@stacksjs/ts-cloud 0.7.14 → 0.7.16

package/dist/{chunk-9ra8b9b4.js → chunk-296n8hvt.js}

@@ -1,8 +1,8 @@
 import {
   buildAndPushServerlessImage
-} from "./chunk-m03vddvr.js";
+} from "./chunk-qgnyzfmx.js";
 import"./chunk-hsk6fe6x.js";
-import"./chunk-vsgkcpqw.js";
+import"./chunk-49nmy775.js";
 import"./chunk-arsh1g5h.js";
 import"./chunk-v0bahtg2.js";
 export {

package/dist/{chunk-vsgkcpqw.js → chunk-49nmy775.js}

@@ -21948,13 +21948,11 @@ function hasManagementDashboardSite(config) {
     if (!site)
       return false;
     const root = site.root ?? "";
-    return name === "dashboard" || root === "ui/dist" || root.endsWith("/ui/dist") || root.endsWith("/dist/ui");
+    return isManagementDashboardSiteName(name) || root === "ui/dist" || root.endsWith("/ui/dist") || root.endsWith("/dist/ui");
   });
 }
 var MANAGEMENT_DASHBOARD_SITE_PREFIX = "dashboard-";
-function dashboardSiteName(domain, primary) {
-  if (primary)
-    return "dashboard";
+function managementDashboardSiteName(domain) {
   return MANAGEMENT_DASHBOARD_SITE_PREFIX + domain.replace(/^dashboard\./, "").replace(/\./g, "-");
 }
 function isManagementDashboardSiteName(name) {
@@ -21980,11 +21978,11 @@ function resolveManagementDashboardSites(config, environment, opts) {
       ...build,
       ...auth2
     };
-    return [{ name: "dashboard", site }];
+    return [{ name: managementDashboardSiteName(domain), site }];
   }
   const domains = resolveDashboardDomains(config, environment, opts.domain);
-  return domains.map((domain, i) => ({
-    name: dashboardSiteName(domain, i === 0),
+  return domains.map((domain) => ({
+    name: managementDashboardSiteName(domain),
     site: {
       root: opts.uiRoot,
       deploy: "server",
@@ -46154,4 +46152,4 @@ class ResourceManagementManager {
 }
 var resourceManagementManager = new ResourceManagementManager;
 
