@stacksjs/ts-cloud 0.5.1 → 0.5.3

package/dist/deploy/serverless-app.d.ts

@@ -51,3 +51,10 @@ export declare function rollbackServerlessApp(config: CloudConfig, environment:
 export declare function setMaintenance(config: CloudConfig, environment: EnvironmentType, enabled: boolean, bypassSecret?: string): Promise<void>;
 /** Invoke the CLI function with an arbitrary command (e.g. `cloud command "migrate"`). */
 export declare function runRemoteCommand(config: CloudConfig, environment: EnvironmentType, command: string): Promise<string>;
+/**
+ * Run a SQL statement against a (private, in-VPC) serverless database via the CLI
+ * function — no bastion needed. Requires the `tscloud/serverless` PHP bridge
+ * (`tscloud:db-query`). The SQL is base64-encoded so it survives the runtime's
+ * whitespace argument parsing.
+ */
+export declare function runDbQuery(config: CloudConfig, environment: EnvironmentType, sql: string): Promise<string>;

package/dist/drivers/shared/compute-ops.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Forge-style operational commands for a provisioned compute fleet, run over
+ * the active driver (SSH/SSM): roll a site back to a previous release, read a
+ * site's deployment history, and run a reusable server recipe across servers.
+ *
+ * Each finds the project's targets via the driver, builds a small shell script
+ * with the shared generators, and runs it on every box — mirroring how
+ * {@link import('./compute-deploy').deploySiteRelease} drives a deploy.
+ */
+import type { CloudDriver, EnvironmentType, RemoteDeployInstanceResult } from '@ts-cloud/core';
+export interface ComputeOpsLogger {
+    info(message: string): void;
+    warn(message: string): void;
+    error(message: string): void;
+    step(message: string): void;
+    success(message: string): void;
+}
+export interface ComputeOpsContext {
+    driver: CloudDriver;
+    slug: string;
+    environment: EnvironmentType;
+    /** Target role label. @default 'app' */
+    role?: string;
+    logger?: ComputeOpsLogger;
+}
+export interface ComputeOpsResult {
+    success: boolean;
+    error?: string;
+    perInstance?: RemoteDeployInstanceResult[];
+}
+/**
+ * Roll a site back to a previous release (Forge-style). With `to`, points
+ * `current` at `releases/<to>`; otherwise the most recent prior release. After
+ * flipping the symlink, php-fpm is restarted and queue workers are signalled so
+ * they pick up the rolled-back code.
+ */
+export declare function rollbackComputeSite(ctx: ComputeOpsContext, options: {
+    siteName: string;
+    to?: string;
+}): Promise<ComputeOpsResult>;
+/**
+ * Read a site's on-box deployment history (the log written by
+ * {@link import('./releases').buildDeployHistoryHeader}). Returns the per-server
+ * output so the caller can print the most recent deploys.
+ */
+export declare function getComputeDeployHistory(ctx: ComputeOpsContext, options: {
+    siteName: string;
+    limit?: number;
+}): Promise<ComputeOpsResult>;
+/**
+ * Run a reusable server recipe (a bash script) across the project's servers as
+ * a chosen user (Forge's Recipes). The recipe runs through a login shell so
+ * pantry's env is loaded; output is captured per server.
+ */
+export declare function runComputeRecipe(ctx: ComputeOpsContext, options: {
+    name: string;
+    script: string[];
+    user?: string;
+}): Promise<ComputeOpsResult>;

package/dist/drivers/shared/nginx-vhost.d.ts

@@ -13,8 +13,15 @@
  * The block listens on :80 only; TLS (the `:443` block + redirect) is layered
  * on by certbot in the SSL step, so this stays stable across cert renewals.
  */
-import type { SiteConfig } from '@ts-cloud/core';
+import type { SiteConfig, SiteNginxConfig } from '@ts-cloud/core';
 export type NginxSiteType = NonNullable<SiteConfig['type']>;
+/**
+ * Resolve the nginx directive lines for a site's vhost from its
+ * {@link SiteNginxConfig} and the server's reusable templates: the referenced
+ * template's lines first, then the per-site `serverSnippet`. Unknown template
+ * names resolve to nothing. Returns `[]` when there's no customization.
+ */
+export declare function resolveNginxSnippet(nginx: SiteNginxConfig | undefined, templates: Record<string, string[]> | undefined): string[];
 export interface NginxVhostOptions {
     /** Site key — names the config file (`/etc/nginx/sites-available/<siteName>`). */
     siteName: string;
@@ -56,6 +63,14 @@ export interface NginxVhostOptions {
         password: string;
         realm?: string;
     };
+    /**
+     * Custom nginx directive lines injected into the server block (after the
+     * managed directives) — a resolved reusable template plus per-site snippet.
+     * See {@link import('@ts-cloud/core').SiteNginxConfig}.
+     */
+    serverSnippet?: string[];
+    /** `client_max_body_size` override for this vhost (e.g. `'256M'`). */
+    clientMaxBodySize?: string;
 }
 /** Path of the htpasswd file for a site. */
 export declare function htpasswdPath(siteName: string): string;

