home-hosted 0.6.7 → 0.6.8

package/dist/cli.js

@@ -391,7 +391,7 @@ function parseBind(value) {
 	const parsed = bindSchema(value);
 	return parsed instanceof type.errors ? null : parsed;
 }
-var bindSchema, portSchema, onPortConflictSchema, onPortConflictDefaultSchema, restartSchema, httpCheckSchema, resourcesSchema, healthSchema, stopSchema, bootstrapSchema, bootstrapOrNullSchema, logBufferLinesSchema, serverSchema, authSchema, telegramSchema, notificationsSchema, logsSchema, tlsSchema, hostSchema, ddnsRecordTypeSchema, ddnsAccountSchema, ddnsDomainSchema, ddnsIpv4Schema, ddnsIpv6Schema, ddnsConfigSchema, ddnsRecordStateSchema, ddnsRecordViewSchema, ddnsStatusSchema, ddnsProviderFieldSchema, ddnsProviderInfoSchema, ddnsViewSchema, ddnsCredentialsSchema, backupsSchema, controlSchema, defaultsSchema, restartPatchSchema, httpCheckPatchSchema, resourcesPatchSchema, healthPatchSchema, stopPatchSchema, authPatchSchema, telegramPatchSchema, notificationsPatchSchema, hostPatchSchema, backupsPatchSchema, logsPatchSchema, tlsPatchSchema, controlPatchSchema, defaultsPatchSchema, editableFields, serverPatchSchema, serverCreateSchema, nannySpecSchema, nannyExitSchema, nannyStateSchema, settingsPatchSchema, authStatusSchema, tlsStatusSchema, telegramStatusSchema, notificationViewSchema, sessionViewSchema, loginSchema, passwordValueSchema, passwordSchema, serverStatusSchema, healthStateSchema, portStateSchema, logStreamSchema, logLineSchema, historyEventSchema, serverHistorySchema, processResourcesSchema, hostDiskSchema, hostViewSchema, backupFileSchema, backupPathSchema, backupsViewSchema, restoreItemSchema, restorePlanSchema, backupCreateSchema, restoreRequestSchema, serverViewSchema, controlViewSchema, appStateSchema, logQuerySchema, freePortResultSchema, logHistoryQuerySchema, logFileInfoSchema, logServerViewSchema, logServersViewSchema, notificationActionSchema, telegramTokenSchema, apiErrorSchema, uiMetaSchema, uiStatusSchema, tlsUploadSchema, settingsViewSchema, settingsSavedSchema;
+var bindSchema, portSchema, onPortConflictSchema, onPortConflictDefaultSchema, restartSchema, httpCheckSchema, resourcesSchema, healthSchema, stopSchema, bootstrapSchema, bootstrapOrNullSchema, logBufferLinesSchema, serverSchema, authSchema, telegramSchema, notificationsSchema, logsSchema, tlsSchema, hostSchema, ddnsRecordTypeSchema, ddnsAccountSchema, ddnsDomainSchema, ddnsIpv4Schema, ddnsIpv6Schema, ddnsConfigSchema, ddnsRecordStateSchema, ddnsRecordViewSchema, ddnsStatusSchema, ddnsProviderFieldSchema, ddnsProviderInfoSchema, ddnsViewSchema, ddnsCredentialsSchema, ddnsPatchSchema, backupsSchema, controlSchema, defaultsSchema, restartPatchSchema, httpCheckPatchSchema, resourcesPatchSchema, healthPatchSchema, stopPatchSchema, authPatchSchema, telegramPatchSchema, notificationsPatchSchema, hostPatchSchema, backupsPatchSchema, logsPatchSchema, tlsPatchSchema, controlPatchSchema, defaultsPatchSchema, editableFields, serverPatchSchema, serverCreateSchema, nannySpecSchema, nannyExitSchema, nannyStateSchema, settingsPatchSchema, authStatusSchema, tlsStatusSchema, telegramStatusSchema, notificationViewSchema, sessionViewSchema, loginSchema, passwordValueSchema, passwordSchema, serverStatusSchema, healthStateSchema, portStateSchema, logStreamSchema, logLineSchema, historyEventSchema, serverHistorySchema, processResourcesSchema, hostDiskSchema, hostViewSchema, backupFileSchema, backupPathSchema, backupsViewSchema, restoreItemSchema, restorePlanSchema, backupCreateSchema, restoreRequestSchema, serverViewSchema, controlViewSchema, appStateSchema, logQuerySchema, freePortResultSchema, logHistoryQuerySchema, logFileInfoSchema, logServerViewSchema, logServersViewSchema, notificationActionSchema, telegramTokenSchema, apiErrorSchema, uiMetaSchema, uiStatusSchema, tlsUploadSchema, settingsViewSchema, settingsSavedSchema;
 var init_contracts = __esmMin((() => {
 	bindSchema = type("\"local\" | \"lan\" | /^\\d{1,3}(?:\\.\\d{1,3}){3}$/");
 	portSchema = type("1 <= number.integer <= 65535 | null");
@@ -553,8 +553,8 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		zone: "string?",
 		/** Seconds; `1` means "automatic" where the provider supports it. */
 		ttl: "number.integer >= 1?",
-		/** Cloudflare only. */
-		proxied: "boolean?",
+		/** Proxying is a property of the record, not the panel: Cloudflare only. */
+		proxied: "boolean = false",
 		enabled: "boolean = true"
 	}).onUndeclaredKey("reject");
 	ddnsIpv4Schema = type({
@@ -574,10 +574,6 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		ipv6: ddnsIpv6Schema.default(() => ({})),
 		/** Default TTL for the records that accept one. */
 		ttl: "number.integer >= 1 = 1",
-		/** Default proxy flag, where the provider has one (Cloudflare). */
-		proxied: "boolean = false",
-		/** Tell Telegram about a change, and about an update that failed. */
-		notify: "boolean = true",
 		accounts: ddnsAccountSchema.array().default(() => []),
 		domains: ddnsDomainSchema.array().default(() => [])
 	}).onUndeclaredKey("reject");
@@ -623,7 +619,25 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		/** Account ids whose credentials are stored. */
 		credentials: type("string[]")
 	});
-	ddnsCredentialsSchema = type({ credentials: type("Record<string, string>") }).onUndeclaredKey("reject");
+	ddnsCredentialsSchema = type({
+		provider: "string >= 1",
+		credentials: type("Record<string, string>")
+	}).onUndeclaredKey("reject");
+	ddnsPatchSchema = type({
+		enabled: "boolean?",
+		intervalMs: "number >= 60000?",
+		ipv4: type({
+			enabled: "boolean?",
+			url: "string?"
+		}).onUndeclaredKey("reject").optional(),
+		ipv6: type({
+			enabled: "boolean?",
+			url: "string?"
+		}).onUndeclaredKey("reject").optional(),
+		ttl: "number.integer >= 1?",
+		accounts: ddnsAccountSchema.array().optional(),
+		domains: ddnsDomainSchema.array().optional()
+	}).onUndeclaredKey("reject");
 	backupsSchema = type({
 		enabled: "boolean = true",
 		dir: "string = \".backups\"",
@@ -807,7 +821,9 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		logs: logsPatchSchema.optional(),
 		notifications: notificationsPatchSchema.optional(),
 		host: hostPatchSchema.optional(),
-		backups: backupsPatchSchema.optional()
+		backups: backupsPatchSchema.optional(),
+		/** Replaces the DDNS lists; see `ddnsPatchSchema`. */
+		ddns: ddnsPatchSchema.optional()
 	}).onUndeclaredKey("reject");
 	authStatusSchema = type({
 		enabled: "boolean",
@@ -943,6 +959,8 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 	});
 	backupPathSchema = type({
 		path: "string",
+		/** Which item this path is in a backup's `include`; `data:<path>`. */
+		id: "string?",
 		/** Who declared it: `global`, `<serverId>:backupPaths` or `<serverId>:<ENV>`. */
 		origin: "string",
 		/** false when a parent path already covers it, or it would swallow the archive dir. */
@@ -986,9 +1004,12 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		reloaded: "boolean",
 		error: "string?"
 	});
-	backupCreateSchema = type({ 
-	/** Optional: encrypts the archive. Never stored. */
-password: passwordValueSchema.optional() }).onUndeclaredKey("reject");
+	backupCreateSchema = type({
+		/** Optional: encrypts the archive. Never stored. */
+		password: passwordValueSchema.optional(),
+		/** Item ids to capture (`config`, `secrets`, `tls`, `data:<path>`); omitted means everything. */
+		include: type("string[] >= 1").optional()
+	}).onUndeclaredKey("reject");
 	restoreRequestSchema = type({
 		name: "string?",
 		password: passwordValueSchema.optional(),
@@ -1243,6 +1264,12 @@ function writeFileAtomic(file, content, options = {}) {
 }
 var init_atomic = __esmMin((() => {}));
 //#endregion
+//#region src/helpers/logger.ts
+var logger;
+var init_logger = __esmMin((() => {
+	logger = createConsola({ level: isDevelopment ? LogLevels.debug : void 0 });
+}));
+//#endregion
 //#region src/config/secrets.ts
 function deriveKey(password, salt, cost, keylen) {
 	return crypto.scryptSync(password.normalize("NFKC"), salt, keylen, { ...cost });
@@ -1291,24 +1318,104 @@ function apiTokenRecord(token, now = Date.now()) {
 		updatedAt: now
 	};
 }
-/**
-* Only account → string map → string survives; a hand-edited file with a number
-* or a nested object in there reads as "no credentials" instead of throwing.
