@stacksjs/ts-cloud 0.5.16 → 0.5.18

package/dist/index.js

@@ -8440,18 +8440,19 @@ class S3Client {
       stream = blob.stream();
       totalSize = blob.size;
     }
-    const uploadId = await this.initiateMultipartUpload(bucket, key, options);
+    const { uploadId, baseUrl } = await this.initiateMultipartUpload(bucket, key, options);
     try {
-      const parts = await this.uploadParts(bucket, key, uploadId, stream, partSize, credentials, totalSize, options.concurrency || 4, options.onProgress);
-      return await this.completeMultipartUpload(bucket, key, uploadId, parts);
+      const parts = await this.uploadParts(bucket, key, baseUrl, uploadId, stream, partSize, credentials, totalSize, options.concurrency || 4, options.onProgress);
+      return await this.completeMultipartUpload(bucket, key, baseUrl, uploadId, parts);
     } catch (error) {
-      await this.abortMultipartUpload(bucket, key, uploadId).catch(() => {});
+      await this.abortMultipartUpload(bucket, key, uploadId, baseUrl).catch(() => {});
       throw error;
     }
   }
   async initiateMultipartUpload(bucket, key, options) {
     const credentials = await this.getCredentials();
-    const url = `${this.buildUrl(bucket, key)}?uploads`;
+    const baseUrl = this.buildUrl(bucket, key);
+    const url = `${baseUrl}?uploads`;
     const headers = {
       "Content-Type": options.contentType || detectContentType(key)
     };
@@ -8487,18 +8488,26 @@ class S3Client {
     if (!uploadIdMatch) {
       throw new S3Error("Failed to parse upload ID from response", 0, bucket, key);
     }
-    return uploadIdMatch[1];
+    let resolvedBaseUrl = baseUrl;
+    if (response.url) {
+      try {
+        const resolved = new URL(response.url);
+        resolved.search = "";
+        resolvedBaseUrl = resolved.toString();
+      } catch {}
+    }
+    return { uploadId: uploadIdMatch[1], baseUrl: resolvedBaseUrl };
   }
-  async uploadParts(bucket, key, uploadId, stream, partSize, credentials, totalSize, concurrency, onProgress) {
+  async uploadParts(bucket, key, baseUrl, uploadId, stream, partSize, credentials, totalSize, concurrency, onProgress) {
     const parts = [];
     const reader = stream.getReader();
     let partNumber = 1;
     let buffer = new Uint8Array(0);
     let loaded = 0;
     const totalParts = totalSize ? Math.ceil(totalSize / partSize) : undefined;
-    const uploadQueue = [];
+    const inFlight = new Map;
     const uploadPart = async (data, num) => {
-      const url = `${this.buildUrl(bucket, key)}?partNumber=${num}&uploadId=${encodeURIComponent(uploadId)}`;
+      const url = `${baseUrl}?partNumber=${num}&uploadId=${encodeURIComponent(uploadId)}`;
       const headers = {
         "Content-Length": String(data.byteLength),
         "x-amz-content-sha256": "UNSIGNED-PAYLOAD"
@@ -8514,15 +8523,24 @@ class S3Client {
       const response = await fetch(signed.url, {
         method: signed.method,
         headers: signed.headers,
-        body: data
+        body: data,
+        redirect: "error"
       });
       if (!response.ok) {
         const error = await response.text();
         throw new S3Error(`Failed to upload part ${num}: ${error}`, response.status, bucket, key);
       }
       const etag = (response.headers.get("ETag") || "").replace(/"/g, "");
+      if (!etag) {
+        throw new S3Error(`Missing ETag for part ${num}`, response.status, bucket, key);
+      }
       return { partNumber: num, etag };
