = 0; skip < PAGE_SIZE * 5; skip += PAGE_SIZE) {
+					const listed = await context.fetch(`${API}/${encodeURIComponent(zone)}?take=${PAGE_SIZE}&skip=${skip}`, {
+						headers,
+						signal: context.signal
+					});
+					if (!listed.ok) return failed(await errorText(listed));
+					const body = await listed.json();
+					const items = Array.isArray(body) ? body : body.items ?? [];
+					found = items.find((entry) => entry.name === name && entry.type === record.type);
+					if (found !== void 0 || items.length < PAGE_SIZE) break;
+				}
+				if (found?.address === record.ip) return succeeded(`already ${record.ip}`, false);
+				const written = await context.fetch(`${API}/${encodeURIComponent(zone)}`, {
+					method: "PUT",
+					headers,
+					body: JSON.stringify({
+						force: true,
+						items: [{
+							type: record.type,
+							name,
+							ttl: spaceshipTtl(record.ttl),
+							address: record.ip
+						}]
+					}),
+					signal: context.signal
+				});
+				if (!written.ok) return failed(await errorText(written));
+				return succeeded(`set ${record.host} ${record.type} to ${record.ip}`, true);
+			} catch (error) {
+				return failed(error instanceof Error ? error.message : String(error));
+			}
+		}
+	};
+}));
+//#endregion
+//#region src/providers/ddns/index.ts
+function ddnsProvider(id) {
+	return BY_ID.get(id) ?? null;
+}
+function ddnsProviderInfos() {
+	return DDNS_PROVIDERS.map((provider) => ({
+		id: provider.id,
+		label: provider.label,
+		docsUrl: provider.docsUrl,
+		families: provider.families,
+		fields: provider.fields,
+		ttl: provider.ttl,
+		proxied: provider.proxied
+	}));
+}
+/**
+* Cross-field problems ArkType cannot see. Credentials are deliberately not
+* required here: an account is normally added before its secret is typed in,
+* and a missing secret is reported per record instead of blocking the save.
+*/
+function validateDdnsConfig(config) {
+	const errors = [];
+	const seenAccounts = /* @__PURE__ */ new Set();
+	for (const account of config.accounts) {
+		if (seenAccounts.has(account.id)) {
+			errors.push(`account "${account.id}" is declared twice`);
+			continue;
+		}
+		seenAccounts.add(account.id);
+		if (ddnsProvider(account.provider) === null) errors.push(`account "${account.id}" uses an unknown provider "${account.provider}"`);
+	}
+	const seenRecords = /* @__PURE__ */ new Set();
+	for (const domain of config.domains) {
+		const account = config.accounts.find((entry) => entry.id === domain.account);
+		if (account === void 0) {
+			errors.push(`"${domain.host}" points at unknown account "${domain.account}"`);
+			continue;
+		}
+		const provider = ddnsProvider(account.provider);
+		if (provider !== null) for (const recordType of domain.types) {
+			if (!provider.families.includes(recordType)) errors.push(`${account.label || provider.label} cannot manage ${recordType} records ("${domain.host}")`);
+			const key = `${domain.host.toLowerCase()}|${recordType}`;
+			if (seenRecords.has(key)) errors.push(`"${domain.host}" asks for ${recordType} twice`);
+			seenRecords.add(key);
+		}
+	}
+	return errors;
+}
+var DDNS_PROVIDERS, BY_ID;
+var init_ddns$2 = __esmMin((() => {
+	init_cloudflare();
+	init_desec();
+	init_digitalocean();
+	init_duckdns();
+	init_dynu();
+	init_freedns();
+	init_gandi();
+	init_godaddy();
+	init_henet();
+	init_namecheap();
+	init_noip();
+	init_porkbun();
+	init_spaceship();
+	DDNS_PROVIDERS = [
+		cloudflareProvider,
+		namecheapProvider,
+		spaceshipProvider,
+		porkbunProvider,
+		godaddyProvider,
+		gandiProvider,
+		digitaloceanProvider,
+		desecProvider,
+		duckdnsProvider,
+		noipProvider,
+		dynuProvider,
+		henetProvider,
+		freednsProvider
+	];
+	BY_ID = new Map(DDNS_PROVIDERS.map((provider) => [provider.id, provider]));
+}));
+//#endregion
+//#region src/api/ddns.ts
+/**
+* Dynamic DNS is configured as one whole block, not as settings patches: its
+* accounts and hostnames are lists, and a key-by-key merge would leave a removed
+* account or hostname behind. Provider credentials never come back over the API —
+* the view only says which accounts have them.
+*/
+function createDdnsRoute(deps) {
+	const view = () => ({
+		config: deps.store.config.ddns,
+		status: deps.ddns.view,
+		providers: ddnsProviderInfos(),
+		credentials: deps.secrets.ddnsAccountIds
+	});
+	return appFactory.createApp().get("/ddns", describeRoute({
+		tags: ["ddns"],
+		summary: "Dynamic DNS policy, live state and the providers this build knows",
+		responses: { 200: {
+			description: "The DDNS view",
+			content: jsonBody(ddnsViewSchema)
+		} }
+	}), (c) => c.json(view())).put("/ddns", describeRoute({
+		tags: ["ddns"],
+		summary: "Replace the dynamic DNS block",
+		responses: {
+			200: {
+				description: "Saved",
+				content: jsonBody(ddnsViewSchema)
+			},
+			400: ERROR_RESPONSES[400]
+		}
+	}), validate("json", ddnsConfigSchema), (c) => {
+		const config = c.req.valid("json");
+		const problems = validateDdnsConfig(config);
+		if (problems.length > 0) throw new DetailedError(`invalid DDNS configuration: ${problems.join("; ")}`, {
+			statusCode: 400,
+			code: "INVALID_DDNS",
+			detail: problems
+		});
+		try {
+			deps.store.updateDdns(config);
+		} catch (error) {
+			if (error instanceof ConfigError) throw new DetailedError(error.message, {
+				statusCode: 400,
+				code: "INVALID_DDNS"
+			});
+			throw error;
+		}
+		deps.ddns.refresh();
+		return c.json(view());
+	}).put("/ddns/credentials/:id", describeRoute({
+		tags: ["ddns"],
+		summary: "Store the credentials of one DDNS account",
+		responses: {
+			200: {
+				description: "Stored",
+				content: jsonBody(ddnsViewSchema)
+			},
+			400: ERROR_RESPONSES[400]
+		}
+	}), validate("param", accountParam), validate("json", ddnsCredentialsSchema), (c) => {
+		const { id } = c.req.valid("param");
+		const account = deps.store.config.ddns.accounts.find((entry) => entry.id === id);
+		if (account === void 0) throw new DetailedError(`unknown DDNS account "${id}"`, {
+			statusCode: 400,
+			code: "UNKNOWN_DDNS_ACCOUNT"
+		});
+		const provider = ddnsProvider(account.provider);
+		if (provider === null) throw new DetailedError(`unknown DDNS provider "${account.provider}"`, {
+			statusCode: 400,
+			code: "UNKNOWN_DDNS_PROVIDER"
+		});
+		const { credentials } = c.req.valid("json");
+		const problem = provider.validate(credentials);
+		if (problem !== null) throw new DetailedError(`${provider.label}: ${problem}`, {
+			statusCode: 400,
+			code: "INVALID_DDNS_CREDENTIALS"
+		});
+		deps.secrets.setDdnsCredentials(id, credentials);
+		deps.ddns.refresh();
+		return c.json(view());
+	}).delete("/ddns/credentials/:id", describeRoute({
+		tags: ["ddns"],
+		summary: "Forget the credentials of one DDNS account",
+		responses: { 200: {
+			description: "Removed",
+			content: jsonBody(ddnsViewSchema)
+		} }
+	}), validate("param", accountParam), (c) => {
+		deps.secrets.clearDdnsCredentials(c.req.valid("param").id);
+		deps.ddns.refresh();
+		return c.json(view());
+	}).post("/ddns/check", describeRoute({
+		tags: ["ddns"],
+		summary: "Run a dynamic DNS pass now",
+		responses: { 200: {
+			description: "The pass, with its result",
+			content: jsonBody(ddnsViewSchema)
+		} }
+	}), async (c) => {
+		await deps.ddns.run({ force: true });
+		return c.json(view());
+	});
+}
+var accountParam;
+var init_ddns$1 = __esmMin((() => {
+	init_store();
+	init_factory();
+	init_openapi$1();
+	init_validator();
+	init_ddns$2();
+	init_contracts();
+	accountParam = type({ id: "/^[a-z0-9][a-z0-9_-]*$/" });
+}));
+//#endregion
+//#region src/api/events.ts
+/**
+* One SSE stream per subscriber. Pass `?serverId=<id>` to receive only that
+* server's messages; the first frame always carries the full state snapshot.