-*/
-function readDdnsCredentials(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return {};
+function isRecord$3(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** A field map: strings only, empty values dropped; anything else reads as absent. */
+function readDdnsValues(value) {
+	if (!isRecord$3(value)) return {};
+	const out = {};
+	for (const [key, field] of Object.entries(value)) if (typeof field === "string" && field.length > 0) out[key] = field;
+	return out;
+}
+function isSealedDdns(value) {
+	return isRecord$3(value) && value.algo === DDNS_SEALED_ALGO && typeof value.iv === "string" && typeof value.tag === "string" && typeof value.data === "string";
+}
+function isPlainDdns(value) {
+	return "plain" in value;
+}
+/** Every shape this file has held: sealed, `{ provider, values }`, or a bare field map. */
+function readStoredDdns(value) {
+	if (!isRecord$3(value)) return {};
 	const out = {};
-	for (const [accountId, fields] of Object.entries(value)) {
-		if (typeof fields !== "object" || fields === null || Array.isArray(fields)) continue;
-		const record = {};
-		for (const [key, field] of Object.entries(fields)) if (typeof field === "string" && field.length > 0) record[key] = field;
-		if (Object.keys(record).length > 0) out[accountId] = record;
+	for (const [accountId, entry] of Object.entries(value)) {
+		if (isSealedDdns(entry)) {
+			out[accountId] = entry;
+			continue;
+		}
+		if (!isRecord$3(entry)) continue;
+		const values = readDdnsValues("values" in entry ? entry.values : entry);
+		if (Object.keys(values).length === 0) continue;
+		out[accountId] = {
+			plain: true,
+			provider: typeof entry.provider === "string" ? entry.provider : "",
+			values
+		};
 	}
 	return out;
 }
-var COST, KEYLEN, SALT_BYTES, API_TOKEN_BYTES, API_TOKEN_HINT_CHARS, SecretsStore;
+function readDdnsKdf(value) {
+	if (!isRecord$3(value) || value.algo !== "scrypt" || typeof value.salt !== "string") return null;
+	const cost = isRecord$3(value.cost) ? value.cost : {};
+	const N = Number(cost.N);
+	const r = Number(cost.r);
+	const p = Number(cost.p);
+	if (!Number.isInteger(N) || !Number.isInteger(r) || !Number.isInteger(p) || N < 2 || r < 1 || p < 1) return null;
+	return {
+		algo: "scrypt",
+		cost: {
+			N,
+			r,
+			p
+		},
+		salt: value.salt
+	};
+}
+function newDdnsKdf() {
+	return {
+		algo: "scrypt",
+		cost: { ...COST },
+		salt: crypto.randomBytes(SALT_BYTES).toString("base64")
+	};
+}
+/** The account id is the AAD, so a sealed entry cannot be moved to another account. */
+function ddnsAad(accountId) {
+	return Buffer$1.from(`${DDNS_AAD_PREFIX}${accountId}`, "utf8");
+}
+function sealDdns(accountId, record, key) {
+	const iv = crypto.randomBytes(DDNS_IV_BYTES);
+	const cipher = crypto.createCipheriv(DDNS_SEALED_ALGO, key, iv);
+	cipher.setAAD(ddnsAad(accountId));
+	const data = Buffer$1.concat([cipher.update(JSON.stringify(record), "utf8"), cipher.final()]);
+	return {
+		algo: DDNS_SEALED_ALGO,
+		iv: iv.toString("base64"),
+		tag: cipher.getAuthTag().toString("base64"),
+		data: data.toString("base64")
+	};
+}
+/** Null when the tag does not verify: a different secret, or a file somebody edited. */
+function openDdns(accountId, sealed, key) {
+	try {
+		const decipher = crypto.createDecipheriv(DDNS_SEALED_ALGO, key, Buffer$1.from(sealed.iv, "base64"));
+		decipher.setAAD(ddnsAad(accountId));
+		decipher.setAuthTag(Buffer$1.from(sealed.tag, "base64"));
+		const plain = Buffer$1.concat([decipher.update(Buffer$1.from(sealed.data, "base64")), decipher.final()]).toString("utf8");
+		const parsed = JSON.parse(plain);
+		if (typeof parsed?.provider !== "string") return null;
+		const values = readDdnsValues(parsed.values);
+		return Object.keys(values).length === 0 ? null : {
+			provider: parsed.provider,
+			values
+		};
+	} catch {
+		return null;
+	}
+}
+var COST, KEYLEN, SALT_BYTES, DDNS_KEYLEN, DDNS_IV_BYTES, DDNS_AAD_PREFIX, DDNS_SEALED_ALGO, API_TOKEN_BYTES, API_TOKEN_HINT_CHARS, SecretsStore;
 var init_secrets = __esmMin((() => {
 	init_atomic();
+	init_logger();
 	COST = {
 		N: 16384,
 		r: 8,
@@ -1316,14 +1423,23 @@ var init_secrets = __esmMin((() => {
 	};
 	KEYLEN = 64;
 	SALT_BYTES = 16;
+	DDNS_KEYLEN = 32;
+	DDNS_IV_BYTES = 12;
+	DDNS_AAD_PREFIX = "hh-ddns-v1:";
+	DDNS_SEALED_ALGO = "aes-256-gcm";
 	API_TOKEN_BYTES = 32;
 	API_TOKEN_HINT_CHARS = 8;
 	SecretsStore = class {
 		file;
 		cache = null;
 		cacheKey = "";
-		constructor(file) {
+		ddnsKeyCache = null;
+		warnedAccounts = /* @__PURE__ */ new Set();
+		ddnsSecret;
+		constructor(file, ddnsSecret) {
 			this.file = file;
+			const candidate = (ddnsSecret ?? process.env.HHOSTED_DDNS_SECRET ?? "").trim();
+			this.ddnsSecret = candidate.length > 0 ? candidate : "hh";
 		}
 		get path() {
 			return this.file;
@@ -1416,38 +1532,98 @@ var init_secrets = __esmMin((() => {
 				telegram: trimmed.length > 0 ? { botToken: trimmed } : null
 			});
 		}
-		getDdnsCredentials(accountId) {
-			return this.load().ddns[accountId] ?? null;
-		}
+		/** Ids that have something stored, whether or not a config still declares them. */
 		get ddnsAccountIds() {
 			return Object.keys(this.load().ddns);
 		}
+		/**
+		* Null when nothing is stored, when the entry belongs to a different provider,
+		* or when the secret cannot open it.
