@stacksjs/buddy 0.70.232 → 0.70.235

package/dist/commands/build.js

@@ -18,6 +18,7 @@ export function build(buddy) {
     buddy: "Build the Buddy binary",
     functions: "Build your function library",
     desktop: "Build the Desktop Application",
+    dmg: "Package the desktop build as a macOS .app inside a .dmg",
     pages: "Build your frontend",
     docs: "Build your documentation",
     framework: "Build Stacks framework",
@@ -153,6 +154,17 @@ export function build(buddy) {
     await outro("Exited", { startTime: perf, useSeconds: !0 });
     process.exit(ExitCode.Success);
   });
+  buddy.command("build:dmg", descriptions.dmg).option("-p, --project [project]", descriptions.project, { default: !1 }).option("--verbose", descriptions.verbose, { default: !1 }).action(async (options) => {
+    log.debug("Running `buddy build:dmg` ...", options);
+    const perf = await intro("buddy build:dmg"), result = await runAction(Action.BuildDmg, options);
+    if (result.isErr) {
+      await outro("While running the build:dmg command, there was an issue", { startTime: perf, useSeconds: !0 }, result.error);
+      process.exit(ExitCode.FatalError);
+    }
+    console.log("");
+    await outro("Exited", { startTime: perf, useSeconds: !0 });
+    process.exit(ExitCode.Success);
+  });
   buddy.command("build:stacks", "Build the Stacks framework.").option("-s, --stacks", descriptions.framework, { default: !0 }).option("-p, --project [project]", descriptions.project, { default: !1 }).option("--verbose", descriptions.verbose, { default: !1 }).action(async (options) => {
     log.debug("Running `buddy build:stacks` ...", options);
     const startTime = await intro("buddy build:stacks"), result = await runAction(Action.BuildStacks, options);

