@stacksjs/ts-cloud 0.4.2 → 0.5.1

package/dist/deploy/management-dashboard.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Auto-deploy of the ts-cloud management dashboard (the `@ts-cloud/ui` stx app)
+ * on every server provision/deploy.
+ *
+ * Resolves the UI directory (the repo's local `ui/`, else the prebuilt UI that
+ * ships inside the installed package at `dist/ui`), derives a `dashboard.<apex>`
+ * host, and injects it into `config.sites` as a server-static site. It is served
+ * behind htpasswd ONLY when `TS_CLOUD_UI_PASSWORD` is set; when it is not, the
+ * dashboard is served without auth (no password is invented).
+ *
+ * Env:
+ * - `TS_CLOUD_UI_PASSWORD`  htpasswd password (unset ⇒ no auth)
+ * - `TS_CLOUD_UI_USERNAME`  htpasswd user (default `admin`)
+ * - `TS_CLOUD_UI_DOMAIN`    explicit dashboard host (else `dashboard.<apex>`)
+ * - `TS_CLOUD_UI_REALM`     browser auth realm
+ * - `TS_CLOUD_UI_DISABLE`   set truthy to skip auto-deploy
+ */
+import type { CloudConfig } from '@stacksjs/ts-cloud';
+export interface EnsureDashboardLogger {
+    info: (msg: string) => void;
+    warn: (msg: string) => void;
+}
+/**
+ * Resolve the UI source to ship. Prefers the repo's local `ui/` (built on the
+ * deploy machine), then the prebuilt UI bundled in the installed package.
+ * Returns `{ uiRoot, build }` or null when no UI is available.
+ */
+export declare function resolveUiSource(cwd: string): {
+    uiRoot: string;
+    build: string | false;
+} | null;
+/**
+ * Inject the management dashboard into `config.sites` for a server deploy.
+ * Mutates and returns `config`. Idempotent and safe to call on every deploy.
+ */
+export declare function ensureManagementDashboard(config: CloudConfig, options?: {
+    cwd?: string;
+    logger?: EnsureDashboardLogger;
+}): CloudConfig;

package/dist/drivers/shared/certbot.d.ts

@@ -10,11 +10,13 @@
  * For the `custom` provider the vhost is rendered with the operator's cert
  * directly (see nginx-vhost's `ssl` option), so certbot is not involved.
  */
-import type { SiteConfig } from '@ts-cloud/core';
+import type { SiteConfig, SslDnsConfig } from '@ts-cloud/core';
 /** Resolve the effective SSL provider for a site (Let's Encrypt by default when it has a domain). */
 export declare function resolveSslProvider(site: SiteConfig): 'letsencrypt' | 'custom' | 'none';
-/** Install certbot + the nginx plugin and ensure the auto-renew timer is enabled. */
-export declare function buildCertbotInstallScript(): string[];
+/** Path of the certbot credentials INI for a DNS provider. */
+export declare function dnsCredentialsPath(provider: SslDnsConfig['provider']): string;
+/** Install certbot (+ optional DNS plugin) and ensure the auto-renew timer is enabled. */
+export declare function buildCertbotInstallScript(dns?: SslDnsConfig): string[];
 export interface CertbotIssueOptions {
     /** Primary domain. */
     domain: string;
@@ -24,15 +26,27 @@ export interface CertbotIssueOptions {
     email?: string;
     /** Redirect HTTP → HTTPS (Forge default). @default true */
     redirect?: boolean;
+    /** Issue `*.<domain>` + `<domain>` (requires `dns`). */
+    wildcard?: boolean;
+    /** DNS-01 validation via a certbot DNS plugin (required for wildcard). */
+    dns?: SslDnsConfig;
 }
 /**
- * Issue (or expand) a Let's Encrypt cert for the domain via the nginx plugin.
- * Idempotent: `--keep-until-expiring` reuses a valid cert, so re-running on
- * every deploy is safe.
+ * Build the commands that write a DNS provider's certbot credentials INI
+ * (root-only) so certbot can create the `_acme-challenge` records. Returns `[]`
+ * when there are no credentials (e.g. route53 using instance-role creds).
