home-hosted 0.7.2 → 0.7.4

package/dist/cli.js

@@ -6,14 +6,14 @@ import path from "node:path";
 import readline from "node:readline";
 import { exec, execFile, spawn, spawnSync } from "node:child_process";
 import os from "node:os";
-import { DetailedError } from "@namesmt/utils";
 import { describeRoute, openAPIRouteHandler, resolver, validator } from "hono-openapi";
 import { createFactory } from "hono/factory";
-import { type } from "arktype";
-import crypto, { X509Certificate, createHash, createPrivateKey, createPublicKey, randomBytes } from "node:crypto";
-import { Buffer as Buffer$1 } from "node:buffer";
 import { LogLevels, createConsola } from "consola";
 import { isDevelopment } from "std-env";
+import { DetailedError } from "@namesmt/utils";
+import { type } from "arktype";
+import crypto, { X509Certificate, createPrivateKey, createPublicKey, randomBytes } from "node:crypto";
+import { Buffer as Buffer$1 } from "node:buffer";
 import { streamSSE } from "hono/streaming";
 import { autoRetry } from "@grammyjs/auto-retry";
 import { Bot } from "grammy";
@@ -350,6 +350,65 @@ var init_version = __esmMin((() => {
 	cached = null;
 }));
 //#endregion
+//#region src/helpers/factory.ts
+var appFactory;
+var init_factory = __esmMin((() => {
+	appFactory = createFactory();
+}));
+//#endregion
+//#region src/helpers/logger.ts
+var logger;
+var init_logger = __esmMin((() => {
+	logger = createConsola({ level: isDevelopment ? LogLevels.debug : void 0 });
+}));
+//#endregion
+//#region src/middleware/loopback.ts
+/** Client address helpers shared by the auth guard and the setup routes. */
+function requestIp(c) {
+	return c.req.raw?.ip ?? null;
+}
+function isLoopback(address) {
+	if (!address) return false;
+	return address === "127.0.0.1" || address === "::1" || address === "::ffff:127.0.0.1";
+}
+function isLoopbackRequest(c) {
+	return isLoopback(requestIp(c));
+}
+var init_loopback = __esmMin((() => {}));
+//#endregion
+//#region src/api/acme.ts
+/**
+* The ACMEProxy endpoint the reverse-proxy engine calls for a DNS-01 challenge.
+*
+* Deliberately outside `/api` — the engine is not a session — and outside `/_hh`,
+* which carries the panel's own local token. Two things guard it: only a loopback
+* peer is answered, and the engine must present the Basic credentials the panel
+* generated for it. The engine never holds DNS credentials; this endpoint writes
+* the record through the workspace account a route names.
+*/
+function createAcmeChallengeRoute(deps) {
+	return appFactory.createApp().post("/:action", describeRoute({
+		tags: ["proxy"],
+		summary: "Answer one ACME DNS-01 challenge (local engine only)",
+		responses: {
+			200: { description: "Written or removed" },
+			401: { description: "Bad credentials" },
+			403: { description: "Not a local caller" }
+		}
+	}), async (c) => {
+		if (!isLoopbackRequest(c)) {
+			logger.warn("proxy:    refused a DNS-01 challenge from a non-loopback caller");
+			return c.json({ error: "only this machine may answer a challenge" }, 403);
+		}
+		return await deps.challenge.handle(c.req.raw, c.req.param("action") ?? "");
+	});
+}
+var init_acme = __esmMin((() => {
+	init_factory();
+	init_logger();
+	init_loopback();
+}));
+//#endregion
 //#region src/helpers/cookies.ts
 function parseCookies(header) {
 	const cookies = {};
@@ -379,19 +438,13 @@ function serializeCookie(name, value, options = {}) {
 }
 var init_cookies = __esmMin((() => {}));
 //#endregion
-//#region src/helpers/factory.ts
-var appFactory;
-var init_factory = __esmMin((() => {
-	appFactory = createFactory();
-}));
-//#endregion
 //#region src/shared/contracts.ts
 /** Parses a bind value (`local` | `lan` | ipv4); null when it is not one. */
 function parseBind(value) {
 	const parsed = bindSchema(value);
 	return parsed instanceof type.errors ? null : parsed;
 }
-var bindSchema, workspaceIdSchema, workspaceSchema, workspaceCreateSchema, workspaceRenameSchema, portSchema, onPortConflictSchema, onPortConflictDefaultSchema, restartSchema, httpCheckSchema, resourcesSchema, healthSchema, stopSchema, bootstrapSchema, bootstrapOrNullSchema, logBufferLinesSchema, serverSchema, authSchema, telegramSchema, notificationsSchema, logsSchema, tlsSchema, hostSchema, ddnsRecordTypeSchema, ddnsAccountSchema, ddnsDomainSchema, ddnsIpv4Schema, ddnsIpv6Schema, ddnsConfigSchema, ddnsRecordStateSchema, ddnsRecordViewSchema, ddnsStatusSchema, ddnsProviderFieldSchema, ddnsProviderInfoSchema, ddnsViewSchema, ddnsCredentialsSchema, backupsSchema, controlSchema, defaultsSchema, restartPatchSchema, httpCheckPatchSchema, resourcesPatchSchema, healthPatchSchema, stopPatchSchema, authPatchSchema, telegramPatchSchema, notificationsPatchSchema, hostPatchSchema, backupsPatchSchema, logsPatchSchema, tlsPatchSchema, controlPatchSchema, defaultsPatchSchema, editableFields, serverPatchSchema, serverCreateSchema, nannySpecSchema, nannyExitSchema, nannyStateSchema, settingsPatchSchema, workspaceSettingsPatchSchema, authStatusSchema, tlsStatusSchema, proxyEngineSchema, proxyTargetSchema, proxyTlsModeSchema, proxyRouteSchema, proxyCertificateSchema, proxyCertificateStateSchema, proxyConfigSchema, proxyEngineSourceSchema, proxyEngineStatusSchema, proxyEngineInfoSchema, proxyRouteStatusSchema, proxyRouteViewSchema, proxyRunStateSchema, proxyStatusSchema, proxyCertificateViewSchema, proxyViewSchema, proxyRoutePatchSchema, proxyPatchSchema, proxyCertificateUploadSchema, proxyEngineInstallSchema, telegramStatusSchema, notificationViewSchema, sessionViewSchema, loginSchema, passwordValueSchema, passwordSchema, serverStatusSchema, healthStateSchema, portStateSchema, logStreamSchema, logLineSchema, historyEventSchema, serverHistorySchema, processResourcesSchema, hostDiskSchema, hostViewSchema, backupFileSchema, backupEntrySchema, backupsViewSchema, restoreItemSchema, restorePlanSchema, backupCreateSchema, restoreRequestSchema, serverViewSchema, controlViewSchema, uiMetaSchema, uiStatusSchema, workspaceViewSchema, appStateSchema, logQuerySchema, freePortResultSchema, logHistoryQuerySchema, logFileInfoSchema, logServerViewSchema, logServersViewSchema, notificationActionSchema, telegramTokenSchema, apiErrorSchema, tlsUploadSchema, settingsViewSchema, settingsSavedSchema, workspaceSettingsViewSchema, workspaceSettingsSavedSchema;
+var bindSchema, workspaceIdSchema, workspaceSchema, workspaceCreateSchema, workspaceRenameSchema, portSchema, onPortConflictSchema, onPortConflictDefaultSchema, restartSchema, httpCheckSchema, resourcesSchema, healthSchema, stopSchema, bootstrapSchema, bootstrapOrNullSchema, logBufferLinesSchema, serverSchema, authSchema, telegramSchema, notificationsSchema, logsSchema, tlsSchema, hostSchema, ddnsRecordTypeSchema, ddnsAccountSchema, ddnsDomainSchema, ddnsIpv4Schema, ddnsIpv6Schema, ddnsConfigSchema, ddnsRecordStateSchema, ddnsRecordViewSchema, ddnsStatusSchema, ddnsProviderFieldSchema, ddnsProviderInfoSchema, ddnsViewSchema, ddnsCredentialsSchema, backupsSchema, controlSchema, defaultsSchema, restartPatchSchema, httpCheckPatchSchema, resourcesPatchSchema, healthPatchSchema, stopPatchSchema, authPatchSchema, telegramPatchSchema, notificationsPatchSchema, hostPatchSchema, backupsPatchSchema, logsPatchSchema, tlsPatchSchema, controlPatchSchema, defaultsPatchSchema, editableFields, serverPatchSchema, serverCreateSchema, nannySpecSchema, nannyExitSchema, nannyStateSchema, settingsPatchSchema, workspaceSettingsPatchSchema, authStatusSchema, tlsStatusSchema, proxyEngineSchema, proxyTargetSchema, proxyTlsModeSchema, proxyRouteSchema, proxyCertificateSchema, proxyCertificateStateSchema, proxyDns01Schema, proxyConfigSchema, proxyEngineSourceSchema, proxyEngineStatusSchema, proxyEngineInfoSchema, proxyRouteStatusSchema, proxyRouteViewSchema, proxyRunStateSchema, proxyStatusSchema, proxyCertificateViewSchema, proxyDnsAccountViewSchema, proxyViewSchema, proxyRoutePatchSchema, proxyPatchSchema, proxyCertificateUploadSchema, proxyEngineInstallSchema, telegramStatusSchema, notificationViewSchema, sessionViewSchema, loginSchema, passwordValueSchema, passwordSchema, serverStatusSchema, healthStateSchema, portStateSchema, logStreamSchema, logLineSchema, historyEventSchema, serverHistorySchema, processResourcesSchema, hostDiskSchema, hostViewSchema, backupFileSchema, backupEntrySchema, backupsViewSchema, restoreItemSchema, restorePlanSchema, backupCreateSchema, restoreRequestSchema, serverViewSchema, controlViewSchema, uiMetaSchema, uiStatusSchema, workspaceViewSchema, appStateSchema, logQuerySchema, freePortResultSchema, logHistoryQuerySchema, logFileInfoSchema, logServerViewSchema, logServersViewSchema, notificationActionSchema, telegramTokenSchema, apiErrorSchema, tlsUploadSchema, settingsViewSchema, settingsSavedSchema, workspaceSettingsViewSchema, workspaceSettingsSavedSchema;
 var init_contracts = __esmMin((() => {
 	bindSchema = type("\"local\" | \"lan\" | /^\\d{1,3}(?:\\.\\d{1,3}){3}$/");
 	workspaceIdSchema = type("/^[a-z0-9][a-z0-9_-]*$/");
@@ -620,7 +673,9 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		families: ddnsRecordTypeSchema.array(),
 		fields: ddnsProviderFieldSchema.array(),
 		ttl: "boolean",
-		proxied: "boolean"
+		proxied: "boolean",
+		/** These credentials can also answer an ACME DNS-01 challenge (a TXT record). */
+		txt: "boolean"
 	});
 	ddnsViewSchema = type({
 		config: ddnsConfigSchema,
@@ -886,13 +941,26 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		url: "string = \"\"",
 		/** Optional path prefix; empty serves the whole host. */
 		path: "string = \"\"",
-		tls: proxyTlsModeSchema.default(() => "auto")
+		tls: proxyTlsModeSchema.default(() => "auto"),
+		/**
+		* Which DNS account answers a DNS-01 challenge for this hostname, as
+		* `<workspace>/<account>` — the account belongs to a workspace, so the proxy
+		* references it rather than owning it. Empty picks the workspace's only
+		* account that can write TXT records.
+		*/
+		dnsAccount: "string = \"\""
 	}).onUndeclaredKey("reject");
 	proxyCertificateSchema = type({
 		id: "/^[a-z0-9][a-z0-9_-]*$/",
 		label: "string = \"\""
 	}).onUndeclaredKey("reject");
-	proxyCertificateStateSchema = type.enumerated("off", "local", "uploaded", "issued", "pending", "failed");
+	proxyCertificateStateSchema = type.enumerated("off", "local", "uploaded", "issued", "pending", "failed", "fallback");
+	proxyDns01Schema = type({
+		/** Off means the engine uses HTTP-01/TLS-ALPN-01, exactly as before. */
+		enabled: "boolean = false",
+		/** Nameservers Caddy checks the TXT record against; empty uses its own defaults. */
+		resolvers: type("string[]").default(() => [])
+	}).onUndeclaredKey("reject");
 	proxyConfigSchema = type({
 		enabled: "boolean = false",
 		engine: proxyEngineSchema.default(() => "caddy"),
@@ -903,6 +971,7 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		email: "string = \"\"",
 		/** The ACME staging endpoint: untrusted certificates, no rate-limit burn. */
 		staging: "boolean = false",
+		dns01: proxyDns01Schema.default(() => ({})),
 		/** PEM pairs a route with `tls: "manual"` may serve; the engine picks by SNI. */
 		certificates: proxyCertificateSchema.array().default(() => []),
 		routes: proxyRouteSchema.array().default(() => [])
@@ -916,8 +985,6 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		source: proxyEngineSourceSchema.or(type("null")),
 		path: "string | null",
 		bytes: "number | null",
-		/** Recorded at download time, so a swapped binary is visible. */
-		sha256: "string | null",
 		error: "string | null"
 	});
 	proxyEngineInfoSchema = type({
@@ -938,8 +1005,13 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		"message": "string | null",
 		/** Where this hostname's certificate stands. Optional: an older panel omits it. */
 		"certificate?": type({
-			state: proxyCertificateStateSchema,
-			message: "string | null"
+			"state": proxyCertificateStateSchema,
+			"message": "string | null",
+			/**
+			* For `fallback`: minutes until the engine tries the CA again by itself, read
+			* from the certificate it fell back to. Optional, so an older client ignores it.
