@stacksjs/ts-cloud 0.7.110 → 0.7.112

package/dist/{chunk-x6yzgv7y.js → chunk-6a1t7fnq.js}

@@ -1,10 +1,10 @@
 import {
   SESClient
-} from "./chunk-hpv68b4a.js";
+} from "./chunk-nsgqsmrh.js";
 import {
   S3Client,
   resolveCredentials
-} from "./chunk-wj3s95p9.js";
+} from "./chunk-rds0sy87.js";
 import {
   AWSClient
 } from "./chunk-zqtpg06c.js";

package/dist/{chunk-d3vx2ekv.js → chunk-6xnwshtc.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-4cjrg98a.js";
 import {
   S3Client
-} from "./chunk-wj3s95p9.js";
+} from "./chunk-rds0sy87.js";
 import {
   renderWafInstallScript
 } from "./chunk-va2yd85b.js";
@@ -1287,7 +1287,7 @@ async function sendNotifications(config, event, message, options = {}) {
 }
 async function sendEmailNotification(email, event, message) {
   try {
-    const mod = await import("./chunk-k114qwg9.js");
+    const mod = await import("./chunk-ttz2ra5j.js");
     await mod.email.send({
       to: email.to,
       from: email.from,
@@ -1336,6 +1336,16 @@ var PHP_SITE_TYPES = new Set([
 function isPhpSite(site) {
   return site.type != null && PHP_SITE_TYPES.has(site.type);
 }
+function resolveProxyUpstreams(site) {
+  const raw = site.proxyTo;
+  if (raw == null)
+    return [];
+  const list = Array.isArray(raw) ? raw : [raw];
+  return list.map((entry) => String(entry).trim()).filter((entry) => entry.length > 0);
+}
+function hasProxyUpstream(site) {
+  return resolveProxyUpstreams(site).length > 0;
+}
 function resolveSiteDeployTarget(site) {
   if (site.deploy)
     return site.deploy;
@@ -1348,6 +1358,8 @@ function resolveSiteDeployTarget(site) {
 function resolveSiteKind(site) {
   if (site.redirect)
     return "redirect";
+  if (hasProxyUpstream(site))
+    return "proxy";
   if (isPhpSite(site))
     return "server-php";
   const target = resolveSiteDeployTarget(site);
@@ -1387,10 +1399,34 @@ function validateDeploymentConfig(config) {
         serverOnly.push("start");
       if (site.root)
         serverOnly.push("root");
+      if (site.proxyTo)
+        serverOnly.push("proxyTo");
       if (serverOnly.length > 0)
         warnings.push(`Site '${name}' is a redirect site but also sets ${serverOnly.join(", ")}. These are ignored.`);
       continue;
     }
+    if (kind === "proxy") {
+      if (!site.domain)
+        errors.push(`Site '${name}' is a proxy site but has no \`domain\` to route from.`);
+      if (!computeConfigured) {
+        errors.push(`Site '${name}' is a proxy site but no \`infrastructure.compute\` is configured to host the gateway that forwards it.`);
+      }
+      const ignored = [];
+      if (site.start)
+        ignored.push("start");
+      if (site.root)
+        ignored.push("root");
+      if (typeof site.port === "number")
+        ignored.push("port");
+      if (site.build)
+        ignored.push("build");
+      if (site.preStart && site.preStart.length > 0)
+        ignored.push("preStart");
+      if (ignored.length > 0) {
+        warnings.push(`Site '${name}' sets \`proxyTo\`, so ts-cloud ships and supervises nothing for it. ${ignored.join(", ")} ${ignored.length === 1 ? "is" : "are"} ignored — remove ${ignored.length === 1 ? "it" : "them"}, or drop \`proxyTo\` to let ts-cloud own the service.`);
+      }
+      continue;
+    }
     if (target === "server" && !site.start && !site.root) {
       errors.push(`Site '${name}' sets deploy:'server' but declares neither \`start\` (dynamic app) nor \`root\` (static site to serve). Add one.`);
       continue;
@@ -1441,7 +1477,7 @@ function validateDeploymentConfig(config) {
 }
 function shipsARelease(site) {
   const kind = resolveSiteKind(site);
-  return kind !== "bucket" && kind !== "redirect";
+  return kind !== "bucket" && kind !== "redirect" && kind !== "proxy";
 }
 