+		*/
+		getDdnsCredentials(accountId, provider) {
+			const stored = this.load().ddns[accountId];
+			if (stored === void 0) return null;
+			const record = this.openStored(accountId, stored);
+			if (record === null) return null;
+			return record.provider.length > 0 && record.provider !== provider ? null : record;
+		}
 		/** An empty field is dropped, so clearing every field forgets the account. */
-		setDdnsCredentials(accountId, credentials) {
-			const entries = Object.entries(credentials).map(([key, value]) => [key, value.trim()]).filter(([, value]) => value.length > 0);
-			const ddns = { ...this.load().ddns };
-			if (entries.length === 0) delete ddns[accountId];
-			else ddns[accountId] = Object.fromEntries(entries);
+		setDdnsCredentials(accountId, provider, credentials) {
+			const current = this.load();
+			const values = readDdnsValues(credentials);
+			const ddns = { ...current.ddns };
+			if (Object.keys(values).length === 0) delete ddns[accountId];
+			else ddns[accountId] = {
+				plain: true,
+				provider,
+				values
+			};
 			this.save({
-				...this.load(),
+				...current,
 				ddns
 			});
 		}
 		clearDdnsCredentials(accountId) {
-			const ddns = { ...this.load().ddns };
+			const current = this.load();
+			if (current.ddns[accountId] === void 0) return;
+			const ddns = { ...current.ddns };
 			delete ddns[accountId];
 			this.save({
-				...this.load(),
+				...current,
 				ddns
 			});
 		}
+		/** Keeps only the accounts a config still declares; returns how many were dropped. */
+		pruneDdnsCredentials(keep) {
+			const wanted = new Set(keep);
+			const current = this.load();
+			const removed = Object.keys(current.ddns).filter((id) => !wanted.has(id));
+			if (removed.length === 0) return 0;
+			const ddns = { ...current.ddns };
+			for (const id of removed) delete ddns[id];
+			this.save({
+				...current,
+				ddns
+			});
+			return removed.length;
+		}
+		openStored(accountId, stored) {
+			if (isPlainDdns(stored)) return {
+				provider: stored.provider,
+				values: stored.values
+			};
+			const kdf = this.load().ddnsKdf;
+			if (kdf === null) {
+				this.warnOnce(accountId, "the file carries no key parameters");
+				return null;
+			}
+			const record = openDdns(accountId, stored, this.ddnsKey(kdf));
+			if (record === null) this.warnOnce(accountId, `the entry could not be opened — is HHOSTED_DDNS_SECRET still the one it was sealed with?`);
+			return record;
+		}
+		/** One derivation per file salt, cached for the life of the process. */
+		ddnsKey(kdf) {
+			if (this.ddnsKeyCache?.salt === kdf.salt) return this.ddnsKeyCache.key;
+			const key = deriveKey(this.ddnsSecret, Buffer$1.from(kdf.salt, "base64"), kdf.cost, DDNS_KEYLEN);
+			this.ddnsKeyCache = {
+				salt: kdf.salt,
+				key
+			};
+			return key;
+		}
+		warnOnce(accountId, reason) {
+			if (this.warnedAccounts.has(accountId)) return;
+			this.warnedAccounts.add(accountId);
+			logger.warn(`ddns: cannot read the credentials for "${accountId}" — ${reason}`);
+		}
 		read() {
 			if (!fs.existsSync(this.file)) return {
 				version: 3,
 				password: null,
 				apiToken: null,
 				telegram: null,
-				ddns: {}
+				ddns: {},
+				ddnsKdf: null
 			};
 			try {
 				const parsed = JSON.parse(fs.readFileSync(this.file, "utf8"));
@@ -1456,7 +1632,8 @@ var init_secrets = __esmMin((() => {
 					password: parsed?.password ?? null,
 					apiToken: parsed?.apiToken?.hash ? parsed.apiToken : null,
 					telegram: parsed?.telegram?.botToken ? { botToken: parsed.telegram.botToken } : null,
-					ddns: readDdnsCredentials(parsed?.ddns)
+					ddns: readStoredDdns(parsed?.ddns),
+					ddnsKdf: readDdnsKdf(parsed?.ddnsKdf)
 				};
 			} catch {
 				return {
@@ -1464,13 +1641,32 @@ var init_secrets = __esmMin((() => {
 					password: null,
 					apiToken: null,
 					telegram: null,
-					ddns: {}
+					ddns: {},
+					ddnsKdf: null
 				};
 			}
 		}
 		save(contents) {
-			writeFileAtomic(this.file, `${JSON.stringify(contents, null, 2)}\n`, { mode: 384 });
-			this.cache = contents;
+			const sealed = this.sealStored(contents);
+			writeFileAtomic(this.file, `${JSON.stringify(sealed, null, 2)}\n`, { mode: 384 });
+			this.cache = sealed;
+		}
+		/** Any write seals the entries still sitting in the clear, so the file never keeps both. */
+		sealStored(contents) {
+			const plain = Object.entries(contents.ddns).filter((entry) => isPlainDdns(entry[1]));
+			if (plain.length === 0) return contents;
+			const kdf = contents.ddnsKdf ?? newDdnsKdf();
+			const key = this.ddnsKey(kdf);
+			const ddns = { ...contents.ddns };
+			for (const [accountId, record] of plain) ddns[accountId] = sealDdns(accountId, {
+				provider: record.provider,
+				values: record.values
+			}, key);
+			return {
+				...contents,
+				ddns,
+				ddnsKdf: kdf
+			};
 		}
 	};
 }));
@@ -1975,12 +2171,6 @@ var init_$_routes$1 = __esmMin((() => {
 	init_contracts();
 }));
 //#endregion
-//#region src/helpers/logger.ts
-var logger;
-var init_logger = __esmMin((() => {
-	logger = createConsola({ level: isDevelopment ? LogLevels.debug : void 0 });
-}));
-//#endregion
 //#region src/helpers/validate.ts
 /**
 * Validates a value that is not a request target (a query string, a URL
@@ -2110,7 +2300,10 @@ function buildBackupsView(store, backups) {
 		dir: backups.directory,
 		keep: store.config.backups.keep,
 		includePaths: store.config.backups.includePaths,
-		paths: backups.paths,
+		paths: backups.paths.map((entry) => ({
+			...entry,
+			id: `data:${entry.path}`
+		})),
 		files: backups.list()
 	};
 }
@@ -2166,7 +2359,10 @@ function createBackupsRoute(deps) {
 		}
 	}), validate("json", backupCreateSchema), async (c) => {
 		const body = c.req.valid("json");
-		const result = await deps.backups.create({ password: body.password });
+		const result = await deps.backups.create({
+			password: body.password,
+			include: body.include
+		});
 		if (!result.ok) throw backupFailed(result.error);
 		return c.json({
 			file: result.file,
@@ -2681,473 +2877,139 @@ var init_seed = __esmMin((() => {
 	};
 }));
 //#endregion
-//#region src/config/store.ts
-function formatErrors(errors) {
-	return errors.summary;
+//#region src/providers/ddns/types.ts
+function succeeded(message, changed) {
+	return {
+		ok: true,
+		changed,
+		message
+	};
 }
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
+function failed(error) {
+	return {
+		ok: false,
+		changed: false,
+		message: error,
+		error
+	};
 }
-function applyPatch(target, patch, mergeKeys) {
-	for (const [key, value] of Object.entries(patch)) {
-		if (value === void 0) continue;
-		if (mergeKeys.has(key) && isRecord(value) && isRecord(target[key])) {
-			target[key] = mergeGroup(target[key], value);
-			continue;
+/** Missing required credential keys, as a sentence for the settings page. */
+function missingFields(credentials, keys) {
+	const missing = keys.filter((key) => (credentials?.[key] ?? "").trim().length === 0);
+	return missing.length === 0 ? null : `set ${missing.join(", ")}`;
+}
+function basicAuth(user, password) {
+	return `Basic ${Buffer$1.from(`${user}:${password}`, "utf8").toString("base64")}`;
+}
+/** A provider error body is useful, but never worth throwing over. */
+async function errorText(response, limit = 300) {
+	try {
+		const text = (await response.text()).replace(/\s+/g, " ").trim();
+		return text.length === 0 ? `HTTP ${response.status}` : `HTTP ${response.status}: ${text.slice(0, limit)}`;
+	} catch {
+		return `HTTP ${response.status}`;
+	}
+}
+/** `Sub.Domain.COM.` -> `sub.domain.com`; DuckDNS and friends are case-insensitive. */
+function normalizeHost(host) {
+	return host.trim().toLowerCase().replace(NORMALIZE_DOTS, "");
+}
+var NORMALIZE_DOTS;
+var init_types = __esmMin((() => {
+	NORMALIZE_DOTS = /\.$/;
+}));
+//#endregion
+//#region src/providers/ddns/cloudflare.ts
+function authHeaders(credentials) {
+	const token = (credentials.apiToken ?? "").trim();
+	if (token.length > 0) return { Authorization: `Bearer ${token}` };
+	const email = (credentials.email ?? "").trim();
+	const key = (credentials.apiKey ?? "").trim();
+	if (email.length > 0 && key.length > 0) return {
+		"X-Auth-Email": email,
+		"X-Auth-Key": key
+	};
+	return null;
+}
+async function call(path, headers, context, init = {}) {
+	try {
+		const response = await context.fetch(`${API$5}${path}`, {
+			...init,
+			headers: {
+				...headers,
+				"Content-Type": "application/json",
+				...init.headers ?? {}
+			},
+			signal: context.signal
+		});
+		const text = await response.text();
+		let parsed;
+		try {
+			parsed = JSON.parse(text);
+		} catch {
+			return {
+				data: null,
+				status: response.status,
+				error: `cloudflare answered ${response.status}: ${text.slice(0, 200)}`
+			};
 		}
-		target[key] = value;
+		if (!response.ok || parsed.success !== true) {
+			const detail = (parsed.errors ?? []).map((entry) => `${entry.code} ${entry.message}`).join("; ");
+			return {
+				data: parsed,
+				status: response.status,
+				error: detail.length > 0 ? detail : `HTTP ${response.status}`
+			};
+		}
+		return {
+			data: parsed,
+			status: response.status,
+			error: null
+		};
+	} catch (error) {
+		return {
+			data: null,
+			status: 0,
+			error: error instanceof Error ? error.message : String(error)
+		};
 	}
 }
 /**
-* Merges one nested group recursively — `health.http` is a group of its own, and
-* replacing it wholesale would silently reset the siblings a partial patch never
-* mentioned. An explicit `null` removes a key, which is how a schema-optional
-* field is cleared.
+* Walks the host's parents through `GET /zones?name=`, which is how the
+* reference image resolves a zone without a pasted zone id; the id is cached in
+* the panel's state file, so it usually costs nothing.