+			*/
+			"retryInMinutes?": "number"
 		})
 	});
 	proxyRunStateSchema = type.enumerated("off", "stopped", "starting", "running", "error", "unsupported");
@@ -968,14 +1040,26 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		hosts: type("string[]"),
 		error: "string | null"
 	});
+	proxyDnsAccountViewSchema = type({
+		workspace: "string",
+		account: "string",
+		provider: "string",
+		label: "string",
+		/** The credentials can write a TXT record, so this account can answer a challenge. */
+		writesTxt: "boolean",
+		/** Credentials are stored; an account without them cannot answer yet. */
+		hasCredentials: "boolean"
+	});
 	proxyViewSchema = type({
-		config: proxyConfigSchema,
-		engine: proxyEngineStatusSchema,
-		engines: proxyEngineInfoSchema.array(),
-		status: proxyStatusSchema,
-		routes: proxyRouteViewSchema.array(),
+		"config": proxyConfigSchema,
+		"engine": proxyEngineStatusSchema,
+		"engines": proxyEngineInfoSchema.array(),
+		"status": proxyStatusSchema,
+		"routes": proxyRouteViewSchema.array(),
 		/** Every uploaded pair, with what it covers and when it expires. */
-		certificates: proxyCertificateViewSchema.array()
+		"certificates": proxyCertificateViewSchema.array(),
+		/** Every DNS account a route may name. Optional: an older panel omits it. */
+		"dnsAccounts?": proxyDnsAccountViewSchema.array()
 	});
 	proxyRoutePatchSchema = type({
 		id: "string",
@@ -986,7 +1070,8 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		server: "string?",
 		url: "string?",
 		path: "string?",
-		tls: proxyTlsModeSchema.optional()
+		tls: proxyTlsModeSchema.optional(),
+		dnsAccount: "string?"
 	}).onUndeclaredKey("reject");
 	proxyPatchSchema = type({
 		enabled: "boolean?",
@@ -995,6 +1080,14 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		httpsPort: "1 <= number.integer <= 65535?",
 		email: "string?",
 		staging: "boolean?",
+		/**
+		* A patch shape, not the config's: both keys are optional and merge, so a client
+		* may send one without resetting the other, and an explicit `null` clears a key.
+		*/
+		dns01: type({
+			enabled: "boolean | null?",
+			resolvers: "string[] | null?"
+		}).onUndeclaredKey("reject").optional(),
 		certificates: proxyCertificateSchema.array().optional(),
 		routes: proxyRoutePatchSchema.array().optional()
 	}).onUndeclaredKey("reject");
@@ -1413,20 +1506,6 @@ function normalizeIssues(error) {
 }
 var init_validator = __esmMin((() => {}));
 //#endregion
-//#region src/middleware/loopback.ts
-/** Client address helpers shared by the auth guard and the setup routes. */
-function requestIp(c) {
-	return c.req.raw?.ip ?? null;
-}
-function isLoopback(address) {
-	if (!address) return false;
-	return address === "127.0.0.1" || address === "::1" || address === "::ffff:127.0.0.1";
-}
-function isLoopbackRequest(c) {
-	return isLoopback(requestIp(c));
-}
-var init_loopback = __esmMin((() => {}));
-//#endregion
 //#region src/helpers/atomic.ts
 /**
 * Write via a temp file in the same directory, then rename: readers never see a
@@ -1434,19 +1513,18 @@ var init_loopback = __esmMin((() => {}));
 */
 function writeFileAtomic(file, content, options = {}) {
 	fs.mkdirSync(path.dirname(file), { recursive: true });
-	const tmp = `${file}.${process.pid}.tmp`;
-	fs.writeFileSync(tmp, content, options.mode === void 0 ? void 0 : { mode: options.mode });
-	if (options.mode !== void 0) fs.chmodSync(tmp, options.mode);
-	fs.renameSync(tmp, file);
+	const tmp = `${file}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+	try {
+		fs.writeFileSync(tmp, content, options.mode === void 0 ? void 0 : { mode: options.mode });
+		if (options.mode !== void 0) fs.chmodSync(tmp, options.mode);
+		fs.renameSync(tmp, file);
+	} catch (error) {
+		fs.rmSync(tmp, { force: true });
+		throw error;
+	}
 }
 var init_atomic = __esmMin((() => {}));
 //#endregion
-//#region src/helpers/logger.ts
-var logger;
-var init_logger = __esmMin((() => {
-	logger = createConsola({ level: isDevelopment ? LogLevels.debug : void 0 });
-}));
-//#endregion
 //#region src/config/secrets.ts
 function deriveKey(password, salt, cost, keylen) {
 	return crypto.scryptSync(password.normalize("NFKC"), salt, keylen, { ...cost });
@@ -2411,6 +2489,7 @@ var paths_exports = /* @__PURE__ */ __exportAll({
 	projectDir: () => projectDir,
 	proxyAdminPath: () => proxyAdminPath,
 	proxyBinDir: () => proxyBinDir,
+	proxyChallengeAuthPath: () => proxyChallengeAuthPath,
 	proxyConfigPath: () => proxyConfigPath,
 	proxyDir: () => proxyDir,
 	proxyEngineDir: () => proxyEngineDir,
@@ -2520,7 +2599,7 @@ function resolveUserPath(target, base = projectDir) {
 	else if (value.startsWith("~/") || value.startsWith("~\\")) value = path.join(os.homedir(), value.slice(2));
 	return path.isAbsolute(value) ? value : path.resolve(base, value);
 }
-var dataRoot, projectDir, hhDir, DEFAULT_WORKSPACE_ID, globalSettingsPath, globalSettingsSchemaPath, globalSecretsPath, workspacesPath, workspacesSchemaPath, tlsDir, defaultBackupsDirName, daemonLogPath, runtimePath, uiDir, proxyDir, proxyBinDir, proxyEngineDir, proxyConfigPath, proxyPreviousConfigPath, proxyStateDir, proxyAdminPath, proxyTlsDir, legacy;
+var dataRoot, projectDir, hhDir, DEFAULT_WORKSPACE_ID, globalSettingsPath, globalSettingsSchemaPath, globalSecretsPath, workspacesPath, workspacesSchemaPath, tlsDir, defaultBackupsDirName, daemonLogPath, runtimePath, uiDir, proxyDir, proxyBinDir, proxyEngineDir, proxyConfigPath, proxyPreviousConfigPath, proxyStateDir, proxyAdminPath, proxyTlsDir, proxyChallengeAuthPath, legacy;
 var init_paths = __esmMin((() => {
 	dataRoot = resolveDataRoot();
 	projectDir = resolveProjectDir();
@@ -2544,6 +2623,7 @@ var init_paths = __esmMin((() => {
 	proxyStateDir = path.join(proxyDir, "state");
 	proxyAdminPath = path.join(proxyStateDir, "admin.json");
 	proxyTlsDir = path.join(proxyDir, "tls");
+	proxyChallengeAuthPath = path.join(proxyStateDir, "challenge.json");
 	legacy = {
 		configPath: path.join(dataRoot, "servers.config.json"),
 		configSchemaPath: path.join(dataRoot, "servers.config.schema.json"),
@@ -3420,7 +3500,7 @@ function mergeGroup(target, patch) {
 	}
 	return merged;
 }
-var SERVER_MERGE_KEYS, CONTROL_MERGE_KEYS, NOTIFICATION_MERGE_KEYS, DDNS_MERGE_KEYS, EMPTY_MERGE_KEYS;
+var SERVER_MERGE_KEYS, CONTROL_MERGE_KEYS, NOTIFICATION_MERGE_KEYS, DDNS_MERGE_KEYS, PROXY_MERGE_KEYS, EMPTY_MERGE_KEYS;
 var init_patch = __esmMin((() => {
 	SERVER_MERGE_KEYS = /* @__PURE__ */ new Set([
 		"restart",
@@ -3430,6 +3510,7 @@ var init_patch = __esmMin((() => {
 	CONTROL_MERGE_KEYS = /* @__PURE__ */ new Set(["auth", "tls"]);
 	NOTIFICATION_MERGE_KEYS = /* @__PURE__ */ new Set(["telegram"]);
 	DDNS_MERGE_KEYS = /* @__PURE__ */ new Set(["ipv4", "ipv6"]);
+	PROXY_MERGE_KEYS = /* @__PURE__ */ new Set(["dns01"]);
 	EMPTY_MERGE_KEYS = /* @__PURE__ */ new Set();
 }));
 //#endregion
@@ -3614,11 +3695,11 @@ var init_settings$1 = __esmMin((() => {
 			this.commit(draft);
 			return backups;
 		}
-		/** The reverse proxy. `routes` is a list a patch replaces, so it merges nothing. */
+		/** The reverse proxy. `routes` is a list a patch replaces; `dns01` merges key by key. */
 		updateProxy(patch) {
 			const draft = structuredClone(this.raw);
 			draft.proxy = { ...draft.proxy ?? {} };
-			applyPatch(draft.proxy, patch, EMPTY_MERGE_KEYS);
+			applyPatch(draft.proxy, patch, PROXY_MERGE_KEYS);
 			const proxy = this.parseGroup(proxyConfigSchema, draft.proxy, "proxy");
 			this.commit(draft);
 			return proxy;
@@ -3722,7 +3803,7 @@ function authHeaders(credentials) {
 	};
 	return null;
 }
-async function call(path, headers, context, init = {}) {
+async function call$1(path, headers, context, init = {}) {
 	try {
 		const response = await context.fetch(`${API$5}${path}`, {
 			...init,
@@ -3778,7 +3859,7 @@ async function resolveZone(host, headers, context, cached) {
 	const labels = host.split(".");
 	for (let index = 0; index <= labels.length - 2; index++) {
 		const candidate = labels.slice(index).join(".");
-		const { data, error } = await call(`/zones?name=${encodeURIComponent(candidate)}&per_page=1`, headers, context);
+		const { data, error } = await call$1(`/zones?name=${encodeURIComponent(candidate)}&per_page=1`, headers, context);
 		if (error !== null || data === null) throw new Error(error ?? "could not look up the zone");
 		const zone = data.result[0];
 		if (zone !== void 0) return zone;
@@ -3787,7 +3868,7 @@ async function resolveZone(host, headers, context, cached) {
 }
 async function findRecord(zoneId, record, headers, context, cached) {
 	if (cached !== void 0) {
-		const fetched = await call(`/zones/${zoneId}/dns_records/${cached}`, headers, context);
+		const fetched = await call$1(`/zones/${zoneId}/dns_records/${cached}`, headers, context);
 		if (fetched.error === null && fetched.data !== null) return {
 			record: fetched.data.result,
 			error: null
@@ -3797,7 +3878,7 @@ async function findRecord(zoneId, record, headers, context, cached) {
 			error: fetched.error
 		};
 	}
-	const listed = await call(`/zones/${zoneId}/dns_records?type=${record.type}&name=${encodeURIComponent(record.host)}&per_page=100`, headers, context);
+	const listed = await call$1(`/zones/${zoneId}/dns_records?type=${record.type}&name=${encodeURIComponent(record.host)}&per_page=100`, headers, context);
 	if (listed.error !== null) return {
 		record: null,
 		error: listed.error
@@ -3870,10 +3951,10 @@ var init_cloudflare = __esmMin((() => {
 					ttl,
 					proxied: record.proxied
 				});
-				const written = existing === null ? await call(`/zones/${zone.id}/dns_records`, headers, context, {
+				const written = existing === null ? await call$1(`/zones/${zone.id}/dns_records`, headers, context, {
 					method: "POST",
 					body
-				}) : await call(`/zones/${zone.id}/dns_records/${existing.id}`, headers, context, {
+				}) : await call$1(`/zones/${zone.id}/dns_records/${existing.id}`, headers, context, {
 					method: "PATCH",
 					body
 				});
@@ -3888,6 +3969,74 @@ var init_cloudflare = __esmMin((() => {
 			} catch (error) {
 				return failed(error instanceof Error ? error.message : String(error));
 			}
+		},
+		/**
+		* One `_acme-challenge` TXT record, written and removed around a validation.
+		* Cloudflare has real per-record endpoints, so nothing else in the zone is read
+		* or rewritten — the failure mode that makes a whole-record-set API risky.