package/dist/drivers/shared/php-provision.d.ts

@@ -16,7 +16,21 @@ export interface PhpProvisionOptions {
     installNginx?: boolean;
     /** Install Composer. @default true */
     installComposer?: boolean;
+    /**
+     * Apply production OPcache + php.ini tuning (Forge's "Optimize for
+     * Production"). @default true
+     */
+    optimizeForProduction?: boolean;
+    /** Extra `php.ini` directives merged on top of (or instead of) the tuning. */
+    ini?: Record<string, string>;
 }
+/**
+ * The production OPcache + runtime tuning Forge applies via "Optimize for
+ * Production". Timestamp validation is off because every deploy restarts
+ * php-fpm (so a fresh release is always recompiled); the larger buffers and
+ * realpath cache cut per-request overhead.
+ */
+export declare const PRODUCTION_PHP_INI: Readonly<Record<string, string>>;
 /** PHP-FPM listen address for nginx `fastcgi_pass` (pantry's php-fpm is TCP). */
 export declare const PHP_FPM_LISTEN = "127.0.0.1:9074";
 /**
@@ -27,10 +41,20 @@ export declare const PHP_FPM_LISTEN = "127.0.0.1:9074";
 export declare function phpFpmSocketPath(_version?: string): string;
 /** Resolve the default PHP version from the requested set. */
 export declare function resolveDefaultPhpVersion(options?: PhpProvisionOptions): string;
+/** Resolve the effective php.ini directives for the given options. */
+export declare function resolvePhpIni(options?: PhpProvisionOptions): Record<string, string>;
+/**
+ * Write a ts-cloud-managed `php.ini` drop-in with the resolved directives and
+ * restart php-fpm so it takes effect. PHP's ini layout is discovered at runtime
+ * via `php -i` (works regardless of pantry's compiled paths): the additional-ini
+ * scan dir is used when present, otherwise a managed marker block is merged into
+ * the loaded `php.ini`. Returns `[]` when there's nothing to set.
+ */
+export declare function buildPhpTuningScript(options?: PhpProvisionOptions): string[];
 /**
  * Build the shell command lines that install PHP-FPM + Composer (+ the nginx
- * binary) via pantry and start php-fpm as a system service. Assumes the pantry
- * CLI is already bootstrapped (see
+ * binary) via pantry, start php-fpm as a system service, and apply production
+ * php.ini tuning. Assumes the pantry CLI is already bootstrapped (see
  * {@link import('./package-manager').buildPantryBootstrapScript}).
  */
 export declare function buildPhpProvisionScript(options?: PhpProvisionOptions): string[];

package/dist/drivers/shared/releases.d.ts

@@ -16,6 +16,14 @@
 export declare const DEFAULT_SHARED_PATHS: readonly string[];
 /** Default number of past releases to retain for rollback. */
 export declare const DEFAULT_KEEP_RELEASES = 4;
+/** Number of per-deploy output logs to keep on the box. */
+export declare const DEFAULT_KEEP_DEPLOY_LOGS = 20;
+/** ts-cloud metadata dir for a site (deploy history + per-deploy logs). */
+export declare function deployMetaDir(base: string): string;
+/** Append-only deploy history log path for a site. */
+export declare function deployHistoryPath(base: string): string;
+/** Per-deploy output log path for a release. */
+export declare function deployLogPath(base: string, releaseId: string): string;
 export interface ReleasePaths {
     /** Site base directory (`/var/www/<site>`). */
     base: string;
@@ -61,3 +69,23 @@ export declare function buildRollbackScript(paths: ReleasePaths, options?: {
  * at the newest, so it is never pruned.
  */
 export declare function buildPruneReleases(paths: ReleasePaths, keep?: number): string[];
+export interface DeployHistoryOptions {
+    /** This deploy's release id. */
+    releaseId: string;
+    /** Commit SHA being deployed (recorded in the history line). */
+    commit?: string;
+    /** Branch being deployed. */
+    branch?: string;
+    /** Per-deploy logs to retain. @default {@link DEFAULT_KEEP_DEPLOY_LOGS} */
+    keepLogs?: number;
+}
+/**
+ * Header lines that record deployment history + capture per-deploy output
+ * (Forge's deployment log). Emitted near the top of the deploy script: it tees
+ * all stdout/stderr to `<base>/.ts-cloud/deploys/<releaseId>.log` and installs
+ * an EXIT trap that appends a `<ts>\t<releaseId>\t<commit>\t<status>` line to
+ * `<base>/.ts-cloud/deploy-history.log` — so both successful and failed deploys
+ * are recorded (the trap reads `$?`). Requires bash (the deploy script already
+ * uses `set -euo pipefail`).
+ */
+export declare function buildDeployHistoryHeader(base: string, options: DeployHistoryOptions): string[];