 */
-function mergeGroup(target, patch) {
-	const merged = { ...target };
-	for (const [key, value] of Object.entries(patch)) {
-		if (value === void 0) continue;
-		if (value === null) {
-			delete merged[key];
-			continue;
-		}
-		if (isRecord(value) && isRecord(merged[key])) {
-			merged[key] = mergeGroup(merged[key], value);
-			continue;
-		}
-		merged[key] = value;
+async function resolveZone(host, headers, context, cached) {
+	if (cached !== void 0) return {
+		id: cached,
+		name: host
+	};
+	const labels = host.split(".");
+	for (let index = 0; index <= labels.length - 2; index++) {
+		const candidate = labels.slice(index).join(".");
+		const { data, error } = await call(`/zones?name=${encodeURIComponent(candidate)}&per_page=1`, headers, context);
+		if (error !== null || data === null) throw new Error(error ?? "could not look up the zone");
+		const zone = data.result[0];
+		if (zone !== void 0) return zone;
 	}
-	return merged;
+	return null;
 }
-var SERVER_MERGE_KEYS, CONTROL_MERGE_KEYS, NOTIFICATION_MERGE_KEYS, EMPTY_MERGE_KEYS, ConfigError, ConfigStore;
-var init_store = __esmMin((() => {
-	init_migrations();
-	init_parse();
-	init_schema();
-	init_seed();
-	init_atomic();
-	init_paths();
-	SERVER_MERGE_KEYS = /* @__PURE__ */ new Set([
-		"restart",
-		"health",
-		"stop"
-	]);
-	CONTROL_MERGE_KEYS = /* @__PURE__ */ new Set(["auth", "tls"]);
-	NOTIFICATION_MERGE_KEYS = /* @__PURE__ */ new Set(["telegram"]);
-	EMPTY_MERGE_KEYS = /* @__PURE__ */ new Set();
-	ConfigError = class extends Error {
-		name = "ConfigError";
-	};
-	ConfigStore = class {
-		file;
-		seed;
-		raw = {};
-		/** The bytes behind the live config, so a watcher can tell a real edit from our own write. */
-		lastText = null;
-		resolvedConfig;
-		error = null;
-		warnings = [];
-		schemaVersion = 1;
-		listeners = /* @__PURE__ */ new Set();
-		constructor(file, seed = SEED_CONFIG) {
-			this.file = file;
-			this.seed = seed;
-		}
-		get path() {
-			return this.file;
-		}
-		get config() {
-			return this.resolvedConfig;
-		}
-		get configError() {
-			return this.error;
-		}
-		/** Keys a newer release wrote that this one ignores; nothing to refuse over. */
-		get configWarnings() {
-			return [...this.warnings];
-		}
-		/** The shape the file declares, as last read. */
-		get configSchemaVersion() {
-			return this.schemaVersion;
-		}
-		/** Steps that would have to run before this release could use the file. */
-		get pendingMigrations() {
-			return planConfigMigrations(this.schemaVersion).steps;
-		}
-		get servers() {
-			return this.resolvedConfig.servers;
-		}
-		get defaults() {
-			return this.resolvedConfig.defaults;
-		}
-		get rawConfig() {
-			return structuredClone(this.raw);
-		}
-		onChange(listener) {
-			this.listeners.add(listener);
-			return () => this.listeners.delete(listener);
-		}
-		getServer(id) {
-			return this.servers.find((server) => server.id === id);
-		}
-		/**
-		* Reads the file and tells the listeners, so whatever wrote it — the settings
-		* page, a restored backup, or the file watcher — becomes the live config.
-		*/
-		load() {
-			this.read();
-			this.notify();
-		}
-		/**
-		* The watcher's entry point: re-reads the file only when its bytes changed.
-		*
-		* `changed` means the file on disk is different from what the live config was
-		* read from, `applied` means that difference was accepted — a file this release
-		* cannot read is reported and the config already running is left alone, which is
-		* what keeps an editor's typo from stopping every server.
-		*/
-		reloadFromDisk() {
-			let text;
-			try {
-				text = fs.readFileSync(this.file, "utf8");
-			} catch {
-				this.error = `${path.basename(this.file)} is gone`;
-				return {
-					changed: false,
-					applied: false,
-					error: this.error
-				};
-			}
-			if (text === this.lastText) {
-				if (this.error !== null) {
-					this.error = null;
-					this.load();
-				}
-				return {
-					changed: false,
-					applied: false,
-					error: null
-				};
-			}
-			const before = this.resolvedConfig;
-			this.load();
-			return {
-				changed: true,
-				applied: this.resolvedConfig !== before,
-				error: this.error
-			};
-		}
-		read() {
-			if (!fs.existsSync(this.file)) {
-				const seed = stampConfig(structuredClone(this.seed));
-				const text = `${JSON.stringify(seed, null, 2)}\n`;
-				writeFileAtomic(this.file, text);
-				this.lastText = text;
-				this.raw = seed;
-				this.apply(seed);
-				return;
-			}
-			let text;
-			let parsed;
-			try {
-				text = fs.readFileSync(this.file, "utf8");
-				parsed = JSON.parse(text);
-			} catch (error) {
-				this.error = `cannot parse ${path.basename(this.file)}: ${error.message}`;
-				if (this.resolvedConfig === void 0) {
-					this.raw = {};
-					this.resolvedConfig = this.resolveFallback();
-				}
-				return;
-			}
-			this.lastText = text;
-			this.apply(parsed);
-		}
-		notify() {
-			for (const listener of this.listeners) listener();
-		}
-		updateServer(id, patch) {
-			const index = this.raw.servers?.findIndex((entry) => entry.id === id) ?? -1;
-			if (index < 0) throw new ConfigError(`unknown server "${id}"`);
-			const draft = structuredClone(this.raw);
-			const entry = draft.servers[index];
-			applyPatch(entry, patch, SERVER_MERGE_KEYS);
-			const validated = this.validateServer(entry, `servers[${index}]`);
-			this.commit(draft);
-			return validated;
-		}
-		updateControl(patch) {
-			const draft = structuredClone(this.raw);
-			draft.control = { ...draft.control ?? {} };
-			applyPatch(draft.control, patch, CONTROL_MERGE_KEYS);
-			const control = controlSchema(draft.control);
-			if (control instanceof type.errors) throw new ConfigError(`control: ${formatErrors(control)}`);
-			this.commit(draft);
-			return control;
-		}
-		updateLogs(patch) {
-			const draft = structuredClone(this.raw);
-			draft.logs = { ...draft.logs ?? {} };
-			applyPatch(draft.logs, patch, EMPTY_MERGE_KEYS);
-			const logs = logsSchema(draft.logs);
-			if (logs instanceof type.errors) throw new ConfigError(`logs: ${formatErrors(logs)}`);
-			this.commit(draft);
-			return logs;
-		}
-		updateNotifications(patch) {
-			const draft = structuredClone(this.raw);
-			draft.notifications = { ...draft.notifications ?? {} };
-			applyPatch(draft.notifications, patch, NOTIFICATION_MERGE_KEYS);
-			const notifications = notificationsSchema(draft.notifications);
-			if (notifications instanceof type.errors) throw new ConfigError(`notifications: ${formatErrors(notifications)}`);
-			this.commit(draft);
-			return notifications;
-		}
-		updateHost(patch) {
-			const draft = structuredClone(this.raw);
-			draft.host = { ...draft.host ?? {} };
-			applyPatch(draft.host, patch, EMPTY_MERGE_KEYS);
-			const host = hostSchema(draft.host);
-			if (host instanceof type.errors) throw new ConfigError(`host: ${formatErrors(host)}`);
-			this.commit(draft);
-			return host;
-		}
-		updateBackups(patch) {
-			const draft = structuredClone(this.raw);
-			draft.backups = { ...draft.backups ?? {} };
-			applyPatch(draft.backups, patch, EMPTY_MERGE_KEYS);
-			const backups = backupsSchema(draft.backups);
-			if (backups instanceof type.errors) throw new ConfigError(`backups: ${formatErrors(backups)}`);
-			this.commit(draft);
-			return backups;
-		}
-		/**
-		* The DDNS block is replaced as a whole: its accounts and domains are lists,
-		* and a key-by-key merge would leave a removed account or hostname behind.
