@stacksjs/ts-cloud 0.7.13 → 0.7.15

package/dist/{chunk-9ra8b9b4.js → chunk-296n8hvt.js}

@@ -1,8 +1,8 @@
 import {
   buildAndPushServerlessImage
-} from "./chunk-m03vddvr.js";
+} from "./chunk-qgnyzfmx.js";
 import"./chunk-hsk6fe6x.js";
-import"./chunk-vsgkcpqw.js";
+import"./chunk-49nmy775.js";
 import"./chunk-arsh1g5h.js";
 import"./chunk-v0bahtg2.js";
 export {

package/dist/{chunk-vsgkcpqw.js → chunk-49nmy775.js}

@@ -21948,13 +21948,11 @@ function hasManagementDashboardSite(config) {
     if (!site)
       return false;
     const root = site.root ?? "";
-    return name === "dashboard" || root === "ui/dist" || root.endsWith("/ui/dist") || root.endsWith("/dist/ui");
+    return isManagementDashboardSiteName(name) || root === "ui/dist" || root.endsWith("/ui/dist") || root.endsWith("/dist/ui");
   });
 }
 var MANAGEMENT_DASHBOARD_SITE_PREFIX = "dashboard-";
-function dashboardSiteName(domain, primary) {
-  if (primary)
-    return "dashboard";
+function managementDashboardSiteName(domain) {
   return MANAGEMENT_DASHBOARD_SITE_PREFIX + domain.replace(/^dashboard\./, "").replace(/\./g, "-");
 }
 function isManagementDashboardSiteName(name) {
@@ -21980,11 +21978,11 @@ function resolveManagementDashboardSites(config, environment, opts) {
       ...build,
       ...auth2
     };
-    return [{ name: "dashboard", site }];
+    return [{ name: managementDashboardSiteName(domain), site }];
   }
   const domains = resolveDashboardDomains(config, environment, opts.domain);
-  return domains.map((domain, i) => ({
-    name: dashboardSiteName(domain, i === 0),
+  return domains.map((domain) => ({
+    name: managementDashboardSiteName(domain),
     site: {
       root: opts.uiRoot,
       deploy: "server",
@@ -46154,4 +46152,4 @@ class ResourceManagementManager {
 }
 var resourceManagementManager = new ResourceManagementManager;
 
