@stacksjs/ts-cloud 0.16.93 → 0.16.94

package/dist/chunk-4khjjgd3.js

@@ -1 +0,0 @@
-import{uu}from"./chunk-kcem6dzk.js";export{uu as assertComputeResidency};

package/dist/chunk-872fdms3.js

@@ -1 +0,0 @@
-import{wc}from"./chunk-c6kb5c5v.js";import"./chunk-hcbrgyfz.js";import"./chunk-7d9ek8rc.js";import"./chunk-72p2tdpe.js";import"./chunk-sjfc9my3.js";export{wc as buildAndPushServerlessImage};

package/dist/chunk-bazah9w0.js

@@ -1 +0,0 @@
-import{ie}from"./chunk-h6kptkce.js";import"./chunk-7d9ek8rc.js";import"./chunk-72p2tdpe.js";import"./chunk-sjfc9my3.js";export{ie as RDSClient};

package/dist/chunk-dmv3vryr.js

@@ -1,138 +0,0 @@
-import{un,fr}from"./chunk-72p2tdpe.js";import{Wr,d}from"./chunk-x7cnfn7y.js";import{isIP as A}from"node:net";var yo="/etc/rpx/certs",N="/etc/rpx/local-ca",k="rpx-root-ca.crt";function So(e=N){return`${e.replace(/\/+$/,"")}/${k}`}function Io(e){if(e.toLowerCase().endsWith(".local"))return!1;return e.split(".").length===2}function bo(e,t={}){let r=new Set;for(let o of Object.values(e)){if(!o?.domain)continue;if(d(o)==="bucket")continue;r.add(o.domain)}let n=new Set;for(let o of Object.values(e)){if(!o?.domain||d(o)==="bucket")continue;for(let u of o.aliases??[]){let i=String(u).trim().toLowerCase();if(i&&i!==o.domain)n.add(i)}}if(t.autoWww!==!1)for(let o of[...r]){if(!Io(o))continue;r.add(`www.${o}`)}for(let o of n)r.add(o);return[...r]}var B=["1.1.1.1","8.8.8.8"],I="/var/www/acme-challenge";function W(e){if(typeof e==="string")return{to:e};let t={to:e.to};if(e.status!=null)t.status=e.status;if(e.preservePath!=null)t.preservePath=e.preservePath;return t}function G(e){let t=e.auth;if(!t||t.enabled===!1||!t.password)return;return{username:t.username||"admin",password:t.password,...t.realm?{realm:t.realm}:{}}}function yd(e){if(!e)return;return e.tls??"local-ca"}function Np(e,t){if(e.cloud?.provider!=="ssh")return;let r=e.ssh?.lan;if(!r)return;return{...r.hostname?{hostname:r.hostname}:{},tls:r.tls??"local-ca",...t?{ip:t}:{}}}function Bp(e){if(e.cloud?.provider!=="ssh")return;return e.ssh?.profile}function U(e){let t=e.trim().toLowerCase();if(!t||t.startsWith("*")||t.includes(":")||t.includes("/")||t.includes(" "))return!1;if(A(t)!==0)return!1;return t.endsWith(".local")||!t.includes(".")}function X(e,t,r){let n=[],o=new Set,u=(g,a)=>{let p=g.trim().toLowerCase();if(!p||o.has(p))return;o.add(p),n.push({host:p,source:a})},i=t.hostname?.trim(),c=(i||`${r}.local`).toLowerCase();if(u(c,i?"ssh.lan.hostname":`the ssh provider's default LAN name for project "${r}"`),Object.entries(e).some(([g,a])=>!!a&&fr(g)))u(`dashboard.${c}`,"the management dashboard site");for(let[g,a]of Object.entries(e)){if(!a?.domain)continue;if(d(a)==="bucket")continue;if(!U(a.domain))continue;u(a.domain,`site "${g}"`)}return n}function F(e,t){if(!t?.length)return;return t.find((r)=>{let n=(r.startsWith(".")?r.slice(1):r).toLowerCase();return e===n||e.endsWith(`.${n}`)})}function j(e,t){if(!t?.enabled)return;for(let{host:r,source:n}of e){let o=F(r,t.allowedSuffixes);if(!o)continue;throw Error(`The LAN certificate authority and public on-demand TLS both claim "${r}". LAN source: ${n}. Public source: the on-demand TLS allowed suffix "${o}", which is derived from the site domains. A host is either LAN-only, with a certificate signed by the box's own CA, or public, with one issued by Let's Encrypt, never both. Give the LAN a name no site domain covers (ssh.lan.hostname), or take that domain out of the sites this deploy routes.