-export { detectServiceRegion, signRequest, signRequestAsync, createPresignedUrl, createPresignedUrlAsync, makeAWSRequest, makeAWSRequestOnce, makeAWSRequestAsync, parseXMLResponse, parseJSONResponse, clearSigningKeyCache, getSigningKeyCacheSize, isNodeCryptoAvailable, isWebCryptoAvailable, QueuePresets, RealtimePresets, detectDeploymentTargets, resolveDeploymentMode, deploymentCoexistenceError, resolveCloudProvider, TemplateBuilder, Pseudo, generateResourceName, generateLogicalId, getTimestamp, sanitizeName, resolveProjectStackName, resolveSiteStackName, resolveSiteResourceName, resolveSiteBucketName, resolveStorageBucketName, resolveDeployBucketName, resolveServerlessAppStackName, resolveServerlessArtifactBucketName, resolveServerlessAssetBucketName, DependencyGraph, analyzeStackDiff, formatDiff, Storage, Registry, CDN, DNS, Security, Compute, Network, FileSystem, Email, exports_incoming_call, Phone, Queue, JobLoader, StacksIntegration, exports_send, SMS, AI, Database, Cache, Permissions, ApiGateway, Messaging, Workflow, Monitoring, Auth, Deployment, AssetHasher, Secrets, ParameterStore, Search, Redirects, Communication, Fn2, Arn, AWS_PSEUDO_PARAMETERS, CloudFormationBuilder, buildCloudFormationTemplate, createStaticSitePreset, createNodeJsServerPreset, createNodeJsServerlessPreset, createServerlessNodePreset, createFullStackAppPreset, createApiBackendPreset, createWordPressPreset, createJamstackPreset, createMicroservicesPreset, createRealtimeAppPreset, createDataPipelinePreset, createMLApiPreset, createTraditionalWebAppPreset, createLaravelPreset, createServerlessLaravelPreset, createDashboardSite, resolveDashboardDomain, resolveDashboardDomains, hasManagementDashboardSite, MANAGEMENT_DASHBOARD_SITE_PREFIX, isManagementDashboardSiteName, resolveManagementDashboardSites, resolveManagementDashboardSite, extendPreset, composePresets, createPreset, mergeInfrastructure, withMonitoring, withSecurity, withDatabase, withCache, withCDN, withQueue, fromEnvironment, fromSharedCredentials, fromEC2Metadata, fromECSMetadata, fromWebIdentity, getCredentials, createCredentialProvider, resolveCredentials, resolveRegion, getAccountId, S3Error, createS3Client, CloudError, ConfigurationError, CredentialError, DeploymentError, ValidationError, AWSAPIError, ErrorCodes, getErrorDetails, createError, DebugLogger, validateConfiguration, detectMisconfigurations, validateCredentials, checkIAMPermissions, getRequiredPermissions, suggestIAMPolicy, DEFAULT_SERVICE_LIMITS, checkServiceQuotas, getQuotaUsageSummary, suggestQuotaIncrease, FileCache, TemplateCache, templateCache, hashFile, hashString, hashBuffer, hashDirectory, hashManifest, quickHash, findChangedFiles, HashCache, parallel, batch, parallelMap, parallelWithRetry, sequence, withTimeout, RateLimiter, chunk, processInChunks, diffTemplates, getDiffSummary, requiresReplacement, categorizeChanges, getDeploymentStrategy, getDiffStats, cloud_config_schema_default, validateAgainstSchema, defaultLocalConfig, getLocalConfig, isLocalDevelopment, getLocalEndpoint, getLocalCredentials, getLocalEnvVars, MockCloudFormation, MockS3, MockDynamoDB, createMockAWS, PreviewEnvironmentManager, previewManager, generatePreviewWorkflow, generateCleanupWorkflow, generateCostReportWorkflow, PreviewNotificationService, previewNotifications, formatTable, formatTree, formatProgressBar, formatBytes, formatDuration, formatList, formatKeyValue, ProgressBar, MultiStepProgress, Spinner, TaskList, suggestCommand, formatSuggestion, isLikelyTypo, getContextualHelp, searchCommands, autocomplete, suggestFlags, formatFlagSuggestions, getCommandUsage, validateCommand, REPL, REPLContext, REPLCommandBuilder, CommandHistory, formatHistory, formatHistoryStats, MultiRegionManager, multiRegionManager, CrossRegionReferenceManager, GlobalResourceManager, RegionPairManager, StackDependencyManager, crossRegionReferenceManager, globalResourceManager, regionPairManager, stackDependencyManager, AWS_REGIONS, getRegion, getAllRegions, getRegionsByLocation, getRegionsByCompliance, getRegionsByPricingTier, isValidRegion, getClosestRegion, suggestRegions, suggestRegionPairs, formatRegion, formatRegionList, getRegionStats, MultiAccountManager, OrganizationManager, multiAccountManager, organizationManager, RECOMMENDED_ACCOUNT_STRUCTURES, RECOMMENDED_SCPS, COMMON_CROSS_ACCOUNT_ROLES, getRecommendedStructure, generateCrossAccountRoleCF, validateAccountStructure, formatAccountStructure, generateDeploymentWorkflow, generateMultiEnvWorkflow, generatePRPreviewWorkflow, generateScheduledWorkflow, generateMatrixWorkflow, generateDeploymentPipeline, generateMultiEnvPipeline, generatePreviewPipeline, generateScheduledPipeline, generateManualPipeline, generateDeploymentConfig, generateMultiEnvConfig, generateScheduledConfig, generateApprovalConfig, generateParallelConfig, BackupManager, backupManager, DisasterRecoveryManager, drManager, AWSConfigManager, awsConfigManager, CloudTrailManager, cloudTrailManager, GuardDutyManager, guardDutyManager, SecurityHubManager, securityHubManager, BlueGreenManager, blueGreenManager, CanaryManager, canaryManager, ABTestManager, abTestManager, ProgressiveDeploymentManager, progressiveDeploymentManager, XRayManager, xrayManager, MetricsManager, metricsManager, LogsManager, logsManager, SyntheticsManager, syntheticsManager, MigrationManager, migrationManager, ReplicaManager, replicaManager, PerformanceManager, performanceManager, DatabaseUserManager, databaseUserManager, SecretsRotationManager, secretsRotationManager, SecretsManager, secretsManager, CertificateManager, certificateManager, SecurityScanningManager, securityScanningManager, ImageScanningManager, imageScanningManager, BuildOptimizationManager, buildOptimizationManager, ContainerRegistryManager, containerRegistryManager, ServiceMeshManager, serviceMeshManager, LambdaLayersManager, lambdaLayersManager, LambdaVersionsManager, lambdaVersionsManager, LambdaConcurrencyManager, lambdaConcurrencyManager, LambdaDestinationsManager, lambdaDestinationsManager, LambdaVPCManager, lambdaVPCManager, LambdaDLQManager, lambdaDLQManager, Route53RoutingManager, route53RoutingManager, DNSSECManager, dnssecManager, Route53ResolverManager, route53ResolverManager, BounceComplaintHandler, bounceComplaintHandler, EmailAnalyticsManager, emailAnalyticsManager, SenderReputationManager, senderReputationManager, EmailTemplateManager, emailTemplateManager, exports_advanced, exports_inbound, exports_advanced2, exports_advanced3, FIFOQueueManager, fifoQueueManager, DLQMonitoringManager, dlqMonitoringManager, BatchProcessingManager, batchProcessingManager, QueueManagementManager, queueManagementManager, createZip, generateBootstrap, runBuildHooks, sha256, artifactKey, packageServerlessApp, MANAGED_NODE_VERSIONS, resolveServerlessRuntime, resolveQueues, resolveQueueNames, composeServerlessAppTemplate, PHP_LAYER_EXTENSIONS, phpLayerPackages, phpLayerBuildStage, generatePhpLayerDockerfile, generateAppImageDockerfile, sharedRuntimeLoop, buildNodeRuntimeLayerZip, buildBunRuntimeLayerZip, resolveApp, eventToRequest, responseToResult, createHttpHandler, createQueueHandler, createCliHandler, createHandlers, generatePhpFpmConfig, phpRuntimeLayerAssets, laravelServerlessEnvDefaults, LARAVEL_SERVERLESS_BUILD_STEPS, buildPhpRuntimeLayerZip, PHP_DEFAULT_EXCLUDES, runPhpBuildHooks, collectPhpAppEntries, packagePhpApp, StaticSiteManager, staticSiteManager, StorageAdvancedManager, storageAdvancedManager, HealthCheckManager, healthCheckManager, NetworkSecurityManager, networkSecurityManager, ResourceManagementManager, resourceManagementManager };
+export { detectServiceRegion, signRequest, signRequestAsync, createPresignedUrl, createPresignedUrlAsync, makeAWSRequest, makeAWSRequestOnce, makeAWSRequestAsync, parseXMLResponse, parseJSONResponse, clearSigningKeyCache, getSigningKeyCacheSize, isNodeCryptoAvailable, isWebCryptoAvailable, QueuePresets, RealtimePresets, detectDeploymentTargets, resolveDeploymentMode, deploymentCoexistenceError, resolveCloudProvider, TemplateBuilder, Pseudo, generateResourceName, generateLogicalId, getTimestamp, sanitizeName, resolveProjectStackName, resolveSiteStackName, resolveSiteResourceName, resolveSiteBucketName, resolveStorageBucketName, resolveDeployBucketName, resolveServerlessAppStackName, resolveServerlessArtifactBucketName, resolveServerlessAssetBucketName, DependencyGraph, analyzeStackDiff, formatDiff, Storage, Registry, CDN, DNS, Security, Compute, Network, FileSystem, Email, exports_incoming_call, Phone, Queue, JobLoader, StacksIntegration, exports_send, SMS, AI, Database, Cache, Permissions, ApiGateway, Messaging, Workflow, Monitoring, Auth, Deployment, AssetHasher, Secrets, ParameterStore, Search, Redirects, Communication, Fn2, Arn, AWS_PSEUDO_PARAMETERS, CloudFormationBuilder, buildCloudFormationTemplate, createStaticSitePreset, createNodeJsServerPreset, createNodeJsServerlessPreset, createServerlessNodePreset, createFullStackAppPreset, createApiBackendPreset, createWordPressPreset, createJamstackPreset, createMicroservicesPreset, createRealtimeAppPreset, createDataPipelinePreset, createMLApiPreset, createTraditionalWebAppPreset, createLaravelPreset, createServerlessLaravelPreset, createDashboardSite, resolveDashboardDomain, resolveDashboardDomains, hasManagementDashboardSite, MANAGEMENT_DASHBOARD_SITE_PREFIX, managementDashboardSiteName, isManagementDashboardSiteName, resolveManagementDashboardSites, resolveManagementDashboardSite, extendPreset, composePresets, createPreset, mergeInfrastructure, withMonitoring, withSecurity, withDatabase, withCache, withCDN, withQueue, fromEnvironment, fromSharedCredentials, fromEC2Metadata, fromECSMetadata, fromWebIdentity, getCredentials, createCredentialProvider, resolveCredentials, resolveRegion, getAccountId, S3Error, createS3Client, CloudError, ConfigurationError, CredentialError, DeploymentError, ValidationError, AWSAPIError, ErrorCodes, getErrorDetails, createError, DebugLogger, validateConfiguration, detectMisconfigurations, validateCredentials, checkIAMPermissions, getRequiredPermissions, suggestIAMPolicy, DEFAULT_SERVICE_LIMITS, checkServiceQuotas, getQuotaUsageSummary, suggestQuotaIncrease, FileCache, TemplateCache, templateCache, hashFile, hashString, hashBuffer, hashDirectory, hashManifest, quickHash, findChangedFiles, HashCache, parallel, batch, parallelMap, parallelWithRetry, sequence, withTimeout, RateLimiter, chunk, processInChunks, diffTemplates, getDiffSummary, requiresReplacement, categorizeChanges, getDeploymentStrategy, getDiffStats, cloud_config_schema_default, validateAgainstSchema, defaultLocalConfig, getLocalConfig, isLocalDevelopment, getLocalEndpoint, getLocalCredentials, getLocalEnvVars, MockCloudFormation, MockS3, MockDynamoDB, createMockAWS, PreviewEnvironmentManager, previewManager, generatePreviewWorkflow, generateCleanupWorkflow, generateCostReportWorkflow, PreviewNotificationService, previewNotifications, formatTable, formatTree, formatProgressBar, formatBytes, formatDuration, formatList, formatKeyValue, ProgressBar, MultiStepProgress, Spinner, TaskList, suggestCommand, formatSuggestion, isLikelyTypo, getContextualHelp, searchCommands, autocomplete, suggestFlags, formatFlagSuggestions, getCommandUsage, validateCommand, REPL, REPLContext, REPLCommandBuilder, CommandHistory, formatHistory, formatHistoryStats, MultiRegionManager, multiRegionManager, CrossRegionReferenceManager, GlobalResourceManager, RegionPairManager, StackDependencyManager, crossRegionReferenceManager, globalResourceManager, regionPairManager, stackDependencyManager, AWS_REGIONS, getRegion, getAllRegions, getRegionsByLocation, getRegionsByCompliance, getRegionsByPricingTier, isValidRegion, getClosestRegion, suggestRegions, suggestRegionPairs, formatRegion, formatRegionList, getRegionStats, MultiAccountManager, OrganizationManager, multiAccountManager, organizationManager, RECOMMENDED_ACCOUNT_STRUCTURES, RECOMMENDED_SCPS, COMMON_CROSS_ACCOUNT_ROLES, getRecommendedStructure, generateCrossAccountRoleCF, validateAccountStructure, formatAccountStructure, generateDeploymentWorkflow, generateMultiEnvWorkflow, generatePRPreviewWorkflow, generateScheduledWorkflow, generateMatrixWorkflow, generateDeploymentPipeline, generateMultiEnvPipeline, generatePreviewPipeline, generateScheduledPipeline, generateManualPipeline, generateDeploymentConfig, generateMultiEnvConfig, generateScheduledConfig, generateApprovalConfig, generateParallelConfig, BackupManager, backupManager, DisasterRecoveryManager, drManager, AWSConfigManager, awsConfigManager, CloudTrailManager, cloudTrailManager, GuardDutyManager, guardDutyManager, SecurityHubManager, securityHubManager, BlueGreenManager, blueGreenManager, CanaryManager, canaryManager, ABTestManager, abTestManager, ProgressiveDeploymentManager, progressiveDeploymentManager, XRayManager, xrayManager, MetricsManager, metricsManager, LogsManager, logsManager, SyntheticsManager, syntheticsManager, MigrationManager, migrationManager, ReplicaManager, replicaManager, PerformanceManager, performanceManager, DatabaseUserManager, databaseUserManager, SecretsRotationManager, secretsRotationManager, SecretsManager, secretsManager, CertificateManager, certificateManager, SecurityScanningManager, securityScanningManager, ImageScanningManager, imageScanningManager, BuildOptimizationManager, buildOptimizationManager, ContainerRegistryManager, containerRegistryManager, ServiceMeshManager, serviceMeshManager, LambdaLayersManager, lambdaLayersManager, LambdaVersionsManager, lambdaVersionsManager, LambdaConcurrencyManager, lambdaConcurrencyManager, LambdaDestinationsManager, lambdaDestinationsManager, LambdaVPCManager, lambdaVPCManager, LambdaDLQManager, lambdaDLQManager, Route53RoutingManager, route53RoutingManager, DNSSECManager, dnssecManager, Route53ResolverManager, route53ResolverManager, BounceComplaintHandler, bounceComplaintHandler, EmailAnalyticsManager, emailAnalyticsManager, SenderReputationManager, senderReputationManager, EmailTemplateManager, emailTemplateManager, exports_advanced, exports_inbound, exports_advanced2, exports_advanced3, FIFOQueueManager, fifoQueueManager, DLQMonitoringManager, dlqMonitoringManager, BatchProcessingManager, batchProcessingManager, QueueManagementManager, queueManagementManager, createZip, generateBootstrap, runBuildHooks, sha256, artifactKey, packageServerlessApp, MANAGED_NODE_VERSIONS, resolveServerlessRuntime, resolveQueues, resolveQueueNames, composeServerlessAppTemplate, PHP_LAYER_EXTENSIONS, phpLayerPackages, phpLayerBuildStage, generatePhpLayerDockerfile, generateAppImageDockerfile, sharedRuntimeLoop, buildNodeRuntimeLayerZip, buildBunRuntimeLayerZip, resolveApp, eventToRequest, responseToResult, createHttpHandler, createQueueHandler, createCliHandler, createHandlers, generatePhpFpmConfig, phpRuntimeLayerAssets, laravelServerlessEnvDefaults, LARAVEL_SERVERLESS_BUILD_STEPS, buildPhpRuntimeLayerZip, PHP_DEFAULT_EXCLUDES, runPhpBuildHooks, collectPhpAppEntries, packagePhpApp, StaticSiteManager, staticSiteManager, StorageAdvancedManager, storageAdvancedManager, HealthCheckManager, healthCheckManager, NetworkSecurityManager, networkSecurityManager, ResourceManagementManager, resourceManagementManager };

