openmates 0.26.0-alpha.0 → 0.26.0-alpha.1

package/dist/{chunk-YW2BJUWQ.js → chunk-OURQ2HZW.js}

@@ -32489,6 +32489,41 @@ function formatTs(ts) {
   return d.toISOString().slice(0, 16).replace("T", " ");
 }
 
+// src/serverNotifications.ts
+function evaluateNotificationDestinationConfiguration(config) {
+  const configuredCount = [config.email, config.discordWebhookUrl, config.genericWebhook].filter(Boolean).length;
+  return {
+    id: "notifications.destination_configured",
+    status: configuredCount >= 2 ? "passed" : "failed",
+    required: true,
+    duration_ms: 0,
+    ...configuredCount < 2 ? {
+      failureClass: "configuration",
+      sanitized_reason: "notification_destination_or_fallback_missing"
+    } : {}
+  };
+}
+function resolveHostNotificationDestinations(value, deploymentMode, serverEnvironment) {
+  const configured = (key) => {
+    const candidate = value(key)?.trim();
+    return candidate && candidate !== "IMPORTED_TO_VAULT" ? candidate : void 0;
+  };
+  const to = configured("OPENMATES_RUNTIME_HEALTH_EMAIL_TO") || configured("ADMIN_NOTIFY_EMAIL");
+  const from = configured("OPENMATES_RUNTIME_HEALTH_EMAIL_FROM") || configured("EMAIL_SENDER_EMAIL") || "noreply@openmates.org";
+  const apiKey = configured("OPENMATES_RUNTIME_HEALTH_BREVO_API_KEY") || configured("BREVO_API_KEY");
+  const email = to && apiKey ? { to, from, apiKey } : void 0;
+  const scopedDiscord = deploymentMode === "self_host" ? configured("DISCORD_WEBHOOK_OPERATIONAL_MONITORING_SELF_HOST") || configured("OPENMATES_RUNTIME_HEALTH_DISCORD_WEBHOOK_URL_SELF_HOST") || configured("OPENMATES_RUNTIME_HEALTH_DISCORD_WEBHOOK_URL") : serverEnvironment === "production" ? configured("OPENMATES_RUNTIME_HEALTH_DISCORD_WEBHOOK_URL_PRODUCTION") || configured("DISCORD_WEBHOOK_OPERATIONAL_MONITORING_PRODUCTION") : configured("OPENMATES_RUNTIME_HEALTH_DISCORD_WEBHOOK_URL_DEVELOPMENT") || configured("DISCORD_WEBHOOK_OPERATIONAL_MONITORING_DEVELOPMENT");
+  const legacyDiscord = deploymentMode === "official_cloud" && configured("OPENMATES_RUNTIME_HEALTH_LEGACY_DISCORD_ENVIRONMENT") === serverEnvironment ? configured("OPENMATES_RUNTIME_HEALTH_DISCORD_WEBHOOK_URL") : void 0;
+  const fallbackDiscord = deploymentMode === "self_host" ? void 0 : serverEnvironment === "production" ? configured("DISCORD_WEBHOOK_PROD_SMOKE") : configured("DISCORD_WEBHOOK_DEV_NIGHTLY") || configured("DISCORD_WEBHOOK_DEV_SMOKE");
+  const discordWebhookUrl = scopedDiscord || legacyDiscord || fallbackDiscord;
+  return {
+    email,
+    discordWebhookUrl,
+    discordDestinationSource: scopedDiscord ? "canonical" : legacyDiscord ? "legacy_environment_mapping" : fallbackDiscord ? serverEnvironment === "production" ? "prod_smoke_fallback" : "dev_fallback" : "missing",
+    discordFallbackUsed: !scopedDiscord && !legacyDiscord && Boolean(fallbackDiscord)
+  };
+}
+
 // src/server.ts
 import { execFileSync as execFileSync5, execSync, spawn as nodeSpawn, spawnSync } from "child_process";
 import { createHash as createHash18, randomBytes as randomBytes9, randomUUID as randomUUID15 } from "crypto";
@@ -33270,6 +33305,109 @@ import { accessSync, constants as constants2, existsSync as existsSync11, mkdirS
 import { tmpdir } from "os";
 import { dirname as dirname6, join as join12 } from "path";
 var hash = (text4) => createHash17("sha256").update(text4).digest("hex");
+function resolveCaddyProfile(role, explicit, previous) {
+  if (explicit === void 0) return previous ?? "self-host";
+  if (role !== "upload" || explicit !== "official-upload") throw new Error("caddy_profile_unsupported");
+  if (previous && previous !== explicit) throw new Error("caddy_profile_conflicts_with_baseline");
+  return explicit;
+}
+function scopedHandleBlock(content, name) {
+  const lines = content.split("\n");
