@stacksjs/ts-cloud 0.5.26 → 0.5.28

package/dist/deploy/dashboard-data-server.d.ts

@@ -2,13 +2,35 @@
  * Resolve REAL server-dashboard data for a provisioned compute box. Runs a small
  * metrics script over the active driver (SSM/SSH), parses the KEY=VALUE output,
  * and derives sites/SSH/workers from the cloud config. Everything is best-effort:
- * if no box is reachable it returns null and the dashboard renders sample data.
+ * if no box is reachable it returns config-derived data marked unavailable.
  */
 import type { CloudConfig, EnvironmentType } from '@ts-cloud/core';
+interface ProbedService {
+    name: string;
+    status: string;
+    memBytes?: number;
+    enabled?: string;
+    since?: string;
+}
 export declare function parseBlock(output: string): Record<string, string> & {
-    services: Array<{
-        name: string;
-        status: string;
-    }>;
+    services: ProbedService[];
 };
+interface ServerLogSource {
+    /** journalctl `-u` pattern (a unit name or a glob like `acme-web-queue-*`). */
+    pattern: string;
+    /** Clean source label shown + filtered on in the UI. */
+    label: string;
+}
+/**
+ * Every log source on the box: the web server, each managed service, and per
+ * server-app site the app service PLUS its queue workers and daemons (collected
+ * via journalctl unit globs so all worker instances are covered, not just the
+ * main service). Deduped by label.
+ */
+export declare function serverLogSources(config: CloudConfig): ServerLogSource[];
+export declare function parseServerLogs(output: string): Array<Record<string, any>>;
+export declare function parseServerSecurity(output: string): Record<string, any>;
+export declare function parseDeployHistory(output: string, sites?: Record<string, any>): Array<Record<string, any>>;
+export declare function resolveConfigOnlyServerDashboardData(config: CloudConfig, environment: EnvironmentType): Record<string, any>;
 export declare function resolveServerDashboardData(config: CloudConfig, environment: EnvironmentType): Promise<Record<string, any> | null>;
+export {};

package/dist/deploy/dashboard-database.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Database & user management for the cockpit: list databases/users and create a
+ * database or an app user over the active driver. MySQL/MariaDB run as root via
+ * the pantry UNIX socket; Postgres over local TCP — mirroring the provisioning
+ * path in {@link import('../drivers/shared/db-provision')}.
+ */
+import type { CloudConfig, EnvironmentType } from '@ts-cloud/core';
+export type DbEngine = 'mysql' | 'mariadb' | 'postgres';
+/** Valid SQL identifier for a database/user name (kept strict for safety). */
+export declare function isValidDbIdentifier(value: string): boolean;
+export declare function resolveDbEngine(config: CloudConfig): DbEngine;
+export declare function buildListScript(engine: DbEngine): string[];
+export declare function buildCreateDatabaseScript(engine: DbEngine, name: string): string[];
+export interface CreateUserInput {
+    username: string;
+    password: string;
+    database?: string;
+    access?: 'all' | 'readonly';
+}
+export declare function buildCreateUserScript(engine: DbEngine, input: CreateUserInput): string[];
+export declare function parseDbList(output: string): {
+    databases: string[];
+    users: string[];
+};
+interface DbRunResult {
+    ok: boolean;
+    stdout?: string;
+    stderr?: string;
+    error?: string;
+}
+export declare function listDatabases(config: CloudConfig, environment: EnvironmentType): Promise<DbRunResult & {
+    engine: DbEngine;
+    databases: string[];
+    users: string[];
+}>;
+export declare function createDatabase(config: CloudConfig, environment: EnvironmentType, name: string): Promise<DbRunResult>;
+export declare function createDatabaseUser(config: CloudConfig, environment: EnvironmentType, input: CreateUserInput): Promise<DbRunResult>;
+export {};

