@stacksjs/ts-cloud 0.7.15 → 0.7.17

package/dist/{chunk-mbpxadga.js → chunk-pr3g0b0t.js}

@@ -25,8 +25,9 @@ import {
   releasePaths,
   resolveSiteFramework,
   resolveSiteKind,
-  resolveUiSource
-} from "./chunk-6agm101w.js";
+  resolveUiSource,
+  siteInstallBase
+} from "./chunk-qergre5a.js";
 import {
   artifactKey,
   composeServerlessAppTemplate,
@@ -10284,13 +10285,13 @@ function shellSingleQuote(value) {
 function sedReplacement(value) {
   return value.replace(/[\\&/]/g, "\\$&");
 }
-function deployHistoryScript(siteNames) {
+function deployHistoryScript(siteNames, slug) {
   if (siteNames.length === 0)
     return ["true"];
   return [
     "set +e",
     ...siteNames.map((siteName) => {
-      const historyPath = shellSingleQuote(`/var/www/${siteName}/.ts-cloud/deploy-history.log`);
+      const historyPath = shellSingleQuote(`${siteInstallBase(slug, siteName)}/.ts-cloud/deploy-history.log`);
       const prefix = sedReplacement(siteName);
       return `TS_CLOUD_HISTORY=${historyPath}; { [ -f "$TS_CLOUD_HISTORY" ] && tail -n 24 "$TS_CLOUD_HISTORY" | sed "s/^/DEPLOY=${prefix}\\t/"; } || true`;
     }),
@@ -10673,7 +10674,7 @@ function resolveConfigOnlyServerDashboardData(config6, environment) {
       const kind = resolveSiteKind(site);
       return {
         ...s,
-        root: kind === "server-static" ? `/var/www/${s.name}` : `/var/www/${s.name}/current`,
+        root: kind === "server-static" ? siteInstallBase(config6.project.slug, s.name) : `${siteInstallBase(config6.project.slug, s.name)}/current`,
         branch: kind === "server-static" ? "build artifact" : "main",
         build: site.build,
         php: site.php ?? site.phpVersion,
@@ -10754,7 +10755,7 @@ async function resolveServerDashboardData(config6, environment) {
       const siteNames = Object.keys(config6.sites ?? {});
       const historyResult = await driver.runRemoteDeploy({
         targets: [targets[0]],
-        commands: deployHistoryScript(siteNames),
+        commands: deployHistoryScript(siteNames, config6.project.slug),
         comment: `ts-cloud dashboard:deploy-history ${config6.project.slug}`,
         tags: { Project: config6.project.slug, Environment: environment, Role: "app" }
       });
@@ -11013,7 +11014,7 @@ async function rollbackComputeSite(ctx, options) {
   const targets = await findTargets(ctx);
   if (targets.length === 0)
     return { success: false, error: `No '${ctx.role || "app"}' servers found for ${ctx.slug}/${ctx.environment}.` };
-  const appBase = `/var/www/${options.siteName}`;
+  const appBase = siteInstallBase(ctx.slug, options.siteName);
   const paths = releasePaths(appBase, options.to || "unused");
   const commands = [
     "set -uo pipefail",
@@ -11139,8 +11140,8 @@ function serviceCommand(verb, target) {
 function pantryEnvEval() {
   return `eval "$(cd ${PANTRY_PROJECT_DIR} && pantry env 2>/dev/null)"`;
 }
-function siteArtisanCommand(site, artisan) {
-  const current = `/var/www/${site}/current`;
+function siteArtisanCommand(slug, site, artisan) {
+  const current = `${siteInstallBase(slug, site)}/current`;
   return [
     "set -uo pipefail",
     `[ -d ${current} ] || { echo "site ${site} has no current release" >&2; exit 1; }`,
@@ -11149,7 +11150,7 @@ function siteArtisanCommand(site, artisan) {
 }
 function workerRestartCommand(framework, slug, site) {
   if (framework === "laravel")
-    return siteArtisanCommand(site, "queue:restart");
+    return siteArtisanCommand(slug, site, "queue:restart");
   const pattern = `${slug}-${site}-queue-*.service`;
   return [
     "set -uo pipefail",
@@ -11161,7 +11162,7 @@ function workerRestartCommand(framework, slug, site) {
 }
 function schedulerRunCommand(framework, slug, site) {
   if (framework === "laravel")
-    return siteArtisanCommand(site, "schedule:run");
+    return siteArtisanCommand(slug, site, "schedule:run");
   const unit = `${slug}-${site}-scheduler.service`;
   return [
     "set -uo pipefail",