package/dist/index.js

@@ -25951,11 +25951,16 @@ function composeServerlessAppTemplate(opts) {
     ...hasQueue ? { TSCLOUD_QUEUE: queueNames[0] } : {},
     ...app.env ?? {}
   });
+  const efsEnabled = Boolean(app.efs);
+  const efsOpts = typeof app.efs === "object" ? app.efs : {};
+  const efsMountPath = efsOpts.mountPath ?? "/mnt/local";
+  const efsProvision = efsEnabled && !efsOpts.accessPointArn;
+  const efsAccessPoint = efsOpts.accessPointArn ?? (efsProvision ? Fn2.getAtt("EfsAccessPoint", "Arn") : undefined);
   const subnets = app.vpc?.subnets ?? [];
   const hasVpc = subnets.length > 0;
-  const needsDataVpc = app.cache?.driver === "elasticache" || app.database?.connection === "aurora-serverless" || Boolean(app.rdsProxy);
+  const needsDataVpc = app.cache?.driver === "elasticache" || app.database?.connection === "aurora-serverless" || Boolean(app.rdsProxy) || efsEnabled;
   if (needsDataVpc && !hasVpc) {
-    throw new Error("serverless app: elasticache / aurora-serverless / rdsProxy require app.vpc.subnets (private subnets) to be set.");
+    throw new Error("serverless app: elasticache / aurora-serverless / rdsProxy / efs require app.vpc.subnets (private subnets) to be set.");
   }
   const vpcConfig = hasVpc ? {
     VpcConfig: {
@@ -25966,6 +25971,15 @@ function composeServerlessAppTemplate(opts) {
       ]
     }
   } : {};
+  const efsDependsOn = efsProvision ? subnets.map((_, i) => `EfsMountTarget${i}`) : [];
+  const efsConfig = efsEnabled ? { FileSystemConfigs: [{ Arn: efsAccessPoint, LocalMountPath: efsMountPath }] } : {};
+  if (efsEnabled) {
+    inlinePolicies[0].PolicyDocument.Statement.push({
+      Effect: "Allow",
+      Action: ["elasticfilesystem:ClientMount", "elasticfilesystem:ClientWrite", "elasticfilesystem:ClientRootAccess", "elasticfilesystem:DescribeMountTargets"],
+      Resource: "*"
+    });
+  }
   function addFunction(logicalId, name, handler8, mode, memory, timeout, reservedConcurrency, tmp = tmpStorage) {
     resources[`${logicalId}LogGroup`] = {
       Type: "AWS::Logs::LogGroup",
@@ -25983,7 +25997,7 @@ function composeServerlessAppTemplate(opts) {
     };
     resources[logicalId] = {
       Type: "AWS::Lambda::Function",
-      DependsOn: [`${logicalId}LogGroup`],
+      DependsOn: [`${logicalId}LogGroup`, ...efsDependsOn],
       Properties: {
         FunctionName: name,
         Architectures: [architecture],
@@ -25994,7 +26008,8 @@ function composeServerlessAppTemplate(opts) {
         EphemeralStorage: { Size: tmp },
         ...codeProps,
         ...reservedConcurrency !== undefined ? { ReservedConcurrentExecutions: reservedConcurrency } : {},
-        ...vpcConfig
+        ...vpcConfig,
+        ...efsConfig
       }
     };
   }
@@ -26243,10 +26258,37 @@ function composeServerlessAppTemplate(opts) {
             DomainName: Fn2.getAtt("AssetsBucket", "RegionalDomainName"),
             OriginAccessControlId: Fn2.ref("AssetsOAC"),
             S3OriginConfig: { OriginAccessIdentity: "" }
-          }]
+          }],
+          ...app.assetDomain ? {
+            Aliases: [app.assetDomain],