`)}}function H(e){let t=e.split(".");return t.length>=3&&t[0]==="*"&&t.slice(1).every((r)=>/^[a-z0-9-]+$/i.test(r))}function O(e,t={}){let{wildcardCerts:r,...n}=e;return JSON.stringify({...t,...n},null,2)}function lA(e){if(!e||e==="/")return;let t=`/${e}`.replace(/\/+/g,"/").replace(/\/+$/,"");if(!t.startsWith("/"))t=`/${t}`;return t===""||t==="/"?void 0:t}function Sd(e,t){let n=(t?`${e}${t}`:e).replace(/[^a-zA-Z0-9._-]+/g,"-").replace(/^-+|-+$/g,"").slice(0,128);return n.length>0?n:"rpx"}function Y(e,t){if(!t||t.length===0)return`localhost:${e}`;return t.map((r)=>`${r.privateIp??r.publicIp}:${e}`)}function M(e,t,r){let n=(t.wwwRoot??"/var/www").replace(/\/+$/,""),o=t.slug??"app",u=t.proxy.certsDir??yo,i=t.proxy.loadBalancer,c=[],f=new Set,g=new Map;for(let[l,s]of Object.entries(e)){if(!s||!s.domain)continue;let y=d(s);if(y==="bucket")continue;let E=c.length,T=[...new Set((s.aliases??[]).map((m)=>String(m).trim().toLowerCase()).filter((m)=>m&&m!==s.domain))],v=()=>{let m=c.slice(E).filter((h)=>h.to===s.domain);for(let h of T){for(let P of m)c.push({...P,to:h,id:Sd(h,P.path)});if(H(h)){if(!g.has(h))g.set(h,{domain:h,dnsEnvFile:`${n}/${o}-${l}/shared/.env`})}else f.add(h)}},S=lA(s.path),_=Sd(s.domain,S),C=G(s);if(y==="redirect"){c.push({to:s.domain,path:S,redirect:W(s.redirect),id:_,...C?{auth:C}:{}}),f.add(s.domain),v();continue}if(y==="proxy"){let m=Wr(s);if(m.length===0)continue;let h=m.length===1?m[0]:m;c.push({to:s.domain,path:S,from:h,id:_,...C?{auth:C}:{},...Array.isArray(h)&&i?{loadBalancer:i}:{}}),f.add(s.domain),v();continue}if(y==="server-app"){if(typeof s.port!=="number")continue;let m=Y(s.port,r);c.push({to:s.domain,path:S,from:m,id:_,...C?{auth:C}:{},...Array.isArray(m)&&i?{loadBalancer:i}:{}})}else c.push({to:s.domain,path:S,static:{dir:`${n}/${o}-${l}/current`,spa:s.spa??!1,pathRewriteStyle:s.pathRewriteStyle??"directory"},cleanUrls:s.pathRewriteStyle!=="flat",...C?{auth:C}:{},id:_});f.add(s.domain),v()}if(t.proxy.autoWww!==!1)for(let l of[...f]){if(!Io(l))continue;let s=`www.${l}`;if(f.has(s))continue;c.push({to:s,redirect:{to:`https://${l}`},id:Sd(s)}),f.add(s)}c.sort((l,s)=>{if(l.to!==s.to)return l.to.localeCompare(s.to);return(s.path?.length??0)-(l.path?.length??0)});let a={proxies:c,productionCerts:{certsDir:u,certsDirServerNames:[...f,...g.keys()]},https:!0,hostsManagement:!1,cleanup:{hosts:!1,certs:!1},...g.size>0?{wildcardCerts:[...g.values()]}:{}};if(t.proxy.onDemandTls&&f.size>0)a.onDemandTls={enabled:!0,allowedSuffixes:[...f],email:t.proxy.onDemandTlsEmail,certsDir:u,staging:t.proxy.onDemandTlsStaging??!1};if(t.proxy.onDemandTls)a.acmeChallengeWebroot=t.proxy.acmeWebroot??I;let p=t.proxy.cdn,w=p?.frontedHosts?.length?p.frontedHosts:[...f];if(p?.secret&&w.length>0)a.originGuard={header:p.secretHeader??"X-Origin-Verify",value:p.secret,hosts:w};if(t.lan)if(yd(t.lan)==="off")a.https=!1;else{let l=X(e,t.lan,o);j(l,a.onDemandTls);let s=t.lan.ip&&A(t.lan.ip)!==0?[t.lan.ip]:[];a.localCa={dir:N,hosts:l.map((y)=>y.host),...s.length>0?{ips:s}:{},installTrust:!0}}return a}function x(e,t){return M({...e,...t.mail?un(t.mail):{}},t)}function nr(e,t,r){return M({...e,...r.mail?un(r.mail):{}},r,t)}function HI(e){return`// Generated by ts-cloud — rpx reverse-proxy gateway.
