sporades 0.1.0

package/bin/sporades-host-helper.js

@@ -0,0 +1,4001 @@
+#!/usr/bin/env node
+// Generated by `npm run build` from TypeScript sources. Do not edit by hand.
+
+// src/cli/sporades-host-helper.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { constants as fsConstants, statSync } from "node:fs";
+import { access, chmod, chown, lstat, mkdir, readdir as readdir2, readFile as readFile2, readlink, rename, rm as rm2, statfs, symlink, writeFile } from "node:fs/promises";
+import { createHash, generateKeyPairSync, randomBytes } from "node:crypto";
+import { freemem, loadavg, totalmem } from "node:os";
+import path4 from "node:path";
+
+// src/base-image.ts
+var SPORADES_BASE_IMAGE = {
+  name: "sporades-base",
+  image: "ghcr.io/sporades/sporades-base:0.1.0-node22-alpine",
+  version: "0.1.0-node22-alpine",
+  runtimeUser: "sporades",
+  runtimeUid: 10001,
+  runtimeGid: 10001,
+  updatePolicy: {
+    defaultMode: "host-managed",
+    modes: ["host-managed", "auto-patch", "manual"],
+    autoPatchSupported: false,
+    autoPatchUnsupportedReason: "Base image updates are applied by replacing containers, not mutating them in place."
+  }
+};
+function baseImageRuntimeUser() {
+  return `${SPORADES_BASE_IMAGE.runtimeUid}:${SPORADES_BASE_IMAGE.runtimeGid}`;
+}
+function normaliseBaseImageUpdatePolicy(value) {
+  const mode = typeof value === "string" ? value : typeof value?.mode === "string" ? value.mode : SPORADES_BASE_IMAGE.updatePolicy.defaultMode;
+  if (!SPORADES_BASE_IMAGE.updatePolicy.modes.includes(mode)) {
+    return SPORADES_BASE_IMAGE.updatePolicy.defaultMode;
+  }
+  return mode;
+}
+function baseImageUpdatePolicy(mode = SPORADES_BASE_IMAGE.updatePolicy.defaultMode) {
+  return {
+    mode: normaliseBaseImageUpdatePolicy(mode),
+    autoPatch: {
+      supported: SPORADES_BASE_IMAGE.updatePolicy.autoPatchSupported,
+      reason: SPORADES_BASE_IMAGE.updatePolicy.autoPatchUnsupportedReason
+    }
+  };
+}
+function baseImageMetadata(updatePolicyMode = SPORADES_BASE_IMAGE.updatePolicy.defaultMode) {
+  return {
+    name: SPORADES_BASE_IMAGE.name,
+    image: SPORADES_BASE_IMAGE.image,
+    version: SPORADES_BASE_IMAGE.version,
+    updatePolicy: baseImageUpdatePolicy(updatePolicyMode)
+  };
+}
+function baseImageLabels(updatePolicyMode = SPORADES_BASE_IMAGE.updatePolicy.defaultMode) {
+  return {
+    "com.sporades.base-image.name": SPORADES_BASE_IMAGE.name,
+    "com.sporades.base-image.version": SPORADES_BASE_IMAGE.version,
+    "com.sporades.base-image.update-policy": normaliseBaseImageUpdatePolicy(updatePolicyMode)
+  };
+}
+
+// src/runtime-restart-policy.ts
+var FATAL_RUNTIME_RESTART_POLICY = {
+  dev: {
+    mode: "automatic",
+    maxAttempts: 10,
+    backoffMs: 250,
+    restartFatalEvents: ["unhandledRejection", "uncaughtException", "initHookFailed", "shutdownHookFailed"],
+    exitFatalEvents: ["sigterm", "sigint"]
+  },
+  container: {
+    mode: "bounded",
+    maxAttempts: 3,
+    backoffMs: 1e3,
+    dockerRestart: "on-failure:3",
+    restartFatalEvents: ["unhandledRejection", "uncaughtException", "initHookFailed"],
+    exitFatalEvents: ["sigterm", "sigint", "shutdownHookFailed"]
+  },
+  hosted: {
+    mode: "bounded",
+    maxAttempts: 3,
+    backoffMs: 1e3,
+    dockerRestart: "on-failure:3",
+    restartFatalEvents: ["unhandledRejection", "uncaughtException", "initHookFailed"],
+    exitFatalEvents: ["sigterm", "sigint", "shutdownHookFailed"],
+    exhaustedRouteTarget: "hosted-capsule-unavailable",
+    verificationFallbackOnly: true
+  }
+};
+function restartPolicyForMode(mode) {
+  const policy = FATAL_RUNTIME_RESTART_POLICY[mode];
+  if (!policy) {
+    throw new Error(`Unknown Sporades restart policy mode: ${mode}`);
+  }
+  return {
+    ...policy,
+    restartFatalEvents: [...policy.restartFatalEvents],
+    exitFatalEvents: [...policy.exitFatalEvents]
+  };
+}
+function restartPolicyStatus(mode, overrides = {}) {
+  const policy = restartPolicyForMode(mode);
+  return {
+    mode: policy.mode,
+    maxAttempts: policy.maxAttempts,
+    backoffMs: policy.backoffMs,
+    dockerRestart: policy.dockerRestart ?? null,
+    restartFatalEvents: policy.restartFatalEvents,
+    exitFatalEvents: policy.exitFatalEvents,
+    ...policy.exhaustedRouteTarget ? { exhaustedRouteTarget: policy.exhaustedRouteTarget } : {},
+    ...policy.verificationFallbackOnly ? { verificationFallbackOnly: true } : {},
+    ...overrides
+  };
+}
+
+// src/cli/cli-support.ts
+function errorDetails(error) {
+  if (error === null || error === void 0) {
+    return {};
+  }
+  return typeof error === "object" ? error : { message: String(error) };
+}
+function helperError(message, hint, diagnostics = null) {
+  const error = new Error(message);
+  error.hint = hint;
+  if (diagnostics) {
+    error.diagnostics = diagnostics;
+  }
+  return error;
+}
+function readStdin() {
+  return new Promise((resolve, reject) => {
+    let stdin = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => {
+      stdin += chunk;
+    });
+    process.stdin.on("end", () => resolve(stdin));
+    process.stdin.on("error", reject);
+  });
+}
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function writeResult(result, failed = false) {
+  process.stdout.write(`${JSON.stringify(result)}
+`);
+  if (failed) {
+    process.exitCode = 1;
+  }
+}
+function writeEnvelope(result, failed = false) {
+  writeResult(result, failed);
+}
+
+// src/cli/host-helper-archive.ts
+import { spawnSync } from "node:child_process";
+import { readdir, rm } from "node:fs/promises";
+import path from "node:path";
+
+// src/cli/host-helper-release-files.ts
+function expectedReleaseFiles(release) {
+  const files = ["server.mjs", "client.js", "index.html", "sporades.json"];
+  if (release.serverEnvIncluded) {
+    files.push(".env.sporades.server");
+  }
+  if (release.sealedServerEnvIncluded) {
+    files.push(".sporades/sealed-server-env/server-env.sealed.json");
+  }
+  return files;
+}
+function isExpectedClaimedReleaseFile(file) {
+  return [
+    "server.mjs",
+    "client.js",
+    "index.html",
+    "sporades.json",
+    ".env.sporades.server",
+    ".sporades/sealed-server-env/server-env.sealed.json"
+  ].includes(file);
+}
+
+// src/cli/host-helper-archive.ts
+function validateReleaseArchive(request) {
+  const release = request.release;
+  const entries = listArchiveEntries(release.remoteArchive);
+  const expectedFiles = expectedReleaseFiles(release);
+  const allNames = entries.map((entry) => normaliseArchiveEntryName(entry.name));
+  const runtimeEntries = entries.filter((entry) => !isDiscardableArchiveMetadata(entry.name));
+  const actualNames = runtimeEntries.map((entry) => normaliseArchiveEntryName(entry.name));
+  if (entries.some((entry) => !isSafeArchiveEntryType(entry))) {
+    throw helperError(
+      "Hosted Capsule release archive contains unsafe entries.",
+      "Push again so Sporades can package regular runtime files only."
+    );
+  }
+  if (allNames.some((name) => !isSafeArchiveEntryName(name))) {
+    throw helperError(
+      "Hosted Capsule release archive contains unsafe paths.",
+      "Push again so Sporades can package runtime files without absolute or parent-relative paths."
+    );
+  }
+  const actual = [...actualNames].sort();
+  const expected = [...expectedFiles].sort();
+  if (actual.length !== expected.length || actual.some((name, index) => name !== expected[index])) {
+    throw helperError(
+      "Hosted Capsule release archive contains unexpected files.",
+      "Push again so Sporades can package only runtime files."
+    );
+  }
+}
+async function removeDiscardedArchiveMetadata(directory) {
+  for (const entry of await readdir(directory, { withFileTypes: true })) {
+    const entryPath = path.join(directory, entry.name);
+    if (entry.name === "__MACOSX" || entry.name.startsWith("._")) {
+      await rm(entryPath, { recursive: entry.isDirectory(), force: true });
+      continue;
+    }
+    if (entry.isDirectory()) {
+      await removeDiscardedArchiveMetadata(entryPath);
+    }
+  }
+}
+function listArchiveEntries(archivePath) {
+  const namesResult = spawnSync("tar", ["-tzf", archivePath], { encoding: "utf8" });
+  const verboseResult = spawnSync("tar", ["-tvzf", archivePath], { encoding: "utf8" });
+  if (namesResult.error || namesResult.status !== 0 || verboseResult.error || verboseResult.status !== 0) {
+    throw helperError(
+      "Failed to inspect Hosted Capsule release archive.",
+      "Upload the release again with `sporades host push` and check that tar is installed on the Host server."
+    );
+  }
+  const names = namesResult.stdout.trim().split("\n").filter(Boolean);
+  const verboseLines = verboseResult.stdout.trim().split("\n").filter(Boolean);
+  if (names.length !== verboseLines.length) {
+    throw helperError(
+      "Hosted Capsule release archive could not be validated.",
+      "Push again so Sporades can package a clean runtime archive."
+    );
+  }
+  return names.map((name, index) => ({
+    name,
+    type: verboseLines[index]?.[0]
+  }));
+}
+function normaliseArchiveEntryName(name) {
+  return String(name).replace(/^\.\//, "").replace(/\/+$/, "");
+}
+function isDiscardableArchiveMetadata(name) {
+  const normalisedName = normaliseArchiveEntryName(name);
+  return normalisedName === "__MACOSX" || normalisedName.startsWith("__MACOSX/") || normalisedName.split("/").some((segment) => segment.startsWith("._"));
+}
+function isSafeArchiveEntryType(entry) {
+  if (entry.type === "-") {
+    return true;
+  }
+  return entry.type === "d" && isDiscardableArchiveMetadata(entry.name);
+}
+function isSafeArchiveEntryName(name) {
+  if (!name || name.startsWith("/") || name.includes("\0")) {
+    return false;
+  }
+  return name.split("/").every((segment) => segment && segment !== "." && segment !== "..");
+}
+
+// src/cli/host-helper-config.ts
+import { readFile } from "node:fs/promises";
+import path2 from "node:path";
+var HOST_HELPER_CONFIG_FILE = "sporades-host-helper.json";
+var DEFAULT_HOSTED_CAPSULE_DOCKER_IMAGE = SPORADES_BASE_IMAGE.image;
+var DEFAULT_HOSTED_CAPSULE_DOCKER_NETWORK = "sporades-hosted-capsules";
+var DEFAULT_HOSTED_CAPSULE_GRACE_CHECK_MS = 500;
+var DEFAULT_HOST_LOG_LINES = 200;
+var DEFAULT_MAX_HOST_LOG_LINES = 1e4;
+function defaultHostHelperConfig() {
+  return {
+    hostedCapsule: {
+      dockerImage: DEFAULT_HOSTED_CAPSULE_DOCKER_IMAGE,
+      dockerNetwork: DEFAULT_HOSTED_CAPSULE_DOCKER_NETWORK,
+      graceCheckMs: DEFAULT_HOSTED_CAPSULE_GRACE_CHECK_MS
+    },
+    logs: {
+      defaultLines: DEFAULT_HOST_LOG_LINES,
+      maxLines: DEFAULT_MAX_HOST_LOG_LINES
+    }
+  };
+}
+async function loadHostHelperConfig(request) {
+  const loaded = defaultHostHelperConfig();
+  const configPath = hostHelperConfigPath(request);
+  if (!configPath) {
+    return loaded;
+  }
+  let contents;
+  try {
+    contents = await readFile(configPath, "utf8");
+  } catch (error) {
+    if (errorDetails(error).code === "ENOENT" && !process.env.SPORADES_HOST_HELPER_CONFIG) {
+      return loaded;
+    }
+    throw helperError(
+      "Failed to read Host helper config.",
+      `Check that ${configPath} exists and is readable by the Host helper.`
+    );
+  }
+  let config;
+  try {
+    config = JSON.parse(contents);
+  } catch {
+    throw helperError(
+      "Host helper config is invalid JSON.",
+      `Fix ${configPath}, then retry the Host helper command.`
+    );
+  }
+  return applyHostHelperConfig(loaded, config, configPath);
+}
+function hostHelperConfigPath(request) {
+  if (process.env.SPORADES_HOST_HELPER_CONFIG) {
+    return process.env.SPORADES_HOST_HELPER_CONFIG;
+  }
+  if (typeof request.host?.remoteRoot !== "string" || request.host.remoteRoot.length === 0) {
+    return null;
+  }
+  return path2.join(request.host.remoteRoot, HOST_HELPER_CONFIG_FILE);
+}
+function applyHostHelperConfig(loaded, config, configPath) {
+  assertPlainObject(config, "Host helper config", configPath);
+  assertKnownKeys(config, ["hostedCapsule", "logs"], "Host helper config", configPath);
+  const hostedCapsule = config.hostedCapsule ?? {};
+  assertPlainObject(hostedCapsule, "Host helper hostedCapsule config", configPath);
+  assertKnownKeys(hostedCapsule, ["dockerImage", "dockerNetwork", "graceCheckMs"], "Host helper hostedCapsule config", configPath);
+  const logs = config.logs ?? {};
+  assertPlainObject(logs, "Host helper logs config", configPath);
+  assertKnownKeys(logs, ["defaultLines", "maxLines"], "Host helper logs config", configPath);
+  if (Object.hasOwn(hostedCapsule, "dockerImage")) {
+    loaded.hostedCapsule.dockerImage = readConfigString(hostedCapsule.dockerImage, "hostedCapsule.dockerImage", configPath);
+  }
+  if (Object.hasOwn(hostedCapsule, "dockerNetwork")) {
+    loaded.hostedCapsule.dockerNetwork = readConfigString(hostedCapsule.dockerNetwork, "hostedCapsule.dockerNetwork", configPath);
+  }
+  if (Object.hasOwn(hostedCapsule, "graceCheckMs")) {
+    loaded.hostedCapsule.graceCheckMs = readConfigPositiveInteger(hostedCapsule.graceCheckMs, "hostedCapsule.graceCheckMs", configPath);
+  }
+  if (Object.hasOwn(logs, "defaultLines")) {
+    loaded.logs.defaultLines = readConfigPositiveInteger(logs.defaultLines, "logs.defaultLines", configPath);
+  }
+  if (Object.hasOwn(logs, "maxLines")) {
+    loaded.logs.maxLines = readConfigPositiveInteger(logs.maxLines, "logs.maxLines", configPath);
+  }
+  if (loaded.logs.defaultLines > loaded.logs.maxLines) {
+    throw helperError(
+      "Host helper config is invalid.",
+      `Set logs.defaultLines less than or equal to logs.maxLines in ${configPath}.`
+    );
+  }
+  return loaded;
+}
+function assertPlainObject(value, label, configPath) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw helperError(
+      "Host helper config is invalid.",
+      `${label} must be a JSON object in ${configPath}.`
+    );
+  }
+}
+function assertKnownKeys(value, knownKeys, label, configPath) {
+  for (const key of Object.keys(value)) {
+    if (!knownKeys.includes(key)) {
+      throw helperError(
+        "Host helper config is invalid.",
+        `${label} contains unsupported key "${key}" in ${configPath}.`
+      );
+    }
+  }
+}
+function readConfigString(value, key, configPath) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw helperError(
+      "Host helper config is invalid.",
+      `Set ${key} to a non-empty string in ${configPath}.`
+    );
+  }
+  return value;
+}
+function readConfigPositiveInteger(value, key, configPath) {
+  if (typeof value !== "number" || !Number.isInteger(value) || value < 1) {
+    throw helperError(
+      "Host helper config is invalid.",
+      `Set ${key} to a positive whole number in ${configPath}.`
+    );
+  }
+  return value;
+}
+
+// src/cli/host-helper-validation.ts
+import path3 from "node:path";
+function missingCapsuleHint(request, purpose) {
+  if (purpose === "push") {
+    return `Run \`sporades host register ${request.capsule.subname} --host ${request.host.alias}\` before pushing a release.`;
+  }
+  if (purpose === "stats") {
+    return `Run \`sporades host register ${request.capsule.subname} --host ${request.host.alias}\` before reading stats.`;
+  }
+  if (purpose === "unregister") {
+    return `Run \`sporades host register ${request.capsule.subname} --host ${request.host.alias}\` before unregistering the Hosted Capsule.`;
+  }
+  return `Run \`sporades host register ${request.capsule.subname} --host ${request.host.alias}\` before managing the Hosted Capsule lifecycle.`;
+}
+function hostRegistryRetryCommand(request) {
+  return request.action === "host.stats" ? `sporades host stats --host ${request.host.alias}` : `sporades host list --host ${request.host.alias}`;
+}
+function validateLifecycleRequest(request) {
+  const requiredStrings = [
+    request.host?.domain,
+    request.host?.alias,
+    request.host?.remoteRoot,
+    request.capsule?.subname
+  ];
+  if (requiredStrings.some((value) => typeof value !== "string" || value.length === 0)) {
+    throw helperError("Invalid Hosted Capsule lifecycle request.", "Update the Sporades CLI and retry the host lifecycle command.");
+  }
+}
+function validateSealedEnvRotationRequest(request) {
+  const requiredStrings = [
+    request.host?.domain,
+    request.host?.alias,
+    request.host?.remoteRoot,
+    request.capsule?.subname
+  ];
+  if (requiredStrings.some((value) => typeof value !== "string" || value.length === 0)) {
+    throw helperError("Invalid Hosted Capsule sealed-env key rotation request.", "Update the Sporades CLI and retry `sporades host rotate-key`.");
+  }
+}
+function validateStatsRequest(request) {
+  const requiredStrings = [
+    request.host?.domain,
+    request.host?.alias,
+    request.host?.remoteRoot,
+    request.capsule?.subname
+  ];
+  if (requiredStrings.some((value) => typeof value !== "string" || value.length === 0)) {
+    throw helperError("Invalid Hosted Capsule stats request.", "Update the Sporades CLI and retry the host stats command.");
+  }
+}
+function validateReleaseListRequest(request) {
+  const requiredStrings = [
+    request.host?.domain,
+    request.host?.alias,
+    request.host?.remoteRoot,
+    request.capsule?.subname
+  ];
+  if (requiredStrings.some((value) => typeof value !== "string" || value.length === 0)) {
+    throw helperError("Invalid Hosted Capsule releases request.", "Update the Sporades CLI and retry `sporades host releases`.");
+  }
+}
+function validateHealthRequest(request) {
+  const requiredStrings = [
+    request.host?.domain,
+    request.host?.alias,
+    request.host?.remoteRoot,
+    request.capsule?.subname
+  ];
+  if (requiredStrings.some((value) => typeof value !== "string" || value.length === 0)) {
+    throw helperError("Invalid Hosted Capsule health request.", "Update the Sporades CLI and retry the host health command.");
+  }
+}
+function validateHostStatsRequest(request) {
+  const requiredStrings = [
+    request.host?.domain,
+    request.host?.alias,
+    request.host?.remoteRoot
+  ];
+  if (requiredStrings.some((value) => typeof value !== "string" || value.length === 0)) {
+    throw helperError("Invalid Host stats request.", "Update the Sporades CLI and retry `sporades host stats`.");
+  }
+}
+function validateRollbackRequest(request) {
+  const requiredStrings = [
+    request.host?.domain,
+    request.host?.alias,
+    request.host?.remoteRoot,
+    request.capsule?.subname,
+    request.rollback?.releaseId
+  ];
+  if (requiredStrings.some((value) => typeof value !== "string" || value.length === 0)) {
+    throw helperError("Invalid Hosted Capsule rollback request.", "Update the Sporades CLI and retry `sporades host rollback`.");
+  }
+  const releaseId = request.rollback?.releaseId;
+  if (!releaseId || !/^\d{8}T\d{6}Z-[a-f0-9]{8}$/.test(releaseId)) {
+    throw helperError(
+      "Invalid Hosted Capsule release ID.",
+      `Choose a recorded release ID from \`sporades host releases ${request.capsule.subname} --host ${request.host.alias} --json\`.`
+    );
+  }
+}
+function validateHostLogsRequest(request, limits) {
+  const requiredStrings = [
+    request.host?.alias,
+    request.host?.domain,
+    request.host?.remoteRoot
+  ];
+  if (requiredStrings.some((value) => typeof value !== "string" || value.length === 0)) {
+    throw helperError("Invalid Host logs request.", "Update the Sporades CLI and retry `sporades host logs`.");
+  }
+  const source = request.logs?.source ?? "caddy-combined";
+  if (!["http", "caddy-combined", "stdout", "stderr"].includes(source)) {
+    throw helperError(
+      "Invalid Host log source.",
+      "Use `http`, `stdout`, or `stderr` for `sporades host logs`."