-		*/
-		updateDdns(config) {
-			const parsed = ddnsConfigSchema(config);
-			if (parsed instanceof type.errors) throw new ConfigError(`ddns: ${formatErrors(parsed)}`);
-			const draft = structuredClone(this.raw);
-			draft.ddns = parsed;
-			this.commit(draft);
-			return parsed;
-		}
-		updateDefaults(patch) {
-			const draft = structuredClone(this.raw);
-			draft.defaults = { ...draft.defaults ?? {} };
-			applyPatch(draft.defaults, patch, SERVER_MERGE_KEYS);
-			const defaults = defaultsSchema(draft.defaults);
-			if (defaults instanceof type.errors) throw new ConfigError(`defaults: ${formatErrors(defaults)}`);
-			this.commit(draft);
-			return defaults;
-		}
-		addServer(input) {
-			const draft = structuredClone(this.raw);
-			draft.servers ??= [];
-			if (draft.servers.some((entry) => entry.id === input.id)) throw new ConfigError(`server "${String(input.id)}" already exists`);
-			const index = draft.servers.length;
-			draft.servers.push(structuredClone(input));
-			const validated = this.validateServer(draft.servers[index], `servers[${index}]`);
-			this.commit(draft);
-			return validated;
-		}
-		removeServer(id) {
-			const draft = structuredClone(this.raw);
-			const before = draft.servers?.length ?? 0;
-			draft.servers = (draft.servers ?? []).filter((entry) => entry.id !== id);
-			if (draft.servers.length === before) throw new ConfigError(`unknown server "${id}"`);
-			this.commit(draft);
-		}
-		/** Regenerates `servers.config.schema.json` for editor autocomplete. */
-		writeJsonSchema() {
-			const schema = JSON.stringify(configSchema.toJsonSchema(), null, 2);
-			if ((fs.existsSync(configSchemaPath) ? fs.readFileSync(configSchemaPath, "utf8") : null) !== schema) writeFileAtomic(configSchemaPath, schema);
-		}
-		validateServer(entry, label) {
-			const parsed = serverSchema(mergeDefaults(this.defaults, entry));
-			if (parsed instanceof type.errors) throw new ConfigError(`${label}: ${formatErrors(parsed)}`);
-			return {
-				...parsed,
-				port: parsed.port ?? null
-			};
-		}
-		commit(draft) {
-			const stamped = stampConfig(draft);
-			const text = `${JSON.stringify(stamped, null, 2)}\n`;
-			writeFileAtomic(this.file, text);
-			this.lastText = text;
-			this.raw = stamped;
-			this.apply(stamped);
-			this.notify();
-		}
-		resolveFallback() {
-			const control = controlSchema({});
-			const defaults = defaultsSchema({});
-			if (control instanceof type.errors || defaults instanceof type.errors) throw new ConfigError("internal: default config failed validation");
-			const logs = logsSchema({});
-			const notifications = notificationsSchema({});
-			const host = hostSchema({});
-			const backups = backupsSchema({});
-			const ddns = ddnsConfigSchema({});
-			if (logs instanceof type.errors || notifications instanceof type.errors || host instanceof type.errors || backups instanceof type.errors || ddns instanceof type.errors) throw new ConfigError("internal: default settings failed validation");
-			return {
-				control,
-				defaults,
-				logs,
-				notifications,
-				host,
-				backups,
-				ddns,
-				servers: []
-			};
-		}
-		apply(raw) {
-			this.raw = raw;
-			const parsed = parseConfig(raw);
-			this.error = parsed.errors.length > 0 ? parsed.errors.join("; ") : null;
-			this.schemaVersion = parsed.schemaVersion;
-			this.warnings = [...parsed.warnings, ...parsed.unknownKeys.length === 0 ? [] : [`${path.basename(this.file)} carries ${parsed.unknownKeys.length} unrecognized key(s) this release ignores: ${parsed.unknownKeys.join(", ")}`]];
-			if (parsed.config !== null) this.resolvedConfig = parsed.config;
-			else if (this.resolvedConfig === void 0) this.resolvedConfig = this.resolveFallback();
-		}
-	};
-}));
-//#endregion
-//#region src/providers/ddns/types.ts
-function succeeded(message, changed) {
-	return {
-		ok: true,
-		changed,
-		message
-	};
-}
-function failed(error) {
-	return {
-		ok: false,
-		changed: false,
-		message: error,
-		error
-	};
-}
-/** Missing required credential keys, as a sentence for the settings page. */
-function missingFields(credentials, keys) {
-	const missing = keys.filter((key) => (credentials?.[key] ?? "").trim().length === 0);
-	return missing.length === 0 ? null : `set ${missing.join(", ")}`;
-}
-function basicAuth(user, password) {
-	return `Basic ${Buffer$1.from(`${user}:${password}`, "utf8").toString("base64")}`;
-}
-/** A provider error body is useful, but never worth throwing over. */
-async function errorText(response, limit = 300) {
-	try {
-		const text = (await response.text()).replace(/\s+/g, " ").trim();
-		return text.length === 0 ? `HTTP ${response.status}` : `HTTP ${response.status}: ${text.slice(0, limit)}`;
-	} catch {
-		return `HTTP ${response.status}`;
-	}
-}
-/** `Sub.Domain.COM.` -> `sub.domain.com`; DuckDNS and friends are case-insensitive. */
-function normalizeHost(host) {
-	return host.trim().toLowerCase().replace(NORMALIZE_DOTS, "");
-}
-var NORMALIZE_DOTS;
-var init_types = __esmMin((() => {
-	NORMALIZE_DOTS = /\.$/;
-}));
-//#endregion
-//#region src/providers/ddns/cloudflare.ts
-function authHeaders(credentials) {
-	const token = (credentials.apiToken ?? "").trim();
-	if (token.length > 0) return { Authorization: `Bearer ${token}` };
-	const email = (credentials.email ?? "").trim();
-	const key = (credentials.apiKey ?? "").trim();
-	if (email.length > 0 && key.length > 0) return {
-		"X-Auth-Email": email,
-		"X-Auth-Key": key
-	};
-	return null;
-}
-async function call(path, headers, context, init = {}) {
-	try {
-		const response = await context.fetch(`${API$5}${path}`, {
-			...init,
-			headers: {
-				...headers,
-				"Content-Type": "application/json",
-				...init.headers ?? {}
-			},
-			signal: context.signal
-		});
-		const text = await response.text();
-		let parsed;
-		try {
-			parsed = JSON.parse(text);
-		} catch {
-			return {
-				data: null,
-				status: response.status,
-				error: `cloudflare answered ${response.status}: ${text.slice(0, 200)}`
-			};
-		}
-		if (!response.ok || parsed.success !== true) {
-			const detail = (parsed.errors ?? []).map((entry) => `${entry.code} ${entry.message}`).join("; ");
-			return {
-				data: parsed,
-				status: response.status,
-				error: detail.length > 0 ? detail : `HTTP ${response.status}`
-			};
-		}
-		return {
-			data: parsed,
-			status: response.status,
-			error: null
-		};
-	} catch (error) {
-		return {
-			data: null,
-			status: 0,
-			error: error instanceof Error ? error.message : String(error)
-		};
-	}
-}
-/**
-* Walks the host's parents through `GET /zones?name=`, which is how the
-* reference image resolves a zone without a pasted zone id; the id is cached in
-* the panel's state file, so it usually costs nothing.
-*/
-async function resolveZone(host, headers, context, cached) {
-	if (cached !== void 0) return {
-		id: cached,
-		name: host
-	};
-	const labels = host.split(".");
-	for (let index = 0; index <= labels.length - 2; index++) {
-		const candidate = labels.slice(index).join(".");
-		const { data, error } = await call(`/zones?name=${encodeURIComponent(candidate)}&per_page=1`, headers, context);
-		if (error !== null || data === null) throw new Error(error ?? "could not look up the zone");
-		const zone = data.result[0];
-		if (zone !== void 0) return zone;
-	}
-	return null;
-}
-async function findRecord(zoneId, record, headers, context, cached) {
-	if (cached !== void 0) {
-		const fetched = await call(`/zones/${zoneId}/dns_records/${cached}`, headers, context);
-		if (fetched.error === null && fetched.data !== null) return {
-			record: fetched.data.result,
-			error: null
-		};
-		if (fetched.status !== 404 && fetched.status !== 400) return {
-			record: null,
-			error: fetched.error
-		};
-	}
-	const listed = await call(`/zones/${zoneId}/dns_records?type=${record.type}&name=${encodeURIComponent(record.host)}&per_page=100`, headers, context);
-	if (listed.error !== null) return {
-		record: null,
-		error: listed.error
+async function findRecord(zoneId, record, headers, context, cached) {
+	if (cached !== void 0) {
+		const fetched = await call(`/zones/${zoneId}/dns_records/${cached}`, headers, context);
+		if (fetched.error === null && fetched.data !== null) return {
+			record: fetched.data.result,
+			error: null
+		};
+		if (fetched.status !== 404 && fetched.status !== 400) return {
+			record: null,
+			error: fetched.error
+		};
+	}
+	const listed = await call(`/zones/${zoneId}/dns_records?type=${record.type}&name=${encodeURIComponent(record.host)}&per_page=100`, headers, context);
+	if (listed.error !== null) return {
+		record: null,
+		error: listed.error
 	};
 	return {
 		record: (listed.data?.result ?? []).find((entry) => entry.id !== void 0) ?? null,
@@ -4088,91 +3950,434 @@ var init_spaceship = __esmMin((() => {
 				if (!written.ok) return failed(await errorText(written));
 				return succeeded(`set ${record.host} ${record.type} to ${record.ip}`, true);
 			} catch (error) {
-				return failed(error instanceof Error ? error.message : String(error));
+				return failed(error instanceof Error ? error.message : String(error));
+			}
+		}
+	};
+}));
+//#endregion
+//#region src/providers/ddns/index.ts
+function ddnsProvider(id) {
+	return BY_ID.get(id) ?? null;
+}
+function ddnsProviderInfos() {
+	return DDNS_PROVIDERS.map((provider) => ({
+		id: provider.id,
+		label: provider.label,
+		docsUrl: provider.docsUrl,
+		families: provider.families,
+		fields: provider.fields,
+		ttl: provider.ttl,
+		proxied: provider.proxied
+	}));
+}
+/**
+* Cross-field problems ArkType cannot see. Credentials are deliberately not
+* required here: an account is normally added before its secret is typed in,
+* and a missing secret is reported per record instead of blocking the save.
