@stacksjs/ts-cloud 0.7.123 → 0.7.124

package/dist/bin/dashboard-server.js

@@ -6170,7 +6170,7 @@ writeFileSync(candidatePath, JSON.stringify(candidate, null, 2) + '\\n', { mode:
 `.trim();return[`__tsc_fragment_candidate="$(mktemp "${E}.candidate.XXXXXX")"`,`cat > "$__tsc_fragment_candidate" <<'${T}'`,_,T,'chmod 0600 "$__tsc_fragment_candidate"',`if [ -f ${E} ]; then TS_CLOUD_RPX_CURRENT_FRAGMENT=${E} TS_CLOUD_RPX_CANDIDATE_FRAGMENT="$__tsc_fragment_candidate" ${t.bunBin} -e ${B9(N)}; fi`,`mv -f "$__tsc_fragment_candidate" ${E}`,`chmod 0600 ${E}`]}function lW(E){return`rpx-cert-renew-${(E||"app").replace(/[^a-z0-9._-]+/gi,"-")}.service`}function iW(E){let _=new Set;for(let T of E.proxies){let t=T.to;if(!t||t.startsWith("*")||t.includes(":")||!t.includes("."))continue;_.add(t)}return[..._]}function W9(E){let{config:_,proxy:T}=E,t=_.acmeChallengeWebroot,N=iW(_);if(!T.onDemandTls||!t||N.length===0)return[];let d=E.bunBin??"/usr/local/bin/bun",R=T.version??"latest",L=_.productionCerts.certsDir,A=T.onDemandTlsEmail??`webmaster@${N[0]}`,S=`${d} ${RT}/node_modules/@stacksjs/tlsx/dist/bin/cli.js`,h=N.join(","),O=N.join(" "),r=(E.slug||"app").replace(/[^a-z0-9._-]+/gi,"-"),U=`${XS}/renew-certs-${r}.sh`,I=lW(r),X=`rpx-cert-renew-${r}.timer`,B=["#!/bin/sh","# Generated by ts-cloud — issue/renew rpx gateway TLS certs via tlsx http-01.","# The running gateway serves the challenge from $WEBROOT on :80, so this needs","# no downtime and no DNS credentials. Reloads the gateway only if a cert changed.","set -u",`CERTS='${L}'`,`WEBROOT='${t}'`,`EMAIL='${A}'`,`TLSX="${S}"`,`DOMAINS='${h}'`,"DNS_ATTEMPTS='24'","DNS_DELAY_SECONDS='5'","wait_for_dns() {",'  d="$1"',"  attempt=1",'  while ! getent ahosts "$d" >/dev/null 2>&1; do','    if [ "$attempt" -ge "$DNS_ATTEMPTS" ]; then','      echo "DNS for $d did not become resolvable after $DNS_ATTEMPTS attempts" >&2',"      return 1","    fi",'    echo "Waiting for public DNS before ACME: $d (attempt $attempt/$DNS_ATTEMPTS)"','    sleep "$DNS_DELAY_SECONDS"',"    attempt=$((attempt + 1))","  done","}",'before=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)',`for d in ${O}; do`,'  if [ ! -s "$CERTS/$d.crt" ]; then','    if wait_for_dns "$d"; then','      $TLSX acme:issue -d "$d" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --prod --email "$EMAIL" || echo "issue $d failed (non-fatal)"',"    else",'      echo "issue $d skipped until DNS resolves (non-fatal)"',"    fi","    # rpx reloads its SNI set when a PEM appears. Complete that reload","    # before the next hostname starts http-01, or :80 can disappear in","    # the middle of the following challenge on a multi-domain deploy.",`    [ -s "$CERTS/$d.crt" ] && systemctl restart ${cN}`,"  fi","done",'$TLSX acme:renew --domains "$DOMAINS" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --days 30 --prod --email "$EMAIL" || echo "renew: some domains failed (non-fatal)"','rm -f "$CERTS"/*.chain.crt','after=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)',`[ "$before" = "$after" ] || systemctl restart ${cN}`].join(`
