@stacksjs/ts-cloud 0.7.119 → 0.7.121

package/dist/{chunk-8xezrv4z.js → chunk-0cx84wm2.js}

@@ -9,7 +9,7 @@ import {
   step,
   success,
   warn
-} from "./chunk-wmbep3b5.js";
+} from "./chunk-b801ga2t.js";
 import {
   AwsBackupClient,
   CloudWatchLogsClient,
@@ -50,7 +50,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-nm1d3a75.js";
+} from "./chunk-zcjc5y9f.js";
 import {
   SSMClient
 } from "./chunk-7m60qnc8.js";
@@ -104,7 +104,7 @@ import {
   spendOpenApiPaths,
   telemetryCursor,
   telemetryEstimatedMonthlyCost
-} from "./chunk-19bs955w.js";
+} from "./chunk-8ynjhsh3.js";
 import {
   artifactKey,
   buildCloudFormationTemplate,
@@ -126,7 +126,7 @@ import {
   resolveStatePath,
   setStateDir,
   statePath
-} from "./chunk-t2s3gdq6.js";
+} from "./chunk-xes5vst2.js";
 import {
   __require
 } from "./chunk-v0bahtg2.js";
@@ -1729,7 +1729,7 @@ async function deployServerlessApp(config, environment, opts = {}) {
   }
   if (imageMode) {
     step("Building + pushing container image");
-    const { buildAndPushServerlessImage } = await import("./chunk-53jatzaw.js");
+    const { buildAndPushServerlessImage } = await import("./chunk-w2zd56qm.js");
     const built = await buildAndPushServerlessImage({
       app,
       projectRoot,

package/dist/{chunk-19bs955w.js → chunk-8ynjhsh3.js}

@@ -4,7 +4,7 @@ import {
 import {
   resolveStatePath,
   statePath
-} from "./chunk-t2s3gdq6.js";
+} from "./chunk-xes5vst2.js";
 
 // src/spend/model.ts
 var METER_KEYS = [

package/dist/{chunk-wmbep3b5.js → chunk-b801ga2t.js}

@@ -8,7 +8,7 @@ import {
   phpRuntimeLayerAssets,
   runPhpBuildHooks,
   sha256
-} from "./chunk-t2s3gdq6.js";
+} from "./chunk-xes5vst2.js";
 
 // src/deploy/serverless-image.ts
 import { execFileSync } from "node:child_process";

package/dist/{chunk-53jatzaw.js → chunk-w2zd56qm.js}

@@ -1,9 +1,9 @@
 import {
   buildAndPushServerlessImage
-} from "./chunk-wmbep3b5.js";
+} from "./chunk-b801ga2t.js";
 import"./chunk-50jpda9q.js";
 import"./chunk-zqtpg06c.js";
-import"./chunk-t2s3gdq6.js";
+import"./chunk-xes5vst2.js";
 import"./chunk-v0bahtg2.js";
 export {
   buildAndPushServerlessImage

