@stacksjs/buddy 0.70.294 → 0.70.295

package/dist/commands/deploy.js

@@ -187,8 +187,27 @@ fi
 # renewed in place, was actively harmful: each extra name made the renewal open
 # another certificate file, and two files sharing a CN meant one overwrote the
 # other.
+#
+# The CLI is resolved rather than hardcoded. This step used to run
+# 'cd /opt/tlsx && bun run packages/tlsx/bin/cli.ts', which requires a source
+# checkout at one exact path and silently does nothing when it is absent -
+# there is no other way to satisfy the guard. On the box this was found on, that
+# checkout had been pinned to a two-month-old tag nobody was updating, so the
+# deploy kept invoking a build whose renewal logic had a known data-loss bug.
+# Preferring an installed 'tlsx' on PATH lets a package manager own the version;
+# the checkout stays as the fallback so existing boxes keep working.
+tlsx_cli() {
+  if command -v tlsx >/dev/null 2>&1; then
+    tlsx "$@"
+  else
+    (cd /opt/tlsx && /usr/local/bin/bun run packages/tlsx/bin/cli.ts "$@")
+  fi
+}
+have_tlsx() {
+  command -v tlsx >/dev/null 2>&1 || { [ -x /usr/local/bin/bun ] && [ -f /opt/tlsx/packages/tlsx/bin/cli.ts ]; }
+}
 CERTFILE=/etc/bun-gateway/certs/mail.stacksjs.com.crt
-if [ -n "$DOMAIN" ] && [ -f "$CERTFILE" ] && [ -d /opt/tlsx ]; then
+if [ -n "$DOMAIN" ] && [ -f "$CERTFILE" ] && have_tlsx; then
   MAILHOSTNAME="mail.$DOMAIN"
   CERTNAME=$(basename "$CERTFILE" .crt)
   CERTKEY=/etc/bun-gateway/certs/mail.stacksjs.com.key
@@ -203,7 +222,7 @@ if [ -n "$DOMAIN" ] && [ -f "$CERTFILE" ] && [ -d /opt/tlsx ]; then
       SAFE=$(mktemp -d)
       cp -a "$CERTFILE" "$SAFE/cert" 2>/dev/null || true
       cp -a "$CERTKEY" "$SAFE/key" 2>/dev/null || true
-      if (cd /opt/tlsx && /usr/local/bin/bun run packages/tlsx/bin/cli.ts acme:issue -d "$ALL" --cert-name "$CERTNAME" --method http-01 --webroot /var/www/acme-challenge --dir /etc/bun-gateway/certs --prod) >/tmp/.mailtenant-cert 2>&1; then
+      if tlsx_cli acme:issue -d "$ALL" --cert-name "$CERTNAME" --method http-01 --webroot /var/www/acme-challenge --dir /etc/bun-gateway/certs --prod >/tmp/.mailtenant-cert 2>&1; then
         # Verify rather than assume. The old code reported CERTHOST on a zero
         # exit alone, which is how an issuance that wrote somewhere else was
         # reported as "added to the mail certificate" for weeks.