 `),z=["[Unit]",`Description=Issue/renew rpx gateway TLS certs for ${r} (tlsx http-01)`,`After=network-online.target ${cN}`,"Wants=network-online.target","","[Service]","Type=oneshot",`ExecStart=${U}`].join(`
 `),P=["[Unit]",`Description=Daily rpx gateway TLS cert issuance/renewal for ${r}`,"","[Timer]","OnCalendar=*-*-* 03:30:00","RandomizedDelaySec=1h","Persistent=true","","[Install]","WantedBy=timers.target"].join(`
-`);return[`mkdir -p ${t}`,`(cd ${RT} && ${d} add @stacksjs/tlsx@${R}) || true`,...yR(U,B,"TS_CLOUD_RENEW_EOF"),`chmod +x ${U}`,...yR(`/etc/systemd/system/${I}`,z,"TS_CLOUD_RENEW_SVC_EOF"),...yR(`/etc/systemd/system/${X}`,P,"TS_CLOUD_RENEW_TIMER_EOF"),"systemctl daemon-reload",`systemctl enable --now ${X} || true`,`${U} || true`]}function Ud(E){let{config:_,proxy:T}=E,t=E.bunBin??"/usr/local/bin/bun",N=T.version??"latest",d=_.productionCerts.certsDir,R=(E.slug||"app").replace(/[^a-z0-9._-]+/gi,"-"),L=JSON.stringify({slug:R,..._},null,2),A=F9(Cd,d),h=[`Environment=RPX_UPSTREAM_TIMEOUT=${T.upstreamTimeout??60}`];if(typeof T.maxUpstreamConns==="number")h.push(`Environment=RPX_MAX_UPSTREAM_CONNS=${T.maxUpstreamConns}`);let O=T.memoryHigh??"512M",r=T.memoryMax??"768M";return["set -euo pipefail",`mkdir -p ${XS} ${Cd} ${d} ${RT}`,`rm -rf ${RT}.next ${RT}.prev`,`mkdir -p ${RT}.next`,`(cd ${RT}.next && ${t} add @stacksjs/rpx@${N})`,`mv ${RT} ${RT}.prev`,`mv ${RT}.next ${RT}`,`rm -rf ${RT}.prev`,`ln -sfn ${RT}/node_modules ${XS}/node_modules`,...nW(`${Cd}/${R}.json`,L,"TS_CLOUD_RPX_FRAGMENT_EOF",{bunBin:t,preserveManagementDashboardRoutes:E.preserveManagementDashboardRoutes}),...yR(zI,A,"TS_CLOUD_RPX_EOF"),`${t} build --production --compile --outfile ${cS}.next ${zI}`,`chmod 0755 ${cS}.next`,`mv -f ${cS}.next ${cS}`,...yR(`/etc/systemd/system/${cN}`,["[Unit]","Description=rpx reverse-proxy gateway (managed by ts-cloud)","After=network.target network-online.target","Wants=network-online.target","","[Service]","Type=simple",`ExecStart=${cS}`,`WorkingDirectory=${RT}`,"Environment=BUN_INSTALL=/root/.bun","Environment=APP_ENV=production","Environment=NODE_ENV=production",...h,"MemoryAccounting=true",`MemoryHigh=${O}`,`MemoryMax=${r}`,"OOMPolicy=stop","Restart=always","RestartSec=5","StartLimitIntervalSec=120","StartLimitBurst=5",`ExecStartPre=/bin/sh -c 'for p in 80 443; do fuser -k -n tcp "$p" 2>/dev/null || true; done; sleep 1'`,"LimitNOFILE=1048576","AmbientCapabilities=CAP_NET_BIND_SERVICE","","[Install]","WantedBy=multi-user.target"].join(`
