@stacksjs/ts-cloud 0.2.26 → 0.3.0

package/dist/drivers/shared/laravel-deploy.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Assemble the remote deploy script for a Forge-style PHP/Laravel site: a
+ * git-clone-on-server, zero-downtime atomic-release deploy.
+ *
+ * The deploy script is a list of steps run in order on the box. Three Forge
+ * macros expand to the release machinery:
+ *   $CREATE_RELEASE   — clone the repo into a new release dir, link shared
+ *                       paths, and `cd` into it (subsequent steps run there).
+ *   $ACTIVATE_RELEASE — flip the `current` symlink atomically, prune old
+ *                       releases, and reload php-fpm so opcache sees new code.
+ *   $RESTART_QUEUES   — gracefully restart Laravel queue workers / Horizon.
+ *
+ * Everything between $CREATE_RELEASE and $ACTIVATE_RELEASE runs inside the new
+ * (not-yet-live) release, so a failure leaves the previous release serving —
+ * the Envoyer zero-downtime guarantee.
+ */
+import type { SiteConfig } from '@ts-cloud/core';
+export declare const MACRO_CREATE_RELEASE = "$CREATE_RELEASE";
+export declare const MACRO_ACTIVATE_RELEASE = "$ACTIVATE_RELEASE";
+export declare const MACRO_RESTART_QUEUES = "$RESTART_QUEUES";
+/**
+ * Default deploy script (with macros) for a site type. Overridden by
+ * {@link SiteConfig.deployScript}.
+ */
+export declare function defaultDeployScriptFor(type: NonNullable<SiteConfig['type']>): string[];
+export interface LaravelDeployOptions {
+    siteName: string;
+    site: SiteConfig;
+    /** Unique release identifier (timestamp or sha) → `releases/<id>`. */
+    releaseId: string;
+    /** Site base dir. @default `/var/www/<siteName>` */
+    appBase?: string;
+    /** Exact commit to deploy (else the branch tip). */
+    commit?: string;
+    /** PHP version selecting the `phpX.Y` binary. @default `site.phpVersion` ?? '8.3' */
+    defaultPhpVersion?: string;
+}
+/**
+ * Build the full remote shell script for a PHP/Laravel git deploy, expanding the
+ * release macros. Requires `site.repository` to be set.
+ */
+export declare function buildLaravelDeployScript(options: LaravelDeployOptions): string[];

package/dist/drivers/shared/laravel-services.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Generate the per-site runtime services for a Forge-style PHP box: queue
+ * workers / Horizon (systemd), the Laravel scheduler (cron), and arbitrary
+ * daemons (systemd). Reconciled on every deploy so units track the config —
+ * units no longer in the config are stopped and removed.
+ *
+ * Unit naming (so a site's units can be globbed for pruning):
+ *   <slug>-<site>-queue-<i>.service
+ *   <slug>-<site>-daemon-<slug-of-name>.service
+ * Scheduler cron lives at /etc/cron.d/<slug>-<site>-scheduler.
+ *
+ * ExecStart commands target `<base>/current/...` (the active-release symlink),
+ * so workers/daemons always run the live code; `queue:restart` (run by the
+ * deploy's $RESTART_QUEUES macro) cycles them onto the new release.
+ */
+import type { DaemonConfig, SiteConfig } from '@ts-cloud/core';
+export interface SiteServicesOptions {
+    slug: string;
+    siteName: string;
+    site: SiteConfig;
+    /** PHP version selecting the `phpX.Y` binary. @default '8.3' */
+    phpVersion?: string;
+    /** Site base dir. @default `/var/www/<siteName>` */
+    appBase?: string;
+}
+export declare function queueUnitName(slug: string, siteName: string, index: number): string;
+export declare function daemonUnitName(slug: string, siteName: string, daemon: DaemonConfig, index: number): string;
+/** Path of the scheduler cron file for a site. */
+export declare function schedulerCronPath(slug: string, siteName: string): string;
+/**
+ * Build the full reconcile script: (re)write desired queue/daemon units +
+ * scheduler cron, prune stale units for this site, and reload systemd.
+ */
+export declare function buildSiteServicesScript(options: SiteServicesOptions): string[];
+/** Whether a site declares any runtime services (avoids emitting an empty reconcile). */
+export declare function siteHasServices(site: SiteConfig): boolean;