     };
+    const drainOne = async () => {
+      const completed = await Promise.race(inFlight.values());
+      inFlight.delete(completed.partNumber);
+      parts.push(completed);
+    };
     while (true) {
       const { done, value } = await reader.read();
       if (value) {
@@ -8535,13 +8553,10 @@ class S3Client {
         const partData = buffer.slice(0, partSize);
         buffer = buffer.slice(partSize);
         const currentPartNumber = partNumber++;
-        if (uploadQueue.length >= concurrency) {
-          const completed = await Promise.race(uploadQueue);
-          parts.push(completed);
-          uploadQueue.splice(uploadQueue.indexOf(Promise.resolve(completed)), 1);
+        if (inFlight.size >= concurrency) {
+          await drainOne();
         }
-        const uploadPromise = uploadPart(partData, currentPartNumber);
-        uploadQueue.push(uploadPromise);
+        inFlight.set(currentPartNumber, uploadPart(partData, currentPartNumber));
         loaded += partData.byteLength;
         if (onProgress) {
           onProgress({
@@ -8555,14 +8570,15 @@ class S3Client {
       if (done)
         break;
     }
-    const remaining = await Promise.all(uploadQueue);
-    parts.push(...remaining);
+    while (inFlight.size > 0) {
+      await drainOne();
+    }
     parts.sort((a, b) => a.partNumber - b.partNumber);
     return parts;
   }
-  async completeMultipartUpload(bucket, key, uploadId, parts) {
+  async completeMultipartUpload(bucket, key, baseUrl, uploadId, parts) {
     const credentials = await this.getCredentials();
-    const url = `${this.buildUrl(bucket, key)}?uploadId=${encodeURIComponent(uploadId)}`;
+    const url = `${baseUrl}?uploadId=${encodeURIComponent(uploadId)}`;
     const partsXml = parts.map((p) => `<Part><PartNumber>${p.partNumber}</PartNumber><ETag>"${p.etag}"</ETag></Part>`).join("");
     const body = `<?xml version="1.0" encoding="UTF-8"?><CompleteMultipartUpload>${partsXml}</CompleteMultipartUpload>`;
     const signed = signRequest({
@@ -8588,9 +8604,9 @@ class S3Client {
     const etag = etagMatch ? etagMatch[1] : "";
     return { etag };
   }
-  async abortMultipartUpload(bucket, key, uploadId) {
+  async abortMultipartUpload(bucket, key, uploadId, baseUrl) {
     const credentials = await this.getCredentials();
-    const url = `${this.buildUrl(bucket, key)}?uploadId=${encodeURIComponent(uploadId)}`;
+    const url = `${baseUrl ?? this.buildUrl(bucket, key)}?uploadId=${encodeURIComponent(uploadId)}`;
     const signed = signRequest({
       method: "DELETE",
       url,
@@ -26399,14 +26415,7 @@ function composeServerlessAppTemplate(opts) {
         VisibilityConfig: { SampledRequestsEnabled: true, CloudWatchMetricsEnabled: true, MetricName: `${slug}-${environment}-waf` }
       }
     };
-    resources.WebAclAssociation = {
-      Type: "AWS::WAFv2::WebACLAssociation",
-      DependsOn: ["HttpStage"],
-      Properties: {
-        ResourceArn: Fn2.sub("arn:aws:apigateway:${AWS::Region}::/apis/${HttpApi}/stages/$default"),
-        WebACLArn: Fn2.getAtt("WebAcl", "Arn")
-      }
-    };
+    outputs.WafAclArn = { Description: "WAF web ACL ARN. Attach to a CloudFront distribution fronting the API to enforce (HTTP API v2 stages do not support direct WAF association).", Value: Fn2.getAtt("WebAcl", "Arn") };
   }
   if (hasVpc && needsDataVpc) {
     if (!app.vpc?.id)
@@ -84081,6 +84090,31 @@ function resolveNginxSnippet(nginx, templates) {