+*/
+function createEventsRoute(deps) {
+	return appFactory.createApp().get("/events", describeRoute({
+		tags: ["panel"],
+		summary: "Panel state and log frames as server-sent events",
+		responses: { 200: { description: "text/event-stream" } }
+	}), validate("query", eventsQuery), (c) => {
+		const query = c.req.valid("query");
+		const serverId = query.serverId ?? null;
+		const logOnly = query.logs !== "0";
+		return streamSSE(c, async (stream) => {
+			let pending = 0;
+			let queue = Promise.resolve();
+			let closed = false;
+			const send = (message) => {
+				if (closed) return queue;
+				if (message.type === "log" && pending > MAX_PENDING_WRITES$1) return queue;
+				pending += 1;
+				queue = queue.then(() => stream.writeSSE({
+					event: message.type,
+					data: JSON.stringify(message)
+				})).catch(() => {
+					closed = true;
+				}).finally(() => {
+					pending -= 1;
+				});
+				return queue;
+			};
+			const unsubscribe = deps.hub.subscribe(serverId, (message) => {
+				if (!logOnly && message.type === "log") return;
+				send(message);
+			});
+			stream.onAbort(() => {
+				closed = true;
+				unsubscribe();
+			});
+			await send({
+				type: "hello",
+				ts: Date.now(),
+				state: deps.supervisor.getState()
+			});
+			while (true) {
+				await stream.sleep(PING_INTERVAL_MS);
+				if (closed) break;
+				await stream.writeSSE({
+					event: "ping",
+					data: String(Date.now())
+				});
+			}
+		});
+	});
+}
+var MAX_PENDING_WRITES$1, PING_INTERVAL_MS, eventsQuery;
+var init_events$1 = __esmMin((() => {
+	init_factory();
+	init_validator();
+	MAX_PENDING_WRITES$1 = 200;
+	PING_INTERVAL_MS = 15e3;
+	eventsQuery = type({
+		/** Only this server's frames. */
+		"serverId?": "string",
+		/** `logs=0` drops log frames; the first frame is always the full state. */
+		"logs?": "string"
+	});
+}));
+//#endregion
+//#region src/api/health.ts
+/**
+* Liveness for external monitors. Mounted outside `/api`, so it answers without a
+* session: it reports whether the panel itself is serving, and 503 when an
+* autostart server has crashed. Server details are only included for an
+* authenticated caller.
+*/
+function createHealthRoute(deps) {
+	return appFactory.createApp().get("/healthz", describeRoute({
+		tags: ["panel"],
+		summary: "Liveness for monitors — no session required",
+		responses: {
+			200: {
+				description: "Serving",
+				content: jsonBody(type({
+					"status": "\"ok\" | \"degraded\"",
+					"uptimeMs": "number",
+					"servers?": type({
+						total: "number",
+						running: "number",
+						crashed: "number",
+						unhealthy: "number"
+					}),
+					"hostAlerts?": "string[]"
+				}))
+			},
+			503: { description: "An autostart server has crashed" }
+		}
+	}), (c) => {
+		const state = deps.supervisor.getState();
+		const broken = state.servers.filter((server) => server.config.autostart && server.status === "crashed");
+		const authenticated = requestIdentity(c, deps.auth).authenticated;
+		return c.json({
+			status: broken.length > 0 ? "degraded" : "ok",
+			uptimeMs: Math.round(process.uptime() * 1e3),
+			...authenticated ? {
+				servers: {
+					total: state.servers.length,
+					running: state.servers.filter((server) => server.status === "running").length,
+					crashed: state.servers.filter((server) => server.status === "crashed").length,
+					unhealthy: state.servers.filter((server) => server.health === "unhealthy").length
+				},
+				hostAlerts: state.host.alerts
+			} : {}
+		}, broken.length > 0 ? 503 : 200);
+	});
+}
+var init_health = __esmMin((() => {
+	init_factory();
+	init_openapi$1();
+	init_auth();
+}));
+//#endregion
+//#region src/api/logs.ts
+function unknownServer$1(id) {
+	return new DetailedError(`unknown server "${id}"`, {
+		statusCode: 404,
+		code: "UNKNOWN_SERVER"
+	});
+}
+function createLogsRoute(deps) {
+	return appFactory.createApp().get("/logs", describeRoute({
+		tags: ["logs"],
+		summary: "Every server with its on-disk log files",
+		responses: { 200: {
+			description: "Log sources",
+			content: jsonBody(logServersViewSchema)
+		} }
+	}), (c) => c.json({ servers: deps.supervisor.views().map((server) => ({
+		serverId: server.id,
+		label: server.config.label ?? server.id,
+		status: server.status,
+		...deps.logFiles.info(server.id)
+	})) })).get("/logs/:id", describeRoute({
+		tags: ["logs"],
+		summary: "Persisted log lines, with search and a stream filter",
+		responses: {
+			200: { description: "Lines" },
+			404: ERROR_RESPONSES[404]
+		}
+	}), validate("param", idParam$1), validate("query", logHistoryQuerySchema), (c) => {
+		const { id } = c.req.valid("param");
+		if (!deps.store.getServer(id)) throw unknownServer$1(id);
+		const query = c.req.valid("query");
+		const requested = query.tail === void 0 ? DEFAULT_TAIL : Number.parseInt(query.tail, 10);
+		const tail = Number.isNaN(requested) ? DEFAULT_TAIL : Math.min(Math.max(requested, MIN_TAIL), MAX_TAIL);
+		const info = deps.logFiles.info(id);
+		const search = query.search?.trim() ?? "";
+		const window = search.length > 0 ? Math.max(tail, MAX_TAIL) : tail;
+		let lines = deps.logFiles.readTail(id, window);
+		if (query.stream !== void 0 && query.stream.length > 0) lines = lines.filter((line) => line.stream === query.stream);
+		if (search.length > 0) {
+			const needle = search.toLowerCase();
+			lines = lines.filter((line) => line.text.toLowerCase().includes(needle));
+		}
+		return c.json({
+			serverId: id,
+			enabled: info.enabled,
+			sizeBytes: info.sizeBytes,
+			files: info.files.map((file) => file.name),
+			searched: search.length > 0 ? window : null,
+			lines: lines.slice(-tail)
+		});
+	}).get("/logs/:id/download", describeRoute({
+		tags: ["logs"],
+		summary: "Download one rotated log file",
+		responses: {
+			200: { description: "application/x-ndjson" },
+			404: ERROR_RESPONSES[404]
+		}
+	}), validate("param", idParam$1), validate("query", downloadQuery), (c) => {
+		const { id } = c.req.valid("param");
+		if (!deps.store.getServer(id)) throw unknownServer$1(id);
+		const requested = c.req.valid("query").file ?? `${id}.log`;
+		if (!deps.logFiles.info(id).files.map((file) => file.name).includes(requested)) throw new DetailedError("unknown log file", {
+			statusCode: 404,
+			code: "UNKNOWN_LOG_FILE"
+		});
+		const file = path.join(deps.logFiles.directory, requested);
+		const body = fs.readFileSync(file);
+		return c.body(body, 200, {
+			"Content-Type": "application/x-ndjson; charset=utf-8",
+			"Content-Length": String(body.byteLength),
+			"Content-Disposition": `attachment; filename="${requested}"`
+		});
+	}).delete("/logs/:id", describeRoute({
+		tags: ["logs"],
+		summary: "Delete the persisted logs of one server",
+		responses: {
+			200: { description: "Cleared" },
+			404: ERROR_RESPONSES[404]
+		}
+	}), validate("param", idParam$1), (c) => {
+		const { id } = c.req.valid("param");
+		if (!deps.store.getServer(id)) throw unknownServer$1(id);
+		deps.logFiles.clear(id);
+		return c.json({ ok: true });
+	});
+}
+var MIN_TAIL, MAX_TAIL, DEFAULT_TAIL, idParam$1, downloadQuery;
+var init_logs = __esmMin((() => {
+	init_factory();
+	init_openapi$1();
+	init_validator();
+	init_contracts();
+	MIN_TAIL = 50;
+	MAX_TAIL = 5e3;
+	DEFAULT_TAIL = 500;
+	idParam$1 = type({ id: "string >= 1" });
+	downloadQuery = type({ "file?": "string" });
+}));
+//#endregion
+//#region src/api/metrics.ts
+/**
+* Prometheus text for whatever wants to scrape the panel (Beszel, Grafana,
+* `curl`). Lives under `/api`, so it needs a session like every other route.