+`);return[`mkdir -p ${t}`,`(cd ${RT} && ${d} add @stacksjs/tlsx@${R}) || true`,...yR(U,B,"TS_CLOUD_RENEW_EOF"),`chmod +x ${U}`,...yR(`/etc/systemd/system/${I}`,z,"TS_CLOUD_RENEW_SVC_EOF"),...yR(`/etc/systemd/system/${X}`,P,"TS_CLOUD_RENEW_TIMER_EOF"),"systemctl daemon-reload",`systemctl enable --now ${X} || true`,`${U} || true`]}function Ud(E){let{config:_,proxy:T}=E,t=E.bunBin??"/usr/local/bin/bun",N=T.version??"latest",d=_.productionCerts.certsDir,R=(E.slug||"app").replace(/[^a-z0-9._-]+/gi,"-"),L=JSON.stringify({slug:R,..._},null,2),A=F9(Cd,d),h=[`Environment=RPX_UPSTREAM_TIMEOUT=${T.upstreamTimeout??60}`];if(typeof T.maxUpstreamConns==="number")h.push(`Environment=RPX_MAX_UPSTREAM_CONNS=${T.maxUpstreamConns}`);let O=T.memoryHigh??"512M",r=T.memoryMax??"768M";return["set -euo pipefail",`mkdir -p ${XS} ${Cd} ${d} ${RT}`,`rm -rf ${RT}.next ${RT}.prev`,`mkdir -p ${RT}.next`,`(cd ${RT}.next && ${t} add @stacksjs/rpx@${N})`,`mv ${RT} ${RT}.prev`,`mv ${RT}.next ${RT}`,`rm -rf ${RT}.prev`,`ln -sfn ${RT}/node_modules ${XS}/node_modules`,...nW(`${Cd}/${R}.json`,L,"TS_CLOUD_RPX_FRAGMENT_EOF",{bunBin:t,preserveManagementDashboardRoutes:E.preserveManagementDashboardRoutes}),...yR(zI,A,"TS_CLOUD_RPX_EOF"),`${t} build --production --compile --outfile ${cS}.next ${zI}`,`chmod 0755 ${cS}.next`,`mv -f ${cS}.next ${cS}`,...yR(`/etc/systemd/system/${cN}`,["[Unit]","Description=rpx reverse-proxy gateway (managed by ts-cloud)","After=network.target network-online.target","Wants=network-online.target","","[Service]","Type=simple",`ExecStart=${cS}`,`WorkingDirectory=${RT}`,"Environment=BUN_INSTALL=/root/.bun","Environment=APP_ENV=production","Environment=NODE_ENV=production",...h,"MemoryAccounting=true",`MemoryHigh=${O}`,`MemoryMax=${r}`,"CPUWeight=500","IOWeight=500","OOMPolicy=stop","Restart=always","RestartSec=5","StartLimitIntervalSec=120","StartLimitBurst=5",`ExecStartPre=/bin/sh -c 'for p in 80 443; do fuser -k -n tcp "$p" 2>/dev/null || true; done; sleep 1'`,"LimitNOFILE=1048576","AmbientCapabilities=CAP_NET_BIND_SERVICE","","[Install]","WantedBy=multi-user.target"].join(`
 `),"TS_CLOUD_RPX_UNIT_EOF"),"systemctl daemon-reload","systemctl disable --now bun-gateway.service 2>/dev/null || true","systemctl disable --now bun-gateway-renew.timer bun-gateway-renew.service 2>/dev/null || true","rm -f /etc/systemd/system/bun-gateway-renew.timer /etc/systemd/system/bun-gateway-renew.service","systemctl disable --now ts-cloud-nginx.service 2>/dev/null || true",`for timer in /etc/systemd/system/rpx-cert-renew-*.timer; do [ -e "$timer" ] || continue; unit="$(basename "$timer")"; tenant="\${unit#rpx-cert-renew-}"; tenant="\${tenant%.timer}"; [ -f "${Cd}/$tenant.json" ] && continue; systemctl disable --now "$unit" 2>/dev/null || true; rm -f "$timer" "/etc/systemd/system/rpx-cert-renew-$tenant.service" "${XS}/renew-certs-$tenant.sh"; done`,`systemctl enable ${cN}`,`systemctl restart ${cN}`,...W9(E)]}function kO(E){let _=(E.slug||"app").replace(/[^a-z0-9._-]+/gi,"-"),T=JSON.stringify({slug:_,...E.config},null,2);return["set -euo pipefail",`mkdir -p ${Cd}`,...nW(`${Cd}/${_}.json`,T,"TS_CLOUD_RPX_FRAGMENT_EOF",{bunBin:"/usr/local/bin/bun",preserveManagementDashboardRoutes:E.preserveManagementDashboardRoutes}),`systemctl restart ${cN}`]}function xR(E=[],_={}){let T=_.path??"/root/.ssh/authorized_keys",N=[`mkdir -p ${T.replace(/\/[^/]*$/,"")}`,`touch ${T}`,`sed -i '/^${aW("# >>> ts-cloud managed keys >>>")}$/,/^${aW("# <<< ts-cloud managed keys <<<")}$/d' ${T}`];if(E.length>0){let d=["# >>> ts-cloud managed keys >>>",...E.map((R)=>`${R.publicKey.trim()} ${R.name}`),"# <<< ts-cloud managed keys <<<"].join(`