+		*/
+		async challenge(record, context) {
+			const headers = authHeaders(context.credentials);
+			if (headers === null) return {
+				ok: false,
+				message: "cloudflare needs an API token (or the legacy email + global key)"
+			};
+			try {
+				const zone = await resolveZone(record.fqdn, headers, context, void 0);
+				if (zone === null) return {
+					ok: false,
+					message: `cloudflare does not have a zone for ${record.fqdn}`
+				};
+				const listed = await call$1(`/zones/${zone.id}/dns_records?type=TXT&name=${encodeURIComponent(record.fqdn)}&per_page=100`, headers, context);
+				if (listed.error !== null) return {
+					ok: false,
+					message: listed.error
+				};
+				const ours = (listed.data?.result ?? []).filter((entry) => entry.id !== void 0).filter((entry) => entry.content === record.value);
+				if (record.action === "present") {
+					if (ours.length > 0) return {
+						ok: true,
+						message: `${record.fqdn} already carries this value`
+					};
+					const written = await call$1(`/zones/${zone.id}/dns_records`, headers, context, {
+						method: "POST",
+						body: JSON.stringify({
+							type: "TXT",
+							name: record.fqdn,
+							content: record.value,
+							ttl: 1
+						})
+					});
+					if (written.error !== null) return {
+						ok: false,
+						message: written.error
+					};
+					return {
+						ok: true,
+						message: `wrote the TXT record for ${record.fqdn}`
+					};
+				}
+				for (const entry of ours) {
+					const removed = await call$1(`/zones/${zone.id}/dns_records/${entry.id}`, headers, context, { method: "DELETE" });
+					if (removed.error !== null && removed.status !== 404) return {
+						ok: false,
+						message: removed.error
+					};
+				}
+				if (ours.length === 0) return {
+					ok: true,
+					message: `${record.fqdn} had no challenge record to remove`
+				};
+				return {
+					ok: true,
+					message: `removed the TXT record for ${record.fqdn}`
+				};
+			} catch (error) {
+				return {
+					ok: false,
+					message: error instanceof Error ? error.message : String(error)
+				};
+			}
 		}
 	};
 }));
@@ -4012,11 +4161,11 @@ var init_dyndns2 = __esmMin((() => {
 }));
 //#endregion
 //#region src/providers/ddns/desec.ts
-var ENDPOINT$6, desecProvider;
+var ENDPOINT$7, desecProvider;
 var init_desec = __esmMin((() => {
 	init_dyndns2();
 	init_types();
-	ENDPOINT$6 = "https://update.dedyn.io/";
+	ENDPOINT$7 = "https://update.dedyn.io/";
 	desecProvider = {
 		id: "desec",
 		label: "deSEC",
@@ -4037,7 +4186,7 @@ var init_desec = __esmMin((() => {
 			const token = (context.credentials.token ?? "").trim();
 			if (token.length === 0) return failed("desec needs an API token");
 			const family = record.type === "A" ? `myipv4=${encodeURIComponent(record.ip)}` : `myipv6=${encodeURIComponent(record.ip)}`;
-			const url = `${ENDPOINT$6}?hostname=${encodeURIComponent(record.host)}&${family}`;
+			const url = `${ENDPOINT$7}?hostname=${encodeURIComponent(record.host)}&${family}`;
 			try {
 				const response = await context.fetch(url, {
 					headers: { Authorization: basicAuth(record.host, token) },
@@ -4182,10 +4331,10 @@ function subdomain(host) {
 	const normalized = host.trim().toLowerCase();
 	return normalized.endsWith(".duckdns.org") ? normalized.slice(0, -12) : normalized;
 }
-var ENDPOINT$5, duckdnsProvider;
+var ENDPOINT$6, duckdnsProvider;
 var init_duckdns = __esmMin((() => {
 	init_types();
-	ENDPOINT$5 = "https://www.duckdns.org/update";
+	ENDPOINT$6 = "https://www.duckdns.org/update";
 	duckdnsProvider = {
 		id: "duckdns",
 		label: "DuckDNS",
@@ -4206,7 +4355,7 @@ var init_duckdns = __esmMin((() => {
 			const token = (context.credentials.token ?? "").trim();
 			if (token.length === 0) return failed("duckdns needs the account token");
 			const family = record.type === "A" ? `ip=${encodeURIComponent(record.ip)}` : `ipv6=${encodeURIComponent(record.ip)}`;
-			const url = `${ENDPOINT$5}?domains=${encodeURIComponent(subdomain(record.host))}&token=${encodeURIComponent(token)}&${family}`;
+			const url = `${ENDPOINT$6}?domains=${encodeURIComponent(subdomain(record.host))}&token=${encodeURIComponent(token)}&${family}`;
 			try {
 				const response = await context.fetch(url, { signal: context.signal });
 				const body = (await response.text()).trim();
@@ -4220,11 +4369,11 @@ var init_duckdns = __esmMin((() => {
 }));
 //#endregion
 //#region src/providers/ddns/dynu.ts
-var ENDPOINT$4, dynuProvider;
+var ENDPOINT$5, dynuProvider;
 var init_dynu = __esmMin((() => {
 	init_dyndns2();
 	init_types();
-	ENDPOINT$4 = "https://api.dynu.com/nic/update";
+	ENDPOINT$5 = "https://api.dynu.com/nic/update";
 	dynuProvider = {
 		id: "dynu",
 		label: "Dynu",
@@ -4251,7 +4400,7 @@ var init_dynu = __esmMin((() => {
 			const password = (context.credentials.password ?? "").trim();
 			if (username.length === 0 || password.length === 0) return failed("dynu needs the username and password");
 			const address = record.type === "A" ? `myip=${encodeURIComponent(record.ip)}` : `myipv6=${encodeURIComponent(record.ip)}`;
-			const url = `${ENDPOINT$4}?hostname=${encodeURIComponent(record.host)}&${address}`;
+			const url = `${ENDPOINT$5}?hostname=${encodeURIComponent(record.host)}&${address}`;
 			try {
 				const response = await context.fetch(url, {
 					headers: { Authorization: basicAuth(username, password) },
@@ -4275,10 +4424,10 @@ function updateToken(credentials) {
 	if (raw.length === 0) return "";
 	return (raw.includes("?") ? raw.slice(raw.indexOf("?") + 1) : raw).replace(/^https?:\/\/[^?]*\?/, "");
 }
-var ENDPOINT$3, freednsProvider;
+var ENDPOINT$4, freednsProvider;
 var init_freedns = __esmMin((() => {
 	init_types();
-	ENDPOINT$3 = "https://freedns.afraid.org/dynamic/update.php";
+	ENDPOINT$4 = "https://freedns.afraid.org/dynamic/update.php";
 	freednsProvider = {
 		id: "freedns",
 		label: "FreeDNS (afraid.org)",
@@ -4299,7 +4448,7 @@ var init_freedns = __esmMin((() => {
 			const token = updateToken(context.credentials);
 			if (token.length === 0) return failed("freedns needs the per-record Direct URL");
 			try {
-				const response = await context.fetch(`${ENDPOINT$3}?${token}&address=${encodeURIComponent(record.ip)}`, { signal: context.signal });
+				const response = await context.fetch(`${ENDPOINT$4}?${token}&address=${encodeURIComponent(record.ip)}`, { signal: context.signal });
 				const body = (await response.text()).trim();
 				if (!response.ok || /^ERROR/i.test(body)) return failed(`freedns answered "${body.slice(0, 160) || `HTTP ${response.status}`}"`);
 				return succeeded(`set ${record.host} ${record.type} to ${record.ip}`, true);
@@ -4453,11 +4602,11 @@ var init_godaddy = __esmMin((() => {
 }));
 //#endregion
 //#region src/providers/ddns/henet.ts
-var ENDPOINT$2, henetProvider;
+var ENDPOINT$3, henetProvider;
 var init_henet = __esmMin((() => {
 	init_dyndns2();
 	init_types();
-	ENDPOINT$2 = "https://dyn.dns.he.net/nic/update";
+	ENDPOINT$3 = "https://dyn.dns.he.net/nic/update";
 	henetProvider = {
 		id: "henet",
 		label: "Hurricane Electric",
@@ -4477,7 +4626,7 @@ var init_henet = __esmMin((() => {
 		async update(record, context) {
 			const key = (context.credentials.key ?? "").trim();
 			if (key.length === 0) return failed("hurricane electric needs the per-host DDNS key");
-			const url = `${ENDPOINT$2}?hostname=${encodeURIComponent(record.host)}&password=${encodeURIComponent(key)}&myip=${encodeURIComponent(record.ip)}`;
+			const url = `${ENDPOINT$3}?hostname=${encodeURIComponent(record.host)}&password=${encodeURIComponent(key)}&myip=${encodeURIComponent(record.ip)}`;
 			try {
 				const response = await context.fetch(url, { signal: context.signal });
 				return describeDyndnsResponse(response, await response.text(), "hurricane electric");
@@ -4492,11 +4641,11 @@ var init_henet = __esmMin((() => {
 function tag(body, name) {
 	return new RegExp(`<${name}>([\\s\\S]*?)</${name}>`, "i").exec(body)?.[1]?.trim() ?? null;
 }
-var ENDPOINT$1, namecheapProvider;
+var ENDPOINT$2, namecheapProvider;
 var init_namecheap = __esmMin((() => {
 	init_types();
 	init_zone();
-	ENDPOINT$1 = "https://dynamicdns.park-your-domain.com/update";
+	ENDPOINT$2 = "https://dynamicdns.park-your-domain.com/update";
 	namecheapProvider = {
 		id: "namecheap",
 		label: "Namecheap",
@@ -4518,7 +4667,7 @@ var init_namecheap = __esmMin((() => {
 			if (password.length === 0) return failed("namecheap needs the Dynamic DNS password");
 			const { zone, name } = splitHost(record.host, record.zone);
 			const host = name === "@" ? "@" : name;
-			const url = `${ENDPOINT$1}?host=${encodeURIComponent(host)}&domain=${encodeURIComponent(zone)}&password=${encodeURIComponent(password)}&ip=${encodeURIComponent(record.ip)}`;
+			const url = `${ENDPOINT$2}?host=${encodeURIComponent(host)}&domain=${encodeURIComponent(zone)}&password=${encodeURIComponent(password)}&ip=${encodeURIComponent(record.ip)}`;
 			try {
 				const body = await (await context.fetch(url, { signal: context.signal })).text();
 				const errCount = Number.parseInt(tag(body, "ErrCount") ?? "0", 10);
@@ -4536,6 +4685,248 @@ var init_namecheap = __esmMin((() => {
 	};
 }));
 //#endregion
+//#region src/providers/ddns/namecheap-api.ts
+/**
+* Namecheap escapes attribute values, so a value read back has to be unescaped
+* before it is written out again: the whole-zone rewrite would otherwise turn
+* `a&b` into `a&amp;b` on every challenge, corrupting a record we did not create.
+*/
+function decodeXml(value) {
+	return value.replace(/&(#X?[0-9a-f]+|[a-z]+);/gi, (whole, body) => {
+		if (body.startsWith("#")) {
+			const hex = body[1] === "x" || body[1] === "X";
+			const code = Number.parseInt(hex ? body.slice(2) : body.slice(1), hex ? 16 : 10);
+			return Number.isInteger(code) && code >= 0 && code <= 1114111 ? String.fromCodePoint(code) : whole;
+		}
+		return XML_ENTITIES[body.toLowerCase()] ?? whole;
+	});
+}
+function attr(tagText, name) {
+	return decodeXml(new RegExp(`${name}="([^"]*)"`, "i").exec(tagText)?.[1] ?? "").trim();
+}
+/** Every `<Host ... />` in a `getHosts` reply, in the order the API listed them. */
+function parseHosts(body) {
+	const records = [];
+	const pattern = /<Host\b([^>]*?)(?:\/>|>)/gi;
+	let match = pattern.exec(body);
+	while (match !== null) {
+		const attributes = match[1] ?? "";
+		records.push({
+			name: attr(attributes, "Name"),
+			type: attr(attributes, "Type"),
+			address: attr(attributes, "Address"),
+			mxPref: attr(attributes, "MXPref") || "10",
+			ttl: attr(attributes, "TTL") || "1800"
+		});
+		match = pattern.exec(body);
+	}
+	return records;
+}
+/** The first `<Err1>`…`<ErrN>` a failed reply carries, as one sentence. */
+function describeErrors(body) {
+	const errors = [];
+	const pattern = /<Err\d+>([\s\S]*?)<\/Err\d+>/gi;
+	let match = pattern.exec(body);
+	while (match !== null) {
+		const text = (match[1] ?? "").trim();
+		if (text.length > 0) errors.push(text);
+		match = pattern.exec(body);
+	}
+	return errors.length > 0 ? errors.join("; ") : "the API refused the request";
+}
+function credentials(store) {
+	const apiUser = (store.apiUser ?? "").trim();
+	const apiKey = (store.apiKey ?? "").trim();
+	const userName = (store.userName ?? "").trim() || apiUser;
+	const clientIp = (store.clientIp ?? "").trim();
+	if (apiUser.length === 0 || apiKey.length === 0 || clientIp.length === 0) return null;
+	return {
+		apiUser,
+		apiKey,
+		userName,
+		clientIp
+	};
+}
+/** One XML call. Namecheap answers HTTP 200 whatever happened, so the body decides. */
+async function call(command, params, context) {
+	const auth = credentials(context.credentials);
+	if (auth === null) return "namecheap needs the API user, the API key and the whitelisted client IP";
+	const query = new URLSearchParams({
+		ApiUser: auth.apiUser,
+		ApiKey: auth.apiKey,
+		UserName: auth.userName,
+		ClientIp: auth.clientIp,
+		Command: command,
+		...params
+	});
+	try {
+		const response = await context.fetch(`${ENDPOINT$1}?${query.toString()}`, { signal: context.signal });
+		const body = await response.text();
+		if (!response.ok && !body.includes("<ApiResponse")) return `namecheap answered HTTP ${response.status}`;
+		const status = /<ApiResponse[^>]*Status="([^"]*)"/i.exec(body)?.[1] ?? "";
+		if (status.toUpperCase() !== "OK") return describeErrors(body);
+		return {
+			status,
+			errors: [],
+			body
+		};
+	} catch (error) {
+		return error instanceof Error ? error.message : String(error);
+	}
+}
+/** The registered domain split into the `SLD`/`TLD` pair the API asks for. */
+function apexParts(zone) {
+	const apex = normalizeHost(zone);
+	const dot = apex.indexOf(".");
+	if (dot < 0) return {
+		SLD: apex,
+		TLD: ""
+	};
+	return {
+		SLD: apex.slice(0, dot),
+		TLD: apex.slice(dot + 1)
+	};
+}
+/** The zone's records, or a sentence saying why they could not be read. */
+async function readHosts(zone, context) {
+	const reply = await call("namecheap.domains.dns.getHosts", { ...apexParts(zone) }, context);
+	if (typeof reply === "string") return reply;
+	return parseHosts(reply.body);
+}
+/** Writes the whole record set back. */
+async function writeHosts(zone, records, context) {
+	const params = { ...apexParts(zone) };
+	records.forEach((record, index) => {
+		const at = index + 1;
+		params[`HostName${at}`] = record.name;
+		params[`RecordType${at}`] = record.type;
+		params[`Address${at}`] = record.address;
+		params[`TTL${at}`] = record.ttl;
+		params[`MXPref${at}`] = record.mxPref;
+	});
+	const reply = await call("namecheap.domains.dns.setHosts", params, context);
+	return typeof reply === "string" ? reply : null;
+}
+/** The record name Namecheap expects for a challenge, relative to the zone. */
+function challengeName(fqdn, zone) {
+	const normalized = normalizeHost(fqdn);
+	const apex = normalizeHost(zone);
+	if (normalized === apex) return "@";
+	return normalized.endsWith(`.${apex}`) ? normalized.slice(0, -(apex.length + 1)) : normalized;
+}
+var ENDPOINT$1, RECORD_LIMIT, CHALLENGE_TTL, XML_ENTITIES, namecheapApiProvider;
+var init_namecheap_api = __esmMin((() => {
+	init_types();
+	init_zone();
+	ENDPOINT$1 = "https://api.namecheap.com/xml.response";
+	RECORD_LIMIT = 150;
+	CHALLENGE_TTL = 60;
+	XML_ENTITIES = {
+		amp: "&",
+		lt: "<",
+		gt: ">",
+		quot: "\"",
+		apos: "'"
+	};
+	namecheapApiProvider = {
+		id: "namecheap-api",
+		label: "Namecheap (API)",
+		docsUrl: "https://www.namecheap.com/support/api/methods/domains-dns/set-hosts/",
+		families: ["A"],
+		ttl: true,
+		proxied: false,
+		fields: [
+			{
+				key: "apiUser",
+				label: "API user",
+				hint: "Dashboard → Profile → Tools → Namecheap API Access. Usually your account name.",
+				optional: false
+			},
+			{
+				key: "apiKey",
+				label: "API key",
+				hint: "Shown once when API access is enabled.",
+				optional: false
+			},
+			{
+				key: "userName",
+				label: "User name",
+				hint: "Leave empty unless the API user differs from the account.",
+				optional: true
+			},
+			{
+				key: "clientIp",
+				label: "Whitelisted IP",
+				hint: "The public IPv4 this panel calls from. It must be whitelisted under API Access, and error 1017105 means it is not.",
+				optional: false
+			}
+		],
+		validate(store) {
+			if (credentials(store ?? {}) !== null) return null;
+			const missing = [
+				"apiUser",
+				"apiKey",
+				"clientIp"
+			].filter((key) => (store?.[key] ?? "").trim().length === 0);
+			return missing.length === 0 ? null : `set ${missing.join(", ")}`;
+		},
+		/**
+		* There is no per-record update here: `setHosts` replaces everything, so this is
+		* a read-modify-write of the whole zone.
+		*/
+		async challenge(record, context) {
+			const { zone } = splitHost(record.fqdn);
+			const hosts = await readHosts(zone, context);
+			if (typeof hosts === "string") return {
+				ok: false,
+				message: hosts
+			};
+			const name = challengeName(record.fqdn, zone);
+			const isChallenge = (host) => host.type.toUpperCase() === "TXT" && host.name.toLowerCase() === name.toLowerCase();
+			const isOurs = (host) => isChallenge(host) && host.address === record.value;
+			if (record.action === "present") {
+				if (hosts.some(isOurs)) return {
+					ok: true,
+					message: `${record.fqdn} already carries this value`
+				};
+				if (hosts.length >= RECORD_LIMIT) return {
+					ok: false,
+					message: `namecheap's setHosts takes at most ${RECORD_LIMIT} host records per call and ${zone} has ${hosts.length}, so the panel cannot rewrite this zone to add a challenge record`
+				};
+				const failure = await writeHosts(zone, [...hosts, {
+					name,
+					type: "TXT",
+					address: record.value,
+					mxPref: "10",
+					ttl: String(CHALLENGE_TTL)
+				}], context);
+				if (failure !== null) return {
+					ok: false,
+					message: failure
+				};
+				return {
+					ok: true,
+					message: `added a TXT record for ${record.fqdn} (rewrote ${hosts.length} others)`
+				};
+			}
+			const kept = hosts.filter((host) => !isOurs(host));
+			if (kept.length === hosts.length) return {
+				ok: true,
+				message: `${record.fqdn} had no challenge record to remove`
+			};
+			const failure = await writeHosts(zone, kept, context);
+			if (failure !== null) return {
+				ok: false,
+				message: failure
+			};
+			return {
+				ok: true,
+				message: `removed the TXT record for ${record.fqdn} (rewrote ${kept.length} others)`
+			};
+		}
+	};
+}));
+//#endregion
 //#region src/providers/ddns/noip.ts
 var ENDPOINT, DEFAULT_AGENT, noipProvider;
 var init_noip = __esmMin((() => {
@@ -4759,7 +5150,8 @@ function ddnsProviderInfos() {
 		families: provider.families,
 		fields: provider.fields,
 		ttl: provider.ttl,
-		proxied: provider.proxied
+		proxied: provider.proxied,
+		txt: provider.challenge !== void 0
 	}));
 }
 /**
@@ -4807,12 +5199,14 @@ var init_ddns$2 = __esmMin((() => {
 	init_godaddy();
 	init_henet();
 	init_namecheap();
+	init_namecheap_api();
 	init_noip();
 	init_porkbun();
 	init_spaceship();
 	DDNS_PROVIDERS = [
 		cloudflareProvider,
 		namecheapProvider,
+		namecheapApiProvider,
 		spaceshipProvider,
 		porkbunProvider,
 		godaddyProvider,
@@ -6626,10 +7020,10 @@ function goArch(arch) {
 		default: return null;
 	}
 }
-var BUILD_URL, PINNED, caddyEngine;
+var BUILD_URL, PLUGINS, caddyEngine;
 var init_caddy = __esmMin((() => {
 	BUILD_URL = "https://caddyserver.com/api/download";
-	PINNED = "2.11.4";
+	PLUGINS = ["github.com/caddy-dns/acmeproxy"];
 	caddyEngine = {
 		info: {
 			id: "caddy",
@@ -6638,10 +7032,9 @@ var init_caddy = __esmMin((() => {
 			releaseUrl: "https://github.com/caddyserver/caddy/releases",
 			acme: true,
 			internalCa: true,
-			dns01: false,
+			dns01: true,
 			tcp: false
 		},
-		pinnedVersion: PINNED,
 		binaryName(platform) {
 			return platform === "win32" ? "hh-caddy.exe" : "hh-caddy";
 		},
@@ -6649,10 +7042,11 @@ var init_caddy = __esmMin((() => {
 			const arch = goArch(target.arch);
 			if (arch === null) return null;
 			if (target.platform !== "linux" && target.platform !== "darwin" && target.platform !== "win32") return null;
-			const version = target.version.length > 0 ? target.version : PINNED;
+			const wanted = target.version.length > 0 ? `&version=${encodeURIComponent(target.version)}` : "";
+			const plugins = PLUGINS.map((plugin) => `&p=${encodeURIComponent(plugin)}`).join("");
 			return {
-				url: `${BUILD_URL}?os=${target.platform}&arch=${arch}&version=${encodeURIComponent(version)}`,
-				version
+				url: `${BUILD_URL}?os=${target.platform}&arch=${arch}${wanted}${plugins}`,
+				version: target.version
 			};
 		},
 		runArgs(run) {
@@ -6709,13 +7103,67 @@ var init_proxy$2 = __esmMin((() => {
 * ZeroSSL is deliberately absent: it needs an EAB key the panel does not collect, so
 * listing it only added a failing issuer and a second retry on every name.
 */
-function acmeIssuers(acme) {
+/**
+* The DNS-01 challenge block, which names the panel as the one that answers it. The
+* engine holds no DNS credentials: it asks the panel over the ACMEProxy protocol, and
+* the panel writes the record through the workspace account the route names.
+*/
+function challengeBlock(dns01) {
+	return { challenges: { dns: {
+		provider: {
+			name: "acmeproxy",
+			endpoint: dns01.endpoint,
+			username: dns01.username,
+			password: dns01.password
+		},
+		...dns01.resolvers.length > 0 ? { resolvers: dns01.resolvers } : {}
+	} } };
+}
+function acmeIssuers(acme, challenge = {}) {
 	return [{
 		module: "acme",
 		...acme.email.length > 0 ? { email: acme.email } : {},
-		...acme.staging ? { ca: ACME_STAGING } : {}
+		...acme.staging ? { ca: ACME_STAGING } : {},
+		...challenge
 	}, { module: "internal" }];
 }
+/**
+* The page a visitor gets when the hostname they reached is not routed at all. It is
+* the answer on both ports, so a request never lands on a redirect into a handshake
+* that cannot finish.