package/dist/drivers/shared/maintenance.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Automatic unattended security/system updates, mirroring Forge's scheduled
+ * maintenance. Installs `unattended-upgrades` and enables the daily APT
+ * auto-update timers so security patches land without manual intervention.
+ */
+/**
+ * Build the commands that enable automatic security updates. Idempotent.
+ * Returns `[]` when disabled.
+ */
+export declare function buildAutoUpdatesScript(enabled?: boolean): string[];

package/dist/drivers/shared/monitoring.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Lightweight server monitoring, mirroring Forge's basic server metrics.
+ *
+ * Dependency-free: a small shell collector reads load average, memory, and
+ * disk usage and writes a JSON snapshot to `/var/lib/ts-cloud/metrics.json`
+ * every minute via a systemd timer. The ts-cloud UI (and any operator tooling)
+ * can read that file for at-a-glance server health.
+ */
+/** Where the metrics snapshot is written. */
+export declare const METRICS_PATH = "/var/lib/ts-cloud/metrics.json";
+/**
+ * Build the commands that install the metrics collector + systemd timer.
+ * Idempotent. Returns `[]` when disabled.
+ */
+export declare function buildMonitoringScript(enabled?: boolean): string[];

package/dist/drivers/shared/nginx-vhost.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Generate an nginx server block (vhost) for a Forge-style site and the shell
+ * commands that install it.
+ *
+ * Site `type` drives the template:
+ *  - `laravel` / `statamic` / `wordpress` — `public/` web root, `index.php`,
+ *    `try_files … /index.php?$query_string`, and a `fastcgi_pass` to the site's
+ *    php-fpm socket (see {@link import('./php-provision').phpFpmSocketPath}).
+ *  - `php` — generic PHP app behind php-fpm, web root at the release root.
+ *  - `static` — plain files, `try_files … =404`.
+ *  - `spa` — SPA fallback to `/index.html`.
+ *
+ * The block listens on :80 only; TLS (the `:443` block + redirect) is layered
+ * on by certbot in the SSL step, so this stays stable across cert renewals.
+ */
+import type { SiteConfig } from '@ts-cloud/core';
+export type NginxSiteType = NonNullable<SiteConfig['type']>;
+export interface NginxVhostOptions {
+    /** Site key — names the config file (`/etc/nginx/sites-available/<siteName>`). */
+    siteName: string;
+    /** Primary hostname (`server_name`). */
+    domain: string;
+    /** Additional hostnames added to `server_name`. */
+    aliases?: string[];
+    /** Site type — selects the template. @default 'laravel' */
+    type?: NginxSiteType;
+    /**
+     * Directory the vhost serves from. For zero-downtime sites this is the
+     * `current` symlink (`/var/www/<site>/current`); the web root appends
+     * {@link webDirectory}.
+     */
+    appDir: string;
+    /** Web root relative to {@link appDir}. Defaults per type (see {@link defaultWebDirectory}). */
+    webDirectory?: string;
+    /** PHP version selecting the php-fpm socket. @default '8.3' */
+    phpVersion?: string;
+    /** `from path` → `to URL` 301 redirects. */
+    redirects?: Record<string, string>;
+    /**
+     * Serve TLS directly from this vhost using operator-provided certs. When set,
+     * the :80 block becomes an HTTPS redirect and a :443 `ssl` block serves the
+     * site. Used for the `custom` SSL provider; for Let's Encrypt, certbot
+     * rewrites the :80 block itself (leave this unset).
+     */
+    ssl?: {
+        certPath: string;
+        keyPath: string;
+    };
+    /**
+     * HTTP Basic auth (htpasswd). When set, the vhost requires auth and the
+     * generated script writes the htpasswd file. The `realm` is shown in the
+     * browser prompt.
+     */
+    auth?: {
+        username: string;
+        password: string;
+        realm?: string;
+    };
+}
+/** Path of the htpasswd file for a site. */
+export declare function htpasswdPath(siteName: string): string;
+/** Whether a site type is served by php-fpm. */
+export declare function isPhpSiteType(type: NginxSiteType): boolean;
+/** Default web root (relative to the release dir) for a site type. */
+export declare function defaultWebDirectory(type: NginxSiteType): string;
+/**
+ * Build the nginx server block text for a site. With `options.ssl`, emits a
+ * :80 → HTTPS redirect plus a :443 `ssl` block (the `custom` cert path);
+ * otherwise a single :80 block (certbot upgrades it for Let's Encrypt).
+ */
+export declare function buildNginxVhost(options: NginxVhostOptions): string;
+/**
+ * Build the shell commands that write the vhost, enable it, validate the nginx
+ * config, and reload. Re-runnable (overwrites the config + refreshes the symlink).
+ */
+export declare function buildNginxVhostScript(options: NginxVhostOptions): string[];
+/** Wrapper that runs the pantry-installed nginx binary inside pantry's env. */
+export declare const NGINX_WRAPPER = "/usr/local/bin/ts-cloud-nginx";
+/**
+ * Set up ts-cloud-managed nginx on top of the pantry-installed nginx binary:
+ * a wrapper that runs nginx within `pantry env` (so it + its shared libs
+ * resolve), a full `/etc/nginx/nginx.conf` that `include`s the per-site vhosts,
+ * and a systemd unit on :80/:443. Replaces apt's nginx service (pantry's own
+ * nginx service serves a minimal :8080 default and isn't started here).
+ *
+ * Run once at provision time, after the nginx binary is installed.
+ */
+export declare function buildNginxServiceScript(projectDir?: string): string[];