package/dist/{chunk-6agm101w.js → chunk-qergre5a.js}

@@ -1659,6 +1659,9 @@ runcmd:
 }
 
 // src/deploy/site-target.ts
+function siteInstallBase(slug, siteName) {
+  return `/var/www/${slug}-${siteName}`;
+}
 var PHP_SITE_TYPES = new Set([
   "laravel",
   "php",
@@ -1815,6 +1818,7 @@ function resolveServerAppFrom(port, appBoxes) {
 }
 function buildRpxConfigInternal(sites, options, appBoxes) {
   const wwwRoot = (options.wwwRoot ?? "/var/www").replace(/\/+$/, "");
+  const installSlug = options.slug ?? "app";
   const certsDir = options.proxy.certsDir ?? DEFAULT_RPX_CERTS_DIR;
   const loadBalancer = options.proxy.loadBalancer;
   const proxies = [];
@@ -1849,7 +1853,7 @@ function buildRpxConfigInternal(sites, options, appBoxes) {
       proxies.push({
         to: site.domain,
         path,
-        static: `${wwwRoot}/${name}/current`,
+        static: `${wwwRoot}/${installSlug}-${name}/current`,
         cleanUrls: site.pathRewriteStyle !== "flat",
         spa: site.spa ?? false,
         ...auth ? { auth } : {},
@@ -2302,7 +2306,7 @@ class HetznerDriver {
     const sitePorts = this.collectUpstreamPorts(sites);
     const rpxProvision = compute.proxy?.engine === "rpx" ? buildRpxProvisionScript({
       proxy: compute.proxy,
-      config: buildRpxConfig(sites, { proxy: compute.proxy }),
+      config: buildRpxConfig(sites, { proxy: compute.proxy, slug: config.project.slug }),
       slug: config.project.slug,
       bunBin: compute.runtime === "node" || compute.runtime === "deno" ? undefined : "/usr/local/bin/bun"
     }) : undefined;
@@ -2651,7 +2655,7 @@ class HetznerDriver {
         const rpxProxy = compute.proxy?.engine === "rpx" ? compute.proxy : { engine: "rpx" };
         const lbRpxProvision = buildRpxProvisionScript({
           proxy: rpxProxy,
-          config: buildRpxLbConfig(sites, appBoxes, { proxy: rpxProxy }),
+          config: buildRpxLbConfig(sites, appBoxes, { proxy: rpxProxy, slug }),
           slug,
           bunBin: appProvisionScripts.runtime === "node" || appProvisionScripts.runtime === "deno" ? undefined : "/usr/local/bin/bun"
         });
@@ -3015,11 +3019,20 @@ ${out}`);
     "-o",
     "LogLevel=ERROR"
   ];
+  static SSH_KEEPALIVE_OPTS = [
+    "-o",
+    "ConnectTimeout=30",
+    "-o",
+    "ServerAliveInterval=15",
+    "-o",
+    "ServerAliveCountMax=4"
+  ];
   sshBaseArgs(host, extra = []) {
     return [
       "-i",
       this.sshPrivateKeyPath,
       ...HetznerDriver.SSH_HOST_KEY_OPTS,
+      ...HetznerDriver.SSH_KEEPALIVE_OPTS,
       "-o",
       "BatchMode=yes",
       ...extra,
@@ -3027,16 +3040,27 @@ ${out}`);
     ];
   }
   scpToHost(host, localPath, remotePath) {
-    execSync([
+    const cmd = [
       "scp",
       "-i",
       this.sshPrivateKeyPath,
       ...HetznerDriver.SSH_HOST_KEY_OPTS,
+      ...HetznerDriver.SSH_KEEPALIVE_OPTS,
       "-o",
       "BatchMode=yes",
       localPath,
       `${this.sshUser}@${host}:${remotePath}`
-    ].map((arg) => `"${arg.replace(/"/g, "\\\"")}"`).join(" "), { stdio: "pipe", maxBuffer: SSH_MAX_BUFFER });
+    ].map((arg) => `"${arg.replace(/"/g, "\\\"")}"`).join(" ");
+    const attempts = 3;
