home-hosted 0.6.6 → 0.6.8

package/dist/cli.js

@@ -22,7 +22,7 @@ import { HTTPException } from "hono/http-exception";
 import { Scalar } from "@scalar/hono-api-reference";
 import http from "node:http";
 import https from "node:https";
-import net from "node:net";
+import net, { isIP } from "node:net";
 import { parseArgs, promisify } from "node:util";
 import { Readable, Writable } from "node:stream";
 import { finished } from "node:stream/promises";
@@ -391,7 +391,7 @@ function parseBind(value) {
 	const parsed = bindSchema(value);
 	return parsed instanceof type.errors ? null : parsed;
 }
-var bindSchema, portSchema, onPortConflictSchema, onPortConflictDefaultSchema, restartSchema, httpCheckSchema, resourcesSchema, healthSchema, stopSchema, bootstrapSchema, bootstrapOrNullSchema, logBufferLinesSchema, serverSchema, authSchema, telegramSchema, notificationsSchema, logsSchema, tlsSchema, hostSchema, backupsSchema, controlSchema, defaultsSchema, restartPatchSchema, httpCheckPatchSchema, resourcesPatchSchema, healthPatchSchema, stopPatchSchema, authPatchSchema, telegramPatchSchema, notificationsPatchSchema, hostPatchSchema, backupsPatchSchema, logsPatchSchema, tlsPatchSchema, controlPatchSchema, defaultsPatchSchema, editableFields, serverPatchSchema, serverCreateSchema, nannySpecSchema, nannyExitSchema, nannyStateSchema, settingsPatchSchema, authStatusSchema, tlsStatusSchema, telegramStatusSchema, notificationViewSchema, sessionViewSchema, loginSchema, passwordValueSchema, passwordSchema, serverStatusSchema, healthStateSchema, portStateSchema, logStreamSchema, logLineSchema, historyEventSchema, serverHistorySchema, processResourcesSchema, hostDiskSchema, hostViewSchema, backupFileSchema, backupPathSchema, backupsViewSchema, restoreItemSchema, restorePlanSchema, backupCreateSchema, restoreRequestSchema, serverViewSchema, controlViewSchema, appStateSchema, logQuerySchema, freePortResultSchema, logHistoryQuerySchema, logFileInfoSchema, logServerViewSchema, logServersViewSchema, notificationActionSchema, telegramTokenSchema, apiErrorSchema, uiMetaSchema, uiStatusSchema, tlsUploadSchema, settingsViewSchema, settingsSavedSchema;
+var bindSchema, portSchema, onPortConflictSchema, onPortConflictDefaultSchema, restartSchema, httpCheckSchema, resourcesSchema, healthSchema, stopSchema, bootstrapSchema, bootstrapOrNullSchema, logBufferLinesSchema, serverSchema, authSchema, telegramSchema, notificationsSchema, logsSchema, tlsSchema, hostSchema, ddnsRecordTypeSchema, ddnsAccountSchema, ddnsDomainSchema, ddnsIpv4Schema, ddnsIpv6Schema, ddnsConfigSchema, ddnsRecordStateSchema, ddnsRecordViewSchema, ddnsStatusSchema, ddnsProviderFieldSchema, ddnsProviderInfoSchema, ddnsViewSchema, ddnsCredentialsSchema, ddnsPatchSchema, backupsSchema, controlSchema, defaultsSchema, restartPatchSchema, httpCheckPatchSchema, resourcesPatchSchema, healthPatchSchema, stopPatchSchema, authPatchSchema, telegramPatchSchema, notificationsPatchSchema, hostPatchSchema, backupsPatchSchema, logsPatchSchema, tlsPatchSchema, controlPatchSchema, defaultsPatchSchema, editableFields, serverPatchSchema, serverCreateSchema, nannySpecSchema, nannyExitSchema, nannyStateSchema, settingsPatchSchema, authStatusSchema, tlsStatusSchema, telegramStatusSchema, notificationViewSchema, sessionViewSchema, loginSchema, passwordValueSchema, passwordSchema, serverStatusSchema, healthStateSchema, portStateSchema, logStreamSchema, logLineSchema, historyEventSchema, serverHistorySchema, processResourcesSchema, hostDiskSchema, hostViewSchema, backupFileSchema, backupPathSchema, backupsViewSchema, restoreItemSchema, restorePlanSchema, backupCreateSchema, restoreRequestSchema, serverViewSchema, controlViewSchema, appStateSchema, logQuerySchema, freePortResultSchema, logHistoryQuerySchema, logFileInfoSchema, logServerViewSchema, logServersViewSchema, notificationActionSchema, telegramTokenSchema, apiErrorSchema, uiMetaSchema, uiStatusSchema, tlsUploadSchema, settingsViewSchema, settingsSavedSchema;
 var init_contracts = __esmMin((() => {
 	bindSchema = type("\"local\" | \"lan\" | /^\\d{1,3}(?:\\.\\d{1,3}){3}$/");
 	portSchema = type("1 <= number.integer <= 65535 | null");
@@ -510,6 +510,8 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		onRecovered: "boolean = false",
 		/** Host vitals breaches (disk, memory, swap, load, temperature). */
 		onHost: "boolean = true",
+		/** Dynamic DNS changes and failures. */
+		onDdns: "boolean = true",
 		/** Per server *and* reason, so a flapping server cannot spam the chat. */
 		cooldownMs: "number >= 0 = 120000"
 	}).onUndeclaredKey("reject");
@@ -533,6 +535,109 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		loadPerCpu: "number >= 0 = 2",
 		tempCelsius: "number >= 0 = 85"
 	}).onUndeclaredKey("reject");
+	ddnsRecordTypeSchema = type.enumerated("A", "AAAA");
+	ddnsAccountSchema = type({
+		id: "/^[a-z0-9][a-z0-9_-]*$/",
+		provider: "string >= 1",
+		label: "string = \"\""
+	}).onUndeclaredKey("reject");
+	ddnsDomainSchema = type({
+		host: "/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)+$/",
+		account: "string >= 1",
+		/** Records to keep current; `A` unless the host needs IPv6 too. */
+		types: ddnsRecordTypeSchema.array().default(() => ["A"]),
+		/**
+		* The registered domain (apex) this host sits in. Only needed where a
+		* provider cannot look it up and the guess is wrong (three-label suffixes).
+		*/
+		zone: "string?",
+		/** Seconds; `1` means "automatic" where the provider supports it. */
+		ttl: "number.integer >= 1?",
+		/** Proxying is a property of the record, not the panel: Cloudflare only. */
+		proxied: "boolean = false",
+		enabled: "boolean = true"
+	}).onUndeclaredKey("reject");
+	ddnsIpv4Schema = type({
+		enabled: "boolean = true",
+		/** Override the public-IP endpoint; empty uses the built-in list. */
+		url: "string = \"\""
+	}).onUndeclaredKey("reject");
+	ddnsIpv6Schema = type({
+		enabled: "boolean = false",
+		url: "string = \"\""
+	}).onUndeclaredKey("reject");
+	ddnsConfigSchema = type({
+		enabled: "boolean = false",
+		/** How often the public address is re-checked. */
+		intervalMs: "number >= 60000 = 300000",
+		ipv4: ddnsIpv4Schema.default(() => ({})),
+		ipv6: ddnsIpv6Schema.default(() => ({})),
+		/** Default TTL for the records that accept one. */
+		ttl: "number.integer >= 1 = 1",
+		accounts: ddnsAccountSchema.array().default(() => []),
+		domains: ddnsDomainSchema.array().default(() => [])
+	}).onUndeclaredKey("reject");
+	ddnsRecordStateSchema = type("\"pending\" | \"ok\" | \"unchanged\" | \"error\" | \"skipped\"");
+	ddnsRecordViewSchema = type({
+		host: "string",
+		account: "string",
+		provider: "string",
+		type: ddnsRecordTypeSchema,
+		ip: "string | null",
+		state: ddnsRecordStateSchema,
+		message: "string | null",
+		updatedAt: "number | null"
+	});
+	ddnsStatusSchema = type({
+		enabled: "boolean",
+		running: "boolean",
+		lastRunAt: "number | null",
+		lastResult: "string | null",
+		ipv4: "string | null",
+		ipv6: "string | null",
+		records: ddnsRecordViewSchema.array()
+	});
+	ddnsProviderFieldSchema = type({
+		key: "string",
+		label: "string",
+		hint: "string = \"\"",
+		optional: "boolean = false"
+	});
+	ddnsProviderInfoSchema = type({
+		id: "string",
+		label: "string",
+		docsUrl: "string",
+		families: ddnsRecordTypeSchema.array(),
+		fields: ddnsProviderFieldSchema.array(),
+		ttl: "boolean",
+		proxied: "boolean"
+	});
+	ddnsViewSchema = type({
+		config: ddnsConfigSchema,
+		status: ddnsStatusSchema,
+		providers: ddnsProviderInfoSchema.array(),
+		/** Account ids whose credentials are stored. */
+		credentials: type("string[]")
+	});
+	ddnsCredentialsSchema = type({
+		provider: "string >= 1",
+		credentials: type("Record<string, string>")
+	}).onUndeclaredKey("reject");
+	ddnsPatchSchema = type({
+		enabled: "boolean?",
+		intervalMs: "number >= 60000?",
+		ipv4: type({
+			enabled: "boolean?",
+			url: "string?"
+		}).onUndeclaredKey("reject").optional(),
+		ipv6: type({
+			enabled: "boolean?",
+			url: "string?"
+		}).onUndeclaredKey("reject").optional(),
+		ttl: "number.integer >= 1?",
+		accounts: ddnsAccountSchema.array().optional(),
+		domains: ddnsDomainSchema.array().optional()
+	}).onUndeclaredKey("reject");
 	backupsSchema = type({
 		enabled: "boolean = true",
 		dir: "string = \".backups\"",
@@ -608,6 +713,7 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		onForcedRestart: "boolean?",
 		onRecovered: "boolean?",
 		onHost: "boolean?",
+		onDdns: "boolean?",
 		cooldownMs: "number >= 0?"
 	}).onUndeclaredKey("reject");
 	notificationsPatchSchema = type({ telegram: telegramPatchSchema.optional() }).onUndeclaredKey("reject");
@@ -715,7 +821,9 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		logs: logsPatchSchema.optional(),
 		notifications: notificationsPatchSchema.optional(),
 		host: hostPatchSchema.optional(),
-		backups: backupsPatchSchema.optional()
+		backups: backupsPatchSchema.optional(),
+		/** Replaces the DDNS lists; see `ddnsPatchSchema`. */
+		ddns: ddnsPatchSchema.optional()
 	}).onUndeclaredKey("reject");
 	authStatusSchema = type({
 		enabled: "boolean",
@@ -762,6 +870,8 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		onRecovered: "boolean",
 		/** Host vitals breaches (disk, memory, swap, load, temperature). */
 		onHost: "boolean",
+		/** Dynamic DNS, when this panel knows about it (optional for an older panel). */
+		onDdns: "boolean?",
 		cooldownMs: "number",
 		/** Last delivery outcome, for the settings page. */
 		lastResult: "string | null",
@@ -849,6 +959,8 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 	});
 	backupPathSchema = type({
 		path: "string",
+		/** Which item this path is in a backup's `include`; `data:<path>`. */
+		id: "string?",
 		/** Who declared it: `global`, `<serverId>:backupPaths` or `<serverId>:<ENV>`. */
 		origin: "string",
 		/** false when a parent path already covers it, or it would swallow the archive dir. */
@@ -892,9 +1004,12 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		reloaded: "boolean",
 		error: "string?"
 	});
-	backupCreateSchema = type({ 
-	/** Optional: encrypts the archive. Never stored. */
-password: passwordValueSchema.optional() }).onUndeclaredKey("reject");
+	backupCreateSchema = type({
+		/** Optional: encrypts the archive. Never stored. */
+		password: passwordValueSchema.optional(),
+		/** Item ids to capture (`config`, `secrets`, `tls`, `data:<path>`); omitted means everything. */
+		include: type("string[] >= 1").optional()
+	}).onUndeclaredKey("reject");
 	restoreRequestSchema = type({
 		name: "string?",
 		password: passwordValueSchema.optional(),
@@ -956,6 +1071,11 @@ password: passwordValueSchema.optional() }).onUndeclaredKey("reject");
 		/** `HHOSTED_HOME`: every file home-hosted owns lives under here. */
 		"dataRoot": "string",
 		"logsDir": "string",
+		/**
+		* Dynamic DNS state. Optional so a newer UI still frames a state a panel from
+		* before this field served: the app would blank on a required key.
+		*/
+		"ddns?": ddnsStatusSchema,
 		/** The release this panel is running. Optional: an older panel does not send one. */
 		"version?": "string",
 		"servers": serverViewSchema.array()
@@ -1144,6 +1264,12 @@ function writeFileAtomic(file, content, options = {}) {
 }
 var init_atomic = __esmMin((() => {}));
 //#endregion
+//#region src/helpers/logger.ts
+var logger;
+var init_logger = __esmMin((() => {
+	logger = createConsola({ level: isDevelopment ? LogLevels.debug : void 0 });
+}));
+//#endregion
 //#region src/config/secrets.ts
 function deriveKey(password, salt, cost, keylen) {
 	return crypto.scryptSync(password.normalize("NFKC"), salt, keylen, { ...cost });
@@ -1192,9 +1318,104 @@ function apiTokenRecord(token, now = Date.now()) {
 		updatedAt: now
 	};
 }
-var COST, KEYLEN, SALT_BYTES, API_TOKEN_BYTES, API_TOKEN_HINT_CHARS, SecretsStore;
+function isRecord$3(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** A field map: strings only, empty values dropped; anything else reads as absent. */
+function readDdnsValues(value) {
+	if (!isRecord$3(value)) return {};
+	const out = {};
+	for (const [key, field] of Object.entries(value)) if (typeof field === "string" && field.length > 0) out[key] = field;
+	return out;
+}
+function isSealedDdns(value) {
+	return isRecord$3(value) && value.algo === DDNS_SEALED_ALGO && typeof value.iv === "string" && typeof value.tag === "string" && typeof value.data === "string";
+}
+function isPlainDdns(value) {
+	return "plain" in value;
+}
+/** Every shape this file has held: sealed, `{ provider, values }`, or a bare field map. */
+function readStoredDdns(value) {
+	if (!isRecord$3(value)) return {};
+	const out = {};
+	for (const [accountId, entry] of Object.entries(value)) {
+		if (isSealedDdns(entry)) {
+			out[accountId] = entry;
+			continue;
+		}
+		if (!isRecord$3(entry)) continue;
+		const values = readDdnsValues("values" in entry ? entry.values : entry);
+		if (Object.keys(values).length === 0) continue;
+		out[accountId] = {
+			plain: true,
+			provider: typeof entry.provider === "string" ? entry.provider : "",
+			values
+		};
+	}
+	return out;
+}
+function readDdnsKdf(value) {
+	if (!isRecord$3(value) || value.algo !== "scrypt" || typeof value.salt !== "string") return null;
+	const cost = isRecord$3(value.cost) ? value.cost : {};
+	const N = Number(cost.N);
+	const r = Number(cost.r);
+	const p = Number(cost.p);
+	if (!Number.isInteger(N) || !Number.isInteger(r) || !Number.isInteger(p) || N < 2 || r < 1 || p < 1) return null;
+	return {
+		algo: "scrypt",
+		cost: {
+			N,
+			r,
+			p
+		},
+		salt: value.salt
+	};
+}
+function newDdnsKdf() {
+	return {
+		algo: "scrypt",
+		cost: { ...COST },
+		salt: crypto.randomBytes(SALT_BYTES).toString("base64")
+	};
+}
+/** The account id is the AAD, so a sealed entry cannot be moved to another account. */
+function ddnsAad(accountId) {
+	return Buffer$1.from(`${DDNS_AAD_PREFIX}${accountId}`, "utf8");
+}
+function sealDdns(accountId, record, key) {
+	const iv = crypto.randomBytes(DDNS_IV_BYTES);
+	const cipher = crypto.createCipheriv(DDNS_SEALED_ALGO, key, iv);
+	cipher.setAAD(ddnsAad(accountId));
+	const data = Buffer$1.concat([cipher.update(JSON.stringify(record), "utf8"), cipher.final()]);
+	return {
+		algo: DDNS_SEALED_ALGO,
+		iv: iv.toString("base64"),
+		tag: cipher.getAuthTag().toString("base64"),
+		data: data.toString("base64")
+	};
+}
+/** Null when the tag does not verify: a different secret, or a file somebody edited. */
+function openDdns(accountId, sealed, key) {
+	try {
+		const decipher = crypto.createDecipheriv(DDNS_SEALED_ALGO, key, Buffer$1.from(sealed.iv, "base64"));
+		decipher.setAAD(ddnsAad(accountId));
+		decipher.setAuthTag(Buffer$1.from(sealed.tag, "base64"));
+		const plain = Buffer$1.concat([decipher.update(Buffer$1.from(sealed.data, "base64")), decipher.final()]).toString("utf8");
+		const parsed = JSON.parse(plain);
+		if (typeof parsed?.provider !== "string") return null;
+		const values = readDdnsValues(parsed.values);
+		return Object.keys(values).length === 0 ? null : {
+			provider: parsed.provider,
+			values
+		};
+	} catch {
+		return null;
+	}
+}
+var COST, KEYLEN, SALT_BYTES, DDNS_KEYLEN, DDNS_IV_BYTES, DDNS_AAD_PREFIX, DDNS_SEALED_ALGO, API_TOKEN_BYTES, API_TOKEN_HINT_CHARS, SecretsStore;
 var init_secrets = __esmMin((() => {
 	init_atomic();
+	init_logger();
 	COST = {
 		N: 16384,
 		r: 8,
@@ -1202,14 +1423,23 @@ var init_secrets = __esmMin((() => {
 	};
 	KEYLEN = 64;
 	SALT_BYTES = 16;
+	DDNS_KEYLEN = 32;
+	DDNS_IV_BYTES = 12;
+	DDNS_AAD_PREFIX = "hh-ddns-v1:";
+	DDNS_SEALED_ALGO = "aes-256-gcm";
 	API_TOKEN_BYTES = 32;
 	API_TOKEN_HINT_CHARS = 8;
 	SecretsStore = class {
 		file;
 		cache = null;
 		cacheKey = "";
-		constructor(file) {
+		ddnsKeyCache = null;
+		warnedAccounts = /* @__PURE__ */ new Set();
+		ddnsSecret;
+		constructor(file, ddnsSecret) {
 			this.file = file;
+			const candidate = (ddnsSecret ?? process.env.HHOSTED_DDNS_SECRET ?? "").trim();
+			this.ddnsSecret = candidate.length > 0 ? candidate : "hh";
 		}
 		get path() {
 			return this.file;
@@ -1302,12 +1532,98 @@ var init_secrets = __esmMin((() => {
 				telegram: trimmed.length > 0 ? { botToken: trimmed } : null
 			});
 		}
+		/** Ids that have something stored, whether or not a config still declares them. */
+		get ddnsAccountIds() {
+			return Object.keys(this.load().ddns);
+		}
+		/**
+		* Null when nothing is stored, when the entry belongs to a different provider,
+		* or when the secret cannot open it.