package/dist/drivers/shared/notifications.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Send deploy / SSL / health-check / backup notifications to the configured
+ * channels (Slack, Discord, Telegram, email, generic webhook), mirroring
+ * Forge's notification system.
+ *
+ * Two surfaces:
+ *  - {@link sendNotifications} — called from the TS deploy orchestrator for
+ *    deploy success/failure (and other events ts-cloud drives locally).
+ *  - {@link buildNotifierScript} — generates an on-box `ts-cloud-notify`
+ *    helper that cron-driven events (certbot renewal, backups) can call.
+ */
+import type { NotifyEvent, NotificationsConfig } from '@ts-cloud/core';
+/** Fetch implementation (injectable for tests). */
+export type FetchLike = (input: string, init?: {
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+}>;
+export interface SendNotificationsOptions {
+    /** Override the fetch implementation (default: global `fetch`). */
+    fetchImpl?: FetchLike;
+}
+/**
+ * Send `message` for `event` to every configured + subscribed channel. Errors
+ * on individual channels are swallowed (a flaky webhook must not fail a deploy);
+ * returns the list of channels that were attempted.
+ */
+export declare function sendNotifications(config: NotificationsConfig | undefined, event: NotifyEvent, message: string, options?: SendNotificationsOptions): Promise<string[]>;
+/** Resolve the effective notifications config for a site (site overrides project). */
+export declare function resolveNotifications(project: NotificationsConfig | undefined, site: NotificationsConfig | undefined): NotificationsConfig | undefined;
+/**
+ * Generate an on-box `ts-cloud-notify` script that POSTs `$1` (a message) to
+ * the webhook channels. Used by cron-driven hooks (certbot renew, backups) so
+ * server-side events also reach Slack/Discord/etc. Returns `[]` when no
+ * webhook-style channel is configured.
+ */
+export declare function buildNotifierScript(config: NotificationsConfig | undefined): string[];