package/dist/deploy/dashboard-database.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-operations.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Generalized server operations for the management cockpit: service lifecycle
+ * (restart/reload/start/stop/enable/disable), deployment rollback, scheduled
+ * backup run + database restore, worker restart, and scheduler run-now.
+ *
+ * The catalog is derived purely from the cloud config + live server data (so it
+ * is trivially unit-testable); the runner dispatches each operation over the
+ * active driver (SSH/SSM), reusing the shared compute-ops builders.
+ */
+import type { CloudConfig, EnvironmentType } from '@ts-cloud/core';
+export type OperationGroup = 'service' | 'deploy' | 'backup' | 'worker' | 'scheduler';
+export interface DashboardOperation {
+    id: string;
+    label: string;
+    group: OperationGroup;
+    target: string;
+    mutates: boolean;
+    /** Token the operator must type to run a mutating operation. */
+    confirm: string;
+    /** Destructive operations rendered with a danger affordance. */
+    danger?: boolean;
+}
+export interface DashboardOperationResult {
+    operation: string;
+    command?: string;
+    ok: boolean;
+    stdout?: string;
+    stderr?: string;
+    error?: string;
+}
+/** Guard systemd unit names so an operation id can never inject shell. */
+export declare function isSafeSystemdUnit(value: string): boolean;
+/**
+ * Build the full operation catalog from config + live server data. Pure: every
+ * operation that appears here is runnable by {@link runDashboardOperation}.
+ */
+export declare function buildDashboardOperations(config: CloudConfig, data: Record<string, any>): DashboardOperation[];
+export declare function resolveDashboardOperation(id: string, config: CloudConfig, data: Record<string, any>): DashboardOperation | undefined;
+/**
+ * Run an operation over the active driver. Rollback + DB restore delegate to the
+ * shared compute-ops; the rest run a single bounded remote script on the app
+ * target. Returns a structured result (never throws on a remote failure).
+ */
+export interface RunOperationOptions {
+    /** For rollback: the release id to roll back to (omit for the previous release). */
+    to?: string;
+}
+export declare function runDashboardOperation(config: CloudConfig, environment: EnvironmentType, operation: DashboardOperation, options?: RunOperationOptions): Promise<DashboardOperationResult>;

package/dist/deploy/dashboard-operations.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/index.d.ts

@@ -9,3 +9,4 @@ export * from './static-site-helper';
 export { buildFunctionEnv, type CodeSource, deployServerlessApp, type DeployServerlessOptions, infraEnvFromOutputs, redeployServerlessApp, type ResolvedContext, rollbackServerlessApp, runRemoteCommand, setMaintenance, } from './serverless-app';
 export { buildAndPushServerlessImage, type BuildImageOptions, type BuiltImage, } from './serverless-image';
 export { type DashboardData, resolveDashboardData, } from './dashboard-data';
+export { dashboardActions, resolveDashboardAction, sanitizeCloudConfig, startLocalDashboardServer, type DashboardAction, type LocalDashboardServer, type LocalDashboardServerOptions, } from './local-dashboard-server';

package/dist/deploy/local-dashboard-server.d.ts

@@ -0,0 +1,31 @@
+import type { CloudConfig, EnvironmentType } from '@ts-cloud/core';
+export interface LocalDashboardServerOptions {
+    host?: string;
+    port?: number;
+    cwd?: string;
+    environment?: EnvironmentType;
+    cliEntry?: string;
+    verbose?: boolean;
+    /**
+     * Box mode: the dashboard runs ON the provisioned server. Data resolution and
+     * operations execute against localhost (the {@link LocalBoxDriver}) instead of
+     * reaching out over SSH/SSM.
+     */
+    box?: boolean;
+}
+export interface LocalDashboardServer {
+    url: string;
+    server: ReturnType<typeof Bun.serve>;
+}
+export interface DashboardAction {
+    id: string;
+    label: string;
+    description: string;
+    command: string[];
+    mutates: boolean;
+    confirm?: string;
+}
+export declare function sanitizeCloudConfig(config: CloudConfig): Record<string, any>;
+export declare function dashboardActions(environment: EnvironmentType): DashboardAction[];
+export declare function resolveDashboardAction(id: string, environment: EnvironmentType): DashboardAction | undefined;
+export declare function startLocalDashboardServer(options?: LocalDashboardServerOptions): Promise<LocalDashboardServer>;