 // src/drivers/shared/rpx-gateway.ts
@@ -1512,6 +1548,22 @@ function buildRpxConfigInternal(sites, options, appBoxes) {
       domains.add(site.domain);
       continue;
     }
+    if (kind === "proxy") {
+      const upstreams = resolveProxyUpstreams(site);
+      if (upstreams.length === 0)
+        continue;
+      const from = upstreams.length === 1 ? upstreams[0] : upstreams;
+      proxies.push({
+        to: site.domain,
+        path,
+        from,
+        id,
+        ...auth ? { auth } : {},
+        ...Array.isArray(from) && loadBalancer ? { loadBalancer } : {}
+      });
+      domains.add(site.domain);
+      continue;
+    }
     if (kind === "server-app") {
       if (typeof site.port !== "number")
         continue;
@@ -1773,10 +1825,29 @@ function buildCertManagementCommands(options) {
     `EMAIL='${email}'`,
     `TLSX="${tlsxCli}"`,
     `DOMAINS='${csv}'`,
+    "DNS_ATTEMPTS='24'",
+    "DNS_DELAY_SECONDS='5'",
+    "wait_for_dns() {",
+    '  d="$1"',
+    "  attempt=1",
+    '  while ! getent ahosts "$d" >/dev/null 2>&1; do',
+    '    if [ "$attempt" -ge "$DNS_ATTEMPTS" ]; then',
+    '      echo "DNS for $d did not become resolvable after $DNS_ATTEMPTS attempts" >&2',
+    "      return 1",
+    "    fi",
+    '    echo "Waiting for public DNS before ACME: $d (attempt $attempt/$DNS_ATTEMPTS)"',
+    '    sleep "$DNS_DELAY_SECONDS"',
+    "    attempt=$((attempt + 1))",
+    "  done",
+    "}",
     'before=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)',
     `for d in ${spaced}; do`,
     '  if [ ! -s "$CERTS/$d.crt" ]; then',
-    '    $TLSX acme:issue -d "$d" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --prod --email "$EMAIL" || echo "issue $d failed (non-fatal)"',
+    '    if wait_for_dns "$d"; then',
+    '      $TLSX acme:issue -d "$d" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --prod --email "$EMAIL" || echo "issue $d failed (non-fatal)"',
+    "    else",
+    '      echo "issue $d skipped until DNS resolves (non-fatal)"',
+    "    fi",
     "    # rpx reloads its SNI set when a PEM appears. Complete that reload",
     "    # before the next hostname starts http-01, or :80 can disappear in",
     "    # the middle of the following challenge on a multi-domain deploy.",
@@ -1877,6 +1948,9 @@ function buildRpxProvisionScript(options) {
       "OOMPolicy=stop",
       "Restart=always",
       "RestartSec=5",
+      "StartLimitIntervalSec=120",
+      "StartLimitBurst=5",
+      `ExecStartPre=/bin/sh -c 'for p in 80 443; do fuser -k -n tcp "$p" 2>/dev/null || true; done; sleep 1'`,
       "LimitNOFILE=1048576",
       "AmbientCapabilities=CAP_NET_BIND_SERVICE",
       "",
@@ -6295,6 +6369,9 @@ var noopLogger2 = {
   step: () => {},
   success: () => {}
 };
+function shellQuote2(value) {
+  return `'${value.replace(/'/g, `'"'"'`)}'`;
+}
 async function deploySiteRelease(driver, options, logger = noopLogger2) {
   const { config, environment, siteName, site, slug, sha, runtime, localTarballPath } = options;
   const remoteKey = `releases/${siteName}/${sha}.tar.gz`;
@@ -6667,6 +6744,8 @@ async function deployAllComputeSites(options) {
     }
     if (kind === "redirect")
       return false;
+    if (kind === "proxy")
+      return false;
     return true;
   });
   if (deployable.length === 0)
@@ -6806,6 +6885,9 @@ async function renewRpxCertificates(options) {