+ */
+export declare function buildDnsCredentialsScript(dns: SslDnsConfig): string[];
+/**
+ * Issue (or expand) a Let's Encrypt cert. Uses the nginx (HTTP-01) plugin by
+ * default; with `dns` set, uses DNS-01 via the provider plugin (the only way to
+ * get a wildcard). Idempotent: `--keep-until-expiring` reuses a valid cert.
  */
 export declare function buildCertbotIssueScript(options: CertbotIssueOptions): string[];
 /**
  * Full SSL script for a site, dispatched on its provider. Returns `[]` for
- * `custom`/`none` (custom certs are baked into the vhost already).
+ * `custom`/`none` (custom certs are baked into the vhost already). A wildcard
+ * request without a DNS config is impossible (HTTP-01 can't do wildcards), so
+ * it's skipped.
  */
 export declare function buildSslScript(site: SiteConfig): string[];

package/dist/drivers/shared/laravel-deploy.d.ts

@@ -14,7 +14,7 @@
  * (not-yet-live) release, so a failure leaves the previous release serving —
  * the Envoyer zero-downtime guarantee.
  */
-import type { SiteConfig } from '@ts-cloud/core';
+import type { SiteConfig, SiteCredentialsConfig } from '@ts-cloud/core';
 export declare const MACRO_CREATE_RELEASE = "$CREATE_RELEASE";
 export declare const MACRO_ACTIVATE_RELEASE = "$ACTIVATE_RELEASE";
 export declare const MACRO_RESTART_QUEUES = "$RESTART_QUEUES";
@@ -35,6 +35,11 @@ export interface LaravelDeployOptions {
     /** PHP version selecting the `phpX.Y` binary. @default `site.phpVersion` ?? '8.3' */
     defaultPhpVersion?: string;
 }
+/**
+ * Write private-registry credential files into the release before build:
+ * Composer `auth.json` and/or `.npmrc`. Quoted heredocs keep tokens literal.
+ */
+export declare function buildCredentialFiles(releaseDir: string, creds?: SiteCredentialsConfig): string[];
 /**
  * Build the full remote shell script for a PHP/Laravel git deploy, expanding the
  * release macros. Requires `site.repository` to be set.

package/dist/drivers/shared/releases.d.ts

@@ -45,6 +45,17 @@ export declare function buildLinkSharedPaths(paths: ReleasePaths, sharedPaths?:
  * `mv -T`s it over `current` so there is no window where `current` is missing.
  */
 export declare function buildActivateRelease(paths: ReleasePaths): string[];
+/**
+ * Roll the active release back to a previous one (Forge-style rollback). With
+ * `to` set, points `current` at `releases/<to>`; otherwise picks the most recent
+ * release that isn't the one `current` resolves to. Atomic (temp symlink + `mv
+ * -T`), and a no-op-safe guard fails loudly if the target is missing rather than
+ * leaving `current` dangling. The caller appends the engine reload
+ * (php-fpm/queues) — see {@link import('./laravel-deploy')}.
+ */
+export declare function buildRollbackScript(paths: ReleasePaths, options?: {
+    to?: string;
+}): string[];
 /**
  * Remove all but the newest `keep` releases (by mtime). `current` always points
  * at the newest, so it is never pruned.

package/dist/drivers/shared/server-recipes.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Server "recipes" — reusable bash scripts run on demand across one or more
+ * provisioned servers, as a chosen user (Forge's Recipes feature). The driver
+ * fans a recipe out over the target servers (SSH/SSM); this module builds the
+ * single wrapped script that runs on each box: it sets a strict shell, runs the
+ * recipe body as the requested user with a login shell (so PATH/pantry env are
+ * loaded), and prints clear begin/end markers + the exit code so captured
+ * output is easy to scan.
+ */
+export interface ServerRecipeOptions {
+    /** Recipe name (shown in the output markers). */
+    name: string;
+    /** The recipe body — bash command lines run on the server. */
+    script: string[];
+    /**
+     * User to run the recipe as. Defaults to `root`. A non-root user is invoked
+     * via `runuser -l` so it gets a login shell (profile + PATH, incl. pantry).
+     */
+    user?: string;
+}
+/**
+ * Build the wrapped recipe script run on a server. The body is written to a
+ * temp file and executed as `user`; the wrapper captures the exit code and
+ * prints `__TS_CLOUD_RECIPE_*__` markers around the run for the driver to parse.