+    );
+  }
+  if ((source === "stdout" || source === "stderr") && (typeof request.capsule?.subname !== "string" || request.capsule.subname.length === 0)) {
+    throw helperError(
+      "Missing Capsule subname for container logs.",
+      "Pass `--subname <capsule-subname>` or run the command from a project with a Hosted Capsule binding."
+    );
+  }
+  const lines = request.logs?.lines ?? limits.defaultLines;
+  if (!Number.isInteger(lines) || lines < 1 || lines > limits.maxLines) {
+    throw helperError(
+      "Invalid Host log line count.",
+      `Pass \`--lines <n>\` with a whole number between 1 and ${limits.maxLines}.`
+    );
+  }
+}
+function validateListRequest(request) {
+  const requiredStrings = [
+    request.host?.domain,
+    request.host?.alias,
+    request.host?.remoteRoot
+  ];
+  if (requiredStrings.some((value) => typeof value !== "string" || value.length === 0)) {
+    throw helperError("Invalid Hosted Capsule list request.", "Update the Sporades CLI and retry `sporades host list`.");
+  }
+}
+function validateListRegistryRecord(request, record, recordPath) {
+  const capsuleRecord = record;
+  const expectedSubname = path3.basename(recordPath, ".json");
+  const expectedRemoteCapsuleId = `${request.host.domain}/${typeof capsuleRecord?.subname === "string" ? capsuleRecord.subname : expectedSubname}`;
+  const valid = capsuleRecord && typeof capsuleRecord.subname === "string" && capsuleRecord.subname.length > 0 && capsuleRecord.subname === expectedSubname && capsuleRecord.domain === request.host.domain && (capsuleRecord.remoteCapsuleId ?? expectedRemoteCapsuleId) === expectedRemoteCapsuleId;
+  if (!valid) {
+    throw helperError(
+      "Hosted Capsule registry record is invalid.",
+      `Repair the Host server registry record at ${recordPath}, then retry \`${hostRegistryRetryCommand(request)}\`.`
+    );
+  }
+}
+function validateBootstrapRequest(request) {
+  const requiredStrings = [
+    request.host?.domain,
+    request.host?.alias,
+    request.host?.remoteRoot
+  ];
+  if (requiredStrings.some((value) => typeof value !== "string" || value.length === 0)) {
+    throw helperError("Invalid Host bootstrap request.", "Update the Sporades CLI and retry `sporades host bootstrap`.");
+  }
+  const tlsMode = request.bootstrap?.tls?.mode ?? "automatic";
+  if (tlsMode !== "automatic" && tlsMode !== "cloudflare-origin") {
+    throw helperError(
+      "Invalid Host TLS mode.",
+      "Use `--tls automatic` for Caddy-managed certificates or `--tls cloudflare-origin` for preinstalled Cloudflare origin certificates."
+    );
+  }
+}
+function validateRegisterRequest(request) {
+  const requiredStrings = [
+    request.host?.domain,
+    request.host?.alias,
+    request.host?.remoteRoot,
+    request.capsule?.subname
+  ];
+  if (requiredStrings.some((value) => typeof value !== "string" || value.length === 0)) {
+    throw helperError("Invalid Hosted Capsule registration request.", "Update the Sporades CLI and retry `sporades host register`.");
+  }
+  const registration = request.registration ?? {};
+  const mismatchedIdentity = registration.subname && registration.subname !== request.capsule.subname || registration.domain && registration.domain !== request.host.domain || registration.remoteCapsuleId && registration.remoteCapsuleId !== `${request.host.domain}/${request.capsule.subname}`;
+  if (mismatchedIdentity) {
+    throw helperError(
+      "Hosted Capsule registration request does not match the Host profile.",
+      "Rebind the local project or pass the correct Host profile and Capsule subname."
+    );
+  }
+  const tlsMode = request.registration?.bootstrap?.tls?.mode ?? request.bootstrap?.tls?.mode ?? "automatic";
+  if (tlsMode !== "automatic" && tlsMode !== "cloudflare-origin") {
+    throw helperError(
+      "Invalid Host TLS mode.",
+      "Use `--tls automatic` for Caddy-managed certificates or `--tls cloudflare-origin` for preinstalled Cloudflare origin certificates."
+    );
+  }
+}
+function validateUnregisterRequest(request) {
+  const requiredStrings = [
+    request.host?.domain,
+    request.host?.alias,
+    request.host?.remoteRoot,
+    request.capsule?.subname
+  ];
+  if (requiredStrings.some((value) => typeof value !== "string" || value.length === 0)) {
+    throw helperError("Invalid Hosted Capsule unregister request.", "Update the Sporades CLI and retry `sporades host unregister`.");
+  }
+  const unregister = request.unregister ?? {};
+  const mismatchedIdentity = unregister.subname && unregister.subname !== request.capsule.subname || unregister.domain && unregister.domain !== request.host.domain || unregister.remoteCapsuleId && unregister.remoteCapsuleId !== `${request.host.domain}/${request.capsule.subname}`;
+  if (mismatchedIdentity) {
+    throw helperError(
+      "Hosted Capsule unregister request does not match the Host profile.",
+      "Rebind the local project or pass the correct Host profile and Capsule subname."
+    );
+  }
+}
+function validateDeleteRequest(request) {
+  const requiredStrings = [
+    request.host?.domain,
+    request.host?.alias,
+    request.host?.remoteRoot,
+    request.capsule?.subname
+  ];
+  if (requiredStrings.some((value) => typeof value !== "string" || value.length === 0)) {
+    throw helperError("Invalid Hosted Capsule delete request.", "Update the Sporades CLI and retry `sporades host delete`.");
+  }
+  const deletion = request.delete ?? {};
+  const mismatchedIdentity = deletion.subname && deletion.subname !== request.capsule.subname || deletion.domain && deletion.domain !== request.host.domain || deletion.remoteCapsuleId && deletion.remoteCapsuleId !== `${request.host.domain}/${request.capsule.subname}`;
+  if (mismatchedIdentity) {
+    throw helperError(
+      "Hosted Capsule delete request does not match the Host profile.",
+      "Rebind the local project or pass the correct Host profile and Capsule subname."
+    );
+  }
+}
+function validateInstallRequest(request) {
+  const release = request.release;
+  const requiredStrings = [
+    request.host?.domain,
+    request.host?.alias,
+    request.host?.remoteRoot,
+    request.capsule?.subname,
+    release?.id,
+    release?.remoteArchive,
+    release?.hostedUrl,
+    release?.directories?.releases,
+    release?.directories?.release,
+    release?.directories?.data,
+    release?.currentLink
+  ];
+  if (requiredStrings.some((value) => typeof value !== "string" || value.length === 0)) {
+    throw helperError("Invalid release install request.", "Update the Sporades CLI and retry `sporades host push`.");
+  }
+  if (!/^\d{8}T\d{6}Z-[a-f0-9]{8}$/.test(release.id)) {
+    throw helperError("Invalid Hosted Capsule release ID.", "Push again to generate a fresh UTC-sortable release ID.");
+  }
+  if (!Array.isArray(release.files) || release.files.some((file) => !isExpectedClaimedReleaseFile(file))) {
+    throw helperError("Invalid Hosted Capsule release file list.", "Update the Sporades CLI and retry `sporades host push`.");
+  }
+  const expectedFiles = expectedReleaseFiles(release);
+  const claimedFiles = [...release.files].sort();
+  const sortedExpectedFiles = [...expectedFiles].sort();
+  if (claimedFiles.length !== sortedExpectedFiles.length || claimedFiles.some((file, index) => file !== sortedExpectedFiles[index])) {
+    throw helperError("Invalid Hosted Capsule release file list.", "Update the Sporades CLI and retry `sporades host push`.");
+  }
+  const directories = release.directories;
+  if (!directories?.releases || !directories.release) {
+    throw helperError("Invalid Hosted Capsule release directory.", "Update the Sporades CLI and retry `sporades host push`.");
+  }
+  const expectedReleaseDirectory = path3.join(directories.releases, release.id);
+  if (path3.resolve(directories.release) !== path3.resolve(expectedReleaseDirectory)) {
+    throw helperError("Invalid Hosted Capsule release directory.", "Update the Sporades CLI and retry `sporades host push`.");
+  }
+}
+
+// src/cli/sporades-host-helper.ts
+var CAPSULE_RUNTIME_HEALTH_PATH = "/__sporades/health/runtime";
+var RUNTIME_PROBE_HEADER = "x-sporades-host-probe";
+var hostHelperConfig = defaultHostHelperConfig();
+main().catch((error) => {
+  writeEnvelope(
+    {
+      ok: false,
+      data: null,
+      error: {
+        message: error.message,
+        hint: error.hint ?? "Check the Host helper request and retry the command.",
+        ...error.diagnostics ? { diagnostics: error.diagnostics } : {}
+      }
+    },
+    false
+  );
+});
+async function main() {
+  const request = JSON.parse(await readStdin());
+  hostHelperConfig = await loadHostHelperConfig(request);
+  if (request.action === "capsule.register") {
+    await registerCapsule(request);
+    return;
+  }
+  if (request.action === "capsule.sealed-env.rotate-key") {
+    await rotateCapsuleSealedEnvKey(request);
+    return;
+  }
+  if (request.action === "capsule.unregister") {
+    await unregisterCapsule(request);
+    return;
+  }
+  if (request.action === "capsule.delete") {
+    await deleteCapsule(request);
+    return;
+  }
+  if (request.action === "capsule.release.install") {
+    await installRelease(request);
+    return;
+  }
+  if (request.action === "capsule.release.list") {
+    await listReleases(request);
+    return;
+  }
+  if (request.action === "capsule.release.rollback") {
+    await rollbackRelease(request);
+    return;
+  }
+  if (request.action === "capsule.start") {
+    await startCapsule(request);
+    return;
+  }
+  if (request.action === "capsule.stop") {
+    await stopCapsule(request);
+    return;
+  }
+  if (request.action === "capsule.restart") {
+    await restartCapsule(request);
+    return;
+  }
+  if (request.action === "capsule.stats") {
+    await statsCapsule(request);
+    return;
+  }
+  if (request.action === "capsule.health") {
+    await healthCapsule(request);
+    return;
+  }
+  if (request.action === "host.stats") {
+    await statsHost(request);
+    return;
+  }
+  if (request.action === "capsule.list") {
+    await listCapsules(request);
+    return;
+  }
+  if (request.action === "host.logs") {
+    await logsHost(request);
+    return;
+  }
+  if (request.action === "host.bootstrap") {
+    await bootstrapHost(request);
+    return;
+  }
+  throw helperError("Unsupported Host helper action.", "Update the Host helper or use a supported Sporades host command.");
+}
+async function bootstrapHost(request) {
+  validateBootstrapRequest(request);
+  const bootstrap = normaliseBootstrap(request);
+  await ensureBootstrapDirectories(bootstrap);
+  await validateBootstrapTls(request, bootstrap);
+  const network = ensureDockerNetwork(bootstrap.network);
+  const accessLog = await provisionCaddyAccessLog(request, bootstrap);
+  const caddy = await installCaddyBootstrapConfig(request, bootstrap);
+  writeEnvelope({
+    ok: true,
+    data: {
+      bootstrapped: true,
+      domain: request.host.domain,
+      remoteRoot: request.host.remoteRoot,
+      network,
+      packages: bootstrap.substrate.packages,
+      services: bootstrap.substrate.services,
+      directories: bootstrap.directories,
+      tls: bootstrap.tls,
+      caddy: { ...caddy, accessLog },
+      preservedCapsules: true
+    },
+    error: null
+  });
+}
+async function registerCapsule(request) {
+  validateRegisterRequest(request);
+  const registration = normaliseRegistration(request);
+  await ensureHostedDomainBootstrapped(request, registration);
+  let reactivated = false;
+  let sealedServerEnv = null;
+  await mkdir(path4.dirname(registryLockPath(request)), { recursive: true });
+  await withRegistryLock(request, async () => {
+    if (await pathExists(registration.registryRecord)) {
+      const existing = await readRegistryRecordForCapsule(request, "register");
+      assertRegistryRecordMatchesRequest(request, existing);
+      if (existing.status === "unregistered") {
+        await mkdir(path4.dirname(registration.registryRecord), { recursive: true });
+        await mkdir(registration.directories.releases, { recursive: true });
+        await mkdir(registration.directories.data, { recursive: true });
+        await writeUnavailableRoute(registration.lifecycle);
+        sealedServerEnv = await ensureHostSealedEnvKeyPair(registration, existing);
+        await writeRegistryRecordAtomic(registration.registryRecord, reactivateRegistrationRecord(existing, sealedServerEnv));
+        reactivated = true;
+        return;
+      }
+      throw helperError(
+        "Hosted Capsule subname is already registered for this Hosted domain.",
+        `Choose a different Capsule subname for ${request.host.domain}.`
+      );
+    }
+    await mkdir(path4.dirname(registration.registryRecord), { recursive: true });
+    await mkdir(registration.directories.releases, { recursive: true });
+    await mkdir(registration.directories.data, { recursive: true });
+    await mkdir(registration.directories.logs, { recursive: true });
+    await writeUnavailableRoute(registration.lifecycle);
+    sealedServerEnv = await ensureHostSealedEnvKeyPair(registration);
+    await writeRegistryRecordAtomic(registration.registryRecord, createRegistrationRecord(registration, sealedServerEnv));
+  });
+  writeEnvelope({
+    ok: true,
+    data: {
+      registered: true,
+      reactivated,
+      authoritative: true,
+      capsule: {
+        subname: registration.subname,
+        domain: registration.domain,
+        hostedUrl: registration.hostedUrl,
+        remoteCapsuleId: registration.remoteCapsuleId
+      },
+      registryRecord: registration.registryRecord,
+      directories: registration.directories,
+      route: registration.route,
+      sealedServerEnv
+    },
+    error: null
+  });
+}
+async function rotateCapsuleSealedEnvKey(request) {
+  validateSealedEnvRotationRequest(request);
+  await mkdir(path4.dirname(registryLockPath(request)), { recursive: true });
+  let data;
+  await withRegistryLock(request, async () => {
+    const record = await readRegistryRecordForCapsule(request, "rotate-key");
+    assertRegistryRecordMatchesRequest(request, record);
+    if (record.status === "unregistered") {
+      throw helperError(
+        "Hosted Capsule is unregistered.",
+        `Run \`sporades host register ${request.capsule.subname} --host ${request.host.alias}\` before rotating the sealed-env key.`
+      );
+    }
+    const dataDirectory = path4.join(request.host.remoteRoot, "hosts", request.host.domain, "capsules", request.capsule.subname, "data");
+    const previousPublicKeyFingerprint = record.sealedServerEnv?.currentKeyFingerprint ?? null;
+    const sealedServerEnv = await generateHostSealedEnvKeyPair(dataDirectory);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const nextRecord = {
+      ...record,
+      sealedServerEnv: { ...record.sealedServerEnv ?? {}, currentKeyFingerprint: sealedServerEnv.publicKeyFingerprint },
+      updatedAt: now
+    };
+    await writeRegistryRecordAtomic(registryPath(request), nextRecord);
+    const referenced = referencedSealedEnvKeyFingerprints(nextRecord);
+    referenced.add(sealedServerEnv.publicKeyFingerprint);
+    const cleanup = await cleanupUnreferencedHostSealedEnvKeys(dataDirectory, referenced);
+    data = {
+      rotated: true,
+      capsule: {
+        subname: request.capsule.subname,
+        domain: request.host.domain,
+        hostedUrl: record.hostedUrl ?? `${request.host.scheme ?? "https"}://${request.capsule.subname}.${request.host.domain}`,
+        remoteCapsuleId: record.remoteCapsuleId ?? `${request.host.domain}/${request.capsule.subname}`
+      },
+      sealedServerEnv: {
+        previousPublicKeyFingerprint,
+        publicKey: sealedServerEnv.publicKey,
+        publicKeyFingerprint: sealedServerEnv.publicKeyFingerprint,
+        publicKeyPath: sealedServerEnv.publicKeyPath
+      },
+      cleanup
+    };
+  });
+  writeEnvelope({ ok: true, data, error: null });
+}
+async function unregisterCapsule(request) {
+  validateUnregisterRequest(request);
+  const unregister = normaliseUnregister(request);
+  await mkdir(path4.dirname(registryLockPath(request)), { recursive: true });
+  let data;
+  await withRegistryLock(request, async () => {
+    const record = await readRegistryRecordForCapsule(request, "unregister");
+    assertRegistryRecordMatchesRequest(request, record);
+    if (record.status === "unregistered") {
+      data = createUnregisterResult(request, unregister, record, true);
+      return;
+    }
+    stopAndRemoveContainer(unregister.container.name);
+    const route = await removeManagedRoute(unregister.lifecycle, unregister.route.routeFile);
+    const now = /* @__PURE__ */ new Date();
+    const deleteAfter = new Date(now.getTime() + 90 * 24 * 60 * 60 * 1e3).toISOString();
+    const nextRecord = {
+      ...record,
+      status: "unregistered",
+      unregistered: true,
+      unregisteredAt: now.toISOString(),
+      deleteAfter,
+      updatedAt: now.toISOString()
+    };
+    try {
+      await writeRegistryRecordAtomic(unregister.registryRecord, nextRecord);
+    } catch (error) {
+      await restoreRemovedRoute(unregister.lifecycle, route);
+      throw error;
+    }
+    await finalizeRemovedRoute(route);
+    data = createUnregisterResult(request, unregister, nextRecord, false, route);
+  });
+  writeEnvelope({ ok: true, data, error: null });
+}
+async function deleteCapsule(request) {
+  validateDeleteRequest(request);
+  const deletion = normaliseDeletion(request);
+  await mkdir(path4.dirname(registryLockPath(request)), { recursive: true });
+  let data;
+  await withRegistryLock(request, async () => {
+    const record = await readOptionalRegistryRecordForCapsule(request);
+    if (record) {
+      assertRegistryRecordMatchesRequest(request, record);
+      if (record.status !== "unregistered") {
+        throw deletionRequiresUnregisterError(request);
+      }
+    } else if (await pathExists(deletion.route.routeFile) || await pathExists(deletion.directories.capsule)) {
+      throw deletionRequiresUnregisterError(request);
+    }
+    const route = await removePathIfPresent(deletion.route.routeFile);
+    if (route.removed) {
+      reloadCaddy(deletion.lifecycle);
+    }
+    const capsuleDirectory = await removePathIfPresent(deletion.directories.capsule, { recursive: true });
+    const registryRecord = await removePathIfPresent(deletion.registryRecord);
+    data = createDeleteResult(request, deletion, {
+      route,
+      capsuleDirectory,
+      registryRecord,
+      idempotent: !record && !route.removed && !capsuleDirectory.removed && !registryRecord.removed
+    });
+  });
+  writeEnvelope({ ok: true, data, error: null });
+}
+function deletionRequiresUnregisterError(request) {
+  return helperError(
+    "Hosted Capsule must be unregistered before deletion.",
+    `Run \`sporades host unregister ${request.capsule.subname} --host ${request.host.alias}\` before deleting Hosted Capsule storage.`
+  );
+}
+async function installRelease(request) {
+  const release = request.release;
+  validateInstallRequest(request);
+  const previousRecord = await verifyRegisteredCapsule(request);
+  const previousCurrentRelease = previousRecord.currentRelease?.id ? { id: previousRecord.currentRelease.id } : null;
+  validateReleaseArchive(request);
+  const paths = canonicalReleasePaths(request);
+  if (!paths.release) {
+    throw helperError("Invalid release install request.", "Update the Sporades CLI and retry `sporades host push`.");
+  }
+  validateSealedServerEnvPrivateKeyPath(release, paths);
+  await mkdir(paths.releases, { recursive: true });
+  await mkdir(paths.data, { recursive: true });
+  await prepareWritableDataPath(paths.data);
+  await mkdir(paths.logs, { recursive: true });
+  const tempReleaseDirectory = `${paths.release}.tmp-${process.pid}`;
+  const tempCurrentLink = `${paths.currentLink}.tmp-${process.pid}`;
+  await rm2(tempReleaseDirectory, { recursive: true, force: true });
+  await rm2(tempCurrentLink, { force: true });
+  await mkdir(tempReleaseDirectory, { recursive: true });
+  const extract = spawnSync2("tar", ["-xzf", release.remoteArchive, "-C", tempReleaseDirectory], {
+    encoding: "utf8"
+  });
+  if (extract.error || extract.status !== 0) {
+    await rm2(tempReleaseDirectory, { recursive: true, force: true });
+    throw helperError(
+      "Failed to extract Hosted Capsule release archive.",
+      "Upload the release again with `sporades host push` and check that tar is installed on the Host server."
