@stacksjs/ts-cloud 0.7.20 → 0.7.22

package/dist/{chunk-49nmy775.js → chunk-0tfwdnmf.js}

@@ -21901,6 +21901,8 @@ function createDashboardSite(options) {
     }
   };
 }
+var DASHBOARD_STATE_DIR = ".ts-cloud";
+var DASHBOARD_ENTRY = "./node_modules/@stacksjs/ts-cloud/dist/bin/cli.js";
 function apexOf(domain) {
   const parts = domain.split(".").filter(Boolean);
   return parts.length <= 2 ? domain : parts.slice(-2).join(".");
@@ -21963,7 +21965,7 @@ function resolveManagementDashboardSites(config, environment, opts) {
     return [];
   const auth2 = opts.password ? { auth: { username: opts.username || "admin", password: opts.password, realm: opts.realm } } : {};
   const build = opts.build === false || opts.build === undefined ? {} : { build: opts.build };
-  if (opts.live) {
+  if (opts.live !== false) {
     const domain = resolveDashboardDomain(config, environment, opts.domain);
     if (!domain)
       return [];
@@ -21972,11 +21974,12 @@ function resolveManagementDashboardSites(config, environment, opts) {
       root: opts.uiRoot,
       deploy: "server",
       domain,
-      start: `cloud dashboard:serve --box --host 127.0.0.1 --port ${port}`,
+      preStart: ["bun install --production --no-save"],
+      start: `bun ${DASHBOARD_ENTRY} dashboard:serve --box --host 127.0.0.1 --port ${port}`,
       port,
-      ssl: { provider: "letsencrypt" },
-      ...build,
-      ...auth2
+      sharedPaths: [DASHBOARD_STATE_DIR],
+      healthCheck: { path: "/login" },
+      ssl: { provider: "letsencrypt" }
     };
     return [{ name: managementDashboardSiteName(domain), site }];
   }
@@ -46152,4 +46155,4 @@ class ResourceManagementManager {
 }
 var resourceManagementManager = new ResourceManagementManager;
 
-export { detectServiceRegion, signRequest, signRequestAsync, createPresignedUrl, createPresignedUrlAsync, makeAWSRequest, makeAWSRequestOnce, makeAWSRequestAsync, parseXMLResponse, parseJSONResponse, clearSigningKeyCache, getSigningKeyCacheSize, isNodeCryptoAvailable, isWebCryptoAvailable, QueuePresets, RealtimePresets, detectDeploymentTargets, resolveDeploymentMode, deploymentCoexistenceError, resolveCloudProvider, TemplateBuilder, Pseudo, generateResourceName, generateLogicalId, getTimestamp, sanitizeName, resolveProjectStackName, resolveSiteStackName, resolveSiteResourceName, resolveSiteBucketName, resolveStorageBucketName, resolveDeployBucketName, resolveServerlessAppStackName, resolveServerlessArtifactBucketName, resolveServerlessAssetBucketName, DependencyGraph, analyzeStackDiff, formatDiff, Storage, Registry, CDN, DNS, Security, Compute, Network, FileSystem, Email, exports_incoming_call, Phone, Queue, JobLoader, StacksIntegration, exports_send, SMS, AI, Database, Cache, Permissions, ApiGateway, Messaging, Workflow, Monitoring, Auth, Deployment, AssetHasher, Secrets, ParameterStore, Search, Redirects, Communication, Fn2, Arn, AWS_PSEUDO_PARAMETERS, CloudFormationBuilder, buildCloudFormationTemplate, createStaticSitePreset, createNodeJsServerPreset, createNodeJsServerlessPreset, createServerlessNodePreset, createFullStackAppPreset, createApiBackendPreset, createWordPressPreset, createJamstackPreset, createMicroservicesPreset, createRealtimeAppPreset, createDataPipelinePreset, createMLApiPreset, createTraditionalWebAppPreset, createLaravelPreset, createServerlessLaravelPreset, createDashboardSite, resolveDashboardDomain, resolveDashboardDomains, hasManagementDashboardSite, MANAGEMENT_DASHBOARD_SITE_PREFIX, managementDashboardSiteName, isManagementDashboardSiteName, resolveManagementDashboardSites, resolveManagementDashboardSite, extendPreset, composePresets, createPreset, mergeInfrastructure, withMonitoring, withSecurity, withDatabase, withCache, withCDN, withQueue, fromEnvironment, fromSharedCredentials, fromEC2Metadata, fromECSMetadata, fromWebIdentity, getCredentials, createCredentialProvider, resolveCredentials, resolveRegion, getAccountId, S3Error, createS3Client, CloudError, ConfigurationError, CredentialError, DeploymentError, ValidationError, AWSAPIError, ErrorCodes, getErrorDetails, createError, DebugLogger, validateConfiguration, detectMisconfigurations, validateCredentials, checkIAMPermissions, getRequiredPermissions, suggestIAMPolicy, DEFAULT_SERVICE_LIMITS, checkServiceQuotas, getQuotaUsageSummary, suggestQuotaIncrease, FileCache, TemplateCache, templateCache, hashFile, hashString, hashBuffer, hashDirectory, hashManifest, quickHash, findChangedFiles, HashCache, parallel, batch, parallelMap, parallelWithRetry, sequence, withTimeout, RateLimiter, chunk, processInChunks, diffTemplates, getDiffSummary, requiresReplacement, categorizeChanges, getDeploymentStrategy, getDiffStats, cloud_config_schema_default, validateAgainstSchema, defaultLocalConfig, getLocalConfig, isLocalDevelopment, getLocalEndpoint, getLocalCredentials, getLocalEnvVars, MockCloudFormation, MockS3, MockDynamoDB, createMockAWS, PreviewEnvironmentManager, previewManager, generatePreviewWorkflow, generateCleanupWorkflow, generateCostReportWorkflow, PreviewNotificationService, previewNotifications, formatTable, formatTree, formatProgressBar, formatBytes, formatDuration, formatList, formatKeyValue, ProgressBar, MultiStepProgress, Spinner, TaskList, suggestCommand, formatSuggestion, isLikelyTypo, getContextualHelp, searchCommands, autocomplete, suggestFlags, formatFlagSuggestions, getCommandUsage, validateCommand, REPL, REPLContext, REPLCommandBuilder, CommandHistory, formatHistory, formatHistoryStats, MultiRegionManager, multiRegionManager, CrossRegionReferenceManager, GlobalResourceManager, RegionPairManager, StackDependencyManager, crossRegionReferenceManager, globalResourceManager, regionPairManager, stackDependencyManager, AWS_REGIONS, getRegion, getAllRegions, getRegionsByLocation, getRegionsByCompliance, getRegionsByPricingTier, isValidRegion, getClosestRegion, suggestRegions, suggestRegionPairs, formatRegion, formatRegionList, getRegionStats, MultiAccountManager, OrganizationManager, multiAccountManager, organizationManager, RECOMMENDED_ACCOUNT_STRUCTURES, RECOMMENDED_SCPS, COMMON_CROSS_ACCOUNT_ROLES, getRecommendedStructure, generateCrossAccountRoleCF, validateAccountStructure, formatAccountStructure, generateDeploymentWorkflow, generateMultiEnvWorkflow, generatePRPreviewWorkflow, generateScheduledWorkflow, generateMatrixWorkflow, generateDeploymentPipeline, generateMultiEnvPipeline, generatePreviewPipeline, generateScheduledPipeline, generateManualPipeline, generateDeploymentConfig, generateMultiEnvConfig, generateScheduledConfig, generateApprovalConfig, generateParallelConfig, BackupManager, backupManager, DisasterRecoveryManager, drManager, AWSConfigManager, awsConfigManager, CloudTrailManager, cloudTrailManager, GuardDutyManager, guardDutyManager, SecurityHubManager, securityHubManager, BlueGreenManager, blueGreenManager, CanaryManager, canaryManager, ABTestManager, abTestManager, ProgressiveDeploymentManager, progressiveDeploymentManager, XRayManager, xrayManager, MetricsManager, metricsManager, LogsManager, logsManager, SyntheticsManager, syntheticsManager, MigrationManager, migrationManager, ReplicaManager, replicaManager, PerformanceManager, performanceManager, DatabaseUserManager, databaseUserManager, SecretsRotationManager, secretsRotationManager, SecretsManager, secretsManager, CertificateManager, certificateManager, SecurityScanningManager, securityScanningManager, ImageScanningManager, imageScanningManager, BuildOptimizationManager, buildOptimizationManager, ContainerRegistryManager, containerRegistryManager, ServiceMeshManager, serviceMeshManager, LambdaLayersManager, lambdaLayersManager, LambdaVersionsManager, lambdaVersionsManager, LambdaConcurrencyManager, lambdaConcurrencyManager, LambdaDestinationsManager, lambdaDestinationsManager, LambdaVPCManager, lambdaVPCManager, LambdaDLQManager, lambdaDLQManager, Route53RoutingManager, route53RoutingManager, DNSSECManager, dnssecManager, Route53ResolverManager, route53ResolverManager, BounceComplaintHandler, bounceComplaintHandler, EmailAnalyticsManager, emailAnalyticsManager, SenderReputationManager, senderReputationManager, EmailTemplateManager, emailTemplateManager, exports_advanced, exports_inbound, exports_advanced2, exports_advanced3, FIFOQueueManager, fifoQueueManager, DLQMonitoringManager, dlqMonitoringManager, BatchProcessingManager, batchProcessingManager, QueueManagementManager, queueManagementManager, createZip, generateBootstrap, runBuildHooks, sha256, artifactKey, packageServerlessApp, MANAGED_NODE_VERSIONS, resolveServerlessRuntime, resolveQueues, resolveQueueNames, composeServerlessAppTemplate, PHP_LAYER_EXTENSIONS, phpLayerPackages, phpLayerBuildStage, generatePhpLayerDockerfile, generateAppImageDockerfile, sharedRuntimeLoop, buildNodeRuntimeLayerZip, buildBunRuntimeLayerZip, resolveApp, eventToRequest, responseToResult, createHttpHandler, createQueueHandler, createCliHandler, createHandlers, generatePhpFpmConfig, phpRuntimeLayerAssets, laravelServerlessEnvDefaults, LARAVEL_SERVERLESS_BUILD_STEPS, buildPhpRuntimeLayerZip, PHP_DEFAULT_EXCLUDES, runPhpBuildHooks, collectPhpAppEntries, packagePhpApp, StaticSiteManager, staticSiteManager, StorageAdvancedManager, storageAdvancedManager, HealthCheckManager, healthCheckManager, NetworkSecurityManager, networkSecurityManager, ResourceManagementManager, resourceManagementManager };
+export { detectServiceRegion, signRequest, signRequestAsync, createPresignedUrl, createPresignedUrlAsync, makeAWSRequest, makeAWSRequestOnce, makeAWSRequestAsync, parseXMLResponse, parseJSONResponse, clearSigningKeyCache, getSigningKeyCacheSize, isNodeCryptoAvailable, isWebCryptoAvailable, QueuePresets, RealtimePresets, detectDeploymentTargets, resolveDeploymentMode, deploymentCoexistenceError, resolveCloudProvider, TemplateBuilder, Pseudo, generateResourceName, generateLogicalId, getTimestamp, sanitizeName, resolveProjectStackName, resolveSiteStackName, resolveSiteResourceName, resolveSiteBucketName, resolveStorageBucketName, resolveDeployBucketName, resolveServerlessAppStackName, resolveServerlessArtifactBucketName, resolveServerlessAssetBucketName, DependencyGraph, analyzeStackDiff, formatDiff, Storage, Registry, CDN, DNS, Security, Compute, Network, FileSystem, Email, exports_incoming_call, Phone, Queue, JobLoader, StacksIntegration, exports_send, SMS, AI, Database, Cache, Permissions, ApiGateway, Messaging, Workflow, Monitoring, Auth, Deployment, AssetHasher, Secrets, ParameterStore, Search, Redirects, Communication, Fn2, Arn, AWS_PSEUDO_PARAMETERS, CloudFormationBuilder, buildCloudFormationTemplate, createStaticSitePreset, createNodeJsServerPreset, createNodeJsServerlessPreset, createServerlessNodePreset, createFullStackAppPreset, createApiBackendPreset, createWordPressPreset, createJamstackPreset, createMicroservicesPreset, createRealtimeAppPreset, createDataPipelinePreset, createMLApiPreset, createTraditionalWebAppPreset, createLaravelPreset, createServerlessLaravelPreset, createDashboardSite, DASHBOARD_STATE_DIR, DASHBOARD_ENTRY, resolveDashboardDomain, resolveDashboardDomains, hasManagementDashboardSite, MANAGEMENT_DASHBOARD_SITE_PREFIX, managementDashboardSiteName, isManagementDashboardSiteName, resolveManagementDashboardSites, resolveManagementDashboardSite, extendPreset, composePresets, createPreset, mergeInfrastructure, withMonitoring, withSecurity, withDatabase, withCache, withCDN, withQueue, fromEnvironment, fromSharedCredentials, fromEC2Metadata, fromECSMetadata, fromWebIdentity, getCredentials, createCredentialProvider, resolveCredentials, resolveRegion, getAccountId, S3Error, createS3Client, CloudError, ConfigurationError, CredentialError, DeploymentError, ValidationError, AWSAPIError, ErrorCodes, getErrorDetails, createError, DebugLogger, validateConfiguration, detectMisconfigurations, validateCredentials, checkIAMPermissions, getRequiredPermissions, suggestIAMPolicy, DEFAULT_SERVICE_LIMITS, checkServiceQuotas, getQuotaUsageSummary, suggestQuotaIncrease, FileCache, TemplateCache, templateCache, hashFile, hashString, hashBuffer, hashDirectory, hashManifest, quickHash, findChangedFiles, HashCache, parallel, batch, parallelMap, parallelWithRetry, sequence, withTimeout, RateLimiter, chunk, processInChunks, diffTemplates, getDiffSummary, requiresReplacement, categorizeChanges, getDeploymentStrategy, getDiffStats, cloud_config_schema_default, validateAgainstSchema, defaultLocalConfig, getLocalConfig, isLocalDevelopment, getLocalEndpoint, getLocalCredentials, getLocalEnvVars, MockCloudFormation, MockS3, MockDynamoDB, createMockAWS, PreviewEnvironmentManager, previewManager, generatePreviewWorkflow, generateCleanupWorkflow, generateCostReportWorkflow, PreviewNotificationService, previewNotifications, formatTable, formatTree, formatProgressBar, formatBytes, formatDuration, formatList, formatKeyValue, ProgressBar, MultiStepProgress, Spinner, TaskList, suggestCommand, formatSuggestion, isLikelyTypo, getContextualHelp, searchCommands, autocomplete, suggestFlags, formatFlagSuggestions, getCommandUsage, validateCommand, REPL, REPLContext, REPLCommandBuilder, CommandHistory, formatHistory, formatHistoryStats, MultiRegionManager, multiRegionManager, CrossRegionReferenceManager, GlobalResourceManager, RegionPairManager, StackDependencyManager, crossRegionReferenceManager, globalResourceManager, regionPairManager, stackDependencyManager, AWS_REGIONS, getRegion, getAllRegions, getRegionsByLocation, getRegionsByCompliance, getRegionsByPricingTier, isValidRegion, getClosestRegion, suggestRegions, suggestRegionPairs, formatRegion, formatRegionList, getRegionStats, MultiAccountManager, OrganizationManager, multiAccountManager, organizationManager, RECOMMENDED_ACCOUNT_STRUCTURES, RECOMMENDED_SCPS, COMMON_CROSS_ACCOUNT_ROLES, getRecommendedStructure, generateCrossAccountRoleCF, validateAccountStructure, formatAccountStructure, generateDeploymentWorkflow, generateMultiEnvWorkflow, generatePRPreviewWorkflow, generateScheduledWorkflow, generateMatrixWorkflow, generateDeploymentPipeline, generateMultiEnvPipeline, generatePreviewPipeline, generateScheduledPipeline, generateManualPipeline, generateDeploymentConfig, generateMultiEnvConfig, generateScheduledConfig, generateApprovalConfig, generateParallelConfig, BackupManager, backupManager, DisasterRecoveryManager, drManager, AWSConfigManager, awsConfigManager, CloudTrailManager, cloudTrailManager, GuardDutyManager, guardDutyManager, SecurityHubManager, securityHubManager, BlueGreenManager, blueGreenManager, CanaryManager, canaryManager, ABTestManager, abTestManager, ProgressiveDeploymentManager, progressiveDeploymentManager, XRayManager, xrayManager, MetricsManager, metricsManager, LogsManager, logsManager, SyntheticsManager, syntheticsManager, MigrationManager, migrationManager, ReplicaManager, replicaManager, PerformanceManager, performanceManager, DatabaseUserManager, databaseUserManager, SecretsRotationManager, secretsRotationManager, SecretsManager, secretsManager, CertificateManager, certificateManager, SecurityScanningManager, securityScanningManager, ImageScanningManager, imageScanningManager, BuildOptimizationManager, buildOptimizationManager, ContainerRegistryManager, containerRegistryManager, ServiceMeshManager, serviceMeshManager, LambdaLayersManager, lambdaLayersManager, LambdaVersionsManager, lambdaVersionsManager, LambdaConcurrencyManager, lambdaConcurrencyManager, LambdaDestinationsManager, lambdaDestinationsManager, LambdaVPCManager, lambdaVPCManager, LambdaDLQManager, lambdaDLQManager, Route53RoutingManager, route53RoutingManager, DNSSECManager, dnssecManager, Route53ResolverManager, route53ResolverManager, BounceComplaintHandler, bounceComplaintHandler, EmailAnalyticsManager, emailAnalyticsManager, SenderReputationManager, senderReputationManager, EmailTemplateManager, emailTemplateManager, exports_advanced, exports_inbound, exports_advanced2, exports_advanced3, FIFOQueueManager, fifoQueueManager, DLQMonitoringManager, dlqMonitoringManager, BatchProcessingManager, batchProcessingManager, QueueManagementManager, queueManagementManager, createZip, generateBootstrap, runBuildHooks, sha256, artifactKey, packageServerlessApp, MANAGED_NODE_VERSIONS, resolveServerlessRuntime, resolveQueues, resolveQueueNames, composeServerlessAppTemplate, PHP_LAYER_EXTENSIONS, phpLayerPackages, phpLayerBuildStage, generatePhpLayerDockerfile, generateAppImageDockerfile, sharedRuntimeLoop, buildNodeRuntimeLayerZip, buildBunRuntimeLayerZip, resolveApp, eventToRequest, responseToResult, createHttpHandler, createQueueHandler, createCliHandler, createHandlers, generatePhpFpmConfig, phpRuntimeLayerAssets, laravelServerlessEnvDefaults, LARAVEL_SERVERLESS_BUILD_STEPS, buildPhpRuntimeLayerZip, PHP_DEFAULT_EXCLUDES, runPhpBuildHooks, collectPhpAppEntries, packagePhpApp, StaticSiteManager, staticSiteManager, StorageAdvancedManager, storageAdvancedManager, HealthCheckManager, healthCheckManager, NetworkSecurityManager, networkSecurityManager, ResourceManagementManager, resourceManagementManager };

package/dist/{chunk-qgnyzfmx.js → chunk-5mejsd43.js}

@@ -8,7 +8,7 @@ import {
   phpRuntimeLayerAssets,
   runPhpBuildHooks,
   sha256
-} from "./chunk-49nmy775.js";
+} from "./chunk-0tfwdnmf.js";
 
 // src/deploy/serverless-image.ts
 import { execFileSync } from "node:child_process";

package/dist/{chunk-296n8hvt.js → chunk-c3yy2xyq.js}

@@ -1,8 +1,8 @@
 import {
   buildAndPushServerlessImage
-} from "./chunk-qgnyzfmx.js";
+} from "./chunk-5mejsd43.js";
 import"./chunk-hsk6fe6x.js";
-import"./chunk-49nmy775.js";
+import"./chunk-0tfwdnmf.js";
 import"./chunk-arsh1g5h.js";
 import"./chunk-v0bahtg2.js";
 export {

package/dist/{chunk-qdhn1s7j.js → chunk-js3vrvvn.js}

@@ -6,7 +6,7 @@ import {
   step,
   success,
   warn
-} from "./chunk-qgnyzfmx.js";
+} from "./chunk-5mejsd43.js";
 import {
   CloudWatchLogsClient,
   CostExplorerClient,
@@ -28,7 +28,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-xgnxz5dz.js";
+} from "./chunk-kcxxwg3j.js";
 import {
   artifactKey,
   composeServerlessAppTemplate,
@@ -42,7 +42,7 @@ import {
   resolveServerlessArtifactBucketName,
   resolveServerlessAssetBucketName,
   resolveServerlessRuntime
-} from "./chunk-49nmy775.js";
+} from "./chunk-0tfwdnmf.js";
 import {
   deployStaticSiteWithExternalDnsFull
 } from "./chunk-d7p84vz5.js";
@@ -347,7 +347,7 @@ async function deployServerlessApp(config, environment, opts = {}) {
   }
   if (imageMode) {
     step("Building + pushing container image");
-    const { buildAndPushServerlessImage } = await import("./chunk-296n8hvt.js");
+    const { buildAndPushServerlessImage } = await import("./chunk-c3yy2xyq.js");
     const built = await buildAndPushServerlessImage({
       app,
       projectRoot,
@@ -11834,6 +11834,135 @@ function scopeCloudConfig(config6, user) {
   };
 }
 
+// src/deploy/dashboard-site-settings.ts
+var MEMBER_EDITABLE_SITE_FIELDS = new Set([
+  "name",
+  "ssl",
+  "env",
+  "redirects",
+  "aliases",
+  "domain",
+  "path"
+]);
+var ADMIN_ONLY_SITE_FIELDS = {
+  build: "build runs as a shell command on the server",
+  start: "start runs as a shell command on the server",
+  root: "root is a filesystem path on the shared server",
+  port: "ports are allocated by the server owner",