+ */
+export declare function buildServerRecipeScript(options: ServerRecipeOptions): string[];

package/dist/index.js

@@ -7654,6 +7654,56 @@ function createDashboardSite(options) {
     }
   };
 }
+function apexOf(domain) {
+  const parts = domain.split(".").filter(Boolean);
+  return parts.length <= 2 ? domain : parts.slice(-2).join(".");
+}
+function resolveDashboardDomain(config6, environment, explicit) {
+  if (explicit)
+    return explicit;
+  const candidates = [];
+  for (const site of Object.values(config6.sites ?? {})) {
+    const d = site?.domain;
+    if (typeof d === "string")
+      candidates.push(d);
+    else if (Array.isArray(d))
+      candidates.push(...d.filter((x) => typeof x === "string"));
+  }
+  if (environment && config6.environments?.[environment]?.domain)
+    candidates.push(config6.environments[environment].domain);
+  const dnsDomain = config6.infrastructure?.dns?.domain;
+  if (dnsDomain)
+    candidates.push(dnsDomain);
+  const base = candidates.find((d) => d && !d.startsWith("dashboard."));
+  if (!base)
+    return null;
+  return `dashboard.${apexOf(base)}`;
+}
+function hasManagementDashboardSite(config6) {
+  return Object.entries(config6.sites ?? {}).some(([name, site]) => {
+    if (!site)
+      return false;
+    const root = site.root ?? "";
+    return name === "dashboard" || root === "ui/dist" || root.endsWith("/ui/dist") || root.endsWith("/dist/ui");
+  });
+}
+function resolveManagementDashboardSite(config6, environment, opts) {
+  if (hasManagementDashboardSite(config6))
+    return null;
+  const domain = resolveDashboardDomain(config6, environment, opts.domain);
+  if (!domain)
+    return null;
+  const site = {
+    root: opts.uiRoot,
+    deploy: "server",
+    type: "static",
+    domain,
+    ssl: { provider: "letsencrypt" },
+    ...opts.build === false || opts.build === undefined ? {} : { build: opts.build },
+    ...opts.password ? { auth: { username: opts.username || "admin", password: opts.password, realm: opts.realm } } : {}
+  };
+  return { name: "dashboard", site };
+}
 function deepMerge5(target, source) {
   const result = { ...target };
   for (const key in source) {
@@ -25896,6 +25946,7 @@ function composeServerlessAppTemplate(opts) {
     TSCLOUD_LAMBDA_MODE: mode,
     TSCLOUD_ENV: environment,
     ...app.octane ? { TSCLOUD_OCTANE: "1" } : {},
+    ...app.scheduler === "sub-minute" ? { TSCLOUD_SCHEDULER: "sub-minute" } : {},
     ...cacheEnabled ? { TSCLOUD_CACHE_TABLE: `${slug}-${environment}-cache` } : {},
     ...hasQueue ? { TSCLOUD_QUEUE: queueNames[0] } : {},
     ...app.env ?? {}
@@ -25915,7 +25966,7 @@ function composeServerlessAppTemplate(opts) {
       ]
     }
   } : {};
-  function addFunction(logicalId, name, handler8, mode, memory, timeout, reservedConcurrency) {
+  function addFunction(logicalId, name, handler8, mode, memory, timeout, reservedConcurrency, tmp = tmpStorage) {
     resources[`${logicalId}LogGroup`] = {
       Type: "AWS::Logs::LogGroup",
       Properties: { LogGroupName: `/aws/lambda/${name}`, RetentionInDays: 14 }
@@ -25940,17 +25991,17 @@ function composeServerlessAppTemplate(opts) {
         Timeout: timeout,
         Role: Fn2.getAtt("AppRole", "Arn"),
         Environment: { Variables: baseEnv(mode) },
-        EphemeralStorage: { Size: tmpStorage },
+        EphemeralStorage: { Size: tmp },
         ...codeProps,
         ...reservedConcurrency !== undefined ? { ReservedConcurrentExecutions: reservedConcurrency } : {},
         ...vpcConfig
       }
     };
   }