package/dist/commands/deploy.js

@@ -831,7 +831,7 @@ async function runHetznerDeploy(args) {
     ".env.keys",
     ".env.production.bak",
     ".env.production.plain"
-  ].flatMap((p) => [`--exclude='${p}'`, `--exclude='*/${p}'`]);
+  ];
   if (onlySite && !sites[onlySite]) {
     log.error(`--site '${onlySite}' is not a configured site. Available: ${Object.keys(sites).join(", ")}`);
     process.exit(ExitCode.FatalError);
@@ -851,9 +851,11 @@ async function runHetznerDeploy(args) {
       log.info(`Building static site '${siteName}': ${site.build}`);
       execSync(site.build, { stdio: verbose ? "inherit" : "pipe" });
     }
-    const root = site.root || ".", tarballPath = join(tmpdir(), `${slug}-${siteName}-${sha}.tar.gz`);
+    const root = site.root || ".", tarballPath = join(tmpdir(), `${slug}-${siteName}-${sha}.tar.gz`), siteExcludes = Array.isArray(site.exclude) ? site.exclude.filter((entry) => typeof entry === "string" && entry.length > 0) : [], excludeArgs = [...tarExcludes, ...siteExcludes].flatMap((pattern) => [`--exclude='${pattern}'`, `--exclude='*/${pattern}'`]);
+    if (siteExcludes.length > 0)
+      log.info(`Excluding server-owned paths: ${siteExcludes.join(", ")}`);
     log.info(`Packaging ${root} \u2192 ${tarballPath}...`);
-    execSync(`tar czf "${tarballPath}" ${tarExcludes.join(" ")} -C "${root}" .`, { stdio: verbose ? "inherit" : "pipe", env: { ...process.env, COPYFILE_DISABLE: "1" } });
+    execSync(`tar czf "${tarballPath}" ${excludeArgs.join(" ")} -C "${root}" .`, { stdio: verbose ? "inherit" : "pipe", env: { ...process.env, COPYFILE_DISABLE: "1" } });
     const sizeMb = Math.max(1, Math.round(statSync(tarballPath).size / 1048576));
     log.info(`Release tarball: ~${sizeMb} MB`);
     tarballs.set(siteName, tarballPath);
@@ -888,8 +890,32 @@ async function runHetznerDeploy(args) {
       success: (m) => log.success(m)
     }
   });
+  let publishedDns = [];
   if (ok)
-    await reconcileHetznerDns(onlySite ? { [onlySite]: sites[onlySite] } : sites, ip, log, ipv6);
+    publishedDns = await reconcileHetznerDns(onlySite ? { [onlySite]: sites[onlySite] } : sites, ip, log, ipv6);
+  if (ok && publishedDns.length > 0) {
+    log.info(`Issuing TLS for ${publishedDns.length} newly published record(s)...`);
+    try {
+      const { renewRpxCertificates, reloadRpxGateway } = await import("@stacksjs/ts-cloud"), gatewayOptions = {
+        rpxConfig: { ...tsCloudConfig, sites: sitesWithResolvedEnv },
+        environment,
+        driver,
+        logger: {
+          info: (m) => log.info(m),
+          warn: (m) => log.warn(m),
+          error: (m) => log.error(m),
+          step: (m) => log.info(m),
+          success: (m) => log.success(m)
+        }
+      };
+      await renewRpxCertificates(gatewayOptions);
+      await reloadRpxGateway(gatewayOptions);
+      log.success("TLS issued and gateway reloaded for the new record(s)");
+    } catch (err) {
+      log.warn(`TLS issuance after DNS failed: ${err?.message || err}`);
+      log.warn(`  Until it succeeds, ${publishedDns.join(", ")} serves a fallback certificate.`);
+    }
+  }
   if (ok)
     await reconcileConfigDns(onlySite ? { [onlySite]: sites[onlySite] } : sites, log);
   if (ok) {
@@ -1379,12 +1405,12 @@ async function reconcileConfigDns(sites, logger) {
     }
 }
 async function reconcileHetznerDns(sites, ip, logger, ipv6) {
-  const domains = new Set;
+  const published = [], domains = new Set;
   for (const site of Object.values(sites))
     if (site?.domain && typeof site.domain === "string")
       domains.add(site.domain.replace(/^www\./, ""));
   if (domains.size === 0)
-    return;
+    return published;
   const providerConfigs = [];
   if (process.env.PORKBUN_API_KEY && process.env.PORKBUN_SECRET_KEY)
     providerConfigs.push({ provider: "porkbun", apiKey: process.env.PORKBUN_API_KEY, secretKey: process.env.PORKBUN_SECRET_KEY });
@@ -1398,7 +1424,7 @@ async function reconcileHetznerDns(sites, ip, logger, ipv6) {
     logger.warn("DNS: no DNS provider credentials found (PORKBUN_API_KEY/\u2026); skipping DNS reconciliation.");
     for (const d of domains)
       logger.info(`  Point manually:  A ${d} \u2192 ${ip}   and   A www.${d} \u2192 ${ip}`);
-    return;
+    return published;
   }
   const {
     createDnsProvider,
@@ -1423,7 +1449,10 @@ async function reconcileHetznerDns(sites, ip, logger, ipv6) {
   };
   for (const domain of domains)
     try {
-      let provider = await detectDnsProvider(domain, providerConfigs);
+      let provider = await detectDnsProvider(domain, providerConfigs).catch((err) => {
+        logger.warn(`  DNS: ignoring a configured provider for ${domain} - its credentials were rejected (${err?.message || err})`);
+        return;
+      });
       if (!provider) {
         const providerName = dnsProviderNameFromNameservers(await resolveAuthoritativeNameservers(domain)), providerConfig = providerConfigs.find((config) => config.provider === providerName);
         if (providerConfig)
@@ -1443,14 +1472,17 @@ async function reconcileHetznerDns(sites, ip, logger, ipv6) {
       }
       for (const sub of ["", "www"]) {
         const fqdn = sub ? `${sub}.${domain}` : domain, report = await reconcileAddressRecords({ provider, zone: domain, fqdn, ipv4: ip, ipv6 });
-        for (const record of report.published)
+        for (const record of report.published) {
           logger.success(`  DNS: ${record.fqdn} \u2192 ${record.content} (${provider.name})`);
+          published.push(record.fqdn);
+        }
         for (const warning of report.warnings)
           logger.warn(`  DNS: ${warning}`);
       }
     } catch (err) {
       logger.warn(`  DNS: ${domain} reconciliation failed: ${err?.message || err}`);
     }
+  return published;
 }
 async function buildContainerImageWithPantry(args) {
   const { slug, sites, verbose } = args, { execSync } = await import("node:child_process");