+  const start = lines.findIndex((line) => new RegExp(`^\\s*handle\\s+${name}\\s*\\{$`).test(line));
+  if (start < 0) return void 0;
+  let depth = 0;
+  for (let i = start; i < lines.length; i++) {
+    const code = lines[i].replace(/#.*$/, "");
+    depth += (code.match(/\{/g)?.length ?? 0) - (code.match(/\}/g)?.length ?? 0);
+    if (depth === 0) return lines.slice(start, i + 1).join("\n");
+  }
+  return void 0;
+}
+function reverseProxyBlocks(content) {
+  const lines = content.split("\n");
+  const blocks = [];
+  for (let i = 0; i < lines.length; i++) {
+    const first = lines[i].replace(/#.*$/, "");
+    if (!/^\s*reverse_proxy\b/.test(first)) continue;
+    if (!/\{\s*$/.test(first)) throw new Error("caddy_official_upload_structure_missing");
+    const start = i;
+    let depth = 0;
+    let closed = false;
+    for (; i < lines.length; i++) {
+      const code = lines[i].replace(/#.*$/, "");
+      depth += (code.match(/\{/g)?.length ?? 0) - (code.match(/\}/g)?.length ?? 0);
+      if (depth === 0) {
+        blocks.push(lines.slice(start, i + 1).join("\n"));
+        closed = true;
+        break;
+      }
+    }
+    if (!closed) throw new Error("caddy_official_upload_structure_missing");
+  }
+  return blocks;
+}
+function headerUpAffectsTargetEnv(line) {
+  const field = /^header_up\s+(\S+)/i.exec(line)?.[1]?.replace(/^['"]|['"]$/g, "").replace(/^[+-]/, "").toLowerCase();
+  if (!field) return false;
+  const escaped = field.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*");
+  return new RegExp(`^${escaped}$`).test("x-target-env");
+}
+function officialUploadOrigins(content) {
+  const origins = {};
+  for (const environment of ["prod", "dev"]) {
+    const matches2 = [...content.matchAll(new RegExp(`^\\s*@${environment}_origin\\s+expression\\s+\\{header\\.Origin\\}\\s*==\\s*"([^"\\n]+)"\\s*$`, "gm"))];
+    if (matches2.length !== 1) {
+      throw new Error("caddy_official_upload_structure_missing");
+    }
+    const origin = matches2[0][1];
+    let parsed;
+    try {
+      parsed = new URL(origin);
+    } catch {
+      throw new Error("caddy_official_upload_origin_invalid");
+    }
+    if (parsed.protocol !== "https:" || parsed.origin !== origin || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
+      throw new Error("caddy_official_upload_origin_invalid");
+    }
+    origins[environment] = origin;
+  }
+  if (origins.prod === origins.dev) throw new Error("caddy_official_upload_origin_conflict");
+  return origins;
+}
+function validateOfficialUploadCaddy(content, expectedOrigins) {
+  const origins = officialUploadOrigins(content);
+  if (expectedOrigins && (origins.prod !== expectedOrigins.prod || origins.dev !== expectedOrigins.dev)) {
+    throw new Error("caddy_official_upload_origin_mismatch");
+  }
+  const scoped = matchers(content, null, true);
+  if (!scoped.has("@prod_origin/@upload_api") || !scoped.has("@dev_origin/@upload_api") || !scoped.has("@upload_health") || !scoped.has("@admin_paths")) {
+    throw new Error("caddy_official_upload_structure_missing");
+  }
+  for (const environment of ["prod", "dev"]) {
+    const block = scopedHandleBlock(content, `@${environment}_origin`);
+    const active = block?.split("\n").filter((line) => !line.trim().startsWith("#")).join("\n") ?? "";
+    if (!block || !active.includes("@upload_options method OPTIONS") || !/handle\s*\{\s*abort\s*\}/.test(active)) {
+      throw new Error("caddy_official_upload_structure_missing");
+    }
+    const proxies = reverseProxyBlocks(active);
+    if (proxies.length < 2) throw new Error("caddy_official_upload_structure_missing");
+    for (const proxy of proxies) {
+      const targetHeaders = proxy.split("\n").map((line) => line.replace(/#.*$/, "").trim()).filter(headerUpAffectsTargetEnv);