+*/
+function validateDdnsConfig(config) {
+	const errors = [];
+	const seenAccounts = /* @__PURE__ */ new Set();
+	for (const account of config.accounts) {
+		if (seenAccounts.has(account.id)) {
+			errors.push(`account "${account.id}" is declared twice`);
+			continue;
+		}
+		seenAccounts.add(account.id);
+		if (ddnsProvider(account.provider) === null) errors.push(`account "${account.id}" uses an unknown provider "${account.provider}"`);
+	}
+	const seenRecords = /* @__PURE__ */ new Set();
+	for (const domain of config.domains) {
+		const account = config.accounts.find((entry) => entry.id === domain.account);
+		if (account === void 0) {
+			errors.push(`"${domain.host}" points at unknown account "${domain.account}"`);
+			continue;
+		}
+		const provider = ddnsProvider(account.provider);
+		if (provider !== null) for (const recordType of domain.types) {
+			if (!provider.families.includes(recordType)) errors.push(`${account.label || provider.label} cannot manage ${recordType} records ("${domain.host}")`);
+			const key = `${domain.host.toLowerCase()}|${recordType}`;
+			if (seenRecords.has(key)) errors.push(`"${domain.host}" asks for ${recordType} twice`);
+			seenRecords.add(key);
+		}
+	}
+	return errors;
+}
+var DDNS_PROVIDERS, BY_ID;
+var init_ddns$2 = __esmMin((() => {
+	init_cloudflare();
+	init_desec();
+	init_digitalocean();
+	init_duckdns();
+	init_dynu();
+	init_freedns();
+	init_gandi();
+	init_godaddy();
+	init_henet();
+	init_namecheap();
+	init_noip();
+	init_porkbun();
+	init_spaceship();
+	DDNS_PROVIDERS = [
+		cloudflareProvider,
+		namecheapProvider,
+		spaceshipProvider,
+		porkbunProvider,
+		godaddyProvider,
+		gandiProvider,
+		digitaloceanProvider,
+		desecProvider,
+		duckdnsProvider,
+		noipProvider,
+		dynuProvider,
+		henetProvider,
+		freednsProvider
+	];
+	BY_ID = new Map(DDNS_PROVIDERS.map((provider) => [provider.id, provider]));
+}));
+//#endregion
+//#region src/config/store.ts
+function formatErrors(errors) {
+	return errors.summary;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function applyPatch(target, patch, mergeKeys) {
+	for (const [key, value] of Object.entries(patch)) {
+		if (value === void 0) continue;
+		if (mergeKeys.has(key) && isRecord(value) && isRecord(target[key])) {
+			target[key] = mergeGroup(target[key], value);
+			continue;
+		}
+		target[key] = value;
+	}
+}
+/**
+* Merges one nested group recursively — `health.http` is a group of its own, and
+* replacing it wholesale would silently reset the siblings a partial patch never
+* mentioned. An explicit `null` removes a key, which is how a schema-optional
+* field is cleared.
+*/
+function mergeGroup(target, patch) {
+	const merged = { ...target };
+	for (const [key, value] of Object.entries(patch)) {
+		if (value === void 0) continue;
+		if (value === null) {
+			delete merged[key];
+			continue;
+		}
+		if (isRecord(value) && isRecord(merged[key])) {
+			merged[key] = mergeGroup(merged[key], value);
+			continue;
+		}
+		merged[key] = value;
+	}
+	return merged;
+}
+var SERVER_MERGE_KEYS, CONTROL_MERGE_KEYS, NOTIFICATION_MERGE_KEYS, DDNS_MERGE_KEYS, EMPTY_MERGE_KEYS, ConfigError, ConfigStore;
+var init_store = __esmMin((() => {
+	init_migrations();
+	init_parse();
+	init_schema();
+	init_seed();
+	init_atomic();
+	init_paths();
+	init_ddns$2();
+	SERVER_MERGE_KEYS = /* @__PURE__ */ new Set([
+		"restart",
+		"health",
+		"stop"
+	]);
+	CONTROL_MERGE_KEYS = /* @__PURE__ */ new Set(["auth", "tls"]);
+	NOTIFICATION_MERGE_KEYS = /* @__PURE__ */ new Set(["telegram"]);
+	DDNS_MERGE_KEYS = /* @__PURE__ */ new Set(["ipv4", "ipv6"]);
+	EMPTY_MERGE_KEYS = /* @__PURE__ */ new Set();
+	ConfigError = class extends Error {
+		name = "ConfigError";
+	};
+	ConfigStore = class {
+		file;
+		seed;
+		raw = {};
+		/** The bytes behind the live config, so a watcher can tell a real edit from our own write. */
+		lastText = null;
+		resolvedConfig;
+		error = null;
+		warnings = [];
+		schemaVersion = 1;
+		listeners = /* @__PURE__ */ new Set();
+		constructor(file, seed = SEED_CONFIG) {
+			this.file = file;
+			this.seed = seed;
+		}
+		get path() {
+			return this.file;
+		}
+		get config() {
+			return this.resolvedConfig;
+		}
+		get configError() {
+			return this.error;
+		}
+		/** Keys a newer release wrote that this one ignores; nothing to refuse over. */
+		get configWarnings() {
+			return [...this.warnings];
+		}
+		/** The shape the file declares, as last read. */
+		get configSchemaVersion() {
+			return this.schemaVersion;
+		}
+		/** Steps that would have to run before this release could use the file. */
+		get pendingMigrations() {
+			return planConfigMigrations(this.schemaVersion).steps;
+		}
+		get servers() {
+			return this.resolvedConfig.servers;
+		}
+		get defaults() {
+			return this.resolvedConfig.defaults;
+		}
+		get rawConfig() {
+			return structuredClone(this.raw);
+		}
+		onChange(listener) {
+			this.listeners.add(listener);
+			return () => this.listeners.delete(listener);
+		}
+		getServer(id) {
+			return this.servers.find((server) => server.id === id);
+		}
+		/**
+		* Reads the file and tells the listeners, so whatever wrote it — the settings
+		* page, a restored backup, or the file watcher — becomes the live config.
+		*/
+		load() {
+			this.read();
+			this.notify();
+		}
+		/**
+		* The watcher's entry point: re-reads the file only when its bytes changed.
+		*
+		* `changed` means the file on disk is different from what the live config was
+		* read from, `applied` means that difference was accepted — a file this release
+		* cannot read is reported and the config already running is left alone, which is
+		* what keeps an editor's typo from stopping every server.
+		*/
+		reloadFromDisk() {
+			let text;
+			try {
+				text = fs.readFileSync(this.file, "utf8");
+			} catch {
+				this.error = `${path.basename(this.file)} is gone`;
+				return {
+					changed: false,
+					applied: false,
+					error: this.error
+				};
+			}
+			if (text === this.lastText) {
+				if (this.error !== null) {
+					this.error = null;
+					this.load();
+				}
+				return {
+					changed: false,
+					applied: false,
+					error: null
+				};
+			}
+			const before = this.resolvedConfig;
+			this.load();
+			return {
+				changed: true,
+				applied: this.resolvedConfig !== before,
+				error: this.error
+			};
+		}
+		read() {
+			if (!fs.existsSync(this.file)) {
+				const seed = stampConfig(structuredClone(this.seed));
+				const text = `${JSON.stringify(seed, null, 2)}\n`;
+				writeFileAtomic(this.file, text);
+				this.lastText = text;
+				this.raw = seed;
+				this.apply(seed);
+				return;
+			}
+			let text;
+			let parsed;
+			try {
+				text = fs.readFileSync(this.file, "utf8");
+				parsed = JSON.parse(text);
+			} catch (error) {
+				this.error = `cannot parse ${path.basename(this.file)}: ${error.message}`;
+				if (this.resolvedConfig === void 0) {
+					this.raw = {};
+					this.resolvedConfig = this.resolveFallback();
+				}
+				return;
 			}
+			this.lastText = text;
+			this.apply(parsed);
 		}
-	};
-}));
-//#endregion
-//#region src/providers/ddns/index.ts
-function ddnsProvider(id) {
-	return BY_ID.get(id) ?? null;
-}
-function ddnsProviderInfos() {
-	return DDNS_PROVIDERS.map((provider) => ({
-		id: provider.id,
-		label: provider.label,
-		docsUrl: provider.docsUrl,
-		families: provider.families,
-		fields: provider.fields,
-		ttl: provider.ttl,
-		proxied: provider.proxied
-	}));
-}
-/**
-* Cross-field problems ArkType cannot see. Credentials are deliberately not
-* required here: an account is normally added before its secret is typed in,
-* and a missing secret is reported per record instead of blocking the save.