-// Routes are derived from the \`sites\` model on every \`buddy deploy\`.
-import { startProxies } from '@stacksjs/rpx'
-
-const config = ${O(e)} as const
-
-// Verbose is the hard default for ts-cloud-installed gateways (RPX_VERBOSE=false
-// opts out) — without it rpx's TLS/routing diagnostics never reach the journal.
-await startProxies({ verbose: process.env.RPX_VERBOSE !== 'false', ...config } as any)
-`}function z(e){return e?.webServer==="rpx"||e?.proxy?.engine==="rpx"}var Co="/etc/rpx",R="/opt/rpx-gateway",xp="/etc/rpx/gateway.ts",vt="/etc/rpx/gateway",Je="rpx-gateway.service",K="/etc/rpx/sites.d";function J(e=K,t=yo){return`// Generated by ts-cloud — rpx gateway assembler.
-// Merges every app's fragment in ${e} so independent deploys compose
-// without clobbering each other. Each deploy writes only its own <slug>.json.
-import { startProxies } from '@stacksjs/rpx'
-import { readdirSync, readFileSync } from 'node:fs'
-
-const dir = ${JSON.stringify(e)}
-const proxies = []
-const seen = new Set()
-const owners = new Map()
-const suffixes = new Set()
-const guardHosts = new Set()
-let email
-let certsDir = ${JSON.stringify(t)}
-let acmeChallengeWebroot
-let guard
-let anyProduction = false
-// LAN certificate authority, unioned across fragments. It is gateway-wide, but
-// it is carried per fragment because THIS file is rewritten wholesale by every
-// deploy on the box: a co-tenant's deploy would erase a CA baked in here, while
-// a fragment belongs to the project that configured it.
-let localCa
-const localCaHosts = new Set()
-const localCaIps = new Set()
-// TLS stays on unless every fragment asks for plain HTTP.
-let fragmentCount = 0
-let anyTls = false
-let files = []
-try { files = readdirSync(dir).filter(n => n.endsWith('.json')).sort() } catch {}
-for (const f of files) {
-  let frag
-  // Fragments are written atomically (temp + rename by ts-cloud), so a parse
-  // failure here means a genuinely corrupt fragment, not a mid-write read. Log
-  // it LOUD — a silent skip drops that app's whole host from the routing table,
-  // which then answers 404 until someone notices. We still continue so one bad
-  // fragment can't take every other app down, but the drop is now visible.
-  try { frag = JSON.parse(readFileSync(dir + '/' + f, 'utf8')) }
-  catch (err) { console.error('[rpx-assembler] SKIPPING malformed fragment ' + f + ' — its host(s) will 404 until fixed: ' + err); continue }
-  fragmentCount++
-  if (frag.https !== false) anyTls = true
-  if (frag.localCa) {
-    if (!localCa) localCa = { dir: frag.localCa.dir }
-    else if (frag.localCa.dir !== localCa.dir) console.warn('[rpx-assembler] ' + f + ' asks for a local CA in ' + frag.localCa.dir + '; the box already uses ' + localCa.dir + ', so its hosts join that CA instead')
-    for (const h of frag.localCa.hosts ?? []) localCaHosts.add(h)
-    for (const ip of frag.localCa.ips ?? []) localCaIps.add(ip)
-    if (frag.localCa.installTrust) localCa.installTrust = true
-    if (localCa.validityDays === undefined) localCa.validityDays = frag.localCa.validityDays
-    if (localCa.renewBeforeDays === undefined) localCa.renewBeforeDays = frag.localCa.renewBeforeDays
-  }
-  for (const p of frag.proxies ?? []) {
-    const key = p.id || (p.to + (p.path ?? ''))
-    if (seen.has(key)) {