   const rpxConfig = buildRpxConfig(routeSource.sites || {}, { proxy, slug: config.project.slug });
   if (rpxConfig.proxies.length === 0)
     return true;
+  const certDomains = certDomainsForConfig(rpxConfig);
+  if (certDomains.length === 0)
+    return true;
   const slug = config.project.slug;
   const stackName = resolveProjectStackName(config, environment);
   let role = "lb";
@@ -6819,9 +6901,13 @@ async function renewRpxCertificates(options) {
     return true;
   }
   logger.step("Issuing rpx TLS certificates after DNS reconciliation...");
+  const certChecks = certDomains.map((domain) => `test -s ${shellQuote2(`${rpxConfig.productionCerts.certsDir}/${domain}.crt`)}`).join(" && ");
   const result = await driver.runRemoteDeploy({
     targets,
-    commands: [`systemctl start ${rpxCertRenewServiceName(slug)}`],
+    commands: [
+      `systemctl start ${rpxCertRenewServiceName(slug)}`,
+      certChecks
+    ],
     comment: `ts-cloud rpx TLS issuance ${slug}`,
     tags: {
       Project: slug,
@@ -6924,4 +7010,4 @@ function buildCloudFrontOriginConfig(options) {
     CustomErrorResponses: { Quantity: 0 }
   };
 }
-export { collectServerDnsDomains, removeStaleServerAddressRecords, normalizePublicIpv6, IPV6_EXCLUDED_HOST_LABELS, hostAcceptsIpv6, reconcileAddressRecords, verifyAddressRecord, PANTRY_PROJECT_DIR, buildPantryBootstrapScript, buildVitessProvisionScript, pgAdminCommand, BACKUP_RUNNER_PATH, buildBackupRestoreScript, siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, shipsARelease, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, planHetznerServerResize, isHetznerCapacityError, executeHetznerServerResize, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, collectHetznerResizeManifest, prepareHetznerResize, verifyHetznerResize, resolveHetznerHostOptimizationPlan, buildHetznerHostOptimizationScript, applyHetznerHostOptimization, collectHetznerHostOptimizationReport, verifyHetznerHostOptimization, resizeCheckpointPath, resizeLockPath, readResizeCheckpoint, writeResizeCheckpoint, acquireResizeLock, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, dashboardCredentialsFile, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };
+export { collectServerDnsDomains, removeStaleServerAddressRecords, normalizePublicIpv6, IPV6_EXCLUDED_HOST_LABELS, hostAcceptsIpv6, reconcileAddressRecords, verifyAddressRecord, PANTRY_PROJECT_DIR, buildPantryBootstrapScript, buildVitessProvisionScript, pgAdminCommand, BACKUP_RUNNER_PATH, buildBackupRestoreScript, siteInstallBase, isPhpSite, resolveProxyUpstreams, hasProxyUpstream, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, shipsARelease, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, planHetznerServerResize, isHetznerCapacityError, executeHetznerServerResize, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, collectHetznerResizeManifest, prepareHetznerResize, verifyHetznerResize, resolveHetznerHostOptimizationPlan, buildHetznerHostOptimizationScript, applyHetznerHostOptimization, collectHetznerHostOptimizationReport, verifyHetznerHostOptimization, resizeCheckpointPath, resizeLockPath, readResizeCheckpoint, writeResizeCheckpoint, acquireResizeLock, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, dashboardCredentialsFile, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };

package/dist/{chunk-wmz8x3cy.js → chunk-ham2enem.js}

@@ -1,6 +1,6 @@
 import {
   deployStaticSiteWithExternalDnsFull
-} from "./chunk-8kh577qh.js";
+} from "./chunk-v0vpamnf.js";
 import {
   box,
   error,
@@ -22,10 +22,10 @@ import {
   SQSClient,
   STSClient,
   SecretsManagerClient
-} from "./chunk-x6yzgv7y.js";
+} from "./chunk-6a1t7fnq.js";
 import {
   IAMClient
-} from "./chunk-hpv68b4a.js";
+} from "./chunk-nsgqsmrh.js";
 import {
   CloudFrontClient
 } from "./chunk-01d86gt1.js";
@@ -50,7 +50,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-d3vx2ekv.js";
+} from "./chunk-6xnwshtc.js";
 import {
   SSMClient
 } from "./chunk-7m60qnc8.js";
@@ -60,7 +60,7 @@ import {
 import {
   S3Client,
   resolveCredentials
-} from "./chunk-wj3s95p9.js";
+} from "./chunk-rds0sy87.js";
 import {
   AWSClient,
   buildQueryParams
@@ -10395,7 +10395,7 @@ async function sendAuthenticationEmail(config, message) {
   if (!from)
     return false;
   try {
-    const { EmailClient } = await import("./chunk-k114qwg9.js");
+    const { EmailClient } = await import("./chunk-ttz2ra5j.js");
     const email = new EmailClient({ region: config.project.region, defaultFrom: from });
     await email.send(message);
     return true;
@@ -30848,6 +30848,8 @@ function siteKindLabel(name, site) {
   const kind = resolveSiteKind(site);
   if (kind === "redirect")
     return "redirect";
+  if (kind === "proxy")
+    return "proxy";
   const build2 = String(site.build ?? "").toLowerCase();
   const start = String(site.start ?? "").toLowerCase();
   if (name === "main" || start.includes("buddy/src/cli.ts serve"))
@@ -30870,7 +30872,7 @@ function siteKindLabel(name, site) {
 }
 function siteRuntime(site) {
   const kind = resolveSiteKind(site);
-  if (kind === "redirect")
+  if (kind === "redirect" || kind === "proxy")
     return "—";
   const command = `${site.start ?? ""} ${site.build ?? ""}`.toLowerCase();
   if (kind === "server-static")
@@ -30885,6 +30887,8 @@ function siteDeployLabel(site) {
   const kind = resolveSiteKind(site);
   if (kind === "redirect")
     return "redirect";
+  if (kind === "proxy")
+    return "proxy";
   if (kind === "server-app")
     return "service";
   if (kind === "server-static")
@@ -36403,7 +36407,7 @@ async function startLocalDashboardServer(options = {}) {
     });
   const notificationRouter = new NotificationRouter(alertStore, {
     emailImpl: async (input) => {
-      const { email } = await import("./chunk-k114qwg9.js");
+      const { email } = await import("./chunk-ttz2ra5j.js");
       return email.send(input);
     }
   });

package/dist/{chunk-9v2pwxv9.js → chunk-kpeb5rcs.js}

@@ -5,12 +5,12 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "./chunk-8kh577qh.js";
+} from "./chunk-v0vpamnf.js";
 import"./chunk-01d86gt1.js";
 import"./chunk-gttvakpv.js";
 import"./chunk-32e7ya18.js";
 import"./chunk-4cjrg98a.js";
-import"./chunk-wj3s95p9.js";
+import"./chunk-rds0sy87.js";
 import"./chunk-zqtpg06c.js";
 import"./chunk-v0bahtg2.js";
 export {

package/dist/{chunk-hpv68b4a.js → chunk-nsgqsmrh.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-32e7ya18.js";
 import {
   S3Client
-} from "./chunk-wj3s95p9.js";
+} from "./chunk-rds0sy87.js";
 import {
   AWSClient
 } from "./chunk-zqtpg06c.js";