 `);N.push(`cat >> ${T} <<'TS_CLOUD_KEYS_EOF'`,d,"TS_CLOUD_KEYS_EOF",`chmod 600 ${T}`)}return N}function aW(E){return E.replace(/[.*[\]\\/^$]/g,"\\$&")}uL();jI();function oW(E,_){let T=`/tmp/ts-cloud-${E}.sh`,t=`TS_CLOUD_${E.toUpperCase().replace(/[^A-Z0-9]/g,"_")}_EOF`;return[`cat > ${T} <<'${t}'`,_.replace(/\n$/,""),t,`chmod +x ${T}`,`bash ${T} || echo "ts-cloud: ${E} setup did not complete; continuing" >&2`,`rm -f ${T}`]}function pW(E,_){if(E===!1)return;if(E===!0||E===void 0)return _;return E}var sW={enabled:!0,ports:[80,443]},H9={mode:"detection",paranoiaLevel:1};function e9(E=!0,_=[]){let T=pW(E,sW);if(!T||T.enabled===!1)return[];let t=[...new Set([...T.ports??sW.ports??[],..._])].sort((N,d)=>N-d);return oW("ddos",ir({...T,ports:t}))}function j9(E=!0){let _=pW(E,H9);if(!_||_.mode==="off")return[];return oW("waf",eI(_))}function Ez(E={},_=[]){return[...e9(E.ddos,_),...j9(E.waf)]}function P9(E){return`${E}-sftp`}function _z(E){return E.port??2222}function f9(E){let _=E.sftp.storage;if(_?.type==="efs"&&_.path)return _.path;return`/var/sftp/${E.slug}`}function qR(E){return`'${E.split("'").join("'\\''")}'`}function Tz(E,_){if(_==="aws")return;let T=E.storage;if(T?.type==="s3"||!T&&!!E.bucket)throw Error(`sftp: bucket-backed storage is only available on the aws provider (Transfer Family). On ${_}, use storage: { type: 'efs' } to serve a directory on the server.`);for(let[N,d]of Object.entries(E.users))if(!d.sshPublicKeys?.length)throw Error(`sftp: user ${N} needs at least one SSH public key`)}function tz(E){let{slug:_,sftp:T}=E,t=P9(_),N=f9(E),d=_z(T),R="/etc/ts-sftp/host_key",L="/etc/ts-sftp/users",A=T.serviceUser??"ts-sftp",S=[`# --- ts-sftp (${t}) ---`,`id -u ${A} >/dev/null 2>&1 || useradd --system --home-dir ${qR(N)} --shell /usr/sbin/nologin ${A}`,'export HOME="${HOME:-/root}"','command -v bun >/dev/null 2>&1 || (curl -fsSL https://bun.sh/install | bash && ln -sf "$HOME/.bun/bin/bun" /usr/local/bin/bun)',`mkdir -p ${qR(N)} /etc/ts-sftp /etc/ts-sftp/users /opt/ts-sftp`,"chmod 750 /etc/ts-sftp",`cd /opt/ts-sftp && [ -f package.json ] || printf '{"name":"ts-sftp-host","private":true}' > package.json`,`cd /opt/ts-sftp && bun add ts-sftp@${T.version??"latest"} --no-save --production || bun add ts-sftp@${T.version??"latest"}`,`[ -f /etc/ts-sftp/host_key ] || bun /opt/ts-sftp/node_modules/ts-sftp/dist/bin/cli.js keygen --out /etc/ts-sftp/host_key --comment ${qR(`${_}-sftp`)}`,"chmod 600 /etc/ts-sftp/host_key",'BUN_REAL=$(readlink -f "$(command -v bun)")','case "$BUN_REAL" in /root/*) install -m 0755 "$BUN_REAL" /usr/local/bin/ts-sftp-bun; BUN_BIN=/usr/local/bin/ts-sftp-bun;; *) BUN_BIN="$BUN_REAL";; esac'],h=[];for(let[O,r]of Object.entries(T.users)){let U=(r.homeDirectory??O).replace(/^\/+|\/+$/g,"");if(!U||U.split("/").includes(".."))throw Error(`sftp: invalid homeDirectory for user ${O}`);let I=`/etc/ts-sftp/users/${O}.pub`;S.push(`mkdir -p ${qR(`${N}/${U}`)}`,`printf '%s\\n' ${qR(r.sshPublicKeys.join(`