package/dist/{chunk-t2s3gdq6.js → chunk-xes5vst2.js}

@@ -10260,11 +10260,45 @@ function normalizeHomeDirectory(value, username) {
     throw new Error(`sftp: invalid homeDirectory for user ${username}`);
   return path;
 }
+function resolveStorage(options) {
+  const storage = options.storage;
+  if (storage?.type === "efs") {
+    const fileSystemId = "fileSystemId" in storage ? storage.fileSystemId : undefined;
+    if (!fileSystemId || typeof fileSystemId === "string" && !fileSystemId.trim())
+      throw new Error("sftp: EFS storage requires fileSystemId, or a fileSystem name defined in infrastructure.fileSystem");
+    return { type: "efs", fileSystemId, posixProfile: storage.posixProfile };
+  }
+  const bucket = (storage?.type === "s3" ? storage.bucket ?? options.bucket : options.bucket)?.trim();
+  if (!bucket)
+    throw new Error("sftp: S3 storage requires bucket, or a storageBucket name defined in infrastructure.storage");
+  return { type: "s3", bucket };
+}
+function posixProfileFor(username, user, fallback) {
+  const profile = user.posixProfile ?? fallback;
+  if (!profile)
+    throw new Error(`sftp: user ${username} requires a posixProfile (uid/gid) on an EFS-backed server`);
+  for (const id of [profile.uid, profile.gid, ...profile.secondaryGids ?? []]) {
+    if (!Number.isInteger(id) || id < 0 || id > 4294967295)
+      throw new Error(`sftp: user ${username} has an invalid posixProfile id ${id}`);
+  }
+  return {
+    Uid: profile.uid,
+    Gid: profile.gid,
+    ...profile.secondaryGids?.length ? { SecondaryGids: profile.secondaryGids } : {}
+  };
+}
+function efsHomeDirectory(fileSystemId, home) {
+  return typeof fileSystemId === "string" ? `/${fileSystemId}/${home}` : { "Fn::Sub": [`/\${FileSystemId}/${home}`, { FileSystemId: fileSystemId }] };
+}
+function efsFileSystemArn(fileSystemId) {
+  const template = "arn:aws:elasticfilesystem:${AWS::Region}:${AWS::AccountId}:file-system/${FileSystemId}";
+  return typeof fileSystemId === "string" ? { "Fn::Sub": template.replace("${FileSystemId}", fileSystemId) } : { "Fn::Sub": [template, { FileSystemId: fileSystemId }] };
+}
 
 class Sftp {
   static create(options) {
-    if (!options.bucket.trim())
-      throw new Error("sftp: bucket is required");
+    const storage = resolveStorage(options);
+    const domain = storage.type === "efs" ? "EFS" : "S3";
     const endpointType = options.endpointType ?? "PUBLIC";
     if (endpointType === "VPC" && (!options.endpointDetails?.vpcId || !options.endpointDetails.subnetIds.length))
       throw new Error("sftp: VPC endpoints require endpointDetails.vpcId and at least one subnet");
@@ -10310,7 +10344,7 @@ class Sftp {
     resources[serverLogicalId] = {
       Type: "AWS::Transfer::Server",
       Properties: {
-        Domain: "S3",
+        Domain: domain,
         EndpointType: endpointType,
         IdentityProviderType: "SERVICE_MANAGED",
         Protocols: ["SFTP"],
@@ -10342,7 +10376,35 @@ class Sftp {
       let roleArn = user.roleArn;
       if (!roleArn) {
         const roleLogicalId = `${prefix}${userPart}Role`;
-        const bucketArn = `arn:aws:s3:::${options.bucket}`;
+        let statements;
+        if (storage.type === "efs") {
+          statements = [
+            {
+              Effect: "Allow",
+              Action: [
+                "elasticfilesystem:ClientMount",
+                "elasticfilesystem:ClientWrite",
+                "elasticfilesystem:DescribeMountTargets"
+              ],
+              Resource: efsFileSystemArn(storage.fileSystemId)
+            }
+          ];
+        } else {
+          const bucketArn = `arn:aws:s3:::${storage.bucket}`;
+          statements = [
+            {
+              Effect: "Allow",
+              Action: ["s3:ListBucket", "s3:GetBucketLocation"],
+              Resource: bucketArn,
+              Condition: { StringLike: { "s3:prefix": [home, `${home}/*`] } }
+            },
+            {
+              Effect: "Allow",
+              Action: ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetObjectVersion"],
+              Resource: `${bucketArn}/${home}/*`
+            }
+          ];
+        }
         resources[roleLogicalId] = {
           Type: "AWS::IAM::Role",
           Properties: {
@@ -10355,22 +10417,7 @@ class Sftp {
             Policies: [
               {
                 PolicyName: "SftpHomeDirectory",
-                PolicyDocument: {
-                  Version: "2012-10-17",
-                  Statement: [
-                    {
-                      Effect: "Allow",
-                      Action: ["s3:ListBucket", "s3:GetBucketLocation"],
-                      Resource: bucketArn,
-                      Condition: { StringLike: { "s3:prefix": [home, `${home}/*`] } }
-                    },
-                    {
-                      Effect: "Allow",
-                      Action: ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetObjectVersion"],
-                      Resource: `${bucketArn}/${home}/*`
-                    }
-                  ]
-                }
+                PolicyDocument: { Version: "2012-10-17", Statement: statements }
               }
             ]
           }
@@ -10385,12 +10432,13 @@ class Sftp {
           UserName: username,
           Role: roleArn,
           HomeDirectoryType: "PATH",
-          HomeDirectory: `/${options.bucket}/${home}`,
+          HomeDirectory: storage.type === "efs" ? efsHomeDirectory(storage.fileSystemId, home) : `/${storage.bucket}/${home}`,
+          ...storage.type === "efs" ? { PosixProfile: posixProfileFor(username, user, storage.posixProfile) } : {},
           SshPublicKeys: user.sshPublicKeys
         }
       };
     }
-    return { resources, serverLogicalId };
+    return { resources, serverLogicalId, domain };
   }
 }
 