+      if (targetHeaders.length !== 1 || !new RegExp(`^header_up\\s+X-Target-Env\\s+(?:"${environment}"|${environment})$`, "i").test(targetHeaders[0])) {
+        throw new Error("caddy_official_upload_structure_missing");
+      }
+    }
+  }
+}
+function renderOfficialUploadCaddyTemplate(template, domain, email) {
+  if (!/^[a-z0-9.-]+$/i.test(domain) || !domain.includes(".") || !/^[^\s{}$@]+@[^\s{}$@]+\.[^\s{}$@]+$/.test(email)) {
+    throw new Error("caddy_official_upload_render_values_invalid");
+  }
+  const rendered = template.replaceAll("${DEPLOY_UPLOAD_DOMAIN}", domain).replaceAll("${DEPLOY_ACME_EMAIL}", email);
+  if (/\$\{[A-Z_][A-Z0-9_]*\}/.test(rendered)) throw new Error("caddy_official_upload_template_unresolved");
+  validateOfficialUploadCaddy(rendered);
+  return rendered;
+}
 function siteRange(lines, site) {
   if (!site) return [0, lines.length];
   const start = lines.findIndex((line) => line.trim() === `${site} {`);
@@ -33282,36 +33420,48 @@ function siteRange(lines, site) {
   }
   throw new Error("caddy_managed_site_unclosed");
 }
-function matchers(content, site) {
+function matchers(content, site, scopeAware = false) {
   const lines = content.split("\n");
   const [start, end] = siteRange(lines, site);
   const result = /* @__PURE__ */ new Map();
+  let depth = 0;
+  const handles = [];
   for (let i = start; i < end; i++) {
     const named = /^\s*(@[\w-]+)\s+(.*)$/.exec(lines[i]);
-    if (!named) continue;
-    let pathLine = i;
-    if (named[2].trim() === "{") {
-      pathLine = -1;
-      for (let j = i + 1; j < end && lines[j].trim() !== "}"; j++) {
-        if (/^\s*path\s/.test(lines[j])) {
-          if (pathLine !== -1) throw new Error("caddy_ambiguous_path_matcher");
-          pathLine = j;
+    if (named) {
+      let pathLine = i;
+      if (named[2].trim() === "{") {
+        pathLine = -1;
+        for (let j = i + 1; j < end && lines[j].trim() !== "}"; j++) {
+          if (/^\s*path\s/.test(lines[j])) {
+            if (pathLine !== -1) throw new Error("caddy_ambiguous_path_matcher");
+            pathLine = j;
+          }
         }
       }
-      if (pathLine === -1) continue;
+      const path2 = pathLine >= 0 ? /^(.*?\bpath\s+)([^#]*?)(\s*(?:#.*)?)$/.exec(lines[pathLine]) : null;
+      if (path2) {
+        const paths = path2[2].trim().split(/\s+/);
+        if (paths.some((value) => !value.startsWith("/") || /[{}"'\\]/.test(value))) throw new Error("caddy_unsupported_path_matcher");
+        const scope2 = scopeAware ? handles.at(-1)?.name : void 0;
+        const key = scope2 ? `${scope2}/${named[1]}` : named[1];
+        if (result.has(key)) throw new Error("caddy_ambiguous_path_matcher");
+        result.set(key, { line: pathLine, paths, prefix: path2[1], suffix: path2[3] });
+      }
+    }
+    if (scopeAware) {
+      const handle = /^\s*handle\s+(@[\w-]+)\s*\{/.exec(lines[i]);
+      if (handle) handles.push({ name: handle[1], depth: depth + 1 });
+      const code = lines[i].replace(/#.*$/, "");
+      depth += (code.match(/\{/g)?.length ?? 0) - (code.match(/\}/g)?.length ?? 0);
+      while (handles.length && depth < handles[handles.length - 1].depth) handles.pop();
     }
-    const path2 = /^(.*?\bpath\s+)([^#]*?)(\s*(?:#.*)?)$/.exec(lines[pathLine]);
-    if (!path2) continue;
-    const paths = path2[2].trim().split(/\s+/);
-    if (paths.some((value) => !value.startsWith("/") || /[{}"'\\]/.test(value))) throw new Error("caddy_unsupported_path_matcher");
-    if (result.has(named[1])) throw new Error("caddy_ambiguous_path_matcher");
-    result.set(named[1], { line: pathLine, paths, prefix: path2[1], suffix: path2[3] });
   }
   return result;
 }
 function mergeCaddyPaths(input) {
-  const current = matchers(input.current, input.site);
-  const target = matchers(input.target, input.site);
+  const current = matchers(input.current, input.site, input.scopeAware);