+*/
+function createMetricsRoute(deps) {
+	return appFactory.createApp().get("/metrics", describeRoute({
+		tags: ["panel"],
+		summary: "Prometheus text for whatever scrapes the panel",
+		responses: { 200: { description: "text/plain; version=0.0.4" } }
+	}), (c) => {
+		const state = deps.supervisor.getState();
+		const lines = [];
+		const metric = (name, help, samples) => {
+			if (samples.length === 0) return;
+			lines.push(`# HELP ${name} ${help}`, `# TYPE ${name} gauge`, ...samples);
+		};
+		metric("hh_control_up", "Control plane is serving", ["hh_control_up 1"]);
+		metric("hh_servers_total", "Configured servers", [`hh_servers_total ${state.servers.length}`]);
+		metric("hh_server_up", "Server process is running", state.servers.map((server) => `hh_server_up{server="${server.id}"} ${server.status === "running" ? 1 : 0}`));
+		metric("hh_server_restarts_total", "Restarts since the control plane started", state.servers.map((server) => `hh_server_restarts_total{server="${server.id}"} ${server.restarts}`));
+		metric("hh_server_crashes_24h", "Crashes in the last 24 hours", state.servers.map((server) => `hh_server_crashes_24h{server="${server.id}"} ${server.history.crashes}`));
+		metric("hh_server_uptime_ratio_24h", "Share of the last 24 hours the server was up", state.servers.filter((server) => server.history.uptimeRatio !== null).map((server) => `hh_server_uptime_ratio_24h{server="${server.id}"} ${server.history.uptimeRatio.toFixed(4)}`));
+		metric("hh_server_response_ms", "Last health probe latency in milliseconds", state.servers.filter((server) => server.responseMs !== null).map((server) => `hh_server_response_ms{server="${server.id}"} ${server.responseMs}`));
+		metric("hh_server_rss_bytes", "RSS of the server process tree", state.servers.filter((server) => server.resources?.rssBytes != null).map((server) => `hh_server_rss_bytes{server="${server.id}"} ${server.resources.rssBytes}`));
+		metric("hh_server_cpu_percent", "CPU percent of the server process tree", state.servers.filter((server) => server.resources?.cpuPercent != null).map((server) => `hh_server_cpu_percent{server="${server.id}"} ${server.resources.cpuPercent}`));
+		metric("hh_host_disk_used_percent", "Disk usage percent per configured path", state.host.disks.map((disk) => `hh_host_disk_used_percent{mount="${disk.path}"} ${disk.usedPercent.toFixed(2)}`));
+		metric("hh_host_memory_used_percent", "Memory usage percent", [`hh_host_memory_used_percent ${state.host.memoryUsedPercent.toFixed(2)}`]);
+		metric("hh_host_swap_used_percent", "Swap usage percent", [`hh_host_swap_used_percent ${state.host.swapUsedPercent.toFixed(2)}`]);
+		metric("hh_host_load1_per_cpu", "1 minute load average per cpu", [`hh_host_load1_per_cpu ${((state.host.loadAvg[0] ?? 0) / Math.max(1, state.host.cpus)).toFixed(3)}`]);
+		return c.text(`${lines.join("\n")}\n`, 200, { "Content-Type": "text/plain; version=0.0.4; charset=utf-8" });
+	});
+}
+var init_metrics = __esmMin((() => {
+	init_factory();
+}));
+//#endregion
+//#region src/providers/telegram.ts
+function getBot(token) {
+	const cached = bots.get(token);
+	if (cached) return cached;
+	const bot = new Bot(token, { client: { timeoutSeconds: 10 } });
+	bot.api.config.use(autoRetry({
+		maxRetryAttempts: 3,
+		maxDelaySeconds: 20
+	}));
+	bots.set(token, bot);
+	return bot;
+}
+/** Drops cached clients; used when the token changes or the service shuts down. */
+function forgetBots() {
+	bots.clear();
+}
+function escapeHtml(value) {
+	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function formatTelegramMessage(title, lines) {
+	const body = lines.filter((line) => line.length > 0).map((line) => `• ${escapeHtml(line)}`).join("\n");
+	return `<b>${escapeHtml(title)}</b>${body.length > 0 ? `\n${body}` : ""}`;
+}
+/** Turns a grammY error into something worth showing in the settings page. */
+function describeTelegramError(error) {
+	if (typeof error === "object" && error !== null) {
+		const candidate = error;
+		const description = candidate.description ?? candidate.message;
+		if (description) return `${description}${candidate.error_code === void 0 ? "" : ` (${candidate.error_code})`}${candidate.parameters?.retry_after === void 0 ? "" : `, retry in ${candidate.parameters.retry_after}s`}`;
+	}
+	return error instanceof Error ? error.message : String(error);
+}
+async function sendTelegramMessage(token, chatId, html) {
+	try {
+		await getBot(token).api.sendMessage(chatId, html, {
+			parse_mode: "HTML",
+			link_preview_options: { is_disabled: true }
+		});
+		return { ok: true };
+	} catch (error) {
+		return {
+			ok: false,
+			error: describeTelegramError(error)
+		};
+	}
+}
+async function verifyTelegramToken(token) {
+	try {
+		return {
+			ok: true,
+			username: (await getBot(token).api.getMe()).username
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			error: describeTelegramError(error)
+		};
+	}
+}
+/**
+* Recent chats that talked to the bot, so a chat id can be picked instead of
+* hunted down by hand. Telegram only reports chats with pending updates, so the
+* caller is told to message the bot first.
+*/
+async function listTelegramChats(token) {
+	try {
+		const updates = await getBot(token).api.getUpdates({
+			limit: 100,
+			allowed_updates: [
+				"message",
+				"channel_post",
+				"edited_message"
+			]
+		});
+		const chats = /* @__PURE__ */ new Map();
+		for (const update of updates) {
+			const chat = update.message?.chat ?? update.channel_post?.chat ?? update.edited_message?.chat;
+			if (!chat) continue;
+			const title = "title" in chat && chat.title ? chat.title : "username" in chat && chat.username ? `@${chat.username}` : "first_name" in chat && chat.first_name ? chat.first_name : "private chat";
+			chats.set(String(chat.id), {
+				id: chat.id,
+				title
+			});
+		}
+		return {
+			ok: true,
+			chats: [...chats.values()]
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			chats: [],
+			error: describeTelegramError(error)
+		};
+	}
+}
+var bots;
+var init_telegram = __esmMin((() => {
+	bots = /* @__PURE__ */ new Map();
+}));
+//#endregion
+//#region src/api/notifications.ts
+/**
+* The bot token is written straight to the secrets file and never into
+* `servers.config.json`, so notification *policy* and the *credential* stay
+* separate.
+*/
+function createNotificationsRoute(deps) {
+	return appFactory.createApp().put("/notifications/token", describeRoute({
+		tags: ["notifications"],
+		summary: "Store the Telegram bot token (verified first)",
+		responses: {
+			200: { description: "Stored" },
+			400: ERROR_RESPONSES[400]
 		}
-		apply(raw) {
-			this.raw = raw;
-			const parsed = parseConfig(raw);
-			this.error = parsed.errors.length > 0 ? parsed.errors.join("; ") : null;
-			this.schemaVersion = parsed.schemaVersion;
-			this.warnings = [...parsed.warnings, ...parsed.unknownKeys.length === 0 ? [] : [`${path.basename(this.file)} carries ${parsed.unknownKeys.length} unrecognized key(s) this release ignores: ${parsed.unknownKeys.join(", ")}`]];
-			if (parsed.config !== null) this.resolvedConfig = parsed.config;
-			else if (this.resolvedConfig === void 0) this.resolvedConfig = this.resolveFallback();
+	}), validate("json", telegramTokenSchema), async (c) => {
+		const { botToken } = c.req.valid("json");
+		const verified = await deps.notifications.verifyToken(botToken);
+		if (!verified.ok) throw new DetailedError(`telegram rejected the token: ${verified.error ?? "unknown error"}`, {
+			statusCode: 400,
+			code: "TELEGRAM_TOKEN_REJECTED"
+		});
+		deps.secrets.setTelegramToken(botToken);
+		forgetBots();
+		return c.json({
+			ok: true,
+			username: verified.username ?? null
+		});
+	}).delete("/notifications/token", describeRoute({
+		tags: ["notifications"],
+		summary: "Forget the Telegram bot token",
+		responses: { 200: { description: "Removed" } }
+	}), (c) => {
+		deps.secrets.setTelegramToken(null);
+		forgetBots();
+		return c.json({ ok: true });
+	}).post("/notifications/test", describeRoute({
+		tags: ["notifications"],
+		summary: "Send a test message",
+		responses: {
+			200: { description: "Sent or refused" },
+			400: ERROR_RESPONSES[400]
 		}
-	};
+	}), validate("json", notificationActionSchema), async (c) => {
+		const result = await deps.notifications.sendTest(c.req.valid("json"));
+		if (!result.ok) throw new DetailedError(result.error ?? "the test message failed", {
+			statusCode: 400,
+			code: "TELEGRAM_SEND_FAILED"
+		});
+		return c.json(result);
+	}).post("/notifications/detect-chats", describeRoute({
+		tags: ["notifications"],
+		summary: "List the chats the bot can see",
+		responses: {
+			200: {
+				description: "Chats",
+				content: jsonBody(type({ chats: type({
+					id: "string | number",
+					title: "string"
+				}).array() }))
+			},
+			400: ERROR_RESPONSES[400]
+		}
+	}), validate("json", notificationActionSchema), async (c) => {
+		const result = await deps.notifications.detectChats(c.req.valid("json"));
+		if (!result.ok) throw new DetailedError(result.error ?? "could not list chats", {
+			statusCode: 400,
+			code: "TELEGRAM_LIST_FAILED"
+		});
+		return c.json({ chats: result.chats });
+	});
+}
+var init_notifications$1 = __esmMin((() => {
+	init_factory();
+	init_openapi$1();
+	init_validator();
+	init_telegram();
+	init_contracts();
 }));
 //#endregion
 //#region src/api/servers/$.routes.ts
-/** Unknown ids are 404; a server that exists but cannot start is a 409. */
-function statusFor(result) {
-	if (result.ok) return 200;
-	return result.error?.startsWith("unknown server") ? 404 : 409;
-}
 function unknownServer(id) {
 	return new DetailedError(`unknown server "${id}"`, {
 		statusCode: 404,
@@ -3387,7 +4879,7 @@ function createServersRoute(deps) {
 		}
 	}), validate("param", idParam), async (c) => {
 		const result = await deps.supervisor.start(c.req.valid("param").id);
-		return c.json(result, statusFor(result));
+		return c.json(result, statusForAction(result));
 	}).post("/:id/stop", describeRoute({
 		tags: ["servers"],
 		summary: "Stop a server",
@@ -3407,7 +4899,7 @@ function createServersRoute(deps) {
 		}
 	}), validate("param", idParam), async (c) => {
 		const result = await deps.supervisor.restart(c.req.valid("param").id);
-		return c.json(result, statusFor(result));
+		return c.json(result, statusForAction(result));
 	}).post("/:id/clear-logs", describeRoute({
 		tags: ["servers"],
 		summary: "Forget the buffered log lines",
@@ -3433,7 +4925,7 @@ function createServersRoute(deps) {
 		const { id } = c.req.valid("param");
 		const result = await deps.supervisor.freePort(id);
 		if (!result.ok) throw new DetailedError(result.error ?? `could not free the port for "${id}"`, {
-			statusCode: statusFor(result),
+			statusCode: statusForAction(result),
 			code: "FREE_PORT_FAILED"
 		});
 		return c.json(result);
@@ -3486,6 +4978,7 @@ function createServersRoute(deps) {
 var idParam, MAX_PENDING_WRITES, serverResponse, serversResponse, okResponse;
 var init_$_routes = __esmMin((() => {
 	init_store();
+	init_action_result();
 	init_factory();
 	init_openapi$1();
 	init_validator();
@@ -3937,13 +5430,14 @@ function createRootApp(deps) {
 		const started = Date.now();
 		await next();
 		logger.debug(`${c.req.method} ${new URL(c.req.url).pathname} ${c.res.status} ${Date.now() - started}ms`);
-	}).onError(errorHandler).route("/_hh", createControlRoute(deps)).use("/api/*", createAuthGuard({ auth: deps.auth })).route("/api", createAuthRoute(deps)).route("/api", createStateRoute(deps)).route("/api", createEventsRoute(deps)).route("/api", createSettingsRoute(deps)).route("/api", createTlsRoute(deps)).route("/api", createLogsRoute(deps)).route("/api", createNotificationsRoute(deps)).route("/api", createMetricsRoute(deps)).route("/api", createBackupsRoute(deps)).route("/api/servers", createServersRoute(deps)).route("/", createHealthRoute(deps));
+	}).onError(errorHandler).route("/_hh", createControlRoute(deps)).use("/api/*", createAuthGuard({ auth: deps.auth })).route("/api", createAuthRoute(deps)).route("/api", createStateRoute(deps)).route("/api", createEventsRoute(deps)).route("/api", createSettingsRoute(deps)).route("/api", createTlsRoute(deps)).route("/api", createLogsRoute(deps)).route("/api", createNotificationsRoute(deps)).route("/api", createDdnsRoute(deps)).route("/api", createMetricsRoute(deps)).route("/api", createBackupsRoute(deps)).route("/api/servers", createServersRoute(deps)).route("/", createHealthRoute(deps));
 	return app.route("/", setupOpenAPI(app)).route("/", createStaticRoute({ dir: () => deps.ui.resolveDir() }));
 }
 var init_app = __esmMin((() => {
 	init_$_routes$1();
 	init_backups$1();
 	init_control();
+	init_ddns$1();
 	init_events$1();
 	init_health();
 	init_logs();
@@ -3968,6 +5462,7 @@ var daemon_exports = /* @__PURE__ */ __exportAll({
 	newToken: () => newToken,
 	probeRuntime: () => probeRuntime,
 	readRuntime: () => readRuntime,
+	requestControl: () => requestControl,
 	requestShutdown: () => requestShutdown,
 	runtimeSchema: () => runtimeSchema,
 	writeRuntime: () => writeRuntime
@@ -4000,10 +5495,10 @@ function isProcessAlive$1(pid) {
 }
 /** A degraded panel is still answering: a 503 must not read as "not running". */
 async function probeRuntime(runtime, timeoutMs = 2500) {
-	const status = await localRequest(runtime, "/healthz", "GET", void 0, timeoutMs);
+	const answer = await localCall(runtime, "/healthz", "GET", void 0, timeoutMs);
 	return {
-		reachable: status !== null,
-		degraded: status === 503
+		reachable: answer !== null,
+		degraded: answer?.status === 503
 	};
 }
 /**
@@ -4011,15 +5506,36 @@ async function probeRuntime(runtime, timeoutMs = 2500) {
 * shut down cleanly on every platform (a bare signal is not graceful on Windows).
 */
 async function requestShutdown(runtime, timeoutMs = 4e3) {
-	const status = await localRequest(runtime, "/_hh/shutdown", "POST", runtime.token, timeoutMs);
-	return status !== null && status >= 200 && status < 300;
+	const answer = await localCall(runtime, "/_hh/shutdown", "POST", runtime.token, timeoutMs);
+	return answer !== null && answer.status >= 200 && answer.status < 300;
+}
+/**
+* Drives a supervised server from this machine (`home-hosted start`/`stop`). The
+* token comes from run.json, so it needs no session, no password and no API token —
+* only the owner of that 0600 file, talking over loopback.
+*
+* The wait is generous on purpose: a start may have to run a bootstrap, which has a
+* 120s default timeout of its own. Past this it is a wedged panel, not a slow one.
+*/
+async function requestControl(runtime, path, timeoutMs = 15e4) {
+	const answer = await localCall(runtime, path, "POST", runtime.token, timeoutMs);
+	if (answer === null) return null;
+	let body = null;
+	try {
+		body = JSON.parse(answer.body);
+	} catch {}
+	return {
+		status: answer.status,
+		body
+	};
 }
 /**
 * Talks to the panel over loopback. Node's `fetch` cannot be told to accept the
 * self-signed certificate an uploaded TLS pair usually is, which would break
-* `status` and the graceful `down` — so this speaks http/https directly.
+* `status`, the graceful `down` and the local start/stop — so this speaks
+* http/https directly.
 */
-function localRequest(runtime, path, method, token, timeoutMs) {
+function localCall(runtime, path, method, token, timeoutMs) {
 	return new Promise((resolve) => {
 		const url = new URL(`${runtime.probeUrl}${path}`);
 		const secure = url.protocol === "https:";
@@ -4032,8 +5548,15 @@ function localRequest(runtime, path, method, token, timeoutMs) {
 			headers: token === void 0 ? {} : { "x-home-hosted-token": token },
 			timeout: timeoutMs
 		}, (response) => {
-			response.resume();
-			response.once("end", () => resolve(response.statusCode ?? null));
+			let body = "";
+			response.setEncoding("utf8");
+			response.on("data", (chunk) => {
+				body += chunk;
+			});
+			response.once("end", () => resolve({
+				status: response.statusCode ?? 0,
+				body
+			}));
 		});
 		request.once("error", () => resolve(null));
 		request.once("timeout", () => {
@@ -5587,9 +7110,20 @@ var init_log_relay = __esmMin((() => {
 			this.start();
 			return history;
 		}
+		/**
+		* Stops following and hands back whatever the file still held unread.
+		*
+		* A nanny writes its last lines and exits in the same breath, so the tailer can be
+		* dropped between two polls with its final lines — the child's crash output — still
+		* on disk. Losing them here is what made a persistent entry's crash silent in the
+		* panel, so the caller gets them to ingest rather than an empty hand.