+		*/
+		getDdnsCredentials(accountId, provider) {
+			const stored = this.load().ddns[accountId];
+			if (stored === void 0) return null;
+			const record = this.openStored(accountId, stored);
+			if (record === null) return null;
+			return record.provider.length > 0 && record.provider !== provider ? null : record;
+		}
+		/** An empty field is dropped, so clearing every field forgets the account. */
+		setDdnsCredentials(accountId, provider, credentials) {
+			const current = this.load();
+			const values = readDdnsValues(credentials);
+			const ddns = { ...current.ddns };
+			if (Object.keys(values).length === 0) delete ddns[accountId];
+			else ddns[accountId] = {
+				plain: true,
+				provider,
+				values
+			};
+			this.save({
+				...current,
+				ddns
+			});
+		}
+		clearDdnsCredentials(accountId) {
+			const current = this.load();
+			if (current.ddns[accountId] === void 0) return;
+			const ddns = { ...current.ddns };
+			delete ddns[accountId];
+			this.save({
+				...current,
+				ddns
+			});
+		}
+		/** Keeps only the accounts a config still declares; returns how many were dropped. */
+		pruneDdnsCredentials(keep) {
+			const wanted = new Set(keep);
+			const current = this.load();
+			const removed = Object.keys(current.ddns).filter((id) => !wanted.has(id));
+			if (removed.length === 0) return 0;
+			const ddns = { ...current.ddns };
+			for (const id of removed) delete ddns[id];
+			this.save({
+				...current,
+				ddns
+			});
+			return removed.length;
+		}
+		openStored(accountId, stored) {
+			if (isPlainDdns(stored)) return {
+				provider: stored.provider,
+				values: stored.values
+			};
+			const kdf = this.load().ddnsKdf;
+			if (kdf === null) {
+				this.warnOnce(accountId, "the file carries no key parameters");
+				return null;
+			}
+			const record = openDdns(accountId, stored, this.ddnsKey(kdf));
+			if (record === null) this.warnOnce(accountId, `the entry could not be opened — is HHOSTED_DDNS_SECRET still the one it was sealed with?`);
+			return record;
+		}
+		/** One derivation per file salt, cached for the life of the process. */
+		ddnsKey(kdf) {
+			if (this.ddnsKeyCache?.salt === kdf.salt) return this.ddnsKeyCache.key;
+			const key = deriveKey(this.ddnsSecret, Buffer$1.from(kdf.salt, "base64"), kdf.cost, DDNS_KEYLEN);
+			this.ddnsKeyCache = {
+				salt: kdf.salt,
+				key
+			};
+			return key;
+		}
+		warnOnce(accountId, reason) {
+			if (this.warnedAccounts.has(accountId)) return;
+			this.warnedAccounts.add(accountId);
+			logger.warn(`ddns: cannot read the credentials for "${accountId}" — ${reason}`);
+		}
 		read() {
 			if (!fs.existsSync(this.file)) return {
 				version: 3,
 				password: null,
 				apiToken: null,
-				telegram: null
+				telegram: null,
+				ddns: {},
+				ddnsKdf: null
 			};
 			try {
 				const parsed = JSON.parse(fs.readFileSync(this.file, "utf8"));
@@ -1315,20 +1631,42 @@ var init_secrets = __esmMin((() => {
 					version: 3,
 					password: parsed?.password ?? null,
 					apiToken: parsed?.apiToken?.hash ? parsed.apiToken : null,
-					telegram: parsed?.telegram?.botToken ? { botToken: parsed.telegram.botToken } : null
+					telegram: parsed?.telegram?.botToken ? { botToken: parsed.telegram.botToken } : null,
+					ddns: readStoredDdns(parsed?.ddns),
+					ddnsKdf: readDdnsKdf(parsed?.ddnsKdf)
 				};
 			} catch {
 				return {
 					version: 3,
 					password: null,
 					apiToken: null,
-					telegram: null
+					telegram: null,
+					ddns: {},
+					ddnsKdf: null
 				};
 			}
 		}
 		save(contents) {
-			writeFileAtomic(this.file, `${JSON.stringify(contents, null, 2)}\n`, { mode: 384 });
-			this.cache = contents;
+			const sealed = this.sealStored(contents);
+			writeFileAtomic(this.file, `${JSON.stringify(sealed, null, 2)}\n`, { mode: 384 });
+			this.cache = sealed;
+		}
+		/** Any write seals the entries still sitting in the clear, so the file never keeps both. */
+		sealStored(contents) {
+			const plain = Object.entries(contents.ddns).filter((entry) => isPlainDdns(entry[1]));
+			if (plain.length === 0) return contents;
+			const kdf = contents.ddnsKdf ?? newDdnsKdf();
+			const key = this.ddnsKey(kdf);
+			const ddns = { ...contents.ddns };
+			for (const [accountId, record] of plain) ddns[accountId] = sealDdns(accountId, {
+				provider: record.provider,
+				values: record.values
+			}, key);
+			return {
+				...contents,
+				ddns,
+				ddnsKdf: kdf
+			};
 		}
 	};
 }));
@@ -1833,12 +2171,6 @@ var init_$_routes$1 = __esmMin((() => {
 	init_contracts();
 }));
 //#endregion
-//#region src/helpers/logger.ts
-var logger;
-var init_logger = __esmMin((() => {
-	logger = createConsola({ level: isDevelopment ? LogLevels.debug : void 0 });
-}));
-//#endregion
 //#region src/helpers/validate.ts
 /**
 * Validates a value that is not a request target (a query string, a URL
@@ -1866,6 +2198,7 @@ var paths_exports = /* @__PURE__ */ __exportAll({
 	daemonLogPath: () => daemonLogPath,
 	dataRoot: () => dataRoot,
 	defaultConfigPath: () => defaultConfigPath,
+	defaultDdnsStatePath: () => defaultDdnsStatePath,
 	defaultHistoryPath: () => defaultHistoryPath,
 	defaultLogsDir: () => defaultLogsDir,
 	defaultNannyDir: () => defaultNannyDir,
@@ -1906,7 +2239,7 @@ function resolveUserPath(target, base = projectDir) {
 	else if (value.startsWith("~/") || value.startsWith("~\\")) value = path.join(os.homedir(), value.slice(2));
 	return path.isAbsolute(value) ? value : path.resolve(base, value);
 }
-var dataRoot, projectDir, defaultConfigPath, configSchemaPath, defaultSecretsPath, defaultLogsDir, defaultHistoryPath, defaultTlsDir, defaultNannyDir, runtimePath, daemonLogPath;
+var dataRoot, projectDir, defaultConfigPath, configSchemaPath, defaultSecretsPath, defaultLogsDir, defaultHistoryPath, defaultTlsDir, defaultNannyDir, defaultDdnsStatePath, runtimePath, daemonLogPath;
 var init_paths = __esmMin((() => {
 	dataRoot = resolveDataRoot();
 	projectDir = resolveProjectDir();
@@ -1917,6 +2250,7 @@ var init_paths = __esmMin((() => {
 	defaultHistoryPath = path.join(dataRoot, ".logs", "history.json");
 	defaultTlsDir = path.join(dataRoot, ".tls");
 	defaultNannyDir = path.join(dataRoot, ".state");
+	defaultDdnsStatePath = path.join(dataRoot, ".state", "ddns.json");
 	runtimePath = path.join(dataRoot, "run.json");
 	daemonLogPath = path.join(dataRoot, ".logs", "home-hosted.log");
 }));
@@ -1966,7 +2300,10 @@ function buildBackupsView(store, backups) {
 		dir: backups.directory,
 		keep: store.config.backups.keep,
 		includePaths: store.config.backups.includePaths,
-		paths: backups.paths,
+		paths: backups.paths.map((entry) => ({
+			...entry,
+			id: `data:${entry.path}`
+		})),
 		files: backups.list()
 	};
 }
@@ -1981,6 +2318,7 @@ function buildAppState(deps) {
 		notifications: { telegram: deps.notifications.status() },
 		host: buildHostView(deps.hostMonitor),
 		backups: buildBackupsView(deps.store, deps.backups),
+		ddns: deps.ddns.view,
 		configPath: deps.store.path,
 		configError: deps.store.configError,
 		projectDir,
@@ -2021,7 +2359,10 @@ function createBackupsRoute(deps) {
 		}
 	}), validate("json", backupCreateSchema), async (c) => {
 		const body = c.req.valid("json");
-		const result = await deps.backups.create({ password: body.password });
+		const result = await deps.backups.create({
+			password: body.password,
+			include: body.include
+		});
 		if (!result.ok) throw backupFailed(result.error);
 		return c.json({
 			file: result.file,
@@ -2252,577 +2593,140 @@ var init_control = __esmMin((() => {
 	init_loopback();
 }));
 //#endregion
-//#region src/api/events.ts
-/**
-* One SSE stream per subscriber. Pass `?serverId=<id>` to receive only that
-* server's messages; the first frame always carries the full state snapshot.
-*/
-function createEventsRoute(deps) {
-	return appFactory.createApp().get("/events", describeRoute({
-		tags: ["panel"],
-		summary: "Panel state and log frames as server-sent events",
-		responses: { 200: { description: "text/event-stream" } }
-	}), validate("query", eventsQuery), (c) => {
-		const query = c.req.valid("query");
-		const serverId = query.serverId ?? null;
-		const logOnly = query.logs !== "0";
-		return streamSSE(c, async (stream) => {
-			let pending = 0;
-			let queue = Promise.resolve();
-			let closed = false;
-			const send = (message) => {
-				if (closed) return queue;
-				if (message.type === "log" && pending > MAX_PENDING_WRITES$1) return queue;
-				pending += 1;
-				queue = queue.then(() => stream.writeSSE({
-					event: message.type,
-					data: JSON.stringify(message)
-				})).catch(() => {
-					closed = true;
-				}).finally(() => {
-					pending -= 1;
-				});
-				return queue;
-			};
-			const unsubscribe = deps.hub.subscribe(serverId, (message) => {
-				if (!logOnly && message.type === "log") return;
-				send(message);
-			});
-			stream.onAbort(() => {
-				closed = true;
-				unsubscribe();
-			});
-			await send({
-				type: "hello",
-				ts: Date.now(),
-				state: deps.supervisor.getState()
-			});
-			while (true) {
-				await stream.sleep(PING_INTERVAL_MS);
-				if (closed) break;
-				await stream.writeSSE({
-					event: "ping",
-					data: String(Date.now())
-				});
-			}
-		});
-	});
+//#region src/config/migrations.ts
+/** What would have to run to bring `from` up to `to`. */
+function planConfigMigrations(from, options = {}) {
+	const to = options.to ?? 1;
+	return {
+		from,
+		to,
+		steps: (options.migrations ?? configMigrations).filter((migration) => migration.to > from && migration.to <= to).sort((a, b) => a.to - b.to),
+		tooNew: from > to
+	};
 }
-var MAX_PENDING_WRITES$1, PING_INTERVAL_MS, eventsQuery;
-var init_events$1 = __esmMin((() => {
-	init_factory();
-	init_validator();
-	MAX_PENDING_WRITES$1 = 200;
-	PING_INTERVAL_MS = 15e3;
-	eventsQuery = type({
-		/** Only this server's frames. */
-		"serverId?": "string",
-		/** `logs=0` drops log frames; the first frame is always the full state. */
-		"logs?": "string"
-	});
+/** Applies the plan in order; the caller owns writing the result. */
+function applyConfigMigrations(config, from, options = {}) {
+	const { steps } = planConfigMigrations(from, options);
+	let current = config;
+	for (const step of steps) current = step.apply(current);
+	return {
+		config: current,
+		applied: steps
+	};
+}
+var configMigrations;
+var init_migrations = __esmMin((() => {
+	configMigrations = [];
 }));
 //#endregion
-//#region src/api/health.ts
+//#region src/config/schema.ts
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 /**
-* Liveness for external monitors. Mounted outside `/api`, so it answers without a
-* session: it reports whether the panel itself is serving, and 503 when an
-* autostart server has crashed. Server details are only included for an
-* authenticated caller.
+* Resolves one entry against the panel's server defaults. A group (`restart`,
+* `health`, `health.http`, `stop`) merges key by key, so an entry that decides one
+* member does not silently fall back to the *schema* default for the others — which
+* is the whole point of the panel having defaults at all.
 */
-function createHealthRoute(deps) {
-	return appFactory.createApp().get("/healthz", describeRoute({
-		tags: ["panel"],
-		summary: "Liveness for monitors — no session required",
-		responses: {
-			200: {
-				description: "Serving",
-				content: jsonBody(type({
-					"status": "\"ok\" | \"degraded\"",
-					"uptimeMs": "number",
-					"servers?": type({
-						total: "number",
-						running: "number",
-						crashed: "number",
-						unhealthy: "number"
-					}),
-					"hostAlerts?": "string[]"
-				}))
-			},
-			503: { description: "An autostart server has crashed" }
-		}
-	}), (c) => {
-		const state = deps.supervisor.getState();
-		const broken = state.servers.filter((server) => server.config.autostart && server.status === "crashed");
-		const authenticated = requestIdentity(c, deps.auth).authenticated;
-		return c.json({
-			status: broken.length > 0 ? "degraded" : "ok",
-			uptimeMs: Math.round(process.uptime() * 1e3),
-			...authenticated ? {
-				servers: {
-					total: state.servers.length,
-					running: state.servers.filter((server) => server.status === "running").length,
-					crashed: state.servers.filter((server) => server.status === "crashed").length,
-					unhealthy: state.servers.filter((server) => server.health === "unhealthy").length
-				},
-				hostAlerts: state.host.alerts
-			} : {}
-		}, broken.length > 0 ? 503 : 200);
-	});
+function mergeDefaults(defaults, entry) {
+	const merged = { ...entry };
+	for (const [key, value] of Object.entries(defaults)) {
+		const current = merged[key];
+		if (current === void 0) merged[key] = value;
+		else if (isRecord$2(value) && isRecord$2(current)) merged[key] = mergeDefaults(value, current);
+	}
+	return merged;
 }
-var init_health = __esmMin((() => {
-	init_factory();
-	init_openapi$1();
-	init_auth();
-}));
-//#endregion
-//#region src/api/logs.ts
-function unknownServer$1(id) {
-	return new DetailedError(`unknown server "${id}"`, {
-		statusCode: 404,
-		code: "UNKNOWN_SERVER"
-	});
-}
-function createLogsRoute(deps) {
-	return appFactory.createApp().get("/logs", describeRoute({
-		tags: ["logs"],
-		summary: "Every server with its on-disk log files",
-		responses: { 200: {
-			description: "Log sources",
-			content: jsonBody(logServersViewSchema)
-		} }
-	}), (c) => c.json({ servers: deps.supervisor.views().map((server) => ({
-		serverId: server.id,
-		label: server.config.label ?? server.id,
-		status: server.status,
-		...deps.logFiles.info(server.id)
-	})) })).get("/logs/:id", describeRoute({
-		tags: ["logs"],
-		summary: "Persisted log lines, with search and a stream filter",
-		responses: {
-			200: { description: "Lines" },
-			404: ERROR_RESPONSES[404]
-		}
-	}), validate("param", idParam$1), validate("query", logHistoryQuerySchema), (c) => {
-		const { id } = c.req.valid("param");
-		if (!deps.store.getServer(id)) throw unknownServer$1(id);
-		const query = c.req.valid("query");
-		const requested = query.tail === void 0 ? DEFAULT_TAIL : Number.parseInt(query.tail, 10);
-		const tail = Number.isNaN(requested) ? DEFAULT_TAIL : Math.min(Math.max(requested, MIN_TAIL), MAX_TAIL);
-		const info = deps.logFiles.info(id);
-		const search = query.search?.trim() ?? "";
-		const window = search.length > 0 ? Math.max(tail, MAX_TAIL) : tail;
-		let lines = deps.logFiles.readTail(id, window);
-		if (query.stream !== void 0 && query.stream.length > 0) lines = lines.filter((line) => line.stream === query.stream);
-		if (search.length > 0) {
-			const needle = search.toLowerCase();
-			lines = lines.filter((line) => line.text.toLowerCase().includes(needle));
-		}
-		return c.json({
-			serverId: id,
-			enabled: info.enabled,
-			sizeBytes: info.sizeBytes,
-			files: info.files.map((file) => file.name),
-			searched: search.length > 0 ? window : null,
-			lines: lines.slice(-tail)
-		});
-	}).get("/logs/:id/download", describeRoute({
-		tags: ["logs"],
-		summary: "Download one rotated log file",
-		responses: {
-			200: { description: "application/x-ndjson" },
-			404: ERROR_RESPONSES[404]
-		}
-	}), validate("param", idParam$1), validate("query", downloadQuery), (c) => {
-		const { id } = c.req.valid("param");
-		if (!deps.store.getServer(id)) throw unknownServer$1(id);
-		const requested = c.req.valid("query").file ?? `${id}.log`;
-		if (!deps.logFiles.info(id).files.map((file) => file.name).includes(requested)) throw new DetailedError("unknown log file", {
-			statusCode: 404,
-			code: "UNKNOWN_LOG_FILE"
-		});
-		const file = path.join(deps.logFiles.directory, requested);
-		const body = fs.readFileSync(file);
-		return c.body(body, 200, {
-			"Content-Type": "application/x-ndjson; charset=utf-8",
-			"Content-Length": String(body.byteLength),
-			"Content-Disposition": `attachment; filename="${requested}"`
-		});
-	}).delete("/logs/:id", describeRoute({
-		tags: ["logs"],
-		summary: "Delete the persisted logs of one server",
-		responses: {
-			200: { description: "Cleared" },
-			404: ERROR_RESPONSES[404]
-		}
-	}), validate("param", idParam$1), (c) => {
-		const { id } = c.req.valid("param");
-		if (!deps.store.getServer(id)) throw unknownServer$1(id);
-		deps.logFiles.clear(id);
-		return c.json({ ok: true });
-	});
-}
-var MIN_TAIL, MAX_TAIL, DEFAULT_TAIL, idParam$1, downloadQuery;
-var init_logs = __esmMin((() => {
-	init_factory();
-	init_openapi$1();
-	init_validator();
+var metaSchema, configSchema, CONFIG_KEYS;
+var init_schema = __esmMin((() => {
 	init_contracts();
-	MIN_TAIL = 50;
-	MAX_TAIL = 5e3;
-	DEFAULT_TAIL = 500;
-	idParam$1 = type({ id: "string >= 1" });
-	downloadQuery = type({ "file?": "string" });
-}));
-//#endregion
-//#region src/api/metrics.ts
-/**
-* Prometheus text for whatever wants to scrape the panel (Beszel, Grafana,
-* `curl`). Lives under `/api`, so it needs a session like every other route.
-*/
-function createMetricsRoute(deps) {
-	return appFactory.createApp().get("/metrics", describeRoute({
-		tags: ["panel"],
-		summary: "Prometheus text for whatever scrapes the panel",
-		responses: { 200: { description: "text/plain; version=0.0.4" } }
-	}), (c) => {
-		const state = deps.supervisor.getState();
-		const lines = [];
-		const metric = (name, help, samples) => {
-			if (samples.length === 0) return;
-			lines.push(`# HELP ${name} ${help}`, `# TYPE ${name} gauge`, ...samples);
-		};
-		metric("hh_control_up", "Control plane is serving", ["hh_control_up 1"]);
-		metric("hh_servers_total", "Configured servers", [`hh_servers_total ${state.servers.length}`]);
-		metric("hh_server_up", "Server process is running", state.servers.map((server) => `hh_server_up{server="${server.id}"} ${server.status === "running" ? 1 : 0}`));
-		metric("hh_server_restarts_total", "Restarts since the control plane started", state.servers.map((server) => `hh_server_restarts_total{server="${server.id}"} ${server.restarts}`));
-		metric("hh_server_crashes_24h", "Crashes in the last 24 hours", state.servers.map((server) => `hh_server_crashes_24h{server="${server.id}"} ${server.history.crashes}`));
-		metric("hh_server_uptime_ratio_24h", "Share of the last 24 hours the server was up", state.servers.filter((server) => server.history.uptimeRatio !== null).map((server) => `hh_server_uptime_ratio_24h{server="${server.id}"} ${server.history.uptimeRatio.toFixed(4)}`));
-		metric("hh_server_response_ms", "Last health probe latency in milliseconds", state.servers.filter((server) => server.responseMs !== null).map((server) => `hh_server_response_ms{server="${server.id}"} ${server.responseMs}`));
-		metric("hh_server_rss_bytes", "RSS of the server process tree", state.servers.filter((server) => server.resources?.rssBytes != null).map((server) => `hh_server_rss_bytes{server="${server.id}"} ${server.resources.rssBytes}`));
-		metric("hh_server_cpu_percent", "CPU percent of the server process tree", state.servers.filter((server) => server.resources?.cpuPercent != null).map((server) => `hh_server_cpu_percent{server="${server.id}"} ${server.resources.cpuPercent}`));
-		metric("hh_host_disk_used_percent", "Disk usage percent per configured path", state.host.disks.map((disk) => `hh_host_disk_used_percent{mount="${disk.path}"} ${disk.usedPercent.toFixed(2)}`));
-		metric("hh_host_memory_used_percent", "Memory usage percent", [`hh_host_memory_used_percent ${state.host.memoryUsedPercent.toFixed(2)}`]);
-		metric("hh_host_swap_used_percent", "Swap usage percent", [`hh_host_swap_used_percent ${state.host.swapUsedPercent.toFixed(2)}`]);
-		metric("hh_host_load1_per_cpu", "1 minute load average per cpu", [`hh_host_load1_per_cpu ${((state.host.loadAvg[0] ?? 0) / Math.max(1, state.host.cpus)).toFixed(3)}`]);
-		return c.text(`${lines.join("\n")}\n`, 200, { "Content-Type": "text/plain; version=0.0.4; charset=utf-8" });
-	});
-}
-var init_metrics = __esmMin((() => {
-	init_factory();
+	metaSchema = type({
+		writtenBy: "string = \"\"",
+		schema: "number.integer >= 1 = 1"
+	}).onUndeclaredKey("reject");
+	configSchema = type({
+		$schema: "string?",
+		meta: metaSchema.optional(),
+		control: controlSchema.default(() => ({})),
+		defaults: defaultsSchema.default(() => ({})),
+		logs: logsSchema.default(() => ({})),
+		notifications: notificationsSchema.default(() => ({})),
+		host: hostSchema.default(() => ({})),
+		backups: backupsSchema.default(() => ({})),
+		ddns: ddnsConfigSchema.default(() => ({})),
+		servers: serverSchema.array().default(() => [])
+	}).onUndeclaredKey("reject");
+	CONFIG_KEYS = [
+		"$schema",
+		"meta",
+		"control",
+		"defaults",
+		"logs",
+		"notifications",
+		"host",
+		"backups",
+		"ddns",
+		"servers"
+	];
 }));
 //#endregion
-//#region src/providers/telegram.ts
-function getBot(token) {
-	const cached = bots.get(token);
-	if (cached) return cached;
-	const bot = new Bot(token, { client: { timeoutSeconds: 10 } });
-	bot.api.config.use(autoRetry({
-		maxRetryAttempts: 3,
-		maxDelaySeconds: 20
-	}));
-	bots.set(token, bot);
-	return bot;
-}
-/** Drops cached clients; used when the token changes or the service shuts down. */
-function forgetBots() {
-	bots.clear();
-}
-function escapeHtml(value) {
-	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-}
-function formatTelegramMessage(title, lines) {
-	const body = lines.filter((line) => line.length > 0).map((line) => `• ${escapeHtml(line)}`).join("\n");
-	return `<b>${escapeHtml(title)}</b>${body.length > 0 ? `\n${body}` : ""}`;
+//#region src/config/parse.ts
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-/** Turns a grammY error into something worth showing in the settings page. */
-function describeTelegramError(error) {
-	if (typeof error === "object" && error !== null) {
-		const candidate = error;
-		const description = candidate.description ?? candidate.message;
-		if (description) return `${description}${candidate.error_code === void 0 ? "" : ` (${candidate.error_code})`}${candidate.parameters?.retry_after === void 0 ? "" : `, retry in ${candidate.parameters.retry_after}s`}`;
+function deleteAtPath(root, path) {
+	let node = root;
+	for (const key of path.slice(0, -1)) {
+		node = Array.isArray(node) ? node[Number(key)] : isRecord$1(node) ? node[key] : void 0;
+		if (node === void 0) return;
 	}
-	return error instanceof Error ? error.message : String(error);
+	const last = path[path.length - 1];
+	if (last === void 0) return;
+	if (isRecord$1(node)) delete node[String(last)];
+	else if (Array.isArray(node) && typeof last === "number") node.splice(last, 1);
 }
-async function sendTelegramMessage(token, chatId, html) {
-	try {
-		await getBot(token).api.sendMessage(chatId, html, {
-			parse_mode: "HTML",
-			link_preview_options: { is_disabled: true }
-		});
-		return { ok: true };
-	} catch (error) {
-		return {
-			ok: false,
-			error: describeTelegramError(error)
+/**
+* Validates one object against one schema, tolerating keys the schema does not
+* know: a config written by a newer release has to keep working here, and losing
+* the *whole group* to schema defaults would silently reset the listener port,
+* the bind and the auth policy over a single unrecognized key.
+*
+* Only unrecognized keys are dropped, and each one is reported. Anything else is
+* a real problem, returned for the caller to refuse on.