package/dist/commands/docs/buddy-commands.js

@@ -1,3 +1,4 @@
+import { assertFrameworkRepo } from "./framework-repo";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 const root = resolve(import.meta.dir, "../../../../../../.."), outputPath = resolve(root, "docs/guide/buddy/commands.md"), cliPath = resolve(root, "storage/framework/core/buddy/src/cli.ts");
@@ -99,6 +100,7 @@ export function loadBuddyInventory() {
   return inventory;
 }
 export async function run() {
+  assertFrameworkRepo(root, "docs:buddy");
   const mode = process.argv.includes("--write") ? "write" : process.argv.includes("--check") ? "check" : null;
   if (!mode) {
     console.error("usage: bun storage/framework/core/buddy/src/commands/docs/buddy-commands.ts --write | --check");

package/dist/commands/docs/framework-repo.d.ts

@@ -0,0 +1,29 @@
+/**
+ * These tools operate on the framework repository, not on an app.
+ *
+ * Each one locates its files by counting `../` up from its own source, so the
+ * root it edits is wherever the module happens to live. In a consumer app that
+ * resolves buddy from a linked framework checkout, that root is the framework
+ * checkout - so `buddy docs:artifacts` run from an application regenerated and
+ * overwrote the FRAMEWORK's `openapi.json`, from routes belonging to a
+ * different project entirely.
+ *
+ * The failure that surfaced first was milder and more confusing: the generator
+ * read the app's routes but compared them against the framework's artifact and
+ * reported "no routes were registered". Nobody would guess from that message
+ * that the command was editing another repository.
+ *
+ * So they refuse to run unless the working directory is inside the root they
+ * would write to.
+ */
+/** Whether `cwd` sits inside `root`. */
+export declare function isInsideRoot(root: string, cwd: string): boolean;
+/** Whether `root` looks like the Stacks framework repository. */
+export declare function looksLikeFrameworkRepo(root: string): boolean;
+/**
+ * Stop unless this is the framework repository and we are standing in it.
+ *
+ * Throws rather than warns: the alternative is silently rewriting a file in a
+ * repository the caller is not looking at.
+ */
+export declare function assertFrameworkRepo(root: string, command: string, cwd?: string): void;

package/dist/commands/docs/framework-repo.js

@@ -0,0 +1,14 @@
+import { existsSync } from "node:fs";
+import { isAbsolute, relative, resolve } from "node:path";
+export function isInsideRoot(root, cwd) {
+  const rel = relative(resolve(root), resolve(cwd));
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+export function looksLikeFrameworkRepo(root) {
+  return existsSync(resolve(root, "storage/framework/core/buddy"));
+}
+export function assertFrameworkRepo(root, command, cwd = process.cwd()) {
+  if (looksLikeFrameworkRepo(root) && isInsideRoot(root, cwd))
+    return;
+  throw Error(`${command} operates on the Stacks framework repository and would write to ${root}, which is not where you are (${cwd}). Run it from a framework checkout; an application has no generated framework artifacts to check.`);
+}

package/dist/commands/docs/framework-repo.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/docs/framework-repo.test.js