+    );
+  }
+  await removeDiscardedArchiveMetadata(tempReleaseDirectory);
+  try {
+    await rename(tempReleaseDirectory, paths.release);
+  } catch (error) {
+    await rm2(tempReleaseDirectory, { recursive: true, force: true });
+    const details = errorDetails(error);
+    if (details.code === "EEXIST" || details.code === "ENOTEMPTY") {
+      throw helperError(
+        "Hosted Capsule release already exists.",
+        "Push again to generate a fresh immutable release ID."
+      );
+    }
+    throw error;
+  }
+  await symlink(paths.release, tempCurrentLink);
+  await rename(tempCurrentLink, paths.currentLink);
+  await installSealedServerEnvPrivateKey(release);
+  await recordReleaseUploaded(request, release);
+  let restartResult = null;
+  let restartError = null;
+  if (release.restart) {
+    try {
+      restartResult = await restartCapsule(request, { write: false });
+    } catch (error) {
+      restartError = error;
+    }
+  }
+  const data = {
+    installed: true,
+    restartRequested: Boolean(release.restart),
+    restarted: Boolean(restartResult?.restarted),
+    capsule: {
+      subname: request.capsule.subname,
+      domain: request.host.domain,
+      hostedUrl: release.hostedUrl
+    },
+    release: {
+      id: release.id,
+      directory: paths.release,
+      currentLink: paths.currentLink,
+      files: release.files,
+      serverEnvIncluded: Boolean(release.serverEnvIncluded),
+      ...release.sealedServerEnvIncluded ? { sealedServerEnvIncluded: true } : {}
+    }
+  };
+  if (restartResult) {
+    data.lifecycle = restartResult;
+  }
+  if (isVerificationRequested(request)) {
+    const verificationResult = await verifyInstalledRelease(request, release, data, previousCurrentRelease, restartResult, restartError);
+    writeEnvelope(verificationResult, !verificationResult.ok);
+    return;
+  }
+  if (release.restart && !restartResult) {
+    writeEnvelope({
+      ok: false,
+      data,
+      error: {
+        message: errorDetails(restartError).message ?? "Hosted Capsule restart failed.",
+        hint: errorDetails(restartError).hint ?? `Check Docker logs for ${normaliseLifecycle(request).container.name}; the route has been returned to the Hosted Capsule unavailable response.`
+      }
+    });
+    return;
+  }
+  writeEnvelope({ ok: true, data, error: null });
+}
+function isVerificationRequested(request) {
+  return request.verification?.enabled === true;
+}
+async function verifyInstalledRelease(request, release, installData, previousCurrentRelease, restartResult, restartError) {
+  const currentAttemptedRelease = { id: release.id };
+  const baseData = {
+    ...installData,
+    previousCurrentRelease,
+    currentAttemptedRelease
+  };
+  if (!restartResult) {
+    const fallback = await maybeFallbackToPreviousRelease(request, release.id, previousCurrentRelease, restartError?.message ?? "Hosted Capsule restart failed.");
+    return verificationFailureResult(
+      request,
+      release.id,
+      {
+        ...baseData,
+        verified: false,
+        verification: {
+          state: "failed",
+          health: null
+        },
+        fallback
+      },
+      restartError?.message ?? "Hosted Capsule restart failed."
+    );
+  }
+  const healthResult = await evaluateCapsuleHealth(request, {
+    timeoutMs: readVerificationHealthTimeoutMs(request)
+  });
+  if (!healthResult.ok) {
+    await routeVerifiedFailureToUnavailable(request, release.id, healthResult.error?.message ?? "Hosted Capsule release verification failed.");
+    const fallback = await maybeFallbackToPreviousRelease(
+      request,
+      release.id,
+      previousCurrentRelease,
+      healthResult.error?.message ?? "Hosted Capsule release verification failed."
+    );
+    return verificationFailureResult(
+      request,
+      release.id,
+      {
+        ...baseData,
+        verified: false,
+        verification: {
+          state: "failed",
+          health: verificationHealthSummary(healthResult)
+        },
+        fallback
+      },
+      healthResult.error?.message ?? "Hosted Capsule release verification failed."
+    );
+  }
+  await recordReleaseVerified(request, release.id);
+  return {
+    ok: true,
+    data: {
+      ...baseData,
+      verified: true,
+      verification: {
+        state: "verified",
+        health: verificationHealthSummary(healthResult)
+      }
+    },
+    error: null
+  };
+}
+function readVerificationHealthTimeoutMs(request) {
+  const value = Number(request.verification?.healthTimeoutMs ?? 1e4);
+  if (!Number.isFinite(value) || value < 1) {
+    return 1e4;
+  }
+  return Math.min(value, 6e4);
+}
+async function routeVerifiedFailureToUnavailable(request, releaseId, message) {
+  const lifecycle = normaliseLifecycle(request);
+  stopAndRemoveContainer(lifecycle.container.name);
+  try {
+    await writeUnavailableRoute(lifecycle);
+  } finally {
+    await recordReleaseVerificationFailed(request, releaseId, message);
+  }
+}
+async function maybeFallbackToPreviousRelease(request, failedReleaseId, previousCurrentRelease, reason) {
+  if (request.verification?.fallbackToPreviousRelease !== true || !previousCurrentRelease?.id) {
+    return {
+      applied: false,
+      reason: request.verification?.fallbackToPreviousRelease === true ? "no-previous-release" : "not-configured"
+    };
+  }
+  const releaseId = previousCurrentRelease.id;
+  const paths = canonicalRollbackPaths(request, releaseId);
+  try {
+    await assertRollbackReleaseFiles(request, paths.release);
+    await switchCurrentReleaseLink(paths.currentLink, paths.release);
+    let lifecycle = null;
+    let restartError = null;
+    try {
+      lifecycle = await restartCapsule(request, { write: false });
+    } catch (error) {
+      restartError = error;
+    }
+    if (!lifecycle) {
+      await restoreFailedReleaseAfterFallbackRestartFailure(request, failedReleaseId, releaseId, reason, restartError);
+      return {
+        applied: false,
+        reason: "fallback-restart-failed",
+        release: { id: releaseId },
+        error: restartError ? { message: errorDetails(restartError).message, hint: errorDetails(restartError).hint ?? null } : null
+      };
+    }
+    await recordReleaseVerificationFallback(request, failedReleaseId, releaseId, reason);
+    return { applied: true, release: { id: releaseId }, lifecycle };
+  } catch (error) {
+    const details = errorDetails(error);
+    return {
+      applied: false,
+      reason: "fallback-failed",
+      release: { id: releaseId },
+      error: { message: details.message, hint: details.hint ?? null }
+    };
+  }
+}
+async function switchCurrentReleaseLink(currentLink, releaseDirectory) {
+  const tempCurrentLink = `${currentLink}.tmp-${process.pid}`;
+  await rm2(tempCurrentLink, { force: true });
+  await symlink(releaseDirectory, tempCurrentLink);
+  await rename(tempCurrentLink, currentLink);
+}
+async function restoreFailedReleaseAfterFallbackRestartFailure(request, failedReleaseId, fallbackReleaseId, reason, restartError) {
+  const failedPaths = canonicalRollbackPaths(request, failedReleaseId);
+  try {
+    await switchCurrentReleaseLink(failedPaths.currentLink, failedPaths.release);
+  } catch {
+  }
+  await recordReleaseVerificationFallbackFailed(
+    request,
+    failedReleaseId,
+    fallbackReleaseId,
+    restartError?.message ?? "Hosted Capsule fallback restart failed.",
+    reason
+  );
+  try {
+    await writeUnavailableRoute(normaliseLifecycle(request));
+  } catch {
+  }
+}
+function verificationFailureResult(request, releaseId, data, message) {
+  const rollbackGuidance = releaseVerificationRollbackGuidance(request, data.previousCurrentRelease);
+  return {
+    ok: false,
+    data: {
+      ...data,
+      rollbackGuidance
+    },
+    error: {
+      message: "Hosted Capsule release verification failed.",
+      hint: rollbackGuidance ? `Run \`${rollbackGuidance.command}\` to explicitly roll back to the previous current release.` : `Inspect \`sporades host releases ${request.capsule.subname} --host ${request.host.alias} --json\` and choose an explicit rollback target.`,
+      details: {
+        releaseId,
+        cause: message,
+        fallback: data.fallback ?? { applied: false, reason: "not-configured" }
+      }
+    }
+  };
+}
+function releaseVerificationRollbackGuidance(request, previousCurrentRelease) {
+  if (!previousCurrentRelease?.id) {
+    return null;
+  }
+  return {
+    previousReleaseId: previousCurrentRelease.id,
+    command: `sporades host rollback ${request.capsule.subname} ${previousCurrentRelease.id} --host ${request.host.alias}`
+  };
+}
+function verificationHealthSummary(result) {
+  if (result.ok) {
+    return {
+      route: {
+        url: result.data.route.url,
+        responding: result.data.route.responding === true
+      },
+      runtime: result.data.runtime
+    };
+  }
+  return {
+    failure: result.data?.failure ?? "verification-failure",
+    route: {
+      url: result.data?.route?.url ?? null,
+      responding: false
+    },
+    runtime: result.data?.runtime ?? null
+  };
+}
+async function startCapsule(request, options = {}) {
+  validateLifecycleRequest(request);
+  const registryRecord = await verifyRegisteredCapsule(request, "lifecycle");
+  const paths = canonicalReleasePaths(request);
+  const releaseId = await currentReleaseId(paths.currentLink, request);
+  const lifecycle = normaliseLifecycle(request, registryRecord);
+  await mkdir(paths.data, { recursive: true });
+  await prepareWritableDataPath(paths.data);
+  await recordReleaseStartAttempt(request, releaseId);
+  stopAndRemoveContainer(lifecycle.container.name);
+  ensureHostedBaseImage(lifecycle);
+  const runArgs = await dockerRunArgs(lifecycle, releaseId);
+  const run = runDocker(runArgs);
+  if (!run.ok) {
+    await recordFailedStartAndUnavailableRoute(request, lifecycle, releaseId, "Hosted Capsule container failed to start.");
+    const result = {
+      ok: false,
+      data: null,
+      error: {
+        message: "Hosted Capsule container failed to start.",
+        hint: `Check Docker logs for ${lifecycle.container.name}, then retry \`sporades host start ${request.capsule.subname} --host ${request.host.alias}\`.`
+      }
+    };
+    if (options.write !== false) {
+      writeEnvelope(result);
+    }
+    return null;
+  }
+  const running = checkContainerRunning(lifecycle.container.name);
+  if (!running) {
+    await recordFailedStartAndUnavailableRoute(request, lifecycle, releaseId, "Hosted Capsule container did not stay running.");
+    const result = {
+      ok: false,
+      data: null,
+      error: {
+        message: "Hosted Capsule container did not stay running.",
+        hint: `Check Docker logs for ${lifecycle.container.name}; the route has been returned to the Hosted Capsule unavailable response.`
+      }
+    };
+    if (options.write !== false) {
+      writeEnvelope(result);
+    }
+    return null;
+  }
+  const publishedPort = inspectLoopbackPublishedPort(lifecycle.container.name, lifecycle.routes.running.port ?? 4e3);
+  if (!publishedPort) {
+    stopAndRemoveContainer(lifecycle.container.name);
+    await recordFailedStartAndUnavailableRoute(request, lifecycle, releaseId, "Docker did not report a loopback published port for Hosted Capsule.");
+    const result = {
+      ok: false,
+      data: null,
+      error: {
+        message: "Docker did not report a loopback published port for Hosted Capsule.",
+        hint: `Ensure Docker published container port 4000 on 127.0.0.1, then retry \`sporades host start ${request.capsule.subname} --host ${request.host.alias}\`.`
+      }
+    };
+    if (options.write !== false) {
+      writeEnvelope(result);
+    }
+    return null;
+  }
+  const runtimeProbe = await ensureRuntimeProbeCredential(request);
+  const runningRoute = loopbackRunningRoute({ ...lifecycle.routes.running, runtimeProbe }, publishedPort);
+  try {
+    await writeRunningRoute(lifecycle, runningRoute);
+  } catch (error) {
+    await recordReleaseFailure(request, releaseId, String(errorDetails(error).message ?? "Failed to apply Hosted Capsule route."));
+    throw error;
+  }
+  await recordReleaseStarted(request, releaseId);
+  const data = {
+    started: true,
+    restarted: false,
+    capsule: capsuleData(request, lifecycle),
+    release: { id: releaseId },
+    container: {
+      id: run.stdout.trim(),
+      name: lifecycle.container.name,
+      network: lifecycle.container.network,
+      image: lifecycle.container.image,
+      user: lifecycle.container.user,
+      labels: lifecycle.container.labels,
+      baseImage: lifecycle.container.baseImage,
+      running: true,
+      publishedPort
+    },
+    route: publicRouteData(runningRoute),
+    restartPolicy: restartPolicyStatus("hosted")
+  };
+  if (options.write !== false) {
+    writeEnvelope({ ok: true, data, error: null });
+  }
+  return data;
+}
+async function installSealedServerEnvPrivateKey(release) {
+  const privateKey = release.sealedServerEnv?.privateKey;
+  const privateKeyPath = release.sealedServerEnv?.privateKeyPath;
+  if (!release.sealedServerEnvIncluded || !privateKey || !privateKeyPath) {
+    return;
+  }
+  await mkdir(path4.dirname(privateKeyPath), { recursive: true });
+  await writeFile(privateKeyPath, privateKey, { mode: 384 });
+}
+function validateSealedServerEnvPrivateKeyPath(release, paths) {
+  if (!release.sealedServerEnvIncluded) {
+    return;
+  }
+  if (!release.sealedServerEnv?.privateKey && !release.sealedServerEnv?.privateKeyPath) {
+    return;
+  }
+  const privateKeyPath = release.sealedServerEnv?.privateKeyPath;
+  const expectedPrivateKeyPath = path4.join(paths.data, "sealed-server-env", "server-env.private.pem");
+  if (typeof privateKeyPath !== "string" || path4.resolve(privateKeyPath) !== path4.resolve(expectedPrivateKeyPath)) {
+    throw helperError(
+      "Invalid Sealed Server env private key path.",
+      "Update the Sporades CLI and retry `sporades host push`."
+    );
+  }
+}
+async function healthCapsule(request) {
+  writeEnvelope(await evaluateCapsuleHealth(request));
+}
+async function evaluateCapsuleHealth(request, options = {}) {
+  validateHealthRequest(request);
+  let health = normaliseHealth(request);
+  let record;
+  try {
+    record = await readRegistryRecordForCapsule(request, "health");
+  } catch (error) {
+    if (errorDetails(error).message === "Hosted Capsule is not registered.") {
+      return unregisteredHealthFailure(request, health);
+    }
+    throw error;
+  }
+  assertRegistryRecordMatchesRequest(request, record);
+  health = normaliseHealth(request, record);
+  if (record.status === "unregistered") {
+    return unregisteredHealthFailure(request, health);
+  }
+  if (!record.currentRelease?.id) {
+    return healthFailure(
+      request,
+      health,
+      "no-current-release",
+      "Hosted Capsule has no current release.",
+      `Run \`sporades host push --host ${request.host.alias} --subname ${request.capsule.subname}\`, then retry health.`
+    );
+  }
+  const running = checkContainerRunning(health.container.name);
+  if (!running) {
+    await routeRuntimeExhaustionToUnavailable(request, record, health);
+    return healthFailure(
+      request,
+      health,
+      "stopped-container",
+      "Hosted Capsule has no running container.",
+      `Run \`sporades host start ${request.capsule.subname} --host ${request.host.alias}\`, then retry health.`
+    );
+  }
+  const runtimeProbe = readRuntimeProbeCredential(record);
+  if (!runtimeProbe) {
+    return healthFailure(
+      request,
+      health,
+      "route-failure",
+      "Hosted Capsule runtime probe is not configured.",
+      `Restart the Hosted Capsule with \`sporades host restart ${request.capsule.subname} --host ${request.host.alias}\`, then retry health.`
+    );
+  }
+  let response;
+  try {
+    response = await fetch(health.runtimeHealthUrl, {
+      headers: {
+        accept: "application/json",
+        [runtimeProbe.header]: runtimeProbe.token
+      },
+      signal: AbortSignal.timeout(options.timeoutMs ?? 1e4)
+    });
+  } catch {
+    return healthFailure(
+      request,
+      health,
+      "route-failure",
+      "Hosted Capsule route did not respond to runtime health.",
+      "Check DNS, Caddy, and the Hosted Capsule route, then retry health."
+    );
+  }
+  if (!response.ok) {
+    return healthFailure(
+      request,
+      health,
+      "route-failure",
+      "Hosted Capsule route returned an HTTP failure for runtime health.",
+      "Check Caddy routing and Hosted Capsule logs, then retry health.",
+      { statusCode: response.status }
+    );
+  }
+  let body;
+  try {
+    body = JSON.parse(await response.text());
+  } catch {
+    return healthFailure(
+      request,
+      health,
+      "runtime-failure",
+      "Hosted Capsule runtime health returned invalid JSON.",
+      "Check Hosted Capsule logs, then retry health."
+    );
+  }
+  const runtime = normaliseRuntimeHealthBody(body);
+  if (!runtime.valid) {
+    return healthFailure(
+      request,
+      health,
+      "runtime-failure",
+      "Hosted Capsule runtime health had an unexpected shape.",
+      "Update the Hosted Capsule release and retry health."