package/dist/{chunk-wj3s95p9.js → chunk-rds0sy87.js}

@@ -1407,7 +1407,8 @@ host:${host}
       queryParams: { uploads: "" },
       headers
     });
-    return { UploadId: result?.InitiateMultipartUploadResult?.UploadId };
+    const root = result?.InitiateMultipartUploadResult ?? result;
+    return { UploadId: root?.UploadId };
   }
   async uploadPart(bucket, key, uploadId, partNumber, body) {
     const { accessKeyId, secretAccessKey, sessionToken } = this.getCredentials();
@@ -1504,7 +1505,7 @@ host:${host}
       bucket,
       queryParams: { uploads: "" }
     });
-    const uploads = result?.ListMultipartUploadsResult?.Upload;
+    const uploads = (result?.ListMultipartUploadsResult ?? result)?.Upload;
     if (!uploads)
       return [];
     const list = Array.isArray(uploads) ? uploads : [uploads];

package/dist/{chunk-k114qwg9.js → chunk-ttz2ra5j.js}

@@ -1,9 +1,9 @@
 import {
   EmailClient,
   email
-} from "./chunk-hpv68b4a.js";
+} from "./chunk-nsgqsmrh.js";
 import"./chunk-32e7ya18.js";
-import"./chunk-wj3s95p9.js";
+import"./chunk-rds0sy87.js";
 import"./chunk-zqtpg06c.js";
 import"./chunk-v0bahtg2.js";
 export {

package/dist/{chunk-8kh577qh.js → chunk-v0vpamnf.js}

@@ -16,7 +16,7 @@ import {
 } from "./chunk-4cjrg98a.js";
 import {
   S3Client
-} from "./chunk-wj3s95p9.js";
+} from "./chunk-rds0sy87.js";
 import {
   __require
 } from "./chunk-v0bahtg2.js";
@@ -815,7 +815,7 @@ async function deployStaticSiteWithExternalDnsFull(config) {
     }
   }
   onProgress?.("upload", "Uploading files to S3...");
-  const { uploadStaticFiles } = await import("./chunk-9v2pwxv9.js");
+  const { uploadStaticFiles } = await import("./chunk-kpeb5rcs.js");
   const uploadResult = await uploadStaticFiles({
     sourceDir,
     bucket: infraResult.bucket,
@@ -835,7 +835,7 @@ async function deployStaticSiteWithExternalDnsFull(config) {
   }
   if (infraResult.distributionId && uploadResult.uploaded > 0) {
     onProgress?.("invalidate", "Invalidating CloudFront cache...");
-    const { invalidateCache } = await import("./chunk-9v2pwxv9.js");
+    const { invalidateCache } = await import("./chunk-kpeb5rcs.js");
     await invalidateCache(infraResult.distributionId);
   }
   onProgress?.("complete", "Deployment complete!");