@@ -0,0 +1,68 @@
+import { describe, expect, it } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { assertFrameworkRepo, isInsideRoot, looksLikeFrameworkRepo } from "./framework-repo";
+describe("isInsideRoot", () => {
+  it("accepts the root itself and anything under it", () => {
+    expect(isInsideRoot("/a/b", "/a/b")).toBe(!0);
+    expect(isInsideRoot("/a/b", "/a/b/c/d")).toBe(!0);
+  });
+  it("rejects a sibling and a parent", () => {
+    expect(isInsideRoot("/a/b", "/a/c")).toBe(!1);
+    expect(isInsideRoot("/a/b", "/a")).toBe(!1);
+  });
+  it("rejects another project entirely", () => {
+    expect(isInsideRoot("/Users/x/Code/stacks", "/Users/x/Code/Apps/reviewos.org")).toBe(!1);
+  });
+});
+describe("looksLikeFrameworkRepo", () => {
+  it("recognises a tree carrying the framework core", () => {
+    const dir = mkdtempSync(join(tmpdir(), "stacks-fw-"));
+    try {
+      mkdirSync(resolve(dir, "storage/framework/core/buddy"), { recursive: !0 });
+      expect(looksLikeFrameworkRepo(dir)).toBe(!0);
+    } finally {
+      rmSync(dir, { recursive: !0, force: !0 });
+    }
+  });
+  it("does not mistake an ordinary application for it", () => {
+    const dir = mkdtempSync(join(tmpdir(), "stacks-app-"));
+    try {
+      mkdirSync(resolve(dir, "app"), { recursive: !0 });
+      expect(looksLikeFrameworkRepo(dir)).toBe(!1);
+    } finally {
+      rmSync(dir, { recursive: !0, force: !0 });
+    }
+  });
+});
+describe("assertFrameworkRepo", () => {
+  it("passes inside the framework repo", () => {
+    const dir = mkdtempSync(join(tmpdir(), "stacks-fw-"));
+    try {
+      mkdirSync(resolve(dir, "storage/framework/core/buddy"), { recursive: !0 });
+      expect(() => assertFrameworkRepo(dir, "docs:artifacts", dir)).not.toThrow();
+    } finally {
+      rmSync(dir, { recursive: !0, force: !0 });
+    }
+  });
+  it("refuses when run from somewhere else, and says where it would have written", () => {
+    const framework = mkdtempSync(join(tmpdir(), "stacks-fw-")), app = mkdtempSync(join(tmpdir(), "stacks-app-"));
+    try {
+      mkdirSync(resolve(framework, "storage/framework/core/buddy"), { recursive: !0 });
+      expect(() => assertFrameworkRepo(framework, "docs:artifacts", app)).toThrow(/docs:artifacts/);
+      expect(() => assertFrameworkRepo(framework, "docs:artifacts", app)).toThrow(new RegExp(framework));
+    } finally {
+      rmSync(framework, { recursive: !0, force: !0 });
+      rmSync(app, { recursive: !0, force: !0 });
+    }
+  });
+  it("refuses when the root is not a framework tree at all", () => {
+    const dir = mkdtempSync(join(tmpdir(), "stacks-app-"));
+    try {
+      expect(() => assertFrameworkRepo(dir, "docs:links", dir)).toThrow();
+    } finally {
+      rmSync(dir, { recursive: !0, force: !0 });
+    }
+  });
+});

package/dist/commands/docs/generated-artifacts.js

@@ -1,5 +1,6 @@
 import { readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
+import { assertFrameworkRepo } from "./framework-repo";
 import { generateOpenApi } from "../../../../api/src/generate-openapi";
 import { renderOpenApiTypes } from "../../../../api/src/generate-types";
 const root = resolve(import.meta.dir, "../../../../../../.."), openApiPath = resolve(root, "storage/framework/api/openapi.json"), apiTypesPath = resolve(root, "storage/framework/api/api-types.ts");
@@ -51,6 +52,7 @@ Run bun run docs:artifacts and review the generated diff.`);
   console.log(`Generated API artifacts are current (${Object.keys(JSON.parse(expected.openApi).paths).length} paths)`);
 }
 export async function run() {
+  assertFrameworkRepo(root, "docs:artifacts");
   try {
     if (process.argv.includes("--write"))
       await write();

package/dist/commands/docs/links.js

@@ -1,3 +1,4 @@
+import { assertFrameworkRepo } from "./framework-repo";
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 const root = resolve(import.meta.dir, "../../../../../../.."), docsDir = resolve(root, "docs"), INLINE_LINK = /\[[^\]]*\]\(([^)]+)\)/g;
@@ -68,6 +69,7 @@ export function checkDocsLinks(docsRoot = docsDir) {
   return broken;
 }
 export async function run() {
+  assertFrameworkRepo(root, "docs:links");
   const broken = checkDocsLinks();
   if (broken.length === 0)
     console.log("\u2713 All internal documentation links resolve.");