package/dist/{chunk-nm1d3a75.js → chunk-zcjc5y9f.js}

@@ -25,7 +25,7 @@ import {
   resolveProjectStackName,
   resolveStatePath,
   statePath
-} from "./chunk-t2s3gdq6.js";
+} from "./chunk-xes5vst2.js";
 import {
   __require
 } from "./chunk-v0bahtg2.js";
@@ -2061,6 +2061,78 @@ function buildProtectionScript(protection = {}, extraPorts = []) {
   return [...buildDdosScript(protection.ddos, extraPorts), ...buildWafScript(protection.waf)];
 }
 
+// src/drivers/shared/sftp-provision.ts
+var SFTP_CONFIG_DIR = "/etc/ts-sftp";
+var SFTP_INSTALL_DIR = "/opt/ts-sftp";
+var SFTP_BUN_BIN = "/usr/local/bin/ts-sftp-bun";
+var DEFAULT_SFTP_PORT = 2222;
+function sftpUnitName(slug) {
+  return `${slug}-sftp`;
+}
+function sftpPort(sftp) {
+  return sftp.port ?? DEFAULT_SFTP_PORT;
+}
+function sftpRoot(options) {
+  const storage = options.sftp.storage;
+  if (storage?.type === "efs" && storage.path)
+    return storage.path;
+  return `/var/sftp/${options.slug}`;
+}
+function quote(value) {
+  return `'${value.split("'").join("'\\''")}'`;
+}
+function assertSftpSupported(sftp, provider) {
+  if (provider === "aws")
+    return;
+  const storage = sftp.storage;
+  const wantsBucket = storage?.type === "s3" || !storage && !!sftp.bucket;
+  if (wantsBucket) {
+    throw new Error(`sftp: bucket-backed storage is only available on the aws provider (Transfer Family). ` + `On ${provider}, use storage: { type: 'efs' } to serve a directory on the server.`);
+  }
+  for (const [username, user] of Object.entries(sftp.users)) {
+    if (!user.sshPublicKeys?.length)
+      throw new Error(`sftp: user ${username} needs at least one SSH public key`);
+  }
+}
+function buildSftpProvisionScript(options) {
+  const { slug, sftp } = options;
+  const unit = sftpUnitName(slug);
+  const root = sftpRoot(options);
+  const port = sftpPort(sftp);
+  const hostKey = `${SFTP_CONFIG_DIR}/host_key`;
+  const usersDir = `${SFTP_CONFIG_DIR}/users`;
+  const serviceUser = sftp.serviceUser ?? "ts-sftp";
+  const commands = [
+    `# --- ts-sftp (${unit}) ---`,
+    `id -u ${serviceUser} >/dev/null 2>&1 || useradd --system --home-dir ${quote(root)} --shell /usr/sbin/nologin ${serviceUser}`,
+    'export HOME="${HOME:-/root}"',
+    'command -v bun >/dev/null 2>&1 || (curl -fsSL https://bun.sh/install | bash && ln -sf "$HOME/.bun/bin/bun" /usr/local/bin/bun)',
+    `mkdir -p ${quote(root)} ${SFTP_CONFIG_DIR} ${usersDir} ${SFTP_INSTALL_DIR}`,
+    `chmod 750 ${SFTP_CONFIG_DIR}`,
+    `cd ${SFTP_INSTALL_DIR} && [ -f package.json ] || printf '{"name":"ts-sftp-host","private":true}' > package.json`,
+    `cd ${SFTP_INSTALL_DIR} && bun add ts-sftp@${sftp.version ?? "latest"} --no-save --production || bun add ts-sftp@${sftp.version ?? "latest"}`,
+    `[ -f ${hostKey} ] || bun ${SFTP_INSTALL_DIR}/node_modules/ts-sftp/dist/bin/cli.js keygen --out ${hostKey} --comment ${quote(`${slug}-sftp`)}`,
+    `chmod 600 ${hostKey}`,
+    'BUN_REAL=$(readlink -f "$(command -v bun)")',
+    `case "$BUN_REAL" in /root/*) install -m 0755 "$BUN_REAL" ${SFTP_BUN_BIN}; BUN_BIN=${SFTP_BUN_BIN};; *) BUN_BIN="$BUN_REAL";; esac`
+  ];
+  const userFlags = [];
+  for (const [username, user] of Object.entries(sftp.users)) {
+    const home = (user.homeDirectory ?? username).replace(/^\/+|\/+$/g, "");
+    if (!home || home.split("/").includes(".."))