+*/
+function parseTolerant(value, schema, prefix, unknownKeys) {
+	const candidate = structuredClone(value);
+	for (let pass = 0; pass < 25; pass++) {
+		const parsed = schema(candidate);
+		if (!(parsed instanceof type.errors)) return {
+			value: parsed,
+			error: null
 		};
-	}
-}
-async function verifyTelegramToken(token) {
-	try {
-		return {
-			ok: true,
-			username: (await getBot(token).api.getMe()).username
+		const removable = parsed.filter((problem) => problem.problem === UNDECLARED);
+		if (removable.length === 0) return {
+			value: null,
+			error: parsed.summary
 		};
-	} catch (error) {
-		return {
-			ok: false,
-			error: describeTelegramError(error)
+		if (!isRecord$1(candidate)) return {
+			value: null,
+			error: parsed.summary
 		};
+		for (const problem of removable) {
+			const at = `${prefix}.${problem.path.join(".")}`;
+			if (!unknownKeys.includes(at)) unknownKeys.push(at);
+			deleteAtPath(candidate, problem.path);
+		}
 	}
+	return {
+		value: null,
+		error: "too many unrecognized keys to ignore"
+	};
 }
 /**
-* Recent chats that talked to the bot, so a chat id can be picked instead of
-* hunted down by hand. Telegram only reports chats with pending updates, so the
-* caller is told to message the bot first.
-*/
-async function listTelegramChats(token) {
-	try {
-		const updates = await getBot(token).api.getUpdates({
-			limit: 100,
-			allowed_updates: [
-				"message",
-				"channel_post",
-				"edited_message"
-			]
-		});
-		const chats = /* @__PURE__ */ new Map();
-		for (const update of updates) {
-			const chat = update.message?.chat ?? update.channel_post?.chat ?? update.edited_message?.chat;
-			if (!chat) continue;
-			const title = "title" in chat && chat.title ? chat.title : "username" in chat && chat.username ? `@${chat.username}` : "first_name" in chat && chat.first_name ? chat.first_name : "private chat";
-			chats.set(String(chat.id), {
-				id: chat.id,
-				title
-			});
-		}
-		return {
-			ok: true,
-			chats: [...chats.values()]
-		};
-	} catch (error) {
-		return {
-			ok: false,
-			chats: [],
-			error: describeTelegramError(error)
-		};
-	}
-}
-var bots;
-var init_telegram = __esmMin((() => {
-	bots = /* @__PURE__ */ new Map();
-}));
-//#endregion
-//#region src/api/notifications.ts
-/**
-* The bot token is written straight to the secrets file and never into
-* `servers.config.json`, so notification *policy* and the *credential* stay
-* separate.
-*/
-function createNotificationsRoute(deps) {
-	return appFactory.createApp().put("/notifications/token", describeRoute({
-		tags: ["notifications"],
-		summary: "Store the Telegram bot token (verified first)",
-		responses: {
-			200: { description: "Stored" },
-			400: ERROR_RESPONSES[400]
-		}
-	}), validate("json", telegramTokenSchema), async (c) => {
-		const { botToken } = c.req.valid("json");
-		const verified = await deps.notifications.verifyToken(botToken);
-		if (!verified.ok) throw new DetailedError(`telegram rejected the token: ${verified.error ?? "unknown error"}`, {
-			statusCode: 400,
-			code: "TELEGRAM_TOKEN_REJECTED"
-		});
-		deps.secrets.setTelegramToken(botToken);
-		forgetBots();
-		return c.json({
-			ok: true,
-			username: verified.username ?? null
-		});
-	}).delete("/notifications/token", describeRoute({
-		tags: ["notifications"],
-		summary: "Forget the Telegram bot token",
-		responses: { 200: { description: "Removed" } }
-	}), (c) => {
-		deps.secrets.setTelegramToken(null);
-		forgetBots();
-		return c.json({ ok: true });
-	}).post("/notifications/test", describeRoute({
-		tags: ["notifications"],
-		summary: "Send a test message",
-		responses: {
-			200: { description: "Sent or refused" },
-			400: ERROR_RESPONSES[400]
-		}
-	}), validate("json", notificationActionSchema), async (c) => {
-		const result = await deps.notifications.sendTest(c.req.valid("json"));
-		if (!result.ok) throw new DetailedError(result.error ?? "the test message failed", {
-			statusCode: 400,
-			code: "TELEGRAM_SEND_FAILED"
-		});
-		return c.json(result);
-	}).post("/notifications/detect-chats", describeRoute({
-		tags: ["notifications"],
-		summary: "List the chats the bot can see",
-		responses: {
-			200: {
-				description: "Chats",
-				content: jsonBody(type({ chats: type({
-					id: "string | number",
-					title: "string"
-				}).array() }))
-			},
-			400: ERROR_RESPONSES[400]
-		}
-	}), validate("json", notificationActionSchema), async (c) => {
-		const result = await deps.notifications.detectChats(c.req.valid("json"));
-		if (!result.ok) throw new DetailedError(result.error ?? "could not list chats", {
-			statusCode: 400,
-			code: "TELEGRAM_LIST_FAILED"
-		});
-		return c.json({ chats: result.chats });
-	});
-}
-var init_notifications$1 = __esmMin((() => {
-	init_factory();
-	init_openapi$1();
-	init_validator();
-	init_telegram();
-	init_contracts();
-}));
-//#endregion
-//#region src/config/migrations.ts
-/** What would have to run to bring `from` up to `to`. */
-function planConfigMigrations(from, options = {}) {
-	const to = options.to ?? 1;
-	return {
-		from,
-		to,
-		steps: (options.migrations ?? configMigrations).filter((migration) => migration.to > from && migration.to <= to).sort((a, b) => a.to - b.to),
-		tooNew: from > to
-	};
-}
-/** Applies the plan in order; the caller owns writing the result. */
-function applyConfigMigrations(config, from, options = {}) {
-	const { steps } = planConfigMigrations(from, options);
-	let current = config;
-	for (const step of steps) current = step.apply(current);
-	return {
-		config: current,
-		applied: steps
-	};
-}
-var configMigrations;
-var init_migrations = __esmMin((() => {
-	configMigrations = [];
-}));
-//#endregion
-//#region src/config/schema.ts
-function isRecord$2(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/**
-* Resolves one entry against the panel's server defaults. A group (`restart`,
-* `health`, `health.http`, `stop`) merges key by key, so an entry that decides one
-* member does not silently fall back to the *schema* default for the others — which
-* is the whole point of the panel having defaults at all.
-*/
-function mergeDefaults(defaults, entry) {
-	const merged = { ...entry };
-	for (const [key, value] of Object.entries(defaults)) {
-		const current = merged[key];
-		if (current === void 0) merged[key] = value;
-		else if (isRecord$2(value) && isRecord$2(current)) merged[key] = mergeDefaults(value, current);
-	}
-	return merged;
-}
-var metaSchema, configSchema, CONFIG_KEYS;
-var init_schema = __esmMin((() => {
-	init_contracts();
-	metaSchema = type({
-		writtenBy: "string = \"\"",
-		schema: "number.integer >= 1 = 1"
-	}).onUndeclaredKey("reject");
-	configSchema = type({
-		$schema: "string?",
-		meta: metaSchema.optional(),
-		control: controlSchema.default(() => ({})),
-		defaults: defaultsSchema.default(() => ({})),
-		logs: logsSchema.default(() => ({})),
-		notifications: notificationsSchema.default(() => ({})),
-		host: hostSchema.default(() => ({})),
-		backups: backupsSchema.default(() => ({})),
-		servers: serverSchema.array().default(() => [])
-	}).onUndeclaredKey("reject");
-	CONFIG_KEYS = [
-		"$schema",
-		"meta",
-		"control",
-		"defaults",
-		"logs",
-		"notifications",
-		"host",
-		"backups",
-		"servers"
-	];
-}));
-//#endregion
-//#region src/config/parse.ts
-function isRecord$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function deleteAtPath(root, path) {
-	let node = root;
-	for (const key of path.slice(0, -1)) {
-		node = Array.isArray(node) ? node[Number(key)] : isRecord$1(node) ? node[key] : void 0;
-		if (node === void 0) return;
-	}
-	const last = path[path.length - 1];
-	if (last === void 0) return;
-	if (isRecord$1(node)) delete node[String(last)];
-	else if (Array.isArray(node) && typeof last === "number") node.splice(last, 1);
-}
-/**
-* Validates one object against one schema, tolerating keys the schema does not
-* know: a config written by a newer release has to keep working here, and losing
-* the *whole group* to schema defaults would silently reset the listener port,
-* the bind and the auth policy over a single unrecognized key.
-*
-* Only unrecognized keys are dropped, and each one is reported. Anything else is
-* a real problem, returned for the caller to refuse on.
-*/
-function parseTolerant(value, schema, prefix, unknownKeys) {
-	const candidate = structuredClone(value);
-	for (let pass = 0; pass < 25; pass++) {
-		const parsed = schema(candidate);
-		if (!(parsed instanceof type.errors)) return {
-			value: parsed,
-			error: null
-		};
-		const removable = parsed.filter((problem) => problem.problem === UNDECLARED);
-		if (removable.length === 0) return {
-			value: null,
-			error: parsed.summary
-		};
-		if (!isRecord$1(candidate)) return {
-			value: null,
-			error: parsed.summary
-		};
-		for (const problem of removable) {
-			const at = `${prefix}.${problem.path.join(".")}`;
-			if (!unknownKeys.includes(at)) unknownKeys.push(at);
-			deleteAtPath(candidate, problem.path);
-		}
-	}
-	return {
-		value: null,
-		error: "too many unrecognized keys to ignore"
-	};
-}
-/**
-* Reads a `servers.config.json` from any release. Unrecognized keys are reported
-* and left on disk; blocking problems — including a file this release cannot
-* understand — land in `errors` and leave `config` null.
+* Reads a `servers.config.json` from any release. Unrecognized keys are reported
+* and left on disk; blocking problems — including a file this release cannot
+* understand — land in `errors` and leave `config` null.
 */
 function parseConfig(raw, options = {}) {
 	const unknownKeys = [];
@@ -2896,6 +2800,7 @@ function parseConfig(raw, options = {}) {
 		notifications: groups.notifications,
 		host: groups.host,
 		backups: groups.backups,
+		ddns: groups.ddns,
 		servers
 	};
 	return result;
@@ -2946,7 +2851,8 @@ var init_parse = __esmMin((() => {
 		["logs", logsSchema],
 		["notifications", notificationsSchema],
 		["host", hostSchema],
-		["backups", backupsSchema]
+		["backups", backupsSchema],
+		["ddns", ddnsConfigSchema]
 	];
 	UNDECLARED = "must be removed";
 }));
@@ -2971,324 +2877,2065 @@ var init_seed = __esmMin((() => {
 	};
 }));
 //#endregion
-//#region src/config/store.ts
-function formatErrors(errors) {
-	return errors.summary;
+//#region src/providers/ddns/types.ts
+function succeeded(message, changed) {
+	return {
+		ok: true,
+		changed,
+		message
+	};
 }
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
+function failed(error) {
+	return {
+		ok: false,
+		changed: false,
+		message: error,
+		error
+	};
 }
-function applyPatch(target, patch, mergeKeys) {
-	for (const [key, value] of Object.entries(patch)) {
-		if (value === void 0) continue;
-		if (mergeKeys.has(key) && isRecord(value) && isRecord(target[key])) {
-			target[key] = mergeGroup(target[key], value);
-			continue;
+/** Missing required credential keys, as a sentence for the settings page. */
+function missingFields(credentials, keys) {
+	const missing = keys.filter((key) => (credentials?.[key] ?? "").trim().length === 0);
+	return missing.length === 0 ? null : `set ${missing.join(", ")}`;
+}
+function basicAuth(user, password) {
+	return `Basic ${Buffer$1.from(`${user}:${password}`, "utf8").toString("base64")}`;
+}
+/** A provider error body is useful, but never worth throwing over. */
+async function errorText(response, limit = 300) {
+	try {
+		const text = (await response.text()).replace(/\s+/g, " ").trim();
+		return text.length === 0 ? `HTTP ${response.status}` : `HTTP ${response.status}: ${text.slice(0, limit)}`;
+	} catch {
+		return `HTTP ${response.status}`;
+	}
+}
+/** `Sub.Domain.COM.` -> `sub.domain.com`; DuckDNS and friends are case-insensitive. */
+function normalizeHost(host) {
+	return host.trim().toLowerCase().replace(NORMALIZE_DOTS, "");
+}
+var NORMALIZE_DOTS;
+var init_types = __esmMin((() => {
+	NORMALIZE_DOTS = /\.$/;
+}));
+//#endregion
+//#region src/providers/ddns/cloudflare.ts
+function authHeaders(credentials) {
+	const token = (credentials.apiToken ?? "").trim();
+	if (token.length > 0) return { Authorization: `Bearer ${token}` };
+	const email = (credentials.email ?? "").trim();
+	const key = (credentials.apiKey ?? "").trim();
+	if (email.length > 0 && key.length > 0) return {
+		"X-Auth-Email": email,
+		"X-Auth-Key": key
+	};
+	return null;
+}
+async function call(path, headers, context, init = {}) {
+	try {
+		const response = await context.fetch(`${API$5}${path}`, {
+			...init,
+			headers: {
+				...headers,
+				"Content-Type": "application/json",
+				...init.headers ?? {}
+			},
+			signal: context.signal
+		});
+		const text = await response.text();
+		let parsed;
+		try {
+			parsed = JSON.parse(text);
+		} catch {
+			return {
+				data: null,
+				status: response.status,
+				error: `cloudflare answered ${response.status}: ${text.slice(0, 200)}`
+			};
 		}
-		target[key] = value;
+		if (!response.ok || parsed.success !== true) {
+			const detail = (parsed.errors ?? []).map((entry) => `${entry.code} ${entry.message}`).join("; ");
+			return {
+				data: parsed,
+				status: response.status,
+				error: detail.length > 0 ? detail : `HTTP ${response.status}`
+			};
+		}
+		return {
+			data: parsed,
+			status: response.status,
+			error: null
+		};
+	} catch (error) {
+		return {
+			data: null,
+			status: 0,
+			error: error instanceof Error ? error.message : String(error)
+		};
 	}
 }
 /**
-* Merges one nested group recursively — `health.http` is a group of its own, and
-* replacing it wholesale would silently reset the siblings a partial patch never
-* mentioned. An explicit `null` removes a key, which is how a schema-optional
-* field is cleared.
+* Walks the host's parents through `GET /zones?name=`, which is how the
+* reference image resolves a zone without a pasted zone id; the id is cached in
+* the panel's state file, so it usually costs nothing.
 */
-function mergeGroup(target, patch) {
-	const merged = { ...target };
-	for (const [key, value] of Object.entries(patch)) {
-		if (value === void 0) continue;
-		if (value === null) {
-			delete merged[key];
-			continue;
-		}
-		if (isRecord(value) && isRecord(merged[key])) {
-			merged[key] = mergeGroup(merged[key], value);
-			continue;
-		}
-		merged[key] = value;
+async function resolveZone(host, headers, context, cached) {
+	if (cached !== void 0) return {
+		id: cached,
+		name: host
+	};
+	const labels = host.split(".");
+	for (let index = 0; index <= labels.length - 2; index++) {
+		const candidate = labels.slice(index).join(".");
+		const { data, error } = await call(`/zones?name=${encodeURIComponent(candidate)}&per_page=1`, headers, context);
+		if (error !== null || data === null) throw new Error(error ?? "could not look up the zone");
+		const zone = data.result[0];
+		if (zone !== void 0) return zone;
 	}
-	return merged;
+	return null;
 }
-var SERVER_MERGE_KEYS, CONTROL_MERGE_KEYS, NOTIFICATION_MERGE_KEYS, EMPTY_MERGE_KEYS, ConfigError, ConfigStore;
-var init_store = __esmMin((() => {
-	init_migrations();
-	init_parse();
-	init_schema();
-	init_seed();
-	init_atomic();
-	init_paths();
-	SERVER_MERGE_KEYS = /* @__PURE__ */ new Set([
-		"restart",
-		"health",
-		"stop"
-	]);
-	CONTROL_MERGE_KEYS = /* @__PURE__ */ new Set(["auth", "tls"]);
-	NOTIFICATION_MERGE_KEYS = /* @__PURE__ */ new Set(["telegram"]);
-	EMPTY_MERGE_KEYS = /* @__PURE__ */ new Set();
-	ConfigError = class extends Error {
-		name = "ConfigError";
+async function findRecord(zoneId, record, headers, context, cached) {
+	if (cached !== void 0) {
+		const fetched = await call(`/zones/${zoneId}/dns_records/${cached}`, headers, context);
+		if (fetched.error === null && fetched.data !== null) return {
+			record: fetched.data.result,
+			error: null
+		};
+		if (fetched.status !== 404 && fetched.status !== 400) return {
+			record: null,
+			error: fetched.error
+		};
+	}
+	const listed = await call(`/zones/${zoneId}/dns_records?type=${record.type}&name=${encodeURIComponent(record.host)}&per_page=100`, headers, context);
+	if (listed.error !== null) return {
+		record: null,
+		error: listed.error
 	};
-	ConfigStore = class {
-		file;
-		seed;
-		raw = {};
-		/** The bytes behind the live config, so a watcher can tell a real edit from our own write. */
-		lastText = null;
-		resolvedConfig;
-		error = null;
-		warnings = [];
-		schemaVersion = 1;
-		listeners = /* @__PURE__ */ new Set();
-		constructor(file, seed = SEED_CONFIG) {
-			this.file = file;
-			this.seed = seed;
-		}
-		get path() {
-			return this.file;
-		}
-		get config() {
-			return this.resolvedConfig;
-		}
-		get configError() {
-			return this.error;
-		}
-		/** Keys a newer release wrote that this one ignores; nothing to refuse over. */
-		get configWarnings() {
-			return [...this.warnings];
-		}
-		/** The shape the file declares, as last read. */
-		get configSchemaVersion() {
-			return this.schemaVersion;
-		}
-		/** Steps that would have to run before this release could use the file. */
-		get pendingMigrations() {
-			return planConfigMigrations(this.schemaVersion).steps;
-		}
-		get servers() {
-			return this.resolvedConfig.servers;
-		}
-		get defaults() {
-			return this.resolvedConfig.defaults;
-		}
-		get rawConfig() {
-			return structuredClone(this.raw);
-		}
-		onChange(listener) {
-			this.listeners.add(listener);
-			return () => this.listeners.delete(listener);
-		}
-		getServer(id) {
-			return this.servers.find((server) => server.id === id);
-		}
-		/**
-		* Reads the file and tells the listeners, so whatever wrote it — the settings
-		* page, a restored backup, or the file watcher — becomes the live config.
-		*/
-		load() {
-			this.read();
-			this.notify();
-		}
-		/**
-		* The watcher's entry point: re-reads the file only when its bytes changed.
-		*
-		* `changed` means the file on disk is different from what the live config was
-		* read from, `applied` means that difference was accepted — a file this release
-		* cannot read is reported and the config already running is left alone, which is
-		* what keeps an editor's typo from stopping every server.
-		*/
-		reloadFromDisk() {
-			let text;
+	return {
+		record: (listed.data?.result ?? []).find((entry) => entry.id !== void 0) ?? null,
+		error: null
+	};
+}
+var API$5, cloudflareProvider;
+var init_cloudflare = __esmMin((() => {
+	init_types();
+	API$5 = "https://api.cloudflare.com/client/v4";
+	cloudflareProvider = {
+		id: "cloudflare",
+		label: "Cloudflare",
+		docsUrl: "https://developers.cloudflare.com/api/resources/dns/subresources/records/",
+		families: ["A", "AAAA"],
+		ttl: true,
+		proxied: true,
+		fields: [
+			{
+				key: "apiToken",
+				label: "API token",
+				hint: "Zone → DNS → Edit (plus Zone → Zone → Read) for your zones. Preferred.",
+				optional: true
+			},
+			{
+				key: "email",
+				label: "Account email",
+				hint: "Only for the legacy Global API Key.",
+				optional: true
+			},
+			{
+				key: "apiKey",
+				label: "Global API key",
+				hint: "Legacy; prefer an API token.",
+				optional: true
+			}
+		],
+		validate(credentials) {
+			if (authHeaders(credentials ?? {}) !== null) return null;
+			return missingFields(credentials, ["apiToken"]);
+		},
+		async update(record, context) {
+			const headers = authHeaders(context.credentials);
+			if (headers === null) return failed("cloudflare needs an API token (or the legacy email + global key)");
 			try {
-				text = fs.readFileSync(this.file, "utf8");
-			} catch {
-				this.error = `${path.basename(this.file)} is gone`;
-				return {
-					changed: false,
-					applied: false,
-					error: this.error
+				const zone = await resolveZone(record.host, headers, context, record.cache?.zoneId);
+				if (zone === null) return failed(`cloudflare does not have a zone for ${record.host}`);
+				const ttl = record.proxied ? 1 : record.ttl;
+				const found = await findRecord(zone.id, record, headers, context, record.cache?.recordId);
+				if (found.error !== null) return failed(found.error);
+				const existing = found.record;
+				if (existing !== null && existing.content === record.ip && existing.ttl === ttl && existing.proxied === record.proxied) return {
+					...succeeded(`already ${record.ip}`, false),
+					cache: {
+						zoneId: zone.id,
+						recordId: existing.id
+					}
 				};
-			}
-			if (text === this.lastText) {
-				if (this.error !== null) {
-					this.error = null;
-					this.load();
-				}
+				const cache = {
+					zoneId: zone.id,
+					recordId: existing?.id
+				};
+				const body = JSON.stringify({
+					type: record.type,
+					name: record.host,
+					content: record.ip,
+					ttl,
+					proxied: record.proxied
+				});
+				const written = existing === null ? await call(`/zones/${zone.id}/dns_records`, headers, context, {
+					method: "POST",
+					body
+				}) : await call(`/zones/${zone.id}/dns_records/${existing.id}`, headers, context, {
+					method: "PATCH",
+					body
+				});
+				if (written.error !== null) return failed(written.error);
 				return {
-					changed: false,
-					applied: false,
-					error: null
+					...succeeded(`set ${record.host} ${record.type} to ${record.ip}`, true),
+					cache: {
+						...cache,
+						recordId: written.data?.result?.id ?? existing?.id
+					}
 				};
+			} catch (error) {
+				return failed(error instanceof Error ? error.message : String(error));
 			}
-			const before = this.resolvedConfig;
-			this.load();
-			return {
-				changed: true,
-				applied: this.resolvedConfig !== before,
-				error: this.error
-			};
 		}
-		read() {
-			if (!fs.existsSync(this.file)) {
-				const seed = stampConfig(structuredClone(this.seed));
-				const text = `${JSON.stringify(seed, null, 2)}\n`;
-				writeFileAtomic(this.file, text);
-				this.lastText = text;
-				this.raw = seed;
-				this.apply(seed);
-				return;
-			}
-			let text;
-			let parsed;
+	};
+}));
+//#endregion
+//#region src/providers/ddns/dyndns2.ts
+/** The first word of the body is the code; the rest is provider detail. */
+function parseDyndnsReply(body) {
+	const trimmed = body.trim();
+	const separator = trimmed.search(/\s/);
+	if (separator < 0) return {
+		code: trimmed.toLowerCase(),
+		detail: ""
+	};
+	return {
+		code: trimmed.slice(0, separator).toLowerCase(),
+		detail: trimmed.slice(separator).trim()
+	};
+}
+/** Maps a dyndns2 body onto the panel's result shape. */
+function describeDyndnsReply(body, provider) {
+	const { code, detail } = parseDyndnsReply(body);
+	const known = CODES[code];
+	if (known === void 0) return failed(`${provider} answered "${(body.trim() || "an empty body").slice(0, 120)}"`);
+	if (known.ok) return succeeded(`${known.message}${detail.length === 0 ? "" : ` (${detail})`}`, known.changed);
+	return failed(`${known.message}${detail.length === 0 ? "" : `: ${detail}`}`);
+}
+/**
+* A 401/400 with a non-dyndns2 body is still an answer worth quoting; a known
+* code wins, because several of these endpoints report errors with HTTP 200.