-  addFunction("HttpFunction", functionNames.http, handlers.http, "http", app.memory ?? 1024, app.timeout ?? 28, app.concurrency);
-  addFunction("CliFunction", functionNames.cli, handlers.cli, "cli", app.cliMemory ?? 1024, app.cliTimeout ?? 900);
+  addFunction("HttpFunction", functionNames.http, handlers.http, "http", app.memory ?? 1024, app.timeout ?? 28, app.concurrency, tmpStorage);
+  addFunction("CliFunction", functionNames.cli, handlers.cli, "cli", app.cliMemory ?? 1024, app.cliTimeout ?? 900, undefined, app.cliTmpStorage ?? tmpStorage);
   if (hasQueue)
-    addFunction("QueueFunction", functionNames.queue, handlers.queue, "queue", app.queueMemory ?? 1024, app.queueTimeout ?? 120);
+    addFunction("QueueFunction", functionNames.queue, handlers.queue, "queue", app.queueMemory ?? 1024, app.queueTimeout ?? 120, undefined, app.queueTmpStorage ?? tmpStorage);
   resources.HttpApi = {
     Type: "AWS::ApiGatewayV2::Api",
     Properties: {
@@ -25997,6 +26048,59 @@ function composeServerlessAppTemplate(opts) {
     Value: Fn2.getAtt("HttpApi", "ApiEndpoint")
   };
   outputs.HttpApiId = { Description: "HTTP API id", Value: Fn2.ref("HttpApi") };
+  const domains = (Array.isArray(app.domain) ? app.domain : app.domain ? [app.domain] : []).filter(Boolean);
+  if (domains.length) {
+    if (!app.certificateArn && !app.hostedZoneId) {
+      throw new Error("serverless app: a custom `domain` needs either `certificateArn` (pre-issued, regional) or `hostedZoneId` (to auto-issue + validate an ACM cert).");
+    }
+    let certRef = app.certificateArn;
+    if (!certRef) {
+      resources.HttpCertificate = {
+        Type: "AWS::CertificateManager::Certificate",
+        Properties: {
+          DomainName: domains[0],
+          ...domains.length > 1 ? { SubjectAlternativeNames: domains.slice(1) } : {},
+          ValidationMethod: "DNS",
+          DomainValidationOptions: domains.map((d) => ({ DomainName: d, HostedZoneId: app.hostedZoneId }))
+        }
+      };
+      certRef = Fn2.ref("HttpCertificate");
+    }
+    domains.forEach((d, i) => {
+      const dn = `HttpDomain${i}`;
+      resources[dn] = {
+        Type: "AWS::ApiGatewayV2::DomainName",
+        Properties: {
+          DomainName: d,
+          DomainNameConfigurations: [{ CertificateArn: certRef, EndpointType: "REGIONAL" }]
+        }
+      };
+      resources[`HttpApiMapping${i}`] = {
+        Type: "AWS::ApiGatewayV2::ApiMapping",
+        DependsOn: ["HttpStage"],
+        Properties: { ApiId: Fn2.ref("HttpApi"), DomainName: Fn2.ref(dn), Stage: "$default" }
+      };
+      if (app.hostedZoneId) {
+        resources[`HttpDomainRecord${i}`] = {
+          Type: "AWS::Route53::RecordSet",
+          Properties: {
+            HostedZoneId: app.hostedZoneId,
+            Name: d,
+            Type: "A",
+            AliasTarget: {
+              DNSName: Fn2.getAtt(dn, "RegionalDomainName"),
+              HostedZoneId: Fn2.getAtt(dn, "RegionalHostedZoneId")
+            }
+          }
+        };
+      }
+      outputs[`CustomDomain${i}`] = { Description: `Custom domain ${d}`, Value: d };
+      outputs[`CustomDomainTarget${i}`] = {
+        Description: `Point ${d} (CNAME/alias) at this APIGW regional domain`,
+        Value: Fn2.getAtt(dn, "RegionalDomainName")
+      };
+    });
+  }
   if (hasQueue) {
     resources.AppQueueDlq = {
       Type: "AWS::SQS::Queue",
@@ -83437,28 +83541,63 @@ function buildDatabaseSetupScript(database, services = {}) {
   if (usePostgres && !useMysql && !useMariadb) {
     const pgIdent = (v) => `"${v.replace(/"/g, '""')}"`;
     const pgLit = (v) => `'${v.replace(/'/g, "''")}'`;