-export { detectServiceRegion, signRequest, signRequestAsync, createPresignedUrl, createPresignedUrlAsync, makeAWSRequest, makeAWSRequestOnce, makeAWSRequestAsync, parseXMLResponse, parseJSONResponse, clearSigningKeyCache, getSigningKeyCacheSize, isNodeCryptoAvailable, isWebCryptoAvailable, QueuePresets, RealtimePresets, detectDeploymentTargets, resolveDeploymentMode, deploymentCoexistenceError, resolveCloudProvider, TemplateBuilder, Pseudo, generateResourceName, generateLogicalId, getTimestamp, sanitizeName, resolveProjectStackName, resolveSiteStackName, resolveSiteResourceName, resolveSiteBucketName, resolveStorageBucketName, resolveDeployBucketName, resolveServerlessAppStackName, resolveServerlessArtifactBucketName, resolveServerlessAssetBucketName, DependencyGraph, analyzeStackDiff, formatDiff, Storage, Registry, CDN, DNS, Security, Compute, Network, FileSystem, Email, exports_incoming_call, Phone, Queue, JobLoader, StacksIntegration, exports_send, SMS, AI, Database, Cache, Permissions, ApiGateway, Messaging, Workflow, Monitoring, Auth, Deployment, AssetHasher, Secrets, ParameterStore, Search, Redirects, Communication, Fn2, Arn, AWS_PSEUDO_PARAMETERS, CloudFormationBuilder, buildCloudFormationTemplate, createStaticSitePreset, createNodeJsServerPreset, createNodeJsServerlessPreset, createServerlessNodePreset, createFullStackAppPreset, createApiBackendPreset, createWordPressPreset, createJamstackPreset, createMicroservicesPreset, createRealtimeAppPreset, createDataPipelinePreset, createMLApiPreset, createTraditionalWebAppPreset, createLaravelPreset, createServerlessLaravelPreset, createDashboardSite, resolveDashboardDomain, resolveDashboardDomains, hasManagementDashboardSite, MANAGEMENT_DASHBOARD_SITE_PREFIX, isManagementDashboardSiteName, resolveManagementDashboardSites, resolveManagementDashboardSite, extendPreset, composePresets, createPreset, mergeInfrastructure, withMonitoring, withSecurity, withDatabase, withCache, withCDN, withQueue, fromEnvironment, fromSharedCredentials, fromEC2Metadata, fromECSMetadata, fromWebIdentity, getCredentials, createCredentialProvider, resolveCredentials, resolveRegion, getAccountId, S3Error, createS3Client, CloudError, ConfigurationError, CredentialError, DeploymentError, ValidationError, AWSAPIError, ErrorCodes, getErrorDetails, createError, DebugLogger, validateConfiguration, detectMisconfigurations, validateCredentials, checkIAMPermissions, getRequiredPermissions, suggestIAMPolicy, DEFAULT_SERVICE_LIMITS, checkServiceQuotas, getQuotaUsageSummary, suggestQuotaIncrease, FileCache, TemplateCache, templateCache, hashFile, hashString, hashBuffer, hashDirectory, hashManifest, quickHash, findChangedFiles, HashCache, parallel, batch, parallelMap, parallelWithRetry, sequence, withTimeout, RateLimiter, chunk, processInChunks, diffTemplates, getDiffSummary, requiresReplacement, categorizeChanges, getDeploymentStrategy, getDiffStats, cloud_config_schema_default, validateAgainstSchema, defaultLocalConfig, getLocalConfig, isLocalDevelopment, getLocalEndpoint, getLocalCredentials, getLocalEnvVars, MockCloudFormation, MockS3, MockDynamoDB, createMockAWS, PreviewEnvironmentManager, previewManager, generatePreviewWorkflow, generateCleanupWorkflow, generateCostReportWorkflow, PreviewNotificationService, previewNotifications, formatTable, formatTree, formatProgressBar, formatBytes, formatDuration, formatList, formatKeyValue, ProgressBar, MultiStepProgress, Spinner, TaskList, suggestCommand, formatSuggestion, isLikelyTypo, getContextualHelp, searchCommands, autocomplete, suggestFlags, formatFlagSuggestions, getCommandUsage, validateCommand, REPL, REPLContext, REPLCommandBuilder, CommandHistory, formatHistory, formatHistoryStats, MultiRegionManager, multiRegionManager, CrossRegionReferenceManager, GlobalResourceManager