package/dist/deploy/index.js

@@ -36,7 +36,7 @@ import {
   synchronizeDashboardUsers,
   trackDashboardOperation,
   verifyStaticApiOrigin
-} from "../chunk-wmz8x3cy.js";
+} from "../chunk-ham2enem.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -47,12 +47,12 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "../chunk-8kh577qh.js";
+} from "../chunk-v0vpamnf.js";
 import {
   buildAndPushServerlessImage
 } from "../chunk-wmbep3b5.js";
-import"../chunk-x6yzgv7y.js";
-import"../chunk-hpv68b4a.js";
+import"../chunk-6a1t7fnq.js";
+import"../chunk-nsgqsmrh.js";
 import"../chunk-01d86gt1.js";
 import"../chunk-50jpda9q.js";
 import"../chunk-he9a874b.js";
@@ -65,12 +65,14 @@ import {
   collectServerDnsDomains,
   dashboardCredentialsFile,
   ensureManagementDashboard,
+  hasProxyUpstream,
   hostAcceptsIpv6,
   isPhpSite,
   normalizePublicIpv6,
   reconcileAddressRecords,
   removeStaleServerAddressRecords,
   resolveDashboardAuth,
+  resolveProxyUpstreams,
   resolveSiteDeployTarget,
   resolveSiteKind,
   resolveUiSource,
@@ -78,10 +80,10 @@ import {
   siteInstallBase,
   validateDeploymentConfig,
   verifyAddressRecord
-} from "../chunk-d3vx2ekv.js";
+} from "../chunk-6xnwshtc.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
-import"../chunk-wj3s95p9.js";
+import"../chunk-rds0sy87.js";
 import"../chunk-zqtpg06c.js";
 import"../chunk-19bs955w.js";
 import"../chunk-va2yd85b.js";
@@ -106,6 +108,7 @@ export {
   resolveUiSource,
   resolveSiteKind,
   resolveSiteDeployTarget,
+  resolveProxyUpstreams,
   resolveLegacyDashboardRoute,
   resolveDashboardData,
   resolveDashboardAuth,
@@ -120,6 +123,7 @@ export {
   infraEnvFromOutputs,
   hostAcceptsIpv6,
   hashContainerContext,
+  hasProxyUpstream,
   generateStaticSiteTemplate,
   generateExternalDnsStaticSiteTemplate,
   generateExistingStaticFullStackTemplate,

package/dist/deploy/site-target.d.ts

@@ -1,6 +1,6 @@
 import type { CloudConfig, SiteConfig, SiteDeployTarget } from '@ts-cloud/core';
 /**
- * The three resolved deployment kinds for a site:
+ * The resolved deployment kinds for a site:
  *  - `'bucket'`        — upload built `root` to object storage + CDN.
  *  - `'server-app'`    — `server` + `start`: dynamic app as a systemd service.
  *  - `'server-static'` — `server` + no `start` (has static `root`): a static
@@ -8,8 +8,12 @@ import type { CloudConfig, SiteConfig, SiteDeployTarget } from '@ts-cloud/core';
  *                        (served by the operator's own proxy, e.g. rpx + tlsx).
  *  - `'redirect'`      — gateway-only: `redirect` is set. Nothing is shipped;
  *                        the gateway answers `domain` with an HTTP redirect.
+ *  - `'proxy'`         — gateway-only: `proxyTo` is set. Nothing is shipped and
+ *                        no unit is managed; the gateway forwards `domain` to an
+ *                        upstream somebody else runs. The domain still joins the
+ *                        gateway's TLS set, which is the point.
  */
-export type SiteDeployKind = 'bucket' | 'server-app' | 'server-static' | 'server-php' | 'redirect';
+export type SiteDeployKind = 'bucket' | 'server-app' | 'server-static' | 'server-php' | 'redirect' | 'proxy';
 /**
  * On-disk base directory for a site's atomic release tree
  * (`<base>/releases/<sha>` + `<base>/current`).
@@ -33,6 +37,17 @@ export declare function siteInstallBase(slug: string, siteName: string): string;
  * `type` (laravel/php/statamic/wordpress).
  */
 export declare function isPhpSite(site: SiteConfig): boolean;
+/**
+ * Normalize a proxy-only site's `proxyTo` into the upstream list the gateway
+ * routes to, dropping blanks so a stray empty string cannot produce a route
+ * pointing at nothing.
+ *
+ * Returns `[]` when the site declares no usable upstream, which is what
+ * {@link hasProxyUpstream} keys off.
+ */
+export declare function resolveProxyUpstreams(site: SiteConfig): string[];
+/** Does this site forward to an upstream ts-cloud does not manage? */
+export declare function hasProxyUpstream(site: SiteConfig): boolean;
 /**
  * Resolve the explicit-or-inferred {@link SiteDeployTarget} for a site.
  *
@@ -68,8 +83,10 @@ export declare function validateDeploymentConfig(config: CloudConfig): Deploymen
  * Does this site produce a release the compute deploy has to build, package and
  * ship?
  *
- * `false` for the two kinds that ship nothing:
+ * `false` for the kinds that ship nothing:
  *  - `bucket`   — handled by the S3/CloudFront static-site path instead;
+ *  - `proxy`    — the gateway forwards the domain to a service ts-cloud does not
+ *    manage, so there is nothing to build, package or restart;
  *  - `redirect` — the gateway answers the domain with a Location header, so
  *    there is no `root` to package. Filtering these BEFORE the packaging loop
  *    matters: that loop reads `site.root` to build a tarball, and a redirect

