@stacksjs/ts-cloud 0.7.115 → 0.7.117

package/dist/{chunk-f52r4fsk.js → chunk-adz3ffn0.js}

@@ -50,7 +50,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-ck9gzxr0.js";
+} from "./chunk-rfm32pqg.js";
 import {
   SSMClient
 } from "./chunk-7m60qnc8.js";

package/dist/{chunk-ck9gzxr0.js → chunk-rfm32pqg.js}

@@ -2667,8 +2667,8 @@ class AwsDriver {
 
 // src/drivers/hetzner/driver.ts
 import { execFileSync, execSync } from "node:child_process";
-import { randomUUID } from "node:crypto";
-import { existsSync, readFileSync as readFileSync2 } from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
+import { createReadStream, existsSync, readFileSync as readFileSync2 } from "node:fs";
 
 // src/drivers/shared/fleet.ts
 function resolveFleetTopology(compute = {}) {
@@ -3209,6 +3209,15 @@ async function writeDriverState(stackName, state) {
 // src/drivers/hetzner/driver.ts
 var SSH_MAX_BUFFER = 1024 * 1024 * 256;
 var SSH_ERROR_OUTPUT_LIMIT = 8000;
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'"'"'`)}'`;
+}
+async function sha256File(path) {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(path))
+    hash.update(chunk);
+  return hash.digest("hex");
+}
 function sshErrorOutput(value) {
   const output = Buffer.isBuffer(value) ? value.toString("utf8") : typeof value === "string" ? value : "";
   return output.replace(/(^|\n)(\s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_]*=).*$/gm, "$1$2[redacted]").replace(/encrypted:[A-Za-z0-9+/=]+/g, "encrypted:[redacted]").trim().slice(-SSH_ERROR_OUTPUT_LIMIT);
@@ -3838,11 +3847,34 @@ class HetznerDriver {
     const stagingStem = options.remoteKey.replace(/^releases\//, "").replace(/\.tar\.gz$/, "").replace(/\//g, "-");
     const stagingName = `${stagingStem}-${randomUUID()}.tar.gz`;
     const remotePath = `/var/ts-cloud/staging/${stagingName}`;
+    const digest = await sha256File(options.localPath);
+    const artifactDir = "/var/ts-cloud/artifacts";
+    const cachedPath = `${artifactDir}/${digest}.tar.gz`;
     for (const target of targets) {
       if (!target.publicIp) {
         throw new Error(`Target ${target.id} has no public IP for SCP upload`);
       }
-      this.scpToHost(target.publicIp, options.localPath, remotePath);
+      const stageCached = [
+        "set -euo pipefail",
+        `mkdir -p ${shellQuote(artifactDir)} /var/ts-cloud/staging`,
+        `test -s ${shellQuote(cachedPath)}`,
+        `cp -- ${shellQuote(cachedPath)} ${shellQuote(remotePath)}`
+      ].join(`
+`);
+      try {
+        this.sshExec(target.publicIp, stageCached);
+        continue;
+      } catch {}
+      const uploadPath = `${artifactDir}/.${digest}-${randomUUID()}.tmp`;
+      this.scpToHost(target.publicIp, options.localPath, uploadPath);
+      this.sshExec(target.publicIp, [
+        "set -euo pipefail",
+        `chmod 600 ${shellQuote(uploadPath)}`,
+        `mv -f -- ${shellQuote(uploadPath)} ${shellQuote(cachedPath)}`,
+        `cp -- ${shellQuote(cachedPath)} ${shellQuote(remotePath)}`,
+        `find ${shellQuote(artifactDir)} -type f -name '*.tar.gz' -mtime +7 -delete 2>/dev/null || true`
+      ].join(`
+`));
     }
     return { artifactRef: remotePath };
   }
@@ -6179,21 +6211,21 @@ function buildGitCheckoutScript(options) {
   const lines = [`rm -rf ${releaseDir}`, `mkdir -p ${releaseDir}`];
   if (repository.strategy === "tag") {
     if (repository.tag) {
-      lines.push(`git clone -q --depth 1 --branch ${shellQuote(repository.tag)} ${shellQuote(url)} ${releaseDir}`);
-      lines.push(`printf '%s' ${shellQuote(repository.tag)} > ${releaseDir}/.ts-cloud-tag`);
+      lines.push(`git clone -q --depth 1 --branch ${shellQuote2(repository.tag)} ${shellQuote2(url)} ${releaseDir}`);
+      lines.push(`printf '%s' ${shellQuote2(repository.tag)} > ${releaseDir}/.ts-cloud-tag`);
     } else {