, RegionPairManager, StackDependencyManager, crossRegionReferenceManager, globalResourceManager, regionPairManager, stackDependencyManager, AWS_REGIONS, getRegion, getAllRegions, getRegionsByLocation, getRegionsByCompliance, getRegionsByPricingTier, isValidRegion, getClosestRegion, suggestRegions, suggestRegionPairs, formatRegion, formatRegionList, getRegionStats, MultiAccountManager, OrganizationManager, multiAccountManager, organizationManager, RECOMMENDED_ACCOUNT_STRUCTURES, RECOMMENDED_SCPS, COMMON_CROSS_ACCOUNT_ROLES, getRecommendedStructure, generateCrossAccountRoleCF, validateAccountStructure, formatAccountStructure, generateDeploymentWorkflow, generateMultiEnvWorkflow, generatePRPreviewWorkflow, generateScheduledWorkflow, generateMatrixWorkflow, generateDeploymentPipeline, generateMultiEnvPipeline, generatePreviewPipeline, generateScheduledPipeline, generateManualPipeline, generateDeploymentConfig, generateMultiEnvConfig, generateScheduledConfig, generateApprovalConfig, generateParallelConfig, BackupManager, backupManager, DisasterRecoveryManager, drManager, AWSConfigManager, awsConfigManager, CloudTrailManager, cloudTrailManager, GuardDutyManager, guardDutyManager, SecurityHubManager, securityHubManager, BlueGreenManager, blueGreenManager, CanaryManager, canaryManager, ABTestManager, abTestManager, ProgressiveDeploymentManager, progressiveDeploymentManager, XRayManager, xrayManager, MetricsManager, metricsManager, LogsManager, logsManager, SyntheticsManager, syntheticsManager, MigrationManager, migrationManager, ReplicaManager, replicaManager, PerformanceManager, performanceManager, DatabaseUserManager, databaseUserManager, SecretsRotationManager, secretsRotationManager, SecretsManager, secretsManager, CertificateManager, certificateManager, SecurityScanningManager, securityScanningManager, ImageScanningManager, imageScanningManager, BuildOptimizationManager, buildOptimizationManager, ContainerRegistryManager, containerRegistryManager, ServiceMeshManager, serviceMeshManager, LambdaLayersManager, lambdaLayersManager, LambdaVersionsManager, lambdaVersionsManager, LambdaConcurrencyManager, lambdaConcurrencyManager, LambdaDestinationsManager, lambdaDestinationsManager, LambdaVPCManager, lambdaVPCManager, LambdaDLQManager, lambdaDLQManager, Route53RoutingManager, route53RoutingManager, DNSSECManager, dnssecManager, Route53ResolverManager, route53ResolverManager, BounceComplaintHandler, bounceComplaintHandler, EmailAnalyticsManager, emailAnalyticsManager, SenderReputationManager, senderReputationManager, EmailTemplateManager, emailTemplateManager, exports_advanced, exports_inbound, exports_advanced2, exports_advanced3, FIFOQueueManager, fifoQueueManager, DLQMonitoringManager, dlqMonitoringManager, BatchProcessingManager, batchProcessingManager, QueueManagementManager, queueManagementManager, createZip, generateBootstrap, runBuildHooks, sha256, artifactKey, packageServerlessApp, MANAGED_NODE_VERSIONS, resolveServerlessRuntime, resolveQueues, resolveQueueNames, composeServerlessAppTemplate, PHP_LAYER_EXTENSIONS, phpLayerPackages, phpLayerBuildStage, generatePhpLayerDockerfile, generateAppImageDockerfile, sharedRuntimeLoop, buildNodeRuntimeLayerZip, buildBunRuntimeLayerZip, resolveApp, eventToRequest, responseToResult, createHttpHandler, createQueueHandler, createCliHandler, createHandlers, generatePhpFpmConfig, phpRuntimeLayerAssets, laravelServerlessEnvDefaults, LARAVEL_SERVERLESS_BUILD_STEPS, buildPhpRuntimeLayerZip, PHP_DEFAULT_EXCLUDES, runPhpBuildHooks, collectPhpAppEntries, packagePhpApp, StaticSiteManager, staticSiteManager, StorageAdvancedManager, storageAdvancedManager, HealthCheckManager, healthCheckManager, NetworkSecurityManager, networkSecurityManager, ResourceManagementManager, resourceManagementManager };