+*/
+function notConfiguredPage() {
+	return `<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>No route for this hostname</title>
+<style>
+  :root { color-scheme: light dark }
+  body { margin: 0; min-height: 100dvh; display: grid; place-items: center; font: 15px/1.6 system-ui, sans-serif }
+  main { max-width: 34rem; padding: 2rem }
+  h1 { font-size: 1.15rem; margin: 0 0 .75rem }
+  p { margin: 0 0 .75rem }
+  code { font-family: ui-monospace, monospace; font-size: .9em }
+  footer { color: #888; font-size: .85em }
+</style></head>
+<body><main>
+  <h1>This route is not configured for any target yet</h1>
+  <p>No route in <strong>home-hosted</strong>'s reverse proxy claims the hostname
+  <code>{http.request.host}</code>, so there is nothing here to serve.</p>
+  <p>Add a route for it under <strong>Others → Reverse Proxy</strong>, or check that you
+  reached the hostname you meant to.</p>
+  <footer>home-hosted reverse proxy</footer>
+</main></body></html>`;
+}
+/** The catch-all: it answers last, so every configured route wins over it. */
+function notConfiguredRoute() {
+	return { handle: [{
+		handler: "static_response",
+		status_code: 404,
+		headers: { "content-type": ["text/html; charset=utf-8"] },
+		body: notConfiguredPage()
+	}] };
+}
 /** The page a visitor gets when a name has no certificate yet and HTTPS cannot work. */
 function noticePage(host, httpPort, httpsPort) {
 	return `<!doctype html>
@@ -6802,11 +7250,20 @@ function renderCaddyConfig(input) {
 	const servers = {};
 	if (managed.length > 0) servers.https = {
 		listen: [`:${config.httpsPort}`],
-		routes: managed.map((route) => ({
-			match: [matchFor(route)],
-			handle: [proxyHandler(route)],
-			terminal: true
-		}))
+		tls_connection_policies: [{ default_sni: FALLBACK_NAME }],
+		routes: [
+			...managed.map((route) => ({
+				match: [matchFor(route)],
+				handle: [proxyHandler(route)],
+				terminal: true
+			})),
+			{
+				match: [{ host: [FALLBACK_NAME] }],
+				...notConfiguredRoute(),
+				terminal: true
+			},
+			notConfiguredRoute()
+		]
 	};
 	if (routes.length > 0) servers.http = {
 		listen: [`:${config.httpPort}`],
@@ -6836,7 +7293,8 @@ function renderCaddyConfig(input) {
 					headers: { "content-type": ["text/html; charset=utf-8"] },
 					body: noticePage(host, config.httpPort, config.httpsPort)
 				}]
-			}))
+			})),
+			notConfiguredRoute()
 		]
 	};
 	const adminBlock = { config: { persist: false } };
@@ -6848,10 +7306,25 @@ function renderCaddyConfig(input) {
 	}
 	const tlsApp = {};
 	if (input.manual.length > 0) tlsApp.certificates = { load_files: input.manual };
-	if (input.acme.subjects.length > 0) tlsApp.automation = { policies: [{
-		subjects: input.acme.subjects,
-		issuers: acmeIssuers(input.acme)
-	}] };
+	const policies = [];
+	if (input.acme.subjects.length > 0) {
+		const challenge = input.dns01 === void 0 ? {} : challengeBlock(input.dns01);
+		const dnsSubjects = new Set(input.dns01?.policies.flatMap((policy) => policy.subjects) ?? []);
+		for (const policy of input.dns01?.policies ?? []) policies.push({
+			subjects: policy.subjects,
+			issuers: acmeIssuers(input.acme, challenge)
+		});
+		const rest = input.acme.subjects.filter((subject) => !dnsSubjects.has(subject));
+		if (rest.length > 0) policies.push({
+			subjects: rest,
+			issuers: acmeIssuers(input.acme)
+		});
+	}
+	if (managed.length > 0) policies.push({
+		subjects: [FALLBACK_NAME],
+		issuers: [{ module: "internal" }]
+	});
+	if (policies.length > 0) tlsApp.automation = { policies };
 	return {
 		admin: adminBlock,
 		storage: {
@@ -6869,9 +7342,10 @@ function renderCaddyConfig(input) {
 		}
 	};
 }
-var ACME_STAGING;
+var ACME_STAGING, FALLBACK_NAME;
 var init_proxy_config = __esmMin((() => {
 	ACME_STAGING = "https://acme-staging-v02.api.letsencrypt.org/directory";
+	FALLBACK_NAME = "hh-fallback.invalid";
 }));
 //#endregion
 //#region src/services/tls.ts
@@ -7054,6 +7528,17 @@ function coversHost(hosts, host) {
 		return name.endsWith(suffix) && !name.slice(0, -suffix.length).includes(".");
 	});
 }
+/**
+* When the engine tries the CA again, in minutes.
+*
+* certmagic renews once a third of a certificate's lifetime is left, so two thirds
+* of it is the wait; the engine's own CA issues 12 hours by default, which is where
+* the "about 8 hours" comes from. Read from the certificate, so shortening that
+* lifetime shortens the wait too.
+*/
+function retryWindowMinutes(lifetimeMs) {
+	return Math.max(1, Math.round(lifetimeMs / 6e4 * (2 / 3)));
+}
 /** `host:port`, `http://host:port` or `https://host:port`; `null` when unusable. */
 function parseUpstream(value) {
 	const trimmed = value.trim();
@@ -7070,8 +7555,36 @@ function parseUpstream(value) {
 		return null;
 	}
 }
+/**
+* The engine policies DNS-01 needs: one per account, because a policy carries one
+* challenge provider. Names that no account answers are left out, and the caller
+* renders them on the port challenges as before.
+*
+* Pure so the grouping can be checked without an engine: getting it wrong means a
+* hostname is asked for through the wrong zone, which fails with nothing to read.
+*/
+function groupDns01Policies(routes, accountFor) {
+	const byAccount = /* @__PURE__ */ new Map();
+	for (const route of routes) {
+		if (route.tls !== "auto" || !isPublicHost(route.host)) continue;
+		const account = accountFor(route.host);
+		if (account === null) continue;
+		const key = `${account.workspaceId}/${account.accountId}`;
+		const existing = byAccount.get(key);
+		if (existing === void 0) byAccount.set(key, {
+			provider: account.provider,
+			subjects: [route.host]
+		});
+		else if (!existing.subjects.includes(route.host)) existing.subjects.push(route.host);
+	}
+	return [...byAccount.entries()].map(([account, group]) => ({
+		account,
+		provider: group.provider,
+		subjects: group.subjects
+	}));
+}
 /** Cross-field problems ArkType cannot see, reported by the API before a save. */
-function validateProxyConfig(config) {
+function validateProxyConfig(config, dnsAccount) {
 	const errors = [];
 	if (config.httpPort === config.httpsPort) errors.push("the http and https ports must differ");
 	const publicNames = [...new Set(config.routes.filter((route) => route.tls !== "off").map((route) => route.host.toLowerCase()))].filter((host) => isPublicHost(host));
@@ -7086,6 +7599,13 @@ function validateProxyConfig(config) {
 		seen.add(key);
 		if (route.target === "server" && (route.workspace.length === 0 || route.server.length === 0)) errors.push(`route "${route.id}" needs a workspace and a server`);
 		if (route.target === "external" && parseUpstream(route.url) === null) errors.push(`route "${route.id}" needs an upstream like http://10.0.0.5:8080`);
+		const named = route.dnsAccount.trim();
+		if (named.length === 0 || dnsAccount === void 0) continue;
+		if (!config.dns01.enabled) errors.push(`route "${route.id}" names DNS account "${named}", but DNS-01 is switched off`);
+		const found = dnsAccount(named, route.workspace);
+		if (found === null) errors.push(`route "${route.id}" names unknown DNS account "${named}"`);
+		else if (!found.writesTxt) errors.push(`route "${route.id}": the "${found.provider}" account cannot write TXT records, so it cannot answer a DNS-01 challenge`);
+		else if (!found.hasCredentials) errors.push(`route "${route.id}": the "${found.provider}" account has no credentials stored yet`);
 	}
 	return errors;
 }
@@ -7104,12 +7624,14 @@ function engineMessage(body) {
 		return body.trim().length > 0 ? body.trim().slice(0, 400) : null;
 	}
 }
-var PROXY_ID, ADMIN_TIMEOUT_MS, READY_TIMEOUT_MS, READY_POLL_MS, DOWNLOAD_TIMEOUT_MS$1, engineRecordSchema, appliedRecordSchema, adminRecordSchema, ProxyService, LOCAL_TLDS;
+var PROXY_ID, ADMIN_TIMEOUT_MS, READY_TIMEOUT_MS, READY_POLL_MS, DOWNLOAD_TIMEOUT_MS$1, ENGINE_COMMAND_TIMEOUT_MS, DNS01_MODULE, engineRecordSchema, challengeAuthSchema, appliedRecordSchema, adminRecordSchema, ProxyService, LOCAL_TLDS;
 var init_proxy$1 = __esmMin((() => {
 	init_atomic();
 	init_logger();
 	init_paths();
 	init_runtime();
+	init_ddns$2();
+	init_types();
 	init_nanny$2();
 	init_port();
 	init_proxy$2();
@@ -7120,15 +7642,20 @@ var init_proxy$1 = __esmMin((() => {
 	READY_TIMEOUT_MS = 2e4;
 	READY_POLL_MS = 250;
 	DOWNLOAD_TIMEOUT_MS$1 = 9e5;
+	ENGINE_COMMAND_TIMEOUT_MS = 1e4;
+	DNS01_MODULE = "dns.providers.acmeproxy";
 	engineRecordSchema = type({
 		engine: "string",
 		version: "string",
 		source: "\"downloaded\" | \"custom\"",
 		url: "string",
-		sha256: "string",
 		bytes: "number",
 		installedAt: "number"
 	}).onUndeclaredKey("reject");
+	challengeAuthSchema = type({
+		username: "string >= 1",
+		password: "string >= 1"
+	}).onUndeclaredKey("reject");
 	appliedRecordSchema = type({
 		httpPort: "1 <= number.integer <= 65535",
 		httpsPort: "1 <= number.integer <= 65535",
@@ -7146,6 +7673,10 @@ var init_proxy$1 = __esmMin((() => {
 		nanny = null;
 		admin = null;
 		lastError = null;
+		/** The installed binary's modules, read once per process; an install clears it. */
+		moduleCache = null;
+		/** A legacy `engine.json` is reported once, not on every state frame. */
+		legacyChecksumWarned = false;
 		certCache = null;
 		/** The certificate state the last apply was built from, so a change re-applies once. */
 		certificateSignature = null;
@@ -7166,6 +7697,146 @@ var init_proxy$1 = __esmMin((() => {
 		get enginePath() {
 			return path.join(this.options.binDir, this.engine.binaryName(process.platform));
 		}
+		/**
+		* The Basic credentials the engine uses to reach the panel's DNS-01 endpoint.
+		* Generated on first use and kept 0600: the endpoint is loopback-only, and this
+		* is the second lock on a door that writes into somebody's DNS.
+		*/
+		challengeAuth() {
+			const file = this.options.challengeAuthPath ?? proxyChallengeAuthPath;
+			try {
+				const parsed = challengeAuthSchema(JSON.parse(fs.readFileSync(file, "utf8")));
+				if (!(parsed instanceof type.errors)) return parsed;
+			} catch {}
+			const auth = {
+				username: "hh",
+				password: randomBytes(24).toString("base64url")
+			};
+			fs.mkdirSync(path.dirname(file), {
+				recursive: true,
+				mode: 448
+			});
+			writeFileAtomic(file, `${JSON.stringify(auth, null, 2)}\n`, { mode: 384 });
+			return auth;
+		}
+		/**
+		* The DNS-01 half of the renderer's input, or undefined when it is switched off.
+		*
+		* One entry per account, because an engine policy carries one challenge provider:
+		* a name whose zone is at Cloudflare and one at deSEC need a policy each.
+		*/
+		dns01Input(routes) {
+			if (!this.config.dns01.enabled) return void 0;
+			const endpoint = this.options.control();
+			const auth = this.challengeAuth();
+			const policies = groupDns01Policies(routes, (host) => this.resolveAccount(host));
+			return {
+				resolvers: this.config.dns01.resolvers,
+				endpoint: `${endpoint.protocol}://127.0.0.1:${endpoint.port}/_acme`,
+				username: auth.username,
+				password: auth.password,
+				policies
+			};
+		}
+		/** The workspace a route's DNS account is looked up in. */
+		workspaceOf(route) {
+			if (route.workspace.length > 0) return route.workspace;
+			return this.options.defaultWorkspaceId?.() ?? "";
+		}
+		/**
+		* The account a route names, or null when it names none.
+		*
+		* A bare id belongs to the route's own workspace; `<workspace>/<id>` crosses into
+		* another one, which is what lets one route table cover zones owned by different
+		* workspaces.
+		*/
+		dnsAccountRef(route) {
+			if (route === void 0) return null;
+			const named = route.dnsAccount.trim();
+			if (named.length === 0) return null;
+			const workspaceId = this.workspaceOf(route);
+			if (workspaceId.length === 0) return null;
+			const [owner, accountId] = named.includes("/") ? named.split("/", 2) : [workspaceId, named];
+			const resolved = this.options.resolveDnsAccount?.(owner ?? "", accountId ?? "");
+			if (resolved === void 0 || resolved === null) return null;
+			return {
+				owner: owner ?? "",
+				accountId: accountId ?? "",
+				provider: resolved.provider
+			};
+		}
+		/** The route that answers for a hostname, challenge prefix or not. */
+		routeForHost(host) {
+			return this.config.routes.find((route) => route.enabled && route.host.toLowerCase() === host);
+		}
+		/**
+		* The account that answers a DNS-01 challenge for one hostname.
+		*
+		* The route is the authority. An explicit `dnsAccount` wins; an empty one falls back
+		* to the only account any route names, so a single-account setup needs no per-route
+		* choice — and never to a guess among several, because writing the wrong zone fails
+		* silently.
+		*/
+		challengeAccount(fqdn) {
+			const host = fqdn.startsWith("_acme-challenge.") ? fqdn.slice(16) : fqdn;
+			return this.resolveAccount(normalizeHost(host));
+		}
+		resolveAccount(host) {
+			if (!this.config.dns01.enabled) return null;
+			if (!isPublicHost(host)) return null;
+			if (this.options.resolveDnsAccount === void 0) return null;
+			const route = this.routeForHost(host);
+			if (route === void 0) return null;
+			const named = this.dnsAccountRef(route);
+			if (named !== null) return this.accountOf(named.owner, named.accountId);
+			const declared = /* @__PURE__ */ new Map();
+			for (const entry of this.config.routes) {
+				if (!entry.enabled) continue;
+				const ref = this.dnsAccountRef(entry);
+				if (ref !== null) declared.set(`${ref.owner}/${ref.accountId}`, {
+					owner: ref.owner,
+					accountId: ref.accountId
+				});
+			}
+			if (declared.size === 1) {
+				const only = [...declared.values()][0];
+				return this.accountOf(only.owner, only.accountId);
+			}
+			if (declared.size > 1) return null;
+			const usable = (this.options.listDnsAccounts?.() ?? []).filter((entry) => entry.writesTxt && entry.hasCredentials);
+			if (usable.length !== 1) return null;
+			const only = usable[0];
+			return this.accountOf(only.workspace, only.account);
+		}
+		accountOf(workspaceId, accountId) {
+			const found = this.options.resolveDnsAccount?.(workspaceId, accountId);
+			if (found === void 0 || found === null || found.credentials === null) return null;
+			return {
+				workspaceId,
+				accountId,
+				provider: found.provider,
+				credentials: found.credentials
+			};
+		}
+		/**
+		* What a route's `dnsAccount` refers to, for the save-time check.