+            ViewerCertificate: {
+              AcmCertificateArn: app.assetCertificateArn,
+              SslSupportMethod: "sni-only",
+              MinimumProtocolVersion: "TLSv1.2_2021"
+            }
+          } : {}
         }
       }
     };
+    if (app.assetDomain) {
+      if (!app.assetCertificateArn)
+        throw new Error("serverless app: `assetDomain` requires `assetCertificateArn` (a us-east-1 ACM cert — CloudFront only accepts certs from us-east-1).");
+      if (app.hostedZoneId) {
+        resources.AssetsDomainRecord = {
+          Type: "AWS::Route53::RecordSet",
+          Properties: {
+            HostedZoneId: app.hostedZoneId,
+            Name: app.assetDomain,
+            Type: "A",
+            AliasTarget: {
+              DNSName: Fn2.getAtt("AssetsDistribution", "DomainName"),
+              HostedZoneId: "Z2FDTNDATAQYW2"
+            }
+          }
+        };
+      }
+      outputs.AssetDomain = { Description: "Custom asset CDN host", Value: app.assetDomain };
+    }
     resources.AssetsBucketPolicy = {
       Type: "AWS::S3::BucketPolicy",
       Properties: {
@@ -26325,6 +26367,37 @@ function composeServerlessAppTemplate(opts) {
       }
     };
   }
+  if (efsProvision) {
+    resources.EfsFileSystem = {
+      Type: "AWS::EFS::FileSystem",
+      Properties: {
+        Encrypted: true,
+        FileSystemTags: [{ Key: "Name", Value: `${slug}-${environment}-efs` }]
+      }
+    };
+    subnets.forEach((subnetId, i) => {
+      resources[`EfsMountTarget${i}`] = {
+        Type: "AWS::EFS::MountTarget",
+        Properties: {
+          FileSystemId: Fn2.ref("EfsFileSystem"),
+          SubnetId: subnetId,
+          SecurityGroups: [Fn2.getAtt("DataSecurityGroup", "GroupId")]
+        }
+      };
+    });
+    resources.EfsAccessPoint = {
+      Type: "AWS::EFS::AccessPoint",
+      Properties: {
+        FileSystemId: Fn2.ref("EfsFileSystem"),
+        PosixUser: { Uid: 1001, Gid: 1001 },
+        RootDirectory: {
+          Path: "/lambda",
+          CreationInfo: { OwnerUid: 1001, OwnerGid: 1001, Permissions: "0755" }
+        }
+      }
+    };
+    outputs.EfsFileSystemId = { Description: "EFS file system id", Value: Fn2.ref("EfsFileSystem") };
+  }
   if (app.cache?.driver === "elasticache") {
     resources.CacheSubnetGroup = {
       Type: "AWS::ElastiCache::SubnetGroup",
@@ -83132,6 +83205,8 @@ function buildFunctionEnv(app, ctx, environment, mode, secrets, assetUrl, queueN
     TSCLOUD_ENV: environment,
     MAINTENANCE_MODE: "0",
     ...app.octane ? { TSCLOUD_OCTANE: "1" } : {},
+    ...app.serveAssets ? { TSCLOUD_SERVE_ASSETS: "1" } : {},
+    ...app.redirectRobotsTxt === false ? { TSCLOUD_REDIRECT_ROBOTS_TXT: "0" } : {},
     ...laravelDefaults,
     ...infraEnv,
     ...ctx.app.cache?.driver !== "elasticache" ? { TSCLOUD_CACHE_TABLE: `${ctx.slug}-${environment}-cache` } : {},
@@ -83172,13 +83247,15 @@ function* walk3(dir) {
       yield full;
   }
 }
-async function uploadAssets(s32, bucket, dir, prefix) {
+async function uploadAssets(s32, bucket, dir, prefix, includeDotfiles = false) {
   let count = 0;