     out.push(...nginx.serverSnippet);
   return out;
 }
+function hstsHeader(hsts) {
+  if (!hsts)
+    return "";
+  const o = typeof hsts === "object" ? hsts : {};
+  const maxAge = o.maxAge ?? 31536000;
+  const parts = [`max-age=${maxAge}`];
+  if (o.includeSubDomains ?? true)
+    parts.push("includeSubDomains");
+  if (o.preload)
+    parts.push("preload");
+  return `    add_header Strict-Transport-Security "${parts.join("; ")}" always;`;
+}
+function securityRules(security) {
+  if (!security || !security.allow?.length && !security.deny?.length)
+    return [];
+  const lines = [];
+  for (const ip of security.deny || [])
+    lines.push(`    deny ${ip};`);
+  if (security.allow?.length) {
+    for (const ip of security.allow)
+      lines.push(`    allow ${ip};`);
+    lines.push("    deny all;");
+  }
+  return lines;
+}
 function htpasswdPath(siteName) {
   return `/etc/nginx/.htpasswd-${siteName}`;
 }
@@ -84089,7 +84123,7 @@ function isPhpSiteType(type) {
   return PHP_TYPES.has(type);
 }
 function defaultWebDirectory(type) {
-  return type === "laravel" || type === "statamic" || type === "wordpress" ? "public" : "";
+  return type === "laravel" || type === "statamic" ? "public" : "";
 }
 function resolveRoot(appDir, webDirectory) {
   const base = appDir.replace(/\/+$/, "");
@@ -84106,13 +84140,14 @@ function vhostBody(options) {
     `    root ${root};`,
     "",
     '    add_header X-Frame-Options "SAMEORIGIN";',
-    '    add_header X-Content-Type-Options "nosniff";',
-    "",
-    `    index ${isPhp ? "index.php index.html" : "index.html index.htm"};`,
-    "",
-    "    charset utf-8;",
-    ""
+    '    add_header X-Content-Type-Options "nosniff";'
   ];
+  const hsts = hstsHeader(options.hsts);
+  if (hsts)
+    lines.push(hsts);
+  for (const rule of securityRules(options.security))
+    lines.push(rule);
+  lines.push("", `    index ${isPhp ? "index.php index.html" : "index.html index.htm"};`, "", "    charset utf-8;", "");
   if (options.clientMaxBodySize) {
     lines.push(`    client_max_body_size ${options.clientMaxBodySize};`, "");
   }
@@ -84125,7 +84160,10 @@ function vhostBody(options) {
   if (Object.keys(options.redirects || {}).length > 0)
     lines.push("");
   if (isPhp) {
-    lines.push("    location / {", "        try_files $uri $uri/ /index.php?$query_string;", "    }", "", "    location = /favicon.ico { access_log off; log_not_found off; }", "    location = /robots.txt  { access_log off; log_not_found off; }", "", "    error_page 404 /index.php;", "", "    location ~ \\.php$ {", `        fastcgi_pass ${phpFpmSocketPath(phpVersion)};`, "        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;", "        include fastcgi_params;", "    }", "", "    location ~ /\\.(?!well-known).* {", "        deny all;", "    }");
+    lines.push("    location / {", "        try_files $uri $uri/ /index.php?$query_string;", "    }", "", "    location = /favicon.ico { access_log off; log_not_found off; }", "    location = /robots.txt  { access_log off; log_not_found off; }", "", "    error_page 404 /index.php;", "", "    location ~ \\.php$ {", `        fastcgi_pass ${options.fastcgiPass ?? phpFpmSocketPath(phpVersion)};`, "        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;", "        include fastcgi_params;", "    }", "", "    location ~ /\\.(?!well-known).* {", "        deny all;", "    }");
+    if (type === "wordpress") {