+    const pgEnsureRole = (u, p) => [
+      "DO $$ BEGIN",
+      `  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = ${pgLit(u)}) THEN`,
+      `    CREATE ROLE ${pgIdent(u)} LOGIN PASSWORD ${pgLit(p)};`,
+      "  ELSE",
+      `    ALTER ROLE ${pgIdent(u)} LOGIN PASSWORD ${pgLit(p)};`,
+      "  END IF;",
+      "END $$;"
+    ];
+    const pgGrant = (u) => {
+      const dbs = u.databases && u.databases.length > 0 ? u.databases : [name];
+      const lines = [];
+      for (const db of dbs) {
+        if (u.access === "readonly") {
+          lines.push(`GRANT CONNECT ON DATABASE ${pgIdent(db)} TO ${pgIdent(u.username)};`, `\\connect ${pgIdent(db)}`, `GRANT USAGE ON SCHEMA public TO ${pgIdent(u.username)};`, `GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${pgIdent(u.username)};`, `ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO ${pgIdent(u.username)};`, "\\connect postgres");
+        } else {
+          lines.push(`GRANT ALL PRIVILEGES ON DATABASE ${pgIdent(db)} TO ${pgIdent(u.username)};`);
+        }
+      }
+      return lines;
+    };
+    const extraUsers2 = database.users || [];
     return [
       pantryEnvActivation(),
       "for i in $(seq 1 30); do pg_isready -h 127.0.0.1 -p 5432 -q && break; sleep 2; done",
       "psql -h 127.0.0.1 -p 5432 -U postgres <<'TS_CLOUD_PG_EOF'",
-      "DO $$ BEGIN",
-      `  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = ${pgLit(user)}) THEN`,
-      `    CREATE ROLE ${pgIdent(user)} LOGIN PASSWORD ${pgLit(pass)};`,
-      "  END IF;",
-      "END $$;",
+      ...pgEnsureRole(user, pass),
       `SELECT 'CREATE DATABASE ${pgIdent(name)} OWNER ${pgIdent(user)}' ` + `WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = ${pgLit(name)})\\gexec`,
+      ...extraUsers2.flatMap((u) => [...pgEnsureRole(u.username, u.password), ...pgGrant(u)]),
       "TS_CLOUD_PG_EOF"
     ];
   }
+  const sock = useMariadb ? "/var/lib/pantry/mariadb/mariadbd.sock" : "/var/lib/pantry/mysql/mysqld.sock";
   const ident = (v) => v.replace(/`/g, "``");
   const lit = (v) => v.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+  const mysqlUser = (u) => {
+    const dbs = u.databases && u.databases.length > 0 ? u.databases : [name];
+    const priv = u.access === "readonly" ? "SELECT" : "ALL PRIVILEGES";
+    const lines = [
+      `CREATE USER IF NOT EXISTS '${lit(u.username)}'@'%' IDENTIFIED BY '${lit(u.password)}';`,
+      `CREATE USER IF NOT EXISTS '${lit(u.username)}'@'localhost' IDENTIFIED BY '${lit(u.password)}';`,
+      `ALTER USER '${lit(u.username)}'@'%' IDENTIFIED BY '${lit(u.password)}';`,
+      `ALTER USER '${lit(u.username)}'@'localhost' IDENTIFIED BY '${lit(u.password)}';`
+    ];
+    for (const db of dbs) {
+      lines.push(`GRANT ${priv} ON \`${ident(db)}\`.* TO '${lit(u.username)}'@'%';`, `GRANT ${priv} ON \`${ident(db)}\`.* TO '${lit(u.username)}'@'localhost';`);
+    }
+    return lines;
+  };
+  const extraUsers = database.users || [];
   return [
     pantryEnvActivation(),
-    "for i in $(seq 1 30); do mysqladmin -h 127.0.0.1 -P 3306 -u root ping 2>/dev/null | grep -q alive && break; sleep 2; done",
-    "mysql -h 127.0.0.1 -P 3306 -u root <<'TS_CLOUD_SQL_EOF'",
+    `for i in $(seq 1 30); do mysqladmin --socket=${sock} -u root ping 2>/dev/null | grep -q alive && break; sleep 2; done`,
+    `mysql --socket=${sock} -u root <<'TS_CLOUD_SQL_EOF'`,
     `CREATE DATABASE IF NOT EXISTS \`${ident(name)}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`,
-    `CREATE USER IF NOT EXISTS '${lit(user)}'@'%' IDENTIFIED BY '${lit(pass)}';`,
