@stacksjs/ts-cloud 0.4.1 → 0.5.0

package/dist/deploy/management-dashboard.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Auto-deploy of the ts-cloud management dashboard (the `@ts-cloud/ui` stx app)
+ * on every server provision/deploy.
+ *
+ * Resolves the UI directory (the repo's local `ui/`, else the prebuilt UI that
+ * ships inside the installed package at `dist/ui`), derives a `dashboard.<apex>`
+ * host, and injects it into `config.sites` as a server-static site. It is served
+ * behind htpasswd ONLY when `TS_CLOUD_UI_PASSWORD` is set; when it is not, the
+ * dashboard is served without auth (no password is invented).
+ *
+ * Env:
+ * - `TS_CLOUD_UI_PASSWORD`  htpasswd password (unset ⇒ no auth)
+ * - `TS_CLOUD_UI_USERNAME`  htpasswd user (default `admin`)
+ * - `TS_CLOUD_UI_DOMAIN`    explicit dashboard host (else `dashboard.<apex>`)
+ * - `TS_CLOUD_UI_REALM`     browser auth realm
+ * - `TS_CLOUD_UI_DISABLE`   set truthy to skip auto-deploy
+ */
+import type { CloudConfig } from '@stacksjs/ts-cloud';
+export interface EnsureDashboardLogger {
+    info: (msg: string) => void;
+    warn: (msg: string) => void;
+}
+/**
+ * Resolve the UI source to ship. Prefers the repo's local `ui/` (built on the
+ * deploy machine), then the prebuilt UI bundled in the installed package.
+ * Returns `{ uiRoot, build }` or null when no UI is available.
+ */
+export declare function resolveUiSource(cwd: string): {
+    uiRoot: string;
+    build: string | false;
+} | null;
+/**
+ * Inject the management dashboard into `config.sites` for a server deploy.
+ * Mutates and returns `config`. Idempotent and safe to call on every deploy.
+ */
+export declare function ensureManagementDashboard(config: CloudConfig, options?: {
+    cwd?: string;
+    logger?: EnsureDashboardLogger;
+}): CloudConfig;

package/dist/index.js

@@ -48,7 +48,7 @@ import { readFileSync as readFileSync5 } from "node:fs";
 import { dirname as dirname42, join as join8 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync52, mkdtempSync as mkdtempSync3, readdirSync as readdirSync52, readFileSync as readFileSync6, rmSync as rmSync3, statSync as statSync32, writeFileSync as writeFileSync52 } from "node:fs";
+import { existsSync as existsSync52, mkdirSync as mkdirSync22, mkdtempSync as mkdtempSync3, readdirSync as readdirSync52, readFileSync as readFileSync6, rmSync as rmSync3, statSync as statSync32, writeFileSync as writeFileSync52 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join9, relative as relative22 } from "node:path";
 import { execSync as execSync2 } from "node:child_process";
@@ -7654,6 +7654,56 @@ function createDashboardSite(options) {
     }
   };
 }
+function apexOf(domain) {
+  const parts = domain.split(".").filter(Boolean);
+  return parts.length <= 2 ? domain : parts.slice(-2).join(".");
+}
+function resolveDashboardDomain(config6, environment, explicit) {
+  if (explicit)
+    return explicit;
+  const candidates = [];
+  for (const site of Object.values(config6.sites ?? {})) {
+    const d = site?.domain;
+    if (typeof d === "string")
+      candidates.push(d);
+    else if (Array.isArray(d))
+      candidates.push(...d.filter((x) => typeof x === "string"));
+  }
+  if (environment && config6.environments?.[environment]?.domain)
+    candidates.push(config6.environments[environment].domain);
+  const dnsDomain = config6.infrastructure?.dns?.domain;
+  if (dnsDomain)
+    candidates.push(dnsDomain);
+  const base = candidates.find((d) => d && !d.startsWith("dashboard."));
+  if (!base)
+    return null;
+  return `dashboard.${apexOf(base)}`;
+}
+function hasManagementDashboardSite(config6) {
+  return Object.entries(config6.sites ?? {}).some(([name, site]) => {
+    if (!site)
+      return false;
+    const root = site.root ?? "";
+    return name === "dashboard" || root === "ui/dist" || root.endsWith("/ui/dist") || root.endsWith("/dist/ui");
+  });
+}
+function resolveManagementDashboardSite(config6, environment, opts) {
+  if (hasManagementDashboardSite(config6))
+    return null;
+  const domain = resolveDashboardDomain(config6, environment, opts.domain);
+  if (!domain)
+    return null;
+  const site = {
+    root: opts.uiRoot,
+    deploy: "server",
+    type: "static",
+    domain,
+    ssl: { provider: "letsencrypt" },
+    ...opts.build === false || opts.build === undefined ? {} : { build: opts.build },
+    ...opts.password ? { auth: { username: opts.username || "admin", password: opts.password, realm: opts.realm } } : {}
+  };
+  return { name: "dashboard", site };
+}
 function deepMerge5(target, source) {
   const result = { ...target };
   for (const key in source) {
@@ -26343,13 +26393,18 @@ function phpLayerBuildStage(phpVersion, asName) {
   const scl = `php${phpVersion.replace(".", "")}`;
   const packages = phpLayerPackages(phpVersion).join(" \\\n      ");
   const sclRoot = `/opt/remi/${scl}/root`;
-  const from = asName ? `FROM amazonlinux:2023 AS ${asName}` : "FROM amazonlinux:2023";
+  const sclEtc = `/etc/opt/remi/${scl}`;
+  const from = asName ? `FROM almalinux:9 AS ${asName}` : "FROM almalinux:9";
   return `${from}
 