package/dist/commands/extension.js

@@ -172,8 +172,13 @@ export function extension(buddy) {
     } else
       log.success(`Extension payload synced \u2192 ${resources}`);
   });
-  buddy.command("extension:safari:publish", "Archive and validate or upload the Safari app to App Store Connect").option("--version <version>", "Override the marketing version (defaults to package.json)").option("--build-number <number>", "CFBundleVersion (defaults to GITHUB_RUN_NUMBER or Unix time)").option("--team-id <id>", "Apple Developer team (defaults to config safariTeamId)").option("--api-key-id <id>", "App Store Connect API key ID").option("--api-issuer-id <id>", "App Store Connect API issuer ID").option("--api-key-path <path>", "Path to the App Store Connect AuthKey_*.p8 file").option("--validate-only", "Create and validate the archive without uploading it").option("--platform <platform>", "Publish macos, ios, or all (defaults to config safariPlatforms)").action(async (options) => {
-    const { publishSafariApp } = await import("@stacksjs/browser-extension"), { config, version } = await load(), result = await publishSafariApp(config, {
+  buddy.command("extension:safari:publish", "Archive and validate or upload the Safari app to App Store Connect").option("--version <version>", "Override the marketing version (defaults to package.json)").option("--build-number <number>", "CFBundleVersion (defaults to GITHUB_RUN_NUMBER or Unix time)").option("--team-id <id>", "Apple Developer team (defaults to config safariTeamId)").option("--api-key-id <id>", "App Store Connect API key ID").option("--api-issuer-id <id>", "App Store Connect API issuer ID").option("--api-key-path <path>", "Path to the App Store Connect AuthKey_*.p8 file").option("--validate-only", "Create and validate the archive without uploading it").option("--platform <platform>", "Publish macos, ios, or all (defaults to config safariPlatforms)").option("--skip-screenshots", "Do not regenerate the App Store screenshot set before publishing").action(async (options) => {
+    const { publishSafariApp } = await import("@stacksjs/browser-extension"), { config, version } = await load();
+    if (!options.skipScreenshots) {
+      const { generateProjectImages } = await import("@stacksjs/actions");
+      await generateProjectImages({ only: ["app-store"] });
+    }
+    const result = await publishSafariApp(config, {
       version: options.version ?? version,
       buildNumber: options.buildNumber,
       teamId: options.teamId,