   for (const file of walk3(dir)) {
-    const key = `${prefix}/${relative6(dir, file).replace(/\\/g, "/")}`;
+    const rel = relative6(dir, file).replace(/\\/g, "/");
+    if (!includeDotfiles && rel.split("/").some((seg) => seg.startsWith(".")))
+      continue;
     await s32.putObject({
       bucket,
-      key,
+      key: `${prefix}/${rel}`,
       body: readFileSync13(file),
       contentType: contentType(file),
       cacheControl: "public, max-age=31536000, immutable"
@@ -83249,7 +83326,7 @@ async function deployServerlessApp(config6, environment, opts = {}) {
       step(`Creating artifact bucket ${artifactBucket}`);
       await s32.createBucket(artifactBucket);
     }
-    const exists = await s32.headObject(artifactBucket, key).then(() => true).catch(() => false);
+    const exists = await s32.headObject(artifactBucket, key).then((r) => r !== null).catch(() => false);
     if (exists) {
       info("Artifact already uploaded — reusing");
     } else {
@@ -83262,7 +83339,20 @@ async function deployServerlessApp(config6, environment, opts = {}) {
   const composed = composeServerlessAppTemplate({ config: config6, environment, app, handlers, runtimeLayers });
   const templateBody = JSON.stringify(composed.template);
   const capabilities = ["CAPABILITY_NAMED_IAM"];
-  const stackExists = await cfn.describeStacks({ stackName }).then((r) => r.Stacks.length > 0).catch(() => false);
+  const status = await cfn.describeStacks({ stackName }).then((r) => r.Stacks[0]?.StackStatus).catch(() => {
+    return;
+  });
+  let stackExists = status !== undefined;
+  if (status && /DELETE_IN_PROGRESS/.test(status)) {
+    step("Waiting for an in-progress stack delete to finish");
+    await cfn.waitForStack(stackName, "stack-delete-complete").catch(() => {});
+    stackExists = false;
+  } else if (status && /(?:ROLLBACK_COMPLETE|REVIEW_IN_PROGRESS|CREATE_FAILED)/.test(status)) {
+    step(`Deleting unusable stack (status ${status}) before recreate`);
+    await cfn.deleteStack(stackName);
+    await cfn.waitForStack(stackName, "stack-delete-complete").catch(() => {});
+    stackExists = false;
+  }
   step(stackExists ? "Updating infrastructure stack" : "Creating infrastructure stack");
   try {
     if (stackExists) {
@@ -83284,10 +83374,10 @@ async function deployServerlessApp(config6, environment, opts = {}) {
   if (app.assets) {
     const assetsDir3 = join16(projectRoot, app.assets);
     if (existsSync17(assetsDir3)) {
-      const cdn = outputs.AssetsCdnDomain;
+      const cdn = app.assetDomain || outputs.AssetsCdnDomain;
       assetUrl = cdn ? `https://${cdn}/${artifactSha}` : undefined;
       step(`Syncing assets from ${app.assets}`);
-      const n = await uploadAssets(s32, ctx.assetsBucket, assetsDir3, artifactSha);
+      const n = await uploadAssets(s32, ctx.assetsBucket, assetsDir3, artifactSha, app.dotFilesAsAssets);
       info(`Uploaded ${n} asset(s)${assetUrl ? ` → ${assetUrl}` : ""}`);
     } else {
       warn(`Assets directory not found: ${assetsDir3}`);
@@ -83621,6 +83711,19 @@ function buildManagedDbEnv(database) {
 }
 