-    `GRANT ALL PRIVILEGES ON \`${ident(name)}\`.* TO '${lit(user)}'@'%';`,
+    ...mysqlUser({ username: user, password: pass }),
+    ...extraUsers.flatMap(mysqlUser),
     "FLUSH PRIVILEGES;",
     "TS_CLOUD_SQL_EOF"
   ];
@@ -83677,6 +83816,12 @@ function buildNginxServiceScript(projectDir = "/opt/pantry") {
     "    fastcgi_temp_path /var/lib/nginx/fastcgi;",
     "    uwsgi_temp_path /var/lib/nginx/uwsgi;",
     "    scgi_temp_path /var/lib/nginx/scgi;",
+    "    server {",
+    "        listen 80 default_server;",
+    "        listen [::]:80 default_server;",
+    "        server_name _;",
+    "        return 444;",
+    "    }",
     "    include /etc/nginx/sites-enabled/*;",
     "}",
     "TS_CLOUD_NGINXCONF_EOF",
@@ -85620,10 +85765,22 @@ function resolveSslProvider(site) {
     return site.ssl.provider;
   return site.domain ? "letsencrypt" : "none";
 }
-function buildCertbotInstallScript() {
+var DNS_PLUGINS = {
+  cloudflare: { pkg: "python3-certbot-dns-cloudflare", plugin: "dns-cloudflare" },
+  route53: { pkg: "python3-certbot-dns-route53", plugin: "dns-route53" },
+  digitalocean: { pkg: "python3-certbot-dns-digitalocean", plugin: "dns-digitalocean" },
+  google: { pkg: "python3-certbot-dns-google", plugin: "dns-google" }
+};
+function dnsCredentialsPath(provider) {
+  return `/etc/letsencrypt/ts-cloud-${provider}.ini`;
+}
+function buildCertbotInstallScript(dns2) {
+  const plugin = dns2 ? DNS_PLUGINS[dns2.provider] : undefined;
+  const pkgs = ["certbot", "python3-certbot-nginx", ...plugin ? [plugin.pkg] : []].join(" ");
+  const installLine = plugin ? `apt-get update -y && apt-get install -y ${pkgs}` : `command -v certbot >/dev/null 2>&1 || { apt-get update -y && apt-get install -y ${pkgs}; }`;
   return [
     "export DEBIAN_FRONTEND=noninteractive",
-    "command -v certbot >/dev/null 2>&1 || { apt-get update -y && apt-get install -y certbot python3-certbot-nginx; }",
+    installLine,
     "mkdir -p /etc/letsencrypt/renewal-hooks/deploy",
     "cat > /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh <<'TS_CLOUD_HOOK_EOF'",
     "#!/bin/sh",
@@ -85634,15 +85791,34 @@ function buildCertbotInstallScript() {
     "systemctl start certbot.timer 2>/dev/null || true"
   ];
 }
-function buildCertbotIssueScript(options) {
-  const domains = [options.domain, ...options.aliases || []].filter(Boolean);
-  const args = [
-    "certbot --nginx",
-    "--non-interactive",
-    "--agree-tos",
-    "--keep-until-expiring",
-    options.redirect === false ? "--no-redirect" : "--redirect"
+function buildDnsCredentialsScript(dns2) {
+  if (!dns2.credentials || Object.keys(dns2.credentials).length === 0)
+    return [];
+  const file = dnsCredentialsPath(dns2.provider);
+  const lines = Object.entries(dns2.credentials).map(([k, v]) => `${k} = ${v}`).join(`
+`);
+  return [
+    `cat > ${file} <<'TS_CLOUD_DNSCREDS_EOF'`,
+    lines,
+    "TS_CLOUD_DNSCREDS_EOF",
+    `chmod 600 ${file}`
   ];
+}
+function buildCertbotIssueScript(options) {
+  const dns2 = options.dns;
+  const domains = options.wildcard ? [`*.${options.domain}`, options.domain] : [options.domain, ...options.aliases || []].filter(Boolean);
+  const args = ["certbot", "--non-interactive", "--agree-tos", "--keep-until-expiring"];
+  if (dns2) {
+    const plugin = DNS_PLUGINS[dns2.provider].plugin;
+    args.push(`--${plugin}`);
+    if (dns2.provider !== "route53" && dns2.credentials)
+      args.push(`--${plugin}-credentials ${dnsCredentialsPath(dns2.provider)}`);
+    if (typeof dns2.propagationSeconds === "number" && dns2.provider !== "route53")