package/dist/drivers/shared/package-manager.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Pantry-based package manager for provisioned servers.
+ *
+ * Every server dependency ts-cloud installs — PHP, nginx, Composer, the
+ * databases/caches/search engines, and the language runtimes — comes from the
+ * pantry registry (`registry.pantry.dev`, Hetzner-backed object storage) via
+ * the `pantry` CLI instead of apt/ppa/curl installers. Long-running services
+ * are managed by pantry's own systemd integration, which runs in **system
+ * scope** when provisioning as root (units under `/etc/systemd/system`, started
+ * at boot) — see `PANTRY_SERVICE_SCOPE` in pantry's service controller.
+ *
+ * This module is the single chokepoint for "install package X" / "run service
+ * Y" so the Hetzner and AWS bootstrap paths share one implementation. It only
+ * emits shell command lines (the convention used across `drivers/shared`); the
+ * caller splices them into the Ubuntu cloud-init / SSM bootstrap.
+ */
+/**
+ * Pantry package domains for the dependencies ts-cloud provisions. Domains
+ * (not aliases) are used because aliases aren't guaranteed in every released
+ * pantry binary. The recipes live in pantry's `src/packages/*` (e.g. `php.net`
+ * is a source build carrying the full Laravel extension matrix).
+ */
+export declare const PANTRY_PACKAGES: {
+    readonly php: "php.net";
+    readonly nginx: "nginx.org";
+    readonly composer: "getcomposer.org";
+    readonly mysql: "mysql.com";
+    readonly mariadb: "mariadb.org";
+    readonly postgres: "postgresql.org";
+    readonly redis: "redis.io";
+    readonly memcached: "memcached.org";
+    readonly meilisearch: "meilisearch.com";
+    readonly git: "git-scm.com";
+    readonly certbot: "certbot.eff.org";
+    readonly bun: "bun.sh";
+    readonly node: "nodejs.org";
+    readonly deno: "deno.land";
+};
+/** Logical package key (`'php'`, `'nginx'`, …). */
+export type PantryPackageKey = keyof typeof PANTRY_PACKAGES;
+/** A fully-qualified pantry package domain (`'php.net'`, `'nginx.org'`, …). */
+export type PantryPackageDomain = (typeof PANTRY_PACKAGES)[PantryPackageKey];
+/** A package to install: a known domain, optionally pinned with `@<version>`. */
+export type PantrySpec = PantryPackageDomain | `${PantryPackageDomain}@${string}`;
+/** Where the `pantry` binary itself is installed (on PATH for all later steps). */
+export declare const PANTRY_INSTALL_DIR = "/usr/local/bin";
+/**
+ * Server-side pantry project root. `pantry install` is project-scoped — it
+ * writes packages under `<root>/pantry/` and exposes their binaries via
+ * `<root>/pantry/.bin`. Provisioning installs everything into this one fixed
+ * project so the env (and thus PATH) is stable across deploy/systemd steps.
+ */
+export declare const PANTRY_PROJECT_DIR = "/opt/pantry";
+export interface PantryBootstrapOptions {
+    /** Pin the pantry CLI version (e.g. `'0.9.39'`). @default latest release */
+    version?: string;
+}
+/**
+ * Bootstrap the `pantry` CLI on a fresh server (idempotent — skips when already
+ * present). Installs to {@link PANTRY_INSTALL_DIR} and selects system-scope
+ * service management so `pantry enable/start` provisions boot-time systemd
+ * units rather than the per-user units that can't run headlessly.
+ */
+export declare function buildPantryBootstrapScript(options?: PantryBootstrapOptions): string[];
+/**
+ * Shell snippet that puts the project's pantry-installed binaries (php,
+ * composer, …) on PATH for a deploy step. `pantry env` is project-scoped, so it
+ * is evaluated from {@link PANTRY_PROJECT_DIR}. Returns a single line to
+ * `eval`/source before invoking those binaries.
+ */
+export declare function pantryEnvActivation(): string;
+/**
+ * Install one or more pantry packages in a single resolve pass. Accepts known
+ * domains (optionally `domain@version`). Returns `[]` for an empty list.
+ */
+export declare function buildPantryInstallScript(specs: readonly PantrySpec[]): string[];
+/**
+ * Enable (start on boot) and start pantry-managed services now. Service names
+ * are pantry's own (`'php-fpm'`, `'nginx'`, `'mysql'`, `'redis'`, …), not the
+ * package domains.
+ */
+export declare function buildPantryServiceScript(services: readonly string[]): string[];
+/** Resolve a logical key (or an explicit domain) to its package domain. */
+export declare function pantryDomain(pkg: PantryPackageKey | PantryPackageDomain): PantryPackageDomain;