+    for (let attempt = 1;attempt <= attempts; attempt++) {
+      try {
+        execSync(cmd, { stdio: "pipe", maxBuffer: SSH_MAX_BUFFER });
+        return;
+      } catch (error) {
+        if (attempt === attempts)
+          throw new Error(formatSshFailure(error));
+      }
+    }
   }
   sshExec(host, script) {
     const escaped = script.replace(/'/g, `'\\''`);
@@ -4384,26 +4408,26 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
   if (isPhpSite(site)) {
     const compute2 = config.infrastructure?.compute;
     const phpVersion = site.phpVersion ?? compute2?.php?.default ?? compute2?.php?.versions?.[0];
-    const appBase = `/var/www/${siteName}`;
+    const appBase2 = siteInstallBase(slug, siteName);
     const dbEnv = outputs.servicesPrivateIp ? buildFleetServicesEnv(outputs.servicesPrivateIp, config.infrastructure?.appDatabase) : buildManagedDbEnv(config.infrastructure?.appDatabase);
     const siteWithEnv = Object.keys(dbEnv).length > 0 ? { ...site, env: { ...dbEnv, ...site.env || {} } } : site;
     const deployScript = buildLaravelDeployScript({
       siteName,
       site: siteWithEnv,
       releaseId: sha,
-      appBase,
+      appBase: appBase2,
       defaultPhpVersion: phpVersion
     });
     const useNginx = compute2?.webServer !== "rpx";
     const sslProvider = resolveSslProvider(site);
     const customCert = sslProvider === "custom" && site.ssl?.certPath && site.ssl?.keyPath ? { certPath: site.ssl.certPath, keyPath: site.ssl.keyPath } : undefined;
-    const poolScript = site.isolation ? buildPhpFpmPoolScript({ siteName, appBase }) : [];
+    const poolScript = site.isolation ? buildPhpFpmPoolScript({ siteName, appBase: appBase2 }) : [];
     const vhostScript = useNginx ? buildNginxVhostScript({
       siteName,
       domain: site.domain || siteName,
       aliases: site.aliases,
       type: site.type,
-      appDir: `${appBase}/current`,
+      appDir: `${appBase2}/current`,
       webDirectory: site.webDirectory,
       phpVersion,
       fastcgiPass: site.isolation ? phpFpmPoolListen(siteName) : undefined,
@@ -4417,12 +4441,12 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
       security: site.security
     }) : [];
     const sslScript = useNginx ? buildSslScript(site) : [];
-    const servicesScript2 = siteHasServices(site) ? buildSiteServicesScript({ slug, siteName, site, phpVersion, appBase }) : [];
+    const servicesScript2 = siteHasServices(site) ? buildSiteServicesScript({ slug, siteName, site, phpVersion, appBase: appBase2 }) : [];
     const healthCheckScript = useNginx ? buildHealthCheckScript(site) : [];
     logger.step(`Deploying PHP site '${siteName}' to ${targets.length} target(s)...`);
     const phpResult = await driver.runRemoteDeploy({
       targets,
-      commands: [...buildSiteOwnerGuard(appBase, slug), ...deployScript, ...poolScript, ...vhostScript, ...sslScript, ...servicesScript2, ...healthCheckScript],
+      commands: [...buildSiteOwnerGuard(appBase2, slug), ...deployScript, ...poolScript, ...vhostScript, ...sslScript, ...servicesScript2, ...healthCheckScript],
       comment: `ts-cloud deploy ${slug}/${siteName}@${sha}`,
       tags: { Project: slug, Environment: environment, Role: "app" }