+  type: "the deploy type is set by the server owner",
+  php: "the PHP runtime is set by the server owner"
+};
+function checkMemberSiteFields(body) {
+  const touched = Object.keys(body).filter((key) => body[key] !== undefined);
+  const forbidden = touched.filter((key) => (key in ADMIN_ONLY_SITE_FIELDS));
+  if (forbidden.length) {
+    const reasons = forbidden.map((key) => `${key} (${ADMIN_ONLY_SITE_FIELDS[key]})`).join(", ");
+    return { ok: false, error: `Only the server owner can change ${reasons}.` };
+  }
+  const unknown = touched.filter((key) => !MEMBER_EDITABLE_SITE_FIELDS.has(key));
+  if (unknown.length)
+    return { ok: false, error: `Only the server owner can change ${unknown.join(", ")}.` };
+  return { ok: true };
+}
+function normalizeHost(value) {
+  return String(value ?? "").trim().toLowerCase().replace(/\.$/, "");
+}
+function normalizePath(value) {
+  const path = String(value ?? "/").trim();
+  if (!path || path === "/")
+    return "/";
+  return (path.startsWith("/") ? path : `/${path}`).replace(/\/+$/, "") || "/";
+}
+function siteHosts(site) {
+  const hosts = [normalizeHost(site?.domain)];
+  if (Array.isArray(site?.aliases))
+    hosts.push(...site.aliases.map(normalizeHost));
+  return hosts.filter(Boolean);
+}
+function checkRouteConflict({ siteName, body, sites, ownSites }) {
+  const current = sites[siteName] ?? {};
+  const owned = new Set(ownSites);
+  const wantedHosts = new Set;
+  if (body.domain !== undefined)
+    wantedHosts.add(normalizeHost(body.domain));
+  if (Array.isArray(body.aliases))
+    for (const alias of body.aliases)
+      wantedHosts.add(normalizeHost(alias));
+  wantedHosts.delete("");
+  if (wantedHosts.size === 0)
+    return { ok: true };
+  const wantedPath = normalizePath(body.path !== undefined ? body.path : current.path);
+  for (const [otherName, other] of Object.entries(sites)) {
+    if (otherName === siteName || owned.has(otherName))
+      continue;
+    const otherPath = normalizePath(other?.path);
+    for (const host of siteHosts(other)) {
+      if (!wantedHosts.has(host))
+        continue;
+      if (otherPath === wantedPath) {
+        return {
+          ok: false,
+          error: `${host}${wantedPath === "/" ? "" : wantedPath} is already served by another site on this server.`
+        };
+      }
+    }
+  }
+  return { ok: true };
+}
+
+// src/deploy/dashboard-throttle.ts
+var MAX_ATTEMPTS = 8;
+var LOCKOUT_MS = 15 * 60 * 1000;
+var WINDOW_MS = 15 * 60 * 1000;
+
+class LoginThrottle {
+  maxAttempts;
+  lockoutMs;
+  windowMs;
+  attempts = new Map;
+  constructor(maxAttempts = MAX_ATTEMPTS, lockoutMs = LOCKOUT_MS, windowMs = WINDOW_MS) {
+    this.maxAttempts = maxAttempts;
+    this.lockoutMs = lockoutMs;
+    this.windowMs = windowMs;
+  }
+  key(username, address) {
+    return `${username.trim().toLowerCase()}\x00${address}`;
+  }
+  check(username, address, now = Date.now()) {
+    const entry = this.attempts.get(this.key(username, address));
+    if (!entry?.until)
+      return { allowed: true };
+    if (now >= entry.until) {
+      this.attempts.delete(this.key(username, address));
+      return { allowed: true };
+    }
+    return { allowed: false, retryAfterSeconds: Math.ceil((entry.until - now) / 1000) };
+  }
+  recordFailure(username, address, now = Date.now()) {
+    const key = this.key(username, address);
+    const entry = this.attempts.get(key);
+    const stale = !entry || now - entry.last > this.windowMs;
+    const count = stale ? 1 : entry.count + 1;
+    const next = { count, last: now };
+    if (count >= this.maxAttempts)
+      next.until = now + this.lockoutMs;
+    this.attempts.set(key, next);
+  }
+  recordSuccess(username, address) {
+    this.attempts.delete(this.key(username, address));
+  }
+  prune(now = Date.now()) {