package/dist/drivers/shared/php-provision.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The baseline Laravel PHP extensions. pantry's `php.net` is a single source
+ * build that already bundles these, so unlike apt there are no per-extension
+ * packages to install — this list documents the expectation and is asserted
+ * against `php -m` in tests.
+ */
+export declare const LARAVEL_PHP_EXTENSIONS: readonly string[];
+export interface PhpProvisionOptions {
+    /** PHP versions to install (first is the default). pantry runs one php-fpm. @default ['8.3'] */
+    versions?: string[];
+    /** Default PHP version. @default first of `versions` */
+    default?: string;
+    /** Extra extensions — informational; pantry's php build is fixed. */
+    extensions?: string[];
+    /** Install the nginx binary (the vhost/service is wired separately). @default true */
+    installNginx?: boolean;
+    /** Install Composer. @default true */
+    installComposer?: boolean;
+}
+/** PHP-FPM listen address for nginx `fastcgi_pass` (pantry's php-fpm is TCP). */
+export declare const PHP_FPM_LISTEN = "127.0.0.1:9074";
+/**
+ * php-fpm `fastcgi_pass` target. The `version` arg is accepted for API
+ * compatibility with the old per-version unix sockets; pantry runs a single
+ * php-fpm on {@link PHP_FPM_LISTEN}.
+ */
+export declare function phpFpmSocketPath(_version?: string): string;
+/** Resolve the default PHP version from the requested set. */
+export declare function resolveDefaultPhpVersion(options?: PhpProvisionOptions): string;
+/**
+ * Build the shell command lines that install PHP-FPM + Composer (+ the nginx
+ * binary) via pantry and start php-fpm as a system service. Assumes the pantry
+ * CLI is already bootstrapped (see
+ * {@link import('./package-manager').buildPantryBootstrapScript}).
+ */
+export declare function buildPhpProvisionScript(options?: PhpProvisionOptions): string[];

package/dist/drivers/shared/releases.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Zero-downtime atomic release management for Forge-style git deploys.
+ *
+ * Directory layout under a site's base (`/var/www/<site>`):
+ *   releases/<id>/   one checkout per deploy
+ *   shared/          files persisted across releases (storage, .env, …)
+ *   current ->       symlink to the active release
+ *
+ * A deploy clones into `releases/<id>`, symlinks the shared paths in, runs the
+ * deploy script, then atomically repoints `current`. Old releases are pruned
+ * to a retention count for rollback. These map to Forge's deploy macros:
+ *   $CREATE_RELEASE   → {@link buildEnsureReleaseLayout} + git clone + {@link buildLinkSharedPaths}
+ *   $ACTIVATE_RELEASE → {@link buildActivateRelease} (+ {@link buildPruneReleases})
+ */
+/** Paths that are always shared across releases (Forge shares `.env` implicitly). */
+export declare const DEFAULT_SHARED_PATHS: readonly string[];
+/** Default number of past releases to retain for rollback. */
+export declare const DEFAULT_KEEP_RELEASES = 4;
+export interface ReleasePaths {
+    /** Site base directory (`/var/www/<site>`). */
+    base: string;
+    /** Releases parent (`<base>/releases`). */
+    releases: string;
+    /** Shared parent (`<base>/shared`). */
+    shared: string;
+    /** Active-release symlink (`<base>/current`). */
+    current: string;
+    /** This deploy's release dir (`<base>/releases/<id>`). */
+    release: string;
+}
+/** Resolve the standard release layout paths for a site + release id. */
+export declare function releasePaths(base: string, releaseId: string): ReleasePaths;
+/**
+ * Ensure the releases/ and shared/ skeleton exist, including the Laravel
+ * `storage` tree and an empty shared `.env` so symlinks never dangle.
+ */
+export declare function buildEnsureReleaseLayout(paths: ReleasePaths, sharedPaths?: readonly string[]): string[];
+/**
+ * Symlink every shared path from `shared/` into the freshly checked-out release,
+ * replacing whatever the checkout shipped (e.g. the repo's empty `storage`).
+ */
+export declare function buildLinkSharedPaths(paths: ReleasePaths, sharedPaths?: readonly string[]): string[];
+/**
+ * Atomically repoint `current` at the new release. Writes a temp symlink and
+ * `mv -T`s it over `current` so there is no window where `current` is missing.
+ */
+export declare function buildActivateRelease(paths: ReleasePaths): string[];
+/**
+ * Remove all but the newest `keep` releases (by mtime). `current` always points
+ * at the newest, so it is never pruned.
+ */
+export declare function buildPruneReleases(paths: ReleasePaths, keep?: number): string[];