package/dist/deploy/management-dashboard.d.ts

@@ -15,7 +15,9 @@
  * - `TS_CLOUD_UI_REALM`     browser auth realm
  * - `TS_CLOUD_UI_DISABLE`   set truthy to skip auto-deploy
  */
-import type { CloudConfig } from '@stacksjs/ts-cloud';
+import type { CloudConfig } from '@ts-cloud/core';
+/** Site key under which the management dashboard is auto-injected. */
+export declare const MANAGEMENT_DASHBOARD_SITE = "dashboard";
 export interface EnsureDashboardLogger {
     info: (msg: string) => void;
     warn: (msg: string) => void;
@@ -37,3 +39,21 @@ export declare function ensureManagementDashboard(config: CloudConfig, options?:
     cwd?: string;
     logger?: EnsureDashboardLogger;
 }): CloudConfig;
+export interface BuildDashboardArtifactOptions {
+    cwd?: string;
+    slug: string;
+    sha: string;
+    logger?: EnsureDashboardLogger;
+}
+/**
+ * Build the management-dashboard release tarball from its injected site config:
+ * run the UI `build` (when not already built), then package `site.root`. Returns
+ * the tarball path, or null when the UI cannot be built/found.
+ *
+ * Best-effort: the dashboard is auxiliary, so any failure logs and returns null
+ * rather than throwing — the surrounding app deploy must never be blocked by it.
+ */
+export declare function buildManagementDashboardArtifact(site: {
+    root?: string;
+    build?: string | false;
+} | undefined, options: BuildDashboardArtifactOptions): string | null;

package/dist/deploy/site-config-editor.d.ts

@@ -10,6 +10,43 @@ export interface AddSiteConfigInput {
     port?: number;
     type?: string;
     pathRewriteStyle?: 'directory' | 'flat';
+    /** Per-site environment variables. */
+    env?: Record<string, string>;
+    /** TLS: `false` to disable, or `{ provider }` (e.g. letsencrypt). */
+    ssl?: boolean | {
+        provider?: string;
+    };
 }
 export declare function addSiteToCloudConfig(input: AddSiteConfigInput): string;
+export interface RemoveSiteInput {
+    configText: string;
+    name: string;
+}
+/** Remove a site (its whole `name: { ... }` entry) from the sites block. */
+export declare function removeSiteFromCloudConfig(input: RemoveSiteInput): string;
+export interface UpdateSiteInput extends Omit<AddSiteConfigInput, 'configText'> {
+    configText: string;
+}
+/**
+ * Replace a site's definition with a regenerated one carrying the merged fields.
+ * Implemented as remove + add so it reuses the validated insert path (the site
+ * moves to the end of the sites block, which keeps the config valid).
+ */
+export declare function updateSiteInCloudConfig(input: UpdateSiteInput): string;
+/**
+ * Set (or insert) a single property on a site, preserving every other field —
+ * the safe path for editing `ssl`/`env` on a site that may also carry queues,
+ * auth, etc. `valueText` is raw TS (use {@link renderSslValue}/{@link renderEnvValue}).
+ */
+export declare function setSitePropertyInCloudConfig(input: {
+    configText: string;
+    siteName: string;
+    key: string;
+    valueText: string;
+}): string;
+export declare function renderSslValue(ssl: boolean | {
+    provider?: string;
+}): string;
+export declare function renderStringValue(value: string): string;
+export declare function renderEnvValue(env: Record<string, string>): string;
 export declare function renderSiteSnippet(input: Omit<AddSiteConfigInput, 'configText'>): string;

package/dist/deploy/site-target.d.ts

@@ -6,8 +6,10 @@ import type { CloudConfig, SiteConfig, SiteDeployTarget } from '@ts-cloud/core';
  *  - `'server-static'` — `server` + no `start` (has static `root`): a static
  *                        site built and shipped to `/var/www/<site>` on the box
  *                        (served by the operator's own proxy, e.g. rpx + tlsx).
+ *  - `'redirect'`      — gateway-only: `redirect` is set. Nothing is shipped;
+ *                        the gateway answers `domain` with an HTTP redirect.
  */
-export type SiteDeployKind = 'bucket' | 'server-app' | 'server-static' | 'server-php';
+export type SiteDeployKind = 'bucket' | 'server-app' | 'server-static' | 'server-php' | 'redirect';
 /**
  * A PHP/Laravel site: deployed to the compute box via git clone into atomic
  * release directories and served by nginx + php-fpm. Identified by a PHP

package/dist/deploy/ssh-config-editor.d.ts

@@ -0,0 +1,22 @@
+import type { SshKeyConfig } from '@ts-cloud/core';
+export interface AddSshKeyInput {
+    configText: string;
+    name: string;
+    publicKey: string;
+    existingKeys?: SshKeyConfig[];
+}
+export interface RemoveSshKeyInput {
+    configText: string;
+    name: string;
+    existingKeys?: SshKeyConfig[];
+}
+export interface ManagedSshKey {
+    name: string;
+    publicKey: string;
+    type: string;
+    fingerprint: string;
+    added: string;
+}
+export declare function addSshKeyToCloudConfig(input: AddSshKeyInput): string;
+export declare function removeSshKeyFromCloudConfig(input: RemoveSshKeyInput): string;
+export declare function describeSshKeys(keys?: SshKeyConfig[]): ManagedSshKey[];

package/dist/deploy/ssh-config-editor.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/drivers/factory.d.ts