+      lines.push("", "    location = /xmlrpc.php { deny all; }", "    location ~* /(?:wp-config\\.php|readme\\.html|license\\.txt)$ { deny all; }", "    location ~* /wp-content/uploads/.*\\.php$ { deny all; }");
+    }
   } else if (type === "spa") {
     lines.push("    location / {", "        try_files $uri $uri/ /index.html;", "    }");
   } else {
@@ -84157,6 +84195,7 @@ function buildNginxVhost(options) {
       `    server_name ${serverNames};`,
       `    ssl_certificate ${options.ssl.certPath};`,
       `    ssl_certificate_key ${options.ssl.keyPath};`,
+      ...options.tlsProtocols?.length ? [`    ssl_protocols ${options.tlsProtocols.join(" ")};`] : [],
       "",
       ...body,
       "}"
@@ -84330,22 +84369,71 @@ function buildAutoUpdatesScript(enabled2 = true) {
 
 // src/drivers/shared/monitoring.ts
 var METRICS_PATH = "/var/lib/ts-cloud/metrics.json";
-function buildMonitoringScript(enabled2 = true) {
+var ALERT_STATE_PATH = "/var/lib/ts-cloud/alert-state";
+var DEFAULT_CPU_LOAD_PER_CORE = 2;
+var DEFAULT_MEM_PERCENT = 90;
+var DEFAULT_DISK_PERCENT = 90;
+var SERVICE_PROBES = [
+  ["nginx", 80],
+  ["phpFpm", 9074],
+  ["mysql", 3306],
+  ["postgres", 5432],
+  ["redis", 6379],
+  ["meilisearch", 7700]
+];
+function resolveMonitoring(monitoring = true) {
+  const obj = typeof monitoring === "object" ? monitoring : {};
+  const enabled2 = typeof monitoring === "boolean" ? monitoring : monitoring.enabled !== false;
+  return {
+    enabled: enabled2,
+    cpuLoadPerCore: obj.alerts?.cpuLoadPerCore ?? DEFAULT_CPU_LOAD_PER_CORE,
+    memPercent: obj.alerts?.memPercent ?? DEFAULT_MEM_PERCENT,
+    diskPercent: obj.alerts?.diskPercent ?? DEFAULT_DISK_PERCENT
+  };
+}
+function buildMonitoringScript(monitoring = true) {
+  const { enabled: enabled2, cpuLoadPerCore, memPercent, diskPercent } = resolveMonitoring(monitoring);
   if (!enabled2)
     return [];
+  const probeLines = SERVICE_PROBES.map(([name, port]) => `SVC_${name.toUpperCase()}=$(probe ${port})`);
+  const servicesJson = SERVICE_PROBES.map(([name]) => `"${name}":"$SVC_${name.toUpperCase()}"`).join(",");
   return [
     "mkdir -p /var/lib/ts-cloud",
     "cat > /usr/local/bin/ts-cloud-metrics.sh <<'TS_CLOUD_METRICS_EOF'",
     "#!/bin/bash",
-    "set -euo pipefail",
+    "set -uo pipefail",
     "LOAD=$(cut -d' ' -f1 /proc/loadavg)",
+    "CPUS=$(nproc)",
     "MEM_TOTAL=$(free -m | awk '/^Mem:/{print $2}')",
     "MEM_USED=$(free -m | awk '/^Mem:/{print $3}')",
+    "SWAP_TOTAL=$(free -m | awk '/^Swap:/{print $2}')",
+    "SWAP_USED=$(free -m | awk '/^Swap:/{print $3}')",
     `DISK_PCT=$(df -P / | awk 'NR==2{gsub("%","",$5); print $5}')`,
-    "CPUS=$(nproc)",
-    "cat > " + METRICS_PATH + " <<JSON",
-    '{"load":$LOAD,"cpus":$CPUS,"memTotalMb":$MEM_TOTAL,"memUsedMb":$MEM_USED,"diskUsedPct":$DISK_PCT}',
+    "UPTIME_SEC=$(cut -d' ' -f1 /proc/uptime | cut -d. -f1)",
+    `RX_BYTES=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{rx+=$3} END{print rx+0}' /proc/net/dev)`,
+    `TX_BYTES=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{tx+=$11} END{print tx+0}' /proc/net/dev)`,
+    "probe(){ (exec 3<>/dev/tcp/127.0.0.1/$1) 2>/dev/null && echo up || echo down; }",
+    ...probeLines,
+    "LOAD=${LOAD:-0}; CPUS=${CPUS:-1}; MEM_TOTAL=${MEM_TOTAL:-0}; MEM_USED=${MEM_USED:-0}",
+    "SWAP_TOTAL=${SWAP_TOTAL:-0}; SWAP_USED=${SWAP_USED:-0}; DISK_PCT=${DISK_PCT:-0}",
+    "UPTIME_SEC=${UPTIME_SEC:-0}; RX_BYTES=${RX_BYTES:-0}; TX_BYTES=${TX_BYTES:-0}",