       const pattern = repository.tagPattern || DEFAULT_TAG_PATTERN;
-      lines.push(`TS_CLOUD_TAG="$(git ls-remote --tags --refs --sort=-v:refname ${shellQuote(url)} ${shellQuote(`refs/tags/${pattern}`)} | head -n1 | sed 's#.*refs/tags/##')"`, `test -n "$TS_CLOUD_TAG" || { echo "no tags matching" ${shellQuote(pattern)} "found in" ${shellQuote(url)} >&2; exit 1; }`, `git clone -q --depth 1 --branch "$TS_CLOUD_TAG" ${shellQuote(url)} ${releaseDir}`, `printf '%s' "$TS_CLOUD_TAG" > ${releaseDir}/.ts-cloud-tag`);
+      lines.push(`TS_CLOUD_TAG="$(git ls-remote --tags --refs --sort=-v:refname ${shellQuote2(url)} ${shellQuote2(`refs/tags/${pattern}`)} | head -n1 | sed 's#.*refs/tags/##')"`, `test -n "$TS_CLOUD_TAG" || { echo "no tags matching" ${shellQuote2(pattern)} "found in" ${shellQuote2(url)} >&2; exit 1; }`, `git clone -q --depth 1 --branch "$TS_CLOUD_TAG" ${shellQuote2(url)} ${releaseDir}`, `printf '%s' "$TS_CLOUD_TAG" > ${releaseDir}/.ts-cloud-tag`);
     }
   } else if (commit) {
-    lines.push(`git -C ${releaseDir} init -q`, `git -C ${releaseDir} remote add origin ${shellQuote(url)}`, `git -C ${releaseDir} fetch -q --depth 1 origin ${shellQuote(commit)}`, `git -C ${releaseDir} checkout -q FETCH_HEAD`);
+    lines.push(`git -C ${releaseDir} init -q`, `git -C ${releaseDir} remote add origin ${shellQuote2(url)}`, `git -C ${releaseDir} fetch -q --depth 1 origin ${shellQuote2(commit)}`, `git -C ${releaseDir} checkout -q FETCH_HEAD`);
   } else {
-    lines.push(`git clone -q --depth 1 --branch ${shellQuote(branch)} ${shellQuote(url)} ${releaseDir}`);
+    lines.push(`git clone -q --depth 1 --branch ${shellQuote2(branch)} ${shellQuote2(url)} ${releaseDir}`);
   }
   lines.push(`git -C ${releaseDir} rev-parse HEAD > ${releaseDir}/.ts-cloud-sha`);
   return lines;
 }
-function shellQuote(value) {
+function shellQuote2(value) {
   const escaped = value.split("'").join("'\\''");
   return `'${escaped}'`;
 }
@@ -6382,7 +6414,7 @@ var noopLogger2 = {
   step: () => {},
   success: () => {}
 };
-function shellQuote2(value) {
+function shellQuote3(value) {
   return `'${value.replace(/'/g, `'"'"'`)}'`;
 }
 async function deploySiteRelease(driver, options, logger = noopLogger2) {
@@ -6914,7 +6946,7 @@ async function renewRpxCertificates(options) {
     return true;
   }
   logger.step("Issuing rpx TLS certificates after DNS reconciliation...");
-  const certChecks = certDomains.map((domain) => `test -s ${shellQuote2(`${rpxConfig.productionCerts.certsDir}/${domain}.crt`)}`).join(" && ");
+  const certChecks = certDomains.map((domain) => `test -s ${shellQuote3(`${rpxConfig.productionCerts.certsDir}/${domain}.crt`)}`).join(" && ");
   const result = await driver.runRemoteDeploy({
     targets,
     commands: [

package/dist/deploy/index.js

@@ -36,7 +36,7 @@ import {
   synchronizeDashboardUsers,
   trackDashboardOperation,
   verifyStaticApiOrigin
-} from "../chunk-f52r4fsk.js";
+} from "../chunk-adz3ffn0.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -81,7 +81,7 @@ import {
   siteInstallBase,
   validateDeploymentConfig,
   verifyAddressRecord
-} from "../chunk-ck9gzxr0.js";
+} from "../chunk-rfm32pqg.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-rds0sy87.js";

package/dist/drivers/index.js

@@ -68,7 +68,7 @@ import {
   waitForSsh,
   wrapCloudInitUserData,
   writeResizeCheckpoint
-} from "../chunk-ck9gzxr0.js";
+} from "../chunk-rfm32pqg.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-rds0sy87.js";

package/dist/index.js

@@ -208,7 +208,7 @@ import {
   verifyUpdateSignature,
   webhookEndpoint,
   zeroCapacity
-} from "./chunk-f52r4fsk.js";
+} from "./chunk-adz3ffn0.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -341,7 +341,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-ck9gzxr0.js";
+} from "./chunk-rfm32pqg.js";
 import {
   EC2Client,
   SSMClient