@stacksjs/ts-cloud 0.7.119 → 0.7.121

package/dist/drivers/aws/driver.d.ts

@@ -1,6 +1,15 @@
 import type { CloudDriver, ComputeStackOutputs, ComputeTarget, FindComputeTargetsOptions, ProvisionComputeOptions, RemoteDeployResult, RunRemoteDeployOptions, UploadReleaseOptions, UploadReleaseResult } from '@ts-cloud/core';
+import { CloudFormationClient } from '../../aws/cloudformation';
+import { EC2Client } from '../../aws/ec2';
 export interface AwsDriverOptions {
     region?: string;
+    /**
+     * Build the EC2 client for a region. Defaults to a real client; tests supply
+     * a fake so the driver's decisions can be exercised without AWS.
+     */
+    ec2Client?: (region: string) => EC2Client;
+    /** Build the CloudFormation client for a region. Same purpose as {@link ec2Client}. */
+    cfnClient?: (region: string) => CloudFormationClient;
 }
 /**
  * Local-state pin (parity with the Hetzner driver's shared-box support): a
@@ -14,6 +23,8 @@ export declare class AwsDriver implements CloudDriver {
     readonly name: 'aws';
     readonly usesCloudFormation = true;
     private region;
+    private readonly ec2Client;
+    private readonly cfnClient;
     constructor(options?: AwsDriverOptions);
     private resolveRegion;
     /**
@@ -27,7 +38,14 @@ export declare class AwsDriver implements CloudDriver {
      * `compute.server.iamInstanceProfile` (live-verified step).
      */
     provisionComputeInfrastructure(options: ProvisionComputeOptions): Promise<ComputeStackOutputs>;
-    /** Terminate the lightweight EC2 box + delete its security group. */
+    /**
+     * Terminate the lightweight EC2 box and delete the security group ts-cloud
+     * created for it.
+     *
+     * Only this project's own resources are removed: the group must sit in the
+     * VPC the instances ran in, and must not be tagged for another project. A
+     * group ts-cloud found rather than created is left where it is.
+     */
     destroyCompute(options: ProvisionComputeOptions): Promise<{
         destroyed: string[];
     }>;

package/dist/drivers/aws/provision.d.ts

@@ -39,3 +39,49 @@ export declare function encodeUserData(userData: string): string;
  * or `null` to signal "resolve Ubuntu via SSM".
  */
 export declare function resolveAwsImageId(config: CloudConfig): string | null;
+/** The security group name ts-cloud gives a project's app box. */
+export declare function awsSecurityGroupName(slug: string, environment: string): string;
+/**
+ * Tags ts-cloud puts on every AWS resource it creates for a project — the same
+ * vocabulary the instances are tagged with, so teardown can tell what it owns
+ * from what it merely found.
+ */
+export declare function awsResourceTags(slug: string, environment: string, role?: string): {
+    Key: string;
+    Value: string;
+}[];
+/** Whether a resource's tags mark it as belonging to this project and environment. */
+export declare function matchesAwsProjectTags(tags: {
+    Key?: string;
+    Value?: string;
+}[] | undefined, slug: string, environment: string): boolean;
+/** A security group as teardown needs to judge it. */
+export interface AwsSecurityGroupCandidate {
+    GroupId?: string;
+    GroupName?: string;
+    VpcId?: string;
+    Tags?: {
+        Key?: string;
+        Value?: string;
+    }[];
+}
+export interface SelectSecurityGroupOptions {
+    slug: string;
+    environment: string;
+    /** VPC the project's instances were in, when it could still be read. */
+    vpcId?: string;
+}
+/**
+ * Pick the security group teardown should delete: the one provisioning would
+ * have reused.
+ *
+ * Provisioning scopes its lookup to a VPC, because a same-named group in
+ * another VPC belongs to something else — teardown has to be at least as
+ * careful, or it deletes another VPC's group (or fails forever against one
+ * still in use, reporting nothing).
+ *
+ * A group tagged for a different project or environment is never a candidate.
+ * Groups created before ts-cloud tagged them carry no tags at all; those are
+ * still deleted, but only when the VPC pins them to this project's box.
+ */
+export declare function selectProjectSecurityGroup(groups: AwsSecurityGroupCandidate[], options: SelectSecurityGroupOptions): AwsSecurityGroupCandidate | undefined;