 `))} > ${I}`,`chmod 644 ${I}`),h.push(`--user ${O}:${I}`)}return S.push(`chown -R ${A}:${A} ${qR(N)} /etc/ts-sftp`,`cat > /etc/systemd/system/${t}.service <<TSCLOUD_SFTP_UNIT`,"[Unit]","Description=ts-sftp file transfer server","After=network.target","","[Service]",`User=${A}`,`ExecStart=$BUN_BIN /opt/ts-sftp/node_modules/ts-sftp/dist/bin/cli.js serve --root ${N} --host-key /etc/ts-sftp/host_key --port ${d}${T.readOnly?" --read-only":""} ${h.join(" ")}`,"Restart=always","RestartSec=2","NoNewPrivileges=true","PrivateTmp=true","ProtectSystem=strict",`ReadWritePaths=${N}`,"","[Install]","WantedBy=multi-user.target","TSCLOUD_SFTP_UNIT","systemctl daemon-reload",`systemctl enable ${t}.service`,`systemctl restart ${t}.service`),S}function Nz(E){return E?[_z(E)]:[]}var Y9=[80,443];function PI(E={}){if(E.enabled===!1)return[];let _=[...new Set([...Y9,...E.allowedPorts||[]])].filter((t)=>Number.isInteger(t)&&t>=1&&t<=65535).sort((t,N)=>t-N),T=["export DEBIAN_FRONTEND=noninteractive","command -v ufw >/dev/null 2>&1 || apt-get install -y ufw","ufw --force reset","ufw default deny incoming","ufw default allow outgoing","ufw allow OpenSSH"];for(let t of _)T.push(`ufw allow ${t}/tcp`);return T.push("ufw --force enable"),T}function FS(E){let _=E.infrastructure?.compute??{},T=_.runtime==="php"||!!_.php,t=T||!!_.managedServices,N=t?YR():[],d=!rd(_),R=T?[...N,...yO({versions:_.php?.versions,default:_.php?.default,extensions:_.php?.extensions,installNginx:d,optimizeForProduction:_.php?.optimizeForProduction,ini:_.php?.ini}),...d?vW():[]]:void 0,L=[],A=__(E);if(!T&&t)L.push(...N);if(L.push(...gR(E.notifications)),_.managedServices)L.push(...ZO(_.managedServices),...$S(A,_.managedServices));let S=E.infrastructure?.sftp;if(S)Tz(S,It(E)),L.push(...tz({slug:E.project.slug,sftp:S}));if(L.push(...PI(_.firewall??(T?{enabled:!0}:{enabled:!1}))),L.push(...Ez({ddos:_.ddos,waf:_.waf},_.firewall?.allowedPorts??[])),L.push(...hd(_.autoUpdates??T)),L.push(...Od(_.monitoring??T)),L.push(...xR(_.sshKeys)),_.backups?.enabled)L.push(...gO({database:A,backups:_.backups}));return{runtime:_.runtime||"bun",runtimeVersion:_.runtimeVersion||"latest",phpBox:T,phpProvision:R,servicesProvision:L.length>0?L:void 0}}function qT(E={}){let{runtime:_="bun",runtimeVersion:T="latest",systemPackages:t=[],database:N,phpProvision:d,servicesProvision:R,caddyfile:L,rpxProvision:A,baked:S=!1,swapGb:h=2}=E,O=new Set(t);if(N==="sqlite")O.add("sqlite3");else if(N==="mysql")O.add("mysql-client");else if(N==="postgres")O.add("postgresql-client");let r=`#!/bin/bash