+      throw new Error(`sftp: invalid homeDirectory for user ${username}`);
+    const keysFile = `${usersDir}/${username}.pub`;
+    commands.push(`mkdir -p ${quote(`${root}/${home}`)}`, `printf '%s\\n' ${quote(user.sshPublicKeys.join(`
+`))} > ${keysFile}`, `chmod 644 ${keysFile}`);
+    userFlags.push(`--user ${username}:${keysFile}`);
+  }
+  commands.push(`chown -R ${serviceUser}:${serviceUser} ${quote(root)} ${SFTP_CONFIG_DIR}`, `cat > /etc/systemd/system/${unit}.service <<TSCLOUD_SFTP_UNIT`, "[Unit]", "Description=ts-sftp file transfer server", "After=network.target", "", "[Service]", `User=${serviceUser}`, `ExecStart=$BUN_BIN ${SFTP_INSTALL_DIR}/node_modules/ts-sftp/dist/bin/cli.js serve --root ${root} --host-key ${hostKey} --port ${port}${sftp.readOnly ? " --read-only" : ""} ${userFlags.join(" ")}`, "Restart=always", "RestartSec=2", "NoNewPrivileges=true", "PrivateTmp=true", "ProtectSystem=strict", `ReadWritePaths=${root}`, "", "[Install]", "WantedBy=multi-user.target", "TSCLOUD_SFTP_UNIT", "systemctl daemon-reload", `systemctl enable ${unit}.service`, `systemctl restart ${unit}.service`);
+  return commands;
+}
+function sftpFirewallPorts(sftp) {
+  return sftp ? [sftpPort(sftp)] : [];
+}
+
 // src/drivers/shared/ufw.ts
 var UFW_BASE_PORTS = [80, 443];
 function buildUfwScript(firewall = {}) {
@@ -2108,6 +2180,11 @@ function buildComputeProvisionScripts(config) {
   if (compute.managedServices) {
     extras.push(...buildServicesProvisionScript(compute.managedServices), ...buildDatabaseSetupScript(appDatabase, compute.managedServices));
   }
+  const sftp = config.infrastructure?.sftp;
+  if (sftp) {
+    assertSftpSupported(sftp, resolveCloudProvider(config));
+    extras.push(...buildSftpProvisionScript({ slug: config.project.slug, sftp }));
+  }
   extras.push(...buildUfwScript(compute.firewall ?? (phpBox ? { enabled: true } : { enabled: false })));
   extras.push(...buildProtectionScript({ ddos: compute.ddos, waf: compute.waf }, compute.firewall?.allowedPorts ?? []));
   extras.push(...buildAutoUpdatesScript(compute.autoUpdates ?? phpBox));
@@ -2340,6 +2417,36 @@ function encodeUserData(userData) {
 function resolveAwsImageId(config) {
   return config.infrastructure?.compute?.image ?? null;
 }
+function awsSecurityGroupName(slug, environment) {
+  return `${slug}-${environment}-app-sg`;
+}
+function awsResourceTags(slug, environment, role = "app") {
+  return [
+    { Key: "Project", Value: slug },
+    { Key: "Environment", Value: environment },
+    { Key: "Role", Value: role },
+    { Key: "ManagedBy", Value: "ts-cloud" }
+  ];
+}
+function matchesAwsProjectTags(tags, slug, environment) {
+  if (!tags?.length)
+    return false;
+  const value = (key) => tags.find((tag) => tag.Key === key)?.Value;
+  return value("Project") === slug && value("Environment") === environment;
+}
+function selectProjectSecurityGroup(groups, options) {
+  const name = awsSecurityGroupName(options.slug, options.environment);
+  return groups.find((group) => {
+    if (group.GroupName !== name)
+      return false;
+    if (options.vpcId && group.VpcId && group.VpcId !== options.vpcId)
+      return false;
+    const tagged = !!group.Tags?.some((tag) => tag.Key === "Project");
+    if (tagged)
+      return matchesAwsProjectTags(group.Tags, options.slug, options.environment);
+    return !!options.vpcId && group.VpcId === options.vpcId;
+  });
+}
 