+		*
+		* A bare id belongs to the default workspace, which is what a person typing one
+		* account means; `<workspace>/<id>` crosses into another.
+		*/
+		checkDnsAccount(reference, workspaceId = "") {
+			const named = reference.trim();
+			if (named.length === 0) return null;
+			const owner = named.includes("/") ? named.split("/", 2)[0] ?? "" : workspaceId.length > 0 ? workspaceId : this.options.defaultWorkspaceId?.() ?? "";
+			const accountId = named.includes("/") ? named.split("/", 2)[1] ?? "" : named;
+			const found = this.options.resolveDnsAccount?.(owner, accountId);
+			if (found === void 0 || found === null) return null;
+			return {
+				provider: found.provider,
+				writesTxt: ddnsProvider(found.provider)?.challenge !== void 0,
+				hasCredentials: found.credentials !== null
+			};
+		}
 		/** One uploaded pair, by the id that names it in the config. */
 		pairStore(id) {
 			return new TlsStore(this.options.tlsDir, id);
@@ -7238,6 +7909,7 @@ var init_proxy$1 = __esmMin((() => {
 			if (this.certCache !== null && this.certCache.key === key && Date.now() - this.certCache.at < 15e3) return this.certCache;
 			const views = this.readCertificateViews();
 			const issued = this.readIssuedCertificates();
+			const local = this.readLocalCertificates();
 			const values = [...issued.values()];
 			const soonest = values.length === 0 ? null : Math.min(...values.map((entry) => entry.notAfter));
 			this.certCache = {
@@ -7245,6 +7917,7 @@ var init_proxy$1 = __esmMin((() => {
 				key,
 				days: soonest === null ? null : Math.floor((soonest - Date.now()) / 864e5),
 				issued,
+				local,
 				views
 			};
 			return this.certCache;
@@ -7337,6 +8010,12 @@ var init_proxy$1 = __esmMin((() => {
 				message: `expires in ${Math.floor((issued.notAfter - Date.now()) / 864e5)} days`
 			};
 			const failure = this.obtainFailures().get(route.host.toLowerCase());
+			const local = this.localCertificates().get(route.host.toLowerCase());
+			if (local !== void 0) return {
+				state: "fallback",
+				message: failure ?? "the CA has not issued for this name",
+				retryInMinutes: retryWindowMinutes(local.lifetimeMs)
+			};
 			return failure === void 0 ? {
 				state: "pending",
 				message: "the engine is waiting for a certificate"
@@ -7349,6 +8028,40 @@ var init_proxy$1 = __esmMin((() => {
 		issuedCertificates() {
 			return this.certSnapshot().issued;
 		}
+		/** Certificates the engine's own CA issued, by hostname. */
+		localCertificates() {
+			return this.certSnapshot().local;
+		}
+		/**
+		* The engine's own certificates, which `readIssuedCertificates` skips on purpose.
+		*
+		* A public name in here means the CA would not issue and the engine fell back to
+		* its own CA — a state worth its own name, because the name is served but not by a
+		* trusted issuer, and it clears itself when the engine next tries the CA.
+		*/
+		readLocalCertificates() {
+			const found = /* @__PURE__ */ new Map();
+			const root = path.join(this.options.engineDir, "data", "certificates", "local");
+			let entries;
+			try {
+				entries = fs.readdirSync(root, { withFileTypes: true });
+			} catch {
+				return found;
+			}
+			for (const entry of entries) {
+				if (!entry.isDirectory()) continue;
+				try {
+					const x509 = new X509Certificate(fs.readFileSync(path.join(root, entry.name, `${entry.name}.crt`)));
+					const notAfter = new Date(x509.validTo).getTime();
+					const notBefore = new Date(x509.validFrom).getTime();
+					for (const host of namesOf(x509)) found.set(host, {
+						notAfter,
+						lifetimeMs: Math.max(0, notAfter - notBefore)
+					});
+				} catch {}
+			}
+			return found;
+		}
 		readIssuedCertificates() {
 			const found = /* @__PURE__ */ new Map();
 			const root = path.join(this.options.engineDir, "data", "certificates");
@@ -7406,7 +8119,7 @@ var init_proxy$1 = __esmMin((() => {
 				const identifier = typeof inner.identifier === "string" ? inner.identifier.toLowerCase() : null;
 				if (identifier === null) continue;
 				if (inner.logger === "tls.obtain" && typeof inner.error === "string") failures.set(identifier, inner.error);
-				if (inner.msg === "certificate obtained successfully") failures.delete(identifier);
+				if (inner.msg === "certificate obtained successfully" && inner.issuer !== "local") failures.delete(identifier);
 			}
 			return failures;
 		}
@@ -7448,6 +8161,16 @@ var init_proxy$1 = __esmMin((() => {
 			}
 		}
 		/** True when a nanny this panel would recognise still owns the engine. */
+		/**
+		* True while a process from the installed binary is alive, however the panel's view
+		* reads. `live()` additionally requires a fresh heartbeat, so a nanny that died and
+		* left its child behind would look gone while the binary is still in use.
+		*/
+		engineRunning() {
+			const state = readNannyState(nannyStatePath(this.options.stateDir, PROXY_ID));
+			if (state === null || state.serverId !== PROXY_ID) return false;
+			return [state.nannyPid, state.childPid].some((pid) => pid !== null && pid > 0 && isProcessAlive$1(pid));
+		}
 		live() {
 			const state = readNannyState(nannyStatePath(this.options.stateDir, PROXY_ID));
 			if (state === null || state.serverId !== PROXY_ID) return false;
@@ -7467,7 +8190,7 @@ var init_proxy$1 = __esmMin((() => {
 			const applied = this.readApplied();
 			const httpPort = applied?.httpPort ?? config.httpPort;
 			const httpsPort = applied?.httpsPort ?? config.httpsPort;
-			const urls = [`http://localhost:${httpPort}`, `https://localhost:${httpsPort}`];
+			const urls = [`http://127.0.0.1:${httpPort}`, `https://127.0.0.1:${httpsPort}`];
 			const certExpiryDays = this.certificateExpiryDays();
 			if (!this.installed()) return {
 				...base,
@@ -7536,8 +8259,63 @@ var init_proxy$1 = __esmMin((() => {
 			return config;
 		}
 		/** Renders the current route table and applies it; the engine keeps serving on failure. */
-		async apply() {
+		/**
+		* Makes the engine ask the CA again for one name, without restarting it.
+		*
+		* Caddy keeps the certificate it holds — in memory and on disk — until the name
+		* leaves its configuration, and the engine's own CA is the last issuer in the
+		* policy, so a name the CA refused is served that untrusted pair and never asks
+		* again until renewal. Reloading the configuration without the route is what makes
+		* the engine let go; the stored pair is dropped while it is out, so putting the
+		* route back leaves nothing to reuse and the engine asks the CA.
+		*
+		* Only this name is out of the configuration, and only for the two reloads: every
+		* other route keeps serving.
+		*/
+		async retryCertificate(routeId) {
+			const route = this.config.routes.find((entry) => entry.id === routeId);
+			if (route === void 0) throw new DetailedError(`unknown route "${routeId}"`, {
+				statusCode: 404,
+				code: "PROXY_ROUTE_UNKNOWN"
+			});
+			if (route.tls !== "auto" || !isPublicHost(route.host)) throw new DetailedError(`"${route.host}" is not a name a CA issues for, so there is nothing to retry`, {
+				statusCode: 400,
+				code: "PROXY_CERT_NOT_MANAGED"
+			});
+			if (!this.installed()) throw new DetailedError("the proxy engine is not installed yet", {
+				statusCode: 400,
+				code: "ENGINE_MISSING"
+			});
+			if (this.status().state !== "running") {
+				this.forgetCertificates(route.host);
+				await this.apply({ force: true });
+				return;
+			}
+			await this.loadIntoEngine(this.render(/* @__PURE__ */ new Set([route.id])));
+			this.forgetCertificates(route.host);
+			await this.apply({ force: true });
+		}
+		/** Removes the engine's stored certificates for one name, and nothing else. */
+		forgetCertificates(host) {
+			const root = path.join(this.options.engineDir, "data", "certificates");
+			let issuers;
+			try {
+				issuers = fs.readdirSync(root);
+			} catch {
+				return;
+			}
+			for (const issuer of issuers) {
+				const dir = path.join(root, issuer, host);
+				if (!dir.startsWith(`${root}${path.sep}`)) continue;
+				fs.rmSync(dir, {
+					recursive: true,
+					force: true
+				});
+			}
+		}
+		async apply(options = {}) {
 			if (!this.config.enabled || !this.installed()) return;
+			await this.assertDns01Module();
 			if (this.admin === null) {
 				const stillThere = this.readAdmin();
 				if (stillThere === null) return;
@@ -7545,7 +8323,7 @@ var init_proxy$1 = __esmMin((() => {
 			}
 			const rendered = this.render();
 			const text = `${JSON.stringify(rendered, null, 2)}\n`;
-			if (fs.existsSync(this.options.configPath) && fs.readFileSync(this.options.configPath, "utf8") === text) {
+			if (options.force !== true && fs.existsSync(this.options.configPath) && fs.readFileSync(this.options.configPath, "utf8") === text) {
 				this.lastError = null;
 				return;
 			}
@@ -7566,13 +8344,69 @@ var init_proxy$1 = __esmMin((() => {
 			}
 			this.rememberConfig(text);
 			this.rememberApplied(this.config.httpPort, this.config.httpsPort);
+			const swept = this.sweepUnroutedCertificates();
+			if (swept > 0) logger.info(`proxy:    dropped ${swept} certificate(s) for names no longer routed`);
 			this.lastError = null;
 			this.options.onStateChange();
 		}
+		/**
+		* Certificates the engine holds for names it no longer serves.
+		*
+		* Caddy keeps a certificate until the name leaves its configuration, so a removed
+		* route would leave its pair behind and re-adding the route would serve that stale
+		* certificate instead of asking the CA. A *disabled* route keeps its pair: it is
+		* still configured, and a temporary switch-off should not cost a new issuance.
+		*/
+		sweepUnroutedCertificates() {
+			const managed = new Set(this.config.routes.filter((route) => route.tls !== "off").map((route) => route.host.toLowerCase()));
+			managed.add(FALLBACK_NAME.toLowerCase());
+			const root = path.join(this.options.engineDir, "data", "certificates");
+			let issuers;
+			try {
+				issuers = fs.readdirSync(root);
+			} catch {
+				return 0;
+			}
+			let removed = 0;
+			for (const issuer of issuers) {
+				const dir = path.join(root, issuer);
+				let hosts;
+				try {
+					hosts = fs.readdirSync(dir, { withFileTypes: true });
+				} catch {
+					continue;
+				}
+				for (const host of hosts) {
+					if (!host.isDirectory() || managed.has(host.name.toLowerCase())) continue;
+					fs.rmSync(path.join(dir, host.name), {
+						recursive: true,
+						force: true
+					});
+					removed += 1;
+				}
+			}
+			return removed;
+		}
+		/** Hands a configuration to the running engine without touching the file on disk. */
+		async loadIntoEngine(rendered) {
+			const result = await this.request("POST", "/load", rendered).catch((error) => {
+				throw new DetailedError(`the engine did not accept the configuration: ${error instanceof Error ? error.message : String(error)}`, {
+					statusCode: 502,
+					code: "ENGINE_UNREACHABLE"
+				});
+			});
+			if (result.status >= 400) {
+				const message = engineMessage(result.body) ?? `the engine rejected the configuration (HTTP ${result.status})`;
+				throw new DetailedError(message, {
+					statusCode: 400,
+					code: "PROXY_CONFIG_REJECTED"
+				});
+			}
+		}
 		/** Advances `previous.json` only for a configuration the engine accepted. */
 		rememberConfig(text) {
-			if (fs.existsSync(this.options.configPath)) writeFileAtomic(this.options.previousConfigPath, fs.readFileSync(this.options.configPath, "utf8"));
-			writeFileAtomic(this.options.configPath, text);
+			if (fs.existsSync(this.options.configPath)) writeFileAtomic(this.options.previousConfigPath, fs.readFileSync(this.options.configPath, "utf8"), { mode: 384 });
+			writeFileAtomic(this.options.configPath, text, { mode: 384 });
 		}
 		/** The ports the engine last bound. */
 		readApplied() {
@@ -7641,9 +8475,9 @@ var init_proxy$1 = __esmMin((() => {
 					code: "PROXY_CONFIG_REJECTED"
 				});
 			}
-			writeFileAtomic(this.options.configPath, previous);
+			writeFileAtomic(this.options.configPath, previous, { mode: 384 });
 			if (current === null) fs.rmSync(this.options.previousConfigPath, { force: true });
-			else writeFileAtomic(this.options.previousConfigPath, current);
+			else writeFileAtomic(this.options.previousConfigPath, current, { mode: 384 });
 			this.lastError = null;
 			this.options.onStateChange();
 		}
@@ -7651,19 +8485,20 @@ var init_proxy$1 = __esmMin((() => {
 		* The engine configuration for the current route table. Throws when a route cannot
 		* be built, because a half-built configuration is worse than a refused one.