-# Remi provides version-isolated PHP SCL packages for EL9 (AL2023 compatible).
-RUN dnf -y install dnf-plugins-core 'dnf-command(config-manager)' && \\
+# Build PHP on AlmaLinux 9 (where Remi's version-isolated SCL packages install
+# cleanly — Remi's release RPM rejects Amazon Linux 2023). AlmaLinux 9 shares
+# glibc 2.34 with the provided.al2023 Lambda runtime, and the relocation step
+# below bundles every non-glibc shared lib under /opt/php/lib, so the resulting
+# /opt tree runs on Lambda's provided.al2023.
+RUN dnf -y install epel-release dnf-plugins-core 'dnf-command(config-manager)' && \\
+    dnf config-manager --set-enabled crb && \\
     dnf -y install https://rpms.remirepo.net/enterprise/remi-release-9.rpm && \\
-    dnf -y update && \\
     dnf -y install \\
       ${packages} \\
       findutils tar gzip && \\
@@ -26362,7 +26417,10 @@ RUN set -eux; \\
     cp ${sclRoot}/usr/sbin/php-fpm /opt/php/sbin/php-fpm; \\
     EXT_DIR="$(${sclRoot}/usr/bin/php -r 'echo ini_get("extension_dir");')"; \\
     cp -a "$EXT_DIR"/*.so /opt/php/lib/php/modules/ || true; \\
-    cp -a ${sclRoot}/etc/php.d/*.ini /opt/php/etc/php.d/ 2>/dev/null || true; \\
+    cp -a ${sclEtc}/php.d/*.ini /opt/php/etc/php.d/ 2>/dev/null || true; \\
+    # Rewrite any absolute extension/zend_extension paths to bare names so they
+    # resolve against the relocated extension_dir.
+    sed -i -E "s#(zend_)?extension *= *.*/([^/]+\\.so)#\\1extension=\\2#" /opt/php/etc/php.d/*.ini 2>/dev/null || true; \\
     # Copy shared-library dependencies of php, php-fpm, and the extension modules.
     for bin in /opt/php/bin/php /opt/php/sbin/php-fpm /opt/php/lib/php/modules/*.so; do \\
       ldd "$bin" 2>/dev/null | awk '/=>/{print $3}/ld-linux/{print $1}' | sort -u | while read -r lib; do \\
@@ -26370,10 +26428,9 @@ RUN set -eux; \\
       done; \\
     done
 
-# Point PHP at the relocated config + extension dir.
+# Build the relocated main php.ini: extension_dir + every per-extension directive.
 RUN printf 'extension_dir=/opt/php/lib/php/modules\\n' > /opt/php/etc/php.ini && \\
     cat /opt/php/etc/php.d/*.ini >> /opt/php/etc/php.ini 2>/dev/null || true
-ENV PHP_INI_SCAN_DIR=/opt/php/etc/php.d
 