+*/
+function describeDyndnsResponse(response, body, provider) {
+	const { code } = parseDyndnsReply(body);
+	if (!response.ok && CODES[code] === void 0) {
+		const text = body.replace(/\s+/g, " ").trim().slice(0, 160);
+		return failed(`${provider} answered HTTP ${response.status}${text.length === 0 ? "" : `: ${text}`}`);
+	}
+	return describeDyndnsReply(body, provider);
+}
+var CODES;
+var init_dyndns2 = __esmMin((() => {
+	init_types();
+	CODES = {
+		"good": {
+			ok: true,
+			changed: true,
+			message: "updated",
+			permanent: false
+		},
+		"nochg": {
+			ok: true,
+			changed: false,
+			message: "already current",
+			permanent: false
+		},
+		"nohost": {
+			ok: false,
+			changed: false,
+			message: "the provider does not know this hostname",
+			permanent: true
+		},
+		"notfqdn": {
+			ok: false,
+			changed: false,
+			message: "the provider wants a fully qualified hostname",
+			permanent: true
+		},
+		"numhost": {
+			ok: false,
+			changed: false,
+			message: "too many hostnames for this provider",
+			permanent: true
+		},
+		"badauth": {
+			ok: false,
+			changed: false,
+			message: "the provider rejected the credentials",
+			permanent: true
+		},
+		"badagent": {
+			ok: false,
+			changed: false,
+			message: "the provider rejected this client (User-Agent)",
+			permanent: true
+		},
+		"!donator": {
+			ok: false,
+			changed: false,
+			message: "this feature needs a paid provider plan",
+			permanent: true
+		},
+		"abuse": {
+			ok: false,
+			changed: false,
+			message: "the provider blocked this account for abuse",
+			permanent: true
+		},
+		"dnserr": {
+			ok: false,
+			changed: false,
+			message: "the provider had a DNS error",
+			permanent: false
+		},
+		"servererror": {
+			ok: false,
+			changed: false,
+			message: "the provider had a server error",
+			permanent: false
+		},
+		"911": {
+			ok: false,
+			changed: false,
+			message: "the provider is down; it asks you to wait about 30 minutes",
+			permanent: false
+		},
+		"unknown": {
+			ok: false,
+			changed: false,
+			message: "the provider answered with an unknown error",
+			permanent: false
+		}
+	};
+}));
+//#endregion
+//#region src/providers/ddns/desec.ts
+var ENDPOINT$6, desecProvider;
+var init_desec = __esmMin((() => {
+	init_dyndns2();
+	init_types();
+	ENDPOINT$6 = "https://update.dedyn.io/";
+	desecProvider = {
+		id: "desec",
+		label: "deSEC",
+		docsUrl: "https://desec.readthedocs.io/en/latest/dyndns/update-api.html",
+		families: ["A", "AAAA"],
+		ttl: false,
+		proxied: false,
+		fields: [{
+			key: "token",
+			label: "API token",
+			hint: "desec.io → Token management; the token must allow the RRset update.",
+			optional: false
+		}],
+		validate(credentials) {
+			return missingFields(credentials, ["token"]);
+		},
+		async update(record, context) {
+			const token = (context.credentials.token ?? "").trim();
+			if (token.length === 0) return failed("desec needs an API token");
+			const family = record.type === "A" ? `myipv4=${encodeURIComponent(record.ip)}` : `myipv6=${encodeURIComponent(record.ip)}`;
+			const url = `${ENDPOINT$6}?hostname=${encodeURIComponent(record.host)}&${family}`;
 			try {
-				text = fs.readFileSync(this.file, "utf8");
-				parsed = JSON.parse(text);
+				const response = await context.fetch(url, {
+					headers: { Authorization: basicAuth(record.host, token) },
+					signal: context.signal
+				});
+				return describeDyndnsResponse(response, await response.text(), "desec");
 			} catch (error) {
-				this.error = `cannot parse ${path.basename(this.file)}: ${error.message}`;
-				if (this.resolvedConfig === void 0) {
-					this.raw = {};
-					this.resolvedConfig = this.resolveFallback();
-				}
-				return;
+				return failed(error instanceof Error ? error.message : String(error));
 			}
-			this.lastText = text;
-			this.apply(parsed);
 		}
-		notify() {
-			for (const listener of this.listeners) listener();
-		}
-		updateServer(id, patch) {
-			const index = this.raw.servers?.findIndex((entry) => entry.id === id) ?? -1;
-			if (index < 0) throw new ConfigError(`unknown server "${id}"`);
-			const draft = structuredClone(this.raw);
-			const entry = draft.servers[index];
-			applyPatch(entry, patch, SERVER_MERGE_KEYS);
-			const validated = this.validateServer(entry, `servers[${index}]`);
-			this.commit(draft);
-			return validated;
+	};
+}));
+//#endregion
+//#region src/providers/ddns/zone.ts
+/**
+* Splits a hostname into the zone and the record name, which is what every
+* provider that has no zone lookup needs. `zone` short-circuits the heuristic.
+*/
+function splitHost(host, zone) {
+	const normalized = normalizeHost(host);
+	const override = normalizeHost(zone ?? "");
+	const resolved = override.length > 0 ? override : guessZone(normalized);
+	if (normalized === resolved) return {
+		zone: resolved,
+		name: "@"
+	};
+	return {
+		zone: resolved,
+		name: normalized.endsWith(`.${resolved}`) ? normalized.slice(0, -(resolved.length + 1)) : normalized
+	};
+}
+function guessZone(host) {
+	const labels = host.split(".");
+	if (labels.length <= 2) return host;
+	const lastTwo = labels.slice(-2).join(".");
+	const lastThree = labels.slice(-3).join(".");
+	return MULTI_LABEL_SUFFIXES.has(lastTwo) ? lastThree : lastTwo;
+}
+var MULTI_LABEL_SUFFIXES;
+var init_zone = __esmMin((() => {
+	init_types();
+	MULTI_LABEL_SUFFIXES = /* @__PURE__ */ new Set([
+		"ac.uk",
+		"co.in",
+		"co.jp",
+		"co.ke",
+		"co.kr",
+		"co.nz",
+		"co.uk",
+		"co.za",
+		"com.au",
+		"com.br",
+		"com.cn",
+		"com.hk",
+		"com.mx",
+		"com.sg",
+		"com.tr",
+		"com.tw",
+		"edu.au",
+		"gov.uk",
+		"net.au",
+		"net.uk",
+		"org.au",
+		"org.uk"
+	]);
+}));
+//#endregion
+//#region src/providers/ddns/digitalocean.ts
+function oceanTtl(ttl) {
+	return Math.max(30, ttl);
+}
+var API$4, digitaloceanProvider;
+var init_digitalocean = __esmMin((() => {
+	init_types();
+	init_zone();
+	API$4 = "https://api.digitalocean.com/v2/domains";
+	digitaloceanProvider = {
+		id: "digitalocean",
+		label: "DigitalOcean",
+		docsUrl: "https://docs.digitalocean.com/reference/api/api-reference/#tag/Domain-Records",
+		families: ["A", "AAAA"],
+		ttl: true,
+		proxied: false,
+		fields: [{
+			key: "token",
+			label: "API token",
+			hint: "A personal access token with the `domain` scope.",
+			optional: false
+		}],
+		validate(credentials) {
+			return missingFields(credentials, ["token"]);
+		},
+		async update(record, context) {
+			const { zone, name } = splitHost(record.host, record.zone);
+			const ttl = oceanTtl(record.ttl);
+			const headers = {
+				"Authorization": `Bearer ${(context.credentials.token ?? "").trim()}`,
+				"Content-Type": "application/json"
+			};
+			const collection = `${API$4}/${encodeURIComponent(zone)}/records`;
+			try {
+				const listed = await context.fetch(`${collection}?per_page=200`, {
+					headers,
+					signal: context.signal
+				});
+				if (!listed.ok) return failed(await errorText(listed));
+				const existing = ((await listed.json()).domain_records ?? []).find((entry) => entry.name === name && entry.type === record.type);
+				if (existing !== void 0 && existing.data === record.ip) return succeeded(`already ${record.ip}`, false);
+				const written = existing === void 0 ? await context.fetch(collection, {
+					method: "POST",
+					headers,
+					body: JSON.stringify({
+						type: record.type,
+						name,
+						data: record.ip,
+						ttl
+					}),
+					signal: context.signal
+				}) : await context.fetch(`${collection}/${existing.id}`, {
+					method: "PUT",
+					headers,
+					body: JSON.stringify({
+						type: record.type,
+						name,
+						data: record.ip,
+						ttl
+					}),
+					signal: context.signal
+				});
+				if (!written.ok) return failed(await errorText(written));
+				return succeeded(`set ${record.host} ${record.type} to ${record.ip}`, true);
+			} catch (error) {
+				return failed(error instanceof Error ? error.message : String(error));
+			}
 		}
-		updateControl(patch) {
-			const draft = structuredClone(this.raw);
-			draft.control = { ...draft.control ?? {} };
-			applyPatch(draft.control, patch, CONTROL_MERGE_KEYS);
-			const control = controlSchema(draft.control);
-			if (control instanceof type.errors) throw new ConfigError(`control: ${formatErrors(control)}`);
-			this.commit(draft);
-			return control;
+	};
+}));
+//#endregion
+//#region src/providers/ddns/duckdns.ts
+/** DuckDNS addresses one subdomain at a time, so the label is the domain. */
+function subdomain(host) {
+	const normalized = host.trim().toLowerCase();
+	return normalized.endsWith(".duckdns.org") ? normalized.slice(0, -12) : normalized;
+}
+var ENDPOINT$5, duckdnsProvider;
+var init_duckdns = __esmMin((() => {
+	init_types();
+	ENDPOINT$5 = "https://www.duckdns.org/update";
+	duckdnsProvider = {
+		id: "duckdns",
+		label: "DuckDNS",
+		docsUrl: "https://www.duckdns.org/spec.jsp",
+		families: ["A", "AAAA"],
+		ttl: false,
+		proxied: false,
+		fields: [{
+			key: "token",
+			label: "Account token",
+			hint: "On duckdns.org after signing in. One token covers every subdomain.",
+			optional: false
+		}],
+		validate(credentials) {
+			return missingFields(credentials, ["token"]);
+		},
+		async update(record, context) {
+			const token = (context.credentials.token ?? "").trim();
+			if (token.length === 0) return failed("duckdns needs the account token");
+			const family = record.type === "A" ? `ip=${encodeURIComponent(record.ip)}` : `ipv6=${encodeURIComponent(record.ip)}`;
+			const url = `${ENDPOINT$5}?domains=${encodeURIComponent(subdomain(record.host))}&token=${encodeURIComponent(token)}&${family}`;
+			try {
+				const response = await context.fetch(url, { signal: context.signal });
+				const body = (await response.text()).trim();
+				if (body.toUpperCase() === "OK") return succeeded(`set ${record.host} ${record.type} to ${record.ip}`, true);
+				return failed(`duckdns answered "${body.slice(0, 120) || `HTTP ${response.status}`}"`);
+			} catch (error) {
+				return failed(error instanceof Error ? error.message : String(error));
+			}
 		}
-		updateLogs(patch) {
-			const draft = structuredClone(this.raw);
-			draft.logs = { ...draft.logs ?? {} };
-			applyPatch(draft.logs, patch, EMPTY_MERGE_KEYS);
-			const logs = logsSchema(draft.logs);
-			if (logs instanceof type.errors) throw new ConfigError(`logs: ${formatErrors(logs)}`);
-			this.commit(draft);
-			return logs;
+	};
+}));
+//#endregion
+//#region src/providers/ddns/dynu.ts
+var ENDPOINT$4, dynuProvider;
+var init_dynu = __esmMin((() => {
+	init_dyndns2();
+	init_types();
+	ENDPOINT$4 = "https://api.dynu.com/nic/update";
+	dynuProvider = {
+		id: "dynu",
+		label: "Dynu",
+		docsUrl: "https://www.dynu.com/DynamicDNS/IP-Update-Protocol",
+		families: ["A", "AAAA"],
+		ttl: false,
+		proxied: false,
+		fields: [{
+			key: "username",
+			label: "Username",
+			hint: "Dynu username; used for HTTP Basic auth.",
+			optional: false
+		}, {
+			key: "password",
+			label: "Password",
+			hint: "Account password, or its SHA-256 hash.",
+			optional: false
+		}],
+		validate(credentials) {
+			return missingFields(credentials, ["username", "password"]);
+		},
+		async update(record, context) {
+			const username = (context.credentials.username ?? "").trim();
+			const password = (context.credentials.password ?? "").trim();
+			if (username.length === 0 || password.length === 0) return failed("dynu needs the username and password");
+			const address = record.type === "A" ? `myip=${encodeURIComponent(record.ip)}` : `myipv6=${encodeURIComponent(record.ip)}`;
+			const url = `${ENDPOINT$4}?hostname=${encodeURIComponent(record.host)}&${address}`;
+			try {
+				const response = await context.fetch(url, {
+					headers: { Authorization: basicAuth(username, password) },
+					signal: context.signal
+				});
+				return describeDyndnsResponse(response, await response.text(), "dynu");
+			} catch (error) {
+				return failed(error instanceof Error ? error.message : String(error));
+			}
 		}
-		updateNotifications(patch) {
-			const draft = structuredClone(this.raw);
-			draft.notifications = { ...draft.notifications ?? {} };
-			applyPatch(draft.notifications, patch, NOTIFICATION_MERGE_KEYS);
-			const notifications = notificationsSchema(draft.notifications);
-			if (notifications instanceof type.errors) throw new ConfigError(`notifications: ${formatErrors(notifications)}`);
-			this.commit(draft);
-			return notifications;
+	};
+}));
+//#endregion
+//#region src/providers/ddns/freedns.ts
+/**
+* FreeDNS credentials *are* a URL: the per-record "Direct URL" hash. Both the
+* bare hash and the whole URL are accepted, because that is what people copy.