 // src/drivers/aws/driver.ts
 function readPinnedInstanceId(stackName) {
@@ -2356,8 +2463,12 @@ class AwsDriver {
   name = "aws";
   usesCloudFormation = true;
   region;
+  ec2Client;
+  cfnClient;
   constructor(options = {}) {
     this.region = options.region || "us-east-1";
+    this.ec2Client = options.ec2Client ?? ((region) => new EC2Client(region));
+    this.cfnClient = options.cfnClient ?? ((region) => new CloudFormationClient(region));
   }
   resolveRegion(config) {
     return config.project.region || this.region;
@@ -2369,8 +2480,8 @@ class AwsDriver {
     const compute = config.infrastructure?.compute;
     if (!compute)
       throw new Error("infrastructure.compute is required to provision AWS compute");
-    const ec2 = new EC2Client(region);
-    const existing = await this.findComputeTargets({ slug, environment, role: "app" });
+    const ec2 = this.ec2Client(region);
+    const existing = await this.findComputeTargets({ slug, environment, role: "app", region });
     if (existing.length > 0) {
       const first = existing[0];
       return {
@@ -2398,7 +2509,7 @@ class AwsDriver {
     const subnetId = subnet?.SubnetId;
     if (!subnet?.MapPublicIpOnLaunch)
       console.warn("ts-cloud: no public subnet found; the instance may not get a public IP (deploys/SSL need one).");
-    const sgName = `${slug}-${environment}-app-sg`;
+    const sgName = awsSecurityGroupName(slug, environment);
     const found = await ec2.describeSecurityGroups({
       Filters: [
         { Name: "group-name", Values: [sgName] },
@@ -2410,7 +2521,8 @@ class AwsDriver {
       const created = await ec2.createSecurityGroup({
         GroupName: sgName,
         Description: `ts-cloud ${slug}/${environment} app`,
-        VpcId: vpc.VpcId
+        VpcId: vpc.VpcId,
+        TagSpecifications: [{ ResourceType: "security-group", Tags: awsResourceTags(slug, environment) }]
       });
       groupId = created.GroupId;
     }
@@ -2441,12 +2553,7 @@ class AwsDriver {
       TagSpecifications: [
         {
           ResourceType: "instance",
-          Tags: [
-            { Key: "Name", Value: `${slug}-${environment}-app` },
-            { Key: "Project", Value: slug },
-            { Key: "Environment", Value: environment },
-            { Key: "Role", Value: "app" }
-          ]
+          Tags: [{ Key: "Name", Value: `${slug}-${environment}-app` }, ...awsResourceTags(slug, environment)]
         }
       ]
     });
@@ -2466,11 +2573,17 @@ class AwsDriver {
   }
   async destroyCompute(options) {
     const { config, environment } = options;
+    const slug = config.project.slug;
     const region = this.resolveRegion(config);
-    const ec2 = new EC2Client(region);
+    const ec2 = this.ec2Client(region);
     const destroyed = [];
-    const targets = await this.findComputeTargets({ slug: config.project.slug, environment, role: "app" });
+    const targets = await this.findComputeTargets({ slug, environment, role: "app", region });
     const ids = targets.map((t) => t.id);
+    let vpcId;
+    if (ids.length > 0) {
+      const described = await ec2.describeInstances({ InstanceIds: ids }).catch(() => ({ Reservations: [] }));
+      vpcId = described.Reservations?.flatMap((reservation) => reservation.Instances ?? []).find((i) => i.VpcId)?.VpcId;
+    }
     if (ids.length > 0) {
       await ec2.terminateInstances(ids);
       destroyed.push(...ids.map((id) => `instance ${id}`));
@@ -2478,13 +2591,16 @@ class AwsDriver {
         return;
       })));
     }