package/dist/{chunk-fy85hcfy.js → chunk-d1370frz.js}

@@ -6,7 +6,7 @@ import {
   step,
   success,
   warn
-} from "./chunk-m03vddvr.js";
+} from "./chunk-qgnyzfmx.js";
 import {
   CloudWatchLogsClient,
   CostExplorerClient,
@@ -25,8 +25,9 @@ import {
   releasePaths,
   resolveSiteFramework,
   resolveSiteKind,
-  resolveUiSource
-} from "./chunk-jg4f2ybx.js";
+  resolveUiSource,
+  siteInstallBase
+} from "./chunk-hb06vk29.js";
 import {
   artifactKey,
   composeServerlessAppTemplate,
@@ -40,7 +41,7 @@ import {
   resolveServerlessArtifactBucketName,
   resolveServerlessAssetBucketName,
   resolveServerlessRuntime
-} from "./chunk-vsgkcpqw.js";
+} from "./chunk-49nmy775.js";
 import {
   deployStaticSiteWithExternalDnsFull
 } from "./chunk-d7p84vz5.js";
@@ -345,7 +346,7 @@ async function deployServerlessApp(config, environment, opts = {}) {
   }
   if (imageMode) {
     step("Building + pushing container image");
-    const { buildAndPushServerlessImage } = await import("./chunk-9ra8b9b4.js");
+    const { buildAndPushServerlessImage } = await import("./chunk-296n8hvt.js");
     const built = await buildAndPushServerlessImage({
       app,
       projectRoot,
@@ -10284,13 +10285,13 @@ function shellSingleQuote(value) {
 function sedReplacement(value) {
   return value.replace(/[\\&/]/g, "\\$&");
 }
-function deployHistoryScript(siteNames) {
+function deployHistoryScript(siteNames, slug) {
   if (siteNames.length === 0)
     return ["true"];
   return [
     "set +e",
     ...siteNames.map((siteName) => {
-      const historyPath = shellSingleQuote(`/var/www/${siteName}/.ts-cloud/deploy-history.log`);
+      const historyPath = shellSingleQuote(`${siteInstallBase(slug, siteName)}/.ts-cloud/deploy-history.log`);
       const prefix = sedReplacement(siteName);
       return `TS_CLOUD_HISTORY=${historyPath}; { [ -f "$TS_CLOUD_HISTORY" ] && tail -n 24 "$TS_CLOUD_HISTORY" | sed "s/^/DEPLOY=${prefix}\\t/"; } || true`;
     }),
@@ -10673,7 +10674,7 @@ function resolveConfigOnlyServerDashboardData(config6, environment) {
       const kind = resolveSiteKind(site);
       return {
         ...s,
-        root: kind === "server-static" ? `/var/www/${s.name}` : `/var/www/${s.name}/current`,
+        root: kind === "server-static" ? siteInstallBase(config6.project.slug, s.name) : `${siteInstallBase(config6.project.slug, s.name)}/current`,
         branch: kind === "server-static" ? "build artifact" : "main",
         build: site.build,
         php: site.php ?? site.phpVersion,
@@ -10754,7 +10755,7 @@ async function resolveServerDashboardData(config6, environment) {
       const siteNames = Object.keys(config6.sites ?? {});
       const historyResult = await driver.runRemoteDeploy({
         targets: [targets[0]],
-        commands: deployHistoryScript(siteNames),
+        commands: deployHistoryScript(siteNames, config6.project.slug),
         comment: `ts-cloud dashboard:deploy-history ${config6.project.slug}`,
         tags: { Project: config6.project.slug, Environment: environment, Role: "app" }
       });
@@ -11013,7 +11014,7 @@ async function rollbackComputeSite(ctx, options) {
   const targets = await findTargets(ctx);
   if (targets.length === 0)
     return { success: false, error: `No '${ctx.role || "app"}' servers found for ${ctx.slug}/${ctx.environment}.` };
-  const appBase = `/var/www/${options.siteName}`;
+  const appBase = siteInstallBase(ctx.slug, options.siteName);
   const paths = releasePaths(appBase, options.to || "unused");
   const commands = [
     "set -uo pipefail",
@@ -11139,8 +11140,8 @@ function serviceCommand(verb, target) {
 function pantryEnvEval() {
   return `eval "$(cd ${PANTRY_PROJECT_DIR} && pantry env 2>/dev/null)"`;
 }
-function siteArtisanCommand(site, artisan) {
-  const current = `/var/www/${site}/current`;
+function siteArtisanCommand(slug, site, artisan) {
+  const current = `${siteInstallBase(slug, site)}/current`;
   return [
     "set -uo pipefail",
     `[ -d ${current} ] || { echo "site ${site} has no current release" >&2; exit 1; }`,
@@ -11149,7 +11150,7 @@ function siteArtisanCommand(site, artisan) {
 }
 function workerRestartCommand(framework, slug, site) {
   if (framework === "laravel")
-    return siteArtisanCommand(site, "queue:restart");
+    return siteArtisanCommand(slug, site, "queue:restart");
   const pattern = `${slug}-${site}-queue-*.service`;
   return [
     "set -uo pipefail",
@@ -11161,7 +11162,7 @@ function workerRestartCommand(framework, slug, site) {
 }
 function schedulerRunCommand(framework, slug, site) {
   if (framework === "laravel")
-    return siteArtisanCommand(site, "schedule:run");
+    return siteArtisanCommand(slug, site, "schedule:run");
   const unit = `${slug}-${site}-scheduler.service`;
   return [
     "set -uo pipefail",

package/dist/{chunk-jg4f2ybx.js → chunk-hb06vk29.js}

@@ -5,7 +5,7 @@ import {
   resolveCloudProvider,
   resolveManagementDashboardSites,
   resolveProjectStackName
-} from "./chunk-vsgkcpqw.js";
+} from "./chunk-49nmy775.js";
 import {
   EC2Client,
   SSMClient
@@ -1659,6 +1659,9 @@ runcmd:
 }
 