+*/
+function updateToken(credentials) {
+	const raw = (credentials.token ?? "").trim();
+	if (raw.length === 0) return "";
+	return (raw.includes("?") ? raw.slice(raw.indexOf("?") + 1) : raw).replace(/^https?:\/\/[^?]*\?/, "");
+}
+var ENDPOINT$3, freednsProvider;
+var init_freedns = __esmMin((() => {
+	init_types();
+	ENDPOINT$3 = "https://freedns.afraid.org/dynamic/update.php";
+	freednsProvider = {
+		id: "freedns",
+		label: "FreeDNS (afraid.org)",
+		docsUrl: "https://freedns.afraid.org/faq/",
+		families: ["A", "AAAA"],
+		ttl: false,
+		proxied: false,
+		fields: [{
+			key: "token",
+			label: "Direct URL",
+			hint: "FreeDNS → Dynamic DNS → the per-record \"Direct URL\". Paste the whole URL or just its hash.",
+			optional: false
+		}],
+		validate(credentials) {
+			return missingFields(credentials, ["token"]);
+		},
+		async update(record, context) {
+			const token = updateToken(context.credentials);
+			if (token.length === 0) return failed("freedns needs the per-record Direct URL");
+			try {
+				const response = await context.fetch(`${ENDPOINT$3}?${token}&address=${encodeURIComponent(record.ip)}`, { signal: context.signal });
+				const body = (await response.text()).trim();
+				if (!response.ok || /^ERROR/i.test(body)) return failed(`freedns answered "${body.slice(0, 160) || `HTTP ${response.status}`}"`);
+				return succeeded(`set ${record.host} ${record.type} to ${record.ip}`, true);
+			} catch (error) {
+				return failed(error instanceof Error ? error.message : String(error));
+			}
 		}
-		updateHost(patch) {
-			const draft = structuredClone(this.raw);
-			draft.host = { ...draft.host ?? {} };
-			applyPatch(draft.host, patch, EMPTY_MERGE_KEYS);
-			const host = hostSchema(draft.host);
-			if (host instanceof type.errors) throw new ConfigError(`host: ${formatErrors(host)}`);
-			this.commit(draft);
-			return host;
+	};
+}));
+//#endregion
+//#region src/providers/ddns/gandi.ts
+/** Gandi's documented minimum; `1` (automatic) has no meaning here. */
+function gandiTtl(ttl) {
+	return Math.min(2592e3, Math.max(300, ttl));
+}
+/** A Personal Access Token (`pat_…`) is preferred; the legacy API key is still accepted. */
+function authHeader(token) {
+	return token.startsWith("pat_") ? `Bearer ${token}` : `Apikey ${token}`;
+}
+var API$3, gandiProvider;
+var init_gandi = __esmMin((() => {
+	init_types();
+	init_zone();
+	API$3 = "https://api.gandi.net/v5/livedns/domains";
+	gandiProvider = {
+		id: "gandi",
+		label: "Gandi",
+		docsUrl: "https://api.gandi.net/docs/livedns/",
+		families: ["A", "AAAA"],
+		ttl: true,
+		proxied: false,
+		fields: [{
+			key: "token",
+			label: "Personal access token",
+			hint: "A `pat_…` token from admin.gandi.net → Organizations. A legacy API key also works.",
+			optional: false
+		}],
+		validate(credentials) {
+			return missingFields(credentials, ["token"]);
+		},
+		async update(record, context) {
+			const token = (context.credentials.token ?? "").trim();
+			if (token.length === 0) return failed("gandi needs an API token");
+			const { zone, name } = splitHost(record.host, record.zone);
+			const ttl = gandiTtl(record.ttl);
+			const url = `${API$3}/${encodeURIComponent(zone)}/records/${encodeURIComponent(name)}/${record.type}`;
+			const headers = {
+				"Authorization": authHeader(token),
+				"Content-Type": "application/json"
+			};
+			try {
+				const current = await context.fetch(url, {
+					headers,
+					signal: context.signal
+				});
+				if (current.ok) {
+					const body = await current.json();
+					if (body.rrset_values?.length === 1 && body.rrset_values[0] === record.ip) return succeeded(`already ${record.ip}`, false);
+				}
+				const written = await context.fetch(url, {
+					method: "PUT",
+					headers,
+					body: JSON.stringify({
+						rrset_values: [record.ip],
+						rrset_ttl: ttl
+					}),
+					signal: context.signal
+				});
+				if (!written.ok) return failed(await errorText(written));
+				return succeeded(`set ${record.host} ${record.type} to ${record.ip}`, true);
+			} catch (error) {
+				return failed(error instanceof Error ? error.message : String(error));
+			}
 		}
-		updateBackups(patch) {
-			const draft = structuredClone(this.raw);
-			draft.backups = { ...draft.backups ?? {} };
-			applyPatch(draft.backups, patch, EMPTY_MERGE_KEYS);
-			const backups = backupsSchema(draft.backups);
-			if (backups instanceof type.errors) throw new ConfigError(`backups: ${formatErrors(backups)}`);
-			this.commit(draft);
-			return backups;
+	};
+}));
+//#endregion
+//#region src/providers/ddns/godaddy.ts
+/** GoDaddy's floor; `1` (automatic) has no meaning here. */
+function godaddyTtl(ttl) {
+	return Math.min(86400, Math.max(600, ttl));
+}
+var API$2, godaddyProvider;
+var init_godaddy = __esmMin((() => {
+	init_types();
+	init_zone();
+	API$2 = "https://api.godaddy.com/v1/domains";
+	godaddyProvider = {
+		id: "godaddy",
+		label: "GoDaddy",
+		docsUrl: "https://developer.godaddy.com/doc/endpoint/dns",
+		families: ["A", "AAAA"],
+		ttl: true,
+		proxied: false,
+		fields: [
+			{
+				key: "key",
+				label: "API key",
+				hint: "developer.godaddy.com/keys.",
+				optional: false
+			},
+			{
+				key: "secret",
+				label: "API secret",
+				hint: "Shown once with the key.",
+				optional: false
+			},
+			{
+				key: "baseUrl",
+				label: "API base URL",
+				hint: "Optional; use https://api.ote-godaddy.com to rehearse against the test environment.",
+				optional: true
+			}
+		],
+		validate(credentials) {
+			return missingFields(credentials, ["key", "secret"]);
+		},
+		async update(record, context) {
+			const { zone, name } = splitHost(record.host, record.zone);
+			const ttl = godaddyTtl(record.ttl);
+			const url = `${(context.credentials.baseUrl ?? "").trim() || API$2}/${encodeURIComponent(zone)}/records/${record.type}/${encodeURIComponent(name)}`;
+			const headers = {
+				"Authorization": `sso-key ${context.credentials.key ?? ""}:${context.credentials.secret ?? ""}`,
+				"Content-Type": "application/json"
+			};
+			try {
+				const current = await context.fetch(url, {
+					headers,
+					signal: context.signal
+				});
+				if (current.ok) {
+					const body = await current.json();
+					if (body.length === 1 && body[0]?.data === record.ip) return succeeded(`already ${record.ip}`, false);
+				}
+				const written = await context.fetch(url, {
+					method: "PUT",
+					headers,
+					body: JSON.stringify([{
+						data: record.ip,
+						ttl
+					}]),
+					signal: context.signal
+				});
+				if (!written.ok) return failed(await errorText(written));
+				return succeeded(`set ${record.host} ${record.type} to ${record.ip}`, true);
+			} catch (error) {
+				return failed(error instanceof Error ? error.message : String(error));
+			}
 		}
-		updateDefaults(patch) {
-			const draft = structuredClone(this.raw);
-			draft.defaults = { ...draft.defaults ?? {} };
-			applyPatch(draft.defaults, patch, SERVER_MERGE_KEYS);
-			const defaults = defaultsSchema(draft.defaults);
-			if (defaults instanceof type.errors) throw new ConfigError(`defaults: ${formatErrors(defaults)}`);
-			this.commit(draft);
-			return defaults;
+	};
+}));
+//#endregion
+//#region src/providers/ddns/henet.ts
+var ENDPOINT$2, henetProvider;
+var init_henet = __esmMin((() => {
+	init_dyndns2();
+	init_types();
+	ENDPOINT$2 = "https://dyn.dns.he.net/nic/update";
+	henetProvider = {
+		id: "henet",
+		label: "Hurricane Electric",
+		docsUrl: "https://dns.he.net/docs.html",
+		families: ["A", "AAAA"],
+		ttl: false,
+		proxied: false,
+		fields: [{
+			key: "key",
+			label: "DDNS key",
+			hint: "dns.he.net → the key shown next to the host when DDNS is enabled.",
+			optional: false
+		}],
+		validate(credentials) {
+			return missingFields(credentials, ["key"]);
+		},
+		async update(record, context) {
+			const key = (context.credentials.key ?? "").trim();
+			if (key.length === 0) return failed("hurricane electric needs the per-host DDNS key");
+			const url = `${ENDPOINT$2}?hostname=${encodeURIComponent(record.host)}&password=${encodeURIComponent(key)}&myip=${encodeURIComponent(record.ip)}`;
+			try {
+				const response = await context.fetch(url, { signal: context.signal });
+				return describeDyndnsResponse(response, await response.text(), "hurricane electric");
+			} catch (error) {
+				return failed(error instanceof Error ? error.message : String(error));
+			}
 		}
-		addServer(input) {
-			const draft = structuredClone(this.raw);
-			draft.servers ??= [];
-			if (draft.servers.some((entry) => entry.id === input.id)) throw new ConfigError(`server "${String(input.id)}" already exists`);
-			const index = draft.servers.length;
-			draft.servers.push(structuredClone(input));
-			const validated = this.validateServer(draft.servers[index], `servers[${index}]`);
-			this.commit(draft);
-			return validated;
+	};
+}));
+//#endregion
+//#region src/providers/ddns/namecheap.ts
+function tag(body, name) {
+	return new RegExp(`<${name}>([\\s\\S]*?)</${name}>`, "i").exec(body)?.[1]?.trim() ?? null;
+}
+var ENDPOINT$1, namecheapProvider;
+var init_namecheap = __esmMin((() => {
+	init_types();
+	init_zone();
+	ENDPOINT$1 = "https://dynamicdns.park-your-domain.com/update";
+	namecheapProvider = {
+		id: "namecheap",
+		label: "Namecheap",
+		docsUrl: "https://www.namecheap.com/support/knowledgebase/article.aspx/29/11/how-to-dynamically-update-the-hosts-ip-with-an-https-request/",
+		families: ["A"],
+		ttl: false,
+		proxied: false,
+		fields: [{
+			key: "password",
+			label: "Dynamic DNS password",
+			hint: "Dashboard → Manage domain → Advanced DNS → Dynamic DNS. Not your account password or API key.",
+			optional: false
+		}],
+		validate(credentials) {
+			return missingFields(credentials, ["password"]);
+		},
+		async update(record, context) {
+			const password = (context.credentials.password ?? "").trim();
+			if (password.length === 0) return failed("namecheap needs the Dynamic DNS password");
+			const { zone, name } = splitHost(record.host, record.zone);
+			const host = name === "@" ? "@" : name;
+			const url = `${ENDPOINT$1}?host=${encodeURIComponent(host)}&domain=${encodeURIComponent(zone)}&password=${encodeURIComponent(password)}&ip=${encodeURIComponent(record.ip)}`;
+			try {
+				const body = await (await context.fetch(url, { signal: context.signal })).text();
+				const errCount = Number.parseInt(tag(body, "ErrCount") ?? "0", 10);
+				const ip = tag(body, "IP");
+				if (errCount > 0) {
+					const first = tag(body, "Err1");
+					return failed(`namecheap rejected the update${first === null ? "" : `: ${first}`}`);
+				}
+				if (ip === null) return failed(`namecheap answered without an IP: ${body.replace(/\s+/g, " ").slice(0, 160)}`);
+				return succeeded(`${host === "@" ? zone : `${host}.${zone}`} now ${ip}`, ip !== record.ip);
+			} catch (error) {
+				return failed(error instanceof Error ? error.message : String(error));
+			}
 		}
-		removeServer(id) {
-			const draft = structuredClone(this.raw);
-			const before = draft.servers?.length ?? 0;
-			draft.servers = (draft.servers ?? []).filter((entry) => entry.id !== id);
-			if (draft.servers.length === before) throw new ConfigError(`unknown server "${id}"`);
-			this.commit(draft);
+	};
+}));
+//#endregion
+//#region src/providers/ddns/noip.ts
+var ENDPOINT, DEFAULT_AGENT, noipProvider;
+var init_noip = __esmMin((() => {
+	init_dyndns2();
+	init_types();
+	ENDPOINT = "https://dynupdate.no-ip.com/nic/update";
+	DEFAULT_AGENT = "home-hosted/1.0 (+https://github.com/NamesMT/home-hosted)";
+	noipProvider = {
+		id: "noip",
+		label: "No-IP",
+		docsUrl: "https://www.noip.com/integrate/request",
+		families: ["A", "AAAA"],
+		ttl: false,
+		proxied: false,
+		fields: [
+			{
+				key: "username",
+				label: "Email",
+				hint: "Your No-IP account email.",
+				optional: false
+			},
+			{
+				key: "password",
+				label: "Password",
+				hint: "Your No-IP account password.",
+				optional: false
+			},
+			{
+				key: "userAgent",
+				label: "User-Agent override",
+				hint: "No-IP only guarantees updates for recognised clients; set an approved agent here if yours is registered.",
+				optional: true
+			}
+		],
+		validate(credentials) {
+			return missingFields(credentials, ["username", "password"]);
+		},
+		async update(record, context) {
+			const username = (context.credentials.username ?? "").trim();
+			const password = (context.credentials.password ?? "").trim();
+			if (username.length === 0 || password.length === 0) return failed("no-ip needs the account email and password");
+			const address = record.type === "A" ? `myip=${encodeURIComponent(record.ip)}` : `myipv6=${encodeURIComponent(record.ip)}`;
+			const url = `${ENDPOINT}?hostname=${encodeURIComponent(record.host)}&${address}`;
+			try {
+				const response = await context.fetch(url, {
+					headers: {
+						"Authorization": basicAuth(username, password),
+						"User-Agent": (context.credentials.userAgent ?? "").trim() || DEFAULT_AGENT
+					},
+					signal: context.signal
+				});
+				return describeDyndnsResponse(response, await response.text(), "no-ip");
+			} catch (error) {
+				return failed(error instanceof Error ? error.message : String(error));
+			}
 		}
-		/** Regenerates `servers.config.schema.json` for editor autocomplete. */
-		writeJsonSchema() {
-			const schema = JSON.stringify(configSchema.toJsonSchema(), null, 2);
-			if ((fs.existsSync(configSchemaPath) ? fs.readFileSync(configSchemaPath, "utf8") : null) !== schema) writeFileAtomic(configSchemaPath, schema);
+	};
+}));
+//#endregion
+//#region src/providers/ddns/porkbun.ts
+/** Porkbun's documented floor; `1` (automatic) maps onto it. */
+function porkbunTtl(ttl) {
+	return Math.max(600, ttl);
+}
+async function post(path, context, body) {
+	try {
+		const response = await context.fetch(`${API$1}${path}`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				"X-API-Key": context.credentials.apikey ?? "",
+				"X-Secret-API-Key": context.credentials.secretapikey ?? ""
+			},
+			body: JSON.stringify(body),
+			signal: context.signal
+		});
+		const parsed = JSON.parse(await response.text());
+		if (parsed.status !== "SUCCESS") return {
+			data: parsed,
+			error: parsed.message ?? `HTTP ${response.status}`
+		};
+		return {
+			data: parsed,
+			error: null
+		};
+	} catch (error) {
+		return {
+			data: null,
+			error: error instanceof Error ? error.message : String(error)
+		};
+	}
+}
+var API$1, porkbunProvider;
+var init_porkbun = __esmMin((() => {
+	init_types();
+	init_zone();
+	API$1 = "https://api.porkbun.com/api/json/v3";
+	porkbunProvider = {
+		id: "porkbun",
+		label: "Porkbun",
+		docsUrl: "https://porkbun.com/api/json/v3/documentation",
+		families: ["A", "AAAA"],
+		ttl: true,
+		proxied: false,
+		fields: [{
+			key: "apikey",
+			label: "API key",
+			hint: "porkbun.com/account/api — starts with pk1_.",
+			optional: false
+		}, {
+			key: "secretapikey",
+			label: "Secret API key",
+			hint: "Shown once when the key is created.",
+			optional: false
+		}],
+		validate(credentials) {
+			return missingFields(credentials, ["apikey", "secretapikey"]);
+		},
+		async update(record, context) {
+			const { zone, name: rawName } = splitHost(record.host, record.zone);
+			const name = rawName === "@" ? "" : rawName;
+			const ttl = porkbunTtl(record.ttl);
+			const existing = (await post(`/dns/retrieveByNameType/${encodeURIComponent(zone)}/${record.type}/${encodeURIComponent(name)}`, context, {})).data?.records?.[0];
+			if (existing !== void 0 && existing.content === record.ip && Number.parseInt(existing.ttl, 10) === ttl) return succeeded(`already ${record.ip}`, false);
+			const written = await post(`/dns/editByNameType/${encodeURIComponent(zone)}/${record.type}/${encodeURIComponent(name)}`, context, {
+				content: record.ip,
+				ttl
+			});
+			if (written.error !== null) return failed(written.error);
+			const warnings = written.data?.warnings ?? [];
+			const note = warnings.length > 0 ? ` — porkbun warns: ${warnings.join("; ")}` : "";
+			return succeeded(`set ${record.host} ${record.type} to ${record.ip}${note}`, true);
 		}
-		validateServer(entry, label) {
-			const parsed = serverSchema(mergeDefaults(this.defaults, entry));
-			if (parsed instanceof type.errors) throw new ConfigError(`${label}: ${formatErrors(parsed)}`);
-			return {
-				...parsed,
-				port: parsed.port ?? null
+	};
+}));
+//#endregion
+//#region src/providers/ddns/spaceship.ts
+function spaceshipTtl(ttl) {
+	return Math.min(3600, Math.max(60, ttl));
+}
+var API, PAGE_SIZE, spaceshipProvider;
+var init_spaceship = __esmMin((() => {
+	init_types();
+	init_zone();
+	API = "https://spaceship.dev/api/v1/dns/records";
+	PAGE_SIZE = 500;
+	spaceshipProvider = {
+		id: "spaceship",
+		label: "Spaceship",
+		docsUrl: "https://docs.spaceship.dev/",
+		families: ["A", "AAAA"],
+		ttl: true,
+		proxied: false,
+		fields: [{
+			key: "apiKey",
+			label: "API key",
+			hint: "spaceship.com → API Manager; needs the `dnsrecords:read`/`write` scopes.",
+			optional: false
+		}, {
+			key: "apiSecret",
+			label: "API secret",
+			hint: "Shown once with the key.",
+			optional: false
+		}],
+		validate(credentials) {
+			return missingFields(credentials, ["apiKey", "apiSecret"]);
+		},
+		async update(record, context) {
+			const { zone, name } = splitHost(record.host, record.zone);
+			const headers = {
+				"X-API-Key": (context.credentials.apiKey ?? "").trim(),
+				"X-API-Secret": (context.credentials.apiSecret ?? "").trim(),
+				"Content-Type": "application/json"
 			};
+			try {
+				let found;
+				for (let skip = 0; skip < PAGE_SIZE * 5; skip += PAGE_SIZE) {
+					const listed = await context.fetch(`${API}/${encodeURIComponent(zone)}?take=${PAGE_SIZE}&skip=${skip}`, {
+						headers,
+						signal: context.signal
+					});
+					if (!listed.ok) return failed(await errorText(listed));
+					const body = await listed.json();
+					const items = Array.isArray(body) ? body : body.items ?? [];
+					found = items.find((entry) => entry.name === name && entry.type === record.type);
+					if (found !== void 0 || items.length < PAGE_SIZE) break;
+				}
+				if (found?.address === record.ip) return succeeded(`already ${record.ip}`, false);
+				const written = await context.fetch(`${API}/${encodeURIComponent(zone)}`, {
+					method: "PUT",
+					headers,
+					body: JSON.stringify({
+						force: true,
+						items: [{
+							type: record.type,
+							name,
+							ttl: spaceshipTtl(record.ttl),
+							address: record.ip
+						}]
+					}),
+					signal: context.signal
+				});
+				if (!written.ok) return failed(await errorText(written));
+				return succeeded(`set ${record.host} ${record.type} to ${record.ip}`, true);
+			} catch (error) {
+				return failed(error instanceof Error ? error.message : String(error));
+			}
+		}
+	};
+}));
+//#endregion
+//#region src/providers/ddns/index.ts
+function ddnsProvider(id) {
+	return BY_ID.get(id) ?? null;
+}
+function ddnsProviderInfos() {
+	return DDNS_PROVIDERS.map((provider) => ({
+		id: provider.id,
+		label: provider.label,
+		docsUrl: provider.docsUrl,
+		families: provider.families,
+		fields: provider.fields,
+		ttl: provider.ttl,
+		proxied: provider.proxied
+	}));
+}
+/**
+* Cross-field problems ArkType cannot see. Credentials are deliberately not
+* required here: an account is normally added before its secret is typed in,
+* and a missing secret is reported per record instead of blocking the save.
+*/
+function validateDdnsConfig(config) {
+	const errors = [];
+	const seenAccounts = /* @__PURE__ */ new Set();
+	for (const account of config.accounts) {
+		if (seenAccounts.has(account.id)) {
+			errors.push(`account "${account.id}" is declared twice`);
+			continue;
+		}
+		seenAccounts.add(account.id);
+		if (ddnsProvider(account.provider) === null) errors.push(`account "${account.id}" uses an unknown provider "${account.provider}"`);
+	}
+	const seenRecords = /* @__PURE__ */ new Set();
+	for (const domain of config.domains) {
+		const account = config.accounts.find((entry) => entry.id === domain.account);
+		if (account === void 0) {
+			errors.push(`"${domain.host}" points at unknown account "${domain.account}"`);
+			continue;
+		}
+		const provider = ddnsProvider(account.provider);
+		if (provider !== null) for (const recordType of domain.types) {
+			if (!provider.families.includes(recordType)) errors.push(`${account.label || provider.label} cannot manage ${recordType} records ("${domain.host}")`);
+			const key = `${domain.host.toLowerCase()}|${recordType}`;
+			if (seenRecords.has(key)) errors.push(`"${domain.host}" asks for ${recordType} twice`);
+			seenRecords.add(key);
+		}
+	}
+	return errors;
+}
+var DDNS_PROVIDERS, BY_ID;
+var init_ddns$2 = __esmMin((() => {
+	init_cloudflare();
+	init_desec();
+	init_digitalocean();
+	init_duckdns();
+	init_dynu();
+	init_freedns();
+	init_gandi();
+	init_godaddy();
+	init_henet();
+	init_namecheap();
+	init_noip();
+	init_porkbun();
+	init_spaceship();
+	DDNS_PROVIDERS = [
+		cloudflareProvider,
+		namecheapProvider,
+		spaceshipProvider,
+		porkbunProvider,
+		godaddyProvider,
+		gandiProvider,
+		digitaloceanProvider,
+		desecProvider,
+		duckdnsProvider,
+		noipProvider,
+		dynuProvider,
+		henetProvider,
+		freednsProvider
+	];
+	BY_ID = new Map(DDNS_PROVIDERS.map((provider) => [provider.id, provider]));
+}));
+//#endregion
+//#region src/config/store.ts
+function formatErrors(errors) {
+	return errors.summary;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function applyPatch(target, patch, mergeKeys) {
+	for (const [key, value] of Object.entries(patch)) {
+		if (value === void 0) continue;
+		if (mergeKeys.has(key) && isRecord(value) && isRecord(target[key])) {
+			target[key] = mergeGroup(target[key], value);
+			continue;
+		}
+		target[key] = value;
+	}
+}
+/**
+* Merges one nested group recursively — `health.http` is a group of its own, and
+* replacing it wholesale would silently reset the siblings a partial patch never
+* mentioned. An explicit `null` removes a key, which is how a schema-optional
+* field is cleared.
+*/
+function mergeGroup(target, patch) {
+	const merged = { ...target };
+	for (const [key, value] of Object.entries(patch)) {
+		if (value === void 0) continue;
+		if (value === null) {
+			delete merged[key];
+			continue;
+		}
+		if (isRecord(value) && isRecord(merged[key])) {
+			merged[key] = mergeGroup(merged[key], value);
+			continue;
+		}
+		merged[key] = value;
+	}
+	return merged;
+}
+var SERVER_MERGE_KEYS, CONTROL_MERGE_KEYS, NOTIFICATION_MERGE_KEYS, DDNS_MERGE_KEYS, EMPTY_MERGE_KEYS, ConfigError, ConfigStore;
+var init_store = __esmMin((() => {
+	init_migrations();
+	init_parse();
+	init_schema();
+	init_seed();
+	init_atomic();
+	init_paths();
+	init_ddns$2();
+	SERVER_MERGE_KEYS = /* @__PURE__ */ new Set([
+		"restart",
+		"health",
+		"stop"
+	]);
+	CONTROL_MERGE_KEYS = /* @__PURE__ */ new Set(["auth", "tls"]);
+	NOTIFICATION_MERGE_KEYS = /* @__PURE__ */ new Set(["telegram"]);
+	DDNS_MERGE_KEYS = /* @__PURE__ */ new Set(["ipv4", "ipv6"]);
+	EMPTY_MERGE_KEYS = /* @__PURE__ */ new Set();
+	ConfigError = class extends Error {
+		name = "ConfigError";
+	};
+	ConfigStore = class {
+		file;
+		seed;
+		raw = {};
+		/** The bytes behind the live config, so a watcher can tell a real edit from our own write. */
+		lastText = null;
+		resolvedConfig;
+		error = null;
+		warnings = [];
+		schemaVersion = 1;
+		listeners = /* @__PURE__ */ new Set();
+		constructor(file, seed = SEED_CONFIG) {
+			this.file = file;
+			this.seed = seed;
+		}
+		get path() {
+			return this.file;
+		}
+		get config() {
+			return this.resolvedConfig;
+		}
+		get configError() {
+			return this.error;
+		}
+		/** Keys a newer release wrote that this one ignores; nothing to refuse over. */
+		get configWarnings() {
+			return [...this.warnings];
+		}
+		/** The shape the file declares, as last read. */
+		get configSchemaVersion() {
+			return this.schemaVersion;
+		}
+		/** Steps that would have to run before this release could use the file. */
+		get pendingMigrations() {
+			return planConfigMigrations(this.schemaVersion).steps;
+		}
+		get servers() {
+			return this.resolvedConfig.servers;
+		}
+		get defaults() {
+			return this.resolvedConfig.defaults;
+		}
+		get rawConfig() {
+			return structuredClone(this.raw);
+		}
+		onChange(listener) {
+			this.listeners.add(listener);
+			return () => this.listeners.delete(listener);
+		}
+		getServer(id) {
+			return this.servers.find((server) => server.id === id);
+		}
+		/**
+		* Reads the file and tells the listeners, so whatever wrote it — the settings
+		* page, a restored backup, or the file watcher — becomes the live config.
+		*/
+		load() {
+			this.read();
+			this.notify();
+		}
+		/**
+		* The watcher's entry point: re-reads the file only when its bytes changed.
+		*
+		* `changed` means the file on disk is different from what the live config was
+		* read from, `applied` means that difference was accepted — a file this release
+		* cannot read is reported and the config already running is left alone, which is
+		* what keeps an editor's typo from stopping every server.