-    const sgName = `${config.project.slug}-${environment}-app-sg`;
-    const found = await ec2.describeSecurityGroups({ Filters: [{ Name: "group-name", Values: [sgName] }] }).catch(() => ({ SecurityGroups: [] }));
-    const groupId = found.SecurityGroups?.[0]?.GroupId;
-    if (groupId) {
+    const sgName = awsSecurityGroupName(slug, environment);
+    const filters = [{ Name: "group-name", Values: [sgName] }];
+    if (vpcId)
+      filters.push({ Name: "vpc-id", Values: [vpcId] });
+    const found = await ec2.describeSecurityGroups({ Filters: filters }).catch(() => ({ SecurityGroups: [] }));
+    const group = selectProjectSecurityGroup(found.SecurityGroups ?? [], { slug, environment, vpcId });
+    if (group?.GroupId) {
       for (let i = 0;i < 10; i++) {
         try {
-          await ec2.deleteSecurityGroup(groupId);
+          await ec2.deleteSecurityGroup(group.GroupId);
           destroyed.push(`security group ${sgName}`);
           break;
         } catch {
@@ -2497,7 +2613,7 @@ class AwsDriver {
   async getComputeOutputs(options) {
     const region = this.resolveRegion(options.config);
     const stackName = resolveProjectStackName(options.config, options.environment);
-    const cfn = new CloudFormationClient(region);
+    const cfn = this.cfnClient(region);
     try {
       const outputs = await cfn.getStackOutputs(stackName);
       return {
@@ -2512,7 +2628,8 @@ class AwsDriver {
       const targets = await this.findComputeTargets({
         slug: options.config.project.slug,
         environment: options.environment,
-        role: "app"
+        role: "app",
+        region
       });
       const first = targets[0];
       return {
@@ -2544,8 +2661,8 @@ class AwsDriver {
     return { artifactRef: `s3://${bucket}/${options.remoteKey}` };
   }
   async findComputeTargets(options) {
-    const region = this.region;
-    const ec2 = new EC2Client(region);
+    const region = options.region ?? this.region;
+    const ec2 = this.ec2Client(region);
     const filters = [
       { Name: "tag:Project", Values: [options.slug] },
       { Name: "tag:Environment", Values: [options.environment] },
@@ -2560,7 +2677,7 @@ class AwsDriver {
     let pinnedId = readPinnedInstanceId(stackName);
     if (!pinnedId) {
       try {
-        pinnedId = (await new CloudFormationClient(region).getStackOutputs(stackName)).appInstanceId ?? null;
+        pinnedId = (await this.cfnClient(region).getStackOutputs(stackName)).appInstanceId ?? null;
       } catch {
         pinnedId = null;
       }
@@ -2988,6 +3105,9 @@ class HetznerClient {
     });
     return data.ssh_key;
   }
+  async deleteSshKey(id) {
+    await this.request("DELETE", `/ssh_keys/${id}`);
+  }
   async getAction(actionId) {
     const data = await this.request("GET", `/actions/${actionId}`);
     return data.action;
@@ -3180,9 +3300,12 @@ function tsCloudLabels(slug, environment, role = "app") {
   };
 }
 function matchesTsCloudLabels(labels, slug, environment, role = "app") {
+  return matchesTsCloudProject(labels, slug, environment) && labels[`${TS_CLOUD_LABEL_PREFIX}/role`] === role;
+}
+function matchesTsCloudProject(labels, slug, environment) {
   if (!labels)
     return false;
-  return labels[`${TS_CLOUD_LABEL_PREFIX}/project`] === slug && labels[`${TS_CLOUD_LABEL_PREFIX}/environment`] === environment && labels[`${TS_CLOUD_LABEL_PREFIX}/role`] === role;
+  return labels[`${TS_CLOUD_LABEL_PREFIX}/project`] === slug && labels[`${TS_CLOUD_LABEL_PREFIX}/environment`] === environment;
 }
 