 // src/drivers/shared/php-provision.ts
+var PRODUCTION_PHP_INI = {
+  "opcache.enable": "1",
+  "opcache.enable_cli": "1",
+  "opcache.memory_consumption": "256",
+  "opcache.interned_strings_buffer": "16",
+  "opcache.max_accelerated_files": "20000",
+  "opcache.validate_timestamps": "0",
+  "opcache.revalidate_freq": "0",
+  "opcache.save_comments": "1",
+  "opcache.fast_shutdown": "1",
+  realpath_cache_size: "4096K",
+  realpath_cache_ttl: "600"
+};
 var PHP_FPM_LISTEN = "127.0.0.1:9074";
 function phpFpmSocketPath(_version) {
   return PHP_FPM_LISTEN;
@@ -83629,6 +83732,45 @@ function resolveDefaultPhpVersion(options = {}) {
   const versions = options.versions?.length ? options.versions : ["8.3"];
   return options.default && versions.includes(options.default) ? options.default : versions[0];
 }
+function resolvePhpIni(options = {}) {
+  const base = options.optimizeForProduction === false ? {} : { ...PRODUCTION_PHP_INI };
+  return { ...base, ...options.ini || {} };
+}
+function buildPhpTuningScript(options = {}) {
+  const ini = resolvePhpIni(options);
+  const keys = Object.keys(ini);
+  if (keys.length === 0)
+    return [];
+  const body = keys.map((k) => `${k}=${ini[k]}`);
+  const marker = "ts-cloud-managed";
+  return [
+    pantryEnvActivation(),
+    "TS_CLOUD_SCAN_DIR=$(php -i 2>/dev/null | awk -F' => ' '/^Scan this dir for additional .ini files/{print $2}' | head -1)",
+    `TS_CLOUD_LOADED_INI=$(php -r 'echo php_ini_loaded_file() ?: "";' 2>/dev/null)`,
+    'if [ -n "$TS_CLOUD_SCAN_DIR" ] && [ "$TS_CLOUD_SCAN_DIR" != "(none)" ]; then',
+    '  mkdir -p "$TS_CLOUD_SCAN_DIR"',
+    '  TS_CLOUD_PHP_INI="$TS_CLOUD_SCAN_DIR/zz-ts-cloud.ini"',
+    `  cat > "$TS_CLOUD_PHP_INI" <<'TS_CLOUD_PHPINI_EOF'`,
+    `; ${marker} — production PHP tuning`,
+    ...body,
+    "TS_CLOUD_PHPINI_EOF",
+    "else",
+    '  if [ -z "$TS_CLOUD_LOADED_INI" ]; then',
+    "    TS_CLOUD_INI_DIR=$(php -i 2>/dev/null | awk -F' => ' '/^Configuration File \\(php.ini\\) Path/{print $2}' | head -1)",
+    '    TS_CLOUD_LOADED_INI="$TS_CLOUD_INI_DIR/php.ini"',
+    '    mkdir -p "$TS_CLOUD_INI_DIR"',
+    '    touch "$TS_CLOUD_LOADED_INI"',
+    "  fi",
+    `  sed -i '/; ${marker} BEGIN/,/; ${marker} END/d' "$TS_CLOUD_LOADED_INI"`,
+    `  cat >> "$TS_CLOUD_LOADED_INI" <<'TS_CLOUD_PHPINI_EOF'`,
+    `; ${marker} BEGIN`,
+    ...body,
+    `; ${marker} END`,
+    "TS_CLOUD_PHPINI_EOF",
+    "fi",
+    `(cd ${PANTRY_PROJECT_DIR} && pantry restart php-fpm) 2>/dev/null || true`
+  ];
+}
 function buildPhpProvisionScript(options = {}) {
   const defaultVersion = resolveDefaultPhpVersion(options);
   const installNginx = options.installNginx !== false;
@@ -83640,11 +83782,22 @@ function buildPhpProvisionScript(options = {}) {
     specs.push("nginx.org");
   return [
     ...buildPantryInstallScript(specs),
-    ...buildPantryServiceScript(["php-fpm"])
+    ...buildPantryServiceScript(["php-fpm"]),
+    ...buildPhpTuningScript(options)
   ];
 }
 