+		*/
+		reloadFromDisk() {
+			let text;
+			try {
+				text = fs.readFileSync(this.file, "utf8");
+			} catch {
+				this.error = `${path.basename(this.file)} is gone`;
+				return {
+					changed: false,
+					applied: false,
+					error: this.error
+				};
+			}
+			if (text === this.lastText) {
+				if (this.error !== null) {
+					this.error = null;
+					this.load();
+				}
+				return {
+					changed: false,
+					applied: false,
+					error: null
+				};
+			}
+			const before = this.resolvedConfig;
+			this.load();
+			return {
+				changed: true,
+				applied: this.resolvedConfig !== before,
+				error: this.error
+			};
+		}
+		read() {
+			if (!fs.existsSync(this.file)) {
+				const seed = stampConfig(structuredClone(this.seed));
+				const text = `${JSON.stringify(seed, null, 2)}\n`;
+				writeFileAtomic(this.file, text);
+				this.lastText = text;
+				this.raw = seed;
+				this.apply(seed);
+				return;
+			}
+			let text;
+			let parsed;
+			try {
+				text = fs.readFileSync(this.file, "utf8");
+				parsed = JSON.parse(text);
+			} catch (error) {
+				this.error = `cannot parse ${path.basename(this.file)}: ${error.message}`;
+				if (this.resolvedConfig === void 0) {
+					this.raw = {};
+					this.resolvedConfig = this.resolveFallback();
+				}
+				return;
+			}
+			this.lastText = text;
+			this.apply(parsed);
+		}
+		notify() {
+			for (const listener of this.listeners) listener();
+		}
+		updateServer(id, patch) {
+			const index = this.raw.servers?.findIndex((entry) => entry.id === id) ?? -1;
+			if (index < 0) throw new ConfigError(`unknown server "${id}"`);
+			const draft = structuredClone(this.raw);
+			const entry = draft.servers[index];
+			applyPatch(entry, patch, SERVER_MERGE_KEYS);
+			const validated = this.validateServer(entry, `servers[${index}]`);
+			this.commit(draft);
+			return validated;
+		}
+		updateControl(patch) {
+			const draft = structuredClone(this.raw);
+			draft.control = { ...draft.control ?? {} };
+			applyPatch(draft.control, patch, CONTROL_MERGE_KEYS);
+			const control = this.parseGroup(controlSchema, draft.control, "control");
+			this.commit(draft);
+			return control;
+		}
+		updateLogs(patch) {
+			const draft = structuredClone(this.raw);
+			draft.logs = { ...draft.logs ?? {} };
+			applyPatch(draft.logs, patch, EMPTY_MERGE_KEYS);
+			const logs = this.parseGroup(logsSchema, draft.logs, "logs");
+			this.commit(draft);
+			return logs;
+		}
+		updateNotifications(patch) {
+			const draft = structuredClone(this.raw);
+			draft.notifications = { ...draft.notifications ?? {} };
+			applyPatch(draft.notifications, patch, NOTIFICATION_MERGE_KEYS);
+			const notifications = this.parseGroup(notificationsSchema, draft.notifications, "notifications");
+			this.commit(draft);
+			return notifications;
+		}
+		updateHost(patch) {
+			const draft = structuredClone(this.raw);
+			draft.host = { ...draft.host ?? {} };
+			applyPatch(draft.host, patch, EMPTY_MERGE_KEYS);
+			const host = this.parseGroup(hostSchema, draft.host, "host");
+			this.commit(draft);
+			return host;
+		}
+		updateBackups(patch) {
+			const draft = structuredClone(this.raw);
+			draft.backups = { ...draft.backups ?? {} };
+			applyPatch(draft.backups, patch, EMPTY_MERGE_KEYS);
+			const backups = this.parseGroup(backupsSchema, draft.backups, "backups");
+			this.commit(draft);
+			return backups;
+		}
+		/**
+		* The DDNS block merges its two nested groups and **replaces** `accounts` and
+		* `domains`: those are lists, and a key-by-key merge cannot express removing a
+		* hostname. A whole-block patch (the `PUT /api/ddns` route) lands the same way.
+		*/
+		updateDdns(patch) {
+			const draft = structuredClone(this.raw);
+			draft.ddns = { ...draft.ddns ?? {} };
+			applyPatch(draft.ddns, patch, DDNS_MERGE_KEYS);
+			const parsed = this.parseGroup(ddnsConfigSchema, draft.ddns, "ddns");
+			const problems = validateDdnsConfig(parsed);
+			if (problems.length > 0) throw new ConfigError(`ddns: ${problems.join("; ")}`);
+			this.commit(draft);
+			return parsed;
+		}
+		updateDefaults(patch) {
+			const draft = structuredClone(this.raw);
+			draft.defaults = { ...draft.defaults ?? {} };
+			applyPatch(draft.defaults, patch, SERVER_MERGE_KEYS);
+			const defaults = this.parseGroup(defaultsSchema, draft.defaults, "defaults");
+			this.commit(draft);
+			return defaults;
+		}
+		addServer(input) {
+			const draft = structuredClone(this.raw);
+			draft.servers ??= [];
+			if (draft.servers.some((entry) => entry.id === input.id)) throw new ConfigError(`server "${String(input.id)}" already exists`);
+			const index = draft.servers.length;
+			draft.servers.push(structuredClone(input));
+			const validated = this.validateServer(draft.servers[index], `servers[${index}]`);
+			this.commit(draft);
+			return validated;
+		}
+		removeServer(id) {
+			const draft = structuredClone(this.raw);
+			const before = draft.servers?.length ?? 0;
+			draft.servers = (draft.servers ?? []).filter((entry) => entry.id !== id);
+			if (draft.servers.length === before) throw new ConfigError(`unknown server "${id}"`);
+			this.commit(draft);
+		}
+		/** Regenerates `servers.config.schema.json` for editor autocomplete. */
+		writeJsonSchema() {
+			const schema = JSON.stringify(configSchema.toJsonSchema(), null, 2);
+			if ((fs.existsSync(configSchemaPath) ? fs.readFileSync(configSchemaPath, "utf8") : null) !== schema) writeFileAtomic(configSchemaPath, schema);
+		}
+		/**
+		* Validates one group the way the reader does: a key this release does not know
+		* is reported and skipped, never fatal. Without this, a config carrying a key a
+		* newer release added — or an older one removed — could not be saved at all.
+		*/
+		parseGroup(schema, value, label) {
+			const parsed = parseTolerant(value, schema, label, []);
+			if (parsed.error !== null) throw new ConfigError(`${label}: ${parsed.error}`);
+			return parsed.value;
+		}
+		validateServer(entry, label) {
+			const parsed = serverSchema(mergeDefaults(this.defaults, entry));
+			if (parsed instanceof type.errors) throw new ConfigError(`${label}: ${formatErrors(parsed)}`);
+			return {
+				...parsed,
+				port: parsed.port ?? null
+			};
+		}
+		commit(draft) {
+			const stamped = stampConfig(draft);
+			const text = `${JSON.stringify(stamped, null, 2)}\n`;
+			writeFileAtomic(this.file, text);
+			this.lastText = text;
+			this.raw = stamped;
+			this.apply(stamped);
+			this.notify();
+		}
+		resolveFallback() {
+			const control = controlSchema({});
+			const defaults = defaultsSchema({});
+			if (control instanceof type.errors || defaults instanceof type.errors) throw new ConfigError("internal: default config failed validation");
+			const logs = logsSchema({});
+			const notifications = notificationsSchema({});
+			const host = hostSchema({});
+			const backups = backupsSchema({});
+			const ddns = ddnsConfigSchema({});
+			if (logs instanceof type.errors || notifications instanceof type.errors || host instanceof type.errors || backups instanceof type.errors || ddns instanceof type.errors) throw new ConfigError("internal: default settings failed validation");
+			return {
+				control,
+				defaults,
+				logs,
+				notifications,
+				host,
+				backups,
+				ddns,
+				servers: []
+			};
+		}
+		apply(raw) {
+			this.raw = raw;
+			const parsed = parseConfig(raw);
+			this.error = parsed.errors.length > 0 ? parsed.errors.join("; ") : null;
+			this.schemaVersion = parsed.schemaVersion;
+			this.warnings = [...parsed.warnings, ...parsed.unknownKeys.length === 0 ? [] : [`${path.basename(this.file)} carries ${parsed.unknownKeys.length} unrecognized key(s) this release ignores: ${parsed.unknownKeys.join(", ")}`]];
+			if (parsed.config !== null) this.resolvedConfig = parsed.config;
+			else if (this.resolvedConfig === void 0) this.resolvedConfig = this.resolveFallback();
+		}
+	};
+}));
+//#endregion
+//#region src/api/ddns.ts
+/**
+* Dynamic DNS is configured as one whole block, not as settings patches: its
+* accounts and hostnames are lists, and a key-by-key merge would leave a removed
+* account or hostname behind. Provider credentials never come back over the API —
+* the view only says which accounts have them.
+*/
+function createDdnsRoute(deps) {
+	const view = () => {
+		const config = deps.store.config.ddns;
+		return {
+			config,
+			status: deps.ddns.view,
+			providers: ddnsProviderInfos(),
+			credentials: deps.secrets.ddnsAccountIds.filter((id) => {
+				const account = config.accounts.find((entry) => entry.id === id);
+				return account === void 0 || deps.secrets.getDdnsCredentials(id, account.provider) !== null;
+			})
+		};
+	};
+	return appFactory.createApp().get("/ddns", describeRoute({
+		tags: ["ddns"],
+		summary: "Dynamic DNS policy, live state and the providers this build knows",
+		responses: { 200: {
+			description: "The DDNS view",
+			content: jsonBody(ddnsViewSchema)
+		} }
+	}), (c) => c.json(view())).put("/ddns", describeRoute({
+		tags: ["ddns"],
+		summary: "Replace the dynamic DNS block",
+		responses: {
+			200: {
+				description: "Saved",
+				content: jsonBody(ddnsViewSchema)
+			},
+			400: ERROR_RESPONSES[400]
+		}
+	}), validate("json", ddnsConfigSchema), (c) => {
+		const config = c.req.valid("json");
+		const problems = validateDdnsConfig(config);
+		if (problems.length > 0) throw new DetailedError(`invalid DDNS configuration: ${problems.join("; ")}`, {
+			statusCode: 400,
+			code: "INVALID_DDNS",
+			detail: problems
+		});
+		try {
+			deps.store.updateDdns(config);
+		} catch (error) {
+			if (error instanceof ConfigError) throw new DetailedError(error.message, {
+				statusCode: 400,
+				code: "INVALID_DDNS"
+			});
+			throw error;
+		}
+		const pruned = deps.secrets.pruneDdnsCredentials(config.accounts.map((account) => account.id));
+		if (pruned > 0) logger.info(`ddns: dropped stored credentials for ${pruned} account(s) the config no longer declares`);
+		deps.ddns.refresh();
+		return c.json(view());
+	}).put("/ddns/credentials/:id", describeRoute({
+		tags: ["ddns"],
+		summary: "Store the credentials of one DDNS account",
+		responses: {
+			200: {
+				description: "Stored",
+				content: jsonBody(ddnsViewSchema)
+			},
+			400: ERROR_RESPONSES[400]
+		}
+	}), validate("param", accountParam), validate("json", ddnsCredentialsSchema), (c) => {
+		const { id } = c.req.valid("param");
+		const { provider: providerId, credentials } = c.req.valid("json");
+		const provider = ddnsProvider(providerId);
+		if (provider === null) throw new DetailedError(`unknown DDNS provider "${providerId}"`, {
+			statusCode: 400,
+			code: "UNKNOWN_DDNS_PROVIDER"
+		});
+		const problem = provider.validate(credentials);
+		if (problem !== null) throw new DetailedError(`${provider.label}: ${problem}`, {
+			statusCode: 400,
+			code: "INVALID_DDNS_CREDENTIALS"
+		});
+		deps.secrets.setDdnsCredentials(id, providerId, credentials);
+		deps.ddns.refresh();
+		return c.json(view());
+	}).delete("/ddns/credentials/:id", describeRoute({
+		tags: ["ddns"],
+		summary: "Forget the credentials of one DDNS account",
+		responses: { 200: {
+			description: "Removed",
+			content: jsonBody(ddnsViewSchema)
+		} }
+	}), validate("param", accountParam), (c) => {
+		deps.secrets.clearDdnsCredentials(c.req.valid("param").id);
+		deps.ddns.refresh();
+		return c.json(view());
+	}).post("/ddns/check", describeRoute({
+		tags: ["ddns"],
+		summary: "Run a dynamic DNS pass now",
+		responses: { 200: {
+			description: "The pass, with its result",
+			content: jsonBody(ddnsViewSchema)
+		} }
+	}), async (c) => {
+		await deps.ddns.run({ force: true });
+		return c.json(view());
+	});
+}
+var accountParam;
+var init_ddns$1 = __esmMin((() => {
+	init_store();
+	init_factory();
+	init_logger();
+	init_openapi$1();
+	init_validator();
+	init_ddns$2();
+	init_contracts();
+	accountParam = type({ id: "/^[a-z0-9][a-z0-9_-]*$/" });
+}));
+//#endregion
+//#region src/api/events.ts
+/**
+* One SSE stream per subscriber. Pass `?serverId=<id>` to receive only that
+* server's messages; the first frame always carries the full state snapshot.
+*/
+function createEventsRoute(deps) {
+	return appFactory.createApp().get("/events", describeRoute({
+		tags: ["panel"],
+		summary: "Panel state and log frames as server-sent events",
+		responses: { 200: { description: "text/event-stream" } }
+	}), validate("query", eventsQuery), (c) => {
+		const query = c.req.valid("query");
+		const serverId = query.serverId ?? null;
+		const logOnly = query.logs !== "0";
+		return streamSSE(c, async (stream) => {
+			let pending = 0;
+			let queue = Promise.resolve();
+			let closed = false;
+			const send = (message) => {
+				if (closed) return queue;
+				if (message.type === "log" && pending > MAX_PENDING_WRITES$1) return queue;
+				pending += 1;
+				queue = queue.then(() => stream.writeSSE({
+					event: message.type,
+					data: JSON.stringify(message)
+				})).catch(() => {
+					closed = true;
+				}).finally(() => {
+					pending -= 1;
+				});
+				return queue;
+			};
+			const unsubscribe = deps.hub.subscribe(serverId, (message) => {
+				if (!logOnly && message.type === "log") return;
+				send(message);
+			});
+			stream.onAbort(() => {
+				closed = true;
+				unsubscribe();
+			});
+			await send({
+				type: "hello",
+				ts: Date.now(),
+				state: deps.supervisor.getState()
+			});
+			while (true) {
+				await stream.sleep(PING_INTERVAL_MS);
+				if (closed) break;
+				await stream.writeSSE({
+					event: "ping",
+					data: String(Date.now())
+				});
+			}
+		});
+	});
+}
+var MAX_PENDING_WRITES$1, PING_INTERVAL_MS, eventsQuery;
+var init_events$1 = __esmMin((() => {
+	init_factory();
+	init_validator();
+	MAX_PENDING_WRITES$1 = 200;
+	PING_INTERVAL_MS = 15e3;
+	eventsQuery = type({
+		/** Only this server's frames. */
+		"serverId?": "string",
+		/** `logs=0` drops log frames; the first frame is always the full state. */
+		"logs?": "string"
+	});
+}));
+//#endregion
+//#region src/api/health.ts
+/**
+* Liveness for external monitors. Mounted outside `/api`, so it answers without a
+* session: it reports whether the panel itself is serving, and 503 when an
+* autostart server has crashed. Server details are only included for an
+* authenticated caller.
+*/
+function createHealthRoute(deps) {
+	return appFactory.createApp().get("/healthz", describeRoute({
+		tags: ["panel"],
+		summary: "Liveness for monitors — no session required",
+		responses: {
+			200: {
+				description: "Serving",
+				content: jsonBody(type({
+					"status": "\"ok\" | \"degraded\"",
+					"uptimeMs": "number",
+					"servers?": type({
+						total: "number",
+						running: "number",
+						crashed: "number",
+						unhealthy: "number"
+					}),
+					"hostAlerts?": "string[]"
+				}))
+			},
+			503: { description: "An autostart server has crashed" }
+		}
+	}), (c) => {
+		const state = deps.supervisor.getState();
+		const broken = state.servers.filter((server) => server.config.autostart && server.status === "crashed");
+		const authenticated = requestIdentity(c, deps.auth).authenticated;
+		return c.json({
+			status: broken.length > 0 ? "degraded" : "ok",
+			uptimeMs: Math.round(process.uptime() * 1e3),
+			...authenticated ? {
+				servers: {
+					total: state.servers.length,
+					running: state.servers.filter((server) => server.status === "running").length,
+					crashed: state.servers.filter((server) => server.status === "crashed").length,
+					unhealthy: state.servers.filter((server) => server.health === "unhealthy").length
+				},
+				hostAlerts: state.host.alerts
+			} : {}
+		}, broken.length > 0 ? 503 : 200);
+	});
+}
+var init_health = __esmMin((() => {
+	init_factory();
+	init_openapi$1();
+	init_auth();
+}));
+//#endregion
+//#region src/api/logs.ts
+function unknownServer$1(id) {
+	return new DetailedError(`unknown server "${id}"`, {
+		statusCode: 404,
+		code: "UNKNOWN_SERVER"
+	});
+}
+function createLogsRoute(deps) {
+	return appFactory.createApp().get("/logs", describeRoute({
+		tags: ["logs"],
+		summary: "Every server with its on-disk log files",
+		responses: { 200: {
+			description: "Log sources",
+			content: jsonBody(logServersViewSchema)
+		} }
+	}), (c) => c.json({ servers: deps.supervisor.views().map((server) => ({
+		serverId: server.id,
+		label: server.config.label ?? server.id,
+		status: server.status,
+		...deps.logFiles.info(server.id)
+	})) })).get("/logs/:id", describeRoute({
+		tags: ["logs"],
+		summary: "Persisted log lines, with search and a stream filter",
+		responses: {
+			200: { description: "Lines" },
+			404: ERROR_RESPONSES[404]
+		}
+	}), validate("param", idParam$1), validate("query", logHistoryQuerySchema), (c) => {
+		const { id } = c.req.valid("param");
+		if (!deps.store.getServer(id)) throw unknownServer$1(id);
+		const query = c.req.valid("query");
+		const requested = query.tail === void 0 ? DEFAULT_TAIL : Number.parseInt(query.tail, 10);
+		const tail = Number.isNaN(requested) ? DEFAULT_TAIL : Math.min(Math.max(requested, MIN_TAIL), MAX_TAIL);
+		const info = deps.logFiles.info(id);
+		const search = query.search?.trim() ?? "";
+		const window = search.length > 0 ? Math.max(tail, MAX_TAIL) : tail;
+		let lines = deps.logFiles.readTail(id, window);
+		if (query.stream !== void 0 && query.stream.length > 0) lines = lines.filter((line) => line.stream === query.stream);
+		if (search.length > 0) {
+			const needle = search.toLowerCase();
+			lines = lines.filter((line) => line.text.toLowerCase().includes(needle));
+		}
+		return c.json({
+			serverId: id,
+			enabled: info.enabled,
+			sizeBytes: info.sizeBytes,
+			files: info.files.map((file) => file.name),
+			searched: search.length > 0 ? window : null,
+			lines: lines.slice(-tail)
+		});
+	}).get("/logs/:id/download", describeRoute({
+		tags: ["logs"],
+		summary: "Download one rotated log file",
+		responses: {
+			200: { description: "application/x-ndjson" },
+			404: ERROR_RESPONSES[404]
+		}
+	}), validate("param", idParam$1), validate("query", downloadQuery), (c) => {
+		const { id } = c.req.valid("param");
+		if (!deps.store.getServer(id)) throw unknownServer$1(id);
+		const requested = c.req.valid("query").file ?? `${id}.log`;
+		if (!deps.logFiles.info(id).files.map((file) => file.name).includes(requested)) throw new DetailedError("unknown log file", {
+			statusCode: 404,
+			code: "UNKNOWN_LOG_FILE"
+		});
+		const file = path.join(deps.logFiles.directory, requested);
+		const body = fs.readFileSync(file);
+		return c.body(body, 200, {
+			"Content-Type": "application/x-ndjson; charset=utf-8",
+			"Content-Length": String(body.byteLength),
+			"Content-Disposition": `attachment; filename="${requested}"`
+		});
+	}).delete("/logs/:id", describeRoute({
+		tags: ["logs"],
+		summary: "Delete the persisted logs of one server",
+		responses: {
+			200: { description: "Cleared" },
+			404: ERROR_RESPONSES[404]
+		}
+	}), validate("param", idParam$1), (c) => {
+		const { id } = c.req.valid("param");
+		if (!deps.store.getServer(id)) throw unknownServer$1(id);
+		deps.logFiles.clear(id);
+		return c.json({ ok: true });
+	});
+}
+var MIN_TAIL, MAX_TAIL, DEFAULT_TAIL, idParam$1, downloadQuery;
+var init_logs = __esmMin((() => {
+	init_factory();
+	init_openapi$1();
+	init_validator();
+	init_contracts();
+	MIN_TAIL = 50;
+	MAX_TAIL = 5e3;
+	DEFAULT_TAIL = 500;
+	idParam$1 = type({ id: "string >= 1" });
+	downloadQuery = type({ "file?": "string" });
+}));
+//#endregion
+//#region src/api/metrics.ts
+/**
+* Prometheus text for whatever wants to scrape the panel (Beszel, Grafana,
+* `curl`). Lives under `/api`, so it needs a session like every other route.