package/dist/commands/generate.js

@@ -6,6 +6,7 @@ import {
   generateLibEntries,
   generateOpenApiSpec,
   generatePantryConfig,
+  generateProjectImages,
   generateTypes,
   generateVsCodeCustomData,
   generateWebTypes,
@@ -26,11 +27,15 @@ export function generate(buddy) {
     coreSymlink: "Generate symlink of the core framework to the project root",
     pantry: "Generate the pantry configuration file",
     openApi: "Generate the OpenAPI specification",
+    images: "Generate every image declared in config/images.ts",
+    og: "Generate the social cards used by link previews",
+    appStore: "Generate the App Store screenshot set",
+    appIcons: "Generate the app icon and favicon sets",
     select: "What are you trying to generate?",
     project: "Target a specific project",
     verbose: "Enable verbose output"
   };
-  buddy.command("generate", descriptions.command).option("-t, --types", descriptions.types).option("-e, --entries", descriptions.entries).option("-w, --web-types", descriptions.webTypes).option("-c, --custom-data", descriptions.customData).option("-i, --ide-helpers", descriptions.ideHelpers).option("-c, --component-meta", descriptions.componentMeta).option("-p, --pantry", descriptions.pantry).option("-o, --openapi", descriptions.openApi).option("-p, --project [project]", descriptions.project, { default: !1 }).option("--core-symlink", descriptions.coreSymlink).option("--verbose", descriptions.verbose, { default: !1 }).action(async (options) => {
+  buddy.command("generate", descriptions.command).option("-t, --types", descriptions.types).option("-e, --entries", descriptions.entries).option("-w, --web-types", descriptions.webTypes).option("-c, --custom-data", descriptions.customData).option("-i, --ide-helpers", descriptions.ideHelpers).option("-c, --component-meta", descriptions.componentMeta).option("-p, --pantry", descriptions.pantry).option("-o, --openapi", descriptions.openApi).option("--images", descriptions.images).option("-p, --project [project]", descriptions.project, { default: !1 }).option("--core-symlink", descriptions.coreSymlink).option("--verbose", descriptions.verbose, { default: !1 }).action(async (options) => {
     log.debug("Running `buddy generate` ...", options);
     await startGenerationProcess(options);
     process.exit(ExitCode.Success);
@@ -100,5 +105,35 @@ export function generate(buddy) {
     log.debug("Running `buddy core-symlink` ...", options);
     await generateCoreSymlink();
   });
+  buddy.command("generate:images", descriptions.images).alias("images:generate").option("--social", "Only build the social cards").option("--app-store", "Only build the App Store screenshots").option("--app-icons", "Only build the app icons and favicons").option("--verbose", descriptions.verbose, { default: !1 }).action(async (options) => {
+    log.debug("Running `buddy generate:images` ...", options);
+    const perf = await intro("buddy generate:images"), only = [];
+    if (options.social)
+      only.push("social");
+    if (options.appStore)
+      only.push("app-store");
+    if (options.appIcons)
+      only.push("app-icons");
+    await generateProjectImages({ only, verbose: options.verbose });
+    await outro("Generated images", { startTime: perf, useSeconds: !0 });
+  });
+  buddy.command("generate:og", descriptions.og).alias("generate:social").option("--verbose", descriptions.verbose, { default: !1 }).action(async (options) => {
+    log.debug("Running `buddy generate:og` ...", options);
+    const perf = await intro("buddy generate:og");
+    await generateProjectImages({ only: ["social"], verbose: options.verbose });
+    await outro("Generated social cards", { startTime: perf, useSeconds: !0 });
+  });
+  buddy.command("generate:app-store", descriptions.appStore).alias("generate:screenshots").option("--verbose", descriptions.verbose, { default: !1 }).action(async (options) => {
+    log.debug("Running `buddy generate:app-store` ...", options);
+    const perf = await intro("buddy generate:app-store");
+    await generateProjectImages({ only: ["app-store"], verbose: options.verbose });
+    await outro("Generated App Store screenshots", { startTime: perf, useSeconds: !0 });
+  });
+  buddy.command("generate:app-icons", descriptions.appIcons).option("--verbose", descriptions.verbose, { default: !1 }).action(async (options) => {
+    log.debug("Running `buddy generate:app-icons` ...", options);
+    const perf = await intro("buddy generate:app-icons");
+    await generateProjectImages({ only: ["app-icons"], verbose: options.verbose });
+    await outro("Generated app icons", { startTime: perf, useSeconds: !0 });
+  });
   onUnknownSubcommand(buddy, "generate");
 }

package/dist/production-server.d.ts

@@ -18,4 +18,18 @@ export declare function resolveUserPartialsPath(cwd?: unknown, configuredDir?: s
  * it {@link resolveUserPartialsPath} falls back to the conventions.
  */
 export declare function loadStxPartialsDir(cwd?: unknown): Promise<string | undefined>;
+/**` proxy target, or `null` when it cannot be
+ * known safely.
+ *
+ * `API_URL` and `PORT_API` are explicit operator intent and always win. The
+ * framework-wide `ports.api` default is only trusted *outside* deployed
+ * environments: locally one app owns the machine, so `127.0.0.1:3008` really is
+ * its own API. On a deployed box that assumption does not hold — ts-cloud runs
+ * many SSR sites side by side, each on its own port, and an unconfigured
+ * default resolves to whichever tenant happens to own it.
+ *
+ * Returning `null` makes the caller answer 502. That is the safe failure: the
+ * alternative is proxying authenticated requests into another app's process.
+ */
+export declare function resolveApiBase(configuredPort?: number, env?: NodeJS.ProcessEnv): string | null;
 export declare function startProductionServer(options?: { port?: string | number, verbose?: boolean }): Promise<void>;