+    );
+  }
+  if (!runtime.checks.sqlite.ok) {
+    return healthFailure(
+      request,
+      health,
+      "sqlite-failure",
+      "Hosted Capsule SQLite health check failed.",
+      "Check the Hosted Capsule data volume and runtime logs, then retry health.",
+      { runtime: runtime.safe }
+    );
+  }
+  if (!runtime.checks.fileStorage.ok) {
+    return healthFailure(
+      request,
+      health,
+      "file-storage-failure",
+      "Hosted Capsule file storage health check failed.",
+      "Check the Hosted Capsule data volume permissions, then retry health.",
+      { runtime: runtime.safe }
+    );
+  }
+  if (!body.ok || !runtime.ready) {
+    return healthFailure(
+      request,
+      health,
+      "runtime-failure",
+      "Hosted Capsule runtime is not ready.",
+      "Check Hosted Capsule logs, then retry health.",
+      { runtime: runtime.safe }
+    );
+  }
+  return {
+    ok: true,
+    data: {
+      capsule: {
+        subname: request.capsule.subname,
+        domain: request.host.domain,
+        hostedUrl: health.hostedUrl,
+        remoteCapsuleId: health.remoteCapsuleId,
+        registered: true
+      },
+      release: { id: record.currentRelease.id, current: true },
+      container: { name: health.container.name, running: true },
+      route: { url: health.runtimeHealthUrl, responding: true },
+      runtime: runtime.safe
+    },
+    error: null
+  };
+}
+async function routeRuntimeExhaustionToUnavailable(request, record, health) {
+  const inspected = inspectContainerLifecycle(health.container.name);
+  const policy = restartPolicyForMode("hosted");
+  if (!Number.isFinite(inspected.restartCount) || inspected.restartCount < policy.maxAttempts) {
+    return;
+  }
+  const releaseId = record.currentRelease?.id;
+  if (!releaseId) {
+    return;
+  }
+  try {
+    await writeUnavailableRoute(normaliseLifecycle(request, record));
+    await recordReleaseFailure(
+      request,
+      releaseId,
+      `Hosted Capsule runtime exhausted ${policy.dockerRestart} restart policy.`
+    );
+  } catch {
+  }
+}
+async function stopCapsule(request, options = {}) {
+  validateLifecycleRequest(request);
+  await verifyRegisteredCapsule(request, "lifecycle");
+  const lifecycle = normaliseLifecycle(request);
+  stopAndRemoveContainer(lifecycle.container.name);
+  await writeUnavailableRoute(lifecycle);
+  await updateRegistryStatus(request, "stopped");
+  const data = {
+    stopped: true,
+    capsule: capsuleData(request, lifecycle),
+    container: { name: lifecycle.container.name, running: false },
+    route: lifecycle.routes.unavailable
+  };
+  if (options.write !== false) {
+    writeEnvelope({ ok: true, data, error: null });
+  }
+  return data;
+}
+async function restartCapsule(request, options = {}) {
+  validateLifecycleRequest(request);
+  const lifecycle = normaliseLifecycle(request);
+  stopAndRemoveContainer(lifecycle.container.name);
+  const startResult = await startCapsule(request, { write: false });
+  if (!startResult) {
+    if (options.write !== false) {
+      writeEnvelope({
+        ok: false,
+        data: null,
+        error: {
+          message: "Hosted Capsule restart failed.",
+          hint: `Check Docker logs for ${lifecycle.container.name}; the route has been returned to the Hosted Capsule unavailable response.`
+        }
+      });
+    }
+    return null;
+  }
+  const data = { ...startResult, restarted: true };
+  if (options.write !== false) {
+    writeEnvelope({ ok: true, data, error: null });
+  }
+  return data;
+}
+async function statsCapsule(request) {
+  validateStatsRequest(request);
+  const registryRecord = await verifyRegisteredCapsule(request, "stats");
+  const stats = normaliseStats(request);
+  const runningState = inspectContainerRunning(stats.container.name);
+  if (!runningState.ok) {
+    throw helperError(
+      "Failed to read Hosted Capsule Docker stats.",
+      `Check Docker on the Host server and retry \`sporades host stats ${request.capsule.subname} --host ${request.host.alias}\`.`
+    );
+  }
+  if (!runningState.running) {
+    throw helperError(
+      "Hosted Capsule has no running container.",
+      `Run \`sporades host start ${request.capsule.subname} --host ${request.host.alias}\`, then retry stats.`
+    );
+  }
+  const result = runDocker(["stats", "--no-stream", "--format", "json", stats.container.name]);
+  if (!result.ok) {
+    throw helperError(
+      "Failed to read Hosted Capsule Docker stats.",
+      `Check Docker on the Host server and retry \`sporades host stats ${request.capsule.subname} --host ${request.host.alias}\`.`
+    );
+  }
+  let raw;
+  try {
+    raw = JSON.parse(result.stdout);
+  } catch {
+    throw helperError(
+      "Hosted Capsule Docker stats were not valid JSON.",
+      "Update Docker or reinstall the Sporades Host helper on the Host server."
+    );
+  }
+  const data = {
+    capsule: {
+      subname: request.capsule.subname,
+      domain: request.host.domain,
+      hostedUrl: stats.hostedUrl,
+      remoteCapsuleId: stats.remoteCapsuleId
+    },
+    container: {
+      name: stats.container.name,
+      running: true
+    },
+    stats: normaliseDockerStats(raw),
+    lifecycle: readCapsuleLifecycle(request, registryRecord, stats.container.name, true),
+    raw
+  };
+  writeEnvelope({ ok: true, data, error: null });
+}
+async function listReleases(request) {
+  validateReleaseListRequest(request);
+  const record = await readRegistryRecordForCapsule(request, "releases");
+  assertRegistryRecordMatchesRequest(request, record);
+  const releases = normaliseReleaseHistory(record).map((release) => markCurrentReleaseEntry(release, record.currentRelease?.id ?? null)).sort(compareReleasesNewestFirst);
+  writeEnvelope({
+    ok: true,
+    data: {
+      capsule: {
+        subname: record.subname,
+        domain: record.domain,
+        hostedUrl: record.hostedUrl ?? `${request.host.scheme ?? "https"}://${record.subname}.${request.host.domain}`,
+        remoteCapsuleId: record.remoteCapsuleId ?? `${request.host.domain}/${record.subname}`
+      },
+      currentRelease: publicCurrentRelease(record),
+      releases
+    },
+    error: null
+  });
+}
+async function rollbackRelease(request) {
+  validateRollbackRequest(request);
+  const record = await readRegistryRecordForCapsule(request, "rollback");
+  assertRegistryRecordMatchesRequest(request, record);
+  if (record.status === "unregistered") {
+    throw helperError(
+      "Hosted Capsule is unregistered.",
+      `Run \`sporades host register ${request.capsule.subname} --host ${request.host.alias}\` before retrying this command.`
+    );
+  }
+  const releases = normaliseReleaseHistory(record);
+  if (releases.length === 0) {
+    throw helperError(
+      "Hosted Capsule has no release history.",
+      `Push a release before running \`sporades host rollback ${request.capsule.subname} <release-id> --host ${request.host.alias}\`.`
+    );
+  }
+  const releaseId = request.rollback?.releaseId;
+  if (!releaseId) {
+    throw helperError("Invalid Hosted Capsule rollback request.", "Update the Sporades CLI and retry `sporades host rollback`.");
+  }
+  const selectedRelease = releases.find((release) => release.id === releaseId);
+  if (!selectedRelease) {
+    throw helperError(
+      "Hosted Capsule release is not recorded.",
+      `Run \`sporades host releases ${request.capsule.subname} --host ${request.host.alias} --json\` and choose a recorded release ID.`
+    );
+  }
+  const paths = canonicalRollbackPaths(request, releaseId);
+  await assertRollbackReleaseFiles(request, paths.release);
+  const previousCurrentRelease = record.currentRelease ?? null;
+  const tempCurrentLink = `${paths.currentLink}.tmp-${process.pid}`;
+  await rm2(tempCurrentLink, { force: true });
+  await symlink(paths.release, tempCurrentLink);
+  await rename(tempCurrentLink, paths.currentLink);
+  await recordReleaseRollbackSelected(request, releaseId);
+  let lifecycle = null;
+  let restartError = null;
+  try {
+    lifecycle = await restartCapsule(request, { write: false });
+  } catch (error) {
+    restartError = error;
+  }
+  const data = {
+    rolledBack: Boolean(lifecycle),
+    capsule: {
+      subname: request.capsule.subname,
+      domain: request.host.domain,
+      hostedUrl: selectedRelease.source.hostedUrl ?? `${request.host.scheme ?? "https"}://${request.capsule.subname}.${request.host.domain}`,
+      remoteCapsuleId: selectedRelease.source.remoteCapsuleId ?? `${request.host.domain}/${request.capsule.subname}`
+    },
+    previousCurrentRelease,
+    currentRelease: { ...record.currentRelease ?? {}, id: releaseId }
+  };
+  if (lifecycle) {
+    data.lifecycle = lifecycle;
+    writeEnvelope({ ok: true, data, error: null });
+    return;
+  }
+  try {
+    await writeUnavailableRoute(normaliseLifecycle(request));
+  } catch (error) {
+    restartError = restartError ?? error;
+  }
+  data.rolledBack = false;
+  writeEnvelope({
+    ok: false,
+    data,
+    error: {
+      message: errorDetails(restartError).message ?? "Hosted Capsule rollback start failed.",
+      hint: errorDetails(restartError).hint ?? `Previous current release was ${previousCurrentRelease?.id ?? "none"}. Check Docker logs for ${normaliseLifecycle(request).container.name}; the route has been returned to the Hosted Capsule unavailable response.`
+    }
+  });
+}
+async function statsHost(request) {
+  validateHostStatsRequest(request);
+  const records = await readCapsuleRegistryRecords(request);
+  const dockerAvailable = checkDockerAvailable();
+  const caddyAvailable = checkCaddyAvailable();
+  const dockerStates = dockerAvailable ? records.map((record) => lookupCapsuleDockerState(request, record)) : [];
+  const data = {
+    host: {
+      alias: request.host.alias,
+      domain: request.host.domain,
+      scheme: request.host.scheme ?? "https",
+      remoteRoot: request.host.remoteRoot
+    },
+    resources: {
+      disk: await readHostDiskStats(request.host.remoteRoot),
+      memory: readHostMemoryStats(),
+      load: readHostLoadStats()
+    },
+    services: {
+      docker: { available: dockerAvailable },
+      caddy: { available: caddyAvailable }
+    },
+    capsules: countHostedCapsules(records, dockerStates)
+  };
+  writeEnvelope({ ok: true, data, error: null });
+}
+async function logsHost(request) {
+  validateHostLogsRequest(request, hostHelperConfig.logs);
+  const logs = normaliseHostLogs(request);
+  if (logs.source === "stdout" || logs.source === "stderr") {
+    const container = logs.container;
+    if (!container) {
+      throw helperError("Hosted Capsule log target is missing.", "Pass a Hosted Capsule subname when reading stdout or stderr logs.");
+    }
+    const entries = readDockerStreamLogs(logs);
+    writeEnvelope({ ok: true, data: { lineCount: logs.lines, source: logs.source, container: container.name, entries }, error: null });
+    return;
+  }
+  const fileEntries = await readManagedCaddyAccessLog(logs);
+  if (fileEntries) {
+    writeEnvelope({ ok: true, data: { lineCount: logs.lines, source: "http", entries: fileEntries }, error: null });
+    return;
+  }
+  if (logs.capsuleScoped) {
+    throw unavailableCapsuleHttpLogsError(logs);
+  }
+  const journalEntries = readCaddyJournalLogs(logs);
+  if (journalEntries) {
+    writeEnvelope({ ok: true, data: { lineCount: logs.lines, source: "http", entries: journalEntries }, error: null });
+    return;
+  }
+  throw unavailableCaddyLogsError(request);
+}
+async function listCapsules(request) {
+  validateListRequest(request);
+  const records = await readCapsuleRegistryRecords(request);
+  const capsules = [];
+  for (const record of records) {
+    if (record.status === "unregistered") {
+      continue;
+    }
+    const capsule = {
+      subname: record.subname,
+      domain: record.domain,
+      hostedUrl: record.hostedUrl ?? `${request.host.scheme ?? "https"}://${record.subname}.${request.host.domain}`,
+      registry: {
+        remoteCapsuleId: record.remoteCapsuleId ?? `${request.host.domain}/${record.subname}`,
+        createdAt: record.createdAt ?? null,
+        updatedAt: record.updatedAt ?? null,
+        status: record.status ?? "registered",
+        ...record.sealedServerEnv ? { sealedServerEnv: publicRegistrySealedServerEnv(record.sealedServerEnv) } : {}
+      },
+      currentRelease: publicCurrentRelease(record),
+      docker: lookupCapsuleDockerState(request, record)
+    };
+    const sealedServerEnv = await inspectHostSealedEnvKey(record, request.host.remoteRoot);
+    if (sealedServerEnv) {
+      capsule.sealedServerEnv = sealedServerEnv;
+    }
+    capsule.baseImage = normaliseRecordBaseImage(record, capsule.docker);
+    capsules.push(capsule);
+  }
+  writeEnvelope({
+    ok: true,
+    data: {
+      host: {
+        alias: request.host.alias,
+        domain: request.host.domain,
+        scheme: request.host.scheme ?? "https",
+        remoteRoot: request.host.remoteRoot
+      },
+      capsules
+    },
+    error: null
+  });
+}
+function createUnregisterResult(request, unregister, record, idempotent, route = null) {
+  return {
+    unregistered: true,
+    idempotent,
+    capsule: {
+      subname: request.capsule.subname,
+      domain: request.host.domain,
+      hostedUrl: unregister.hostedUrl,
+      remoteCapsuleId: unregister.remoteCapsuleId
+    },
+    registryRecord: unregister.registryRecord,
+    directories: unregister.directories,
+    preserved: {
+      releases: record.currentRelease?.id ? path4.join(unregister.directories.releases, record.currentRelease.id) : unregister.directories.releases,
+      data: unregister.directories.data
+    },
+    deleteAfter: record.deleteAfter ?? null,
+    container: { name: unregister.container.name, running: false, removed: true },
+    route: route ?? { ...unregister.route, removed: true }
+  };
+}
+function createDeleteResult(request, deletion, removals) {
+  const capsuleRemoved = removals.capsuleDirectory.removed;
+  return {
+    deleted: true,
+    idempotent: removals.idempotent,
+    capsule: {
+      subname: request.capsule.subname,
+      domain: request.host.domain,
+      hostedUrl: deletion.hostedUrl,
+      remoteCapsuleId: deletion.remoteCapsuleId
+    },
+    registryRecord: {
+      path: deletion.registryRecord,
+      removed: removals.registryRecord.removed,
+      alreadyAbsent: !removals.registryRecord.removed
+    },
+    directories: {
+      capsule: {
+        path: deletion.directories.capsule,
+        removed: capsuleRemoved,
+        alreadyAbsent: !capsuleRemoved
+      },
+      releases: {
+        path: deletion.directories.releases,
+        removed: capsuleRemoved,
+        alreadyAbsent: !capsuleRemoved
+      },
+      data: {
+        path: deletion.directories.data,
+        removed: capsuleRemoved,
+        alreadyAbsent: !capsuleRemoved
+      }
+    },
+    route: {
+      path: deletion.route.routeFile,
+      removed: removals.route.removed,
+      alreadyAbsent: !removals.route.removed
+    }
+  };
+}
+function canonicalReleasePaths(request) {
+  const capsule = path4.join(
+    request.host.remoteRoot,
+    "hosts",
+    request.host.domain,
+    "capsules",
+    request.capsule.subname
+  );
+  const releases = path4.join(capsule, "releases");
+  return {
+    capsule,
+    releases,
+    release: request.release?.id ? path4.join(releases, request.release.id) : null,
+    data: path4.join(capsule, "data"),
+    logs: path4.join(capsule, "logs"),
+    currentLink: path4.join(capsule, "current")
+  };
+}
+function canonicalRollbackPaths(request, releaseId) {
+  const paths = canonicalReleasePaths({ ...request, release: { id: releaseId, remoteArchive: "", files: [] } });
+  return {
+    ...paths,
+    release: path4.join(paths.releases, releaseId)
+  };
+}
+function normaliseLifecycle(request, registryRecord = null) {
+  const provided = request.lifecycle ?? {};
+  const paths = canonicalReleasePaths(request);
+  const subname = request.capsule.subname;
+  const domain = request.host.domain;
+  const hostedUrl = typeof provided.hostedUrl === "string" ? provided.hostedUrl : request.release?.hostedUrl ?? `${request.host.scheme ?? "https"}://${subname}.${domain}`;
+  const remoteCapsuleId = typeof provided.remoteCapsuleId === "string" ? provided.remoteCapsuleId : `${domain}/${subname}`;
+  const containerName = provided.container?.name ?? createHostedContainerName(domain, subname);
+  const routeFile = provided.routes?.running?.routeFile ?? path4.join(request.host.remoteRoot, "caddy", "hosts", domain, `${subname}.caddy`);
+  const currentLink = typeof provided.currentLink === "string" ? provided.currentLink : paths.currentLink;
+  const routeAccessLog = provided.routes;
+  const accessLog = routeAccessLog?.accessLog ?? provided.accessLog ?? defaultCapsuleHttpLogPath(request.host.remoteRoot, domain, subname);
+  const sealedServerEnvPrivateKey = releaseSealedServerEnvPrivateKeyMount(registryRecord, paths);
+  const authoritativeBaseImage = request.release?.baseImage ?? registryRecord?.baseImage ?? null;
+  const updatePolicyMode = normaliseBaseImageUpdatePolicy(
+    authoritativeBaseImage?.updatePolicy ?? provided.container?.baseImage?.updatePolicy
+  );
+  const baseImage = {
+    ...baseImageMetadata(updatePolicyMode),
+    name: authoritativeBaseImage?.name ?? provided.container?.baseImage?.name ?? SPORADES_BASE_IMAGE.name,
+    image: authoritativeBaseImage?.image ?? provided.container?.baseImage?.image ?? provided.container?.image ?? hostHelperConfig.hostedCapsule.dockerImage,
+    version: authoritativeBaseImage?.version ?? provided.container?.baseImage?.version ?? SPORADES_BASE_IMAGE.version
+  };
+  const defaultMounts = {
+    files: [
+      { host: path4.join(currentLink, "server.mjs"), container: "/app/server.mjs", mode: "ro" },
+      { host: path4.join(currentLink, "client.js"), container: "/app/client.js", mode: "ro" },
+      { host: path4.join(currentLink, "index.html"), container: "/app/index.html", mode: "ro" },
+      { host: path4.join(currentLink, "sporades.json"), container: "/app/sporades.json", mode: "ro" },
+      { host: path4.join(currentLink, ".env.sporades.server"), container: "/app/.env.sporades.server", mode: "ro", optional: true },
+      {
+        host: path4.join(currentLink, ".sporades", "sealed-server-env", "server-env.sealed.json"),
+        container: "/app/.sporades/sealed-server-env/server-env.sealed.json",
+        mode: "ro",
+        optional: true
+      },
+      {
+        host: sealedServerEnvPrivateKey.host,
+        container: "/app/.sporades/sealed-server-env/server-env.private.pem",
+        mode: "ro",
+        optional: !sealedServerEnvPrivateKey.fingerprint,