+  const target = matchers(input.target, input.site, input.scopeAware);
   if (!target.size) throw new Error("caddy_release_matchers_missing");
   const lines = input.current.split("\n");
   const paths = {};
@@ -33337,7 +33487,7 @@ function readCaddyUpdateState(path2, configPath, site) {
   if (!existsSync11(path2)) return void 0;
   try {
     const state = JSON.parse(readFileSync12(path2, "utf8"));
-    if (state.version !== 1 || state.configPath !== configPath || state.site !== site || !/^[a-f0-9]{40}$/i.test(state.revision) || typeof state.template !== "string" || !state.template || !state.paths || Array.isArray(state.paths) || Object.entries(state.paths).some(([name, paths]) => !/^@[\w-]+$/.test(name) || !Array.isArray(paths) || paths.some((path3) => typeof path3 !== "string" || !path3.startsWith("/")))) {
+    if (state.version !== 1 || state.configPath !== configPath || state.site !== site || !/^[a-f0-9]{40}$/i.test(state.revision) || typeof state.template !== "string" || !state.template || !state.paths || Array.isArray(state.paths) || state.profile !== void 0 && state.profile !== "self-host" && state.profile !== "official-upload" || Object.entries(state.paths).some(([name, paths]) => !/^(?:@[\w-]+\/)?@[\w-]+$/.test(name) || !Array.isArray(paths) || paths.some((path3) => typeof path3 !== "string" || !path3.startsWith("/")))) {
       throw new Error();
     }
     return state;
@@ -33446,15 +33596,17 @@ async function applyCaddyPathUpdate(input) {
   const current = caddyHostOperation({ action: "read", configPath: input.configPath }).content;
   const statePath = join12(input.installPath, ".openmates", "caddy", `${input.role}.json`);
   const previous = readCaddyUpdateState(statePath, input.configPath, input.site);
-  const merged = previous ? { content: mergeCaddyRelease(current, previous.template, input.target), paths: Object.fromEntries([...matchers(input.target, input.site)].map(([name, matcher]) => [name, matcher.paths])) } : mergeCaddyPaths({ current, target: input.target, site: input.site });
+  const merged = previous ? { content: mergeCaddyRelease(current, previous.template, input.target), paths: Object.fromEntries([...matchers(input.target, input.site, input.profile === "official-upload")].map(([name, matcher]) => [name, matcher.paths])) } : mergeCaddyPaths({ current, target: input.target, site: input.site, scopeAware: input.profile === "official-upload" });
+  if (input.profile === "official-upload") validateOfficialUploadCaddy(merged.content, officialUploadOrigins(input.target));
   const result = caddyHostOperation({ action: "apply", configPath: input.configPath, expectedHash: hash(current), content: merged.content });
   try {
     await input.verify();
-  } catch {
+  } catch (error) {
     if (result.backupPath) caddyHostOperation({ action: "restore", configPath: input.configPath, expectedHash: hash(merged.content), backupPath: result.backupPath });
+    if (error instanceof Error && /^caddy_upload_(?:health_route_failed|prod_preflight_failed|dev_preflight_failed|unknown_origin_allowed)$/.test(error.message)) throw error;
     throw new Error("caddy_public_route_verification_failed");
   }
-  const state = { version: 1, configPath: input.configPath, site: input.site, revision: input.revision, paths: merged.paths, template: input.target };
+  const state = { version: 1, configPath: input.configPath, site: input.site, revision: input.revision, paths: merged.paths, template: input.target, profile: input.profile ?? "self-host" };
   mkdirSync10(dirname6(statePath), { recursive: true });
   const temp = `${statePath}.${process.pid}.tmp`;
   writeFileSync6(temp, JSON.stringify(state) + "\n", { mode: 384 });
@@ -33483,6 +33635,52 @@ async function verifyCaddyCoreRoutes(apiUrl, origin) {