+    for (const [key, entry] of this.attempts) {
+      const expired = entry.until ? now >= entry.until : now - entry.last > this.windowMs;
+      if (expired)
+        this.attempts.delete(key);
+    }
+  }
+  get size() {
+    return this.attempts.size;
+  }
+}
+
 // src/deploy/firewall-config-editor.ts
 var ALWAYS_OPEN = new Set([22, 80, 443]);
 function isValidPort(port) {
@@ -12988,6 +13117,9 @@ async function startLocalDashboardServer(options = {}) {
   const authEnabled = !authDisabled;
   const secret = resolveSessionSecret(cwd);
   const guard = createDashboardGuard({ cwd, enabled: authEnabled, secret });
+  const throttle = new LoginThrottle;
+  const throttleSweep = setInterval(() => throttle.prune(), 5 * 60 * 1000);
+  throttleSweep.unref?.();
   if (authEnabled) {
     const bootstrap = ensureAdminUser(cwd, process.env.TS_CLOUD_UI_USERNAME?.trim() || "admin");
     if (bootstrap.generated) {
@@ -13040,11 +13172,19 @@ async function startLocalDashboardServer(options = {}) {
           const body = await readJsonBody(req);
           const username = String(body.username ?? "").trim();
           const password = String(body.password ?? "");
+          const address = server2.requestIP(req)?.address ?? "unknown";
+          const gate = throttle.check(username, address);
+          if (!gate.allowed) {
+            return json({ ok: false, error: `Too many failed attempts. Try again in ${Math.ceil((gate.retryAfterSeconds ?? 0) / 60)} minute(s).` }, 429, { "retry-after": String(gate.retryAfterSeconds ?? 60) });
+          }
           const user2 = findUser(loadUsers(cwd), username);
           const hash = user2?.passwordHash || DUMMY_HASH;
           const ok = verifyPassword(password, hash) && !!user2;
-          if (!ok)
+          if (!ok) {
+            throttle.recordFailure(username, address);
             return json({ ok: false, error: "Incorrect username or password." }, 401);
+          }
+          throttle.recordSuccess(username, address);
           const token = createSessionToken(user2.username, secret);
           return json({ ok: true, user: describeUser(user2) }, 200, {
             "set-cookie": serializeSessionCookie(token, { secure: cookieSecure })
@@ -13248,6 +13388,19 @@ async function startLocalDashboardServer(options = {}) {
           const existing = config6.sites?.[name];
           if (!name || !existing)
             return json({ ok: false, error: `Site '${name}' was not found.` }, 404);
+          if (user.role === "member") {
+            const fields = checkMemberSiteFields(body);
+            if (!fields.ok)
+              return json({ ok: false, error: fields.error }, 403);
+            const conflict = checkRouteConflict({
+              siteName: name,
+              body,
+              sites: config6.sites ?? {},
+              ownSites: Object.keys(user.sites)
+            });
+            if (!conflict.ok)
+              return json({ ok: false, error: conflict.error }, 409);
+          }
           if (body.port !== undefined && body.port !== null && body.port !== "" && (!Number.isInteger(Number(body.port)) || Number(body.port) < 1 || Number(body.port) > 65535))
             return json({ ok: false, error: "Port must be a number between 1 and 65535." }, 422);
           let text2 = await readFile(configPath, "utf8");

package/dist/{chunk-xgnxz5dz.js → chunk-kcxxwg3j.js}

@@ -5,7 +5,7 @@ import {
   resolveCloudProvider,
   resolveManagementDashboardSites,
   resolveProjectStackName
-} from "./chunk-49nmy775.js";
+} from "./chunk-0tfwdnmf.js";
 import {
   EC2Client,
   SSMClient
@@ -3579,7 +3579,9 @@ function releasePaths(base, releaseId) {
 }
 function isFileSharedPath(p) {
   const name = p.split("/").pop() || p;
-  return name.startsWith(".") || /\.[a-z0-9]+$/i.test(name);
+  if (name === ".env" || name.startsWith(".env."))