-      console.warn('[rpx-assembler] duplicate route ' + key + ' in ' + f + ' ignored; first declared by ' + owners.get(key))
-      continue
-    }
-    seen.add(key)
-    owners.set(key, f)
-    proxies.push(p)
-  }
-  for (const s of frag.onDemandTls?.allowedSuffixes ?? []) suffixes.add(s)
-  email ??= frag.onDemandTls?.email
-  // One gateway, one ACME directory: production wins any disagreement between
-  // co-tenants, and a fragment predating the flag counts as production. A
-  // staging cert chains to an untrusted root, so defaulting the other way
-  // breaks every client of every tenant that wanted a real cert.
-  if (frag.onDemandTls && frag.onDemandTls.staging !== true) anyProduction = true
-  if (frag.productionCerts?.certsDir) certsDir = frag.productionCerts.certsDir
-  acmeChallengeWebroot ??= frag.acmeChallengeWebroot
-  if (frag.originGuard) {
-    // One gateway means one origin-guard secret (rpx takes a single
-    // header/value). A tenant whose secret disagrees with the adopted one must
-    // NOT have its hosts guarded: its CDN would send a different value, the
-    // gateway would reject every request, and a working host would go dark.
-    // Unguarded is weaker but serving, and the mismatch is logged.
-    guard ??= { header: frag.originGuard.header, value: frag.originGuard.value }
-    if (frag.originGuard.header === guard.header && frag.originGuard.value === guard.value) {
-      for (const h of frag.originGuard.hosts ?? []) guardHosts.add(h)
-    }
-    else {
-      console.warn('[rpx-assembler] origin-guard secret in ' + f + ' differs from the one already in force; its hosts stay unguarded rather than rejecting all traffic')
-    }
-  }
-}
-if (localCa) {
-  localCa.hosts = [...localCaHosts]
-  if (localCaIps.size > 0) localCa.ips = [...localCaIps]
-}
-const config = {
-  proxies,
-  productionCerts: {
-    certsDir,
-    // A shared host's cert directory also contains mail and retired-site PEMs.
-    // Keep those files on disk for their owners, but do not turn them into live
-    // OpenSSL SNI contexts when no current route can select them.
-    certsDirServerNames: [...new Set(proxies.map(p => p.to).filter(Boolean))],
-  },
-  https: fragmentCount === 0 ? true : anyTls,
-  hostsManagement: false,
-  cleanup: { hosts: false, certs: false },
-  // Verbose is the hard default for ts-cloud-installed gateways: without it,
-  // rpx's TLS/routing diagnostics (tlsx on-demand 'refused issuance',
-  // 'issuance failed', 'adopted existing on-disk cert') never reach the systemd
-  // journal and a production TLS failure looks like "nothing happens". Silence
-  // it by setting RPX_VERBOSE=false on the systemd unit.
-  verbose: process.env.RPX_VERBOSE !== 'false',
-  ...(suffixes.size > 0 ? { onDemandTls: { enabled: true, allowedSuffixes: [...suffixes], email, certsDir, staging: !anyProduction } } : {}),
-  ...(acmeChallengeWebroot ? { acmeChallengeWebroot } : {}),
-  ...(guard ? { originGuard: { header: guard.header, value: guard.value, hosts: [...guardHosts] } } : {}),
-  ...(localCa && localCa.hosts.length > 0 ? { localCa } : {}),
-}
-
-await startProxies(config)
-`}function b(e,t,r,n="0644"){return[`__tsc_tmp="$(mktemp "${e}.XXXXXX")"`,`cat > "$__tsc_tmp" <<'${r}'`,t,r,`mv -f "$__tsc_tmp" ${e}`,`chmod ${n} ${e}`]}function q(e){return`'${e.replaceAll("'","'\\''")}'`}function D(e,t,r,n){if(!n.preserveManagementDashboardRoutes)return b(e,t,r,"0600");let o=`