package/dist/production-server.js

@@ -89,6 +89,16 @@ function resolveCsrfMiddlewarePath() {
     return vendored;
   }
 }
+export function resolveApiBase(configuredPort, env = process.env) {
+  if (env.API_URL)
+    return env.API_URL;
+  const explicitPort = Number(env.PORT_API);
+  if (explicitPort)
+    return `http://127.0.0.1:${explicitPort}`;
+  if (["production", "staging", "development"].includes((env.APP_ENV || "").toLowerCase()))
+    return null;
+  return `http://127.0.0.1:${configuredPort || 3008}`;
+}
 export async function startProductionServer(options) {
   if (options?.port)
     process.env.PORT = String(options.port);
@@ -111,7 +121,7 @@ export async function startProductionServer(options) {
     } catch {}
   if (!stxServe)
     ({ serve: stxServe } = await import("bun-plugin-stx/serve"));
-  const stxModule = await resolveVendoredStxModule(), { site: siteConfig, i18n: i18nConfig } = await loadStxSiteConfig(), userViewsPath = "resources/views", defaultsResources = resolveDefaultsResources(), defaultViewsPath = join(defaultsResources, "views"), userLayoutsPath = existsSync("resources/views/layouts") ? "resources/views/layouts" : "resources/layouts", userPartialsPath = resolveUserPartialsPath(process.cwd(), await loadStxPartialsDir()), apiBase = process.env.API_URL || `http://127.0.0.1:${Number(process.env.PORT_API) || config.ports?.api || 3008}`;
+  const stxModule = await resolveVendoredStxModule(), { site: siteConfig, i18n: i18nConfig } = await loadStxSiteConfig(), userViewsPath = "resources/views", defaultsResources = resolveDefaultsResources(), defaultViewsPath = join(defaultsResources, "views"), userLayoutsPath = existsSync("resources/views/layouts") ? "resources/views/layouts" : "resources/layouts", userPartialsPath = resolveUserPartialsPath(process.cwd(), await loadStxPartialsDir()), apiBase = resolveApiBase(config.ports?.api);
   log.info(`Starting production server on port ${port}...`);
   await stxServe({
     patterns: [userViewsPath, defaultViewsPath],
@@ -132,13 +142,18 @@ export async function startProductionServer(options) {
       if (gated)
         return gated;
       const url = new URL(req.url);
-      if (isApiBoundRequest(req, url.pathname))
+      if (isApiBoundRequest(req, url.pathname)) {
+        if (!apiBase) {
+          log.error(`No API target configured for ${url.pathname}. This app shares its host with other ` + "deployments, so there is no safe default port to guess \u2014 refusing to proxy. Set " + "PORT_API (or API_URL) for this site, and deploy an `api` site on its own port.");
+          return new Response("Bad Gateway", { status: 502 });
+        }
         try {
           return await proxyToBackend(req, apiBase);
         } catch (error) {
           log.error(`API proxy to ${apiBase} failed: ${error.message}`);
           return new Response("Bad Gateway", { status: 502 });
         }
+      }
       if (existsSync(join(process.cwd(), "resources/views/blog.stx"))) {
         const { renderBlogFeed } = await import("@stacksjs/actions/blog"), feed = await renderBlogFeed(req);
         if (feed)