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/buddy",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.294",
+  "version": "0.70.295",
   "description": "Meet Buddy. The Stacks runtime.",
   "author": "Chris Breuer",
   "contributors": [
@@ -95,53 +95,53 @@
     "prepublishOnly": "bun run build"
   },
   "dependencies": {
-    "@stacksjs/actions": "^0.70.294",
-    "@stacksjs/ai": "^0.70.294",
-    "@stacksjs/alias": "^0.70.294",
-    "@stacksjs/arrays": "^0.70.294",
-    "@stacksjs/auth": "^0.70.294",
-    "@stacksjs/build": "^0.70.294",
-    "@stacksjs/cache": "^0.70.294",
-    "@stacksjs/cli": "^0.70.294",
+    "@stacksjs/actions": "^0.70.295",
+    "@stacksjs/ai": "^0.70.295",
+    "@stacksjs/alias": "^0.70.295",
+    "@stacksjs/arrays": "^0.70.295",
+    "@stacksjs/auth": "^0.70.295",
+    "@stacksjs/build": "^0.70.295",
+    "@stacksjs/cache": "^0.70.295",
+    "@stacksjs/cli": "^0.70.295",
     "@stacksjs/clapp": "^0.2.12",
-    "@stacksjs/cloud": "^0.70.294",
-    "@stacksjs/collections": "^0.70.294",
-    "@stacksjs/config": "^0.70.294",
-    "@stacksjs/database": "^0.70.294",
-    "@stacksjs/desktop-build": "^0.70.294",
-    "@stacksjs/dns": "^0.70.294",
-    "@stacksjs/email": "^0.70.294",
-    "@stacksjs/enums": "^0.70.294",
-    "@stacksjs/error-handling": "^0.70.294",
-    "@stacksjs/events": "^0.70.294",
-    "@stacksjs/git": "^0.70.294",
+    "@stacksjs/cloud": "^0.70.295",
+    "@stacksjs/collections": "^0.70.295",
+    "@stacksjs/config": "^0.70.295",
+    "@stacksjs/database": "^0.70.295",
+    "@stacksjs/desktop-build": "^0.70.295",
+    "@stacksjs/dns": "^0.70.295",
+    "@stacksjs/email": "^0.70.295",
+    "@stacksjs/enums": "^0.70.295",
+    "@stacksjs/error-handling": "^0.70.295",
+    "@stacksjs/events": "^0.70.295",
+    "@stacksjs/git": "^0.70.295",
     "@stacksjs/gitit": "^0.2.5",
-    "@stacksjs/health": "^0.70.294",
+    "@stacksjs/health": "^0.70.295",
     "@stacksjs/dnsx": "^0.2.3",
     "@stacksjs/httx": "^0.1.10",
-    "@stacksjs/image": "^0.70.294",
-    "@stacksjs/lint": "^0.70.294",
-    "@stacksjs/logging": "^0.70.294",
-    "@stacksjs/notifications": "^0.70.294",
-    "@stacksjs/objects": "^0.70.294",
-    "@stacksjs/orm": "^0.70.294",
-    "@stacksjs/path": "^0.70.294",
-    "@stacksjs/skills": "^0.70.294",
-    "@stacksjs/payments": "^0.70.294",
-    "@stacksjs/realtime": "^0.70.294",
-    "@stacksjs/router": "^0.70.294",
+    "@stacksjs/image": "^0.70.295",
+    "@stacksjs/lint": "^0.70.295",
+    "@stacksjs/logging": "^0.70.295",
+    "@stacksjs/notifications": "^0.70.295",
+    "@stacksjs/objects": "^0.70.295",
+    "@stacksjs/orm": "^0.70.295",
+    "@stacksjs/path": "^0.70.295",
+    "@stacksjs/skills": "^0.70.295",
+    "@stacksjs/payments": "^0.70.295",
+    "@stacksjs/realtime": "^0.70.295",
+    "@stacksjs/router": "^0.70.295",
     "@stacksjs/rpx": "^0.11.42",
-    "@stacksjs/search-engine": "^0.70.294",
-    "@stacksjs/security": "^0.70.294",
-    "@stacksjs/server": "^0.70.294",
-    "@stacksjs/storage": "^0.70.294",
-    "@stacksjs/strings": "^0.70.294",
-    "@stacksjs/testing": "^0.70.294",
-    "@stacksjs/tunnel": "^0.70.294",
-    "@stacksjs/types": "^0.70.294",
-    "@stacksjs/ui": "^0.70.294",
-    "@stacksjs/utils": "^0.70.294",
-    "@stacksjs/validation": "^0.70.294",
+    "@stacksjs/search-engine": "^0.70.295",
+    "@stacksjs/security": "^0.70.295",
+    "@stacksjs/server": "^0.70.295",
+    "@stacksjs/storage": "^0.70.295",
+    "@stacksjs/strings": "^0.70.295",
+    "@stacksjs/testing": "^0.70.295",
+    "@stacksjs/tunnel": "^0.70.295",
+    "@stacksjs/types": "^0.70.295",
+    "@stacksjs/ui": "^0.70.295",
+    "@stacksjs/utils": "^0.70.295",
+    "@stacksjs/validation": "^0.70.295",
     "@stacksjs/ts-cloud": "^0.7.103",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",