+    "MEM_PCT=$(( MEM_TOTAL > 0 ? MEM_USED * 100 / MEM_TOTAL : 0 ))",
+    `cat > ${METRICS_PATH}.tmp <<JSON`,
+    '{"load":$LOAD,"cpus":$CPUS,"memTotalMb":$MEM_TOTAL,"memUsedMb":$MEM_USED,"memUsedPct":$MEM_PCT,"swapTotalMb":$SWAP_TOTAL,"swapUsedMb":$SWAP_USED,"diskUsedPct":$DISK_PCT,"uptimeSec":$UPTIME_SEC,"network":{"rxBytes":$RX_BYTES,"txBytes":$TX_BYTES},"services":{' + servicesJson + "}}",
     "JSON",
+    `mv -f ${METRICS_PATH}.tmp ${METRICS_PATH}`,
+    'ALERTS=""',
+    `if awk -v l="$LOAD" -v c="$CPUS" -v t=${cpuLoadPerCore} 'BEGIN{exit !(c>0 && l/c > t)}'; then ALERTS="$ALERTS load=$LOAD/${cpuLoadPerCore}xCPU"; fi`,
+    `if [ "\${MEM_PCT:-0}" -ge ${memPercent} ]; then ALERTS="$ALERTS mem=\${MEM_PCT}%"; fi`,
+    `if [ "\${DISK_PCT:-0}" -ge ${diskPercent} ]; then ALERTS="$ALERTS disk=\${DISK_PCT}%"; fi`,
+    `PREV=$(cat ${ALERT_STATE_PATH} 2>/dev/null || echo ok)`,
+    'if [ -n "$ALERTS" ]; then',
+    '  if [ "$PREV" != alert ] && [ -x /usr/local/bin/ts-cloud-notify ]; then /usr/local/bin/ts-cloud-notify "⚠️ $(hostname): resource alert —$ALERTS" || true; fi',
+    `  echo alert > ${ALERT_STATE_PATH}`,
+    "else",
+    '  if [ "$PREV" = alert ] && [ -x /usr/local/bin/ts-cloud-notify ]; then /usr/local/bin/ts-cloud-notify "✅ $(hostname): resource usage back to normal" || true; fi',
+    `  echo ok > ${ALERT_STATE_PATH}`,
+    "fi",
     "TS_CLOUD_METRICS_EOF",
     "chmod +x /usr/local/bin/ts-cloud-metrics.sh",
     "cat > /etc/systemd/system/ts-cloud-metrics.service <<'TS_CLOUD_METRICS_SVC_EOF'",
@@ -85386,6 +85474,10 @@ function buildRpxProvisionScript(options) {
   const version2 = proxy.version ?? "latest";
   const certsDir = config6.productionCerts.certsDir;
   const launcher = renderRpxLauncher(config6);
+  const upstreamTimeout = proxy.upstreamTimeout ?? 60;
+  const poolEnv = [`Environment=RPX_UPSTREAM_TIMEOUT=${upstreamTimeout}`];
+  if (typeof proxy.maxUpstreamConns === "number")
+    poolEnv.push(`Environment=RPX_MAX_UPSTREAM_CONNS=${proxy.maxUpstreamConns}`);
   return [
     "set -euo pipefail",
     `mkdir -p ${RPX_DIR} ${certsDir}`,
@@ -85401,6 +85493,7 @@ function buildRpxProvisionScript(options) {
       "Type=simple",
       `ExecStart=${bunBin} ${RPX_LAUNCHER_PATH}`,
       `Environment=BUN_INSTALL=/root/.bun`,
+      ...poolEnv,
       "Restart=always",
       "RestartSec=5",
       "LimitNOFILE=1048576",
@@ -86440,12 +86533,12 @@ function defaultDeployScriptFor(type) {
         MACRO_RESTART_QUEUES
       ];
     case "php":
+    case "wordpress":
       return [
         MACRO_CREATE_RELEASE,
         `${COMPOSER_INSTALL} || true`,
         MACRO_ACTIVATE_RELEASE
       ];
-    case "wordpress":
     case "static":
     case "spa":
       return [
@@ -86481,6 +86574,19 @@ function buildCredentialFiles(releaseDir, creds) {
     out.push(...writeFileHeredoc2(`${releaseDir}/.npmrc`, creds.npmrc, "TS_CLOUD_NPMRC_EOF"));
   return out;
 }
+function buildHealthCheckScript(site) {
+  const path = site.healthCheck?.path;
+  if (!path || !site.domain)
+    return [];
+  const p = path.startsWith("/") ? path : `/${path}`;
+  const url = `http://127.0.0.1${p}`;
+  return [
+    `echo "[ts-cloud] health check ${url} (Host: ${site.domain})"`,
+    "TS_CLOUD_HC_OK=0",
+    `for i in $(seq 1 10); do TS_CLOUD_HC=$(curl -s -o /dev/null -w "%{http_code}" -H "Host: ${site.domain}" -m 10 "${url}" 2>/dev/null || echo 000); case "$TS_CLOUD_HC" in 2*|3*) TS_CLOUD_HC_OK=1; break ;; esac; sleep 3; done`,