+        fingerprint: sealedServerEnvPrivateKey.fingerprint
+      }
+    ],
+    data: { host: paths.data, container: "/app/data", mode: "rw" }
+  };
+  const fileMounts = authoritativeSealedServerEnvPrivateKeyMount(
+    provided.mounts?.files ?? defaultMounts.files,
+    sealedServerEnvPrivateKey
+  );
+  return {
+    subname,
+    domain,
+    hostedUrl,
+    remoteCapsuleId,
+    currentLink,
+    directories: {
+      capsule: paths.capsule,
+      releases: paths.releases,
+      data: paths.data,
+      logs: paths.logs
+    },
+    remoteRoot: request.host.remoteRoot,
+    mounts: {
+      ...provided.mounts,
+      files: fileMounts,
+      data: provided.mounts?.data ?? defaultMounts.data
+    },
+    container: {
+      name: containerName,
+      network: provided.container?.network ?? hostHelperConfig.hostedCapsule.dockerNetwork,
+      image: provided.container?.image ?? baseImage.image,
+      user: provided.container?.user ?? baseImageRuntimeUser(),
+      baseImage,
+      graceCheckMs: provided.container?.graceCheckMs ?? hostHelperConfig.hostedCapsule.graceCheckMs,
+      labels: {
+        ...provided.container?.labels ?? {},
+        "com.sporades.managed": "true",
+        "com.sporades.hosted-domain": domain,
+        "com.sporades.capsule-subname": subname,
+        "com.sporades.capsule-id": remoteCapsuleId,
+        ...baseImageLabels(updatePolicyMode)
+      }
+    },
+    routes: {
+      running: withRouteAccessLog(
+        provided.routes?.running ?? {
+          hostname: `${subname}.${domain}`,
+          target: "container",
+          containerName,
+          port: 4e3,
+          routeFile
+        },
+        accessLog
+      ),
+      unavailable: withRouteAccessLog(
+        provided.routes?.unavailable ?? {
+          hostname: `${subname}.${domain}`,
+          target: "hosted-capsule-unavailable",
+          statusCode: 503,
+          routeFile
+        },
+        accessLog
+      )
+    }
+  };
+}
+function authoritativeSealedServerEnvPrivateKeyMount(fileMounts, sealedServerEnvPrivateKey) {
+  const privateKeyContainerPath = "/app/.sporades/sealed-server-env/server-env.private.pem";
+  let replaced = false;
+  const next = fileMounts.map((mount) => {
+    if (mount.container !== privateKeyContainerPath) {
+      return mount;
+    }
+    replaced = true;
+    return {
+      ...mount,
+      host: sealedServerEnvPrivateKey.host,
+      mode: mount.mode ?? "ro",
+      optional: !sealedServerEnvPrivateKey.fingerprint,
+      fingerprint: sealedServerEnvPrivateKey.fingerprint
+    };
+  });
+  if (!replaced && sealedServerEnvPrivateKey.fingerprint) {
+    next.push({
+      host: sealedServerEnvPrivateKey.host,
+      container: privateKeyContainerPath,
+      mode: "ro",
+      optional: false,
+      fingerprint: sealedServerEnvPrivateKey.fingerprint
+    });
+  }
+  return next;
+}
+function withRouteAccessLog(route, accessLog) {
+  if (route.log === null) {
+    return route;
+  }
+  return {
+    ...route,
+    log: route.log ?? { file: accessLog }
+  };
+}
+function normaliseStats(request) {
+  const provided = request.stats ?? {};
+  const subname = request.capsule.subname;
+  const domain = request.host.domain;
+  const hostedUrl = provided.hostedUrl ?? `${request.host.scheme ?? "https"}://${subname}.${domain}`;
+  const remoteCapsuleId = provided.remoteCapsuleId ?? `${domain}/${subname}`;
+  return {
+    hostedUrl,
+    remoteCapsuleId,
+    container: {
+      name: provided.container?.name ?? createHostedContainerName(domain, subname)
+    }
+  };
+}
+function normaliseHealth(request, record = null) {
+  const provided = request.health ?? {};
+  const subname = request.capsule.subname;
+  const domain = request.host.domain;
+  const hostedUrl = record?.hostedUrl ?? `${request.host.scheme ?? "https"}://${subname}.${domain}`;
+  const remoteCapsuleId = record?.remoteCapsuleId ?? `${domain}/${subname}`;
+  return {
+    hostedUrl,
+    remoteCapsuleId,
+    runtimeHealthUrl: `${hostedUrl}${CAPSULE_RUNTIME_HEALTH_PATH}`,
+    container: {
+      name: provided.container?.name ?? createHostedContainerName(domain, subname)
+    }
+  };
+}
+async function ensureRuntimeProbeCredential(request) {
+  let probe = null;
+  await mutateRegistryRecord(request, (record) => {
+    probe = readRuntimeProbeCredential(record) ?? {
+      header: RUNTIME_PROBE_HEADER,
+      token: randomBytes(32).toString("hex"),
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    return { ...record, runtimeProbe: probe };
+  });
+  return probe;
+}
+function readRuntimeProbeCredential(record) {
+  const header = record?.runtimeProbe?.header;
+  const token = record?.runtimeProbe?.token;
+  if (header !== RUNTIME_PROBE_HEADER || typeof token !== "string" || token.length === 0) {
+    return null;
+  }
+  return { header, token };
+}
+function normaliseRuntimeHealthBody(body) {
+  const checks = body?.data?.checks;
+  const sqlite = checks?.sqlite;
+  const fileStorage = checks?.fileStorage;
+  const ready = body?.data?.runtime?.ready;
+  const valid = typeof body?.ok === "boolean" && typeof ready === "boolean" && typeof sqlite?.ok === "boolean" && typeof fileStorage?.ok === "boolean";
+  const safe = {
+    ready: ready === true,
+    checks: {
+      sqlite: { ok: sqlite?.ok === true },
+      fileStorage: { ok: fileStorage?.ok === true }
+    }
+  };
+  return { valid, ready: ready === true, checks: safe.checks, safe };
+}
+function healthFailure(request, health, failure, message, hint, extra = {}) {
+  return {
+    ok: false,
+    data: {
+      capsule: {
+        subname: request.capsule.subname,
+        domain: request.host.domain,
+        hostedUrl: health.hostedUrl,
+        remoteCapsuleId: health.remoteCapsuleId
+      },
+      route: { url: health.runtimeHealthUrl },
+      container: { name: health.container.name },
+      failure,
+      ...extra
+    },
+    error: { message, hint }
+  };
+}
+function unregisteredHealthFailure(request, health) {
+  return healthFailure(
+    request,
+    health,
+    "unregistered-capsule",
+    "Hosted Capsule is not registered.",
+    `Run \`sporades host register ${request.capsule.subname} --host ${request.host.alias}\` before checking runtime health.`
+  );
+}
+function publicRouteData(route) {
+  const { runtimeProbe, ...safeRoute } = route;
+  return safeRoute;
+}
+async function readHostDiskStats(targetPath) {
+  let stats;
+  try {
+    stats = await statfs(targetPath);
+  } catch {
+    throw helperError(
+      "Failed to read Host server disk stats.",
+      `Check that ${targetPath} exists and is readable by the Host helper, then retry \`sporades host stats --host <alias>\`.`
+    );
+  }
+  const blockSize = Number(stats.bsize);
+  const totalBytes = Number(stats.blocks) * blockSize;
+  const freeBytes = Number(stats.bfree) * blockSize;
+  const availableBytes = Number(stats.bavail) * blockSize;
+  const usedBytes = Math.max(0, totalBytes - freeBytes);
+  return {
+    path: targetPath,
+    totalBytes,
+    usedBytes,
+    availableBytes,
+    usedPercent: percentage(usedBytes, totalBytes)
+  };
+}
+function readHostMemoryStats() {
+  const totalBytes = totalmem();
+  const availableBytes = freemem();
+  const usedBytes = Math.max(0, totalBytes - availableBytes);
+  return {
+    totalBytes,
+    usedBytes,
+    availableBytes,
+    usedPercent: percentage(usedBytes, totalBytes)
+  };
+}
+function readHostLoadStats() {
+  const [oneMinute, fiveMinutes, fifteenMinutes] = loadavg();
+  return { oneMinute, fiveMinutes, fifteenMinutes };
+}
+function checkDockerAvailable() {
+  return runDocker(["version", "--format", "{{.Server.Version}}"]).ok;
+}
+function checkCaddyAvailable() {
+  const result = spawnSync2("caddy", ["version"], { encoding: "utf8" });
+  return !result.error && result.status === 0;
+}
+function countHostedCapsules(records, dockerStates) {
+  let running = 0;
+  let stopped = 0;
+  for (let index = 0; index < records.length; index += 1) {
+    const docker = dockerStates[index] ?? null;
+    if (docker?.running === true) {
+      running += 1;
+      continue;
+    }
+    if (docker?.running === false || records[index].status === "stopped") {
+      stopped += 1;
+    }
+  }
+  return {
+    total: records.length,
+    registered: records.filter((record) => (record.status ?? "registered") === "registered").length,
+    running,
+    stopped,
+    unavailable: records.length - running
+  };
+}
+function readCapsuleLifecycle(_request, registryRecord, containerName, running) {
+  const inspected = inspectContainerLifecycle(containerName);
+  return {
+    registered: true,
+    registryStatus: registryRecord.status ?? "registered",
+    running,
+    startedAt: inspected.startedAt,
+    uptimeSeconds: inspected.uptimeSeconds,
+    restartCount: inspected.restartCount,
+    currentReleaseId: registryRecord.currentRelease?.id ?? null,
+    routeTarget: registryRecord.route?.target ?? (running ? "container" : "hosted-capsule-unavailable")
+  };
+}
+function inspectContainerLifecycle(containerName) {
+  const result = runDocker(["inspect", "--format", "{{json .}}", containerName]);
+  if (!result.ok) {
+    return { startedAt: null, uptimeSeconds: null, restartCount: null };
+  }
+  let raw;
+  try {
+    raw = JSON.parse(result.stdout);
+  } catch {
+    return { startedAt: null, uptimeSeconds: null, restartCount: null };
+  }
+  const startedAt = typeof raw.State?.StartedAt === "string" && raw.State.StartedAt !== "0001-01-01T00:00:00Z" ? raw.State.StartedAt : null;
+  return {
+    startedAt,
+    uptimeSeconds: startedAt ? Math.max(0, Math.floor((Date.now() - Date.parse(startedAt)) / 1e3)) : null,
+    restartCount: Number.isFinite(raw.RestartCount) ? raw.RestartCount : null
+  };
+}
+async function readCapsuleRegistryRecords(request) {
+  const registryDirectory = path4.join(request.host.remoteRoot, "hosts", request.host.domain, "registry", "capsules");
+  let entries;
+  try {
+    entries = await readdir2(registryDirectory, { withFileTypes: true });
+  } catch (error) {
+    if (errorDetails(error).code === "ENOENT") {
+      return [];
+    }
+    throw error;
+  }
+  const records = [];
+  const files = entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name).sort();
+  for (const file of files) {
+    const recordPath = path4.join(registryDirectory, file);
+    let record;
+    try {
+      record = JSON.parse(await readFile2(recordPath, "utf8"));
+    } catch (error) {
+      if (error instanceof SyntaxError) {
+        throw helperError(
+          "Hosted Capsule registry record is invalid.",
+          `Repair the Host server registry record at ${recordPath}, then retry \`${hostRegistryRetryCommand(request)}\`.`
+        );
+      }
+      throw error;
+    }
+    validateListRegistryRecord(request, record, recordPath);
+    records.push(record);
+  }
+  return records;
+}
+function lookupCapsuleDockerState(request, record) {
+  const subname = record.subname;
+  const containerName = createHostedContainerName(request.host.domain, subname);
+  const result = runDocker([
+    "ps",
+    "-a",
+    "--filter",
+    "label=com.sporades.managed=true",
+    "--filter",
+    `label=com.sporades.hosted-domain=${request.host.domain}`,
+    "--filter",
+    `label=com.sporades.capsule-subname=${subname}`,
+    "--format",
+    "json"
+  ]);
+  if (!result.ok) {
+    return null;
+  }
+  const containers = parseDockerPsJsonLines(result.stdout);
+  const remoteCapsuleId = record.remoteCapsuleId ?? `${request.host.domain}/${subname}`;
+  const match = containers.find((container) => dockerPsContainerMatches(container, containerName, remoteCapsuleId, subname));
+  return match ? normaliseDockerPsContainer(match, containerName) : null;
+}
+function parseDockerPsJsonLines(output) {
+  return String(output ?? "").split("\n").map((line) => line.trim()).filter(Boolean).map((line) => {
+    try {
+      return JSON.parse(line);
+    } catch {
+      return null;
+    }
+  }).filter(Boolean);
+}
+function dockerPsContainerMatches(container, containerName, remoteCapsuleId, subname) {
+  const names = String(container.Names ?? container.Name ?? "");
+  const labels = parseDockerLabels(container.Labels);
+  return names.split(",").map((name) => name.trim()).includes(containerName) || labels["com.sporades.capsule-id"] === remoteCapsuleId || labels["com.sporades.capsule-subname"] === subname;
+}
+function parseDockerLabels(value) {
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    return Object.fromEntries(Object.entries(value).map(([key, labelValue]) => [key, String(labelValue)]));
+  }
+  const labels = {};
+  for (const label of String(value ?? "").split(",")) {
+    const [key, ...rest] = label.split("=");
+    if (key && rest.length > 0) {
+      labels[key.trim()] = rest.join("=").trim();
+    }
+  }
+  return labels;
+}
+function normaliseDockerPsContainer(container, fallbackContainerName) {
+  const state = String(container.State ?? container.state ?? "").toLowerCase();
+  const containerName = String(container.Names ?? container.Name ?? fallbackContainerName).split(",")[0].trim();
+  const status = String(container.Status ?? container.status ?? "");
+  const labels = parseDockerLabels(container.Labels);
+  const normalised = {
+    containerId: String(container.ID ?? container.Id ?? container.id ?? ""),
+    containerName,
+    image: String(container.Image ?? container.image ?? ""),
+    state: state || "unknown",
+    status,
+    running: state === "running"
+  };
+  const baseImage = normaliseDockerBaseImage(labels);
+  if (baseImage) {
+    normalised.baseImage = baseImage;
+  }
+  return normalised;
+}
+function normaliseDockerBaseImage(labels) {
+  if (!labels["com.sporades.base-image.name"] && !labels["com.sporades.base-image.version"]) {
+    return null;
+  }
+  return {
+    name: labels["com.sporades.base-image.name"] ?? SPORADES_BASE_IMAGE.name,
+    version: labels["com.sporades.base-image.version"] ?? "unknown",
+    updatePolicy: {
+      mode: normaliseBaseImageUpdatePolicy(labels["com.sporades.base-image.update-policy"])
+    }
+  };
+}
+function normaliseRecordBaseImage(record, docker = null) {
+  const provided = record.baseImage ?? {};
+  const dockerBaseImage = docker?.baseImage ?? null;
+  const hasKnownBaseImage = Boolean(record.baseImage || dockerBaseImage);
+  const mode = normaliseBaseImageUpdatePolicy(provided.updatePolicy ?? dockerBaseImage?.updatePolicy);
+  const metadata = baseImageMetadata(mode);
+  if (!hasKnownBaseImage) {
+    return {
+      ...metadata,
+      name: "unknown",
+      image: docker?.image ?? "unknown",
+      version: "unknown"
+    };
+  }
+  return {
+    ...metadata,
+    image: provided.image ?? docker?.image ?? SPORADES_BASE_IMAGE.image,
+    name: provided.name ?? dockerBaseImage?.name ?? SPORADES_BASE_IMAGE.name,
+    version: provided.version ?? dockerBaseImage?.version ?? SPORADES_BASE_IMAGE.version
+  };
+}
+function normaliseProvidedBaseImage(value) {
+  const provided = value && typeof value === "object" && !Array.isArray(value) ? value : {};
+  const updatePolicy = provided.updatePolicy && typeof provided.updatePolicy === "object" && "mode" in provided.updatePolicy ? provided.updatePolicy.mode : provided.updatePolicy;
+  const mode = normaliseBaseImageUpdatePolicy(updatePolicy ?? "pinned");
+  return {
+    ...baseImageMetadata(mode),
+    image: provided.image ?? SPORADES_BASE_IMAGE.image,
+    name: provided.name ?? SPORADES_BASE_IMAGE.name,
+    version: provided.version ?? SPORADES_BASE_IMAGE.version
+  };
+}
+function normaliseRegistration(request) {
+  const subname = request.capsule.subname;
+  const domain = request.host.domain;
+  const remoteRoot = request.host.remoteRoot;
+  const scheme = request.host.scheme ?? "https";
+  const hostedUrl = `${scheme}://${subname}.${domain}`;
+  const remoteCapsuleId = `${domain}/${subname}`;
+  const capsuleDirectory = path4.join(remoteRoot, "hosts", domain, "capsules", subname);
+  const routeFile = path4.join(remoteRoot, "caddy", "hosts", domain, `${subname}.caddy`);
+  const routeTls = normaliseRegistrationTls(request);
+  const accessLog = request.registration?.route?.log?.file ?? defaultCapsuleHttpLogPath(remoteRoot, domain, subname);
+  const route = {
+    hostname: `${subname}.${domain}`,
+    target: "hosted-capsule-unavailable",
+    statusCode: 503,
+    routeFile,
+    tls: routeTls,
+    log: { file: accessLog }
+  };
+  return {
+    subname,
+    domain,
+    remoteRoot,
+    hostedUrl,
+    remoteCapsuleId,
+    registryRecord: path4.join(remoteRoot, "hosts", domain, "registry", "capsules", `${subname}.json`),
+    directories: {
+      capsule: capsuleDirectory,
+      releases: path4.join(capsuleDirectory, "releases"),
+      data: path4.join(capsuleDirectory, "data"),
+      logs: path4.join(capsuleDirectory, "logs")
+    },
+    baseImage: normaliseProvidedBaseImage(request.registration?.baseImage),
+    route,
+    lifecycle: {
+      remoteRoot,
+      routes: { unavailable: route }
+    }
+  };
+}
+function normaliseUnregister(request) {
+  const provided = request.unregister ?? {};
+  const subname = request.capsule.subname;
+  const domain = request.host.domain;
+  const remoteRoot = request.host.remoteRoot;
+  const scheme = request.host.scheme ?? "https";
+  const hostedUrl = `${scheme}://${subname}.${domain}`;
+  const remoteCapsuleId = `${domain}/${subname}`;
+  const capsuleDirectory = path4.join(remoteRoot, "hosts", domain, "capsules", subname);
+  const routeFile = path4.join(remoteRoot, "caddy", "hosts", domain, `${subname}.caddy`);
+  const containerName = createHostedContainerName(domain, subname);
+  return {
+    subname,
+    domain,
+    hostedUrl,
+    remoteCapsuleId,
+    registryRecord: path4.join(remoteRoot, "hosts", domain, "registry", "capsules", `${subname}.json`),
+    directories: {
+      capsule: capsuleDirectory,
+      releases: path4.join(capsuleDirectory, "releases"),
+      data: path4.join(capsuleDirectory, "data")
+    },
+    container: {
+      name: containerName
+    },
+    route: {
+      hostname: `${subname}.${domain}`,
+      target: "removed",
+      routeFile
+    },
+    lifecycle: {
+      remoteRoot
+    },
+    provided
+  };
+}
+function normaliseDeletion(request) {
+  const subname = request.capsule.subname;
+  const domain = request.host.domain;
+  const remoteRoot = request.host.remoteRoot;
+  const scheme = request.host.scheme ?? "https";
+  const capsuleDirectory = path4.join(remoteRoot, "hosts", domain, "capsules", subname);
+  return {
+    subname,
+    domain,
+    hostedUrl: `${scheme}://${subname}.${domain}`,
+    remoteCapsuleId: `${domain}/${subname}`,