@@ -5,6 +5,10 @@ export interface CreateCloudDriverOptions {
 }
 /**
  * Create a cloud infrastructure driver from configuration.
+ *
+ * In box mode (`TS_CLOUD_DASHBOARD_BOX`), every driver resolves to the
+ * {@link LocalBoxDriver} so the on-box management dashboard runs its metrics
+ * scripts and operations against localhost instead of reaching out over SSH/SSM.
  */
 export declare function createCloudDriver(options: CreateCloudDriverOptions): CloudDriver;
 /**

package/dist/drivers/index.d.ts

@@ -1,6 +1,7 @@
 export * from './factory';
 export { AwsDriver } from './aws/driver';
 export { HetznerDriver } from './hetzner/driver';
+export { isBoxMode, LocalBoxDriver } from './local-box/driver';
 export { HetznerClient, resolveHetznerApiToken } from './hetzner/client';
 export { generateUbuntuAppCloudInit, wrapCloudInitUserData } from './hetzner/cloud-init';
 export { buildAwsArtifactFetch, buildLocalArtifactFetch, buildSiteDeployScript, buildStaticSiteDeployScript, resolveExecStart, } from './shared/deploy-script';

package/dist/drivers/local-box/driver.d.ts

@@ -0,0 +1,20 @@
+import type { CloudDriver, ComputeStackOutputs, ComputeTarget, FindComputeTargetsOptions, RemoteDeployResult, RunRemoteDeployOptions, UploadReleaseOptions, UploadReleaseResult } from '@ts-cloud/core';
+/**
+ * A {@link CloudDriver} that runs every "remote" command on the LOCAL machine.
+ *
+ * Used when the management dashboard runs ON a provisioned server (box mode):
+ * data resolution and operations execute against localhost via `bash` instead of
+ * SSH/SSM, so the existing dashboard code path — metrics scripts, service ops,
+ * rollbacks — works unchanged on the box itself. The single synthetic target is
+ * the box; provisioning/upload methods are inert (the box is already up).
+ */
+export declare class LocalBoxDriver implements CloudDriver {
+    readonly name: "hetzner";
+    readonly usesCloudFormation = false;
+    getComputeOutputs(): Promise<ComputeStackOutputs>;
+    uploadRelease(options: UploadReleaseOptions): Promise<UploadReleaseResult>;
+    findComputeTargets(_options: FindComputeTargetsOptions): Promise<ComputeTarget[]>;
+    runRemoteDeploy(options: RunRemoteDeployOptions): Promise<RemoteDeployResult>;
+}
+/** Truthy-env check shared by the box-mode gate. */
+export declare function isBoxMode(): boolean;

package/dist/drivers/shared/compute-deploy.d.ts

@@ -18,6 +18,8 @@ export interface DeployAllSitesOptions {
     runtime: 'bun' | 'node' | 'deno' | 'php';
     tarballForSite: (siteName: string) => string;
     logger?: ComputeDeployLogger;
+    /** Project root used to resolve/build the management dashboard UI. Defaults to `process.cwd()`. */
+    cwd?: string;
 }
 /**
  * Deploy every site that targets the compute server — both dynamic apps