 // src/deploy/site-target.ts
+function siteInstallBase(slug, siteName) {
+  return `/var/www/${slug}-${siteName}`;
+}
 var PHP_SITE_TYPES = new Set([
   "laravel",
   "php",
@@ -1815,6 +1818,7 @@ function resolveServerAppFrom(port, appBoxes) {
 }
 function buildRpxConfigInternal(sites, options, appBoxes) {
   const wwwRoot = (options.wwwRoot ?? "/var/www").replace(/\/+$/, "");
+  const installSlug = options.slug ?? "app";
   const certsDir = options.proxy.certsDir ?? DEFAULT_RPX_CERTS_DIR;
   const loadBalancer = options.proxy.loadBalancer;
   const proxies = [];
@@ -1849,7 +1853,7 @@ function buildRpxConfigInternal(sites, options, appBoxes) {
       proxies.push({
         to: site.domain,
         path,
-        static: `${wwwRoot}/${name}/current`,
+        static: `${wwwRoot}/${installSlug}-${name}/current`,
         cleanUrls: site.pathRewriteStyle !== "flat",
         spa: site.spa ?? false,
         ...auth ? { auth } : {},
@@ -2302,7 +2306,7 @@ class HetznerDriver {
     const sitePorts = this.collectUpstreamPorts(sites);
     const rpxProvision = compute.proxy?.engine === "rpx" ? buildRpxProvisionScript({
       proxy: compute.proxy,
-      config: buildRpxConfig(sites, { proxy: compute.proxy }),
+      config: buildRpxConfig(sites, { proxy: compute.proxy, slug: config.project.slug }),
       slug: config.project.slug,
       bunBin: compute.runtime === "node" || compute.runtime === "deno" ? undefined : "/usr/local/bin/bun"
     }) : undefined;
@@ -2651,7 +2655,7 @@ class HetznerDriver {
         const rpxProxy = compute.proxy?.engine === "rpx" ? compute.proxy : { engine: "rpx" };
         const lbRpxProvision = buildRpxProvisionScript({
           proxy: rpxProxy,
-          config: buildRpxLbConfig(sites, appBoxes, { proxy: rpxProxy }),
+          config: buildRpxLbConfig(sites, appBoxes, { proxy: rpxProxy, slug }),
           slug,
           bunBin: appProvisionScripts.runtime === "node" || appProvisionScripts.runtime === "deno" ? undefined : "/usr/local/bin/bun"
         });
@@ -3548,6 +3552,24 @@ function buildPruneReleases(paths, keep = DEFAULT_KEEP_RELEASES) {
     "done"
   ];
 }
+function siteOwnerPath(base) {
+  return `${deployMetaDir(base)}/owner`;
+}
+function buildSiteOwnerGuard(base, slug) {
+  const owner = siteOwnerPath(base);
+  return [
+    `if [ -f "${owner}" ]; then`,
+    `  TS_CLOUD_OWNER=$(cat "${owner}")`,
+    `  if [ "$TS_CLOUD_OWNER" != "${slug}" ]; then`,
+    `    echo "[ts-cloud] REFUSING deploy: ${base} belongs to project '$TS_CLOUD_OWNER', not '${slug}'. Another project on this box derives the same site key — give one of them a distinct site name/domain, or remove ${owner} to transfer ownership." >&2`,
+    "    exit 1",
+    "  fi",
+    "else",
+    `  mkdir -p "$(dirname "${owner}")"`,
+    `  printf '%s\\n' "${slug}" > "${owner}"`,
+    "fi"
+  ];
+}
 function buildDeployHistoryHeader(base, options) {
   const meta = deployMetaDir(base);
   const log = deployLogPath(base, options.releaseId);
@@ -3827,7 +3849,7 @@ function buildManagementDashboardArtifact(site, options) {
       logger.warn(`Management dashboard: build output not found at ${root} — skipping dashboard artifact.`);
       return null;
     }
-    const tarball = join4(tmpdir(), `${options.slug}-${MANAGEMENT_DASHBOARD_SITE}-${options.sha}.tar.gz`);
+    const tarball = join4(tmpdir(), `${options.slug}-${options.siteName ?? MANAGEMENT_DASHBOARD_SITE}-${options.sha}.tar.gz`);
     execSync2(`tar czf "${tarball}" -C "${root}" .`, { stdio: "inherit" });
     return tarball;
   } catch (error) {
@@ -4366,26 +4388,26 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
   if (isPhpSite(site)) {
     const compute2 = config.infrastructure?.compute;
     const phpVersion = site.phpVersion ?? compute2?.php?.default ?? compute2?.php?.versions?.[0];
-    const appBase = `/var/www/${siteName}`;
+    const appBase2 = siteInstallBase(slug, siteName);
     const dbEnv = outputs.servicesPrivateIp ? buildFleetServicesEnv(outputs.servicesPrivateIp, config.infrastructure?.appDatabase) : buildManagedDbEnv(config.infrastructure?.appDatabase);
     const siteWithEnv = Object.keys(dbEnv).length > 0 ? { ...site, env: { ...dbEnv, ...site.env || {} } } : site;
     const deployScript = buildLaravelDeployScript({
       siteName,
       site: siteWithEnv,
       releaseId: sha,
-      appBase,
+      appBase: appBase2,
       defaultPhpVersion: phpVersion
     });
     const useNginx = compute2?.webServer !== "rpx";
     const sslProvider = resolveSslProvider(site);
     const customCert = sslProvider === "custom" && site.ssl?.certPath && site.ssl?.keyPath ? { certPath: site.ssl.certPath, keyPath: site.ssl.keyPath } : undefined;
-    const poolScript = site.isolation ? buildPhpFpmPoolScript({ siteName, appBase }) : [];
+    const poolScript = site.isolation ? buildPhpFpmPoolScript({ siteName, appBase: appBase2 }) : [];
     const vhostScript = useNginx ? buildNginxVhostScript({
       siteName,
       domain: site.domain || siteName,
       aliases: site.aliases,
       type: site.type,
-      appDir: `${appBase}/current`,
+      appDir: `${appBase2}/current`,
       webDirectory: site.webDirectory,
       phpVersion,
       fastcgiPass: site.isolation ? phpFpmPoolListen(siteName) : undefined,
@@ -4399,12 +4421,12 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
       security: site.security
     }) : [];
     const sslScript = useNginx ? buildSslScript(site) : [];
-    const servicesScript2 = siteHasServices(site) ? buildSiteServicesScript({ slug, siteName, site, phpVersion, appBase }) : [];
+    const servicesScript2 = siteHasServices(site) ? buildSiteServicesScript({ slug, siteName, site, phpVersion, appBase: appBase2 }) : [];
     const healthCheckScript = useNginx ? buildHealthCheckScript(site) : [];
     logger.step(`Deploying PHP site '${siteName}' to ${targets.length} target(s)...`);
     const phpResult = await driver.runRemoteDeploy({
       targets,
-      commands: [...deployScript, ...poolScript, ...vhostScript, ...sslScript, ...servicesScript2, ...healthCheckScript],
+      commands: [...buildSiteOwnerGuard(appBase2, slug), ...deployScript, ...poolScript, ...vhostScript, ...sslScript, ...servicesScript2, ...healthCheckScript],
       comment: `ts-cloud deploy ${slug}/${siteName}@${sha}`,
       tags: { Project: slug, Environment: environment, Role: "app" }
     });
@@ -4437,14 +4459,17 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
   });
   const artifactFetch = driver.name === "aws" ? buildAwsArtifactFetch(outputs.deployBucketName, remoteKey, config.project.region || "us-east-1", siteName) : buildLocalArtifactFetch(uploadResult.artifactRef, siteName);
   const kind = resolveSiteKind(site);
+  const appBase = siteInstallBase(slug, siteName);
   const baseScript = kind === "server-static" ? buildStaticSiteDeployScript({
     siteName,
+    appDir: appBase,
     artifactFetch,
     releaseId: sha,
     preStartCommands: site.preStart
   }) : buildSiteDeployScript({
     siteName,
     slug,
+    appDir: appBase,
     artifactFetch,
     releaseId: sha,
     execStart: resolveExecStart(site.start, runtime),
@@ -4461,7 +4486,7 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
     domain: site.domain,
     aliases: site.aliases,
     type: site.type === "spa" ? "spa" : "static",
-    appDir: `/var/www/${siteName}/current`,
+    appDir: `${appBase}/current`,
     webDirectory: "",
     redirects: site.redirects,
     auth: site.auth && site.auth.enabled !== false && site.auth.password ? { username: site.auth.username || "admin", password: site.auth.password, realm: site.auth.realm } : undefined,
@@ -4472,13 +4497,14 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
     security: site.security
   }) : [];
   const staticSsl = wantsNginxStatic ? buildSslScript(site) : [];
-  const servicesScript = siteHasServices(site) ? buildSiteServicesScript({ slug, siteName, site, appBase: `/var/www/${siteName}` }) : [];
+  const servicesScript = siteHasServices(site) ? buildSiteServicesScript({ slug, siteName, site, appBase }) : [];
   const remoteScript = [
-    ...buildDeployHistoryHeader(`/var/www/${siteName}`, {
+    ...buildDeployHistoryHeader(appBase, {
       releaseId: sha,
       commit: sha,
       branch: site.branch ?? "main"
     }),
+    ...buildSiteOwnerGuard(appBase, slug),
     ...baseScript,
     ...staticVhost,
     ...staticSsl,
@@ -4521,7 +4547,7 @@ async function deployAllComputeSites(options) {
   let dashboardTarball = null;
   const dashboardTarballBySite = new Map;
   if (injectedDashboardSites.length > 0) {
-    dashboardTarball = buildManagementDashboardArtifact(config.sites?.[injectedDashboardSites[0]], { cwd, slug, sha, logger: { info: logger.info, warn: logger.warn } });
+    dashboardTarball = buildManagementDashboardArtifact(config.sites?.[injectedDashboardSites[0]], { cwd, slug, sha, siteName: injectedDashboardSites[0], logger: { info: logger.info, warn: logger.warn } });
     if (!dashboardTarball) {
       logger.warn("Management dashboard: no artifact available — skipping dashboard site(s) for this deploy.");
       for (const name of injectedDashboardSites) {
@@ -4530,7 +4556,7 @@ async function deployAllComputeSites(options) {
       }
     } else {
       for (const name of injectedDashboardSites) {
-        if (name === MANAGEMENT_DASHBOARD_SITE) {
+        if (name === injectedDashboardSites[0]) {
           dashboardTarballBySite.set(name, dashboardTarball);
           continue;
         }
@@ -4601,7 +4627,7 @@ async function reloadRpxGateway(options) {
   if (proxy?.engine !== "rpx")
     return true;
   const sites = routeSource.sites || {};
-  const rpxConfig = buildRpxConfig(sites, { proxy });
+  const rpxConfig = buildRpxConfig(sites, { proxy, slug: config.project.slug });
   if (rpxConfig.proxies.length === 0) {
     logger.warn("rpx gateway: no server sites with a domain to route — skipping gateway reload.");
     return true;
@@ -4715,4 +4741,4 @@ function buildCloudFrontOriginConfig(options) {
     CustomErrorResponses: { Quantity: 0 }
   };
 }
-export { isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, HetznerClient, resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, buildAwsArtifactFetch, buildLocalArtifactFetch, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };
+export { siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, HetznerClient, resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, buildAwsArtifactFetch, buildLocalArtifactFetch, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };

package/dist/{chunk-m03vddvr.js → chunk-qgnyzfmx.js}

@@ -8,7 +8,7 @@ import {
   phpRuntimeLayerAssets,
   runPhpBuildHooks,
   sha256
-} from "./chunk-vsgkcpqw.js";
+} from "./chunk-49nmy775.js";
 
 // src/deploy/serverless-image.ts
 import { execFileSync } from "node:child_process";

package/dist/deploy/index.js

@@ -12,10 +12,10 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "../chunk-fy85hcfy.js";
+} from "../chunk-d1370frz.js";
 import {
   buildAndPushServerlessImage
-} from "../chunk-m03vddvr.js";
+} from "../chunk-qgnyzfmx.js";
 import"../chunk-b82pbxyp.js";
 import"../chunk-hsk6fe6x.js";
 import {
@@ -28,9 +28,10 @@ import {
   resolveSiteDeployTarget,
   resolveSiteKind,
   resolveUiSource,
+  siteInstallBase,
   validateDeploymentConfig
-} from "../chunk-jg4f2ybx.js";
-import"../chunk-vsgkcpqw.js";
+} from "../chunk-hb06vk29.js";
+import"../chunk-49nmy775.js";
 import"../chunk-93hjhs78.js";
 import {
   deleteStaticSite,
@@ -54,6 +55,7 @@ export {
   validateDeploymentConfig,
   uploadStaticFiles,
   startLocalDashboardServer,
+  siteInstallBase,
   setMaintenance,
   sanitizeCloudConfig,
   runRemoteCommand,