+    '[ "$TS_CLOUD_HC_OK" = 1 ] && echo "health check passed ($TS_CLOUD_HC)" || { echo "health check FAILED (last=$TS_CLOUD_HC)" >&2; exit 1; }'
+  ];
+}
 function buildLaravelDeployScript(options) {
   const { siteName, site, releaseId, commit } = options;
   if (!site.repository?.url)
@@ -86662,6 +86768,68 @@ function siteHasServices(site) {
   return !!(site.queues?.length || site.daemons?.length || site.scheduler);
 }
 
+// src/drivers/shared/php-fpm-pool.ts
+var PHP_FPM_POOL_DIR = "/var/lib/pantry/php-fpm/pool.d";
+var POOL_PORT_BASE = 9100;
+var POOL_PORT_SPAN = 400;
+function siteToken(siteName) {
+  const base = siteName.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  return (base || "site").slice(0, 28);
+}
+function siteUser(siteName) {
+  return `web_${siteToken(siteName)}`;
+}
+function phpFpmPoolPort(siteName) {
+  const token = siteToken(siteName);
+  let h = 0;
+  for (let i = 0;i < token.length; i++)
+    h = h * 31 + token.charCodeAt(i) >>> 0;
+  return POOL_PORT_BASE + h % POOL_PORT_SPAN;
+}
+function phpFpmPoolListen(siteName) {
+  return `127.0.0.1:${phpFpmPoolPort(siteName)}`;
+}
+function buildPhpFpmPoolConf(options) {
+  const pool = siteToken(options.siteName);
+  const user = siteUser(options.siteName);
+  const maxChildren = options.maxChildren ?? 10;
+  return [
+    `; ts-cloud-managed pool for ${options.siteName} (site isolation)`,
+    `[${pool}]`,
+    `user = ${user}`,
+    `group = ${user}`,
+    `listen = ${phpFpmPoolListen(options.siteName)}`,
+    "pm = dynamic",
+    `pm.max_children = ${maxChildren}`,
+    "pm.start_servers = 2",
+    "pm.min_spare_servers = 1",
+    "pm.max_spare_servers = 3",
+    "pm.max_requests = 500",
+    "catch_workers_output = yes",
+    `php_admin_value[open_basedir] = ${options.appBase}:/tmp`,
+    ""
+  ].join(`
+`);
+}
+function buildPhpFpmPoolScript(options) {
+  const user = siteUser(options.siteName);
+  const pool = siteToken(options.siteName);
+  const conf = `${PHP_FPM_POOL_DIR}/${pool}.conf`;
+  return [
+    `getent group ${user} >/dev/null || groupadd --system ${user}`,
+    `id -u ${user} >/dev/null 2>&1 || useradd --system --no-create-home --shell /usr/sbin/nologin -g ${user} ${user}`,
+    `usermod -aG ${user} www-data 2>/dev/null || true`,
+    `chown -R ${user}:${user} ${options.appBase} || true`,
+    `chmod -R g+rX ${options.appBase} || true`,
+    `chmod 600 ${options.appBase}/shared/.env 2>/dev/null || true`,
+    `mkdir -p ${PHP_FPM_POOL_DIR}`,
+    `cat > ${conf} <<'TS_CLOUD_FPMPOOL_EOF'`,
+    buildPhpFpmPoolConf(options).replace(/\n$/, ""),
+    "TS_CLOUD_FPMPOOL_EOF",
+    `(cd ${PANTRY_PROJECT_DIR} && pantry restart php-fpm) 2>/dev/null || true`
+  ];
+}
+
 // src/drivers/shared/compute-deploy.ts
 var noopLogger = {
   info: () => {},
@@ -86709,6 +86877,7 @@ async function deploySiteRelease(driver, options, logger4 = noopLogger) {
     const useNginx = compute2?.webServer !== "rpx";
     const sslProvider = resolveSslProvider(site);
     const customCert = sslProvider === "custom" && site.ssl?.certPath && site.ssl?.keyPath ? { certPath: site.ssl.certPath, keyPath: site.ssl.keyPath } : undefined;
+    const poolScript = site.isolation ? buildPhpFpmPoolScript({ siteName, appBase }) : [];
     const vhostScript = useNginx ? buildNginxVhostScript({
       siteName,
       domain: site.domain || siteName,