package/dist/drivers/shared/deploy-script.d.ts

@@ -8,40 +8,56 @@ export interface BuildSiteDeployScriptOptions {
     slug: string;
     /** How the remote host obtains the release tarball */
     artifactFetch: string[];
+    /** Site base dir holding `releases/`, `shared/`, `current`. Default `/var/www/<site>`. */
     appDir?: string;
+    /** Unique id for this release dir (typically the commit sha). */
+    releaseId: string;
     execStart: string;
     envEntries: Record<string, string>;
     port?: number;
+    /** Past releases to keep for rollback. @default {@link DEFAULT_KEEP_RELEASES} */
+    keepReleases?: number;
     /**
-     * Commands run inside `appDir` after extraction + `.env` write, before the
-     * systemd unit is (re)written and started. Typically dependency install
-     * and/or build steps (e.g. `bun install --frozen-lockfile`, `bun run build`)
-     * so the release tarball can omit `node_modules`.
+     * Commands run inside the new release dir after extraction + `.env` link,
+     * before the `current` symlink is repointed and the service restarted.
+     * Typically dependency install and/or build steps (e.g.
+     * `bun install --frozen-lockfile`, `bun run build`) so the tarball can omit
+     * `node_modules`.
      */
     preStartCommands?: string[];
 }
 /**
- * Build the remote shell commands that install/refresh a site on a compute target.
+ * Build the remote shell commands that install/refresh a server-app site on a
+ * compute target with a **zero-downtime atomic release** (Envoyer-style): unpack
+ * into `releases/<id>`, link the shared `.env`, build, then atomically repoint
+ * `current` and restart the systemd service (which runs from `current`). Old
+ * releases are pruned for rollback.
  */
 export declare function buildSiteDeployScript(options: BuildSiteDeployScriptOptions): string[];
 export interface BuildStaticSiteDeployScriptOptions {
     siteName: string;
     /** How the remote host obtains the release tarball */
     artifactFetch: string[];
-    /** Target directory the static site is shipped to. Default `/var/www/<site>`. */
+    /** Site base dir holding `releases/`, `current`. Default `/var/www/<site>`. */
     appDir?: string;
+    /** Unique id for this release dir (typically the commit sha). */
+    releaseId: string;
+    /** Past releases to keep for rollback. @default {@link DEFAULT_KEEP_RELEASES} */
+    keepReleases?: number;
     /**
-     * Commands run inside `appDir` after extraction — e.g. build the docs/blog on
-     * the box itself (`bun install`, `bun run docs:build`) when the tarball ships
-     * source rather than a pre-built site.
+     * Commands run inside the new release dir after extraction — e.g. build the
+     * docs/blog on the box itself (`bun install`, `bun run docs:build`) when the
+     * tarball ships source rather than a pre-built site.
      */
     preStartCommands?: string[];
 }
 /**
  * Build the remote shell commands that install/refresh a STATIC site on a
- * compute target. Unlike {@link buildSiteDeployScript}, there is no systemd
- * service — the extracted files are shipped to `/var/www/<site>` and served by
- * the operator's own proxy (e.g. rpx + tlsx), which ts-cloud does not manage.
+ * compute target with a **zero-downtime atomic release** (Envoyer-style). Unlike
+ * {@link buildSiteDeployScript}, there is no systemd service: the artifact is
+ * unpacked into `releases/<id>` and `current` is repointed atomically, so the
+ * docroot is never empty mid-deploy. The gateway serves `<base>/current` (rpx +
+ * tlsx), which ts-cloud points at the symlink. Old releases are pruned.
  */
 export declare function buildStaticSiteDeployScript(options: BuildStaticSiteDeployScriptOptions): string[];
 export declare function buildAwsArtifactFetch(bucket: string, key: string, region: string, siteName: string): string[];