-const { readFileSync, writeFileSync } = require('node:fs')
-const currentPath = process.env.TS_CLOUD_RPX_CURRENT_FRAGMENT
-const candidatePath = process.env.TS_CLOUD_RPX_CANDIDATE_FRAGMENT
-const isDashboard = route => /^(?:dashboard|cloud)\\./i.test(String(route?.to || ''))
-const current = JSON.parse(readFileSync(currentPath, 'utf8'))
-const candidate = JSON.parse(readFileSync(candidatePath, 'utf8'))
-const retained = Array.isArray(current.proxies) ? current.proxies.filter(isDashboard) : []
-const next = Array.isArray(candidate.proxies) ? candidate.proxies.filter(route => !isDashboard(route)) : []
-candidate.proxies = [...next, ...retained]
-writeFileSync(candidatePath, JSON.stringify(candidate, null, 2) + '\\n', { mode: 0o600 })
-`.trim();return[`__tsc_fragment_candidate="$(mktemp "${e}.candidate.XXXXXX")"`,`cat > "$__tsc_fragment_candidate" <<'${r}'`,t,r,'chmod 0600 "$__tsc_fragment_candidate"',`if [ -f ${e} ]; then TS_CLOUD_RPX_CURRENT_FRAGMENT=${e} TS_CLOUD_RPX_CANDIDATE_FRAGMENT="$__tsc_fragment_candidate" ${n.bunBin} -e ${q(o)}; fi`,`mv -f "$__tsc_fragment_candidate" ${e}`,`chmod 0600 ${e}`]}var Q={high:"256M",max:"384M"},Z={high:"512M",max:"768M"};function Id(e){return`rpx-cert-renew-${(e||"app").replace(/[^a-z0-9._-]+/gi,"-")}.service`}function bd(e){let t=new Set;for(let r of e.proxies){let n=r.to;if(!n||n.startsWith("*")||n.includes(":")||!n.includes("."))continue;t.add(n)}return[...t]}function ee(e){if(e.length===0)return[];let t=["# Wildcards: dns-01 (Porkbun), keys read from the site's env file for tlsx alone.","dns_env() {",'  [ -r "$1" ] || return 0',`  sed -n "s/^$2=//p" "$1" | tail -n 1 | sed -e 's/^"\\(.*\\)"$/\\1/' -e "s/^'\\(.*\\)'$/\\1/"`,"}","wildcard() {",'  apex="$1"','  envfile="$2"','  name="*.$apex"','  key=$(dns_env "$envfile" PORKBUN_API_KEY)','  secret=$(dns_env "$envfile" PORKBUN_SECRET_KEY)','  if [ -z "$key" ] || [ -z "$secret" ]; then','    echo "wildcard $name skipped: no PORKBUN_API_KEY / PORKBUN_SECRET_KEY in $envfile (non-fatal)"',"    return 0","  fi",'  if [ ! -s "$CERTS/_wildcard.$apex.crt" ]; then','    PORKBUN_API_KEY="$key" PORKBUN_SECRET_KEY="$secret" $TLSX acme:issue -d "$name" --method dns-01 --dns-provider porkbun --dir "$CERTS" --prod --email "$EMAIL" || echo "issue $name failed (non-fatal)"',"  else",'    PORKBUN_API_KEY="$key" PORKBUN_SECRET_KEY="$secret" $TLSX acme:renew --domains "$name" --method dns-01 --dir "$CERTS" --days 30 --prod --email "$EMAIL" || echo "renew $name failed (non-fatal)"',"  fi","}"];for(let r of e){let n=r.domain.replace(/^\*\./,"");t.push(`wildcard '${n}' '${r.dnsEnvFile.replace(/'/g,"")}'`)}return t}function L(e){let{config:t,proxy:r}=e,n=t.acmeChallengeWebroot,o=bd(t);if(!r.onDemandTls||!n||o.length===0)return[];let u=e.bunBin??"/usr/local/bin/bun",i=r.tlsxVersion??"latest",c=t.productionCerts.certsDir,f=r.onDemandTlsEmail??`webmaster@${o[0]}`,g=`${u} ${R}/node_modules/@stacksjs/tlsx/dist/bin/cli.js`,a=o.join(","),p=o.join(" "),w=(e.slug||"app").replace(/[^a-z0-9._-]+/gi,"-"),l=`${Co}/renew-certs-${w}.sh`,s=Id(w),y=`rpx-cert-renew-${w}.timer`,E=t.wildcardCerts??[],T=E.length>0?"tlsx http-01 + dns-01 wildcard":"tlsx http-01",v=["#!/bin/sh",`# Generated by ts-cloud — issue/renew rpx gateway TLS certs via ${T}.