+*/
+function createMetricsRoute(deps) {
+	return appFactory.createApp().get("/metrics", describeRoute({
+		tags: ["panel"],
+		summary: "Prometheus text for whatever scrapes the panel",
+		responses: { 200: { description: "text/plain; version=0.0.4" } }
+	}), (c) => {
+		const state = deps.supervisor.getState();
+		const lines = [];
+		const metric = (name, help, samples) => {
+			if (samples.length === 0) return;
+			lines.push(`# HELP ${name} ${help}`, `# TYPE ${name} gauge`, ...samples);
+		};
+		metric("hh_control_up", "Control plane is serving", ["hh_control_up 1"]);
+		metric("hh_servers_total", "Configured servers", [`hh_servers_total ${state.servers.length}`]);
+		metric("hh_server_up", "Server process is running", state.servers.map((server) => `hh_server_up{server="${server.id}"} ${server.status === "running" ? 1 : 0}`));
+		metric("hh_server_restarts_total", "Restarts since the control plane started", state.servers.map((server) => `hh_server_restarts_total{server="${server.id}"} ${server.restarts}`));
+		metric("hh_server_crashes_24h", "Crashes in the last 24 hours", state.servers.map((server) => `hh_server_crashes_24h{server="${server.id}"} ${server.history.crashes}`));
+		metric("hh_server_uptime_ratio_24h", "Share of the last 24 hours the server was up", state.servers.filter((server) => server.history.uptimeRatio !== null).map((server) => `hh_server_uptime_ratio_24h{server="${server.id}"} ${server.history.uptimeRatio.toFixed(4)}`));
+		metric("hh_server_response_ms", "Last health probe latency in milliseconds", state.servers.filter((server) => server.responseMs !== null).map((server) => `hh_server_response_ms{server="${server.id}"} ${server.responseMs}`));
+		metric("hh_server_rss_bytes", "RSS of the server process tree", state.servers.filter((server) => server.resources?.rssBytes != null).map((server) => `hh_server_rss_bytes{server="${server.id}"} ${server.resources.rssBytes}`));
+		metric("hh_server_cpu_percent", "CPU percent of the server process tree", state.servers.filter((server) => server.resources?.cpuPercent != null).map((server) => `hh_server_cpu_percent{server="${server.id}"} ${server.resources.cpuPercent}`));
+		metric("hh_host_disk_used_percent", "Disk usage percent per configured path", state.host.disks.map((disk) => `hh_host_disk_used_percent{mount="${disk.path}"} ${disk.usedPercent.toFixed(2)}`));
+		metric("hh_host_memory_used_percent", "Memory usage percent", [`hh_host_memory_used_percent ${state.host.memoryUsedPercent.toFixed(2)}`]);
+		metric("hh_host_swap_used_percent", "Swap usage percent", [`hh_host_swap_used_percent ${state.host.swapUsedPercent.toFixed(2)}`]);
+		metric("hh_host_load1_per_cpu", "1 minute load average per cpu", [`hh_host_load1_per_cpu ${((state.host.loadAvg[0] ?? 0) / Math.max(1, state.host.cpus)).toFixed(3)}`]);
+		return c.text(`${lines.join("\n")}\n`, 200, { "Content-Type": "text/plain; version=0.0.4; charset=utf-8" });
+	});
+}
+var init_metrics = __esmMin((() => {
+	init_factory();
+}));
+//#endregion
+//#region src/providers/telegram.ts
+function getBot(token) {
+	const cached = bots.get(token);
+	if (cached) return cached;
+	const bot = new Bot(token, { client: { timeoutSeconds: 10 } });
+	bot.api.config.use(autoRetry({
+		maxRetryAttempts: 3,
+		maxDelaySeconds: 20
+	}));
+	bots.set(token, bot);
+	return bot;
+}
+/** Drops cached clients; used when the token changes or the service shuts down. */
+function forgetBots() {
+	bots.clear();
+}
+function escapeHtml(value) {
+	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function formatTelegramMessage(title, lines) {
+	const body = lines.filter((line) => line.length > 0).map((line) => `• ${escapeHtml(line)}`).join("\n");
+	return `<b>${escapeHtml(title)}</b>${body.length > 0 ? `\n${body}` : ""}`;
+}
+/** Turns a grammY error into something worth showing in the settings page. */
+function describeTelegramError(error) {
+	if (typeof error === "object" && error !== null) {
+		const candidate = error;
+		const description = candidate.description ?? candidate.message;
+		if (description) return `${description}${candidate.error_code === void 0 ? "" : ` (${candidate.error_code})`}${candidate.parameters?.retry_after === void 0 ? "" : `, retry in ${candidate.parameters.retry_after}s`}`;
+	}
+	return error instanceof Error ? error.message : String(error);
+}
+async function sendTelegramMessage(token, chatId, html) {
+	try {
+		await getBot(token).api.sendMessage(chatId, html, {
+			parse_mode: "HTML",
+			link_preview_options: { is_disabled: true }
+		});
+		return { ok: true };
+	} catch (error) {
+		return {
+			ok: false,
+			error: describeTelegramError(error)
+		};
+	}
+}
+async function verifyTelegramToken(token) {
+	try {
+		return {
+			ok: true,
+			username: (await getBot(token).api.getMe()).username
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			error: describeTelegramError(error)
+		};
+	}
+}
+/**
+* Recent chats that talked to the bot, so a chat id can be picked instead of
+* hunted down by hand. Telegram only reports chats with pending updates, so the
+* caller is told to message the bot first.
+*/
+async function listTelegramChats(token) {
+	try {
+		const updates = await getBot(token).api.getUpdates({
+			limit: 100,
+			allowed_updates: [
+				"message",
+				"channel_post",
+				"edited_message"
+			]
+		});
+		const chats = /* @__PURE__ */ new Map();
+		for (const update of updates) {
+			const chat = update.message?.chat ?? update.channel_post?.chat ?? update.edited_message?.chat;
+			if (!chat) continue;
+			const title = "title" in chat && chat.title ? chat.title : "username" in chat && chat.username ? `@${chat.username}` : "first_name" in chat && chat.first_name ? chat.first_name : "private chat";
+			chats.set(String(chat.id), {
+				id: chat.id,
+				title
+			});
 		}
-		commit(draft) {
-			const stamped = stampConfig(draft);
-			const text = `${JSON.stringify(stamped, null, 2)}\n`;
-			writeFileAtomic(this.file, text);
-			this.lastText = text;
-			this.raw = stamped;
-			this.apply(stamped);
-			this.notify();
+		return {
+			ok: true,
+			chats: [...chats.values()]
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			chats: [],
+			error: describeTelegramError(error)
+		};
+	}
+}
+var bots;
+var init_telegram = __esmMin((() => {
+	bots = /* @__PURE__ */ new Map();
+}));
+//#endregion
+//#region src/api/notifications.ts
+/**
+* The bot token is written straight to the secrets file and never into
+* `servers.config.json`, so notification *policy* and the *credential* stay
+* separate.
+*/
+function createNotificationsRoute(deps) {
+	return appFactory.createApp().put("/notifications/token", describeRoute({
+		tags: ["notifications"],
+		summary: "Store the Telegram bot token (verified first)",
+		responses: {
+			200: { description: "Stored" },
+			400: ERROR_RESPONSES[400]
 		}
-		resolveFallback() {
-			const control = controlSchema({});
-			const defaults = defaultsSchema({});
-			if (control instanceof type.errors || defaults instanceof type.errors) throw new ConfigError("internal: default config failed validation");
-			const logs = logsSchema({});
-			const notifications = notificationsSchema({});
-			const host = hostSchema({});
-			const backups = backupsSchema({});
-			if (logs instanceof type.errors || notifications instanceof type.errors || host instanceof type.errors || backups instanceof type.errors) throw new ConfigError("internal: default settings failed validation");
-			return {
-				control,
-				defaults,
-				logs,
-				notifications,
-				host,
-				backups,
-				servers: []
-			};
+	}), validate("json", telegramTokenSchema), async (c) => {
+		const { botToken } = c.req.valid("json");
+		const verified = await deps.notifications.verifyToken(botToken);
+		if (!verified.ok) throw new DetailedError(`telegram rejected the token: ${verified.error ?? "unknown error"}`, {
+			statusCode: 400,
+			code: "TELEGRAM_TOKEN_REJECTED"
+		});
+		deps.secrets.setTelegramToken(botToken);
+		forgetBots();
+		return c.json({
+			ok: true,
+			username: verified.username ?? null
+		});
+	}).delete("/notifications/token", describeRoute({
+		tags: ["notifications"],
+		summary: "Forget the Telegram bot token",
+		responses: { 200: { description: "Removed" } }
+	}), (c) => {
+		deps.secrets.setTelegramToken(null);
+		forgetBots();
+		return c.json({ ok: true });
+	}).post("/notifications/test", describeRoute({
+		tags: ["notifications"],
+		summary: "Send a test message",
+		responses: {
+			200: { description: "Sent or refused" },
+			400: ERROR_RESPONSES[400]
 		}
-		apply(raw) {
-			this.raw = raw;
-			const parsed = parseConfig(raw);
-			this.error = parsed.errors.length > 0 ? parsed.errors.join("; ") : null;
-			this.schemaVersion = parsed.schemaVersion;
-			this.warnings = [...parsed.warnings, ...parsed.unknownKeys.length === 0 ? [] : [`${path.basename(this.file)} carries ${parsed.unknownKeys.length} unrecognized key(s) this release ignores: ${parsed.unknownKeys.join(", ")}`]];
-			if (parsed.config !== null) this.resolvedConfig = parsed.config;
-			else if (this.resolvedConfig === void 0) this.resolvedConfig = this.resolveFallback();
+	}), validate("json", notificationActionSchema), async (c) => {
+		const result = await deps.notifications.sendTest(c.req.valid("json"));
+		if (!result.ok) throw new DetailedError(result.error ?? "the test message failed", {
+			statusCode: 400,
+			code: "TELEGRAM_SEND_FAILED"
+		});
+		return c.json(result);
+	}).post("/notifications/detect-chats", describeRoute({
+		tags: ["notifications"],
+		summary: "List the chats the bot can see",
+		responses: {
+			200: {
+				description: "Chats",
+				content: jsonBody(type({ chats: type({
+					id: "string | number",
+					title: "string"
+				}).array() }))
+			},
+			400: ERROR_RESPONSES[400]
 		}
-	};
+	}), validate("json", notificationActionSchema), async (c) => {
+		const result = await deps.notifications.detectChats(c.req.valid("json"));
+		if (!result.ok) throw new DetailedError(result.error ?? "could not list chats", {
+			statusCode: 400,
+			code: "TELEGRAM_LIST_FAILED"
+		});
+		return c.json({ chats: result.chats });
+	});
+}
+var init_notifications$1 = __esmMin((() => {
+	init_factory();
+	init_openapi$1();
+	init_validator();
+	init_telegram();
+	init_contracts();
 }));
 //#endregion
 //#region src/api/servers/$.routes.ts
@@ -3609,6 +5256,7 @@ function createSettingsRoute(deps) {
 			if (patch.notifications !== void 0) deps.store.updateNotifications(patch.notifications);
 			if (patch.host !== void 0) deps.store.updateHost(patch.host);
 			if (patch.backups !== void 0) deps.store.updateBackups(patch.backups);
+			if (patch.ddns !== void 0) deps.store.updateDdns(patch.ddns);
 			if (patch.control !== void 0) deps.store.updateControl(patch.control);
 		} catch (error) {
 			if (error instanceof ConfigError) throw new DetailedError(error.message, {
@@ -3617,6 +5265,7 @@ function createSettingsRoute(deps) {
 			});
 			throw error;
 		}
+		if (patch.ddns !== void 0) deps.ddns.refresh();
 		const next = deps.store.config.control;
 		const endpointChanged = next.host !== deps.controlServer.endpoint.host || next.port !== deps.controlServer.endpoint.port;
 		const proxyChanged = next.auth.trustProxy !== previous.trustProxy;
@@ -3992,13 +5641,14 @@ function createRootApp(deps) {
 		const started = Date.now();
 		await next();
 		logger.debug(`${c.req.method} ${new URL(c.req.url).pathname} ${c.res.status} ${Date.now() - started}ms`);
-	}).onError(errorHandler).route("/_hh", createControlRoute(deps)).use("/api/*", createAuthGuard({ auth: deps.auth })).route("/api", createAuthRoute(deps)).route("/api", createStateRoute(deps)).route("/api", createEventsRoute(deps)).route("/api", createSettingsRoute(deps)).route("/api", createTlsRoute(deps)).route("/api", createLogsRoute(deps)).route("/api", createNotificationsRoute(deps)).route("/api", createMetricsRoute(deps)).route("/api", createBackupsRoute(deps)).route("/api/servers", createServersRoute(deps)).route("/", createHealthRoute(deps));
+	}).onError(errorHandler).route("/_hh", createControlRoute(deps)).use("/api/*", createAuthGuard({ auth: deps.auth })).route("/api", createAuthRoute(deps)).route("/api", createStateRoute(deps)).route("/api", createEventsRoute(deps)).route("/api", createSettingsRoute(deps)).route("/api", createTlsRoute(deps)).route("/api", createLogsRoute(deps)).route("/api", createNotificationsRoute(deps)).route("/api", createDdnsRoute(deps)).route("/api", createMetricsRoute(deps)).route("/api", createBackupsRoute(deps)).route("/api/servers", createServersRoute(deps)).route("/", createHealthRoute(deps));
 	return app.route("/", setupOpenAPI(app)).route("/", createStaticRoute({ dir: () => deps.ui.resolveDir() }));
 }
 var init_app = __esmMin((() => {
 	init_$_routes$1();
 	init_backups$1();
 	init_control();
+	init_ddns$1();
 	init_events$1();
 	init_health();
 	init_logs();
@@ -5671,9 +7321,20 @@ var init_log_relay = __esmMin((() => {
 			this.start();
 			return history;
 		}
+		/**
+		* Stops following and hands back whatever the file still held unread.
+		*
+		* A nanny writes its last lines and exits in the same breath, so the tailer can be
+		* dropped between two polls with its final lines — the child's crash output — still
+		* on disk. Losing them here is what made a persistent entry's crash silent in the
+		* panel, so the caller gets them to ingest rather than an empty hand.
+		*/
 		unfollow(serverId) {
+			const current = this.followed.get(serverId);
+			const rest = current === void 0 ? [] : current.tailer.read();
 			this.followed.delete(serverId);
 			if (this.followed.size === 0) this.stopTimer();
+			return rest;
 		}
 		followedIds() {
 			return [...this.followed.keys()];
@@ -5708,6 +7369,18 @@ var init_log_relay = __esmMin((() => {
 }));
 //#endregion
 //#region src/services/supervisor.ts
+/** One line's exact identity: a timestamp this panel minted, its stream and its text. */
+function echoedKey(line) {
+	return `${line.ts}\u0000${line.stream}\u0000${line.text}`;
+}
+function rememberEchoedLine(set, line) {
+	set.add(echoedKey(line));
+	while (set.size > ECHOED_LINE_LIMIT) set.delete(set.values().next().value);
+}
+/** True when this line is this panel's own echo, so it is only ever reported once. */
+function forgetEchoedLine(set, line) {
+	return set.delete(echoedKey(line));
+}
 function delay(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -5727,7 +7400,7 @@ function serverTemplateVars(config) {
 		home: os.homedir()
 	};
 }
-var HISTORY_WINDOW_MS, HISTORY_CACHE_MS, TICK_INTERVAL_MS, PORT_STATE_INTERVAL_MS, PORT_RELEASE_RECHECK_MS, RESOURCE_SAMPLE_INTERVAL_MS, PERSISTENT_BACKFILL_LINES, Supervisor;
+var HISTORY_WINDOW_MS, HISTORY_CACHE_MS, TICK_INTERVAL_MS, PORT_STATE_INTERVAL_MS, PORT_RELEASE_RECHECK_MS, RESOURCE_SAMPLE_INTERVAL_MS, PERSISTENT_BACKFILL_LINES, ECHOED_LINE_LIMIT, Supervisor;
 var init_supervisor = __esmMin((() => {
 	init_backoff();
 	init_bind();
@@ -5752,6 +7425,7 @@ var init_supervisor = __esmMin((() => {
 	PORT_RELEASE_RECHECK_MS = 300;
 	RESOURCE_SAMPLE_INTERVAL_MS = 5e3;
 	PERSISTENT_BACKFILL_LINES = 200;
+	ECHOED_LINE_LIMIT = 100;
 	Supervisor = class {
 		store;
 		hub;
@@ -6101,7 +7775,7 @@ var init_supervisor = __esmMin((() => {
 					clearNannyState(nannyStatePath(this.options.nannyDir, entry.config.id));
 					clearNannySpec(nannySpecPath(this.options.nannyDir, entry.config.id));
 				} else this.log(entry, "system", `pid ${survivor} is still alive after the stop — its state file is kept`);
-				this.relay.unfollow(entry.config.id);
+				this.drainRelay(entry);
 			}
 			entry.stopping = false;
 			entry.child = null;
@@ -6143,6 +7817,7 @@ var init_supervisor = __esmMin((() => {
 				stopping: false,
 				bootstrapDone: !config.bootstrap,
 				logs: new LogBuffer(config.logBufferLines),
+				echoed: /* @__PURE__ */ new Set(),
 				responseMs: null,
 				resources: null,
 				resourcesSampledAt: 0,
@@ -6162,8 +7837,8 @@ var init_supervisor = __esmMin((() => {
 					continue;
 				}
 				const bufferChanged = entry.config.logBufferLines !== config.logBufferLines;
+				if (entry.config.persistent && !config.persistent) this.drainRelay(entry);
 				entry.config = config;
-				if (!config.persistent) this.relay.unfollow(id);
 				if (bufferChanged) {
 					const kept = entry.logs.list(config.logBufferLines);
 					entry.logs = new LogBuffer(config.logBufferLines);
@@ -6323,8 +7998,8 @@ var init_supervisor = __esmMin((() => {
 			entry.health = entry.config.health.enabled ? "unknown" : "disabled";
 			entry.startedAt = Date.now();
 			entry.lastError = null;
+			if (entry.config.persistent) this.followPersistent(entry, true);
 			this.log(entry, "system", `adopted pid ${pid}: a detached restart of this entry is already serving port ${entry.config.port}`);
-			if (entry.config.persistent) this.followPersistent(entry);
 			this.publishServer(entry);
 			return { ok: true };
 		}
@@ -6559,25 +8234,41 @@ var init_supervisor = __esmMin((() => {
 		ingestExternalLines(serverId, lines) {
 			const entry = this.entries.get(serverId);
 			if (entry === void 0 || !entry.config.persistent || lines.length === 0) return;
-			for (const line of lines) entry.logs.push(line);
+			const kept = lines.filter((line) => !forgetEchoedLine(entry.echoed, line));
+			if (kept.length === 0) return;
+			for (const line of kept) entry.logs.push(line);
 			this.hub.publish({
 				type: "log",
-				ts: lines[lines.length - 1].ts,
+				ts: kept[kept.length - 1].ts,
 				serverId,
-				lines
+				lines: kept
 			});
 		}
 		/**
+		* Whatever the relay had not read yet, ingested before its tailer goes: a nanny's
+		* exit and a stop both end with lines the panel has never seen.
+		*/
+		drainRelay(entry) {
+			const rest = this.relay.unfollow(entry.config.id);
+			if (rest.length > 0) this.ingestExternalLines(entry.config.id, rest);
+		}
+		/**
 		* Follows a persistent entry's log file, filling the ring buffer from what is on disk.
 		*
 		* The backfill is read *through* the tailer, which is the only thing that may own the
 		* offset: reading it from `LogFiles` first and seeking to EOF second would either
 		* replay a line as news or skip one as history, depending on which order the two
 		* syscalls happen to land in.
+		*
+		* `attach` is the caller's word for "this entry is already running, and its history is
+		* new to this panel": only then is the file's tail history. The buffer itself cannot
+		* answer that — spawn, adopt and reattach all log a line of their own — which is why a
+		* `logs.size === 0` test left this backfill dead. An empty buffer is still required, so
+		* a second attach to an entry we already hold lines for cannot replay older ones on top.