package/dist/deploy/management-dashboard.d.ts

@@ -20,7 +20,13 @@
  * - `TS_CLOUD_UI_DISABLE`   set truthy to skip auto-deploy
  */
 import type { CloudConfig } from '@ts-cloud/core';
-/** Site key under which the management dashboard is auto-injected. */
+/**
+ * Legacy site key for the management dashboard. Auto-injected dashboards are
+ * now keyed per domain (`dashboard-<apex-dashed>`, see
+ * `managementDashboardSiteName` in `@ts-cloud/core`) so tenants sharing a box
+ * via `attachTo` never collide on `/var/www/dashboard`. This bare key remains
+ * only for hand-configured dashboards and pre-0.8 deploys.
+ */
 export declare const MANAGEMENT_DASHBOARD_SITE = "dashboard";
 /** Where an auto-generated dashboard password is persisted (per project checkout). */
 export declare const DASHBOARD_CREDENTIALS_FILE: string;
@@ -68,6 +74,8 @@ export interface BuildDashboardArtifactOptions {
     cwd?: string;
     slug: string;
     sha: string;
+    /** Site key the tarball is staged under. @default MANAGEMENT_DASHBOARD_SITE */
+    siteName?: string;
     logger?: EnsureDashboardLogger;
 }
 /**

package/dist/deploy/site-target.d.ts

@@ -10,6 +10,23 @@ import type { CloudConfig, SiteConfig, SiteDeployTarget } from '@ts-cloud/core';
  *                        the gateway answers `domain` with an HTTP redirect.
  */
 export type SiteDeployKind = 'bucket' | 'server-app' | 'server-static' | 'server-php' | 'redirect';
+/**
+ * On-disk base directory for a site's atomic release tree
+ * (`<base>/releases/<sha>` + `<base>/current`).
+ *
+ * Namespaced by the project **slug** so that on a shared / multi-tenant box
+ * (`cloud.attachTo`) two projects — or a tenant and the box owner — can never
+ * collide on the same `/var/www/<name>` path. A bare `/var/www/<siteName>`
+ * meant that e.g. every project with a `main` site fought over `/var/www/main`,
+ * silently overwriting each other's releases and round-robining stale responses
+ * on the shared port. This mirrors the systemd unit naming (`<slug>-<siteName>`)
+ * so a release directory and the service that runs it share one identity.
+ *
+ * MUST be the single source of truth for the install path — deploy, rpx routing
+ * (server-static), rollback/ops, and dashboard data all derive from it, so they
+ * can never diverge.
+ */
+export declare function siteInstallBase(slug: string, siteName: string): string;
 /**
  * A PHP/Laravel site: deployed to the compute box via git clone into atomic
  * release directories and served by nginx + php-fpm. Identified by a PHP

package/dist/drivers/index.js

@@ -48,8 +48,8 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "../chunk-jg4f2ybx.js";
-import"../chunk-vsgkcpqw.js";
+} from "../chunk-hb06vk29.js";
+import"../chunk-49nmy775.js";
 import"../chunk-93hjhs78.js";
 import"../chunk-qpj3edwz.js";
 import"../chunk-vd87cpvn.js";

package/dist/drivers/shared/releases.d.ts

@@ -77,6 +77,18 @@ export declare function buildRollbackScript(paths: ReleasePaths, options?: {
  * at the newest, so it is never pruned.
  */
 export declare function buildPruneReleases(paths: ReleasePaths, keep?: number): string[];
+/** Owner marker recording which project a site's base dir belongs to. */
+export declare function siteOwnerPath(base: string): string;
+/**
+ * Guard a site's base dir against cross-project deploys on a shared box
+ * (`attachTo`): the first deploy stamps `<base>/.ts-cloud/owner` with the
+ * project slug; a later deploy whose slug differs fails loudly instead of
+ * silently overwriting another tenant's releases. Two projects can only trip
+ * this by deriving the same site key (e.g. both claiming the same domain),
+ * which is a config conflict the operator must resolve — not one deploys
+ * should paper over. Emitted before anything mutates the dir.
+ */
+export declare function buildSiteOwnerGuard(base: string, slug: string): string[];
 export interface DeployHistoryOptions {
     /** This deploy's release id. */
     releaseId: string;

package/dist/drivers/shared/rpx-gateway.d.ts

@@ -138,6 +138,14 @@ export interface BuildRpxConfigOptions {
     proxy: ComputeProxyConfig;
     /** Directory static sites are shipped to. @default '/var/www' */
     wwwRoot?: string;
+    /**
+     * Project slug — server-static routes are served from the slug-namespaced
+     * install dir (`<wwwRoot>/<slug>-<name>/current`), matching where the deploy
+     * ships them (see {@link siteInstallBase}). Omitted ⇒ `app` (single-tenant
+     * back-compat). MUST be set on a shared box or static routes point at the
+     * wrong directory.
+     */
+    slug?: string;
 }
 /**
  * Normalize a path prefix to a leading-slash, no-trailing-slash form, or

package/dist/index.js

@@ -55,10 +55,10 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "./chunk-fy85hcfy.js";
+} from "./chunk-d1370frz.js";
 import {
   buildAndPushServerlessImage
-} from "./chunk-m03vddvr.js";
+} from "./chunk-qgnyzfmx.js";
 import {
   CloudWatchLogsClient,
   EFSClient,
@@ -105,7 +105,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-jg4f2ybx.js";
+} from "./chunk-hb06vk29.js";
 import {
   ABTestManager,
   AI,
@@ -412,6 +412,7 @@ import {
   makeAWSRequest,
   makeAWSRequestAsync,
   makeAWSRequestOnce,
+  managementDashboardSiteName,
   mergeInfrastructure,
   metricsManager,
   migrationManager,
@@ -503,7 +504,7 @@ import {
   withSecurity,
   withTimeout,
   xrayManager
-} from "./chunk-vsgkcpqw.js";
+} from "./chunk-49nmy775.js";
 import {
   EC2Client,
   SSMClient
@@ -4757,6 +4758,7 @@ export {
   migrateObjectStorage,
   metricsManager,
   mergeInfrastructure,
+  managementDashboardSiteName,
   makeAWSRequestOnce,
   makeAWSRequestAsync,
   makeAWSRequest,