package/dist/drivers/shared/ssh-keys.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Declaratively manage operator SSH keys in the box's `authorized_keys`.
+ *
+ * Keys are written inside a ts-cloud-managed block (delimited by marker
+ * comments) so the set can be reconciled on every provision/deploy without
+ * disturbing keys added out-of-band: the whole block is rewritten from the
+ * config each time. Adding an SSH key is therefore "add an entry + redeploy".
+ */
+import type { SshKeyConfig } from '@ts-cloud/core';
+/** Default authorized_keys path (root deploy user). */
+export declare const DEFAULT_AUTHORIZED_KEYS = "/root/.ssh/authorized_keys";
+export interface AuthorizedKeysOptions {
+    /** authorized_keys file to manage. @default '/root/.ssh/authorized_keys' */
+    path?: string;
+}
+/**
+ * Build the commands that reconcile the managed key block in authorized_keys.
+ * Strips any previous ts-cloud block, then appends the current set. Returns `[]`
+ * when there are no keys to manage.
+ */
+export declare function buildAuthorizedKeysScript(keys?: SshKeyConfig[], options?: AuthorizedKeysOptions): string[];

package/dist/drivers/shared/ubuntu-bootstrap.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The canonical Ubuntu provisioning recipe for a ts-cloud compute box.
+ *
+ * This single bash builder is used in three places so there is exactly one
+ * source of truth (and zero per-provider divergence):
+ *  - **cold boot** — Hetzner cloud-init / AWS EC2 UserData run it on first boot.
+ *  - **image bake** — the golden-image pipeline runs it to pre-install the
+ *    stack, then snapshots the box into a Hetzner snapshot / AWS AMI.
+ *  - **baked boot** — when a box boots from a pre-provisioned image, pass
+ *    `baked: true` to skip the install-heavy steps (apt/runtime/php/services)
+ *    that are already in the image, keeping only cheap per-boot setup.
+ *
+ * Targets Ubuntu (apt) — Forge's platform — on every provider, so the apt
+ * provisioning, nginx vhosts, php-fpm sockets, and deploy scripts are identical
+ * for Hetzner and AWS.
+ */
+export interface UbuntuBootstrapOptions {
+    runtime?: 'bun' | 'node' | 'deno' | 'php';
+    runtimeVersion?: string;
+    systemPackages?: string[];
+    database?: 'sqlite' | 'mysql' | 'postgres';
+    /**
+     * Shell commands that install PHP-FPM + nginx + Composer, built by
+     * {@link import('./php-provision').buildPhpProvisionScript}. Spliced
+     * after the base packages so Laravel/PHP sites have their runtime ready
+     * before any deploy. Used when `runtime === 'php'` (or `compute.php` is set).
+     */
+    phpProvision?: string[];
+    /**
+     * Shell commands that install on-box services (database engine, redis,
+     * memcached, meilisearch) and create the app database + user, built by
+     * {@link import('./db-provision')}. Spliced after the PHP provision.
+     */
+    servicesProvision?: string[];
+    caddyfile?: string;
+    /**
+     * Shell commands that install + start the rpx reverse-proxy gateway, built by
+     * {@link import('./rpx-gateway').buildRpxProvisionScript}. Appended
+     * after the runtime is installed so `bun add -g @stacksjs/rpx` works. Mutually
+     * exclusive with `caddyfile` (the box runs one gateway).
+     */
+    rpxProvision?: string[];
+    /**
+     * The box boots from a pre-provisioned (golden) image that already has the
+     * runtime + PHP + services + base packages installed. Skip those install
+     * steps — only do the cheap per-boot setup (dirs, gateway config). Makes
+     * boot near-instant. @default false
+     */
+    baked?: boolean;
+}
+/**
+ * Build the Ubuntu provisioning bash script (with `#!/bin/bash` shebang).
+ */
+export declare function buildUbuntuBootstrapScript(options?: UbuntuBootstrapOptions): string;

package/dist/drivers/shared/ufw.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Host firewall (UFW) provisioning, mirroring Forge's per-server firewall.
+ *
+ * Defaults to deny-incoming / allow-outgoing, with SSH (OpenSSH), HTTP (80),
+ * and HTTPS (443) always open so deploys and web traffic keep working, plus
+ * any extra ports the config lists (e.g. a Reverb/websocket port). On Hetzner
+ * this is layered on top of the cloud firewall; on a bare box it's the primary
+ * line of defence.
+ */
+import type { ComputeFirewallConfig } from '@ts-cloud/core';
+/** Ports always allowed so SSH deploys + web traffic are never locked out. */
+export declare const UFW_BASE_PORTS: readonly number[];
+/**
+ * Build the UFW provisioning commands. Idempotent: `ufw allow` is a no-op when
+ * a rule already exists, and `--force enable` is safe to re-run.
+ */
+export declare function buildUfwScript(firewall?: ComputeFirewallConfig): string[];