package/dist/drivers/index.js

@@ -68,10 +68,10 @@ import {
   waitForSsh,
   wrapCloudInitUserData,
   writeResizeCheckpoint
-} from "../chunk-d3vx2ekv.js";
+} from "../chunk-6xnwshtc.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
-import"../chunk-wj3s95p9.js";
+import"../chunk-rds0sy87.js";
 import"../chunk-zqtpg06c.js";
 import"../chunk-va2yd85b.js";
 import"../chunk-aa2dkn7b.js";

package/dist/drivers/shared/rpx-gateway.d.ts

@@ -2,10 +2,12 @@
  * Generate the rpx reverse-proxy gateway config + provisioning from the `sites`
  * model.
  *
- * ts-cloud's per-site deploy model resolves each site to one of three kinds
+ * ts-cloud's per-site deploy model resolves each site to a kind
  * (see {@link import('../../deploy/site-target').resolveSiteKind}):
  *  - `server-app`    — a dynamic app running on a port (systemd service);
  *  - `server-static` — a static site shipped to `/var/www/<name>`;
+ *  - `redirect`      — answered here with a Location header, nothing shipped;
+ *  - `proxy`         — forwarded here to an upstream ts-cloud does not manage;
  *  - `bucket`        — object storage + CDN (not on the box; ignored here).
  *
  * The rpx gateway fronts :80/:443 on the box and routes by host **and path**:

package/dist/index.d.ts

@@ -32,7 +32,7 @@ export type { ObjectStorageConfig, ObjectStorageCredentials, ObjectStorageProvid
 export { keyMatchesFilters, migrateObjectStorage, remapKey } from './object-storage/migrate';
 export type { MigrateEndpoint, MigrateError, MigrateOptions, MigratePlanItem, MigrateProgress, MigrateResult, MigrateVerification, } from './object-storage/migrate';
 export * from './ssl';
-export { deployStaticSite, deployStaticSiteFull, uploadStaticFiles, invalidateCache, deleteStaticSite, generateStaticSiteTemplate, deployStaticSiteWithExternalDns, deployStaticSiteWithExternalDnsFull, generateExternalDnsStaticSiteTemplate, deploySite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, buildAndPushServerlessImage, buildFunctionEnv, deployServerlessApp, infraEnvFromOutputs, redeployServerlessApp, rollbackServerlessApp, runRemoteCommand, setMaintenance, buildManagementDashboardArtifact, dashboardCredentialsFile, ensureManagementDashboard, MANAGEMENT_DASHBOARD_SITE, resolveDashboardAuth, resolveUiSource, } from './deploy';
+export { deployStaticSite, deployStaticSiteFull, uploadStaticFiles, invalidateCache, deleteStaticSite, generateStaticSiteTemplate, deployStaticSiteWithExternalDns, deployStaticSiteWithExternalDnsFull, generateExternalDnsStaticSiteTemplate, deploySite, hasProxyUpstream, resolveProxyUpstreams, resolveSiteDeployTarget, resolveSiteKind, shipsARelease, validateDeploymentConfig, buildAndPushServerlessImage, buildFunctionEnv, deployServerlessApp, infraEnvFromOutputs, redeployServerlessApp, rollbackServerlessApp, runRemoteCommand, setMaintenance, buildManagementDashboardArtifact, dashboardCredentialsFile, ensureManagementDashboard, MANAGEMENT_DASHBOARD_SITE, resolveDashboardAuth, resolveUiSource, } from './deploy';
 export { collectServerDnsDomains, hostAcceptsIpv6, IPV6_EXCLUDED_HOST_LABELS, normalizePublicIpv6, reconcileAddressRecords, removeStaleServerAddressRecords, verifyAddressRecord, } from './deploy/server-dns';
 export type { AddressRecordReport } from './deploy/server-dns';
 export type { EnsureDashboardLogger, ResolvedDashboardAuth, StaticSiteConfig, DeployResult, UploadOptions, ExternalDnsStaticSiteConfig, ExternalDnsDeployResult, DeploySiteConfig, DeploySiteResult, StaticSiteDnsProvider, SiteDeployKind, DeploymentValidationResult, BuildImageOptions, BuiltImage, CodeSource, DeployServerlessOptions, ResolvedContext, } from './deploy';