+export { detectServiceRegion, signRequest, signRequestAsync, createPresignedUrl, createPresignedUrlAsync, makeAWSRequest, makeAWSRequestOnce, makeAWSRequestAsync, parseXMLResponse, parseJSONResponse, clearSigningKeyCache, getSigningKeyCacheSize, isNodeCryptoAvailable, isWebCryptoAvailable, QueuePresets, RealtimePresets, detectDeploymentTargets, resolveDeploymentMode, deploymentCoexistenceError, resolveCloudProvider, TemplateBuilder, Pseudo, generateResourceName, generateLogicalId, getTimestamp, sanitizeName, resolveProjectStackName, resolveSiteStackName, resolveSiteResourceName, resolveSiteBucketName, resolveStorageBucketName, resolveDeployBucketName, resolveServerlessAppStackName, resolveServerlessArtifactBucketName, resolveServerlessAssetBucketName, DependencyGraph, analyzeStackDiff, formatDiff, Storage, Registry, CDN, DNS, Security, Compute, Network, FileSystem, Email, exports_incoming_call, Phone, Queue, JobLoader, StacksIntegration, exports_send, SMS, AI, Database, Cache, Permissions, ApiGateway, Messaging, Workflow, Monitoring, Auth, Deployment, AssetHasher, Secrets, ParameterStore, Search, Redirects, Communication, Fn2, Arn, AWS_PSEUDO_PARAMETERS, CloudFormationBuilder, buildCloudFormationTemplate, createStaticSitePreset, createNodeJsServerPreset, createNodeJsServerlessPreset, createServerlessNodePreset, createFullStackAppPreset, createApiBackendPreset, createWordPressPreset, createJamstackPreset, createMicroservicesPreset, createRealtimeAppPreset, createDataPipelinePreset, createMLApiPreset, createTraditionalWebAppPreset, createLaravelPreset, createServerlessLaravelPreset, createDashboardSite, resolveDashboardDomain, resolveDashboardDomains, hasManagementDashboardSite, MANAGEMENT_DASHBOARD_SITE_PREFIX, managementDashboardSiteName, isManagementDashboardSiteName, resolveManagementDashboardSites, resolveManagementDashboardSite, extendPreset, composePresets, createPreset, mergeInfrastructure, withMonitoring, withSecurity, withDatabase, withCache, withCDN, withQueue, fromEnvironment, fromSharedCredentials, fromEC2Metadata, fromECSMetadata, fromWebIdentity, getCredentials, createCredentialProvider, resolveCredentials, resolveRegion, getAccountId, S3Error, createS3Client, CloudError, ConfigurationError, CredentialError, DeploymentError, ValidationError, AWSAPIError, ErrorCodes, getErrorDetails, createError, DebugLogger, validateConfiguration, detectMisconfigurations, validateCredentials, checkIAMPermissions, getRequiredPermissions, suggestIAMPolicy, DEFAULT_SERVICE_LIMITS, checkServiceQuotas, getQuotaUsageSummary, suggestQuotaIncrease, FileCache, TemplateCache, templateCache, hashFile, hashString, hashBuffer, hashDirectory, hashManifest, quickHash, findChangedFiles, HashCache, parallel, batch, parallelMap, parallelWithRetry, sequence, withTimeout, RateLimiter, chunk, processInChunks, diffTemplates, getDiffSummary, requiresReplacement, categorizeChanges, getDeploymentStrategy, getDiffStats, cloud_config_schema_default, validateAgainstSchema, defaultLocalConfig, getLocalConfig, isLocalDevelopment, getLocalEndpoint, getLocalCredentials, getLocalEnvVars, MockCloudFormation, MockS3, MockDynamoDB, createMockAWS, PreviewEnvironmentManager, previewManager, generatePreviewWorkflow, generateCleanupWorkflow, generateCostReportWorkflow, PreviewNotificationService, previewNotifications, formatTable, formatTree, formatProgressBar, formatBytes, formatDuration, formatList, formatKeyValue, ProgressBar, MultiStepProgress, Spinner, TaskList, suggestCommand, formatSuggestion, isLikelyTypo, getContextualHelp, searchCommands, autocomplete, suggestFlags, formatFlagSuggestions, getCommandUsage, validateCommand, REPL, REPLContext, REPLCommandBuilder, CommandHistory, formatHistory, formatHistoryStats, MultiRegionManager, multiRegionManager, CrossRegionReferenceManager, GlobalResourceManager, RegionPairManager, StackDependencyManager, crossRegionReferenceManager, globalResourceManager, regionPairManager, stackDependencyManager, AWS_REGIONS, getRegion, getAllRegions, getRegionsByLocation, getRegionsByCompliance, getRegionsByPricingTier, isValidRegion, getClosestRegion, suggestRegions, suggestRegionPairs, formatRegion, formatRegionList, getRegionStats, MultiAccountManager, OrganizationManager, multiAccountManager, organizationManager, RECOMMENDED_ACCOUNT_STRUCTURES, RECOMMENDED_SCPS, COMMON_CROSS_ACCOUNT_ROLES, getRecommendedStructure, generateCrossAccountRoleCF, validateAccountStructure, formatAccountStructure, generateDeploymentWorkflow, generateMultiEnvWorkflow, generatePRPreviewWorkflow, generateScheduledWorkflow, generateMatrixWorkflow, generateDeploymentPipeline, generateMultiEnvPipeline, generatePreviewPipeline, generateScheduledPipeline, generateManualPipeline, generateDeploymentConfig, generateMultiEnvConfig, generateScheduledConfig, generateApprovalConfig, generateParallelConfig, BackupManager, backupManager, DisasterRecoveryManager, drManager, AWSConfigManager, awsConfigManager, CloudTrailManager, cloudTrailManager, GuardDutyManager, guardDutyManager, SecurityHubManager, securityHubManager, BlueGreenManager, blueGreenManager, CanaryManager, canaryManager, ABTestManager, abTestManager, ProgressiveDeploymentManager, progressiveDeploymentManager, XRayManager, xrayManager, MetricsManager, metricsManager, LogsManager, logsManager, SyntheticsManager, syntheticsManager, MigrationManager, migrationManager, ReplicaManager, replicaManager, PerformanceManager, performanceManager, DatabaseUserManager, databaseUserManager, SecretsRotationManager, secretsRotationManager, SecretsManager, secretsManager, CertificateManager, certificateManager, SecurityScanningManager, securityScanningManager, ImageScanningManager, imageScanningManager, BuildOptimizationManager, buildOptimizationManager, ContainerRegistryManager, containerRegistryManager, ServiceMeshManager, serviceMeshManager, LambdaLayersManager, lambdaLayersManager, LambdaVersionsManager, lambdaVersionsManager, LambdaConcurrencyManager, lambdaConcurrencyManager, LambdaDestinationsManager, lambdaDestinationsManager, LambdaVPCManager, lambdaVPCManager, LambdaDLQManager, lambdaDLQManager, Route53RoutingManager, route53RoutingManager, DNSSECManager, dnssecManager, Route53ResolverManager, route53ResolverManager, BounceComplaintHandler, bounceComplaintHandler, EmailAnalyticsManager, emailAnalyticsManager, SenderReputationManager, senderReputationManager, EmailTemplateManager, emailTemplateManager, exports_advanced, exports_inbound, exports_advanced2, exports_advanced3, FIFOQueueManager, fifoQueueManager, DLQMonitoringManager, dlqMonitoringManager, BatchProcessingManager, batchProcessingManager, QueueManagementManager, queueManagementManager, createZip, generateBootstrap, runBuildHooks, sha256, artifactKey, packageServerlessApp, MANAGED_NODE_VERSIONS, resolveServerlessRuntime, resolveQueues, resolveQueueNames, composeServerlessAppTemplate, PHP_LAYER_EXTENSIONS, phpLayerPackages, phpLayerBuildStage, generatePhpLayerDockerfile, generateAppImageDockerfile, sharedRuntimeLoop, buildNodeRuntimeLayerZip, buildBunRuntimeLayerZip, resolveApp, eventToRequest, responseToResult, createHttpHandler, createQueueHandler, createCliHandler, createHandlers, generatePhpFpmConfig, phpRuntimeLayerAssets, laravelServerlessEnvDefaults, LARAVEL_SERVERLESS_BUILD_STEPS, buildPhpRuntimeLayerZip, PHP_DEFAULT_EXCLUDES, runPhpBuildHooks, collectPhpAppEntries, packagePhpApp, StaticSiteManager, staticSiteManager, StorageAdvancedManager, storageAdvancedManager, HealthCheckManager, healthCheckManager, NetworkSecurityManager, networkSecurityManager, ResourceManagementManager, resourceManagementManager };