`,"# The running gateway serves the challenge from $WEBROOT on :80, so this needs","# no downtime and no DNS credentials. Reloads the gateway only if a cert changed.","set -u",`CERTS='${c}'`,`WEBROOT='${n}'`,`EMAIL='${f}'`,`TLSX="${g}"`,`BUN='${u}'`,`DOMAINS='${a}'`,"DNS_ATTEMPTS='24'","DNS_DELAY_SECONDS='5'",`DNS_RESOLVERS='${B.join(" ")}'`,"dns_resolves() {",'  d="$1"',"  for ns in $DNS_RESOLVERS; do",`    if $BUN --eval "const{Resolver}=require('node:dns');const r=new Resolver();r.setServers([process.argv[1]]);r.resolve4(process.argv[2],e=>process.exit(e?1:0))" "$ns" "$d" >/dev/null 2>&1; then`,"      return 0","    fi","  done",'  getent ahosts "$d" >/dev/null 2>&1',"}","wait_for_dns() {",'  d="$1"',"  attempt=1",'  while ! dns_resolves "$d"; do','    if [ "$attempt" -ge "$DNS_ATTEMPTS" ]; then','      echo "DNS for $d did not become resolvable after $DNS_ATTEMPTS attempts" >&2',"      return 1","    fi",'    echo "Waiting for public DNS before ACME: $d (attempt $attempt/$DNS_ATTEMPTS)"','    sleep "$DNS_DELAY_SECONDS"',"    attempt=$((attempt + 1))","  done","}",'before=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)',`for d in ${p}; do`,'  if [ ! -s "$CERTS/$d.crt" ]; then','    if wait_for_dns "$d"; then','      $TLSX acme:issue -d "$d" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --prod --email "$EMAIL" || echo "issue $d failed (non-fatal)"',"    else",'      echo "issue $d skipped until DNS resolves (non-fatal)"',"    fi","    # rpx reloads its SNI set when a PEM appears. Complete that reload","    # before the next hostname starts http-01, or :80 can disappear in","    # the middle of the following challenge on a multi-domain deploy.",`    [ -s "$CERTS/$d.crt" ] && systemctl restart ${Je}`,"  fi","done",'$TLSX acme:renew --domains "$DOMAINS" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --days 30 --prod --email "$EMAIL" || echo "renew: some domains failed (non-fatal)"',...ee(E),'rm -f "$CERTS"/*.chain.crt','after=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)',`[ "$before" = "$after" ] || systemctl restart ${Je}`].join(`
-`),S=["[Unit]",`Description=Issue/renew rpx gateway TLS certs for ${w} (${T})`,`After=network-online.target ${Je}`,"Wants=network-online.target","","[Service]","Type=oneshot",`ExecStart=${l}`].join(`
-`),_=["[Unit]",`Description=Daily rpx gateway TLS cert issuance/renewal for ${w}`,"","[Timer]","OnCalendar=*-*-* 03:30:00","RandomizedDelaySec=1h","Persistent=true","","[Install]","WantedBy=timers.target"].join(`
-`);return[`mkdir -p ${n}`,...e.tenant?[]:[`(cd ${R} && ${u} add @stacksjs/tlsx@${i}) || true`],...b(l,v,"TS_CLOUD_RENEW_EOF"),`chmod +x ${l}`,...b(`/etc/systemd/system/${s}`,S,"TS_CLOUD_RENEW_SVC_EOF"),...b(`/etc/systemd/system/${y}`,_,"TS_CLOUD_RENEW_TIMER_EOF"),"systemctl daemon-reload",`systemctl enable --now ${y} || true`,`${l} || true`]}function V(e){let{config:t,proxy:r}=e,n=e.bunBin??"