 // src/drivers/shared/nginx-vhost.ts
+function resolveNginxSnippet(nginx, templates) {
+  if (!nginx)
+    return [];
+  const out = [];
+  if (nginx.template && templates?.[nginx.template])
+    out.push(...templates[nginx.template]);
+  if (nginx.serverSnippet)
+    out.push(...nginx.serverSnippet);
+  return out;
+}
 function htpasswdPath(siteName) {
   return `/etc/nginx/.htpasswd-${siteName}`;
 }
@@ -83677,6 +83830,9 @@ function vhostBody(options) {
     "    charset utf-8;",
     ""
   ];
+  if (options.clientMaxBodySize) {
+    lines.push(`    client_max_body_size ${options.clientMaxBodySize};`, "");
+  }
   if (options.auth) {
     lines.push(`    auth_basic "${options.auth.realm || "Restricted"}";`, `    auth_basic_user_file ${htpasswdPath(options.siteName)};`, "");
   }
@@ -83692,6 +83848,11 @@ function vhostBody(options) {
   } else {
     lines.push("    location / {", "        try_files $uri $uri/ =404;", "    }");
   }
+  if (options.serverSnippet && options.serverSnippet.length > 0) {
+    lines.push("");
+    for (const line of options.serverSnippet)
+      lines.push(line ? `    ${line}` : "");
+  }
   return lines;
 }
 function buildNginxVhost(options) {
@@ -84149,7 +84310,9 @@ function buildComputeProvisionScripts(config6) {
       versions: compute.php?.versions,
       default: compute.php?.default,
       extensions: compute.php?.extensions,
-      installNginx: useNginx
+      installNginx: useNginx,
+      optimizeForProduction: compute.php?.optimizeForProduction,
+      ini: compute.php?.ini
     }),
     ...useNginx ? buildNginxServiceScript() : []
   ] : undefined;
@@ -85269,7 +85432,9 @@ class HetznerDriver {
       versions: compute.php?.versions,
       default: compute.php?.default,
       extensions: compute.php?.extensions,
-      installNginx: compute.webServer !== "rpx"
+      installNginx: compute.webServer !== "rpx",
+      optimizeForProduction: compute.php?.optimizeForProduction,
+      ini: compute.php?.ini
     });
     const appUserData = wrapCloudInitUserData(buildUbuntuBootstrapScript({ runtime: "php", phpProvision: appPhp, servicesProvision: appProvision, baked }));
     const existingApp = all.filter((s) => matchesTsCloudLabels(s.labels, slug, environment, "app"));
@@ -85883,6 +86048,16 @@ function shellQuote(value) {
 // src/drivers/shared/releases.ts
 var DEFAULT_SHARED_PATHS = ["storage", ".env"];
 var DEFAULT_KEEP_RELEASES = 4;
+var DEFAULT_KEEP_DEPLOY_LOGS = 20;
+function deployMetaDir(base) {
+  return `${base.replace(/\/+$/, "")}/.ts-cloud`;
+}
+function deployHistoryPath(base) {
+  return `${deployMetaDir(base)}/deploy-history.log`;
+}
+function deployLogPath(base, releaseId) {
+  return `${deployMetaDir(base)}/deploys/${releaseId}.log`;
+}
 function releasePaths(base, releaseId) {
   const root = base.replace(/\/+$/, "");
   return {
@@ -85936,6 +86111,26 @@ function buildPruneReleases(paths, keep = DEFAULT_KEEP_RELEASES) {
     "done"
   ];
 }
+function buildDeployHistoryHeader(base, options) {
+  const meta = deployMetaDir(base);
+  const log4 = deployLogPath(base, options.releaseId);
+  const history = deployHistoryPath(base);
+  const keepLogs = Math.max(1, options.keepLogs ?? DEFAULT_KEEP_DEPLOY_LOGS);
+  const commit = options.commit || "";
+  const branch = options.branch || "";
+  return [
+    `mkdir -p ${meta}/deploys`,
+    `exec > >(tee -a ${log4}) 2>&1`,
+    `echo "[ts-cloud] deploy ${options.releaseId} commit=${commit} branch=${branch} starting $(date -u +%Y-%m-%dT%H:%M:%SZ)"`,
+    "ts_cloud_record_deploy() {",
+    "  TS_CLOUD_RC=$?",
+    '  if [ "$TS_CLOUD_RC" -eq 0 ]; then TS_CLOUD_ST=success; else TS_CLOUD_ST=failed; fi',
+    `  printf '%s\\t%s\\t%s\\t%s\\trc=%s\\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "${options.releaseId}" "${commit}" "$TS_CLOUD_ST" "$TS_CLOUD_RC" >> ${history}`,
+    "}",
+    "trap ts_cloud_record_deploy EXIT",
+    `ls -1t ${meta}/deploys/*.log 2>/dev/null | tail -n +${keepLogs + 1} | while read -r TS_CLOUD_OLDLOG; do rm -f "$TS_CLOUD_OLDLOG"; done`
+  ];
+}
 