package/dist/drivers/hetzner/client.d.ts

@@ -292,6 +292,11 @@ export declare class HetznerClient {
     }>): Promise<HetznerAction[]>;
     listSshKeys(): Promise<HetznerSshKey[]>;
     createSshKey(options: CreateSshKeyOptions): Promise<HetznerSshKey>;
+    /**
+     * Delete an SSH key. Running servers are unaffected — the key is only read
+     * when a server is created, and lives in the box's authorized_keys after.
+     */
+    deleteSshKey(id: number): Promise<void>;
     getAction(actionId: number): Promise<HetznerAction>;
     shutdownServer(serverId: number): Promise<HetznerAction>;
     powerOnServer(serverId: number): Promise<HetznerAction>;

package/dist/drivers/hetzner/driver.d.ts

@@ -81,8 +81,12 @@ export declare class HetznerDriver implements CloudDriver {
     private provisionBunFleet;
     /**
      * Tear down the compute — single server or full fleet (load balancer, all
-     * app + services servers, firewalls, and the private network) — and clear
-     * local state.
+     * app + services servers, firewalls, the private network, and the SSH key
+     * this project created) — and clear local state.
+     *
+     * Only resources ts-cloud created for this project and environment are
+     * removed; anything it merely reused (an SSH key already on the account, say)
+     * is left where it is.
      */
     destroyCompute(options: ProvisionComputeOptions): Promise<{
         destroyed: string[];

package/dist/drivers/hetzner/instance-sizes.d.ts

@@ -8,3 +8,13 @@ export declare function resolveHetznerServerType(size?: string): string;
 export declare const TS_CLOUD_LABEL_PREFIX = "ts-cloud";
 export declare function tsCloudLabels(slug: string, environment: string, role?: string): Record<string, string>;
 export declare function matchesTsCloudLabels(labels: Record<string, string> | undefined, slug: string, environment: string, role?: string): boolean;
+/**
+ * Whether a resource belongs to this project and environment, whatever role it
+ * plays. Use this for resources that are not per-role — an SSH key is created
+ * once and used by app, services, and load balancer boxes alike.
+ *
+ * A resource ts-cloud merely *reused* (an SSH key already on the account under
+ * someone else's name, say) carries no ts-cloud labels, so it never matches —
+ * which is what keeps teardown from deleting something it did not create.
+ */
+export declare function matchesTsCloudProject(labels: Record<string, string> | undefined, slug: string, environment: string): boolean;

package/dist/drivers/index.js

@@ -68,14 +68,14 @@ import {
   waitForSsh,
   wrapCloudInitUserData,
   writeResizeCheckpoint
-} from "../chunk-nm1d3a75.js";
+} from "../chunk-zcjc5y9f.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-rds0sy87.js";
 import"../chunk-zqtpg06c.js";
 import"../chunk-va2yd85b.js";
 import"../chunk-aa2dkn7b.js";
-import"../chunk-t2s3gdq6.js";
+import"../chunk-xes5vst2.js";
 import"../chunk-v0bahtg2.js";
 export {
   writeResizeCheckpoint,

package/dist/drivers/shared/deploy-script.d.ts

@@ -74,6 +74,13 @@ export interface BuildSiteDeployScriptOptions {
      * @default 5
      */
     healthGateSeconds?: number;
+    /**
+     * systemd `MemoryHigh` for the app unit. See {@link SiteConfig.memoryHigh}.
+     * @default '2G'
+     */
+    memoryHigh?: string;
+    /** systemd `MemoryMax` for the app unit. Unset by default. */
+    memoryMax?: string;
 }
 /**
  * Build the remote shell commands that install/refresh a server-app site on a