/usr/local/bin/bun",o=r.version??"latest",u=t.productionCerts.certsDir,i=(e.slug||"app").replace(/[^a-z0-9._-]+/gi,"-"),c=O(t,{slug:i}),f=J(K,u);if(e.tenant)return["set -euo pipefail",`if [ ! -x ${vt} ] || [ ! -d ${R}/node_modules/@stacksjs/rpx ]; then`,`  echo "ts-cloud: no rpx gateway on this box. This project attaches to another project's compute, so it does not provision one - deploy the owning project first." >&2`,"  exit 1","fi",`mkdir -p ${K} ${u}`,`__tsc_rpx_before="$(sha256sum ${K}/${i}.json 2>/dev/null | cut -d' ' -f1 || true)"`,...D(`${K}/${i}.json`,c,"TS_CLOUD_RPX_FRAGMENT_EOF",{bunBin:n,preserveManagementDashboardRoutes:e.preserveManagementDashboardRoutes}),`__tsc_rpx_after="$(sha256sum ${K}/${i}.json 2>/dev/null | cut -d' ' -f1 || true)"`,`if [ "$__tsc_rpx_before" != "$__tsc_rpx_after" ] || ! systemctl is-active --quiet ${Je}; then`,`  systemctl restart ${Je}`,"else",`  echo "[ts-cloud] rpx routes for ${i} unchanged - leaving the shared gateway alone"`,"fi",...L(e)];let a=[`Environment=RPX_UPSTREAM_TIMEOUT=${r.upstreamTimeout??60}`];if(typeof r.maxUpstreamConns==="number")a.push(`Environment=RPX_MAX_UPSTREAM_CONNS=${r.maxUpstreamConns}`);let p=e.profile==="raspberry-pi"?Q:Z,w=r.memoryHigh??p.high,l=r.memoryMax??p.max;return["set -euo pipefail",`mkdir -p ${Co} ${K} ${u} ${R}`,`rm -rf ${R}.next ${R}.prev`,`mkdir -p ${R}.next`,`(cd ${R}.next && ${n} add @stacksjs/rpx@${o})`,`mv ${R} ${R}.prev`,`mv ${R}.next ${R}`,`rm -rf ${R}.prev`,`ln -sfn ${R}/node_modules ${Co}/node_modules`,...D(`${K}/${i}.json`,c,"TS_CLOUD_RPX_FRAGMENT_EOF",{bunBin:n,preserveManagementDashboardRoutes:e.preserveManagementDashboardRoutes}),...b(xp,f,"TS_CLOUD_RPX_EOF"),`${n} build --production --compile --outfile ${vt}.next ${xp}`,`chmod 0755 ${vt}.next`,`mv -f ${vt}.next ${vt}`,...b(`/etc/systemd/system/${Je}`,["[Unit]","Description=rpx reverse-proxy gateway (managed by ts-cloud)","After=network.target network-online.target","Wants=network-online.target","","[Service]","Type=simple",`ExecStart=${vt}`,`WorkingDirectory=${R}`,"Environment=BUN_INSTALL=/root/.bun","Environment=APP_ENV=production","Environment=NODE_ENV=production",...a,"MemoryAccounting=true",`MemoryHigh=${w}`,`MemoryMax=${l}`,"CPUWeight=500","IOWeight=500","OOMPolicy=stop","Restart=always","RestartSec=5","StartLimitIntervalSec=120","StartLimitBurst=5",`ExecStartPre=/bin/sh -c 'for p in 80 443; do fuser -k -n tcp "$p" 2>/dev/null || true; done; sleep 1'`,"LimitNOFILE=1048576","AmbientCapabilities=CAP_NET_BIND_SERVICE","","[Install]","WantedBy=multi-user.target"].join(`
-`),"TS_CLOUD_RPX_UNIT_EOF"),"systemctl daemon-reload","systemctl disable --now bun-gateway.service 2>/dev/null || true","systemctl disable --now bun-gateway-renew.timer bun-gateway-renew.service 2>/dev/null || true","rm -f /etc/systemd/system/bun-gateway-renew.timer /etc/systemd/system/bun-gateway-renew.service","systemctl disable --now ts-cloud-nginx.service 2>/dev/null || true",`for timer in /etc/systemd/system/rpx-cert-renew-*.timer; do [ -e "$timer" ] || continue; unit="$(basename "$timer")"; tenant="\${unit#rpx-cert-renew-}"; tenant="\${tenant%.timer}"; [ -f "${K}/$tenant.json" ] && continue; systemctl disable --now "$unit" 2>/dev/null || true; rm -f "$timer" "/etc/systemd/system/rpx-cert-renew-$tenant.service" "${Co}/renew-certs-$tenant.sh"; done`,`systemctl enable ${Je}`,`systemctl restart ${Je}`,...L(e)]}function xe(e){let t=(e.slug||"app").replace(/[^a-z0-9._-]+/gi,"-"),r=O(e.config,{slug:t});return["set -euo pipefail",`mkdir -p ${K}`,...D(`${K}/${t}.json`,r,"TS_CLOUD_RPX_FRAGMENT_EOF",{bunBin:"/usr/local/bin/bun",preserveManagementDashboardRoutes:e.preserveManagementDashboardRoutes}),`systemctl restart ${Je}`]}
-export{yo,So,Io,bo,yd,Np,Bp,lA,Sd,x,nr,HI,z,Co,R,xp,vt,Je,K,Id,bd,V,xe};