     if (response.status !== 401 || response.headers.get("access-control-allow-origin") !== origin) throw new Error("caddy_workflow_route_failed");
   }
 }
+async function verifyCaddyUploadRoutes(baseUrl, origins, fetcher = fetch) {
+  const endpoint = baseUrl.replace(/\/$/, "");
+  const request = (path2, init = {}) => fetcher(`${endpoint}${path2}`, {
+    ...init,
+    redirect: "error",
+    signal: AbortSignal.timeout(5e3)
+  });
+  let health;
+  try {
+    health = await request("/health");
+  } catch {
+    throw new Error("caddy_upload_health_route_failed");
+  }
+  if (!health.ok) throw new Error("caddy_upload_health_route_failed");
+  for (const environment of ["prod", "dev"]) {
+    const origin = origins[environment];
+    let preflight;
+    try {
+      preflight = await request("/v1/upload/file", { method: "OPTIONS", headers: {
+        Origin: origin,
+        "Access-Control-Request-Method": "POST",
+        "Access-Control-Request-Headers": "content-type"
+      } });
+    } catch {
+      throw new Error(`caddy_upload_${environment}_preflight_failed`);
+    }
+    const methods = preflight.headers.get("access-control-allow-methods")?.split(",").map((value) => value.trim().toUpperCase()) ?? [];
+    if (!preflight.ok || preflight.headers.get("access-control-allow-origin") !== origin || preflight.headers.get("access-control-allow-credentials") !== "true" || !methods.includes("POST")) {
+      throw new Error(`caddy_upload_${environment}_preflight_failed`);
+    }
+  }
+  const unknownOrigin = "https://openmates-route-probe.invalid";
+  if (Object.values(origins).includes(unknownOrigin)) throw new Error("caddy_upload_unknown_origin_allowed");
+  try {
+    const denied = await request("/v1/upload/file", { method: "OPTIONS", headers: {
+      Origin: unknownOrigin,
+      "Access-Control-Request-Method": "POST",
+      "Access-Control-Request-Headers": "content-type"
+    } });
+    if (![403, 404].includes(denied.status) || denied.headers.get("access-control-allow-origin") === unknownOrigin) {
+      throw new Error("caddy_upload_unknown_origin_allowed");
+    }
+  } catch (error) {
+    if (error instanceof Error && error.message === "caddy_upload_unknown_origin_allowed") throw error;
+  }
+}
 
 // src/serverHealth.ts
 import dnsModule, { promises as dns } from "dns";
@@ -36435,19 +36633,9 @@ function runRuntimeVerification(installPath, role, config) {
     if (cmsCacheCheck.status !== "passed") output.status = "failed";
   }
   if (mode.effectiveMode === "official_cloud") {
-    const destinations = runtimeNotificationConfig(installPath);
-    const configuredCount = [destinations.email, destinations.discordWebhookUrl, destinations.genericWebhook].filter(Boolean).length;
-    if (configuredCount < 2) {
-      output.status = "failed";
-      output.checks.push({
-        id: "notifications.destination_configured",
-        status: "failed",
-        required: true,
-        duration_ms: 0,
-        failureClass: "configuration",
-        sanitized_reason: "notification_destination_or_fallback_missing"
-      });
-    }
+    const notificationCheck = evaluateNotificationDestinationConfiguration(runtimeNotificationConfig(installPath));
+    output.checks.push(notificationCheck);
+    if (notificationCheck.status === "failed") output.status = "failed";
   }
   for (const check of output.checks) {
     const marker = check.status === "passed" ? "x" : "!";
@@ -36462,26 +36650,17 @@ function runtimeNotificationConfig(installPath) {
   const deploymentMode = getInstallDeploymentMode(installPath, serverConfig);
   const serverEnvironment = value("SERVER_ENVIRONMENT") === "production" ? "production" : "development";
   const environment = deploymentMode === "self_host" ? "self_host" : serverEnvironment;
-  const emailTo = value("OPENMATES_RUNTIME_HEALTH_EMAIL_TO") || value("ADMIN_NOTIFY_EMAIL");