@@ -86717,18 +86886,23 @@ async function deploySiteRelease(driver, options, logger4 = noopLogger) {
       appDir: `${appBase}/current`,
       webDirectory: site.webDirectory,
       phpVersion,
+      fastcgiPass: site.isolation ? phpFpmPoolListen(siteName) : undefined,
       redirects: site.redirects,
       ssl: customCert,
       auth: site.auth && site.auth.enabled !== false && site.auth.password ? { username: site.auth.username || "admin", password: site.auth.password, realm: site.auth.realm } : undefined,
       serverSnippet: resolveNginxSnippet(site.nginx, compute2?.nginxTemplates),
-      clientMaxBodySize: site.nginx?.clientMaxBodySize
+      clientMaxBodySize: site.nginx?.clientMaxBodySize,
+      hsts: site.ssl?.hsts,
+      tlsProtocols: site.ssl?.tlsProtocols,
+      security: site.security
     }) : [];
     const sslScript = useNginx ? buildSslScript(site) : [];
     const servicesScript = siteHasServices(site) ? buildSiteServicesScript({ slug, siteName, site, phpVersion, appBase }) : [];
+    const healthCheckScript = useNginx ? buildHealthCheckScript(site) : [];
     logger4.step(`Deploying PHP site '${siteName}' to ${targets.length} target(s)...`);
     const phpResult = await driver.runRemoteDeploy({
       targets,
-      commands: [...deployScript, ...vhostScript, ...sslScript, ...servicesScript],
+      commands: [...deployScript, ...poolScript, ...vhostScript, ...sslScript, ...servicesScript, ...healthCheckScript],
       comment: `ts-cloud deploy ${slug}/${siteName}@${sha}`,
       tags: { Project: slug, Environment: environment, Role: "app" }
     });
@@ -86786,7 +86960,10 @@ async function deploySiteRelease(driver, options, logger4 = noopLogger) {
     redirects: site.redirects,
     auth: site.auth && site.auth.enabled !== false && site.auth.password ? { username: site.auth.username || "admin", password: site.auth.password, realm: site.auth.realm } : undefined,
     serverSnippet: resolveNginxSnippet(site.nginx, compute?.nginxTemplates),
-    clientMaxBodySize: site.nginx?.clientMaxBodySize
+    clientMaxBodySize: site.nginx?.clientMaxBodySize,
+    hsts: site.ssl?.hsts,
+    tlsProtocols: site.ssl?.tlsProtocols,
+    security: site.security
   }) : [];
   const staticSsl = wantsNginxStatic ? buildSslScript(site) : [];
   const remoteScript = [...baseScript, ...staticVhost, ...staticSsl];

package/dist/security/pre-deploy-scanner.d.ts

@@ -67,7 +67,7 @@ export declare class PreDeployScanner {
      */
     private isLikelyPlaceholder;
     /**
-     * Heuristic for "this match has way too little entropy to be a real secret."
+     * Heuristic for `this match has way too little entropy to be a real secret`.
      * Real cryptographic keys spread their characters across the alphabet; ASCII
      * art dividers, padding placeholders, and runs of repeated chars do not.
      *

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@stacksjs/ts-cloud",
   "type": "module",
-  "version": "0.5.16",
+  "version": "0.5.18",
   "description": "A lightweight, performant infrastructure-as-code library and CLI for deploying both server-based (EC2) and serverless applications.",
   "author": "Chris Breuer <chris@stacksjs.com>",
   "license": "MIT",
@@ -89,8 +89,8 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ts-cloud/aws-types": "0.5.16",
-    "@ts-cloud/core": "0.5.16",
+    "@ts-cloud/aws-types": "0.5.18",
+    "@ts-cloud/core": "0.5.18",
     "@stacksjs/ts-xml": "^0.1.0"
   },
   "devDependencies": {