package/dist/chunk-qs7814ya.js

@@ -1 +0,0 @@
-import{Wn,Kh}from"./chunk-zy3kr4s2.js";import"./chunk-tpvmpmxj.js";import"./chunk-1psh3mhm.js";import"./chunk-7d9ek8rc.js";import"./chunk-72p2tdpe.js";import"./chunk-sjfc9my3.js";export{Wn as EmailClient,Kh as email};

package/dist/chunk-sd5a61c6.js

@@ -1 +0,0 @@
-import{Xe,Op,_p,xi,n,g,uA}from"./chunk-7d9ek8rc.js";import"./chunk-72p2tdpe.js";import"./chunk-sjfc9my3.js";export{n as AWSClient,g as buildQueryParams,_p as canonicalUriFor,xi as coerceXmlValues,uA as detectCredentialSource,Xe as resolveS3Endpoint,Op as signingNameFor};

package/dist/chunk-t1wq0ckc.js

@@ -1,2 +0,0 @@
-function h(n,r){return(n?.[`${r}Response`]??n)?.[`${r}Result`]}function y(n){if(n===void 0||n===null||n==="")return[];return Array.isArray(n)?n:[n]}function Cd(n){return n===!0||n==="true"}
-export{h,y,Cd};

package/dist/chunk-zft558kj.js

@@ -1 +0,0 @@
-import{Os,_s,Ls,$s,vc,Tc}from"./chunk-9f18pebj.js";import"./chunk-1087xz1v.js";import"./chunk-zwayp7fz.js";import"./chunk-tpvmpmxj.js";import"./chunk-by7hejhg.js";import"./chunk-1psh3mhm.js";import"./chunk-7d9ek8rc.js";import"./chunk-72p2tdpe.js";import"./chunk-sjfc9my3.js";export{vc as deleteStaticSite,_s as deployStaticSite,Tc as deployStaticSiteFull,Os as generateStaticSiteTemplate,$s as invalidateCache,Ls as uploadStaticFiles};