-  const emailFrom = value("OPENMATES_RUNTIME_HEALTH_EMAIL_FROM") || value("EMAIL_SENDER_EMAIL") || "noreply@openmates.org";
-  const emailApiKey = value("OPENMATES_RUNTIME_HEALTH_BREVO_API_KEY") || value("BREVO_API_KEY");
-  const email = emailTo && emailFrom && emailApiKey ? { to: emailTo, from: emailFrom, apiKey: emailApiKey } : void 0;
+  const destinations = resolveHostNotificationDestinations(value, deploymentMode, serverEnvironment);
   const webhookUrl = value("OPENMATES_RUNTIME_HEALTH_WEBHOOK_URL");
   const webhookSecret = value("OPENMATES_RUNTIME_HEALTH_WEBHOOK_SECRET");
   const allowLocalDevelopmentFixture = value("SERVER_ENVIRONMENT") === "development" && value("OPENMATES_RUNTIME_HEALTH_ALLOW_LOCAL_WEBHOOK_FIXTURE") === "true";
   const genericWebhook = webhookUrl && webhookSecret ? { url: webhookUrl, secret: webhookSecret, allowLocalDevelopmentFixture } : void 0;
-  const canonicalDiscordWebhookUrl = deploymentMode === "self_host" ? value("DISCORD_WEBHOOK_OPERATIONAL_MONITORING_SELF_HOST") || value("OPENMATES_RUNTIME_HEALTH_DISCORD_WEBHOOK_URL_SELF_HOST") || value("OPENMATES_RUNTIME_HEALTH_DISCORD_WEBHOOK_URL") : serverEnvironment === "production" ? value("OPENMATES_RUNTIME_HEALTH_DISCORD_WEBHOOK_URL_PRODUCTION") || value("DISCORD_WEBHOOK_OPERATIONAL_MONITORING_PRODUCTION") : value("OPENMATES_RUNTIME_HEALTH_DISCORD_WEBHOOK_URL_DEVELOPMENT") || value("DISCORD_WEBHOOK_OPERATIONAL_MONITORING_DEVELOPMENT");
-  const fallbackDiscordWebhookUrl = deploymentMode === "self_host" ? void 0 : serverEnvironment === "production" ? value("DISCORD_WEBHOOK_PROD_SMOKE") : value("DISCORD_WEBHOOK_DEV_NIGHTLY") || value("DISCORD_WEBHOOK_DEV_SMOKE");
-  const discordWebhookUrl = canonicalDiscordWebhookUrl || fallbackDiscordWebhookUrl;
   return {
     environment,
     deploymentMode,
     serverName: value("OPENMATES_RUNTIME_SERVER_NAME"),
     version: value("OPENMATES_IMAGE_TAG") || serverConfig?.imageTag || "source",
-    email,
-    discordWebhookUrl,
-    discordDestinationSource: canonicalDiscordWebhookUrl ? "canonical" : fallbackDiscordWebhookUrl ? serverEnvironment === "production" ? "prod_smoke_fallback" : "dev_fallback" : "missing",
-    discordFallbackUsed: !canonicalDiscordWebhookUrl && Boolean(fallbackDiscordWebhookUrl),
+    ...destinations,
     genericWebhook
   };
 }
@@ -36681,7 +36860,15 @@ function caddyUpdatePlan(installPath, role, config, flags) {
   const configPath = resolve7(typeof flags["caddy-config"] === "string" ? flags["caddy-config"] : "/etc/caddy/Caddyfile");
   const required = role === "core" && getInstallDeploymentMode(installPath, config) === "official_cloud";
   if (!existsSync13(configPath) && required) throw new Error("Managed cloud Caddyfile is missing; update cannot proceed.");
-  return { configPath, status: existsSync13(configPath) ? "planned" : "not_installed" };
+  const prior = role === "upload" ? readCaddyUpdateState(join15(installPath, ".openmates", "caddy", `${role}.json`), configPath, null) : void 0;
+  const profile = resolveCaddyProfile(role, flags["caddy-profile"], prior ? prior.profile ?? "self-host" : void 0);
+  if (profile === "official-upload" && !existsSync13(configPath)) throw new Error("caddy_official_upload_host_missing");
+  if (role === "upload" && existsSync13(configPath)) {
+    const live = caddyHostOperation({ action: "read", configPath }).content;
+    if (profile === "official-upload") validateOfficialUploadCaddy(live);
+    else if (live.includes("@prod_origin") || live.includes("@dev_origin")) throw new Error("caddy_profile_required_official_upload");
+  }
+  return { configPath, status: existsSync13(configPath) ? "planned" : "not_installed", profile };
 }
 async function updateServerCaddy(input) {
   const plan = caddyUpdatePlan(input.installPath, input.role, input.config, input.flags);