-*/
-function validateDdnsConfig(config) {
-	const errors = [];
-	const seenAccounts = /* @__PURE__ */ new Set();
-	for (const account of config.accounts) {
-		if (seenAccounts.has(account.id)) {
-			errors.push(`account "${account.id}" is declared twice`);
-			continue;
+		notify() {
+			for (const listener of this.listeners) listener();
 		}
-		seenAccounts.add(account.id);
-		if (ddnsProvider(account.provider) === null) errors.push(`account "${account.id}" uses an unknown provider "${account.provider}"`);
-	}
-	const seenRecords = /* @__PURE__ */ new Set();
-	for (const domain of config.domains) {
-		const account = config.accounts.find((entry) => entry.id === domain.account);
-		if (account === void 0) {
-			errors.push(`"${domain.host}" points at unknown account "${domain.account}"`);
-			continue;
+		updateServer(id, patch) {
+			const index = this.raw.servers?.findIndex((entry) => entry.id === id) ?? -1;
+			if (index < 0) throw new ConfigError(`unknown server "${id}"`);
+			const draft = structuredClone(this.raw);
+			const entry = draft.servers[index];
+			applyPatch(entry, patch, SERVER_MERGE_KEYS);
+			const validated = this.validateServer(entry, `servers[${index}]`);
+			this.commit(draft);
+			return validated;
 		}
-		const provider = ddnsProvider(account.provider);
-		if (provider !== null) for (const recordType of domain.types) {
-			if (!provider.families.includes(recordType)) errors.push(`${account.label || provider.label} cannot manage ${recordType} records ("${domain.host}")`);
-			const key = `${domain.host.toLowerCase()}|${recordType}`;
-			if (seenRecords.has(key)) errors.push(`"${domain.host}" asks for ${recordType} twice`);
-			seenRecords.add(key);
+		updateControl(patch) {
+			const draft = structuredClone(this.raw);
+			draft.control = { ...draft.control ?? {} };
+			applyPatch(draft.control, patch, CONTROL_MERGE_KEYS);
+			const control = this.parseGroup(controlSchema, draft.control, "control");
+			this.commit(draft);
+			return control;
 		}
-	}
-	return errors;
-}
-var DDNS_PROVIDERS, BY_ID;
-var init_ddns$2 = __esmMin((() => {
-	init_cloudflare();
-	init_desec();
-	init_digitalocean();
-	init_duckdns();
-	init_dynu();
-	init_freedns();
-	init_gandi();
-	init_godaddy();
-	init_henet();
-	init_namecheap();
-	init_noip();
-	init_porkbun();
-	init_spaceship();
-	DDNS_PROVIDERS = [
-		cloudflareProvider,
-		namecheapProvider,
-		spaceshipProvider,
-		porkbunProvider,
-		godaddyProvider,
-		gandiProvider,
-		digitaloceanProvider,
-		desecProvider,
-		duckdnsProvider,
-		noipProvider,
-		dynuProvider,
-		henetProvider,
-		freednsProvider
-	];
-	BY_ID = new Map(DDNS_PROVIDERS.map((provider) => [provider.id, provider]));
+		updateLogs(patch) {
+			const draft = structuredClone(this.raw);
+			draft.logs = { ...draft.logs ?? {} };
+			applyPatch(draft.logs, patch, EMPTY_MERGE_KEYS);
+			const logs = this.parseGroup(logsSchema, draft.logs, "logs");
+			this.commit(draft);
+			return logs;
+		}
+		updateNotifications(patch) {
+			const draft = structuredClone(this.raw);
+			draft.notifications = { ...draft.notifications ?? {} };
+			applyPatch(draft.notifications, patch, NOTIFICATION_MERGE_KEYS);
+			const notifications = this.parseGroup(notificationsSchema, draft.notifications, "notifications");
+			this.commit(draft);
+			return notifications;
+		}
+		updateHost(patch) {
+			const draft = structuredClone(this.raw);
+			draft.host = { ...draft.host ?? {} };
+			applyPatch(draft.host, patch, EMPTY_MERGE_KEYS);
+			const host = this.parseGroup(hostSchema, draft.host, "host");
+			this.commit(draft);
+			return host;
+		}
+		updateBackups(patch) {
+			const draft = structuredClone(this.raw);
+			draft.backups = { ...draft.backups ?? {} };
+			applyPatch(draft.backups, patch, EMPTY_MERGE_KEYS);
+			const backups = this.parseGroup(backupsSchema, draft.backups, "backups");
+			this.commit(draft);
+			return backups;
+		}
+		/**
+		* The DDNS block merges its two nested groups and **replaces** `accounts` and
+		* `domains`: those are lists, and a key-by-key merge cannot express removing a
+		* hostname. A whole-block patch (the `PUT /api/ddns` route) lands the same way.
+		*/
+		updateDdns(patch) {
+			const draft = structuredClone(this.raw);
+			draft.ddns = { ...draft.ddns ?? {} };
+			applyPatch(draft.ddns, patch, DDNS_MERGE_KEYS);
+			const parsed = this.parseGroup(ddnsConfigSchema, draft.ddns, "ddns");
+			const problems = validateDdnsConfig(parsed);
+			if (problems.length > 0) throw new ConfigError(`ddns: ${problems.join("; ")}`);
+			this.commit(draft);
+			return parsed;
+		}
+		updateDefaults(patch) {
+			const draft = structuredClone(this.raw);
+			draft.defaults = { ...draft.defaults ?? {} };
+			applyPatch(draft.defaults, patch, SERVER_MERGE_KEYS);
+			const defaults = this.parseGroup(defaultsSchema, draft.defaults, "defaults");
+			this.commit(draft);
+			return defaults;
+		}
+		addServer(input) {
+			const draft = structuredClone(this.raw);
+			draft.servers ??= [];
+			if (draft.servers.some((entry) => entry.id === input.id)) throw new ConfigError(`server "${String(input.id)}" already exists`);
+			const index = draft.servers.length;
+			draft.servers.push(structuredClone(input));
+			const validated = this.validateServer(draft.servers[index], `servers[${index}]`);
+			this.commit(draft);
+			return validated;
+		}
+		removeServer(id) {
+			const draft = structuredClone(this.raw);
+			const before = draft.servers?.length ?? 0;
+			draft.servers = (draft.servers ?? []).filter((entry) => entry.id !== id);
+			if (draft.servers.length === before) throw new ConfigError(`unknown server "${id}"`);
+			this.commit(draft);
+		}
+		/** Regenerates `servers.config.schema.json` for editor autocomplete. */
+		writeJsonSchema() {
+			const schema = JSON.stringify(configSchema.toJsonSchema(), null, 2);
+			if ((fs.existsSync(configSchemaPath) ? fs.readFileSync(configSchemaPath, "utf8") : null) !== schema) writeFileAtomic(configSchemaPath, schema);
+		}
+		/**
+		* Validates one group the way the reader does: a key this release does not know
+		* is reported and skipped, never fatal. Without this, a config carrying a key a
+		* newer release added — or an older one removed — could not be saved at all.
+		*/
+		parseGroup(schema, value, label) {
+			const parsed = parseTolerant(value, schema, label, []);
+			if (parsed.error !== null) throw new ConfigError(`${label}: ${parsed.error}`);
+			return parsed.value;
+		}
+		validateServer(entry, label) {
+			const parsed = serverSchema(mergeDefaults(this.defaults, entry));
+			if (parsed instanceof type.errors) throw new ConfigError(`${label}: ${formatErrors(parsed)}`);
+			return {
+				...parsed,
+				port: parsed.port ?? null
+			};
+		}
+		commit(draft) {
+			const stamped = stampConfig(draft);
+			const text = `${JSON.stringify(stamped, null, 2)}\n`;
+			writeFileAtomic(this.file, text);
+			this.lastText = text;
+			this.raw = stamped;
+			this.apply(stamped);
+			this.notify();
+		}
+		resolveFallback() {
+			const control = controlSchema({});
+			const defaults = defaultsSchema({});
+			if (control instanceof type.errors || defaults instanceof type.errors) throw new ConfigError("internal: default config failed validation");
+			const logs = logsSchema({});
+			const notifications = notificationsSchema({});
+			const host = hostSchema({});
+			const backups = backupsSchema({});
+			const ddns = ddnsConfigSchema({});
+			if (logs instanceof type.errors || notifications instanceof type.errors || host instanceof type.errors || backups instanceof type.errors || ddns instanceof type.errors) throw new ConfigError("internal: default settings failed validation");
+			return {
+				control,
+				defaults,
+				logs,
+				notifications,
+				host,
+				backups,
+				ddns,
+				servers: []
+			};
+		}
+		apply(raw) {
+			this.raw = raw;
+			const parsed = parseConfig(raw);
+			this.error = parsed.errors.length > 0 ? parsed.errors.join("; ") : null;
+			this.schemaVersion = parsed.schemaVersion;
+			this.warnings = [...parsed.warnings, ...parsed.unknownKeys.length === 0 ? [] : [`${path.basename(this.file)} carries ${parsed.unknownKeys.length} unrecognized key(s) this release ignores: ${parsed.unknownKeys.join(", ")}`]];
+			if (parsed.config !== null) this.resolvedConfig = parsed.config;
+			else if (this.resolvedConfig === void 0) this.resolvedConfig = this.resolveFallback();
+		}
+	};
 }));
 //#endregion
 //#region src/api/ddns.ts
@@ -4183,12 +4388,18 @@ var init_ddns$2 = __esmMin((() => {
 * the view only says which accounts have them.
 */
 function createDdnsRoute(deps) {
-	const view = () => ({
-		config: deps.store.config.ddns,
-		status: deps.ddns.view,
-		providers: ddnsProviderInfos(),
-		credentials: deps.secrets.ddnsAccountIds
-	});
+	const view = () => {
+		const config = deps.store.config.ddns;
+		return {
+			config,
+			status: deps.ddns.view,
+			providers: ddnsProviderInfos(),
+			credentials: deps.secrets.ddnsAccountIds.filter((id) => {
+				const account = config.accounts.find((entry) => entry.id === id);
+				return account === void 0 || deps.secrets.getDdnsCredentials(id, account.provider) !== null;
+			})
+		};
+	};
 	return appFactory.createApp().get("/ddns", describeRoute({
 		tags: ["ddns"],
 		summary: "Dynamic DNS policy, live state and the providers this build knows",
@@ -4223,6 +4434,8 @@ function createDdnsRoute(deps) {
 			});
 			throw error;
 		}
+		const pruned = deps.secrets.pruneDdnsCredentials(config.accounts.map((account) => account.id));
+		if (pruned > 0) logger.info(`ddns: dropped stored credentials for ${pruned} account(s) the config no longer declares`);
 		deps.ddns.refresh();
 		return c.json(view());
 	}).put("/ddns/credentials/:id", describeRoute({
@@ -4237,23 +4450,18 @@ function createDdnsRoute(deps) {
 		}
 	}), validate("param", accountParam), validate("json", ddnsCredentialsSchema), (c) => {
 		const { id } = c.req.valid("param");
-		const account = deps.store.config.ddns.accounts.find((entry) => entry.id === id);
-		if (account === void 0) throw new DetailedError(`unknown DDNS account "${id}"`, {
-			statusCode: 400,
-			code: "UNKNOWN_DDNS_ACCOUNT"
-		});
-		const provider = ddnsProvider(account.provider);
-		if (provider === null) throw new DetailedError(`unknown DDNS provider "${account.provider}"`, {
+		const { provider: providerId, credentials } = c.req.valid("json");
+		const provider = ddnsProvider(providerId);
+		if (provider === null) throw new DetailedError(`unknown DDNS provider "${providerId}"`, {
 			statusCode: 400,
 			code: "UNKNOWN_DDNS_PROVIDER"
 		});
-		const { credentials } = c.req.valid("json");
 		const problem = provider.validate(credentials);
 		if (problem !== null) throw new DetailedError(`${provider.label}: ${problem}`, {
 			statusCode: 400,
 			code: "INVALID_DDNS_CREDENTIALS"
 		});
-		deps.secrets.setDdnsCredentials(id, credentials);
+		deps.secrets.setDdnsCredentials(id, providerId, credentials);
 		deps.ddns.refresh();
 		return c.json(view());
 	}).delete("/ddns/credentials/:id", describeRoute({
@@ -4283,6 +4491,7 @@ var accountParam;
 var init_ddns$1 = __esmMin((() => {
 	init_store();
 	init_factory();
+	init_logger();
 	init_openapi$1();
 	init_validator();
 	init_ddns$2();
@@ -5047,6 +5256,7 @@ function createSettingsRoute(deps) {
 			if (patch.notifications !== void 0) deps.store.updateNotifications(patch.notifications);
 			if (patch.host !== void 0) deps.store.updateHost(patch.host);
 			if (patch.backups !== void 0) deps.store.updateBackups(patch.backups);
+			if (patch.ddns !== void 0) deps.store.updateDdns(patch.ddns);
 			if (patch.control !== void 0) deps.store.updateControl(patch.control);
 		} catch (error) {
 			if (error instanceof ConfigError) throw new DetailedError(error.message, {
@@ -5055,6 +5265,7 @@ function createSettingsRoute(deps) {
 			});
 			throw error;
 		}
+		if (patch.ddns !== void 0) deps.ddns.refresh();
 		const next = deps.store.config.control;
 		const endpointChanged = next.host !== deps.controlServer.endpoint.host || next.port !== deps.controlServer.endpoint.port;
 		const proxyChanged = next.auth.trustProxy !== previous.trustProxy;
@@ -8713,6 +8924,8 @@ var init_backups = __esmMin((() => {
 				error: "backups are disabled"
 			};
 			const password = options.password !== void 0 && options.password.length > 0 ? options.password : null;
+			const wanted = options.include === void 0 ? null : new Set(options.include);
+			const captures = (id) => wanted === null || wanted.has(id);
 			const dir = this.resolveDir();
 			const sources = this.options.getSources();
 			const staging = path.join(dir, `.staging-${Date.now()}`);
@@ -8721,12 +8934,12 @@ var init_backups = __esmMin((() => {
 			const destination = path.join(dir, name);
 			try {
 				fs.mkdirSync(staging, { recursive: true });
-				this.copyInto(staging, "config/servers.config.json", sources.configPath);
-				this.copyInto(staging, "secrets/control-secrets.json", sources.secretsPath);
-				this.copyInto(staging, "tls", sources.tlsDir);
+				if (captures("config")) this.copyInto(staging, "config/servers.config.json", sources.configPath);
+				if (captures("secrets")) this.copyInto(staging, "secrets/control-secrets.json", sources.secretsPath);
+				if (captures("tls")) this.copyInto(staging, "tls", sources.tlsDir);
 				const data = [];
 				for (const declared of this.paths) {
-					if (!declared.included || !fs.existsSync(declared.path)) continue;
+					if (!captures(`data:${declared.path}`) || !declared.included || !fs.existsSync(declared.path)) continue;
 					const slug = slugifyPath(declared.path);
 					if (data.some((entry) => entry.slug === slug)) continue;
 					this.copyInto(staging, path.join("data", slug), declared.path, declared.ignoreGenerated === true);
@@ -8736,6 +8949,16 @@ var init_backups = __esmMin((() => {
 						origin: declared.origin
 					});
 				}
+				if (wanted !== null && fs.readdirSync(staging).length === 0) {
+					fs.rmSync(staging, {
+						recursive: true,
+						force: true
+					});
+					return {
+						ok: false,
+						error: "nothing was selected to back up"
+					};
+				}
 				const manifest = {
 					version: 1,
 					createdAt,
@@ -8913,12 +9136,26 @@ var init_backups = __esmMin((() => {
 					});
 				}
 				const fromArchive = archiveTargets(restoredConfig);
-				const candidates = [...actions.has("config") ? fromArchive : [], ...this.paths.filter((entry) => entry.included).map((entry) => ({
+				const archiveCandidates = actions.has("config") ? fromArchive : [];
+				const instanceCandidates = this.paths.filter((entry) => entry.included).map((entry) => ({
 					path: entry.path,
 					origin: entry.origin
-				}))];
+				}));
+				const candidates = [...archiveCandidates, ...instanceCandidates];
+				const cursors = {
+					archive: /* @__PURE__ */ new Map(),
+					instance: /* @__PURE__ */ new Map()
+				};
+				const matchByOrigin = (list, cursor, origin) => {
+					if (origin === void 0) return void 0;
+					const same = list.filter((candidate) => candidate.origin === origin);
+					if (same.length === 0) return void 0;
+					const used = cursor.get(origin) ?? 0;
+					cursor.set(origin, used + 1);
+					return same[used] ?? same[0];
+				};
 				for (const entry of manifest.data ?? []) {
-					const target = candidates.find((candidate) => entry.origin !== void 0 && candidate.origin === entry.origin) ?? candidates.find((candidate) => candidate.path === entry.path);
+					const target = matchByOrigin(archiveCandidates, cursors.archive, entry.origin) ?? matchByOrigin(instanceCandidates, cursors.instance, entry.origin) ?? candidates.find((candidate) => candidate.path === entry.path);
 					const from = path.join(staging, "data", safeSlug(entry.slug) ?? slugifyPath(entry.path));
 					const common = {
 						id: `data:${entry.path}`,
@@ -9485,7 +9722,7 @@ var init_ddns = __esmMin((() => {
 					if (!domain.enabled) continue;
 					const account = config.accounts.find((entry) => entry.id === domain.account);
 					const provider = account === void 0 ? null : ddnsProvider(account.provider);
-					const credentials = account === void 0 ? null : this.deps.getCredentials(account.id);
+					const credentials = account === void 0 ? null : this.deps.getCredentials(account.id, account.provider);
 					for (const type of domain.types) {
 						const key = cacheKey(domain.host, type);
 						const family = type === "A" ? "ipv4" : "ipv6";
@@ -9522,7 +9759,7 @@ var init_ddns = __esmMin((() => {
 							type,
 							ip: address,
 							ttl: domain.ttl ?? config.ttl,
-							proxied: domain.proxied ?? config.proxied,
+							proxied: domain.proxied,
 							...domain.zone === void 0 ? {} : { zone: domain.zone },
 							...cache === void 0 ? {} : { cache: {
 								...cache.zoneId === void 0 ? {} : { zoneId: cache.zoneId },
@@ -9557,7 +9794,7 @@ var init_ddns = __esmMin((() => {
 				this.persisted.updatedAt = this.lastRunAt;
 				this.writeState();
 				this.lastResult = this.describe(changed, unchanged, failed, skipped);
-				this.announce(config, {
+				this.announce({
 					changed,
 					failed
 				});
@@ -9590,8 +9827,8 @@ var init_ddns = __esmMin((() => {
 			return parts.length === 0 ? "nothing to update" : parts.join(", ");
 		}
 		/** One message per pass, so a flapping provider cannot flood the chat. */
-		announce(config, counts) {
-			if (!config.notify || counts.changed === 0 && counts.failed === 0) return;
+		announce(counts) {
+			if (counts.changed === 0 && counts.failed === 0) return;
 			if (counts.failed > 0) {
 				this.deps.notifications.notify({
 					serverId: "ddns",
@@ -11176,7 +11413,7 @@ async function runControlPlane(options) {
 	})), notifications);
 	const ddns = new DdnsService({
 		getConfig: () => store.config.ddns,
-		getCredentials: (accountId) => secrets.getDdnsCredentials(accountId),
+		getCredentials: (accountId, provider) => secrets.getDdnsCredentials(accountId, provider)?.values ?? null,
 		notifications,
 		statePath: defaultDdnsStatePath
 	});