package/dist/{chunk-jg4f2ybx.js → chunk-6agm101w.js}

@@ -5,7 +5,7 @@ import {
   resolveCloudProvider,
   resolveManagementDashboardSites,
   resolveProjectStackName
-} from "./chunk-vsgkcpqw.js";
+} from "./chunk-49nmy775.js";
 import {
   EC2Client,
   SSMClient
@@ -3548,6 +3548,24 @@ function buildPruneReleases(paths, keep = DEFAULT_KEEP_RELEASES) {
     "done"
   ];
 }
+function siteOwnerPath(base) {
+  return `${deployMetaDir(base)}/owner`;
+}
+function buildSiteOwnerGuard(base, slug) {
+  const owner = siteOwnerPath(base);
+  return [
+    `if [ -f "${owner}" ]; then`,
+    `  TS_CLOUD_OWNER=$(cat "${owner}")`,
+    `  if [ "$TS_CLOUD_OWNER" != "${slug}" ]; then`,
+    `    echo "[ts-cloud] REFUSING deploy: ${base} belongs to project '$TS_CLOUD_OWNER', not '${slug}'. Another project on this box derives the same site key — give one of them a distinct site name/domain, or remove ${owner} to transfer ownership." >&2`,
+    "    exit 1",
+    "  fi",
+    "else",
+    `  mkdir -p "$(dirname "${owner}")"`,
+    `  printf '%s\\n' "${slug}" > "${owner}"`,
+    "fi"
+  ];
+}
 function buildDeployHistoryHeader(base, options) {
   const meta = deployMetaDir(base);
   const log = deployLogPath(base, options.releaseId);
@@ -3827,7 +3845,7 @@ function buildManagementDashboardArtifact(site, options) {
       logger.warn(`Management dashboard: build output not found at ${root} — skipping dashboard artifact.`);
       return null;
     }
-    const tarball = join4(tmpdir(), `${options.slug}-${MANAGEMENT_DASHBOARD_SITE}-${options.sha}.tar.gz`);
+    const tarball = join4(tmpdir(), `${options.slug}-${options.siteName ?? MANAGEMENT_DASHBOARD_SITE}-${options.sha}.tar.gz`);
     execSync2(`tar czf "${tarball}" -C "${root}" .`, { stdio: "inherit" });
     return tarball;
   } catch (error) {
@@ -4404,7 +4422,7 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
     logger.step(`Deploying PHP site '${siteName}' to ${targets.length} target(s)...`);
     const phpResult = await driver.runRemoteDeploy({
       targets,
-      commands: [...deployScript, ...poolScript, ...vhostScript, ...sslScript, ...servicesScript2, ...healthCheckScript],
+      commands: [...buildSiteOwnerGuard(appBase, slug), ...deployScript, ...poolScript, ...vhostScript, ...sslScript, ...servicesScript2, ...healthCheckScript],
       comment: `ts-cloud deploy ${slug}/${siteName}@${sha}`,
       tags: { Project: slug, Environment: environment, Role: "app" }
     });
@@ -4479,6 +4497,7 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
       commit: sha,
       branch: site.branch ?? "main"
     }),
+    ...buildSiteOwnerGuard(`/var/www/${siteName}`, slug),
     ...baseScript,
     ...staticVhost,
     ...staticSsl,
@@ -4521,7 +4540,7 @@ async function deployAllComputeSites(options) {
   let dashboardTarball = null;
   const dashboardTarballBySite = new Map;
   if (injectedDashboardSites.length > 0) {
-    dashboardTarball = buildManagementDashboardArtifact(config.sites?.[injectedDashboardSites[0]], { cwd, slug, sha, logger: { info: logger.info, warn: logger.warn } });
+    dashboardTarball = buildManagementDashboardArtifact(config.sites?.[injectedDashboardSites[0]], { cwd, slug, sha, siteName: injectedDashboardSites[0], logger: { info: logger.info, warn: logger.warn } });
     if (!dashboardTarball) {
       logger.warn("Management dashboard: no artifact available — skipping dashboard site(s) for this deploy.");
       for (const name of injectedDashboardSites) {
@@ -4530,7 +4549,7 @@ async function deployAllComputeSites(options) {
       }
     } else {
       for (const name of injectedDashboardSites) {
-        if (name === MANAGEMENT_DASHBOARD_SITE) {
+        if (name === injectedDashboardSites[0]) {
           dashboardTarballBySite.set(name, dashboardTarball);
           continue;
         }