 // src/drivers/hetzner/state.ts
@@ -3297,7 +3420,10 @@ class HetznerDriver {
     const { firewall } = await this.ensureFirewall(firewallName, labels, buildHetznerFirewallRules({
       allowSsh: compute.allowSsh !== false,
       sitePorts,
-      allowedPorts: compute.firewall?.allowedPorts
+      allowedPorts: [
+        ...compute.firewall?.allowedPorts ?? [],
+        ...sftpFirewallPorts(config.infrastructure?.sftp)
+      ]
     }));
     const sshKeyId = await this.ensureSshKey(slug, environment, labels);
     const existing = await readDriverState(stackName);
@@ -3800,6 +3926,14 @@ class HetznerDriver {
         }
       }
     }
+    const sshKeys = await this.client.listSshKeys().catch(() => []);
+    const ourKeys = sshKeys.filter((key) => matchesTsCloudProject(key.labels, slug, environment));
+    for (const key of ourKeys) {
+      try {
+        await this.client.deleteSshKey(key.id);
+        destroyed.push(`ssh key ${key.name}`);
+      } catch {}
+    }
     await writeDriverState(stackName, { provider: "hetzner", stackName }).catch(() => {});
     return { destroyed };
   }
@@ -4089,7 +4223,7 @@ class HetznerDriver {
     let lastErr;
     while (Date.now() - start < sshTimeoutMs) {
       try {
-        execSync(`ssh ${this.sshBaseArgs(host, ["-o", "ConnectTimeout=5"]).map((a) => `'${a.replace(/'/g, "\\\"")}"`).join(" ")} true`, {
+        execSync(`ssh ${this.sshBaseArgs(host, ["-o", "ConnectTimeout=5"]).map(shellQuote).join(" ")} true`, {
           stdio: "pipe",
           maxBuffer: SSH_MAX_BUFFER
         });
@@ -5518,7 +5652,9 @@ function buildSiteDeployScript(options) {
     keepReleases = DEFAULT_KEEP_RELEASES,
     preStartCommands = [],
     healthCheckPath,
-    healthGateSeconds = 5
+    healthGateSeconds = 5,
+    memoryHigh = "2G",
+    memoryMax
   } = options;
   const zeroDowntime = options.zeroDowntime ?? port != null;
   const base = options.appDir ?? `/var/www/${siteName}`;
@@ -5543,7 +5679,8 @@ function buildSiteDeployScript(options) {
     "TS_CLOUD_ENV_EOF",
     `chmod 600 ${paths.shared}/.env`,
     ...buildPromoteStagedRelease(paths),
-    `for TS_CLOUD_ENV in ${paths.shared}/.env ${paths.release}/.env ${paths.release}/.env.*; do [ -f "$TS_CLOUD_ENV" ] && sed -i -E '/^[[:space:]]*(PORT|PORT_BACKEND|PORT_ADMIN|PORT_FRONTEND)[[:space:]]*=/d' "$TS_CLOUD_ENV" 2>/dev/null || true; done`,
+    `find ${paths.release} -maxdepth 1 \\( -type f -o -type l \\) -name '.env*' ! -name '.env.example' ! -name '*.example' -delete`,
+    `sed -i -E '/^[[:space:]]*(PORT|PORT_BACKEND|PORT_ADMIN|PORT_FRONTEND)[[:space:]]*=/d' ${paths.shared}/.env 2>/dev/null || true`,
     ...buildLinkSharedPaths(paths, sharedPaths),
     ...preStart
   ];
@@ -5564,6 +5701,9 @@ function buildSiteDeployScript(options) {
       `ExecStart=${execStart}`,
       "Restart=always",
       "RestartSec=5",
+      "MemoryAccounting=true",
+      ...memoryHigh ? [`MemoryHigh=${memoryHigh}`] : [],
+      ...memoryMax ? [`MemoryMax=${memoryMax}`] : [],
       `EnvironmentFile=${paths.releases}/%i/.env`,
       `Environment=PORT=${port}`,
       "",
@@ -6546,7 +6686,9 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
     preStartCommands: site.preStart,
     sharedPaths: site.sharedPaths,
     zeroDowntime: site.zeroDowntime !== false,
-    healthCheckPath: site.healthCheck?.path
+    healthCheckPath: site.healthCheck?.path,
+    memoryHigh: site.memoryHigh,
+    memoryMax: site.memoryMax
   });
   const wantsNginxStatic = kind === "server-static" && !usesRpxProxy(compute) && !!site.domain;
   const staticVhost = wantsNginxStatic ? buildNginxVhostScript({