 // src/drivers/shared/laravel-deploy.ts
 var MACRO_CREATE_RELEASE = "$CREATE_RELEASE";
@@ -86020,6 +86215,12 @@ function buildLaravelDeployScript(options) {
     "export COMPOSER_ALLOW_SUPERUSER=1",
     pantryEnvActivation()
   ];
+  out.push(...buildDeployHistoryHeader(base, {
+    releaseId,
+    commit,
+    branch: site.repository.branch,
+    keepLogs: keepReleases
+  }));
   out.push(...buildEnsureReleaseLayout(paths, sharedPaths));
   if (site.env && Object.keys(site.env).length > 0)
     out.push(...writeSharedEnv(`${paths.shared}/.env`, site.env));
@@ -86052,6 +86253,9 @@ function pantryExec(cmd) {
 function reEscape(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+function cronQuote(value) {
+  return `'${value.split("'").join("'\\''")}'`;
+}
 function slugify(value) {
   return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "unnamed";
 }
@@ -86153,9 +86357,18 @@ function buildSiteServicesScript(options) {
     out.push(`systemctl enable ${name}.service`, `systemctl restart ${name}.service`);
   }
   const cronPath = schedulerCronPath(slug, siteName);
-  if (site.scheduler) {
-    const cron = `* * * * * root cd ${current} && ${PANTRY_ENV_EVAL} && ${phpBin} artisan schedule:run >> /dev/null 2>&1
-`;
+  const scheduler2 = site.scheduler;
+  const schedulerEnabled = scheduler2 === true || typeof scheduler2 === "object" && scheduler2 !== null;
+  if (schedulerEnabled) {
+    const heartbeat = typeof scheduler2 === "object" && scheduler2 !== null ? scheduler2 : undefined;
+    let command = `cd ${current} && ${PANTRY_ENV_EVAL} && ${phpBin} artisan schedule:run >> /dev/null 2>&1`;
+    if (heartbeat?.heartbeatUrl) {
+      const method = heartbeat.heartbeatMethod || "GET";
+      const methodFlag = method === "GET" ? "" : `-X ${method} `;
+      command += ` && curl -fsS -m 10 ${methodFlag}${cronQuote(heartbeat.heartbeatUrl)} >/dev/null 2>&1`;
+    }
+    const cron = `* * * * * root ${command}
+`.replace(/%/g, "\\%");
     out.push(`cat > ${cronPath} <<'TS_CLOUD_CRON_EOF'`, cron.replace(/\n$/, ""), "TS_CLOUD_CRON_EOF", `chmod 644 ${cronPath}`);
   } else {
     out.push(`rm -f ${cronPath}`);
@@ -86223,7 +86436,9 @@ async function deploySiteRelease(driver, options, logger4 = noopLogger) {
       phpVersion,
       redirects: site.redirects,
       ssl: customCert,
-      auth: site.auth && site.auth.enabled !== false && site.auth.password ? { username: site.auth.username || "admin", password: site.auth.password, realm: site.auth.realm } : undefined
+      auth: site.auth && site.auth.enabled !== false && site.auth.password ? { username: site.auth.username || "admin", password: site.auth.password, realm: site.auth.realm } : undefined,
+      serverSnippet: resolveNginxSnippet(site.nginx, compute2?.nginxTemplates),
+      clientMaxBodySize: site.nginx?.clientMaxBodySize
     }) : [];
     const sslScript = useNginx ? buildSslScript(site) : [];
     const servicesScript = siteHasServices(site) ? buildSiteServicesScript({ slug, siteName, site, phpVersion, appBase }) : [];
@@ -86286,7 +86501,9 @@ async function deploySiteRelease(driver, options, logger4 = noopLogger) {
     appDir: `/var/www/${siteName}`,
     webDirectory: "",
     redirects: site.redirects,
-    auth: site.auth && site.auth.enabled !== false && site.auth.password ? { username: site.auth.username || "admin", password: site.auth.password, realm: site.auth.realm } : undefined
+    auth: site.auth && site.auth.enabled !== false && site.auth.password ? { username: site.auth.username || "admin", password: site.auth.password, realm: site.auth.realm } : undefined,
+    serverSnippet: resolveNginxSnippet(site.nginx, compute?.nginxTemplates),
+    clientMaxBodySize: site.nginx?.clientMaxBodySize
   }) : [];
   const staticSsl = wantsNginxStatic ? buildSslScript(site) : [];
   const remoteScript = [...baseScript, ...staticVhost, ...staticSsl];

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@stacksjs/ts-cloud",
   "type": "module",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "A lightweight, performant infrastructure-as-code library and CLI for deploying both server-based (EC2) and serverless applications.",
   "author": "Chris Breuer <chris@stacksjs.com>",
   "license": "MIT",
@@ -89,8 +89,8 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ts-cloud/aws-types": "0.5.1",
-    "@ts-cloud/core": "0.5.1",
+    "@ts-cloud/aws-types": "0.5.3",
+    "@ts-cloud/core": "0.5.3",
     "@stacksjs/ts-xml": "^0.1.0"
   },
   "devDependencies": {