+		*/
 		unfollow(serverId) {
+			const current = this.followed.get(serverId);
+			const rest = current === void 0 ? [] : current.tailer.read();
 			this.followed.delete(serverId);
 			if (this.followed.size === 0) this.stopTimer();
+			return rest;
 		}
 		followedIds() {
 			return [...this.followed.keys()];
@@ -5624,6 +7158,18 @@ var init_log_relay = __esmMin((() => {
 }));
 //#endregion
 //#region src/services/supervisor.ts
+/** One line's exact identity: a timestamp this panel minted, its stream and its text. */
+function echoedKey(line) {
+	return `${line.ts}\u0000${line.stream}\u0000${line.text}`;
+}
+function rememberEchoedLine(set, line) {
+	set.add(echoedKey(line));
+	while (set.size > ECHOED_LINE_LIMIT) set.delete(set.values().next().value);
+}
+/** True when this line is this panel's own echo, so it is only ever reported once. */
+function forgetEchoedLine(set, line) {
+	return set.delete(echoedKey(line));
+}
 function delay(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -5643,7 +7189,7 @@ function serverTemplateVars(config) {
 		home: os.homedir()
 	};
 }
-var HISTORY_WINDOW_MS, HISTORY_CACHE_MS, TICK_INTERVAL_MS, PORT_STATE_INTERVAL_MS, PORT_RELEASE_RECHECK_MS, RESOURCE_SAMPLE_INTERVAL_MS, PERSISTENT_BACKFILL_LINES, Supervisor;
+var HISTORY_WINDOW_MS, HISTORY_CACHE_MS, TICK_INTERVAL_MS, PORT_STATE_INTERVAL_MS, PORT_RELEASE_RECHECK_MS, RESOURCE_SAMPLE_INTERVAL_MS, PERSISTENT_BACKFILL_LINES, ECHOED_LINE_LIMIT, Supervisor;
 var init_supervisor = __esmMin((() => {
 	init_backoff();
 	init_bind();
@@ -5668,6 +7214,7 @@ var init_supervisor = __esmMin((() => {
 	PORT_RELEASE_RECHECK_MS = 300;
 	RESOURCE_SAMPLE_INTERVAL_MS = 5e3;
 	PERSISTENT_BACKFILL_LINES = 200;
+	ECHOED_LINE_LIMIT = 100;
 	Supervisor = class {
 		store;
 		hub;
@@ -6017,7 +7564,7 @@ var init_supervisor = __esmMin((() => {
 					clearNannyState(nannyStatePath(this.options.nannyDir, entry.config.id));
 					clearNannySpec(nannySpecPath(this.options.nannyDir, entry.config.id));
 				} else this.log(entry, "system", `pid ${survivor} is still alive after the stop — its state file is kept`);
-				this.relay.unfollow(entry.config.id);
+				this.drainRelay(entry);
 			}
 			entry.stopping = false;
 			entry.child = null;
@@ -6059,6 +7606,7 @@ var init_supervisor = __esmMin((() => {
 				stopping: false,
 				bootstrapDone: !config.bootstrap,
 				logs: new LogBuffer(config.logBufferLines),
+				echoed: /* @__PURE__ */ new Set(),
 				responseMs: null,
 				resources: null,
 				resourcesSampledAt: 0,
@@ -6078,8 +7626,8 @@ var init_supervisor = __esmMin((() => {
 					continue;
 				}
 				const bufferChanged = entry.config.logBufferLines !== config.logBufferLines;
+				if (entry.config.persistent && !config.persistent) this.drainRelay(entry);
 				entry.config = config;
-				if (!config.persistent) this.relay.unfollow(id);
 				if (bufferChanged) {
 					const kept = entry.logs.list(config.logBufferLines);
 					entry.logs = new LogBuffer(config.logBufferLines);
@@ -6239,8 +7787,8 @@ var init_supervisor = __esmMin((() => {
 			entry.health = entry.config.health.enabled ? "unknown" : "disabled";
 			entry.startedAt = Date.now();
 			entry.lastError = null;
+			if (entry.config.persistent) this.followPersistent(entry, true);
 			this.log(entry, "system", `adopted pid ${pid}: a detached restart of this entry is already serving port ${entry.config.port}`);
-			if (entry.config.persistent) this.followPersistent(entry);
 			this.publishServer(entry);
 			return { ok: true };
 		}
@@ -6475,25 +8023,41 @@ var init_supervisor = __esmMin((() => {
 		ingestExternalLines(serverId, lines) {
 			const entry = this.entries.get(serverId);
 			if (entry === void 0 || !entry.config.persistent || lines.length === 0) return;
-			for (const line of lines) entry.logs.push(line);
+			const kept = lines.filter((line) => !forgetEchoedLine(entry.echoed, line));
+			if (kept.length === 0) return;
+			for (const line of kept) entry.logs.push(line);
 			this.hub.publish({
 				type: "log",
-				ts: lines[lines.length - 1].ts,
+				ts: kept[kept.length - 1].ts,
 				serverId,
-				lines
+				lines: kept
 			});
 		}
 		/**
+		* Whatever the relay had not read yet, ingested before its tailer goes: a nanny's
+		* exit and a stop both end with lines the panel has never seen.
+		*/
+		drainRelay(entry) {
+			const rest = this.relay.unfollow(entry.config.id);
+			if (rest.length > 0) this.ingestExternalLines(entry.config.id, rest);
+		}
+		/**
 		* Follows a persistent entry's log file, filling the ring buffer from what is on disk.
 		*
 		* The backfill is read *through* the tailer, which is the only thing that may own the
 		* offset: reading it from `LogFiles` first and seeking to EOF second would either
 		* replay a line as news or skip one as history, depending on which order the two
 		* syscalls happen to land in.
+		*
+		* `attach` is the caller's word for "this entry is already running, and its history is
+		* new to this panel": only then is the file's tail history. The buffer itself cannot
+		* answer that — spawn, adopt and reattach all log a line of their own — which is why a
+		* `logs.size === 0` test left this backfill dead. An empty buffer is still required, so
+		* a second attach to an entry we already hold lines for cannot replay older ones on top.
 		*/
-		followPersistent(entry) {
+		followPersistent(entry, attach = false) {
 			const id = entry.config.id;
-			const backfill = entry.logs.size === 0 && this.options.logFiles.config.persist ? PERSISTENT_BACKFILL_LINES : 0;
+			const backfill = attach && entry.logs.size === 0 && this.options.logFiles.config.persist ? PERSISTENT_BACKFILL_LINES : 0;
 			const history = this.relay.follow(id, nannyLogFile(this.options.logFiles.directory, id), { backfill });
 			if (history.length > 0) entry.logs.extend(history);
 		}
@@ -6516,8 +8080,8 @@ var init_supervisor = __esmMin((() => {
 				entry.lastError = null;
 				entry.nannyExit = null;
 				const child = state.childPid === null ? "" : `, server pid ${state.childPid}`;
+				this.followPersistent(entry, true);
 				this.log(entry, "system", `persistent: still running (nanny pid ${state.nannyPid}${child}) — reattached`);
-				this.followPersistent(entry);
 				this.publishServer(entry);
 				return true;
 			}
@@ -6556,7 +8120,7 @@ var init_supervisor = __esmMin((() => {
 			const state = readNannyState(statePath);
 			if (state?.lastExit !== void 0) entry.nannyExit = state.lastExit;
 			clearNannyState(statePath);
-			this.relay.unfollow(entry.config.id);
+			this.drainRelay(entry);
 		}
 		/** One probe using the configured mode (TCP or HTTP), with timing. */
 		async probeEntryHealth(entry) {
@@ -6675,6 +8239,7 @@ var init_supervisor = __esmMin((() => {
 			if (this.disposed) return;
 			const now = Date.now();
 			await this.options.hostMonitor.tick(now);
+			this.options.ddns.tick(now);
 			await this.sampleResources(now);
 			await Promise.allSettled([...this.entries.values()].map((entry) => this.probeEntry(entry, now)));
 			for (const entry of this.entries.values()) {
@@ -6820,6 +8385,7 @@ var init_supervisor = __esmMin((() => {
 			};
 			entry.logs.push(line);
 			this.options.logFiles.append(entry.config.id, line);
+			if (entry.config.persistent && this.options.logFiles.config.persist) rememberEchoedLine(entry.echoed, line);
 			this.hub.publish({
 				type: "log",
 				ts: line.ts,
@@ -6839,19 +8405,30 @@ var init_supervisor = __esmMin((() => {
 		}
 		publishState() {
 			const state = this.getState();
-			const signature = [state.configError ?? "", ...state.servers.map((server) => [
-				server.id,
-				server.status,
-				server.health,
-				server.portState,
-				server.pid,
-				server.restarts,
-				server.nextRetryAt,
-				server.lastError,
-				server.bufferedLines,
-				server.responseMs,
-				server.resources?.sampledAt
-			].join(":"))].join("|");
+			const ddns = state.ddns;
+			const signature = [
+				state.configError ?? "",
+				ddns === void 0 ? "" : [
+					ddns.running,
+					ddns.lastRunAt,
+					ddns.ipv4,
+					ddns.ipv6,
+					...ddns.records.map((record) => `${record.host}:${record.type}:${record.state}:${record.ip}`)
+				].join(":"),
+				...state.servers.map((server) => [
+					server.id,
+					server.status,
+					server.health,
+					server.portState,
+					server.pid,
+					server.restarts,
+					server.nextRetryAt,
+					server.lastError,
+					server.bufferedLines,
+					server.responseMs,
+					server.resources?.sampledAt
+				].join(":"))
+			].join("|");
 			if (signature === this.lastStateSignature) return;
 			this.lastStateSignature = signature;
 			this.hub.publish({
@@ -7048,7 +8625,7 @@ function safeSlug(slug) {
 	return slug;
 }
 /** A flag is valid for one exact file revision, not for the name alone. */
-function cacheKey(file) {
+function cacheKey$1(file) {
 	return `${file.sizeBytes}:${file.createdAt}`;
 }
 /** Stable, filesystem-safe name for a data path inside the archive. */
@@ -7113,13 +8690,13 @@ var init_backups = __esmMin((() => {
 			const files = this.scan();
 			for (const file of files) {
 				const cached = this.flags.get(file.name);
-				if (cached === void 0 || cached.key !== cacheKey(file)) this.scheduleRefresh();
+				if (cached === void 0 || cached.key !== cacheKey$1(file)) this.scheduleRefresh();
 			}
 			return files.map((file) => {
 				const cached = this.flags.get(file.name);
 				return {
 					...file,
-					encrypted: cached !== void 0 && cached.key === cacheKey(file) ? cached.encrypted : false
+					encrypted: cached !== void 0 && cached.key === cacheKey$1(file) ? cached.encrypted : false
 				};
 			});
 		}
@@ -7444,7 +9021,7 @@ var init_backups = __esmMin((() => {
 			const dir = this.resolveDir();
 			const listed = this.scan();
 			for (const file of listed) {
-				const key = cacheKey(file);
+				const key = cacheKey$1(file);
 				if (this.flags.get(file.name)?.key === key) continue;
 				try {
 					const entries = await listZip(path.join(dir, file.name));
@@ -7680,6 +9257,370 @@ var init_control_server = __esmMin((() => {
 	};
 }));
 //#endregion
+//#region src/providers/ddns/ip.ts
+/** RFC1918, loopback, link-local and CGNAT are never a public DNS target. */
+function isPublicAddress(ip, family) {
+	if (family === "A") {
+		const parts = ip.split(".").map((part) => Number.parseInt(part, 10));
+		if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return false;
+		const [a, b] = parts;
+		return !(a === 0 || a === 10 || a === 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 100 && b >= 64 && b <= 127);
+	}
+	const lower = ip.toLowerCase();
+	if (lower === "::1" || lower === "::") return false;
+	return !(lower.startsWith("fc") || lower.startsWith("fd") || /^fe[89ab]/.test(lower));
+}
+/**
+* Reads the address out of whatever the endpoint answered: a bare address, a
+* Cloudflare `cdn-cgi/trace` body (`ip=…`), or a small JSON object.