 # Runtime assets (bootstrap, runtime loops, fpm config) are added by the build
 # orchestrator after the image is produced. Export /opt as the layer payload.
@@ -26685,16 +26742,17 @@ function buildPhpRuntimeLayerZip(options = {}) {
     writeFileSync52(join9(stage, "Dockerfile"), generatePhpLayerDockerfile(options));
     step("Building PHP runtime image (docker)");
     execFileSync2("docker", ["build", "--platform", platform, "-t", imageTag, stage], { stdio: "inherit" });
-    step("Extracting /opt from image");
+    step("Extracting /opt/php from image");
     const cid = execFileSync2("docker", ["create", "--platform", platform, imageTag], { encoding: "utf-8" }).trim();
     const optDir = join9(stage, "opt");
+    mkdirSync22(optDir, { recursive: true });
     try {
-      execFileSync2("docker", ["cp", `${cid}:/opt/.`, optDir], { stdio: "inherit" });
+      execFileSync2("docker", ["cp", `${cid}:/opt/php`, join9(optDir, "php")], { stdio: "inherit" });
     } finally {
       execFileSync2("docker", ["rm", cid], { stdio: "ignore" });
     }
-    if (!existsSync52(optDir))
-      throw new Error("layer build produced no /opt directory");
+    if (!existsSync52(join9(optDir, "php", "bin", "php")))
+      throw new Error("layer build produced no /opt/php/bin/php");
     const entries = [];
     for (const file of walk(optDir)) {
       const rel = relative22(optDir, file).replace(/\\/g, "/");
@@ -45734,6 +45792,7 @@ async function sendFallbackSms(to, message) {
   PHP_LAYER_EXTENSIONS = [
     "cli",
     "fpm",
+    "curl",
     "mbstring",
     "xml",
     "pdo",
@@ -83441,15 +83500,18 @@ function buildDatabaseSetupScript(database, services = {}) {
       "TS_CLOUD_PG_EOF"
     ];
   }
+  const sock = useMariadb ? "/var/lib/pantry/mariadb/mariadbd.sock" : "/var/lib/pantry/mysql/mysqld.sock";
   const ident = (v) => v.replace(/`/g, "``");
   const lit = (v) => v.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
   return [
     pantryEnvActivation(),
-    "for i in $(seq 1 30); do mysqladmin -h 127.0.0.1 -P 3306 -u root ping 2>/dev/null | grep -q alive && break; sleep 2; done",
-    "mysql -h 127.0.0.1 -P 3306 -u root <<'TS_CLOUD_SQL_EOF'",
+    `for i in $(seq 1 30); do mysqladmin --socket=${sock} -u root ping 2>/dev/null | grep -q alive && break; sleep 2; done`,
+    `mysql --socket=${sock} -u root <<'TS_CLOUD_SQL_EOF'`,
     `CREATE DATABASE IF NOT EXISTS \`${ident(name)}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`,
     `CREATE USER IF NOT EXISTS '${lit(user)}'@'%' IDENTIFIED BY '${lit(pass)}';`,
+    `CREATE USER IF NOT EXISTS '${lit(user)}'@'localhost' IDENTIFIED BY '${lit(pass)}';`,
     `GRANT ALL PRIVILEGES ON \`${ident(name)}\`.* TO '${lit(user)}'@'%';`,
+    `GRANT ALL PRIVILEGES ON \`${ident(name)}\`.* TO '${lit(user)}'@'localhost';`,
     "FLUSH PRIVILEGES;",
     "TS_CLOUD_SQL_EOF"
   ];
@@ -86266,9 +86328,11 @@ export {
   resolveQueueNames,
   resolveProjectStackName,
   resolveObjectStorage,
+  resolveManagementDashboardSite,
   resolveHetznerApiToken,
   resolveExecStart,
   resolveDeployBucketName,
+  resolveDashboardDomain,
   resolveCredentials,
   resolveCloudProvider,
   resolveApp,
@@ -86331,6 +86395,7 @@ export {
   hashFile,
   hashDirectory,
   hashBuffer,
+  hasManagementDashboardSite,
   guardDutyManager,
   globalResourceManager,
   getTimestamp,

package/dist/ui/404.html

@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Page Not Found</title>
+  <style>
+    body { font-family: system-ui, sans-serif; display: flex; align-items: center; justify-content: center; min-height: 100vh; margin: 0; }
+    .container { text-align: center; }
+    h1 { font-size: 6rem; margin: 0; color: #333; }
+    p { color: #666; }
+    a { color: #0066cc; }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <h1>404</h1>
+    <p>Page not found</p>
+    <a href="/">Go home</a>
+  </div>
+</body>
+</html>