+      args.push(`--${plugin}-propagation-seconds ${dns2.propagationSeconds}`);
+    args.push("certonly");
+  } else {
+    args.push("--nginx", options.redirect === false ? "--no-redirect" : "--redirect");
+  }
   if (options.email)
     args.push(`-m ${options.email}`);
   else
@@ -85654,12 +85830,20 @@ function buildCertbotIssueScript(options) {
 function buildSslScript(site) {
   if (resolveSslProvider(site) !== "letsencrypt" || !site.domain)
     return [];
+  const ssl = site.ssl;
+  const dns2 = ssl?.dns;
+  const wildcard = ssl?.wildcard === true;
+  if (wildcard && !dns2)
+    return [];
   return [
-    ...buildCertbotInstallScript(),
+    ...buildCertbotInstallScript(dns2),
+    ...dns2 ? buildDnsCredentialsScript(dns2) : [],
     ...buildCertbotIssueScript({
       domain: site.domain,
       aliases: site.aliases,
-      email: site.ssl?.email
+      email: ssl?.email,
+      wildcard,
+      dns: dns2
     })
   ];
 }
@@ -85804,6 +85988,21 @@ function writeSharedEnv(sharedEnvPath, env2) {
     `chmod 600 ${sharedEnvPath}`
   ];
 }
+function writeFileHeredoc2(path, body, marker) {
+  return [`cat > ${path} <<'${marker}'`, body.replace(/\n$/, ""), marker, `chmod 600 ${path}`];
+}
+function buildCredentialFiles(releaseDir, creds) {
+  if (!creds)
+    return [];
+  const out = [];
+  if (creds.composerAuth) {
+    const json = typeof creds.composerAuth === "string" ? creds.composerAuth : JSON.stringify(creds.composerAuth, null, 2);
+    out.push(...writeFileHeredoc2(`${releaseDir}/auth.json`, json, "TS_CLOUD_AUTHJSON_EOF"));
+  }
+  if (creds.npmrc)
+    out.push(...writeFileHeredoc2(`${releaseDir}/.npmrc`, creds.npmrc, "TS_CLOUD_NPMRC_EOF"));
+  return out;
+}
 function buildLaravelDeployScript(options) {
   const { siteName, site, releaseId, commit } = options;
   if (!site.repository?.url)
@@ -85830,6 +86029,7 @@ function buildLaravelDeployScript(options) {
       out.push(...buildGitCheckoutScript({ repository: site.repository, releaseDir: paths.release, commit }));
       out.push(...buildLinkSharedPaths(paths, sharedPaths));
       out.push(`cd ${paths.release}`);
+      out.push(...buildCredentialFiles(paths.release, site.credentials));
       out.push(`chown -R www-data:www-data ${paths.shared}/storage 2>/dev/null || true`, `[ -d ${paths.release}/bootstrap/cache ] && chown -R www-data:www-data ${paths.release}/bootstrap/cache 2>/dev/null || true`, `chmod -R ug+rwX ${paths.shared}/storage 2>/dev/null || true`);
     } else if (line === MACRO_ACTIVATE_RELEASE) {
       out.push(...buildActivateRelease(paths));
@@ -86275,9 +86475,11 @@ export {
   resolveQueueNames,
   resolveProjectStackName,
   resolveObjectStorage,
+  resolveManagementDashboardSite,
   resolveHetznerApiToken,
   resolveExecStart,
   resolveDeployBucketName,
+  resolveDashboardDomain,
   resolveCredentials,
   resolveCloudProvider,
   resolveApp,
@@ -86340,6 +86542,7 @@ export {
   hashFile,
   hashDirectory,
   hashBuffer,
+  hasManagementDashboardSite,
   guardDutyManager,
   globalResourceManager,
   getTimestamp,

package/dist/ui/404.html

@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Page Not Found</title>
+  <style>
+    body { font-family: system-ui, sans-serif; display: flex; align-items: center; justify-content: center; min-height: 100vh; margin: 0; }
+    .container { text-align: center; }
+    h1 { font-size: 6rem; margin: 0; color: #333; }
+    p { color: #666; }
+    a { color: #0066cc; }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <h1>404</h1>
+    <p>Page not found</p>
+    <a href="/">Go home</a>
+  </div>
+</body>
+</html>