 		*/
-		followPersistent(entry) {
+		followPersistent(entry, attach = false) {
 			const id = entry.config.id;
-			const backfill = entry.logs.size === 0 && this.options.logFiles.config.persist ? PERSISTENT_BACKFILL_LINES : 0;
+			const backfill = attach && entry.logs.size === 0 && this.options.logFiles.config.persist ? PERSISTENT_BACKFILL_LINES : 0;
 			const history = this.relay.follow(id, nannyLogFile(this.options.logFiles.directory, id), { backfill });
 			if (history.length > 0) entry.logs.extend(history);
 		}
@@ -6600,8 +8291,8 @@ var init_supervisor = __esmMin((() => {
 				entry.lastError = null;
 				entry.nannyExit = null;
 				const child = state.childPid === null ? "" : `, server pid ${state.childPid}`;
+				this.followPersistent(entry, true);
 				this.log(entry, "system", `persistent: still running (nanny pid ${state.nannyPid}${child}) — reattached`);
-				this.followPersistent(entry);
 				this.publishServer(entry);
 				return true;
 			}
@@ -6640,7 +8331,7 @@ var init_supervisor = __esmMin((() => {
 			const state = readNannyState(statePath);
 			if (state?.lastExit !== void 0) entry.nannyExit = state.lastExit;
 			clearNannyState(statePath);
-			this.relay.unfollow(entry.config.id);
+			this.drainRelay(entry);
 		}
 		/** One probe using the configured mode (TCP or HTTP), with timing. */
 		async probeEntryHealth(entry) {
@@ -6759,6 +8450,7 @@ var init_supervisor = __esmMin((() => {
 			if (this.disposed) return;
 			const now = Date.now();
 			await this.options.hostMonitor.tick(now);
+			this.options.ddns.tick(now);
 			await this.sampleResources(now);
 			await Promise.allSettled([...this.entries.values()].map((entry) => this.probeEntry(entry, now)));
 			for (const entry of this.entries.values()) {
@@ -6904,6 +8596,7 @@ var init_supervisor = __esmMin((() => {
 			};
 			entry.logs.push(line);
 			this.options.logFiles.append(entry.config.id, line);
+			if (entry.config.persistent && this.options.logFiles.config.persist) rememberEchoedLine(entry.echoed, line);
 			this.hub.publish({
 				type: "log",
 				ts: line.ts,
@@ -6923,19 +8616,30 @@ var init_supervisor = __esmMin((() => {
 		}
 		publishState() {
 			const state = this.getState();
-			const signature = [state.configError ?? "", ...state.servers.map((server) => [
-				server.id,
-				server.status,
-				server.health,
-				server.portState,
-				server.pid,
-				server.restarts,
-				server.nextRetryAt,
-				server.lastError,
-				server.bufferedLines,
-				server.responseMs,
-				server.resources?.sampledAt
-			].join(":"))].join("|");
+			const ddns = state.ddns;
+			const signature = [
+				state.configError ?? "",
+				ddns === void 0 ? "" : [
+					ddns.running,
+					ddns.lastRunAt,
+					ddns.ipv4,
+					ddns.ipv6,
+					...ddns.records.map((record) => `${record.host}:${record.type}:${record.state}:${record.ip}`)
+				].join(":"),
+				...state.servers.map((server) => [
+					server.id,
+					server.status,
+					server.health,
+					server.portState,
+					server.pid,
+					server.restarts,
+					server.nextRetryAt,
+					server.lastError,
+					server.bufferedLines,
+					server.responseMs,
+					server.resources?.sampledAt
+				].join(":"))
+			].join("|");
 			if (signature === this.lastStateSignature) return;
 			this.lastStateSignature = signature;
 			this.hub.publish({
@@ -7132,7 +8836,7 @@ function safeSlug(slug) {
 	return slug;
 }
 /** A flag is valid for one exact file revision, not for the name alone. */
-function cacheKey(file) {
+function cacheKey$1(file) {
 	return `${file.sizeBytes}:${file.createdAt}`;
 }
 /** Stable, filesystem-safe name for a data path inside the archive. */
@@ -7197,13 +8901,13 @@ var init_backups = __esmMin((() => {
 			const files = this.scan();
 			for (const file of files) {
 				const cached = this.flags.get(file.name);
-				if (cached === void 0 || cached.key !== cacheKey(file)) this.scheduleRefresh();
+				if (cached === void 0 || cached.key !== cacheKey$1(file)) this.scheduleRefresh();
 			}
 			return files.map((file) => {
 				const cached = this.flags.get(file.name);
 				return {
 					...file,
-					encrypted: cached !== void 0 && cached.key === cacheKey(file) ? cached.encrypted : false
+					encrypted: cached !== void 0 && cached.key === cacheKey$1(file) ? cached.encrypted : false
 				};
 			});
 		}
@@ -7220,6 +8924,8 @@ var init_backups = __esmMin((() => {
 				error: "backups are disabled"
 			};
 			const password = options.password !== void 0 && options.password.length > 0 ? options.password : null;
+			const wanted = options.include === void 0 ? null : new Set(options.include);
+			const captures = (id) => wanted === null || wanted.has(id);
 			const dir = this.resolveDir();
 			const sources = this.options.getSources();
 			const staging = path.join(dir, `.staging-${Date.now()}`);
@@ -7228,12 +8934,12 @@ var init_backups = __esmMin((() => {
 			const destination = path.join(dir, name);
 			try {
 				fs.mkdirSync(staging, { recursive: true });
-				this.copyInto(staging, "config/servers.config.json", sources.configPath);
-				this.copyInto(staging, "secrets/control-secrets.json", sources.secretsPath);
-				this.copyInto(staging, "tls", sources.tlsDir);
+				if (captures("config")) this.copyInto(staging, "config/servers.config.json", sources.configPath);
+				if (captures("secrets")) this.copyInto(staging, "secrets/control-secrets.json", sources.secretsPath);
+				if (captures("tls")) this.copyInto(staging, "tls", sources.tlsDir);
 				const data = [];
 				for (const declared of this.paths) {
-					if (!declared.included || !fs.existsSync(declared.path)) continue;
+					if (!captures(`data:${declared.path}`) || !declared.included || !fs.existsSync(declared.path)) continue;
 					const slug = slugifyPath(declared.path);
 					if (data.some((entry) => entry.slug === slug)) continue;
 					this.copyInto(staging, path.join("data", slug), declared.path, declared.ignoreGenerated === true);
@@ -7243,6 +8949,16 @@ var init_backups = __esmMin((() => {
 						origin: declared.origin
 					});
 				}
+				if (wanted !== null && fs.readdirSync(staging).length === 0) {
+					fs.rmSync(staging, {
+						recursive: true,
+						force: true
+					});
+					return {
+						ok: false,
+						error: "nothing was selected to back up"
+					};
+				}
 				const manifest = {
 					version: 1,
 					createdAt,
@@ -7420,12 +9136,26 @@ var init_backups = __esmMin((() => {
 					});
 				}
 				const fromArchive = archiveTargets(restoredConfig);
-				const candidates = [...actions.has("config") ? fromArchive : [], ...this.paths.filter((entry) => entry.included).map((entry) => ({
+				const archiveCandidates = actions.has("config") ? fromArchive : [];
+				const instanceCandidates = this.paths.filter((entry) => entry.included).map((entry) => ({
 					path: entry.path,
 					origin: entry.origin
-				}))];
+				}));
+				const candidates = [...archiveCandidates, ...instanceCandidates];
+				const cursors = {
+					archive: /* @__PURE__ */ new Map(),
+					instance: /* @__PURE__ */ new Map()
+				};
+				const matchByOrigin = (list, cursor, origin) => {
+					if (origin === void 0) return void 0;
+					const same = list.filter((candidate) => candidate.origin === origin);
+					if (same.length === 0) return void 0;
+					const used = cursor.get(origin) ?? 0;
+					cursor.set(origin, used + 1);
+					return same[used] ?? same[0];
+				};
 				for (const entry of manifest.data ?? []) {
-					const target = candidates.find((candidate) => entry.origin !== void 0 && candidate.origin === entry.origin) ?? candidates.find((candidate) => candidate.path === entry.path);
+					const target = matchByOrigin(archiveCandidates, cursors.archive, entry.origin) ?? matchByOrigin(instanceCandidates, cursors.instance, entry.origin) ?? candidates.find((candidate) => candidate.path === entry.path);
 					const from = path.join(staging, "data", safeSlug(entry.slug) ?? slugifyPath(entry.path));
 					const common = {
 						id: `data:${entry.path}`,
@@ -7528,7 +9258,7 @@ var init_backups = __esmMin((() => {
 			const dir = this.resolveDir();
 			const listed = this.scan();
 			for (const file of listed) {
-				const key = cacheKey(file);
+				const key = cacheKey$1(file);
 				if (this.flags.get(file.name)?.key === key) continue;
 				try {
 					const entries = await listZip(path.join(dir, file.name));
@@ -7764,6 +9494,370 @@ var init_control_server = __esmMin((() => {
 	};
 }));
 //#endregion
+//#region src/providers/ddns/ip.ts
+/** RFC1918, loopback, link-local and CGNAT are never a public DNS target. */
+function isPublicAddress(ip, family) {
+	if (family === "A") {
+		const parts = ip.split(".").map((part) => Number.parseInt(part, 10));
+		if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return false;
+		const [a, b] = parts;
+		return !(a === 0 || a === 10 || a === 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 100 && b >= 64 && b <= 127);
+	}
+	const lower = ip.toLowerCase();
+	if (lower === "::1" || lower === "::") return false;
+	return !(lower.startsWith("fc") || lower.startsWith("fd") || /^fe[89ab]/.test(lower));
+}
+/**
+* Reads the address out of whatever the endpoint answered: a bare address, a
+* Cloudflare `cdn-cgi/trace` body (`ip=…`), or a small JSON object.
+*/
+function parseAddressResponse(text, family) {
+	const trimmed = text.trim();
+	if (trimmed.length === 0) return null;
+	const candidates = [];
+	const trace = /^ip=(.+)$/m.exec(trimmed)?.[1];
+	if (trace !== void 0) candidates.push(trace.trim());
+	if (trimmed.startsWith("{")) try {
+		const parsed = JSON.parse(trimmed);
+		for (const key of [
+			"ip",
+			"address",
+			"ip_addr",
+			"query"
+		]) {
+			const value = parsed[key];
+			if (typeof value === "string") candidates.push(value.trim());
+		}
+	} catch {}
+	candidates.push(trimmed);
+	const wanted = family === "A" ? 4 : 6;
+	for (const candidate of candidates) {
+		const value = candidate.split(/[\s,]/)[0] ?? "";
+		if (isIP(value) === wanted && isPublicAddress(value, family)) return value;
+	}
+	return null;
+}
+/**
+* Tries the configured endpoint, or the built-in list in order, and returns the
+* first address that is really public. A transient failure never deletes a
+* record; it just leaves the previous one in place.
+*/
+async function detectPublicAddress(family, overrideUrl, fetchImpl, signal) {
+	const configured = overrideUrl.trim();
+	const endpoints = configured.length > 0 ? [configured] : family === "A" ? DEFAULT_IPV4_ENDPOINTS : DEFAULT_IPV6_ENDPOINTS;
+	let lastError = null;
+	for (const endpoint of endpoints) try {
+		const response = await fetchImpl(endpoint, {
+			signal,
+			headers: { Accept: "text/plain, application/json" }
+		});
+		if (!response.ok) {
+			lastError = `${endpoint} answered ${response.status}`;
+			continue;
+		}
+		const parsed = parseAddressResponse(await response.text(), family);
+		if (parsed !== null) return {
+			ip: parsed,
+			error: null
+		};
+		lastError = `${endpoint} did not answer with a public ${family === "A" ? "IPv4" : "IPv6"} address`;
+	} catch (error) {
+		lastError = `${endpoint}: ${error instanceof Error ? error.message : String(error)}`;
+	}
+	return {
+		ip: null,
+		error: lastError ?? `no endpoint for ${family}`
+	};
+}
+var DEFAULT_IPV4_ENDPOINTS, DEFAULT_IPV6_ENDPOINTS;
+var init_ip = __esmMin((() => {
+	DEFAULT_IPV4_ENDPOINTS = [
+		"https://api4.ipify.org",
+		"https://ipv4.icanhazip.com",
+		"https://checkip.amazonaws.com",
+		"https://4.ident.me",
+		"https://cloudflare.com/cdn-cgi/trace"
+	];
+	DEFAULT_IPV6_ENDPOINTS = [
+		"https://api6.ipify.org",
+		"https://ipv6.icanhazip.com",
+		"https://6.ident.me",
+		"https://cloudflare.com/cdn-cgi/trace"
+	];
+}));
+//#endregion
+//#region src/services/ddns.ts
+function emptyState() {
+	return {
+		version: 1,
+		updatedAt: 0,
+		records: {}
+	};
+}
+function readState(file) {
+	try {
+		const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+		const records = {};
+		for (const [key, value] of Object.entries(parsed?.records ?? {})) if (typeof value?.ip === "string") records[key] = value;
+		return {
+			version: 1,
+			updatedAt: typeof parsed?.updatedAt === "number" ? parsed.updatedAt : 0,
+			records
+		};
+	} catch {
+		return emptyState();
+	}
+}
+function cacheKey(host, type) {
+	return `${normalizeHost(host)}|${type}`;
+}
+var RUN_TIMEOUT_MS, DdnsService;
+var init_ddns = __esmMin((() => {
+	init_atomic();
+	init_logger();
+	init_ddns$2();
+	init_ip();
+	init_types();
+	RUN_TIMEOUT_MS = 6e4;
+	DdnsService = class {
+		deps;
+		results = /* @__PURE__ */ new Map();
+		persisted;
+		running = false;
+		disposed = false;
+		/** Null until the first pass, so a fresh panel looks immediately. */
+		lastStartedAt = null;
+		lastRunAt = null;
+		lastResult = null;
+		ipv4 = null;
+		ipv6 = null;
+		constructor(deps) {
+			this.deps = deps;
+			this.persisted = readState(deps.statePath);
+		}
+		now() {
+			return this.deps.now?.() ?? Date.now();
+		}
+		/** What the state frame and the settings page read. */
+		get view() {
+			return {
+				enabled: this.deps.getConfig().enabled,
+				running: this.running,
+				lastRunAt: this.lastRunAt,
+				lastResult: this.lastResult,
+				ipv4: this.ipv4,
+				ipv6: this.ipv6,
+				records: this.records()
+			};
+		}
+		/** One entry per configured target, with whatever the last pass learned. */
+		records() {
+			const config = this.deps.getConfig();
+			const views = [];
+			for (const domain of config.domains) {
+				const account = config.accounts.find((entry) => entry.id === domain.account);
+				const provider = account === void 0 ? null : ddnsProvider(account.provider);
+				for (const type of domain.types) {
+					const found = this.results.get(cacheKey(domain.host, type));
+					views.push({
+						host: domain.host,
+						account: domain.account,
+						provider: account?.provider ?? "",
+						type,
+						ip: found?.ip ?? this.persisted.records[cacheKey(domain.host, type)]?.ip ?? null,
+						state: found?.state ?? (provider === null ? "skipped" : "pending"),
+						message: found?.message ?? (account === void 0 ? `unknown account "${domain.account}"` : provider === null ? `unknown provider "${account.provider}"` : null),
+						updatedAt: found?.updatedAt ?? null
+					});
+				}
+			}
+			return views;
+		}
+		/** Makes the next tick run immediately, after a config or credential save. */
+		refresh() {
+			this.lastStartedAt = null;
+		}
+		/**
+		* Cheap enough to call every supervisor tick, and deliberately non-blocking:
+		* a slow provider must never hold up health probes.
+		*/
+		tick(now = this.now()) {
+			if (this.disposed || this.running) return;
+			const config = this.deps.getConfig();
+			if (!config.enabled) return;
+			if (this.lastStartedAt !== null && now - this.lastStartedAt < config.intervalMs) return;
+			this.lastStartedAt = now;
+			this.run().catch((error) => {
+				logger.error("ddns pass failed", error);
+			});
+		}
+		/** Runs one pass now; `force` re-sends addresses the cache already knows. */
+		async run(options = {}) {
+			if (this.running || this.disposed) return this.view;
+			this.running = true;
+			const config = this.deps.getConfig();
+			const signal = AbortSignal.timeout(RUN_TIMEOUT_MS);
+			const fetchImpl = this.deps.fetchImpl ?? ((input, init) => fetch(input, init));
+			let changed = 0;
+			let unchanged = 0;
+			let failed = 0;
+			let skipped = 0;
+			try {
+				const wanted = this.wantedFamilies(config);
+				const detected = {
+					ipv4: wanted.ipv4 ? await detectPublicAddress("A", config.ipv4.url, fetchImpl, signal) : {
+						ip: null,
+						error: null
+					},
+					ipv6: wanted.ipv6 ? await detectPublicAddress("AAAA", config.ipv6.url, fetchImpl, signal) : {
+						ip: null,
+						error: null
+					}
+				};
+				if (detected.ipv4.ip !== null) this.ipv4 = detected.ipv4.ip;
+				if (detected.ipv6.ip !== null) this.ipv6 = detected.ipv6.ip;
+				if (detected.ipv4.error !== null) logger.warn(`ddns: could not detect the public IPv4 address (${detected.ipv4.error})`);
+				if (detected.ipv6.error !== null) logger.warn(`ddns: could not detect the public IPv6 address (${detected.ipv6.error})`);
+				for (const domain of config.domains) {
+					if (!domain.enabled) continue;
+					const account = config.accounts.find((entry) => entry.id === domain.account);
+					const provider = account === void 0 ? null : ddnsProvider(account.provider);
+					const credentials = account === void 0 ? null : this.deps.getCredentials(account.id, account.provider);
+					for (const type of domain.types) {
+						const key = cacheKey(domain.host, type);
+						const family = type === "A" ? "ipv4" : "ipv6";
+						const familyConfig = type === "A" ? config.ipv4 : config.ipv6;
+						const address = type === "A" ? detected.ipv4.ip : detected.ipv6.ip;
+						if (provider === null || account === void 0) {
+							this.remember(key, "skipped", address, `unknown account or provider for "${domain.account}"`);
+							skipped += 1;
+							continue;
+						}
+						if (!familyConfig.enabled) {
+							this.remember(key, "skipped", address, `${type} records need ${family} detection, which is off`);
+							skipped += 1;
+							continue;
+						}
+						if (address === null) {
+							this.remember(key, "skipped", null, detected[family].error ?? `no public ${family} address was found`);
+							skipped += 1;
+							continue;
+						}
+						if (!provider.families.includes(type)) {
+							this.remember(key, "skipped", address, `${provider.label} cannot manage ${type} records`);
+							skipped += 1;
+							continue;
+						}
+						if (!options.force && this.persisted.records[key]?.ip === address) {
+							this.remember(key, "unchanged", address, null);
+							unchanged += 1;
+							continue;
+						}
+						const cache = this.persisted.records[key];
+						const record = {
+							host: domain.host,
+							type,
+							ip: address,
+							ttl: domain.ttl ?? config.ttl,
+							proxied: domain.proxied,
+							...domain.zone === void 0 ? {} : { zone: domain.zone },
+							...cache === void 0 ? {} : { cache: {
+								...cache.zoneId === void 0 ? {} : { zoneId: cache.zoneId },
+								...cache.recordId === void 0 ? {} : { recordId: cache.recordId }
+							} }
+						};
+						const result = await provider.update(record, {
+							credentials: credentials ?? {},
+							fetch: fetchImpl,
+							signal
+						});
+						if (result.ok) {
+							this.persisted.records[key] = {
+								ip: address,
+								updatedAt: this.now(),
+								...result.cache?.zoneId === void 0 ? {} : { zoneId: result.cache.zoneId },
+								...result.cache?.recordId === void 0 ? {} : { recordId: result.cache.recordId }
+							};
+							this.remember(key, result.changed ? "ok" : "unchanged", address, result.message);
+							if (result.changed) changed += 1;
+							else unchanged += 1;
+						} else {
+							this.remember(key, "error", address, result.error ?? result.message);
+							failed += 1;
+							logger.warn(`ddns: ${domain.host} ${type}: ${result.error ?? result.message}`);
+						}
+					}
+				}
+			} finally {
+				this.running = false;
+				this.lastRunAt = this.now();
+				this.persisted.updatedAt = this.lastRunAt;
+				this.writeState();
+				this.lastResult = this.describe(changed, unchanged, failed, skipped);
+				this.announce({
+					changed,
+					failed
+				});
+			}
+			return this.view;
+		}
+		/** Only the families a configured target actually asks for. */
+		wantedFamilies(config) {
+			return {
+				ipv4: config.ipv4.enabled && config.domains.some((domain) => domain.enabled && domain.types.includes("A")),
+				ipv6: config.ipv6.enabled && config.domains.some((domain) => domain.enabled && domain.types.includes("AAAA"))
+			};
+		}
+		remember(key, state, ip, message) {
+			this.results.set(key, {
+				state,
+				ip,
+				message,
+				updatedAt: this.now()
+			});
+		}
+		/** Counts only: the detected addresses are shown beside it, and are the status's own. */
+		describe(changed, unchanged, failed, skipped) {
+			const parts = [
+				changed > 0 ? `${changed} updated` : null,
+				unchanged > 0 ? `${unchanged} already current` : null,
+				failed > 0 ? `${failed} failed` : null,
+				skipped > 0 ? `${skipped} skipped` : null
+			].filter((part) => part !== null);
+			return parts.length === 0 ? "nothing to update" : parts.join(", ");
+		}
+		/** One message per pass, so a flapping provider cannot flood the chat. */
+		announce(counts) {
+			if (counts.changed === 0 && counts.failed === 0) return;
+			if (counts.failed > 0) {
+				this.deps.notifications.notify({
+					serverId: "ddns",
+					label: "DDNS",
+					reason: "ddns-error",
+					detail: this.lastResult ?? "a dynamic DNS update failed"
+				});
+				return;
+			}
+			this.deps.notifications.notify({
+				serverId: "ddns",
+				label: "DDNS",
+				reason: "ddns",
+				detail: this.lastResult ?? "a dynamic DNS record changed"
+			});
+		}
+		writeState() {
+			try {
+				writeFileAtomic(this.deps.statePath, `${JSON.stringify(this.persisted, null, 2)}\n`);
+			} catch (error) {
+				logger.warn(`ddns: could not save its state (${error instanceof Error ? error.message : String(error)})`);
+			}
+		}
+		dispose() {
+			this.disposed = true;
+		}
+	};
+}));
+//#endregion
 //#region src/services/events.ts
 var ALL, EventHub;
 var init_events = __esmMin((() => {
@@ -8277,7 +10371,9 @@ var init_notifications = __esmMin((() => {
 		"recovered": "recovered",
 		"rss": "exceeded its memory limit",
 		"host": "host thresholds breached",
-		"host-recovered": "host thresholds recovered"
+		"host-recovered": "host thresholds recovered",
+		"ddns": "updated a dynamic DNS record",
+		"ddns-error": "hit a dynamic DNS error"
 	};
 	TITLE = {
 		"crash": "🔴 server down",
@@ -8286,7 +10382,9 @@ var init_notifications = __esmMin((() => {
 		"recovered": "🟢 server recovered",
 		"rss": "🔴 server over its memory limit",
 		"host": "🟠 host warning",
-		"host-recovered": "🟢 host recovered"
+		"host-recovered": "🟢 host recovered",
+		"ddns": "🌐 DNS updated",
+		"ddns-error": "🌐 DNS update failed"
 	};
 	NotificationService = class {
 		secrets;
@@ -8314,6 +10412,7 @@ var init_notifications = __esmMin((() => {
 				onForcedRestart: telegram.onForcedRestart,
 				onRecovered: telegram.onRecovered,
 				onHost: telegram.onHost,
+				onDdns: telegram.onDdns,
 				cooldownMs: telegram.cooldownMs,
 				lastResult: this.lastResult,
 				lastResultAt: this.lastResultAt
@@ -8330,7 +10429,9 @@ var init_notifications = __esmMin((() => {
 				"recovered": telegram.onRecovered,
 				"rss": telegram.onCrash,
 				"host": telegram.onHost,
-				"host-recovered": telegram.onHost
+				"host-recovered": telegram.onHost,
+				"ddns": telegram.onDdns,
+				"ddns-error": telegram.onDdns
 			}[event.reason]) return false;
 			const until = this.cooldowns.get(`${event.serverId}:${event.reason}`) ?? 0;
 			return !(telegram.cooldownMs > 0 && until > now);
@@ -9310,6 +11411,12 @@ async function runControlPlane(options) {
 		dataRoot,
 		home: os.homedir()
 	})), notifications);
+	const ddns = new DdnsService({
+		getConfig: () => store.config.ddns,
+		getCredentials: (accountId, provider) => secrets.getDdnsCredentials(accountId, provider)?.values ?? null,
+		notifications,
+		statePath: defaultDdnsStatePath
+	});
 	let onConfigRestored;
 	const backups = new BackupService({
 		dataRoot,
@@ -9393,6 +11500,7 @@ async function runControlPlane(options) {
 			notifications,
 			hostMonitor,
 			backups,
+			ddns,
 			logsDir: logFiles.directory,
 			views
 		}),
@@ -9400,6 +11508,7 @@ async function runControlPlane(options) {
 		logFiles,
 		notifications,
 		hostMonitor,
+		ddns,
 		nannyDir: defaultNannyDir
 	});
 	/**
@@ -9447,6 +11556,7 @@ async function runControlPlane(options) {
 		clearRuntime();
 		configWatch.dispose();
 		auth.dispose();
+		ddns.dispose();
 		await supervisor.dispose();
 		logFiles.dispose();
 		history.dispose();
@@ -9464,6 +11574,7 @@ async function runControlPlane(options) {
 		logFiles,
 		notifications,
 		backups,
+		ddns,
 		ui,
 		runtimeToken: token,
 		onShutdown: () => shutdown("shutdown requested locally")
@@ -9543,6 +11654,7 @@ var init_src = __esmMin((() => {
 	init_backups();
 	init_config_watch();
 	init_control_server();
+	init_ddns();
 	init_events();
 	init_exposure();
 	init_history();