+*/
+function parseAddressResponse(text, family) {
+	const trimmed = text.trim();
+	if (trimmed.length === 0) return null;
+	const candidates = [];
+	const trace = /^ip=(.+)$/m.exec(trimmed)?.[1];
+	if (trace !== void 0) candidates.push(trace.trim());
+	if (trimmed.startsWith("{")) try {
+		const parsed = JSON.parse(trimmed);
+		for (const key of [
+			"ip",
+			"address",
+			"ip_addr",
+			"query"
+		]) {
+			const value = parsed[key];
+			if (typeof value === "string") candidates.push(value.trim());
+		}
+	} catch {}
+	candidates.push(trimmed);
+	const wanted = family === "A" ? 4 : 6;
+	for (const candidate of candidates) {
+		const value = candidate.split(/[\s,]/)[0] ?? "";
+		if (isIP(value) === wanted && isPublicAddress(value, family)) return value;
+	}
+	return null;
+}
+/**
+* Tries the configured endpoint, or the built-in list in order, and returns the
+* first address that is really public. A transient failure never deletes a
+* record; it just leaves the previous one in place.
+*/
+async function detectPublicAddress(family, overrideUrl, fetchImpl, signal) {
+	const configured = overrideUrl.trim();
+	const endpoints = configured.length > 0 ? [configured] : family === "A" ? DEFAULT_IPV4_ENDPOINTS : DEFAULT_IPV6_ENDPOINTS;
+	let lastError = null;
+	for (const endpoint of endpoints) try {
+		const response = await fetchImpl(endpoint, {
+			signal,
+			headers: { Accept: "text/plain, application/json" }
+		});
+		if (!response.ok) {
+			lastError = `${endpoint} answered ${response.status}`;
+			continue;
+		}
+		const parsed = parseAddressResponse(await response.text(), family);
+		if (parsed !== null) return {
+			ip: parsed,
+			error: null
+		};
+		lastError = `${endpoint} did not answer with a public ${family === "A" ? "IPv4" : "IPv6"} address`;
+	} catch (error) {
+		lastError = `${endpoint}: ${error instanceof Error ? error.message : String(error)}`;
+	}
+	return {
+		ip: null,
+		error: lastError ?? `no endpoint for ${family}`
+	};
+}
+var DEFAULT_IPV4_ENDPOINTS, DEFAULT_IPV6_ENDPOINTS;
+var init_ip = __esmMin((() => {
+	DEFAULT_IPV4_ENDPOINTS = [
+		"https://api4.ipify.org",
+		"https://ipv4.icanhazip.com",
+		"https://checkip.amazonaws.com",
+		"https://4.ident.me",
+		"https://cloudflare.com/cdn-cgi/trace"
+	];
+	DEFAULT_IPV6_ENDPOINTS = [
+		"https://api6.ipify.org",
+		"https://ipv6.icanhazip.com",
+		"https://6.ident.me",
+		"https://cloudflare.com/cdn-cgi/trace"
+	];
+}));
+//#endregion
+//#region src/services/ddns.ts
+function emptyState() {
+	return {
+		version: 1,
+		updatedAt: 0,
+		records: {}
+	};
+}
+function readState(file) {
+	try {
+		const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+		const records = {};
+		for (const [key, value] of Object.entries(parsed?.records ?? {})) if (typeof value?.ip === "string") records[key] = value;
+		return {
+			version: 1,
+			updatedAt: typeof parsed?.updatedAt === "number" ? parsed.updatedAt : 0,
+			records
+		};
+	} catch {
+		return emptyState();
+	}
+}
+function cacheKey(host, type) {
+	return `${normalizeHost(host)}|${type}`;
+}
+var RUN_TIMEOUT_MS, DdnsService;
+var init_ddns = __esmMin((() => {
+	init_atomic();
+	init_logger();
+	init_ddns$2();
+	init_ip();
+	init_types();
+	RUN_TIMEOUT_MS = 6e4;
+	DdnsService = class {
+		deps;
+		results = /* @__PURE__ */ new Map();
+		persisted;
+		running = false;
+		disposed = false;
+		/** Null until the first pass, so a fresh panel looks immediately. */
+		lastStartedAt = null;
+		lastRunAt = null;
+		lastResult = null;
+		ipv4 = null;
+		ipv6 = null;
+		constructor(deps) {
+			this.deps = deps;
+			this.persisted = readState(deps.statePath);
+		}
+		now() {
+			return this.deps.now?.() ?? Date.now();
+		}
+		/** What the state frame and the settings page read. */
+		get view() {
+			return {
+				enabled: this.deps.getConfig().enabled,
+				running: this.running,
+				lastRunAt: this.lastRunAt,
+				lastResult: this.lastResult,
+				ipv4: this.ipv4,
+				ipv6: this.ipv6,
+				records: this.records()
+			};
+		}
+		/** One entry per configured target, with whatever the last pass learned. */
+		records() {
+			const config = this.deps.getConfig();
+			const views = [];
+			for (const domain of config.domains) {
+				const account = config.accounts.find((entry) => entry.id === domain.account);
+				const provider = account === void 0 ? null : ddnsProvider(account.provider);
+				for (const type of domain.types) {
+					const found = this.results.get(cacheKey(domain.host, type));
+					views.push({
+						host: domain.host,
+						account: domain.account,
+						provider: account?.provider ?? "",
+						type,
+						ip: found?.ip ?? this.persisted.records[cacheKey(domain.host, type)]?.ip ?? null,
+						state: found?.state ?? (provider === null ? "skipped" : "pending"),
+						message: found?.message ?? (account === void 0 ? `unknown account "${domain.account}"` : provider === null ? `unknown provider "${account.provider}"` : null),
+						updatedAt: found?.updatedAt ?? null
+					});
+				}
+			}
+			return views;
+		}
+		/** Makes the next tick run immediately, after a config or credential save. */
+		refresh() {
+			this.lastStartedAt = null;
+		}
+		/**
+		* Cheap enough to call every supervisor tick, and deliberately non-blocking:
+		* a slow provider must never hold up health probes.