package/dist/drivers/shared/sftp-provision.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Run an SFTP server on a box.
+ *
+ * AWS deploys get Transfer Family, which is a managed service with no box to
+ * put anything on. Every other driver — Hetzner, local — provisions
+ * [ts-sftp](https://github.com/stacksjs/ts-sftp) as a systemd unit instead, so
+ * the same `infrastructure.sftp` config produces a working SFTP endpoint
+ * whichever provider is behind it.
+ *
+ * Storage is a directory on the server. Bucket-backed storage is an AWS-only
+ * option (see {@link assertSftpSupported}).
+ */
+import type { SftpConfig } from '@ts-cloud/core';
+/** Where the server's own files live on the box. */
+export declare const SFTP_CONFIG_DIR = "/etc/ts-sftp";
+/** Where ts-sftp itself is installed. */
+export declare const SFTP_INSTALL_DIR = "/opt/ts-sftp";
+/** Bun interpreter the service runs, copied out of /root when it lives there. */
+export declare const SFTP_BUN_BIN = "/usr/local/bin/ts-sftp-bun";
+/** Default port. 2222 rather than 22, which sshd already owns. */
+export declare const DEFAULT_SFTP_PORT = 2222;
+export interface SftpProvisionOptions {
+    slug: string;
+    sftp: SftpConfig;
+}
+/** The systemd unit name for a project's SFTP server. */
+export declare function sftpUnitName(slug: string): string;
+/** The port the box serves SFTP on. */
+export declare function sftpPort(sftp: SftpConfig): number;
+/** The directory served to users. */
+export declare function sftpRoot(options: SftpProvisionOptions): string;
+/**
+ * Check that an SFTP config can be delivered by the given provider, and explain
+ * the gap when it cannot. Bucket-backed storage needs S3 behind it, which only
+ * the AWS path provides.
+ */
+export declare function assertSftpSupported(sftp: SftpConfig, provider: string): void;
+/**
+ * Build the commands that install and run ts-sftp on the box. Idempotent: the
+ * host key is generated once and kept, so a redeploy does not change the
+ * fingerprint clients have pinned.
+ */
+export declare function buildSftpProvisionScript(options: SftpProvisionOptions): string[];
+/** Ports the SFTP server needs open, for the firewall builders. */
+export declare function sftpFirewallPorts(sftp: SftpConfig | undefined): number[];

package/dist/drivers/shared/sftp-provision.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/generators/infrastructure.d.ts

@@ -27,6 +27,16 @@ export declare class InfrastructureGenerator {
     private resolveApiOriginPort;
     private defaultComputeCachePathPatterns;
     private shouldRouteStorageBucketToCompute;
+    /** Physical name of the bucket generated for an `infrastructure.storage` entry. */
+    private storageBucketName;
+    /** Logical ID of the EFS file system generated for an `infrastructure.fileSystem` entry. */
+    private fileSystemLogicalId;
+    /**
+     * Resolve a `storageBucket`/`fileSystem` name reference in `sftp.storage` to the
+     * resource this stack generates for it. Returns undefined when the storage config
+     * already names a concrete backend, which the Sftp module handles on its own.
+     */
+    private resolveSftpStorage;
     private resolveComputeCachePathPatterns;
     private createComputeCacheBehavior;
     private appendComputeAppOrigin;