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/buddy",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.232",
+  "version": "0.70.235",
   "description": "Meet Buddy. The Stacks runtime.",
   "author": "Chris Breuer",
   "contributors": [
@@ -41,20 +41,17 @@
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
-      "development": "./src/index.ts",
       "bun": "./dist/index.js",
       "import": "./dist/index.js",
       "default": "./dist/index.js"
     },
     "./cli": {
       "types": "./dist/cli.d.ts",
-      "development": "./src/cli.ts",
       "bun": "./dist/cli.js",
       "import": "./dist/cli.js",
       "default": "./dist/cli.js"
     },
     "./*": {
-      "development": "./src/*",
       "bun": "./dist/*",
       "import": "./dist/*",
       "default": "./dist/*"
@@ -91,52 +88,53 @@
     "prepublishOnly": "bun run build"
   },
   "dependencies": {
-    "@stacksjs/actions": "^0.70.180",
-    "@stacksjs/ai": "^0.70.180",
-    "@stacksjs/alias": "^0.70.180",
-    "@stacksjs/arrays": "^0.70.180",
-    "@stacksjs/auth": "^0.70.180",
-    "@stacksjs/build": "^0.70.180",
-    "@stacksjs/cache": "^0.70.180",
-    "@stacksjs/cli": "^0.70.180",
+    "@stacksjs/actions": "^0.70.235",
+    "@stacksjs/ai": "^0.70.235",
+    "@stacksjs/alias": "^0.70.235",
+    "@stacksjs/arrays": "^0.70.235",
+    "@stacksjs/auth": "^0.70.235",
+    "@stacksjs/build": "^0.70.235",
+    "@stacksjs/cache": "^0.70.235",
+    "@stacksjs/cli": "^0.70.235",
     "@stacksjs/clapp": "^0.2.12",
-    "@stacksjs/cloud": "^0.70.180",
-    "@stacksjs/collections": "^0.70.180",
-    "@stacksjs/config": "^0.70.180",
-    "@stacksjs/database": "^0.70.180",
-    "@stacksjs/desktop": "^0.70.180",
-    "@stacksjs/dns": "^0.70.180",
-    "@stacksjs/email": "^0.70.180",
-    "@stacksjs/enums": "^0.70.180",
-    "@stacksjs/error-handling": "^0.70.180",
-    "@stacksjs/events": "^0.70.180",
-    "@stacksjs/git": "^0.70.180",
+    "@stacksjs/cloud": "^0.70.235",
+    "@stacksjs/collections": "^0.70.235",
+    "@stacksjs/config": "^0.70.235",
+    "@stacksjs/database": "^0.70.235",
+    "@stacksjs/desktop-build": "^0.70.235",
+    "@stacksjs/dns": "^0.70.235",
+    "@stacksjs/email": "^0.70.235",
+    "@stacksjs/enums": "^0.70.235",
+    "@stacksjs/error-handling": "^0.70.235",
+    "@stacksjs/events": "^0.70.235",
+    "@stacksjs/git": "^0.70.235",
     "@stacksjs/gitit": "^0.2.5",
-    "@stacksjs/health": "^0.70.180",
+    "@stacksjs/health": "^0.70.235",
     "@stacksjs/dnsx": "^0.2.3",
     "@stacksjs/httx": "^0.1.10",
-    "@stacksjs/lint": "^0.70.180",
-    "@stacksjs/logging": "^0.70.180",
-    "@stacksjs/notifications": "^0.70.180",
-    "@stacksjs/objects": "^0.70.180",
-    "@stacksjs/orm": "^0.70.180",
-    "@stacksjs/path": "^0.70.180",
-    "@stacksjs/skills": "^0.70.180",
-    "@stacksjs/payments": "^0.70.180",
-    "@stacksjs/realtime": "^0.70.180",
-    "@stacksjs/router": "^0.70.180",
+    "@stacksjs/image": "^0.70.235",
+    "@stacksjs/lint": "^0.70.235",
+    "@stacksjs/logging": "^0.70.235",
+    "@stacksjs/notifications": "^0.70.235",
+    "@stacksjs/objects": "^0.70.235",
+    "@stacksjs/orm": "^0.70.235",
+    "@stacksjs/path": "^0.70.235",
+    "@stacksjs/skills": "^0.70.235",
+    "@stacksjs/payments": "^0.70.235",
+    "@stacksjs/realtime": "^0.70.235",
+    "@stacksjs/router": "^0.70.235",
     "@stacksjs/rpx": "^0.11.42",
-    "@stacksjs/search-engine": "^0.70.180",
-    "@stacksjs/security": "^0.70.180",
-    "@stacksjs/server": "^0.70.180",
-    "@stacksjs/storage": "^0.70.180",
-    "@stacksjs/strings": "^0.70.180",
-    "@stacksjs/testing": "^0.70.180",
-    "@stacksjs/tunnel": "^0.70.180",
-    "@stacksjs/types": "^0.70.180",
-    "@stacksjs/ui": "^0.70.180",
-    "@stacksjs/utils": "^0.70.180",
-    "@stacksjs/validation": "^0.70.180",
+    "@stacksjs/search-engine": "^0.70.235",
+    "@stacksjs/security": "^0.70.235",
+    "@stacksjs/server": "^0.70.235",
+    "@stacksjs/storage": "^0.70.235",
+    "@stacksjs/strings": "^0.70.235",
+    "@stacksjs/testing": "^0.70.235",
+    "@stacksjs/tunnel": "^0.70.235",
+    "@stacksjs/types": "^0.70.235",
+    "@stacksjs/ui": "^0.70.235",
+    "@stacksjs/utils": "^0.70.235",
+    "@stacksjs/validation": "^0.70.235",
     "@stacksjs/ts-cloud": "^0.7.92",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",