 		*/
-		render() {
-			const blocked = this.resolveRoutes().find((view) => view.status === "error");
+		render(exclude) {
+			const blocked = this.resolveRoutes(exclude).find((view) => view.status === "error");
 			if (blocked !== void 0) throw new DetailedError(blocked.message ?? `${blocked.route.host} cannot be routed`, {
 				statusCode: 400,
 				code: "PROXY_ROUTE_INVALID"
 			});
-			const routes = this.engineRoutes();
+			const routes = this.engineRoutes(exclude);
 			return renderCaddyConfig({
 				config: this.config,
 				admin: this.admin ?? this.unixAdmin(),
 				engineDir: this.options.engineDir,
 				manual: this.manualPairs(),
 				acme: this.acmeAccount(routes),
+				dns01: this.dns01Input(routes),
 				routes
 			});
 		}
@@ -7684,9 +8519,9 @@ var init_proxy$1 = __esmMin((() => {
 			};
 		}
 		/** Every route, resolved far enough to render. */
-		resolveRoutes() {
+		resolveRoutes(exclude) {
 			const seen = /* @__PURE__ */ new Map();
-			return this.config.routes.map((route) => {
+			return this.config.routes.filter((route) => exclude?.has(route.id) !== true).map((route) => {
 				const key = `${route.host.toLowerCase()}${route.path}`;
 				const clash = seen.get(key);
 				if (clash !== void 0) return {
@@ -7780,8 +8615,8 @@ var init_proxy$1 = __esmMin((() => {
 			});
 		}
 		/** Only the routes the engine can serve, in the shape the renderer wants. */
-		engineRoutes() {
-			return this.resolveRoutes().filter((resolved) => resolved.status === "ok" && resolved.upstream !== null).map((resolved) => {
+		engineRoutes(exclude) {
+			return this.resolveRoutes(exclude).filter((resolved) => resolved.status === "ok" && resolved.upstream !== null).map((resolved) => {
 				const certificate = this.certificateFor(resolved.route);
 				return {
 					host: resolved.route.host,
@@ -7813,7 +8648,8 @@ var init_proxy$1 = __esmMin((() => {
 				engines: proxyEngineInfos(),
 				status: this.status(),
 				routes: this.routeViews(),
-				certificates: this.certificateViews()
+				certificates: this.certificateViews(),
+				dnsAccounts: this.options.listDnsAccounts?.() ?? []
 			};
 		}
 		installed() {
@@ -7825,8 +8661,18 @@ var init_proxy$1 = __esmMin((() => {
 		}
 		readEngineRecord() {
 			try {
-				const parsed = engineRecordSchema(JSON.parse(fs.readFileSync(path.join(this.options.binDir, "engine.json"), "utf8")));
-				return parsed instanceof type.errors ? null : parsed;
+				const parsed = JSON.parse(fs.readFileSync(path.join(this.options.binDir, "engine.json"), "utf8"));
+				if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return null;
+				const record = parsed;
+				if ("sha256" in record) {
+					delete record.sha256;
+					if (!this.legacyChecksumWarned) {
+						this.legacyChecksumWarned = true;
+						logger.warn("proxy:    dropped the recorded engine checksum; nothing verifies it");
+					}
+				}
+				const parsedRecord = engineRecordSchema(record);
+				return parsedRecord instanceof type.errors ? null : parsedRecord;
 			} catch {
 				return null;
 			}
@@ -7840,7 +8686,6 @@ var init_proxy$1 = __esmMin((() => {
 				source: null,
 				path: null,
 				bytes: null,
-				sha256: null,
 				error: null
 			};
 			let stats;
@@ -7856,14 +8701,17 @@ var init_proxy$1 = __esmMin((() => {
 				version: record?.version ?? null,
 				source: record?.source ?? (stats.isFile() ? "custom" : null),
 				path: path_,
-				bytes: record?.bytes ?? stats.size,
-				sha256: record?.sha256 ?? null
+				bytes: record?.bytes ?? stats.size
 			};
 		}
 		/**
-		* Downloads a pinned release from the engine's own build service. Plugins are
-		* compiled in server-side, so no toolchain is involved and the version is
-		* whatever was asked for — never "latest" by accident.
+		* Downloads a release from the engine's own build service. Plugins are compiled
+		* in server-side, so no toolchain is involved. An empty `version` asks for the
+		* current release, which is how a security fix reaches the user by pressing Update.
+		*
+		* Refused while the engine is up: the binary is replaced on disk, and Windows
+		* will not replace a running executable at all. Stopping first is the caller's
+		* move, so the panel never drops a socket that faces the internet on its own.
 		*/
 		async install(version = "") {
 			const engine = this.engine;
@@ -7871,6 +8719,10 @@ var init_proxy$1 = __esmMin((() => {
 				statusCode: 400,
 				code: "INVALID_ENGINE_VERSION"
 			});
+			if (this.engineRunning()) throw new DetailedError(`the ${engine.info.label} engine is still running — stop it before installing another build`, {
+				statusCode: 409,
+				code: "ENGINE_BUSY"
+			});
 			const download = engine.download({
 				platform: process.platform,
 				arch: process.arch,
@@ -7894,13 +8746,11 @@ var init_proxy$1 = __esmMin((() => {
 				statusCode: 502,
 				code: "ENGINE_DOWNLOAD_FAILED"
 			});
-			const hash = createHash("sha256");
 			const handle = fs.openSync(target, "w", 493);
 			let bytes = 0;
 			try {
 				for await (const chunk of response.body) {
 					const buffer = Buffer$1.isBuffer(chunk) ? chunk : Buffer$1.from(chunk);
-					hash.update(buffer);
 					bytes += buffer.length;
 					fs.writeSync(handle, buffer);
 				}
@@ -7914,30 +8764,33 @@ var init_proxy$1 = __esmMin((() => {
 					code: "ENGINE_DOWNLOAD_FAILED"
 				});
 			}
-			const sha256 = hash.digest("hex");
 			if (process.platform !== "win32") fs.chmodSync(target, 493);
 			fs.renameSync(target, this.enginePath);
 			if (process.platform !== "win32") fs.chmodSync(this.enginePath, 493);
 			const probed = await this.probeEngineVersion();
 			const record = {
 				engine: engine.info.id,
-				version: probed ?? download.version,
+				version: probed ?? (download.version.length > 0 ? download.version : "unknown"),
 				source: "downloaded",
 				url: download.url,
-				sha256,
 				bytes,
 				installedAt: Date.now()
 			};
 			writeFileAtomic(path.join(this.options.binDir, "engine.json"), `${JSON.stringify(record, null, 2)}\n`, { mode: 384 });
+			this.moduleCache = null;
 			logger.info(`proxy:    installed ${engine.info.label} ${record.version} (${Math.round(bytes / 1024 / 1024)} MB)`);
 			this.options.onStateChange();
 			return this.engineStatus();
 		}
-		/** Runs `version` once and reports what the binary actually is. */
-		async probeEngineVersion() {
-			if (!this.installed()) return null;
-			return await new Promise((resolve) => {
-				const child = spawn(this.enginePath, ["version"], {
+		/**
+		* Runs the binary for its stdout, with a deadline. The engine is operator-supplied
+		* — a replaced or wrapped binary that never exits must not hang `start()` or the
+		* request that triggered it, so a timeout kills it and reads as "no answer".
+		*/
+		runEngine(args, timeoutMs) {
+			if (!this.installed()) return Promise.resolve(null);
+			return new Promise((resolve) => {
+				const child = spawn(this.enginePath, args, {
 					stdio: [
 						"ignore",
 						"pipe",
@@ -7946,11 +8799,59 @@ var init_proxy$1 = __esmMin((() => {
 					windowsHide: true
 				});
 				let output = "";
+				let settled = false;
+				let timer;
+				let killTimer;
+				const finish = (value) => {
+					if (settled) return;
+					settled = true;
+					if (timer !== void 0) clearTimeout(timer);
+					if (killTimer !== void 0) clearTimeout(killTimer);
+					resolve(value);
+				};
+				timer = setTimeout(() => {
+					child.kill();
+					killTimer = setTimeout(() => child.kill("SIGKILL"), 500);
+					killTimer.unref();
+					finish(null);
+				}, timeoutMs);
 				child.stdout?.on("data", (chunk) => {
 					output += chunk.toString("utf8");
 				});
-				child.on("error", () => resolve(null));
-				child.on("exit", () => resolve(this.engine.parseVersion(output)));
+				child.on("error", () => finish(null));
+				child.on("exit", () => finish(output));
+			});
+		}
+		/** Runs `version` once and reports what the binary actually is. */
+		async probeEngineVersion() {
+			const output = await this.runEngine(["version"], this.options.engineCommandTimeoutMs ?? ENGINE_COMMAND_TIMEOUT_MS);
+			return output === null ? null : this.engine.parseVersion(output);
+		}
+		/**
+		* The modules the installed binary carries, by module name.
+		*
+		* A build from an earlier release has no ACMEProxy module, and a configuration
+		* that names it fails inside the engine with something a person cannot act on.
+		* `list-modules` answers in a few milliseconds, so asking is cheaper than the
+		* support question it prevents.