package/dist/deploy/index.js

@@ -36,7 +36,7 @@ import {
   synchronizeDashboardUsers,
   trackDashboardOperation,
   verifyStaticApiOrigin
-} from "../chunk-8xezrv4z.js";
+} from "../chunk-0cx84wm2.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -50,7 +50,7 @@ import {
 } from "../chunk-v0vpamnf.js";
 import {
   buildAndPushServerlessImage
-} from "../chunk-wmbep3b5.js";
+} from "../chunk-b801ga2t.js";
 import"../chunk-6a1t7fnq.js";
 import"../chunk-nsgqsmrh.js";
 import"../chunk-01d86gt1.js";
@@ -83,15 +83,15 @@ import {
   siteInstallBase,
   validateDeploymentConfig,
   verifyAddressRecord
-} from "../chunk-nm1d3a75.js";
+} from "../chunk-zcjc5y9f.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-rds0sy87.js";
 import"../chunk-zqtpg06c.js";
-import"../chunk-19bs955w.js";
+import"../chunk-8ynjhsh3.js";
 import"../chunk-va2yd85b.js";
 import"../chunk-aa2dkn7b.js";
-import"../chunk-t2s3gdq6.js";
+import"../chunk-xes5vst2.js";
 import"../chunk-v0bahtg2.js";
 export {
   verifyStaticApiOrigin,

package/dist/deploy/release-content.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Pre-flight check on what a site is about to ship.
+ *
+ * `existsSync(site.root)` was the only gate before this, and a directory
+ * existing says nothing about whether it holds a servable site. The failure it
+ * missed is specific and expensive: a static-site generator that renders into a
+ * SUBDIRECTORY of its output directory (BunPress writes `<outdir>/.bunpress`,
+ * and it is far from alone) leaves the configured `root` existing but holding
+ * only that one child. The tarball then ships `current/.bunpress/index.html`,
+ * the gateway serves `current/`, and every URL 404s while the deploy prints
+ * success and exits 0.
+ *
+ * So the check looks at the content, and when the content says the root is one
+ * level too high it says so by name instead of leaving it to be found in
+ * production.
+ */
+export interface ReleaseContentIssue {
+    level: 'error' | 'warning';
+    message: string;
+}
+export interface CheckReleaseContentOptions {
+    /** The site's resolved `root`, as configured. */
+    root: string;
+    /** Site key, for messages. */
+    siteName: string;
+    /**
+     * Static sites are served by path from the release root, so a missing
+     * top-level `index.html` means the domain root 404s. An app site ships a
+     * source tree and has no such expectation.
+     */
+    expectIndex: boolean;
+}
+/**
+ * Inspect what a site is about to package. Returns every issue found; the
+ * caller fails the deploy when any of them is an `error`.
+ */
+export declare function checkReleaseContent(options: CheckReleaseContentOptions): ReleaseContentIssue[];

package/dist/deploy/release-content.test.d.ts

@@ -0,0 +1 @@
+export {};