+    registryRecord: path4.join(remoteRoot, "hosts", domain, "registry", "capsules", `${subname}.json`),
+    directories: {
+      capsule: capsuleDirectory,
+      releases: path4.join(capsuleDirectory, "releases"),
+      data: path4.join(capsuleDirectory, "data")
+    },
+    route: {
+      hostname: `${subname}.${domain}`,
+      routeFile: path4.join(remoteRoot, "caddy", "hosts", domain, `${subname}.caddy`)
+    },
+    lifecycle: {
+      remoteRoot
+    }
+  };
+}
+function normaliseRegistrationTls(request) {
+  const remoteRoot = request.host.remoteRoot;
+  const domain = request.host.domain;
+  const tlsMode = request.registration?.bootstrap?.tls?.mode ?? request.bootstrap?.tls?.mode ?? "automatic";
+  const tlsDirectory = path4.join(remoteRoot, "hosts", domain, "tls");
+  return {
+    mode: tlsMode,
+    directory: tlsDirectory,
+    certificate: tlsMode === "cloudflare-origin" ? path4.join(tlsDirectory, "origin.crt") : null,
+    key: tlsMode === "cloudflare-origin" ? path4.join(tlsDirectory, "origin.key") : null
+  };
+}
+async function ensureHostedDomainBootstrapped(request, registration) {
+  const caddyfile = path4.join(request.host.remoteRoot, "caddy", "Caddyfile");
+  const domainInclude = path4.join(request.host.remoteRoot, "caddy", "hosts", `${request.host.domain}.caddy`);
+  const bootstrapped = await pathExists(caddyfile) && await pathExists(domainInclude);
+  if (bootstrapped) {
+    return;
+  }
+  const tls = registration.route.tls;
+  const tlsHint = tls?.mode === "cloudflare-origin" ? ` after installing readable Cloudflare origin certificate and key files at ${tls.certificate} and ${tls.key}` : "";
+  throw helperError(
+    "Hosted domain has not been bootstrapped.",
+    `Run \`sporades host bootstrap --host ${request.host.alias}\`${tlsHint}.`
+  );
+}
+function createRegistrationRecord(registration, sealedServerEnv = null) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  return {
+    subname: registration.subname,
+    domain: registration.domain,
+    remoteCapsuleId: registration.remoteCapsuleId,
+    hostedUrl: registration.hostedUrl,
+    status: "registered",
+    createdAt: now,
+    updatedAt: now,
+    currentRelease: null,
+    baseImage: registration.baseImage,
+    ...sealedServerEnv ? { sealedServerEnv: { currentKeyFingerprint: sealedServerEnv.publicKeyFingerprint } } : {}
+  };
+}
+async function ensureHostSealedEnvKeyPair(registration, existingRecord = null) {
+  const existingFingerprint = existingRecord?.sealedServerEnv?.currentKeyFingerprint;
+  if (existingFingerprint) {
+    const existing = await readPublicHostSealedEnvKey(
+      {
+        subname: registration.subname,
+        domain: registration.domain,
+        sealedServerEnv: { currentKeyFingerprint: existingFingerprint }
+      },
+      registration.remoteRoot
+    );
+    if (existing) {
+      return existing;
+    }
+  }
+  return generateHostSealedEnvKeyPair(registration.directories.data);
+}
+async function generateHostSealedEnvKeyPair(dataDirectory) {
+  const { publicKey, privateKey } = generateKeyPairSync("rsa", {
+    modulusLength: 2048,
+    publicKeyEncoding: { type: "spki", format: "pem" },
+    privateKeyEncoding: { type: "pkcs8", format: "pem" }
+  });
+  const publicKeyFingerprint = fingerprintPublicKey(publicKey);
+  const paths = hostSealedEnvKeyPaths(dataDirectory, publicKeyFingerprint);
+  await mkdir(paths.root, { recursive: true, mode: 448 });
+  await chmod(paths.root, 448);
+  await mkdir(paths.keys, { recursive: true, mode: 448 });
+  await chmod(paths.keys, 448);
+  await writeFile(paths.privateKey, privateKey, { mode: 384 });
+  await chmod(paths.privateKey, 384);
+  await writeFile(paths.publicKey, publicKey, { mode: 420 });
+  await chmod(paths.publicKey, 420);
+  return {
+    publicKey,
+    publicKeyFingerprint,
+    publicKeyPath: paths.publicKey
+  };
+}
+async function cleanupUnreferencedHostSealedEnvKeys(dataDirectory, referencedFingerprints) {
+  const paths = hostSealedEnvKeyPaths(dataDirectory, "placeholder");
+  let entries;
+  try {
+    entries = await readdir2(paths.keys);
+  } catch (error) {
+    if (errorDetails(error).code === "ENOENT") {
+      return {
+        deletedKeyFingerprints: [],
+        retainedKeyFingerprints: [...referencedFingerprints].sort()
+      };
+    }
+    throw error;
+  }
+  const deleted = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    const match = /^([a-f0-9]{16})\.(private|public)\.pem$/.exec(entry);
+    if (!match) {
+      continue;
+    }
+    const fingerprint = match[1];
+    if (referencedFingerprints.has(fingerprint)) {
+      continue;
+    }
+    await rm2(path4.join(paths.keys, entry), { force: true });
+    deleted.add(fingerprint);
+  }
+  return {
+    deletedKeyFingerprints: [...deleted].sort(),
+    retainedKeyFingerprints: [...referencedFingerprints].sort()
+  };
+}
+function referencedSealedEnvKeyFingerprints(record) {
+  const fingerprints = /* @__PURE__ */ new Set();
+  for (const release of normaliseReleaseHistory(record)) {
+    const fingerprint = release?.source?.sealedServerEnv?.publicKeyFingerprint;
+    if (typeof fingerprint === "string" && fingerprint.length > 0) {
+      fingerprints.add(fingerprint);
+    }
+  }
+  return fingerprints;
+}
+async function readPublicHostSealedEnvKey(record, remoteRoot) {
+  const inspected = await inspectHostSealedEnvKey(record, remoteRoot);
+  if (!inspected?.publicKey || !inspected?.publicKeyFingerprint) {
+    return null;
+  }
+  return {
+    publicKey: inspected.publicKey,
+    publicKeyFingerprint: inspected.publicKeyFingerprint,
+    publicKeyPath: inspected.publicKeyPath
+  };
+}
+async function inspectHostSealedEnvKey(record, remoteRoot) {
+  const publicKeyFingerprint = record?.sealedServerEnv?.currentKeyFingerprint;
+  if (typeof publicKeyFingerprint !== "string" || publicKeyFingerprint.length === 0) {
+    return null;
+  }
+  const dataDirectory = path4.join(remoteRoot, "hosts", record.domain, "capsules", record.subname, "data");
+  const paths = hostSealedEnvKeyPaths(dataDirectory, publicKeyFingerprint);
+  const [publicKeyReadable, privateKeyReadable] = await Promise.all([
+    pathReadable(paths.publicKey),
+    pathReadable(paths.privateKey)
+  ]);
+  const keyStatus = hostSealedEnvKeyStatus(publicKeyReadable, privateKeyReadable);
+  const base = {
+    publicKeyFingerprint,
+    publicKeyPath: paths.publicKey,
+    status: keyStatus,
+    publicKeyAvailable: publicKeyReadable,
+    privateKeyAvailable: privateKeyReadable
+  };
+  if (!publicKeyReadable) {
+    return base;
+  }
+  try {
+    return {
+      ...base,
+      publicKey: await readFile2(paths.publicKey, "utf8")
+    };
+  } catch (error) {
+    if (errorDetails(error).code === "ENOENT") {
+      return { ...base, publicKeyAvailable: false, status: hostSealedEnvKeyStatus(false, privateKeyReadable) };
+    }
+    throw error;
+  }
+}
+function hostSealedEnvKeyStatus(publicKeyReadable, privateKeyReadable) {
+  if (publicKeyReadable && privateKeyReadable) {
+    return "available";
+  }
+  if (!publicKeyReadable && !privateKeyReadable) {
+    return "missing-key-material";
+  }
+  if (!publicKeyReadable) {
+    return "missing-public-key";
+  }
+  return "missing-private-key";
+}
+function publicRegistrySealedServerEnv(sealedServerEnv) {
+  return {
+    currentKeyFingerprint: sealedServerEnv.currentKeyFingerprint ?? null
+  };
+}
+function publicCurrentRelease(record) {
+  if (!record?.currentRelease) {
+    return null;
+  }
+  const currentRelease = { ...record.currentRelease };
+  const fingerprint = currentReleaseSealedServerEnvFingerprint(record);
+  if (fingerprint) {
+    currentRelease.sealedServerEnv = { publicKeyFingerprint: fingerprint };
+  }
+  return currentRelease;
+}
+function currentReleaseSealedServerEnvFingerprint(record) {
+  const releaseId = record?.currentRelease?.id ?? null;
+  if (!releaseId) {
+    return null;
+  }
+  const release = normaliseReleaseHistory(record).find((entry) => entry.id === releaseId);
+  const fingerprint = release?.source?.sealedServerEnv?.publicKeyFingerprint;
+  return typeof fingerprint === "string" ? fingerprint : null;
+}
+function hostSealedEnvKeyPaths(dataDirectory, fingerprint) {
+  const root = path4.join(dataDirectory, "sealed-server-env");
+  const keys = path4.join(root, "keys");
+  return {
+    root,
+    keys,
+    privateKey: path4.join(keys, `${fingerprint}.private.pem`),
+    publicKey: path4.join(keys, `${fingerprint}.public.pem`)
+  };
+}
+function fingerprintPublicKey(publicKey) {
+  return createHash("sha256").update(publicKey).digest("hex").slice(0, 16);
+}
+function reactivateRegistrationRecord(record, sealedServerEnv = null) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const { unregistered, unregisteredAt, deleteAfter, ...activeRecord } = record;
+  return {
+    ...activeRecord,
+    status: "registered",
+    updatedAt: now,
+    ...sealedServerEnv ? { sealedServerEnv: { currentKeyFingerprint: sealedServerEnv.publicKeyFingerprint } } : {}
+  };
+}
+function normaliseHostLogs(request) {
+  const provided = request.logs ?? {};
+  const lines = provided.lines ?? hostHelperConfig.logs.defaultLines;
+  const explicitFile = Boolean(provided.file ?? provided.path ?? provided.accessLog?.file);
+  const source = provided.source === "caddy-combined" ? "http" : provided.source ?? "http";
+  const subname = request.capsule?.subname;
+  const containerName = provided.container?.name ?? (subname ? createHostedContainerName(request.host.domain, subname) : null);
+  const capsuleScoped = source === "http" && typeof subname === "string" && subname.length > 0;
+  return {
+    source,
+    lines,
+    file: provided.file ?? provided.path ?? provided.accessLog?.file ?? (capsuleScoped ? defaultCapsuleHttpLogPath(request.host.remoteRoot, request.host.domain, subname) : defaultCaddyAccessLogPath(request.host.remoteRoot)),
+    explicitFile,
+    capsuleScoped,
+    subname,
+    container: containerName ? { name: containerName } : null
+  };
+}
+function normaliseDockerStats(raw) {
+  const [memoryUsageBytes, memoryLimitBytes] = parsePair(raw.MemUsage, parseDockerByteSize);
+  const [networkInputBytes, networkOutputBytes] = parsePair(raw.NetIO, parseDockerByteSize);
+  const [blockInputBytes, blockOutputBytes] = parsePair(raw.BlockIO, parseDockerByteSize);
+  return {
+    cpuPercent: parseDockerPercent(raw.CPUPerc),
+    memoryUsageBytes,
+    memoryLimitBytes,
+    memoryPercent: parseDockerPercent(raw.MemPerc),
+    networkInputBytes,
+    networkOutputBytes,
+    blockInputBytes,
+    blockOutputBytes,
+    pids: parseDockerInteger(raw.PIDs)
+  };
+}
+function percentage(numerator, denominator) {
+  if (!Number.isFinite(numerator) || !Number.isFinite(denominator) || denominator <= 0) {
+    return 0;
+  }
+  return Math.round(numerator / denominator * 1e4) / 100;
+}
+function normaliseBootstrap(request) {
+  const provided = request.bootstrap ?? {};
+  const remoteRoot = request.host.remoteRoot;
+  const domain = request.host.domain;
+  const caddyDirectory = path4.join(remoteRoot, "caddy");
+  const domainDirectory = path4.join(remoteRoot, "hosts", domain);
+  const tlsDirectory = path4.join(domainDirectory, "tls");
+  const tlsMode = provided.tls?.mode ?? "automatic";
+  const directories = {
+    remoteRoot,
+    bin: path4.join(remoteRoot, "bin"),
+    incoming: path4.join(remoteRoot, "incoming"),
+    caddy: caddyDirectory,
+    caddyHosts: path4.join(caddyDirectory, "hosts"),
+    hosts: path4.join(remoteRoot, "hosts"),
+    domain: domainDirectory,
+    tls: tlsDirectory,
+    registry: path4.join(domainDirectory, "registry"),
+    capsules: path4.join(domainDirectory, "capsules"),
+    ...provided.directories ?? {}
+  };
+  directories.incoming = provided.directories?.incoming ?? path4.join(remoteRoot, "incoming");
+  const tls = {
+    mode: tlsMode,
+    directory: provided.tls?.directory ?? directories.tls,
+    certificate: tlsMode === "cloudflare-origin" ? provided.tls?.certificate ?? path4.join(directories.tls, "origin.crt") : null,
+    key: tlsMode === "cloudflare-origin" ? provided.tls?.key ?? path4.join(directories.tls, "origin.key") : null
+  };
+  return {
+    substrate: {
+      packages: provided.substrate?.packages ?? ["docker", "caddy"],
+      services: provided.substrate?.services ?? ["docker", "caddy"]
+    },
+    directories,
+    domainDirectory: provided.domainDirectory ?? directories.domain,
+    tls,
+    network: provided.network ?? hostHelperConfig.hostedCapsule.dockerNetwork,
+    caddy: {
+      caddyfile: path4.join(directories.caddy, "Caddyfile"),
+      managedInclude: provided.caddy?.managedInclude ?? path4.join(directories.caddy, "sporades-hosted-domains.caddy"),
+      domainInclude: provided.caddy?.domainInclude ?? path4.join(directories.caddyHosts, `${domain}.caddy`),
+      routesDirectory: path4.join(directories.caddyHosts, domain),
+      healthRoute: path4.join(directories.caddyHosts, domain, "host.caddy"),
+      accessLog: provided.caddy?.accessLog ?? defaultCaddyAccessLogPath(remoteRoot)
+    }
+  };
+}
+async function ensureBootstrapDirectories(bootstrap) {
+  const directories = [
+    bootstrap.directories.remoteRoot,
+    bootstrap.directories.bin,
+    bootstrap.directories.incoming,
+    bootstrap.directories.caddy,
+    path4.dirname(bootstrap.caddy.accessLog),
+    bootstrap.directories.caddyHosts,
+    bootstrap.directories.hosts,
+    bootstrap.directories.domain,
+    bootstrap.directories.tls,
+    bootstrap.directories.registry,
+    path4.join(bootstrap.directories.registry, "capsules"),
+    bootstrap.directories.capsules,
+    bootstrap.caddy.routesDirectory
+  ];
+  for (const directory of directories) {
+    await mkdir(directory, { recursive: true });
+  }
+}
+async function provisionCaddyAccessLog(request, bootstrap) {
+  const logFile = bootstrap.caddy.accessLog;
+  const logDirectory = path4.dirname(logFile);
+  const caddyUser = resolveCaddyServiceUser();
+  if (!caddyUser) {
+    throw helperError(
+      "Caddy service user could not be found.",
+      "Install Caddy with its system service user available, then rerun `sporades host bootstrap`."
+    );
+  }
+  await mkdir(logDirectory, { recursive: true });
+  await writeFile(logFile, "", { flag: "a" });
+  await chmod(logDirectory, 488);
+  await chmod(logFile, 416);
+  const chown2 = spawnSync2("chown", [`${caddyUser.uid}:${caddyUser.gid}`, logDirectory, logFile], { encoding: "utf8" });
+  if (chown2.error || chown2.status !== 0) {
+    throw helperError(
+      "Failed to provision the Caddy access log for the service user.",
+      `Ensure the Host helper runs with permission to chown ${logDirectory} and ${logFile}, then rerun \`sporades host bootstrap --host ${request.host.alias}\`.`
+    );
+  }
+  return {
+    file: logFile,
+    directory: logDirectory,
+    owner: caddyUser.name,
+    writableByService: true
+  };
+}
+async function provisionRouteLogFile(route) {
+  const logFile = route.log?.file;
+  if (!logFile) {
+    return;
+  }
+  const logDirectory = path4.dirname(logFile);
+  await mkdir(logDirectory, { recursive: true });
+  await writeFile(logFile, "", { flag: "a" });
+  await chmod(logDirectory, 488);
+  await chmod(logFile, 416);
+  const caddyUser = resolveCaddyServiceUser();
+  if (!caddyUser) {
+    return;
+  }
+  const chown2 = spawnSync2("chown", [`${caddyUser.uid}:${caddyUser.gid}`, logDirectory, logFile], { encoding: "utf8" });
+  if (chown2.error || chown2.status !== 0) {
+    throw helperError(
+      "Failed to provision the Hosted Capsule HTTP log for the Caddy service user.",
+      `Ensure the Host helper runs with permission to chown ${logDirectory} and ${logFile}, then retry the Hosted Capsule command.`
+    );
+  }
+}
+function resolveCaddyServiceUser() {
+  const user = spawnSync2("id", ["-u", "caddy"], { encoding: "utf8" });
+  const group = spawnSync2("id", ["-g", "caddy"], { encoding: "utf8" });
+  if (user.error || user.status !== 0 || group.error || group.status !== 0) {
+    return null;
+  }
+  return { name: "caddy", uid: user.stdout.trim(), gid: group.stdout.trim() };
+}
+async function validateBootstrapTls(request, bootstrap) {
+  if (bootstrap.tls.mode === "automatic") {
+    return;
+  }
+  if (bootstrap.tls.mode !== "cloudflare-origin") {
+    throw helperError(
+      "Invalid Host TLS mode.",
+      "Use `--tls automatic` for Caddy-managed certificates or `--tls cloudflare-origin` for preinstalled Cloudflare origin certificates."
+    );
+  }
+  const readable = await Promise.all([
+    pathReadable(bootstrap.tls.certificate),
+    pathReadable(bootstrap.tls.key)
+  ]);
+  if (!readable.every(Boolean)) {
+    throw helperError(
+      "Cloudflare origin certificate material is missing or unusable.",
+      `Install readable Cloudflare origin certificate and key files at ${bootstrap.tls.certificate} and ${bootstrap.tls.key}, then rerun \`sporades host bootstrap --host ${request.host.alias}\`.`
+    );
+  }
+}
+function ensureDockerNetwork(networkName) {
+  const inspect = spawnSync2("docker", ["network", "inspect", networkName], { encoding: "utf8" });
+  if (inspect.error) {
+    throw helperError(
+      "Docker is unavailable on the Host server.",
+      "Install Docker, ensure the Docker daemon is running, then rerun `sporades host bootstrap`."
+    );
+  }
+  if (inspect.status === 0) {
+    return { name: networkName, created: false };
+  }
+  const create = spawnSync2("docker", ["network", "create", networkName], { encoding: "utf8" });
+  if (create.error || create.status !== 0) {
+    throw helperError(
+      "Failed to create the Hosted Capsule Docker network.",
+      `Check Docker on the Host server, then rerun \`sporades host bootstrap\`. Docker stderr: ${trimForHint(create.stderr)}`
+    );
+  }
+  return { name: networkName, created: true };
+}
+async function installCaddyBootstrapConfig(request, bootstrap) {
+  const caddyfile = bootstrap.caddy.caddyfile;
+  const managedInclude = bootstrap.caddy.managedInclude;
+  const domainInclude = bootstrap.caddy.domainInclude;
+  const placeholderRoute = path4.join(bootstrap.caddy.routesDirectory, ".sporades-placeholder.caddy");
+  await writeFile(placeholderRoute, "# Sporades keeps this placeholder so Caddy route imports are valid before Capsules are registered.\n");
+  await writeFile(bootstrap.caddy.healthRoute, renderHostHealthRoute(request.host.domain, bootstrap.tls));
+  await writeManagedCaddyfile(caddyfile, `import ${managedInclude}`);
+  await writeFile(managedInclude, `# Sporades-managed Hosted domain include list.
+import ${path4.join(bootstrap.directories.caddyHosts, "*.caddy")}
+`);
+  await writeFile(domainInclude, `# Sporades-managed routes for ${request.host.domain}.