+		*/
+		async installedModules() {
+			if (!this.installed()) return null;
+			if (this.moduleCache !== null) return this.moduleCache;
+			const output = await this.runEngine(["list-modules"], this.options.engineCommandTimeoutMs ?? ENGINE_COMMAND_TIMEOUT_MS);
+			if (output === null) return null;
+			const modules = new Set(output.split("\n").map((line) => line.trim()).filter((line) => line.length > 0));
+			this.moduleCache = modules;
+			return modules;
+		}
+		/** The module the panel's DNS-01 configuration needs the engine to carry. */
+		async assertDns01Module() {
+			if (!this.config.dns01.enabled) return;
+			const modules = await this.installedModules();
+			if (modules === null || modules.has(DNS01_MODULE)) return;
+			throw new DetailedError(`the installed ${this.engine.info.label} build has no ${DNS01_MODULE} module — update the engine to enable DNS-01`, {
+				statusCode: 400,
+				code: "ENGINE_MODULE_NOT_INSTALLED"
 			});
 		}
 		async start() {
@@ -7968,6 +8869,7 @@ var init_proxy$1 = __esmMin((() => {
 				statusCode: 400,
 				code: "ENGINE_MISSING"
 			});
+			await this.assertDns01Module();
 			if (this.live()) {
 				const admin = this.readAdmin();
 				if (admin === null) throw new DetailedError("the engine is already running but its admin endpoint is unknown — stop it first", {
@@ -7993,6 +8895,7 @@ var init_proxy$1 = __esmMin((() => {
 				engineDir: this.options.engineDir,
 				manual: this.manualPairs(),
 				acme: this.acmeAccount(routes),
+				dns01: this.dns01Input(routes),
 				routes
 			});
 			fs.mkdirSync(this.options.engineDir, {
@@ -8099,6 +9002,7 @@ var init_proxy$1 = __esmMin((() => {
 			this.admin = null;
 			this.certCache = null;
 			this.certificateSignature = null;
+			this.lastError = null;
 			fs.rmSync(nannySpecPath(this.options.stateDir, PROXY_ID), { force: true });
 			fs.rmSync(this.options.adminPath, { force: true });
 			fs.rmSync(path.join(this.options.stateDir, "applied.json"), { force: true });
@@ -8249,7 +9153,7 @@ var init_proxy$1 = __esmMin((() => {
 /** The patch, applied to the live config the way the store would apply it. */
 function candidateConfig(current, patch) {
 	const merged = { ...current };
-	for (const [key, value] of Object.entries(patch)) if (value !== void 0) merged[key] = value;
+	applyPatch(merged, patch, PROXY_MERGE_KEYS);
 	const parsed = proxyConfigSchema(merged);
 	if (parsed instanceof type.errors) throw new DetailedError(parsed.summary, {
 		statusCode: 400,
@@ -8267,7 +9171,7 @@ function createProxyRoute(deps) {
 	const view = () => proxy().view();
 	/** Everything that has to hold before a change is written to disk. */
 	const guard = (candidate) => {
-		const problems = validateProxyConfig(candidate);
+		const problems = validateProxyConfig(candidate, (ref, workspaceId) => proxy().checkDnsAccount(ref, workspaceId));
 		if (problems.length > 0) throw new DetailedError(`invalid reverse proxy configuration: ${problems.join("; ")}`, {
 			statusCode: 400,
 			code: "INVALID_PROXY",
@@ -8363,6 +9267,20 @@ function createProxyRoute(deps) {
 	}), async (c) => {
 		await proxy().stop();
 		return c.json(view());
+	}).post("/proxy/routes/:id/retry-certificate", describeRoute({
+		tags: ["proxy"],
+		summary: "Make the engine ask the CA again for one route",
+		responses: {
+			200: {
+				description: "Retried",
+				content: jsonBody(proxyViewSchema)
+			},
+			400: ERROR_RESPONSES[400],
+			404: ERROR_RESPONSES[404]
+		}
+	}), async (c) => {
+		await proxy().retryCertificate(c.req.param("id"));
+		return c.json(view());
 	}).post("/proxy/apply", describeRoute({
 		tags: ["proxy"],
 		summary: "Regenerate and reload the engine configuration",
@@ -8427,6 +9345,7 @@ function createProxyRoute(deps) {
 }
 var certificateParam;
 var init_proxy = __esmMin((() => {
+	init_patch();
 	init_settings$1();
 	init_factory();
 	init_openapi$1();
@@ -9295,10 +10214,11 @@ function createRootApp(deps) {
 		const started = Date.now();
 		await next();
 		logger.debug(`${c.req.method} ${new URL(c.req.url).pathname} ${c.res.status} ${Date.now() - started}ms`);
-	}).onError(errorHandler).route("/_hh", createControlRoute(deps)).use("/api/*", createAuthGuard({ auth: deps.auth })).route("/api", createAuthRoute(deps)).route("/api", createStateRoute(deps)).route("/api", createEventsRoute(deps)).route("/api", createSettingsRoute(deps)).route("/api", createTlsRoute(deps)).route("/api", createLogsRoute(deps)).route("/api", createNotificationsRoute(deps)).route("/api", createDdnsRoute(deps)).route("/api", createProxyRoute(deps)).route("/api", createMetricsRoute(deps)).route("/api", createBackupsRoute(deps)).route("/api/workspaces", createWorkspacesRoute(deps)).route("/api/servers", createServersRoute(deps)).route("/", createHealthRoute(deps));
+	}).onError(errorHandler).route("/_hh", createControlRoute(deps)).route("/_acme", createAcmeChallengeRoute(deps)).use("/api/*", createAuthGuard({ auth: deps.auth })).route("/api", createAuthRoute(deps)).route("/api", createStateRoute(deps)).route("/api", createEventsRoute(deps)).route("/api", createSettingsRoute(deps)).route("/api", createTlsRoute(deps)).route("/api", createLogsRoute(deps)).route("/api", createNotificationsRoute(deps)).route("/api", createDdnsRoute(deps)).route("/api", createProxyRoute(deps)).route("/api", createMetricsRoute(deps)).route("/api", createBackupsRoute(deps)).route("/api/workspaces", createWorkspacesRoute(deps)).route("/api/servers", createServersRoute(deps)).route("/", createHealthRoute(deps));
 	return app.route("/", setupOpenAPI(app)).route("/", createStaticRoute({ dir: () => deps.ui.resolveDir() }));
 }
 var init_app = __esmMin((() => {
+	init_acme();
 	init_$_routes$2();
 	init_backups$1();
 	init_control();
@@ -9695,6 +10615,100 @@ function resolveRecord(record, vars) {
 }
 var init_template = __esmMin((() => {}));
 //#endregion
+//#region src/services/acme-challenge.ts
+function reply(message, status = 200) {
+	return new Response(JSON.stringify(message), {
+		status,
+		headers: { "content-type": "application/json" }
+	});
+}
+function failure(status, message) {
+	return new Response(JSON.stringify({ error: message }), {
+		status,
+		headers: { "content-type": "application/json" }
+	});
+}
+/** Constant-time, and length-safe: `timingSafeEqual` throws on differing lengths. */
+function matches(actual, expected) {
+	const left = Buffer$1.from(actual, "utf8");
+	const right = Buffer$1.from(expected, "utf8");
+	if (left.length !== right.length) return false;
+	return crypto.timingSafeEqual(left, right);
+}
+var proxyMessageSchema, AcmeChallengeService;
+var init_acme_challenge = __esmMin((() => {
+	init_ddns$2();
+	init_types();
+	proxyMessageSchema = type({
+		fqdn: "string >= 1",
+		value: "string >= 1"
+	}).onUndeclaredKey("reject");
+	AcmeChallengeService = class {
+		options;
+		constructor(options) {
+			this.options = options;
+		}
+		async handle(request, action) {
+			if (action !== "present" && action !== "cleanup") return failure(404, `unknown action "${action}"`);
+			const auth = this.options.auth();
+			if (auth === null) return failure(403, "DNS-01 is not switched on for this panel");
+			if (!this.authorized(request, auth)) return failure(401, "authentication required");
+			let parsed;
+			try {
+				parsed = await request.json();
+			} catch {
+				return failure(400, "the body must be JSON");
+			}
+			const message = proxyMessageSchema(parsed);
+			if (message instanceof type.errors) return failure(400, "the body must carry fqdn and value");
+			const fqdn = normalizeHost(message.fqdn);
+			const account = this.options.accountFor(fqdn);
+			if (account === null) return failure(404, `no DNS account answers for ${fqdn}`);
+			const provider = ddnsProvider(account.provider);
+			if (provider?.challenge === void 0) return failure(400, `the "${account.provider}" account cannot write TXT records`);
+			const record = {
+				fqdn,
+				value: message.value,
+				action
+			};
+			const result = await provider.challenge(record, {
+				credentials: account.credentials,
+				fetch: this.options.fetchImpl ?? fetch
+			});
+			this.options.onResult?.({
+				fqdn,
+				action,
+				ok: result.ok,
+				message: result.message,
+				account
+			});
+			if (!result.ok && action === "cleanup") return reply({
+				fqdn: message.fqdn,
+				value: message.value
+			});
+			if (!result.ok) return failure(502, result.message);
+			return reply({
+				fqdn: message.fqdn,
+				value: message.value
+			});
+		}
+		authorized(request, auth) {
+			const header = request.headers.get("authorization") ?? "";
+			if (!header.toLowerCase().startsWith("basic ")) return false;
+			try {
+				const decoded = Buffer$1.from(header.slice(6).trim(), "base64").toString("utf8");
+				const separator = decoded.indexOf(":");
+				if (separator < 0) return false;
+				const user = decoded.slice(0, separator);
+				const password = decoded.slice(separator + 1);
+				return matches(user, auth.username) && matches(password, auth.password);
+			} catch {
+				return false;
+			}
+		}
+	};
+}));
+//#endregion
 //#region src/helpers/env-file.ts
 /** `KEY=value` files, with optional `export `, `#` comments and quoted values. */
 function parseEnvFile(text) {
@@ -13287,7 +14301,12 @@ var init_ddns = __esmMin((() => {
 								...cache.recordId === void 0 ? {} : { recordId: cache.recordId }
 							} }
 						};
-						const result = await provider.update(record, {
+						const update = provider.update;
+						if (update === void 0) {
+							this.remember(key, "skipped", address, `the "${account.provider}" provider does not update addresses`);
+							continue;
+						}
+						const result = await update(record, {
 							credentials: credentials ?? {},
 							fetch: fetchImpl,
 							signal
@@ -13845,6 +14864,7 @@ var init_panel = __esmMin((() => {
 	init_logger();
 	init_paths();
 	init_version();
+	init_ddns$2();
 	init_config_watch();
 	init_ddns();
 	init_history();
@@ -13904,6 +14924,44 @@ var init_panel = __esmMin((() => {
 				config
 			};
 		}
+		/**
+		* One workspace's DDNS account, credentials included, for the panel-wide proxy.
+		*
+		* The account stays where it lives — a workspace owns its secrets and its
+		* notification routing — so the proxy references it instead of holding a copy.
+		*/
+		findDnsAccount(workspaceId, accountId) {
+			const workspace = this.runtimes.get(workspaceId);
+			if (workspace === void 0) return null;
+			const account = workspace.store.ddns.accounts.find((entry) => entry.id === accountId);
+			if (account === void 0) return null;
+			return {
+				workspace,
+				account,
+				credentials: workspace.secrets.getDdnsCredentials(accountId, account.provider)?.values ?? null
+			};
+		}
+		/**
+		* Every DNS account a proxy route may name, across every workspace.
+		*
+		* A route references `<workspace>/<account>`, so the picker needs all of them; the
+		* account itself never leaves the workspace that owns it.
+		*/
+		listDnsAccounts() {
+			const accounts = [];
+			for (const workspace of this.runtimes.values()) for (const account of workspace.store.ddns.accounts) {
+				const provider = ddnsProvider(account.provider);
+				accounts.push({
+					workspace: workspace.id,
+					account: account.id,
+					provider: account.provider,
+					label: account.label,
+					writesTxt: provider?.challenge !== void 0,
+					hasCredentials: workspace.secrets.getDdnsCredentials(account.id, account.provider) !== null
+				});
+			}
+			return accounts;
+		}
 		serverViews(workspaceId) {
 			if (workspaceId !== void 0) return this.runtimes.get(workspaceId)?.supervisor.views() ?? [];
 			return this.workspaces().flatMap((runtime) => runtime.supervisor.views());
@@ -15000,6 +16058,16 @@ async function runControlPlane(options) {
 				message: null
 			};
 		},
+		resolveDnsAccount: (workspaceId, accountId) => {
+			const found = panel?.findDnsAccount(workspaceId, accountId);
+			if (found === void 0 || found === null) return null;
+			return {
+				provider: found.account.provider,
+				credentials: found.credentials
+			};
+		},
+		listDnsAccounts: () => panel?.listDnsAccounts() ?? [],
+		defaultWorkspaceId: () => registry.defaultId,
 		exposureBlocked: () => checkProxyExposure(settings.proxy, settings.control.auth.enabled, auth.passwordSet, auth.usingDefaultPassword),
 		onStateChange: () => panel?.notifyStateChange()
 	});
@@ -15060,6 +16128,13 @@ async function runControlPlane(options) {
 		backups,
 		ui,
 		proxy,
+		challenge: new AcmeChallengeService({
+			auth: () => proxy.config.dns01.enabled ? proxy.challengeAuth() : null,
+			accountFor: (fqdn) => proxy.challengeAccount(fqdn),
+			onResult: (result) => {
+				if (!result.ok) logger.warn(`proxy:    the DNS-01 challenge for ${result.fqdn} failed (${result.action}): ${result.message}`);
+			}
+		}),
 		runtimeToken: token,
 		onShutdown: () => shutdown("shutdown requested locally")
 	});
@@ -15157,6 +16232,7 @@ var init_src = __esmMin((() => {
 	init_template();
 	init_version();
 	init_port();
+	init_acme_challenge();
 	init_auth$1();
 	init_backups();
 	init_config_watch();
@@ -16581,34 +17657,42 @@ async function runNanny(spec, statePath) {
 			text
 		});
 	};
+	let stopping = false;
+	let pending = null;
+	let spawned = null;
+	const stopChild = (child, signal) => {
+		emit("system", `${signal} — stopping this entry (grace ${spec.stop.graceMs}ms)`);
+		terminate(child, {
+			signal: spec.stop.signal,
+			killGroup: false,
+			graceMs: spec.stop.graceMs
+		});
+	};
+	const onSignal = (signal) => {
+		if (stopping) return;
+		stopping = true;
+		if (spawned === null) pending = signal;
+		else stopChild(spawned, signal);
+	};
+	process.on("SIGTERM", () => onSignal("SIGTERM"));
+	process.on("SIGINT", () => onSignal("SIGINT"));
 	const child = spawnManaged({
 		command: spec.command,
 		args: spec.args,
 		cwd: spec.cwd,
 		env: spec.env
 	}, { detached: false });
+	spawned = child;
 	childPid = child.pid ?? null;
 	persistState();
 	emit("system", `persistent: nanny pid ${process.pid} runs this entry`);
+	if (pending !== null) stopChild(child, pending);
 	const stdout = new LineSplitter((stream, text) => emit(stream, text));
 	const stderr = new LineSplitter((stream, text) => emit(stream, text));
 	child.stdout?.on("data", (chunk) => stdout.push("stdout", chunk));
 	child.stderr?.on("data", (chunk) => stderr.push("stderr", chunk));
 	const heartbeat = setInterval(persistState, NANNY_HEARTBEAT_MS);
 	heartbeat.unref();
-	let stopping = false;
-	const onSignal = (signal) => {
-		if (stopping) return;
-		stopping = true;
-		emit("system", `${signal} — stopping this entry (grace ${spec.stop.graceMs}ms)`);
-		terminate(child, {
-			signal: spec.stop.signal,
-			killGroup: false,
-			graceMs: spec.stop.graceMs
-		});
-	};
-	process.on("SIGTERM", () => onSignal("SIGTERM"));
-	process.on("SIGINT", () => onSignal("SIGINT"));
 	await new Promise((resolve) => {
 		let settled = false;
 		const finish = (code, signal, runtimeMs, note) => {