package/dist/drivers/shared/rpx-gateway.d.ts

@@ -17,9 +17,23 @@
  * It replaces the old Caddyfile generation — pantry/stacks use rpx (their own
  * tooling), so the gateway is rpx, not Caddy.
  */
-import type { ComputeProxyConfig, SiteConfig } from '@ts-cloud/core';
+import type { ComputeProxyConfig, SiteConfig, SiteRedirectConfig } from '@ts-cloud/core';
 /** Default directory on the box that holds real per-domain TLS certs. */
 export declare const DEFAULT_RPX_CERTS_DIR = "/etc/rpx/certs";
+/** Default webroot the gateway serves ACME http-01 challenges from on `:80`. */
+export declare const DEFAULT_ACME_WEBROOT = "/var/www/acme-challenge";
+/** A normalized redirect target on an {@link RpxRoute} (see rpx's `redirect`). */
+export interface RpxRedirect {
+    to: string;
+    status?: 301 | 302 | 307 | 308;
+    preservePath?: boolean;
+}
+/**
+ * Normalize a site's `redirect` (string shorthand or object) into the minimal
+ * {@link RpxRedirect} the gateway config carries. Optional fields are omitted
+ * when unset so rpx applies its own defaults (status `301`, path-preserving).
+ */
+export declare function normalizeSiteRedirect(input: string | SiteRedirectConfig): RpxRedirect;
 /** A single rpx proxy route, mapped from one site. */
 export interface RpxRoute {
     /** Public host this route is served under (the site's `domain`). */
@@ -30,13 +44,36 @@ export interface RpxRoute {
     from?: string;
     /** Absolute directory served for a `server-static` route (`/var/www/<name>`). */
     static?: string;
+    /**
+     * Redirect target for a `redirect` site — the gateway answers `to` (the host)
+     * with an HTTP redirect here instead of proxying/serving. The request path +
+     * query are appended unless `preservePath` is `false`.
+     */
+    redirect?: RpxRedirect;
     /** Strip `.html` and resolve clean URLs (set for static sites). */
     cleanUrls?: boolean;
     /** SPA fallback for static sites. */
     spa?: boolean;
+    /**
+     * HTTP Basic auth gate for this route (from the site's `auth`). rpx challenges
+     * every request to the route until valid credentials are supplied — this is
+     * how the management dashboard (and other protected sites) stay private behind
+     * rpx, the same way the nginx driver applies htpasswd.
+     */
+    auth?: {
+        username: string;
+        password: string;
+        realm?: string;
+    };
     /** Stable id used when rpx registers the route. Derived from `to`+`path`. */
     id: string;
 }
+/**
+ * Resolve a site's `auth` into the rpx route auth shape, or `undefined` when the
+ * site is public. Mirrors the management-dashboard preset: auth applies only when
+ * enabled (default) AND a password is present — no password is ever invented.
+ */
+export declare function resolveRouteAuth(site: SiteConfig): RpxRoute['auth'];
 /** The rpx daemon/proxy config produced from a sites model. */
 export interface RpxGatewayConfig {
     /** Multi-proxy route list (host + path keyed). */
@@ -58,6 +95,13 @@ export interface RpxGatewayConfig {
         email?: string;
         certsDir: string;
     };
+    /**
+     * Directory the gateway serves ACME http-01 challenge tokens from on `:80`
+     * before redirecting to HTTPS. Set when ts-cloud manages certs so the renewal
+     * cron (`tlsx acme:renew --webroot`) can issue/renew without taking the gateway
+     * down to free `:80`. Omitted ⇒ the `:80` server only redirects.
+     */
+    acmeChallengeWebroot?: string;
     /** Always `true` — the gateway terminates TLS on the box. */
     https: true;
     /** Never touch `/etc/hosts` on a real server with real DNS. */
@@ -104,21 +148,74 @@ export declare function buildRpxConfig(sites: Record<string, SiteConfig | undefi
 /**
  * Render the rpx gateway config as a self-contained launcher TS module. The
  * systemd unit runs `bun <file>`, which imports `startProxies` from the
- * globally-installed `@stacksjs/rpx` and starts the gateway with the generated
+ * managed `/opt/rpx-gateway` install and starts the gateway with the generated
  * options. We ship a runnable launcher (not a bare config) because rpx's CLI
  * resolves its own config from its install dir, not an arbitrary path.
  */
 export declare function renderRpxLauncher(config: RpxGatewayConfig): string;
 /** Default install location for the gateway launcher + config on the box. */
 export declare const RPX_DIR = "/etc/rpx";
+export declare const RPX_INSTALL_DIR = "/opt/rpx-gateway";
 export declare const RPX_LAUNCHER_PATH = "/etc/rpx/gateway.ts";
 export declare const RPX_SERVICE_NAME = "rpx-gateway.service";
+/**
+ * Per-app gateway registry. Each project's deploy writes ONLY its own fragment
+ * (`<slug>.json`) here; the launcher ({@link renderRpxAssembler}) merges every
+ * fragment at startup. So several independent apps share one box's gateway
+ * Forge-style — one app's deploy never clobbers another's routes.
+ */
+export declare const RPX_SITES_DIR = "/etc/rpx/sites.d";
+/** A registry fragment: one project's gateway config, tagged with its slug. */
+export type RpxFragment = RpxGatewayConfig & {
+    slug: string;
+};
+/**
+ * Merge per-app fragments into one gateway config (the runtime equivalent of
+ * what {@link renderRpxAssembler} does on the box, exported for testing).
+ *
+ * Routes are concatenated (deduped by `id`, first writer wins); on-demand
+ * suffixes and origin-guard hosts are unioned; the first non-empty email /
+ * certsDir / acmeChallengeWebroot / origin-guard header+secret wins. Fragments
+ * are applied in the given order (the box sorts them by filename).
+ */
+export declare function mergeRpxFragments(fragments: RpxGatewayConfig[]): RpxGatewayConfig;
+/**
+ * Render the stable assembler launcher. Its content is identical for every app
+ * and every deploy — it reads all `<slug>.json` fragments from {@link RPX_SITES_DIR}
+ * at startup, merges them (same algorithm as {@link mergeRpxFragments}), and
+ * starts the gateway. A malformed fragment is skipped, not fatal.
+ */
+export declare function renderRpxAssembler(sitesDir?: string, defaultCertsDir?: string): string;
 export interface BuildRpxProvisionOptions {
     config: RpxGatewayConfig;
     proxy: ComputeProxyConfig;
+    /**
+     * This project's slug — the registry fragment is written to
+     * `<sites.d>/<slug>.json`. So a box can host several independent apps and each
+     * deploy only rewrites its own fragment. Defaults to `'app'` for single-app
+     * boxes / backward compatibility.
+     */
+    slug?: string;
     /** Absolute path to the `bun` binary on the box. @default '/usr/local/bin/bun' */
     bunBin?: string;
 }
+export declare const RPX_CERT_RENEW_SCRIPT = "/etc/rpx/renew-certs.sh";
+export declare const RPX_CERT_RENEW_SERVICE = "rpx-cert-renew.service";
+export declare const RPX_CERT_RENEW_TIMER = "rpx-cert-renew.timer";
+/** The routable FQDNs in a gateway config — each terminates TLS so each needs a cert. */
+export declare function certDomainsForConfig(config: RpxGatewayConfig): string[];
+/**
+ * Commands that make ts-cloud manage the gateway's TLS certs end-to-end: install
+ * tlsx, issue a Let's Encrypt cert for every routed domain via http-01 (the
+ * running gateway serves the challenge from {@link RpxGatewayConfig.acmeChallengeWebroot}
+ * on `:80`, so no downtime), and a daily systemd timer that renews anything
+ * expiring within 30 days and reloads the gateway only when a cert changed.
+ *
+ * Returns `[]` (no-op) unless on-demand/managed TLS is enabled and there's at
+ * least one routable domain. Must run AFTER the gateway is started so the
+ * challenge listener is live.
+ */
+export declare function buildCertManagementCommands(options: BuildRpxProvisionOptions): string[];
 /**
  * Build the idempotent, re-runnable shell commands that install rpx as the
  * gateway, write the generated launcher + ensure the certs dir, install the