package/dist/index.js

@@ -208,7 +208,7 @@ import {
   verifyUpdateSignature,
   webhookEndpoint,
   zeroCapacity
-} from "./chunk-8xezrv4z.js";
+} from "./chunk-0cx84wm2.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -222,7 +222,7 @@ import {
 } from "./chunk-v0vpamnf.js";
 import {
   buildAndPushServerlessImage
-} from "./chunk-wmbep3b5.js";
+} from "./chunk-b801ga2t.js";
 import {
   ApplicationAutoScalingClient,
   BedrockClient,
@@ -341,7 +341,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-nm1d3a75.js";
+} from "./chunk-zcjc5y9f.js";
 import {
   EC2Client,
   SSMClient
@@ -514,7 +514,7 @@ import {
   zeroFill,
   zoneOffsetMs,
   zonedParts
-} from "./chunk-19bs955w.js";
+} from "./chunk-8ynjhsh3.js";
 import {
   DEFAULT_ATTACK_MODE_HOURS,
   MAX_CONTROL_HOURS,
@@ -978,7 +978,7 @@ import {
   withSecurity,
   withTimeout,
   xrayManager
-} from "./chunk-t2s3gdq6.js";
+} from "./chunk-xes5vst2.js";
 import {
   __require
 } from "./chunk-v0bahtg2.js";
@@ -1216,6 +1216,32 @@ class InfrastructureGenerator {
   shouldRouteStorageBucketToCompute(name, storageConfig) {
     return name === "public" || storageConfig.routeCompute === true;
   }
+  storageBucketName(slug, env, name) {
+    return this.mergedConfig.infrastructure?.storage?.[name]?.bucket ?? `${slug}-${env}-${name}`;
+  }
+  fileSystemLogicalId(slug, env, name) {
+    return generateLogicalId(generateResourceName({ slug: `${slug}-${name}`, environment: env, resourceType: "efs" }));
+  }
+  resolveSftpStorage(sftp, slug, env) {
+    const storage = sftp.storage;
+    if (storage?.type === "efs" && storage.fileSystem) {
+      if (!this.mergedConfig.infrastructure?.fileSystem?.[storage.fileSystem]) {
+        throw new Error(`sftp: storage.fileSystem "${storage.fileSystem}" is not defined in infrastructure.fileSystem`);
+      }
+      return {
+        type: "efs",
+        fileSystemId: { Ref: this.fileSystemLogicalId(slug, env, storage.fileSystem) },
+        posixProfile: storage.posixProfile
+      };
+    }
+    if (storage?.type === "s3" && storage.storageBucket) {
+      if (!this.mergedConfig.infrastructure?.storage?.[storage.storageBucket]) {
+        throw new Error(`sftp: storage.storageBucket "${storage.storageBucket}" is not defined in infrastructure.storage`);
+      }
+      return { type: "s3", bucket: this.storageBucketName(slug, env, storage.storageBucket) };
+    }
+    return;
+  }
   resolveComputeCachePathPatterns(routes) {
     if (routes && routes.length > 0) {
       return routes;
@@ -2216,7 +2242,7 @@ ${handles.join(`
       })).filter((bucket) => bucket.name !== "public" && bucket.config.website && bucket.mountPath);
       for (const [name, storageConfig] of Object.entries(this.mergedConfig.infrastructure.storage)) {
         const serveViaCloudFront = !!(storageConfig.website && sharedOacLogicalId);
-        const physicalBucketName = storageConfig.bucket ?? `${slug}-${env}-${name}`;
+        const physicalBucketName = this.storageBucketName(slug, env, name);
         const { bucket, logicalId } = Storage.createBucket({
           slug,
           name,
@@ -2501,8 +2527,10 @@ else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`
       }
     }
     if (this.mergedConfig.infrastructure?.sftp) {
+      const sftpConfig = this.mergedConfig.infrastructure.sftp;
       const result = Sftp.create({
-        ...this.mergedConfig.infrastructure.sftp,
+        ...sftpConfig,
+        storage: this.resolveSftpStorage(sftpConfig, slug, env) ?? sftpConfig.storage,
         slug,
         environment: env
       });
@@ -2516,6 +2544,10 @@ else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`
         Value: { "Fn::Sub": `\${${result.serverLogicalId}}.server.transfer.\${AWS::Region}.amazonaws.com` },
         Description: "AWS Transfer Family SFTP endpoint"
       });
+      this.builder.addOutput("SftpStorageDomain", {
+        Value: result.domain,
+        Description: "Storage backing the SFTP server (EFS or S3)"
+      });
     }
     if (hostedZoneId && websiteBucketDistributions.length > 0) {
       for (const { name, distLogicalId, aliases } of websiteBucketDistributions) {

package/dist/protection/index.js

@@ -44,7 +44,7 @@ import {
   parseChain,
   propagationHeaders,
   recursionBlockedResponse
-} from "../chunk-t2s3gdq6.js";
+} from "../chunk-xes5vst2.js";
 import"../chunk-v0bahtg2.js";
 export {
   wafEventTelemetry,

package/dist/spend/index.js

@@ -82,9 +82,9 @@ import {
   zeroFill,
   zoneOffsetMs,
   zonedParts
-} from "../chunk-19bs955w.js";
+} from "../chunk-8ynjhsh3.js";
 import"../chunk-aa2dkn7b.js";
-import"../chunk-t2s3gdq6.js";
+import"../chunk-xes5vst2.js";
 import"../chunk-v0bahtg2.js";
 export {
   zonedParts,