package/dist/{chunk-xes5vst2.js → chunk-050r7ycy.js}

@@ -22050,6 +22050,9 @@ function resolveManagementDashboardSites(config, environment, opts) {
       preStart: ["bun install --production --no-save"],
       start: `bun ${DASHBOARD_ENTRY} --box --host 127.0.0.1 --port ${port}`,
       port,
+      cpuWeight: 10,
+      ioWeight: 10,
+      tasksMax: 128,
       env: {
         APP_ENV: "production",
         NODE_ENV: "production",

package/dist/{chunk-8ynjhsh3.js → chunk-29rse4p1.js}

@@ -4,7 +4,7 @@ import {
 import {
   resolveStatePath,
   statePath
-} from "./chunk-xes5vst2.js";
+} from "./chunk-050r7ycy.js";
 
 // src/spend/model.ts
 var METER_KEYS = [

package/dist/{chunk-gtrecc8b.js → chunk-4q7jx76n.js}

@@ -25,7 +25,7 @@ import {
   resolveProjectStackName,
   resolveStatePath,
   statePath
-} from "./chunk-xes5vst2.js";
+} from "./chunk-050r7ycy.js";
 import {
   __require
 } from "./chunk-v0bahtg2.js";
@@ -1961,6 +1961,8 @@ function buildRpxProvisionScript(options) {
       "MemoryAccounting=true",
       `MemoryHigh=${memoryHigh}`,
       `MemoryMax=${memoryMax}`,
+      "CPUWeight=500",
+      "IOWeight=500",
       "OOMPolicy=stop",
       "Restart=always",
       "RestartSec=5",
@@ -5654,8 +5656,16 @@ function buildSiteDeployScript(options) {
     healthCheckPath,
     healthGateSeconds = 5,
     memoryHigh = "2G",
-    memoryMax
+    memoryMax,
+    cpuWeight,
+    ioWeight,
+    tasksMax
   } = options;
+  const qosDirectives = [
+    ...cpuWeight != null ? [`CPUWeight=${cpuWeight}`] : [],
+    ...ioWeight != null ? [`IOWeight=${ioWeight}`] : [],
+    ...tasksMax != null ? [`TasksMax=${tasksMax}`] : []
+  ];
   const zeroDowntime = options.zeroDowntime ?? port != null;
   const base = options.appDir ?? `/var/www/${siteName}`;
   const paths = releasePaths(base, releaseId);
@@ -5704,6 +5714,7 @@ function buildSiteDeployScript(options) {
       "MemoryAccounting=true",
       ...memoryHigh ? [`MemoryHigh=${memoryHigh}`] : [],
       ...memoryMax ? [`MemoryMax=${memoryMax}`] : [],
+      ...qosDirectives,
       `EnvironmentFile=${paths.releases}/%i/.env`,
       `Environment=PORT=${port}`,
       "",
@@ -5744,6 +5755,7 @@ function buildSiteDeployScript(options) {
     "MemoryAccounting=true",
     ...memoryHigh ? [`MemoryHigh=${memoryHigh}`] : [],
     ...memoryMax ? [`MemoryMax=${memoryMax}`] : [],
+    ...qosDirectives,
     `EnvironmentFile=${paths.current}/.env`,
     ...port ? [`Environment=PORT=${port}`] : [],
     "",
@@ -6694,7 +6706,10 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
     zeroDowntime: site.zeroDowntime !== false,
     healthCheckPath: site.healthCheck?.path,
     memoryHigh: site.memoryHigh,
-    memoryMax: site.memoryMax
+    memoryMax: site.memoryMax,
+    cpuWeight: site.cpuWeight,
+    ioWeight: site.ioWeight,
+    tasksMax: site.tasksMax
   });
   const wantsNginxStatic = kind === "server-static" && !usesRpxProxy(compute) && !!site.domain;
   const staticVhost = wantsNginxStatic ? buildNginxVhostScript({