package/dist/index.d.ts

@@ -13,6 +13,8 @@ export { deployStaticSite, deployStaticSiteFull, uploadStaticFiles, invalidateCa
 export type { StaticSiteConfig, DeployResult, UploadOptions, ExternalDnsStaticSiteConfig, ExternalDnsDeployResult, DeploySiteConfig, DeploySiteResult, StaticSiteDnsProvider, SiteDeployKind, DeploymentValidationResult, BuildImageOptions, BuiltImage, CodeSource, DeployServerlessOptions, ResolvedContext, } from './deploy';
 export { createCloudDriver, CloudDriverFactory, cloudDrivers, AwsDriver, HetznerDriver, HetznerClient, resolveHetznerApiToken, generateUbuntuAppCloudInit, wrapCloudInitUserData, buildSiteDeployScript, buildStaticSiteDeployScript, resolveExecStart, deployAllComputeSites, deploySiteRelease, } from './drivers';
 export type { CreateCloudDriverOptions } from './drivers/factory';
+export { dashboardActions, resolveDashboardAction, sanitizeCloudConfig, startLocalDashboardServer, } from './deploy/local-dashboard-server';
+export type { DashboardAction, LocalDashboardServer, LocalDashboardServerOptions, } from './deploy/local-dashboard-server';
 export { createDnsProvider, detectDnsProvider, DnsProviderFactory, dnsProviders, PorkbunProvider, GoDaddyProvider, Route53Provider, UnifiedDnsValidator, createPorkbunValidator, createGoDaddyValidator, createRoute53Validator, } from './dns';
 export type { DnsProvider, DnsProviderConfig, DnsRecord, DnsRecordType, DnsRecordResult, CreateRecordResult, DeleteRecordResult, ListRecordsResult, } from './dns';
 export * from '@ts-cloud/core';