+import ${path4.join(bootstrap.caddy.routesDirectory, "*.caddy")}
+`);
+  validateCaddyBootstrap(caddyfile);
+  reloadCaddyBootstrap(caddyfile);
+  return {
+    caddyfile,
+    managedInclude,
+    domainInclude,
+    routesDirectory: bootstrap.caddy.routesDirectory,
+    health: {
+      hostname: `host.${request.host.domain}`,
+      path: "/__sporades/health",
+      url: `${request.host.scheme ?? "https"}://host.${request.host.domain}/__sporades/health`
+    },
+    globalConfigReplaced: false,
+    reloaded: true
+  };
+}
+function renderHostHealthRoute(domain, tls) {
+  const route = {
+    hostname: `host.${domain}`,
+    routeFile: "",
+    tls
+  };
+  return renderRoute(
+    route,
+    [
+      "header /__sporades/health Content-Type application/json",
+      'respond /__sporades/health "{\\"ok\\":true}" 200',
+      "respond 404"
+    ].join("\n  ")
+  );
+}
+async function writeManagedCaddyfile(caddyfile, importLine) {
+  const begin = "# BEGIN Sporades hosted domains";
+  const end = "# END Sporades hosted domains";
+  const block = `${begin}
+${importLine}
+${end}
+`;
+  let existing = "";
+  try {
+    existing = await readFile2(caddyfile, "utf8");
+  } catch (error) {
+    if (errorDetails(error).code !== "ENOENT") {
+      throw error;
+    }
+  }
+  let next;
+  const markerPattern = new RegExp(`${escapeRegExp(begin)}\\n[\\s\\S]*?${escapeRegExp(end)}\\n?`);
+  if (markerPattern.test(existing)) {
+    next = existing.replace(markerPattern, block);
+  } else {
+    const prefix = existing && !existing.endsWith("\n") ? `${existing}
+` : existing;
+    next = `${prefix}${existing ? "\n" : ""}${block}`;
+  }
+  await writeFile(caddyfile, next);
+}
+function validateCaddyBootstrap(caddyfile) {
+  const result = spawnSync2("caddy", ["validate", "--config", caddyfile, "--adapter", "caddyfile"], { encoding: "utf8" });
+  if (result.error || result.status !== 0) {
+    throw helperError(
+      "Failed to validate the Sporades Caddy bootstrap configuration.",
+      `Check Caddy on the Host server, then rerun \`sporades host bootstrap\`. Caddy stderr: ${trimForHint(result.stderr)}`
+    );
+  }
+}
+function reloadCaddyBootstrap(caddyfile) {
+  const result = spawnSync2("caddy", ["reload", "--config", caddyfile, "--adapter", "caddyfile"], { encoding: "utf8" });
+  if (result.error || result.status !== 0) {
+    throw helperError(
+      "Failed to reload the Sporades Caddy bootstrap configuration.",
+      `Check the Host server Caddy service, then rerun \`sporades host bootstrap\`. Caddy stderr: ${trimForHint(result.stderr)}`
+    );
+  }
+}
+function parsePair(value, parser) {
+  const [left, right] = String(value ?? "").split("/").map((part) => part.trim());
+  return [parser(left), parser(right)];
+}
+function parseDockerPercent(value) {
+  const parsed = Number.parseFloat(String(value ?? "").replace("%", "").trim());
+  return Number.isFinite(parsed) ? parsed : null;
+}
+function parseDockerInteger(value) {
+  const parsed = Number.parseInt(String(value ?? "").trim(), 10);
+  return Number.isFinite(parsed) ? parsed : null;
+}
+function parseDockerByteSize(value) {
+  const match = String(value ?? "").trim().match(/^([\d.]+)\s*([KMGTPE]?i?B|B)$/i);
+  if (!match) {
+    return null;
+  }
+  const amount = Number.parseFloat(match[1]);
+  if (!Number.isFinite(amount)) {
+    return null;
+  }
+  const unit = match[2].toLowerCase();
+  const multipliers = {
+    b: 1,
+    kb: 1e3,
+    mb: 1e6,
+    gb: 1e9,
+    tb: 1e12,
+    pb: 1e15,
+    eb: 1e18,
+    kib: 1024,
+    mib: 1024 ** 2,
+    gib: 1024 ** 3,
+    tib: 1024 ** 4,
+    pib: 1024 ** 5,
+    eib: 1024 ** 6
+  };
+  if (!multipliers[unit]) {
+    return null;
+  }
+  return Math.round(amount * multipliers[unit]);
+}
+async function dockerRunArgs(lifecycle, releaseId) {
+  const args = [
+    "run",
+    "--detach",
+    "--name",
+    lifecycle.container.name,
+    "--network",
+    lifecycle.container.network,
+    "--restart",
+    restartPolicyForMode("hosted").dockerRestart,
+    "--read-only",
+    "--tmpfs",
+    "/tmp:rw,nosuid,nodev,noexec",
+    "--cap-drop",
+    "ALL",
+    "--security-opt",
+    "no-new-privileges",
+    "--user",
+    lifecycle.container.user,
+    "--log-driver",
+    "json-file",
+    "--log-opt",
+    "max-size=10m",
+    "--log-opt",
+    "max-file=5"
+  ];
+  const labels = {
+    ...lifecycle.container.labels,
+    "com.sporades.release-id": releaseId
+  };
+  for (const [key, value] of Object.entries(labels)) {
+    args.push("--label", `${key}=${value}`);
+  }
+  for (const mount of lifecycle.mounts.files) {
+    if (mount.optional && !await pathExists(mount.host)) {
+      continue;
+    }
+    if (!mount.optional && mount.container === "/app/.sporades/sealed-server-env/server-env.private.pem" && !await pathReadable(mount.host)) {
+      throw missingHostSealedServerEnvPrivateKeyError(lifecycle, mount);
+    }
+    args.push("--volume", formatMount(mount));
+    if (mount.container === "/app/.env.sporades.server") {
+      args.push("--env-file", mount.host);
+    }
+    if (mount.container === "/app/.sporades/sealed-server-env/server-env.sealed.json") {
+      args.push("--env", `SPORADES_SEALED_SERVER_ENV_PATH=${mount.container}`);
+    }
+    if (mount.container === "/app/.sporades/sealed-server-env/server-env.private.pem") {
+      args.push("--env", `SPORADES_SEALED_SERVER_ENV_PRIVATE_KEY_PATH=${mount.container}`);
+    }
+  }
+  args.push(
+    "--volume",
+    formatMount(lifecycle.mounts.data),
+    "--workdir",
+    "/app",
+    "--env",
+    "PORT=4000",
+    "--env",
+    "SPORADES_LOG_STDOUT=1",
+    "--env",
+    `SPORADES_RELEASE_ID=${releaseId}`
+  );
+  args.push("--publish", `127.0.0.1::${lifecycle.routes.running.port ?? 4e3}`);
+  args.push(lifecycle.container.image, "node", "/app/server.mjs");
+  return args;
+}
+function missingHostSealedServerEnvPrivateKeyError(lifecycle, mount) {
+  const fingerprint = mount.fingerprint ?? null;
+  const expected = fingerprint ? ` Expected sealed-env key fingerprint: ${fingerprint}.` : "";
+  return helperError(
+    "Hosted Capsule Sealed Server env private key is missing.",
+    `Host key material for ${lifecycle.remoteCapsuleId} is missing.${expected} Old Host-encrypted envelopes cannot be decrypted without that private key. To recover, re-key the Hosted Capsule, re-seal from source-of-truth Server env values, then push a new release.`,
+    {
+      capsule: {
+        subname: lifecycle.subname,
+        domain: lifecycle.domain,
+        hostedUrl: lifecycle.hostedUrl,
+        remoteCapsuleId: lifecycle.remoteCapsuleId
+      },
+      sealedServerEnv: {
+        expectedPublicKeyFingerprint: fingerprint,
+        privateKeyPath: mount.host,
+        recovery: "re-key-and-re-seal-from-source-of-truth"
+      }
+    }
+  );
+}
+function stopAndRemoveContainer(containerName) {
+  runDocker(["stop", containerName], { ignoreFailure: true });
+  runDocker(["rm", containerName], { ignoreFailure: true });
+}
+function ensureHostedBaseImage(lifecycle) {
+  const image = lifecycle.container.image;
+  const inspect = runDocker(["image", "inspect", image], { ignoreFailure: true });
+  if (inspect.ok) {
+    return;
+  }
+  const pull = runDocker(["pull", image], { ignoreFailure: true });
+  if (pull.ok) {
+    return;
+  }
+  const dockerfilePath = path4.join(lifecycle.remoteRoot, "Dockerfile.base");
+  if (!pathExistsSync(dockerfilePath)) {
+    throw helperError(
+      "Unable to prepare the Sporades Base image.",
+      `Docker could not pull ${image}, and ${dockerfilePath} is missing. Reinstall the Sporades Host helper files, then retry \`sporades host start ${lifecycle.subname} --host <alias>\`.`
+    );
+  }
+  const build = runDocker(["build", "-f", dockerfilePath, "-t", image, lifecycle.remoteRoot], { ignoreFailure: true });
+  if (!build.ok) {
+    throw helperError(
+      "Unable to prepare the Sporades Base image.",
+      `Docker could not pull or build ${image}. Check Docker and ${dockerfilePath} on the Host server, then retry \`sporades host start ${lifecycle.subname} --host <alias>\`.`
+    );
+  }
+}
+function runDocker(args, options = {}) {
+  const result = spawnSync2("docker", args, { encoding: "utf8" });
+  if (options.ignoreFailure) {
+    return { ok: result.status === 0, stdout: result.stdout ?? "", stderr: result.stderr ?? "" };
+  }
+  return {
+    ok: !result.error && result.status === 0,
+    stdout: result.stdout ?? "",
+    stderr: result.stderr ?? result.error?.message ?? ""
+  };
+}
+function checkContainerRunning(containerName) {
+  return inspectContainerRunning(containerName).running;
+}
+function inspectContainerRunning(containerName) {
+  const result = runDocker(["inspect", "-f", "{{.State.Running}}", containerName]);
+  if (!result.ok) {
+    return { ok: false, running: false };
+  }
+  const value = result.stdout.trim();
+  return { ok: true, running: value === "true" };
+}
+function inspectLoopbackPublishedPort(containerName, containerPort) {
+  const result = runDocker([
+    "inspect",
+    "-f",
+    `{{(index (index .NetworkSettings.Ports "${containerPort}/tcp") 0).HostIp}}:{{(index (index .NetworkSettings.Ports "${containerPort}/tcp") 0).HostPort}}`,
+    containerName
+  ]);
+  if (!result.ok) {
+    return null;
+  }
+  const match = result.stdout.trim().match(/^(127\.0\.0\.1):([1-9][0-9]*)$/);
+  if (!match) {
+    return null;
+  }
+  return {
+    containerPort,
+    hostIp: match[1],
+    hostPort: Number(match[2])
+  };
+}
+async function currentReleaseId(currentLink, request) {
+  let target;
+  try {
+    target = await readlink(currentLink);
+  } catch (error) {
+    const details = errorDetails(error);
+    if (details.code === "ENOENT" || details.code === "EINVAL") {
+      throw helperError(
+        "No Hosted Capsule release has been pushed.",
+        `Run \`sporades host push --host ${request.host.alias} --subname ${request.capsule.subname}\` before starting the Hosted Capsule.`
+      );
+    }
+    throw error;
+  }
+  return path4.basename(target);
+}
+function loopbackRunningRoute(route, publishedPort) {
+  return {
+    ...route,
+    target: "loopback",
+    upstream: `${publishedPort.hostIp}:${publishedPort.hostPort}`,
+    publishedPort
+  };
+}
+async function writeRunningRoute(lifecycle, route = lifecycle.routes.running) {
+  await provisionRouteLogFile(route);
+  const proxyLine = `reverse_proxy ${route.upstream ?? `${route.containerName}:${route.port ?? 4e3}`}`;
+  await applyManagedRoute(
+    lifecycle,
+    route.routeFile,
+    renderRoute(route, renderRunningRouteHandler(route, proxyLine))
+  );
+}
+function renderRunningRouteHandler(route, proxyLine) {
+  const probe = route.runtimeProbe;
+  if (!probe?.token || probe.header !== RUNTIME_PROBE_HEADER) {
+    return proxyLine;
+  }
+  return [
+    `@sporadesRuntimeHealth path ${CAPSULE_RUNTIME_HEALTH_PATH}`,
+    "@sporadesRuntimeProbe {",
+    `  path ${CAPSULE_RUNTIME_HEALTH_PATH}`,
+    `  header ${RUNTIME_PROBE_HEADER} ${probe.token}`,
+    "}",
+    "handle @sporadesRuntimeProbe {",
+    `  ${proxyLine}`,
+    "}",
+    "respond @sporadesRuntimeHealth 404",
+    proxyLine
+  ].join("\n  ");
+}
+async function writeUnavailableRoute(lifecycle) {
+  const route = lifecycle.routes.unavailable;
+  await provisionRouteLogFile(route);
+  await applyManagedRoute(
+    lifecycle,
+    route.routeFile,
+    renderRoute(route, renderUnavailableRouteHandler(route))
+  );
+}
+function renderUnavailableRouteHandler(route) {
+  return [
+    `@sporadesRuntimeHealth path ${CAPSULE_RUNTIME_HEALTH_PATH}`,
+    "respond @sporadesRuntimeHealth 404",
+    `respond "Hosted Capsule unavailable" ${route.statusCode ?? 503}`
+  ].join("\n  ");
+}
+function renderRoute(route, handlerLine) {
+  const tlsLine = renderRouteTlsLine(route.tls);
+  const logBlock = renderRouteLogBlock(route.log);
+  return `${route.hostname} {
+${tlsLine}${logBlock}  ${handlerLine}
+}
+`;
+}
+function renderRouteTlsLine(tls) {
+  if (tls?.mode !== "cloudflare-origin") {
+    return "";
+  }
+  return `  tls ${tls.certificate} ${tls.key}
+`;
+}
+function renderRouteLogBlock(log) {
+  if (!log?.file) {
+    return "";
+  }
+  return `  log {
+    output file ${log.file} {
+      roll_size 10MiB
+      roll_keep 5
+      roll_keep_for 720h
+    }
+  }
+`;
+}
+async function applyManagedRoute(lifecycle, routeFile, contents) {
+  await mkdir(path4.dirname(routeFile), { recursive: true });
+  const tempRouteFile = `${routeFile}.tmp`;
+  const previousRouteFile = `${routeFile}.previous-${process.pid}`;
+  await rm2(tempRouteFile, { force: true });
+  await rm2(previousRouteFile, { force: true });
+  await writeFile(tempRouteFile, contents);
+  try {
+    validateCaddyRoute(tempRouteFile);
+  } catch (error) {
+    await rm2(tempRouteFile, { force: true });
+    throw error;
+  }
+  const hadPreviousRoute = await pathExists(routeFile);
+  if (hadPreviousRoute) {
+    await rename(routeFile, previousRouteFile);
+  }
+  try {
+    await rename(tempRouteFile, routeFile);
+    reloadCaddy(lifecycle);
+  } catch (error) {
+    await rm2(routeFile, { force: true });
+    if (hadPreviousRoute) {
+      await rename(previousRouteFile, routeFile);
+    }
+    try {
+      reloadCaddy(lifecycle);
+    } catch (rollbackError) {
+      throw helperError(
+        "Failed to apply Hosted Capsule route and failed to reload the restored Caddy config.",
+        "The previous route file was restored, but Caddy could not reload it. Check the Host server Caddy service and configuration, then retry the lifecycle command."
+      );
+    }
+    throw error;
+  }
+  await rm2(previousRouteFile, { force: true });
+}
+async function removeManagedRoute(lifecycle, routeFile) {
+  const previousRouteFile = `${routeFile}.previous-${process.pid}`;
+  await rm2(previousRouteFile, { force: true });
+  const hadRoute = await pathExists(routeFile);
+  if (!hadRoute) {
+    return { routeFile, removed: false };
+  }
+  await rename(routeFile, previousRouteFile);
+  try {
+    reloadCaddy(lifecycle);
+  } catch (error) {
+    await rename(previousRouteFile, routeFile);
+    try {
+      reloadCaddy(lifecycle);
+    } catch {
+      throw helperError(
+        "Failed to remove Hosted Capsule route and failed to reload the restored Caddy config.",
+        "The previous route file was restored, but Caddy could not reload it. Check the Host server Caddy service and configuration, then retry unregister."
+      );
+    }
+    throw helperError(
+      "Failed to remove Hosted Capsule route.",
+      "The previous route file was restored. Check the Host server Caddy service and configuration, then retry unregister."
+    );
+  }
+  return { routeFile, removed: true, previousRouteFile };
+}
+async function finalizeRemovedRoute(route) {
+  if (route?.previousRouteFile) {
+    await rm2(route.previousRouteFile, { force: true });
+  }
+}
+async function restoreRemovedRoute(lifecycle, route) {
+  if (!route?.previousRouteFile) {
+    return;
+  }
+  await rm2(route.routeFile, { force: true });
+  await rename(route.previousRouteFile, route.routeFile);
+  reloadCaddy(lifecycle);
+}
+async function removePathIfPresent(targetPath, options = {}) {
+  const existed = await pathExists(targetPath);
+  if (!existed) {
+    return { path: targetPath, removed: false };
+  }
+  await rm2(targetPath, { recursive: Boolean(options.recursive), force: true });
+  return { path: targetPath, removed: true };
+}
+async function prepareWritableDataPath(targetPath) {
+  let stats;
+  try {
+    stats = await lstat(targetPath);
+  } catch (error) {
+    if (errorDetails(error).code === "ENOENT") {
+      return;
+    }
+    throw error;
+  }
+  if (stats.isSymbolicLink()) {
+    throw helperError(
+      "Hosted Capsule data path contains a symbolic link.",
+      `Remove the symbolic link at ${targetPath}, then retry the Host lifecycle command.`
+    );
+  }
+  await prepareRuntimeDataOwnership(targetPath, stats);
+  if (stats.isDirectory()) {
+    await chmod(targetPath, 448);
+    const entries = await readdir2(targetPath, { withFileTypes: true });
+    for (const entry of entries) {
+      await prepareWritableDataPath(path4.join(targetPath, entry.name));
+    }
+    return;
+  }
+  if (stats.isFile()) {
+    await chmod(targetPath, 384);
+  }
+}
+async function prepareRuntimeDataOwnership(targetPath, stats) {
+  const uid = SPORADES_BASE_IMAGE.runtimeUid;
+  const gid = SPORADES_BASE_IMAGE.runtimeGid;
+  if (process.env.SPORADES_TEST_FORCE_RUNTIME_DATA_CHOWN_FAILURE === "1") {
+    throw runtimeDataOwnershipError(targetPath, uid, gid);
+  }
+  if (stats.uid === uid && stats.gid === gid) {
+    return;
+  }
+  try {
+    await chown(targetPath, uid, gid);
+  } catch (error) {
+    if (process.env.SPORADES_TEST_ALLOW_RUNTIME_DATA_OWNER_FALLBACK === "1" && ["EPERM", "EINVAL"].includes(String(errorDetails(error).code ?? ""))) {
+      return;
+    }
+    throw runtimeDataOwnershipError(targetPath, uid, gid);
+  }
+}
+function runtimeDataOwnershipError(targetPath, uid, gid) {
+  return helperError(
+    "Unable to prepare Hosted Capsule data ownership for the non-root runtime user.",
+    `Run the Host helper as a user that can chown Capsule data to ${uid}:${gid}, or repair ownership with \`sudo chown -R ${uid}:${gid} ${targetPath}\` and retry.`
+  );
+}
+function validateCaddyRoute(routeFile) {
+  const result = spawnSync2("caddy", ["validate", "--config", routeFile, "--adapter", "caddyfile"], { encoding: "utf8" });
+  if (result.error || result.status !== 0) {
+    throw helperError(
+      "Failed to validate Hosted Capsule route.",
+      "Check the generated Caddy route for this Hosted Capsule, then retry the lifecycle command."
+    );
+  }
+}
+function reloadCaddy(lifecycle) {
+  const configPath = path4.join(lifecycle.remoteRoot, "caddy", "Caddyfile");
+  const result = spawnSync2("caddy", ["reload", "--config", configPath, "--adapter", "caddyfile"], { encoding: "utf8" });
+  if (result.error || result.status !== 0) {
+    throw helperError(
+      "Failed to apply Hosted Capsule route.",
+      "Check the Host server Caddy configuration, then retry the lifecycle command."