     });
@@ -4455,14 +4479,17 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
   });
   const artifactFetch = driver.name === "aws" ? buildAwsArtifactFetch(outputs.deployBucketName, remoteKey, config.project.region || "us-east-1", siteName) : buildLocalArtifactFetch(uploadResult.artifactRef, siteName);
   const kind = resolveSiteKind(site);
+  const appBase = siteInstallBase(slug, siteName);
   const baseScript = kind === "server-static" ? buildStaticSiteDeployScript({
     siteName,
+    appDir: appBase,
     artifactFetch,
     releaseId: sha,
     preStartCommands: site.preStart
   }) : buildSiteDeployScript({
     siteName,
     slug,
+    appDir: appBase,
     artifactFetch,
     releaseId: sha,
     execStart: resolveExecStart(site.start, runtime),
@@ -4479,7 +4506,7 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
     domain: site.domain,
     aliases: site.aliases,
     type: site.type === "spa" ? "spa" : "static",
-    appDir: `/var/www/${siteName}/current`,
+    appDir: `${appBase}/current`,
     webDirectory: "",
     redirects: site.redirects,
     auth: site.auth && site.auth.enabled !== false && site.auth.password ? { username: site.auth.username || "admin", password: site.auth.password, realm: site.auth.realm } : undefined,
@@ -4490,14 +4517,14 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
     security: site.security
   }) : [];
   const staticSsl = wantsNginxStatic ? buildSslScript(site) : [];
-  const servicesScript = siteHasServices(site) ? buildSiteServicesScript({ slug, siteName, site, appBase: `/var/www/${siteName}` }) : [];
+  const servicesScript = siteHasServices(site) ? buildSiteServicesScript({ slug, siteName, site, appBase }) : [];
   const remoteScript = [
-    ...buildDeployHistoryHeader(`/var/www/${siteName}`, {
+    ...buildDeployHistoryHeader(appBase, {
       releaseId: sha,
       commit: sha,
       branch: site.branch ?? "main"
     }),
-    ...buildSiteOwnerGuard(`/var/www/${siteName}`, slug),
+    ...buildSiteOwnerGuard(appBase, slug),
     ...baseScript,
     ...staticVhost,
     ...staticSsl,
@@ -4620,7 +4647,7 @@ async function reloadRpxGateway(options) {
   if (proxy?.engine !== "rpx")
     return true;
   const sites = routeSource.sites || {};
-  const rpxConfig = buildRpxConfig(sites, { proxy });
+  const rpxConfig = buildRpxConfig(sites, { proxy, slug: config.project.slug });
   if (rpxConfig.proxies.length === 0) {
     logger.warn("rpx gateway: no server sites with a domain to route — skipping gateway reload.");
     return true;
@@ -4734,4 +4761,4 @@ function buildCloudFrontOriginConfig(options) {
     CustomErrorResponses: { Quantity: 0 }
   };
 }
-export { isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, HetznerClient, resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, buildAwsArtifactFetch, buildLocalArtifactFetch, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };
+export { siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, HetznerClient, resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, buildAwsArtifactFetch, buildLocalArtifactFetch, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };

package/dist/deploy/index.js

@@ -12,7 +12,7 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "../chunk-mbpxadga.js";
+} from "../chunk-pr3g0b0t.js";
 import {
   buildAndPushServerlessImage
 } from "../chunk-qgnyzfmx.js";
@@ -28,8 +28,9 @@ import {
   resolveSiteDeployTarget,
   resolveSiteKind,
   resolveUiSource,
+  siteInstallBase,
   validateDeploymentConfig
-} from "../chunk-6agm101w.js";
+} from "../chunk-qergre5a.js";
 import"../chunk-49nmy775.js";
 import"../chunk-93hjhs78.js";
 import {
@@ -54,6 +55,7 @@ export {
   validateDeploymentConfig,
   uploadStaticFiles,
   startLocalDashboardServer,
+  siteInstallBase,
   setMaintenance,
   sanitizeCloudConfig,
   runRemoteCommand,

package/dist/deploy/site-target.d.ts

@@ -10,6 +10,23 @@ import type { CloudConfig, SiteConfig, SiteDeployTarget } from '@ts-cloud/core';
  *                        the gateway answers `domain` with an HTTP redirect.
  */
 export type SiteDeployKind = 'bucket' | 'server-app' | 'server-static' | 'server-php' | 'redirect';
+/**
+ * On-disk base directory for a site's atomic release tree
+ * (`<base>/releases/<sha>` + `<base>/current`).
+ *
+ * Namespaced by the project **slug** so that on a shared / multi-tenant box
+ * (`cloud.attachTo`) two projects — or a tenant and the box owner — can never
+ * collide on the same `/var/www/<name>` path. A bare `/var/www/<siteName>`
+ * meant that e.g. every project with a `main` site fought over `/var/www/main`,
+ * silently overwriting each other's releases and round-robining stale responses
+ * on the shared port. This mirrors the systemd unit naming (`<slug>-<siteName>`)
+ * so a release directory and the service that runs it share one identity.
+ *
+ * MUST be the single source of truth for the install path — deploy, rpx routing
+ * (server-static), rollback/ops, and dashboard data all derive from it, so they
+ * can never diverge.
+ */
+export declare function siteInstallBase(slug: string, siteName: string): string;
 /**
  * A PHP/Laravel site: deployed to the compute box via git clone into atomic
  * release directories and served by nginx + php-fpm. Identified by a PHP

package/dist/drivers/hetzner/driver.d.ts

@@ -135,6 +135,14 @@ export declare class HetznerDriver implements CloudDriver {
      * `REMOTE HOST IDENTIFICATION HAS CHANGED`.
      */
     private static readonly SSH_HOST_KEY_OPTS;
+    /**
+     * Keepalive + connect timeout for every ssh/scp. Without these a connection
+     * that stalls mid-transfer (a flaky network, an sshd hiccup) hangs the deploy
+     * FOREVER — execSync has no timeout, so a dead socket blocks the whole run.
+     * ServerAlive probes abort a silent connection after ~60s (15s × 4) so the
+     * transfer fails loudly (and, for scp, is retried) instead of wedging.
+     */
+    private static readonly SSH_KEEPALIVE_OPTS;
     private sshBaseArgs;
     private scpToHost;
     private sshExec;

package/dist/drivers/index.js

@@ -48,7 +48,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "../chunk-6agm101w.js";
+} from "../chunk-qergre5a.js";
 import"../chunk-49nmy775.js";
 import"../chunk-93hjhs78.js";
 import"../chunk-qpj3edwz.js";

package/dist/drivers/shared/rpx-gateway.d.ts

@@ -138,6 +138,14 @@ export interface BuildRpxConfigOptions {
     proxy: ComputeProxyConfig;
     /** Directory static sites are shipped to. @default '/var/www' */
     wwwRoot?: string;
+    /**
+     * Project slug — server-static routes are served from the slug-namespaced
+     * install dir (`<wwwRoot>/<slug>-<name>/current`), matching where the deploy
+     * ships them (see {@link siteInstallBase}). Omitted ⇒ `app` (single-tenant
+     * back-compat). MUST be set on a shared box or static routes point at the
+     * wrong directory.
+     */
+    slug?: string;
 }
 /**
  * Normalize a path prefix to a leading-slash, no-trailing-slash form, or

package/dist/index.js

@@ -55,7 +55,7 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "./chunk-mbpxadga.js";
+} from "./chunk-pr3g0b0t.js";
 import {
   buildAndPushServerlessImage
 } from "./chunk-qgnyzfmx.js";
@@ -105,7 +105,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-6agm101w.js";
+} from "./chunk-qergre5a.js";
 import {
   ABTestManager,
   AI,