package/dist/{chunk-b801ga2t.js → chunk-fgk8cqew.js}

@@ -8,7 +8,7 @@ import {
   phpRuntimeLayerAssets,
   runPhpBuildHooks,
   sha256
-} from "./chunk-xes5vst2.js";
+} from "./chunk-050r7ycy.js";
 
 // src/deploy/serverless-image.ts
 import { execFileSync } from "node:child_process";

package/dist/{chunk-w2zd56qm.js → chunk-k2yyatfw.js}

@@ -1,9 +1,9 @@
 import {
   buildAndPushServerlessImage
-} from "./chunk-b801ga2t.js";
+} from "./chunk-fgk8cqew.js";
 import"./chunk-50jpda9q.js";
 import"./chunk-zqtpg06c.js";
-import"./chunk-xes5vst2.js";
+import"./chunk-050r7ycy.js";
 import"./chunk-v0bahtg2.js";
 export {
   buildAndPushServerlessImage

package/dist/{chunk-48czwsvj.js → chunk-vn6g8f60.js}

@@ -9,7 +9,7 @@ import {
   step,
   success,
   warn
-} from "./chunk-b801ga2t.js";
+} from "./chunk-fgk8cqew.js";
 import {
   AwsBackupClient,
   CloudWatchLogsClient,
@@ -50,7 +50,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-gtrecc8b.js";
+} from "./chunk-4q7jx76n.js";
 import {
   SSMClient
 } from "./chunk-7m60qnc8.js";
@@ -104,7 +104,7 @@ import {
   spendOpenApiPaths,
   telemetryCursor,
   telemetryEstimatedMonthlyCost
-} from "./chunk-8ynjhsh3.js";
+} from "./chunk-29rse4p1.js";
 import {
   artifactKey,
   buildCloudFormationTemplate,
@@ -126,7 +126,7 @@ import {
   resolveStatePath,
   setStateDir,
   statePath
-} from "./chunk-xes5vst2.js";
+} from "./chunk-050r7ycy.js";
 import {
   __require
 } from "./chunk-v0bahtg2.js";
@@ -1729,7 +1729,7 @@ async function deployServerlessApp(config, environment, opts = {}) {
   }
   if (imageMode) {
     step("Building + pushing container image");
-    const { buildAndPushServerlessImage } = await import("./chunk-w2zd56qm.js");
+    const { buildAndPushServerlessImage } = await import("./chunk-k2yyatfw.js");
     const built = await buildAndPushServerlessImage({
       app,
       projectRoot,

package/dist/deploy/index.js

@@ -36,7 +36,7 @@ import {
   synchronizeDashboardUsers,
   trackDashboardOperation,
   verifyStaticApiOrigin
-} from "../chunk-48czwsvj.js";
+} from "../chunk-vn6g8f60.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -50,7 +50,7 @@ import {
 } from "../chunk-v0vpamnf.js";
 import {
   buildAndPushServerlessImage
-} from "../chunk-b801ga2t.js";
+} from "../chunk-fgk8cqew.js";
 import"../chunk-6a1t7fnq.js";
 import"../chunk-nsgqsmrh.js";
 import"../chunk-01d86gt1.js";
@@ -83,15 +83,15 @@ import {
   siteInstallBase,
   validateDeploymentConfig,
   verifyAddressRecord
-} from "../chunk-gtrecc8b.js";
+} from "../chunk-4q7jx76n.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-rds0sy87.js";
 import"../chunk-zqtpg06c.js";
-import"../chunk-8ynjhsh3.js";
+import"../chunk-29rse4p1.js";
 import"../chunk-va2yd85b.js";
 import"../chunk-aa2dkn7b.js";
-import"../chunk-xes5vst2.js";
+import"../chunk-050r7ycy.js";
 import"../chunk-v0bahtg2.js";
 export {
   verifyStaticApiOrigin,