package/dist/index.js

@@ -208,7 +208,7 @@ import {
   verifyUpdateSignature,
   webhookEndpoint,
   zeroCapacity
-} from "./chunk-wmz8x3cy.js";
+} from "./chunk-ham2enem.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -219,7 +219,7 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "./chunk-8kh577qh.js";
+} from "./chunk-v0vpamnf.js";
 import {
   buildAndPushServerlessImage
 } from "./chunk-wmbep3b5.js";
@@ -260,12 +260,12 @@ import {
   providerEndpoint,
   remapKey,
   resolveObjectStorage
-} from "./chunk-x6yzgv7y.js";
+} from "./chunk-6a1t7fnq.js";
 import {
   EmailClient,
   IAMClient,
   SESClient
-} from "./chunk-hpv68b4a.js";
+} from "./chunk-nsgqsmrh.js";
 import {
   CloudFrontClient
 } from "./chunk-01d86gt1.js";
@@ -316,6 +316,7 @@ import {
   ensureManagementDashboard,
   ensureServer,
   ensureSshKey,
+  hasProxyUpstream,
   hostAcceptsIpv6,
   normalizePublicIpv6,
   normalizeSshPublicKey,
@@ -326,11 +327,13 @@ import {
   resolveDashboardAuth,
   resolveExecStart,
   resolveHetznerApiToken,
+  resolveProxyUpstreams,
   resolveSiteDeployTarget,
   resolveSiteKind,
   resolveUiSource,
   scpUpload,
   serverPublicIpv4,
+  shipsARelease,
   sshExec,
   sshExecOrThrow,
   validateDeploymentConfig,
@@ -338,7 +341,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-d3vx2ekv.js";
+} from "./chunk-6xnwshtc.js";
 import {
   EC2Client,
   SSMClient
@@ -348,7 +351,7 @@ import {
 } from "./chunk-4cjrg98a.js";
 import {
   S3Client
-} from "./chunk-wj3s95p9.js";
+} from "./chunk-rds0sy87.js";
 import {
   AWSClient
 } from "./chunk-zqtpg06c.js";
@@ -5333,6 +5336,7 @@ export {
   signRequest,
   signCloudFrontUrl,
   signCloudFrontCookies,
+  shipsARelease,
   sharedRuntimeLoop,
   sharedRecursionGuard,
   sha256,
@@ -5396,6 +5400,7 @@ export {
   resolveQueues,
   resolveQueuedDeploymentCommand,
   resolveQueueNames,
+  resolveProxyUpstreams,
   resolveProjectStackName,
   resolveObjectStorage,
   resolveManagementDashboardSites,
@@ -5558,6 +5563,7 @@ export {
   hashFile,
   hashDirectory,
   hashBuffer,
+  hasProxyUpstream,
   hasManagementDashboardSite,
   handleSpendRequest,
   guardDutyManager,