+		*/
+		tick(now = this.now()) {
+			if (this.disposed || this.running) return;
+			const config = this.deps.getConfig();
+			if (!config.enabled) return;
+			if (this.lastStartedAt !== null && now - this.lastStartedAt < config.intervalMs) return;
+			this.lastStartedAt = now;
+			this.run().catch((error) => {
+				logger.error("ddns pass failed", error);
+			});
+		}
+		/** Runs one pass now; `force` re-sends addresses the cache already knows. */
+		async run(options = {}) {
+			if (this.running || this.disposed) return this.view;
+			this.running = true;
+			const config = this.deps.getConfig();
+			const signal = AbortSignal.timeout(RUN_TIMEOUT_MS);
+			const fetchImpl = this.deps.fetchImpl ?? ((input, init) => fetch(input, init));
+			let changed = 0;
+			let unchanged = 0;
+			let failed = 0;
+			let skipped = 0;
+			try {
+				const wanted = this.wantedFamilies(config);
+				const detected = {
+					ipv4: wanted.ipv4 ? await detectPublicAddress("A", config.ipv4.url, fetchImpl, signal) : {
+						ip: null,
+						error: null
+					},
+					ipv6: wanted.ipv6 ? await detectPublicAddress("AAAA", config.ipv6.url, fetchImpl, signal) : {
+						ip: null,
+						error: null
+					}
+				};
+				if (detected.ipv4.ip !== null) this.ipv4 = detected.ipv4.ip;
+				if (detected.ipv6.ip !== null) this.ipv6 = detected.ipv6.ip;
+				if (detected.ipv4.error !== null) logger.warn(`ddns: could not detect the public IPv4 address (${detected.ipv4.error})`);
+				if (detected.ipv6.error !== null) logger.warn(`ddns: could not detect the public IPv6 address (${detected.ipv6.error})`);
+				for (const domain of config.domains) {
+					if (!domain.enabled) continue;
+					const account = config.accounts.find((entry) => entry.id === domain.account);
+					const provider = account === void 0 ? null : ddnsProvider(account.provider);
+					const credentials = account === void 0 ? null : this.deps.getCredentials(account.id);
+					for (const type of domain.types) {
+						const key = cacheKey(domain.host, type);
+						const family = type === "A" ? "ipv4" : "ipv6";
+						const familyConfig = type === "A" ? config.ipv4 : config.ipv6;
+						const address = type === "A" ? detected.ipv4.ip : detected.ipv6.ip;
+						if (provider === null || account === void 0) {
+							this.remember(key, "skipped", address, `unknown account or provider for "${domain.account}"`);
+							skipped += 1;
+							continue;
+						}
+						if (!familyConfig.enabled) {
+							this.remember(key, "skipped", address, `${type} records need ${family} detection, which is off`);
+							skipped += 1;
+							continue;
+						}
+						if (address === null) {
+							this.remember(key, "skipped", null, detected[family].error ?? `no public ${family} address was found`);
+							skipped += 1;
+							continue;
+						}
+						if (!provider.families.includes(type)) {
+							this.remember(key, "skipped", address, `${provider.label} cannot manage ${type} records`);
+							skipped += 1;
+							continue;
+						}
+						if (!options.force && this.persisted.records[key]?.ip === address) {
+							this.remember(key, "unchanged", address, null);
+							unchanged += 1;
+							continue;
+						}
+						const cache = this.persisted.records[key];
+						const record = {
+							host: domain.host,
+							type,
+							ip: address,
+							ttl: domain.ttl ?? config.ttl,
+							proxied: domain.proxied ?? config.proxied,
+							...domain.zone === void 0 ? {} : { zone: domain.zone },
+							...cache === void 0 ? {} : { cache: {
+								...cache.zoneId === void 0 ? {} : { zoneId: cache.zoneId },
+								...cache.recordId === void 0 ? {} : { recordId: cache.recordId }
+							} }
+						};
+						const result = await provider.update(record, {
+							credentials: credentials ?? {},
+							fetch: fetchImpl,
+							signal
+						});
+						if (result.ok) {
+							this.persisted.records[key] = {
+								ip: address,
+								updatedAt: this.now(),
+								...result.cache?.zoneId === void 0 ? {} : { zoneId: result.cache.zoneId },
+								...result.cache?.recordId === void 0 ? {} : { recordId: result.cache.recordId }
+							};
+							this.remember(key, result.changed ? "ok" : "unchanged", address, result.message);
+							if (result.changed) changed += 1;
+							else unchanged += 1;
+						} else {
+							this.remember(key, "error", address, result.error ?? result.message);
+							failed += 1;
+							logger.warn(`ddns: ${domain.host} ${type}: ${result.error ?? result.message}`);
+						}
+					}
+				}
+			} finally {
+				this.running = false;
+				this.lastRunAt = this.now();
+				this.persisted.updatedAt = this.lastRunAt;
+				this.writeState();
+				this.lastResult = this.describe(changed, unchanged, failed, skipped);
+				this.announce(config, {
+					changed,
+					failed
+				});
+			}
+			return this.view;
+		}
+		/** Only the families a configured target actually asks for. */
+		wantedFamilies(config) {
+			return {
+				ipv4: config.ipv4.enabled && config.domains.some((domain) => domain.enabled && domain.types.includes("A")),
+				ipv6: config.ipv6.enabled && config.domains.some((domain) => domain.enabled && domain.types.includes("AAAA"))
+			};
+		}
+		remember(key, state, ip, message) {
+			this.results.set(key, {
+				state,
+				ip,
+				message,
+				updatedAt: this.now()
+			});
+		}
+		/** Counts only: the detected addresses are shown beside it, and are the status's own. */
+		describe(changed, unchanged, failed, skipped) {
+			const parts = [
+				changed > 0 ? `${changed} updated` : null,
+				unchanged > 0 ? `${unchanged} already current` : null,
+				failed > 0 ? `${failed} failed` : null,
+				skipped > 0 ? `${skipped} skipped` : null
+			].filter((part) => part !== null);
+			return parts.length === 0 ? "nothing to update" : parts.join(", ");
+		}
+		/** One message per pass, so a flapping provider cannot flood the chat. */
+		announce(config, counts) {
+			if (!config.notify || counts.changed === 0 && counts.failed === 0) return;
+			if (counts.failed > 0) {
+				this.deps.notifications.notify({
+					serverId: "ddns",
+					label: "DDNS",
+					reason: "ddns-error",
+					detail: this.lastResult ?? "a dynamic DNS update failed"
+				});
+				return;
+			}
+			this.deps.notifications.notify({
+				serverId: "ddns",
+				label: "DDNS",
+				reason: "ddns",
+				detail: this.lastResult ?? "a dynamic DNS record changed"
+			});
+		}
+		writeState() {
+			try {
+				writeFileAtomic(this.deps.statePath, `${JSON.stringify(this.persisted, null, 2)}\n`);
+			} catch (error) {
+				logger.warn(`ddns: could not save its state (${error instanceof Error ? error.message : String(error)})`);
+			}
+		}
+		dispose() {
+			this.disposed = true;
+		}
+	};
+}));
+//#endregion
 //#region src/services/events.ts
 var ALL, EventHub;
 var init_events = __esmMin((() => {
@@ -8193,7 +10134,9 @@ var init_notifications = __esmMin((() => {
 		"recovered": "recovered",
 		"rss": "exceeded its memory limit",
 		"host": "host thresholds breached",
-		"host-recovered": "host thresholds recovered"
+		"host-recovered": "host thresholds recovered",
+		"ddns": "updated a dynamic DNS record",
+		"ddns-error": "hit a dynamic DNS error"
 	};
 	TITLE = {
 		"crash": "🔴 server down",
@@ -8202,7 +10145,9 @@ var init_notifications = __esmMin((() => {
 		"recovered": "🟢 server recovered",
 		"rss": "🔴 server over its memory limit",
 		"host": "🟠 host warning",
-		"host-recovered": "🟢 host recovered"
+		"host-recovered": "🟢 host recovered",
+		"ddns": "🌐 DNS updated",
+		"ddns-error": "🌐 DNS update failed"
 	};
 	NotificationService = class {
 		secrets;
@@ -8230,6 +10175,7 @@ var init_notifications = __esmMin((() => {
 				onForcedRestart: telegram.onForcedRestart,
 				onRecovered: telegram.onRecovered,
 				onHost: telegram.onHost,
+				onDdns: telegram.onDdns,
 				cooldownMs: telegram.cooldownMs,
 				lastResult: this.lastResult,
 				lastResultAt: this.lastResultAt
@@ -8246,7 +10192,9 @@ var init_notifications = __esmMin((() => {
 				"recovered": telegram.onRecovered,
 				"rss": telegram.onCrash,
 				"host": telegram.onHost,
-				"host-recovered": telegram.onHost
+				"host-recovered": telegram.onHost,
+				"ddns": telegram.onDdns,
+				"ddns-error": telegram.onDdns
 			}[event.reason]) return false;
 			const until = this.cooldowns.get(`${event.serverId}:${event.reason}`) ?? 0;
 			return !(telegram.cooldownMs > 0 && until > now);
@@ -9226,6 +11174,12 @@ async function runControlPlane(options) {
 		dataRoot,
 		home: os.homedir()
 	})), notifications);
+	const ddns = new DdnsService({
+		getConfig: () => store.config.ddns,
+		getCredentials: (accountId) => secrets.getDdnsCredentials(accountId),
+		notifications,
+		statePath: defaultDdnsStatePath
+	});
 	let onConfigRestored;
 	const backups = new BackupService({