package/dist/{chunk-fy85hcfy.js → chunk-mbpxadga.js}

@@ -6,7 +6,7 @@ import {
   step,
   success,
   warn
-} from "./chunk-m03vddvr.js";
+} from "./chunk-qgnyzfmx.js";
 import {
   CloudWatchLogsClient,
   CostExplorerClient,
@@ -26,7 +26,7 @@ import {
   resolveSiteFramework,
   resolveSiteKind,
   resolveUiSource
-} from "./chunk-jg4f2ybx.js";
+} from "./chunk-6agm101w.js";
 import {
   artifactKey,
   composeServerlessAppTemplate,
@@ -40,7 +40,7 @@ import {
   resolveServerlessArtifactBucketName,
   resolveServerlessAssetBucketName,
   resolveServerlessRuntime
-} from "./chunk-vsgkcpqw.js";
+} from "./chunk-49nmy775.js";
 import {
   deployStaticSiteWithExternalDnsFull
 } from "./chunk-d7p84vz5.js";
@@ -345,7 +345,7 @@ async function deployServerlessApp(config, environment, opts = {}) {
   }
   if (imageMode) {
     step("Building + pushing container image");
-    const { buildAndPushServerlessImage } = await import("./chunk-9ra8b9b4.js");
+    const { buildAndPushServerlessImage } = await import("./chunk-296n8hvt.js");
     const built = await buildAndPushServerlessImage({
       app,
       projectRoot,

package/dist/{chunk-m03vddvr.js → chunk-qgnyzfmx.js}

@@ -8,7 +8,7 @@ import {
   phpRuntimeLayerAssets,
   runPhpBuildHooks,
   sha256
-} from "./chunk-vsgkcpqw.js";
+} from "./chunk-49nmy775.js";
 
 // src/deploy/serverless-image.ts
 import { execFileSync } from "node:child_process";

package/dist/deploy/index.js

@@ -12,10 +12,10 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "../chunk-fy85hcfy.js";
+} from "../chunk-mbpxadga.js";
 import {
   buildAndPushServerlessImage
-} from "../chunk-m03vddvr.js";
+} from "../chunk-qgnyzfmx.js";
 import"../chunk-b82pbxyp.js";
 import"../chunk-hsk6fe6x.js";
 import {
@@ -29,8 +29,8 @@ import {
   resolveSiteKind,
   resolveUiSource,
   validateDeploymentConfig
-} from "../chunk-jg4f2ybx.js";
-import"../chunk-vsgkcpqw.js";
+} from "../chunk-6agm101w.js";
+import"../chunk-49nmy775.js";
 import"../chunk-93hjhs78.js";
 import {
   deleteStaticSite,