+    );
+  }
+}
+async function updateRegistryStatus(request, status) {
+  await mutateRegistryRecord(request, (record) => {
+    record.status = status;
+    record.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+    return record;
+  });
+}
+async function recordFailedStartAndUnavailableRoute(request, lifecycle, releaseId, failureMessage) {
+  try {
+    await writeUnavailableRoute(lifecycle);
+  } catch (error) {
+    await recordReleaseFailure(request, releaseId, String(errorDetails(error).message ?? "Failed to apply Hosted Capsule route."));
+    throw error;
+  }
+  await recordReleaseFailure(request, releaseId, failureMessage);
+}
+async function recordReleaseUploaded(request, release) {
+  await mutateRegistryRecord(request, (record) => {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    record.currentRelease = { ...record.currentRelease ?? {}, id: release.id };
+    record.baseImage = normaliseProvidedBaseImage(release.baseImage ?? record.baseImage);
+    record.status = "released";
+    record.updatedAt = now;
+    record.releases = upsertReleaseEntry(record, release.id, (entry) => ({
+      ...entry,
+      id: release.id,
+      createdAt: entry.createdAt ?? now,
+      uploadedAt: entry.uploadedAt ?? now,
+      state: "uploaded",
+      current: true,
+      source: {
+        ...entry.source ?? {},
+        hostedUrl: release.hostedUrl ?? entry.source?.hostedUrl ?? null,
+        remoteCapsuleId: release.remoteCapsuleId ?? entry.source?.remoteCapsuleId ?? null,
+        files: Array.isArray(release.files) ? [...release.files] : [],
+        serverEnvIncluded: Boolean(release.serverEnvIncluded),
+        sealedServerEnvIncluded: Boolean(release.sealedServerEnvIncluded),
+        sealedServerEnv: release.sealedServerEnv?.publicKeyFingerprint ? { publicKeyFingerprint: release.sealedServerEnv.publicKeyFingerprint } : void 0
+      }
+    }));
+    return record;
+  });
+}
+async function recordReleaseStartAttempt(request, releaseId) {
+  await mutateRegistryRecord(request, (record) => {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    record.updatedAt = now;
+    record.releases = upsertReleaseEntry(record, releaseId, (entry) => ({
+      ...entry,
+      id: releaseId,
+      createdAt: entry.createdAt ?? record.currentRelease?.createdAt ?? now,
+      uploadedAt: entry.uploadedAt ?? null,
+      current: true,
+      startAttempts: [...normaliseReleaseEventList(entry.startAttempts), { startedAt: now }]
+    }));
+    return record;
+  });
+}
+async function recordReleaseStarted(request, releaseId) {
+  await mutateRegistryRecord(request, (record) => {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    record.currentRelease = { ...record.currentRelease ?? {}, id: releaseId };
+    record.status = "running";
+    record.updatedAt = now;
+    record.releases = upsertReleaseEntry(record, releaseId, (entry) => ({
+      ...entry,
+      id: releaseId,
+      createdAt: entry.createdAt ?? now,
+      uploadedAt: entry.uploadedAt ?? null,
+      state: "started",
+      current: true,
+      failure: null
+    }));
+    return record;
+  });
+}
+async function recordReleaseVerified(request, releaseId) {
+  await mutateRegistryRecord(request, (record) => {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    record.currentRelease = { ...record.currentRelease ?? {}, id: releaseId };
+    record.status = "running";
+    record.updatedAt = now;
+    record.releases = upsertReleaseEntry(record, releaseId, (entry) => ({
+      ...entry,
+      id: releaseId,
+      createdAt: entry.createdAt ?? now,
+      uploadedAt: entry.uploadedAt ?? null,
+      state: "verified",
+      current: true,
+      verificationAttempts: [...normaliseReleaseEventList(entry.verificationAttempts), { verifiedAt: now }],
+      failure: null
+    }));
+    return record;
+  });
+}
+async function recordReleaseVerificationFailed(request, releaseId, message) {
+  await mutateRegistryRecord(request, (record) => {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    record.status = "failed";
+    record.updatedAt = now;
+    record.releases = upsertReleaseEntry(record, releaseId, (entry) => ({
+      ...entry,
+      id: releaseId,
+      createdAt: entry.createdAt ?? now,
+      uploadedAt: entry.uploadedAt ?? null,
+      state: "failed",
+      current: (record.currentRelease?.id ?? null) === releaseId,
+      verificationAttempts: [
+        ...normaliseReleaseEventList(entry.verificationAttempts),
+        { failedAt: now, failure: { message } }
+      ],
+      failure: {
+        failedAt: now,
+        message
+      }
+    }));
+    return record;
+  });
+}
+async function recordReleaseVerificationFallback(request, failedReleaseId, fallbackReleaseId, message) {
+  await mutateRegistryRecord(request, (record) => {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    record.currentRelease = { ...record.currentRelease ?? {}, id: fallbackReleaseId };
+    record.status = "running";
+    record.updatedAt = now;
+    record.releases = upsertReleaseEntry(record, failedReleaseId, (entry) => ({
+      ...entry,
+      id: failedReleaseId,
+      state: "failed",
+      current: false,
+      fallbackAttempts: [
+        ...normaliseReleaseEventList(entry.fallbackAttempts),
+        { fallbackAt: now, releaseId: fallbackReleaseId, reason: message }
+      ],
+      failure: {
+        failedAt: entry.failure?.failedAt ?? now,
+        message
+      }
+    }));
+    record.releases = upsertReleaseEntry(record, fallbackReleaseId, (entry) => ({
+      ...entry,
+      id: fallbackReleaseId,
+      current: true,
+      fallbackSelectedAt: now,
+      failure: null
+    }));
+    return record;
+  });
+}
+async function recordReleaseVerificationFallbackFailed(request, failedReleaseId, fallbackReleaseId, fallbackMessage, verificationMessage) {
+  await mutateRegistryRecord(request, (record) => {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    record.currentRelease = { ...record.currentRelease ?? {}, id: failedReleaseId };
+    record.status = "failed";
+    record.updatedAt = now;
+    record.releases = upsertReleaseEntry(record, failedReleaseId, (entry) => ({
+      ...entry,
+      id: failedReleaseId,
+      state: "failed",
+      current: true,
+      fallbackAttempts: [
+        ...normaliseReleaseEventList(entry.fallbackAttempts),
+        {
+          failedAt: now,
+          releaseId: fallbackReleaseId,
+          reason: verificationMessage,
+          failure: { message: fallbackMessage }
+        }
+      ],
+      failure: {
+        failedAt: entry.failure?.failedAt ?? now,
+        message: verificationMessage
+      }
+    }));
+    record.releases = normaliseReleaseHistory(record).map(
+      (release) => release.id === fallbackReleaseId ? { ...release, current: false } : release
+    );
+    return record;
+  });
+}
+async function recordReleaseFailure(request, releaseId, message) {
+  await mutateRegistryRecord(request, (record) => {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    record.status = "failed";
+    record.updatedAt = now;
+    record.releases = upsertReleaseEntry(record, releaseId, (entry) => ({
+      ...entry,
+      id: releaseId,
+      createdAt: entry.createdAt ?? now,
+      uploadedAt: entry.uploadedAt ?? null,
+      state: "failed",
+      current: (record.currentRelease?.id ?? null) === releaseId,
+      failure: {
+        failedAt: now,
+        message
+      }
+    }));
+    return record;
+  });
+}
+async function recordReleaseRollbackSelected(request, releaseId) {
+  await mutateRegistryRecord(request, (record) => {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    record.currentRelease = { ...record.currentRelease ?? {}, id: releaseId };
+    record.status = "released";
+    record.updatedAt = now;
+    record.releases = upsertReleaseEntry(record, releaseId, (entry) => ({
+      ...entry,
+      id: releaseId,
+      createdAt: entry.createdAt ?? now,
+      uploadedAt: entry.uploadedAt ?? null,
+      current: true,
+      failure: null
+    }));
+    return record;
+  });
+}
+function upsertReleaseEntry(record, releaseId, mutateEntry) {
+  const releases = normaliseReleaseHistory(record);
+  const existing = releases.find((release) => release.id === releaseId) ?? createLegacyReleaseEntry(releaseId, record);
+  const next = mutateEntry(existing);
+  const withoutRelease = releases.filter((release) => release.id !== releaseId);
+  return [...withoutRelease, next].map((release) => markCurrentReleaseEntry(release, releaseId));
+}
+function normaliseReleaseHistory(record) {
+  const currentReleaseId2 = record?.currentRelease?.id ?? null;
+  const releases = Array.isArray(record?.releases) ? record.releases.filter((release) => release && typeof release === "object" && typeof release.id === "string" && release.id.length > 0).map((release) => normaliseReleaseEntry(release, currentReleaseId2)) : [];
+  if (releases.length === 0 && currentReleaseId2) {
+    releases.push(createLegacyReleaseEntry(currentReleaseId2, record));
+  }
+  const seen = /* @__PURE__ */ new Set();
+  return releases.filter((release) => {
+    if (seen.has(release.id)) {
+      return false;
+    }
+    seen.add(release.id);
+    return true;
+  });
+}
+function normaliseReleaseEntry(release, currentReleaseId2) {
+  const releaseState = typeof release.state === "string" ? release.state : "uploaded";
+  const state = ["uploaded", "started", "verified", "failed"].includes(releaseState) ? releaseState : "uploaded";
+  return {
+    id: release.id,
+    createdAt: typeof release.createdAt === "string" ? release.createdAt : null,
+    uploadedAt: typeof release.uploadedAt === "string" ? release.uploadedAt : null,
+    state,
+    current: release.id === currentReleaseId2,
+    source: normaliseReleaseSource(release.source),
+    startAttempts: normaliseReleaseEventList(release.startAttempts),
+    verificationAttempts: normaliseReleaseEventList(release.verificationAttempts),
+    fallbackAttempts: normaliseReleaseEventList(release.fallbackAttempts),
+    fallbackSelectedAt: typeof release.fallbackSelectedAt === "string" ? release.fallbackSelectedAt : null,
+    failure: normaliseReleaseFailure(release.failure)
+  };
+}
+function createLegacyReleaseEntry(releaseId, record) {
+  return {
+    id: releaseId,
+    createdAt: typeof record?.currentRelease?.createdAt === "string" ? record.currentRelease.createdAt : null,
+    uploadedAt: null,
+    state: "uploaded",
+    current: true,
+    source: normaliseReleaseSource(record?.currentRelease?.source),
+    startAttempts: [],
+    verificationAttempts: [],
+    failure: null,
+    legacy: true
+  };
+}
+function markCurrentReleaseEntry(release, currentReleaseId2) {
+  return {
+    ...release,
+    current: release.id === currentReleaseId2
+  };
+}
+function normaliseReleaseSource(source) {
+  if (!source || typeof source !== "object" || Array.isArray(source)) {
+    return {};
+  }
+  return Object.fromEntries(
+    Object.entries(source).filter(([, value]) => value !== void 0)
+  );
+}
+function releaseSealedServerEnvPrivateKeyMount(registryRecord, paths) {
+  const releaseId = registryRecord?.currentRelease?.id ?? null;
+  const release = normaliseReleaseHistory(registryRecord).find((entry) => entry.id === releaseId);
+  const fingerprint = release?.source?.sealedServerEnv?.publicKeyFingerprint;
+  if (typeof fingerprint === "string" && /^[a-f0-9]{16}$/.test(fingerprint)) {
+    return {
+      host: path4.join(paths.data, "sealed-server-env", "keys", `${fingerprint}.private.pem`),
+      fingerprint
+    };
+  }
+  return {
+    host: path4.join(paths.data, "sealed-server-env", "server-env.private.pem"),
+    fingerprint: null
+  };
+}
+function normaliseReleaseEventList(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value.filter((event) => event && typeof event === "object" && !Array.isArray(event));
+}
+function normaliseReleaseFailure(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  const failure = value;
+  return {
+    failedAt: typeof failure.failedAt === "string" ? failure.failedAt : null,
+    message: typeof failure.message === "string" ? failure.message : "Hosted Capsule release failed."
+  };
+}
+function compareReleasesNewestFirst(left, right) {
+  return String(right.createdAt ?? right.id).localeCompare(String(left.createdAt ?? left.id)) || right.id.localeCompare(left.id);
+}
+async function readRegistryRecordForCapsule(request, purpose) {
+  const registryRecordPath = registryPath(request);
+  try {
+    return JSON.parse(await readFile2(registryRecordPath, "utf8"));
+  } catch (error) {
+    if (errorDetails(error).code === "ENOENT") {
+      throw helperError(
+        "Hosted Capsule is not registered.",
+        missingCapsuleHint(request, purpose)
+      );
+    }
+    if (error instanceof SyntaxError) {
+      throw helperError(
+        "Hosted Capsule registry record is invalid.",
+        "Repair the Host server registry record before retrying the command."
+      );
+    }
+    throw error;
+  }
+}
+async function readOptionalRegistryRecordForCapsule(request) {
+  try {
+    return await readRegistryRecordForCapsule(request, "delete");
+  } catch (error) {
+    if (errorDetails(error).message === "Hosted Capsule is not registered.") {
+      return null;
+    }
+    throw error;
+  }
+}
+function assertRegistryRecordMatchesRequest(request, record) {
+  const expectedRemoteCapsuleId = `${request.host.domain}/${request.capsule.subname}`;
+  const matches = record?.subname === request.capsule.subname && record?.domain === request.host.domain && (record?.remoteCapsuleId ?? expectedRemoteCapsuleId) === expectedRemoteCapsuleId;
+  if (!matches) {
+    throw helperError(
+      "Hosted Capsule registry record does not match the release request.",
+      "Rebind the local project or pass the correct Host profile and Capsule subname."
+    );
+  }
+}
+async function mutateRegistryRecord(request, mutate) {
+  return withRegistryLock(request, async () => {
+    const registryRecordPath = registryPath(request);
+    const record = JSON.parse(await readFile2(registryRecordPath, "utf8"));
+    await writeRegistryRecordAtomic(registryRecordPath, mutate(record));
+  });
+}
+async function writeRegistryRecordAtomic(registryRecordPath, record) {
+  const tempPath = `${registryRecordPath}.tmp-${process.pid}-${Date.now()}`;
+  try {
+    await writeFile(tempPath, `${JSON.stringify(record, null, 2)}
+`);
+    if (process.env.SPORADES_FAKE_REGISTRY_ATOMIC_WRITE_FAILURE === "1") {
+      throw helperError(
+        "Failed to write Hosted Capsule registry record.",
+        "Check Host server disk permissions and free space, then retry the command."
+      );
+    }
+    await rename(tempPath, registryRecordPath);
+  } catch (error) {
+    await rm2(tempPath, { force: true });
+    throw error;
+  }
+}
+async function withRegistryLock(request, fn) {
+  const lockDir = registryLockPath(request);
+  const timeoutMs = Number(process.env.SPORADES_REGISTRY_LOCK_TIMEOUT_MS ?? "5000");
+  const startedAt = Date.now();
+  while (true) {
+    try {
+      await mkdir(lockDir, { recursive: false });
+      break;
+    } catch (error) {
+      if (errorDetails(error).code !== "EEXIST") {
+        throw error;
+      }
+      if (Date.now() - startedAt >= timeoutMs) {
+        throw helperError(
+          "Hosted domain registry is locked.",
+          "Wait for the other Host server operation to finish, then retry the command."
+        );
+      }
+      await delay(25);
+    }
+  }
+  try {
+    return await fn();
+  } finally {
+    await rm2(lockDir, { recursive: true, force: true });
+  }
+}
+function registryPath(request) {
+  return path4.join(
+    request.host.remoteRoot,
+    "hosts",
+    request.host.domain,
+    "registry",
+    "capsules",
+    `${request.capsule.subname}.json`
+  );
+}
+function registryLockPath(request) {
+  return path4.join(request.host.remoteRoot, "hosts", request.host.domain, "registry", ".lock");
+}
+function capsuleData(request, lifecycle) {
+  return {
+    subname: request.capsule.subname,
+    domain: request.host.domain,
+    hostedUrl: lifecycle.hostedUrl,
+    remoteCapsuleId: lifecycle.remoteCapsuleId
+  };
+}
+function formatMount(mount) {
+  const mode = mount.mode === "ro" ? ":ro" : mount.mode === "rw" ? ":rw" : "";
+  return `${mount.host}:${mount.container}${mode}`;
+}
+async function pathExists(filePath) {
+  try {
+    await access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function pathExistsSync(filePath) {
+  try {
+    statSync(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function pathReadable(filePath) {
+  if (!filePath) {
+    return false;
+  }
+  try {
+    await access(filePath, fsConstants.R_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function readManagedCaddyAccessLog(logs) {
+  const readable = await pathReadable(logs.file);
+  if (!readable) {
+    if (logs.explicitFile) {
+      throw helperError(
+        "Host server Caddy combined logs are unavailable.",
+        `Check that ${logs.file} exists and is readable by the Host helper, then retry \`sporades host logs\`.`
+      );
+    }
+    return null;
+  }
+  const contents = await readFile2(logs.file, "utf8");
+  return lastLogEntries(contents, logs.lines);
+}
+function readCaddyJournalLogs(logs) {
+  const result = spawnSync2("journalctl", ["-u", "caddy", "-n", String(logs.lines), "--no-pager", "-o", "cat"], {
+    encoding: "utf8"
+  });
+  if (result.error || result.status !== 0) {
+    return null;
+  }
+  return lastLogEntries(result.stdout ?? "", logs.lines);
+}
+function readDockerStreamLogs(logs) {
+  const result = spawnSync2("docker", ["logs", "--tail", String(logs.lines), logs.container.name], {
+    encoding: "utf8"
+  });
+  if (result.error || result.status !== 0) {
+    throw helperError(
+      "Hosted Capsule container logs are unavailable.",
+      `Check that Docker container ${logs.container.name} still exists, then retry \`sporades host logs ${logs.source}\`.`
+    );
+  }
+  return lastLogEntries(logs.source === "stdout" ? result.stdout : result.stderr, logs.lines);
+}
+function lastLogEntries(contents, lines) {
+  return String(contents ?? "").split(/\r?\n/).filter((line) => line.length > 0).slice(-lines);
+}
+function unavailableCaddyLogsError(request) {
+  return helperError(
+    "Host server Caddy combined logs are unavailable.",
+    `Run \`sporades host bootstrap --host ${request.host.alias}\` and check Caddy on the Host server.`
+  );
+}
+function unavailableCapsuleHttpLogsError(logs) {
+  return helperError(
+    "Hosted Capsule HTTP logs are unavailable.",
+    `Check that ${logs.file} exists and is readable, then retry \`sporades host logs http --subname ${logs.subname}\`.`
+  );
+}
+function trimForHint(value) {
+  const trimmed = String(value ?? "").trim();
+  return trimmed || "no stderr output";
+}
+function escapeRegExp(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function createHostedContainerName(domain, subname) {
+  return `sporades-${domain.replace(/[^a-z0-9]+/gi, "-").replace(/^-+|-+$/g, "").toLowerCase()}-${subname}`;
+}
+function defaultCaddyAccessLogPath(remoteRoot) {
+  return path4.join(remoteRoot, "caddy", "logs", "access.log");
+}
+function defaultCapsuleHttpLogPath(remoteRoot, domain, subname) {
+  return path4.join(remoteRoot, "hosts", domain, "capsules", subname, "logs", "http.log");
+}
+async function assertRollbackReleaseFiles(request, releaseDirectory) {
+  const requiredFiles = ["server.mjs", "client.js", "index.html", "sporades.json"];
+  for (const file of requiredFiles) {
+    if (!await pathReadable(path4.join(releaseDirectory, file))) {
+      throw helperError(
+        "Hosted Capsule release files are missing.",
+        `The recorded release cannot be started from ${releaseDirectory}. Push a new release or choose another release from \`sporades host releases ${request.capsule.subname} --host ${request.host.alias} --json\`.`
+      );
+    }
+  }
+}
+async function verifyRegisteredCapsule(request, purpose = "push") {
+  const record = await readRegistryRecordForCapsule(request, purpose);
+  assertRegistryRecordMatchesRequest(request, record);
+  if (record.status === "unregistered") {
+    throw helperError(
+      "Hosted Capsule is unregistered.",
+      `Run \`sporades host register ${request.capsule.subname} --host ${request.host.alias}\` before retrying this command.`
+    );
+  }
+  return record;
+}