@@ -36697,6 +36884,8 @@ async function updateServerCaddy(input) {
     templatePath = site === "api.openmates.org" ? "deployment/prod_server/Caddyfile" : "deployment/dev_server/Caddyfile";
   } else if (cloud) {
     templatePath = `deployment/${input.role}_server/Caddyfile`;
+  } else if (plan.profile === "official-upload") {
+    templatePath = "deployment/upload_server/Caddyfile";
   }
   const revision = input.mode === "image" ? installedImageLabels(input)["org.opencontainers.image.revision"]?.trim() : exec("git rev-parse HEAD", input.installPath).trim();
   if (!revision || !/^[a-f0-9]{40}$/i.test(revision)) throw new Error("caddy_release_revision_invalid");
@@ -36711,8 +36900,15 @@ async function updateServerCaddy(input) {
   const env = readEnvMap(input.installPath);
   const urls = deriveSelfHostCliUrls(readEnvContent(input.installPath));
   const domain = env[`DEPLOY_${input.role.toUpperCase()}_DOMAIN`];
-  const hostname = site ?? domain ?? live.split("\n").map((line) => /^([^\s{$]+)\s+\{$/.exec(line)?.[1]).find(Boolean);
+  const liveHostname = live.split("\n").map((line) => /^([^\s{$]+)\s+\{$/.exec(line)?.[1]).find(Boolean);
+  const hostname = site ?? (plan.profile === "official-upload" ? liveHostname : domain ?? liveHostname);
   if (!hostname) throw new Error("caddy_public_endpoint_unavailable");
+  if (plan.profile === "official-upload") {
+    const email = /^\s*email\s+(\S+)\s*$/m.exec(live)?.[1];
+    if (!email) throw new Error("caddy_official_upload_email_missing");
+    target = renderOfficialUploadCaddyTemplate(target, hostname, email);
+    validateOfficialUploadCaddy(live, officialUploadOrigins(target));
+  }
   const baseUrl = hostname.includes("://") ? hostname : `https://${hostname}`;
   const endpoint = new URL(baseUrl);
   if (!["http:", "https:"].includes(endpoint.protocol) || endpoint.username || endpoint.password) throw new Error("caddy_public_endpoint_invalid");
@@ -36723,8 +36919,10 @@ async function updateServerCaddy(input) {
     site,
     target,
     revision,
+    profile: plan.profile,
     verify: async () => {
       if (input.role === "core") await verifyCaddyCoreRoutes(baseUrl, new URL(urls.appUrl).origin);
+      else if (plan.profile === "official-upload") await verifyCaddyUploadRoutes(baseUrl, officialUploadOrigins(target));
       else {
         const response = await fetch(`${baseUrl}/health`, { redirect: "error", signal: AbortSignal.timeout(5e3) });
         if (!response.ok) throw new Error("caddy_health_route_failed");
@@ -38196,6 +38394,7 @@ Command Options:
   update:
     --dry-run           Show update plan without changing files or containers
     --caddy-config <file> Host Caddyfile (default: /etc/caddy/Caddyfile); automatically update managed routes
+    --caddy-profile official-upload  Preserve the upload host's prod/dev Origin routing; saved after verification
     --services <csv>    Update only selected role services
     --exclude <csv>     Update all role services except selected services
     --image-tag <tag>   Image mode: update to a specific prebuilt image tag

package/dist/cli.js

@@ -19,7 +19,7 @@ import {
   serializeToYaml,
   shouldRequireTrustedAccountGuard,
   waitForWorkflowRun
-} from "./chunk-YW2BJUWQ.js";
+} from "./chunk-OURQ2HZW.js";
 import "./chunk-IWKP55ZB.js";
 import "./chunk-BBKJZ23O.js";
 export {

package/dist/index.js

@@ -43,7 +43,7 @@ import {
   selectAssistantMessagesForSpeech,
   serializeToYaml,
   summarizeAssistantSpeech
-} from "./chunk-YW2BJUWQ.js";
+} from "./chunk-OURQ2HZW.js";
 import "./chunk-IWKP55ZB.js";
 import "./chunk-BBKJZ23O.js";
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmates",
-  "version": "0.26.0-alpha.0",
+  "version": "0.26.0-alpha.1",
   "description": "OpenMates CLI and SDK",
   "type": "module",
   "main": "dist/index.js",