package/dist/drivers/index.js

@@ -68,14 +68,14 @@ import {
   waitForSsh,
   wrapCloudInitUserData,
   writeResizeCheckpoint
-} from "../chunk-gtrecc8b.js";
+} from "../chunk-4q7jx76n.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-rds0sy87.js";
 import"../chunk-zqtpg06c.js";
 import"../chunk-va2yd85b.js";
 import"../chunk-aa2dkn7b.js";
-import"../chunk-xes5vst2.js";
+import"../chunk-050r7ycy.js";
 import"../chunk-v0bahtg2.js";
 export {
   writeResizeCheckpoint,

package/dist/drivers/shared/deploy-script.d.ts

@@ -81,6 +81,24 @@ export interface BuildSiteDeployScriptOptions {
     memoryHigh?: string;
     /** systemd `MemoryMax` for the app unit. Unset by default. */
     memoryMax?: string;
+    /**
+     * systemd `CPUWeight` for the unit — relative CPU share under contention.
+     *
+     * Everything on a shared box competes for the same eight cores, and not
+     * everything on it matters equally: the gateway every tenant is served
+     * through should outrank a batch scanner, and a monitoring dashboard should
+     * outrank neither. Left unset the kernel gives every unit the same weight,
+     * so a background job saturating the CPU degrades the serving path just as
+     * much as it degrades itself.
+     *
+     * Unset by default: a box with one workload has nothing to prioritise, and
+     * inventing a hierarchy where none was asked for is its own surprise.
+     */
+    cpuWeight?: number;
+    /** systemd `IOWeight` — the same idea for disk bandwidth. Unset by default. */
+    ioWeight?: number;
+    /** systemd `TasksMax` — cap on threads/processes. Unset by default. */
+    tasksMax?: number;
 }
 /**
  * Build the remote shell commands that install/refresh a server-app site on a

package/dist/index.js

@@ -208,7 +208,7 @@ import {
   verifyUpdateSignature,
   webhookEndpoint,
   zeroCapacity
-} from "./chunk-48czwsvj.js";
+} from "./chunk-vn6g8f60.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -222,7 +222,7 @@ import {
 } from "./chunk-v0vpamnf.js";
 import {
   buildAndPushServerlessImage
-} from "./chunk-b801ga2t.js";
+} from "./chunk-fgk8cqew.js";
 import {
   ApplicationAutoScalingClient,
   BedrockClient,
@@ -341,7 +341,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-gtrecc8b.js";
+} from "./chunk-4q7jx76n.js";
 import {
   EC2Client,
   SSMClient
@@ -514,7 +514,7 @@ import {
   zeroFill,
   zoneOffsetMs,
   zonedParts
-} from "./chunk-8ynjhsh3.js";
+} from "./chunk-29rse4p1.js";
 import {
   DEFAULT_ATTACK_MODE_HOURS,
   MAX_CONTROL_HOURS,
@@ -978,7 +978,7 @@ import {
   withSecurity,
   withTimeout,
   xrayManager
-} from "./chunk-xes5vst2.js";
+} from "./chunk-050r7ycy.js";
 import {
   __require
 } from "./chunk-v0bahtg2.js";

package/dist/protection/index.js

@@ -44,7 +44,7 @@ import {
   parseChain,
   propagationHeaders,
   recursionBlockedResponse
-} from "../chunk-xes5vst2.js";
+} from "../chunk-050r7ycy.js";
 import"../chunk-v0bahtg2.js";
 export {
   wafEventTelemetry,

package/dist/spend/index.js

@@ -82,9 +82,9 @@ import {
   zeroFill,
   zoneOffsetMs,
   zonedParts
-} from "../chunk-8ynjhsh3.js";
+} from "../chunk-29rse4p1.js";
 import"../chunk-aa2dkn7b.js";
-import"../chunk-xes5vst2.js";
+import"../chunk-050r7ycy.js";
 import"../chunk-v0bahtg2.js";
 export {
   zonedParts,