 		dataRoot,
@@ -9309,6 +11263,7 @@ async function runControlPlane(options) {
 			notifications,
 			hostMonitor,
 			backups,
+			ddns,
 			logsDir: logFiles.directory,
 			views
 		}),
@@ -9316,6 +11271,7 @@ async function runControlPlane(options) {
 		logFiles,
 		notifications,
 		hostMonitor,
+		ddns,
 		nannyDir: defaultNannyDir
 	});
 	/**
@@ -9363,6 +11319,7 @@ async function runControlPlane(options) {
 		clearRuntime();
 		configWatch.dispose();
 		auth.dispose();
+		ddns.dispose();
 		await supervisor.dispose();
 		logFiles.dispose();
 		history.dispose();
@@ -9380,6 +11337,7 @@ async function runControlPlane(options) {
 		logFiles,
 		notifications,
 		backups,
+		ddns,
 		ui,
 		runtimeToken: token,
 		onShutdown: () => shutdown("shutdown requested locally")
@@ -9459,6 +11417,7 @@ var init_src = __esmMin((() => {
 	init_backups();
 	init_config_watch();
 	init_control_server();
+	init_ddns();
 	init_events();
 	init_exposure();
 	init_history();
@@ -9530,7 +11489,9 @@ async function runUp(flags, entry) {
 	const { daemonLogPath, dataRoot, projectDir } = await Promise.resolve().then(() => (init_paths(), paths_exports));
 	const existing = readRuntime();
 	if (existing !== null && isProcessAlive(existing.pid)) {
-		process.stdout.write(`${green("already running")} (pid ${existing.pid}) at ${existing.url}\n`);
+		process.stdout.write(`${green("already running")} home-hosted ${existing.version} (pid ${existing.pid}) at ${existing.url}\n`);
+		const note = versionMismatchNote(existing.version);
+		if (note !== null) process.stdout.write(`${dim(note)}\n`);
 		process.stdout.write(`${dim("stop it with `home-hosted down`")}\n`);
 		return;
 	}
@@ -9566,7 +11527,7 @@ async function runUp(flags, entry) {
 		if (output.length > 0) process.stderr.write(`${dim(`${daemonLogPath}:`)}\n${output}\n`);
 		process.exit(1);
 	}
-	process.stdout.write(`${green("home-hosted is up")} (pid ${runtime.pid})\n`);
+	process.stdout.write(`${green(`home-hosted ${runtime.version} is up`)} (pid ${runtime.pid})\n`);
 	process.stdout.write(`  ${bold(runtime.url)}\n`);
 	process.stdout.write(`  ${dim(`project ${runtime.projectDir}`)}\n`);
 	process.stdout.write(`  ${dim(`state   ${runtime.dataRoot}`)}\n`);
@@ -9600,6 +11561,7 @@ var init_up = __esmMin((() => {
 	init_args();
 	init_io();
 	init_runtime();
+	init_version();
 	DEFAULT_PORT$1 = 3999;
 	LOG_ROTATE_BYTES = 5242880;
 	upArgs = {
@@ -9652,14 +11614,20 @@ async function runDown() {
 	}
 	if (!isProcessAlive(runtime.pid)) {
 		clearRuntime();
-		process.stdout.write("home-hosted is not running (removed a stale run.json)\n");
+		process.stdout.write(`home-hosted is not running (removed a stale run.json from home-hosted ${runtime.version})\n`);
 		return;
 	}
+	/** What was stopped, and whether this CLI is a different release than it was. */
+	const reportStopped = (forced) => {
+		process.stdout.write(`${green("stopped")}${forced ? " (forced)" : ""} ${dim(`— was home-hosted ${runtime.version}`)}\n`);
+		const note = versionMismatchNote(runtime.version);
+		if (note !== null) process.stdout.write(`${dim(note)}\n`);
+	};
 	process.stdout.write(`stopping pid ${runtime.pid}…\n`);
 	if (!await requestShutdown(runtime)) signal(runtime.pid, "SIGTERM");
 	if (await waitForExit(runtime.pid, 2e4)) {
 		clearRuntime();
-		process.stdout.write(`${green("stopped")}\n`);
+		reportStopped(false);
 		await reportPersistent();
 		return;
 	}
@@ -9667,7 +11635,7 @@ async function runDown() {
 	forceStop(runtime.pid);
 	await waitForExit(runtime.pid, 5e3);
 	clearRuntime();
-	process.stdout.write(`${green("stopped")} (forced)\n`);
+	reportStopped(true);
 	await reportPersistent();
 }
 /**
@@ -9725,6 +11693,7 @@ function forceStop(pid) {
 var downCommand;
 var init_down = __esmMin((() => {
 	init_io();
+	init_version();
 	downCommand = defineCommand({
 		meta: {
 			name: "down",
@@ -9836,6 +11805,55 @@ var init_status = __esmMin((() => {
 	});
 }));
 //#endregion
+//#region src/cli/server.ts
+var server_exports = /* @__PURE__ */ __exportAll({
+	runServerAction: () => runServerAction,
+	startCommand: () => startCommand,
+	stopCommand: () => stopCommand
+});
+async function runServerAction(action, id) {
+	const { clearRuntime, isProcessAlive, readRuntime, requestControl } = await Promise.resolve().then(() => (init_daemon(), daemon_exports));
+	const runtime = readRuntime();
+	if (runtime === null || !isProcessAlive(runtime.pid)) {
+		if (runtime !== null) clearRuntime();
+		fail("home-hosted is not running — start it with `home-hosted up`");
+	}
+	const answer = await requestControl(runtime, `/_hh/servers/${encodeURIComponent(id)}/${action}`);
+	if (answer === null) fail(`the control panel is not answering on ${runtime.probeUrl}`);
+	const body = answer.body ?? {};
+	if (body.ok !== true) {
+		const reason = body.error ?? body.message;
+		if (reason !== void 0) fail(reason);
+		if (answer.status === 404) fail(`the panel on ${runtime.url} is home-hosted ${runtime.version}, which does not know this command — restart it on this release`);
+		fail(`the panel answered ${answer.status}`);
+	}
+	process.stdout.write(`${green(action === "start" ? "started" : "stopped")} ${id}\n`);
+}
+function serverCommand(action) {
+	return defineCommand({
+		meta: {
+			name: action,
+			description: action === "start" ? "start one server (the panel keeps running)" : "stop one server (the panel keeps running)"
+		},
+		args: { id: {
+			type: "positional",
+			required: false,
+			description: "the server id from servers.config.json"
+		} },
+		run: async ({ args }) => {
+			const id = typeof args.id === "string" ? args.id.trim() : "";
+			if (id.length === 0) fail(`${action} needs a server id — see \`home-hosted status\` or servers.config.json`);
+			await runServerAction(action, id);
+		}
+	});
+}
+var startCommand, stopCommand;
+var init_server = __esmMin((() => {
+	init_io();
+	startCommand = serverCommand("start");
+	stopCommand = serverCommand("stop");
+}));
+//#endregion
 //#region src/cli/set-password.ts
 var set_password_exports = /* @__PURE__ */ __exportAll({
 	runSetPassword: () => runSetPassword,
@@ -10894,6 +12912,8 @@ var SYNOPSIS = {
 	"down": "home-hosted down",
 	"restart": "home-hosted restart [options]",
 	"status": "home-hosted status [--json]",
+	"start": "home-hosted start <id>",
+	"stop": "home-hosted stop <id>",
 	"set-password": "home-hosted set-password",
 	"set-token": "home-hosted set-token",
 	"migrate": "home-hosted migrate",
@@ -10907,6 +12927,8 @@ var SUMMARIES = {
 	"down": "stop it, and everything it supervises",
 	"restart": "down, then up",
 	"status": "is it running, where, and how to reach it",
+	"start": "start one server, leaving the panel up",
+	"stop": "stop one server, leaving the panel up",
 	"set-password": "set the panel password without the API",
 	"set-token": "set the API token that scripts and agents use",
 	"migrate": "bring the config up to this release's schema",
@@ -10933,6 +12955,10 @@ var STATUS_SECTION = {
 	heading: "Options for status",
 	lines: [["--json", "print machine-readable JSON"]]
 };
+var SERVER_SECTION = {
+	heading: "Arguments for start/stop",
+	lines: [["<id>", "the server id from servers.config.json"]]
+};
 var SET_PASSWORD_SECTION = {
 	heading: "Options for set-password",
 	lines: [["--clear", "remove the password, which disables authentication"]]
@@ -11044,11 +13070,15 @@ var USAGE = [
 	"",
 	renderSection(STATUS_SECTION),
 	"",
+	renderSection(SERVER_SECTION),
+	"",
 	SHARED_TRAILER
 ].join("\n");
 var UP_COMMANDS = /* @__PURE__ */ new Set(["up", "restart"]);
 var SECTIONS = {
 	"status": STATUS_SECTION,
+	"start": SERVER_SECTION,
+	"stop": SERVER_SECTION,
 	"set-password": SET_PASSWORD_SECTION,
 	"set-token": SET_TOKEN_SECTION,
 	"migrate": MIGRATE_SECTION,
@@ -11095,6 +13125,8 @@ var COMMANDS = {
 	"down": () => Promise.resolve().then(() => (init_down(), down_exports)).then((module) => module.downCommand),
 	"restart": () => Promise.resolve().then(() => (init_restart(), restart_exports)).then((module) => module.restartCommand(CLI_ENTRY)),
 	"status": () => Promise.resolve().then(() => (init_status(), status_exports)).then((module) => module.statusCommand),
+	"start": () => Promise.resolve().then(() => (init_server(), server_exports)).then((module) => module.startCommand),
+	"stop": () => Promise.resolve().then(() => (init_server(), server_exports)).then((module) => module.stopCommand),
 	"set-password": () => Promise.resolve().then(() => (init_set_password(), set_password_exports)).then((module) => module.setPasswordCommand),
 	"set-token": () => Promise.resolve().then(() => (init_set_token(), set_token_exports)).then((module) => module.setTokenCommand),
 	"migrate": () => Promise.resolve().then(() => (init_migrate(), migrate_exports)).then((module) => module.migrateCommand),