package/dist/deploy/management-dashboard.d.ts

@@ -20,7 +20,13 @@
  * - `TS_CLOUD_UI_DISABLE`   set truthy to skip auto-deploy
  */
 import type { CloudConfig } from '@ts-cloud/core';
-/** Site key under which the management dashboard is auto-injected. */
+/**
+ * Legacy site key for the management dashboard. Auto-injected dashboards are
+ * now keyed per domain (`dashboard-<apex-dashed>`, see
+ * `managementDashboardSiteName` in `@ts-cloud/core`) so tenants sharing a box
+ * via `attachTo` never collide on `/var/www/dashboard`. This bare key remains
+ * only for hand-configured dashboards and pre-0.8 deploys.
+ */
 export declare const MANAGEMENT_DASHBOARD_SITE = "dashboard";
 /** Where an auto-generated dashboard password is persisted (per project checkout). */
 export declare const DASHBOARD_CREDENTIALS_FILE: string;
@@ -68,6 +74,8 @@ export interface BuildDashboardArtifactOptions {
     cwd?: string;
     slug: string;
     sha: string;
+    /** Site key the tarball is staged under. @default MANAGEMENT_DASHBOARD_SITE */
+    siteName?: string;
     logger?: EnsureDashboardLogger;
 }
 /**

package/dist/drivers/index.js

@@ -48,8 +48,8 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "../chunk-jg4f2ybx.js";
-import"../chunk-vsgkcpqw.js";
+} from "../chunk-6agm101w.js";
+import"../chunk-49nmy775.js";
 import"../chunk-93hjhs78.js";
 import"../chunk-qpj3edwz.js";
 import"../chunk-vd87cpvn.js";

package/dist/drivers/shared/releases.d.ts

@@ -77,6 +77,18 @@ export declare function buildRollbackScript(paths: ReleasePaths, options?: {
  * at the newest, so it is never pruned.
  */
 export declare function buildPruneReleases(paths: ReleasePaths, keep?: number): string[];
+/** Owner marker recording which project a site's base dir belongs to. */
+export declare function siteOwnerPath(base: string): string;
+/**
+ * Guard a site's base dir against cross-project deploys on a shared box
+ * (`attachTo`): the first deploy stamps `<base>/.ts-cloud/owner` with the
+ * project slug; a later deploy whose slug differs fails loudly instead of
+ * silently overwriting another tenant's releases. Two projects can only trip
+ * this by deriving the same site key (e.g. both claiming the same domain),
+ * which is a config conflict the operator must resolve — not one deploys
+ * should paper over. Emitted before anything mutates the dir.
+ */
+export declare function buildSiteOwnerGuard(base: string, slug: string): string[];
 export interface DeployHistoryOptions {
     /** This deploy's release id. */
     releaseId: string;

package/dist/index.js

@@ -55,10 +55,10 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "./chunk-fy85hcfy.js";
+} from "./chunk-mbpxadga.js";
 import {
   buildAndPushServerlessImage
-} from "./chunk-m03vddvr.js";
+} from "./chunk-qgnyzfmx.js";
 import {
   CloudWatchLogsClient,
   EFSClient,
@@ -105,7 +105,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-jg4f2ybx.js";
+} from "./chunk-6agm101w.js";
 import {
   ABTestManager,
   AI,
@@ -412,6 +412,7 @@ import {
   makeAWSRequest,
   makeAWSRequestAsync,
   makeAWSRequestOnce,
+  managementDashboardSiteName,
   mergeInfrastructure,
   metricsManager,
   migrationManager,
@@ -503,7 +504,7 @@ import {
   withSecurity,
   withTimeout,
   xrayManager
-} from "./chunk-vsgkcpqw.js";
+} from "./chunk-49nmy775.js";
 import {
   EC2Client,
   SSMClient
@@ -4757,6 +4758,7 @@ export {
   migrateObjectStorage,
   metricsManager,
   mergeInfrastructure,
+  managementDashboardSiteName,
   makeAWSRequestOnce,
   makeAWSRequestAsync,
   makeAWSRequest,