+    return true;
+  return /\.[a-z0-9]+$/i.test(name);
 }
 function buildEnsureReleaseLayout(paths, sharedPaths = DEFAULT_SHARED_PATHS) {
   const lines = [
@@ -3706,7 +3708,7 @@ function buildSiteDeployScript(options) {
   const paths = releasePaths(base, releaseId);
   const unitBase = `${slug}-${siteName}`;
   const serviceName = `${unitBase}.service`;
-  const sharedPaths = [".env"];
+  const sharedPaths = [...new Set([".env", ...options.sharedPaths ?? []])];
   const envFile = formatEnvFile(envEntries);
   const preStart = preStartCommands.length > 0 ? [`cd ${paths.release}`, ...preStartCommands] : [];
   const stageRelease = [
@@ -3816,14 +3818,14 @@ function buildLocalArtifactFetch(localPath, siteName) {
   ];
 }
 // src/drivers/shared/compute-deploy.ts
-import { copyFileSync } from "node:fs";
+import { copyFileSync as copyFileSync2 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
 import { join as join5 } from "node:path";
 
 // src/deploy/management-dashboard.ts
 import { execSync as execSync2 } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { chmodSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync3, writeFileSync } from "node:fs";
+import { chmodSync, copyFileSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync3, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, isAbsolute, join as join4 } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -3862,6 +3864,57 @@ var noopLogger = { info: () => {}, warn: () => {} };
 function truthy(v) {
   return v != null && v !== "" && v !== "0" && v.toLowerCase() !== "false";
 }
+var LIVE_STAGE_DIR = join4(".ts-cloud", "dashboard-release");
+var CONFIG_CANDIDATES = [
+  ["config", "cloud.ts"],
+  ["config", "cloud.js"],
+  ["cloud.config.ts"],
+  ["cloud.config.js"]
+];
+function resolveDashboardVersion() {
+  const explicit = process.env.TS_CLOUD_UI_VERSION?.trim();
+  if (explicit)
+    return explicit;
+  const here = dirname(fileURLToPath(import.meta.url));
+  for (const candidate of [join4(here, "..", "..", "package.json"), join4(here, "..", "package.json")]) {
+    try {
+      const pkg = JSON.parse(readFileSync3(candidate, "utf8"));
+      if (pkg.name === "@stacksjs/ts-cloud" && pkg.version)
+        return `^${pkg.version}`;
+    } catch {}
+  }
+  return "latest";
+}
+function stageLiveDashboardRoot(cwd, logger) {
+  const source = CONFIG_CANDIDATES.map((parts) => join4(cwd, ...parts)).find((file) => existsSync2(file));
+  if (!source) {
+    logger.warn("Management dashboard: no cloud config found to ship — skipping the live dashboard.");
+    return null;
+  }
+  const stage = join4(cwd, LIVE_STAGE_DIR);
+  try {
+    mkdirSync(stage, { recursive: true });
+    const isStacksLayout = source.endsWith(join4("config", "cloud.ts")) || source.endsWith(join4("config", "cloud.js"));
+    if (isStacksLayout) {
+      mkdirSync(join4(stage, "config"), { recursive: true });
+      copyFileSync(source, join4(stage, "config", source.endsWith(".ts") ? "cloud.ts" : "cloud.js"));
+    } else {
+      copyFileSync(source, join4(stage, source.endsWith(".ts") ? "cloud.config.ts" : "cloud.config.js"));
+    }
+    const pkg = {
+      name: "ts-cloud-dashboard",
+      private: true,
+      type: "module",
+      dependencies: { "@stacksjs/ts-cloud": resolveDashboardVersion() }
+    };
+    writeFileSync(join4(stage, "package.json"), `${JSON.stringify(pkg, null, 2)}
+`);
+    return LIVE_STAGE_DIR;
+  } catch (error) {
+    logger.warn(`Management dashboard: could not stage the live release (${error?.message ?? error}) — skipping.`);
+    return null;
+  }
+}
 function resolveUiSource(cwd) {
   if (existsSync2(join4(cwd, "packages", "ui", "pages")) || existsSync2(join4(cwd, "packages", "ui", "package.json"))) {
     return { uiRoot: "packages/ui/dist", build: "cd packages/ui && bun install && bun run build" };
@@ -3888,6 +3941,32 @@ function ensureManagementDashboard(config, options = {}) {
   }
   if (hasManagementDashboardSite(config))
     return config;
+  const environment = config.environments && Object.keys(config.environments)[0];
+  const domain = process.env.TS_CLOUD_UI_DOMAIN?.trim() || undefined;
+  const port = Number(process.env.TS_CLOUD_UI_PORT) || undefined;
+  const sites = { ...config.sites ?? {} };
+  if (!truthy(process.env.TS_CLOUD_UI_STATIC)) {
+    const uiRoot = stageLiveDashboardRoot(cwd, logger);
+    if (!uiRoot)
+      return config;
+    const resolved2 = resolveManagementDashboardSites(config, environment ?? "production", {
+      uiRoot,
+      build: false,
+      domain,
+      port,
+      live: true
+    });
+    if (resolved2.length === 0) {
+      logger.info("Management dashboard: no domain resolved (set TS_CLOUD_UI_DOMAIN or configure a site domain) — skipping.");
+      return config;
+    }
+    for (const { name, site } of resolved2) {
+      sites[name] = site;
+      logger.info(`Management dashboard → https://${site.domain} (sign in with your ts-cloud account; the first deploy prints an admin password once)`);
+    }
+    config.sites = sites;
+    return config;
+  }
   const ui = resolveUiSource(cwd);
   if (!ui) {
     logger.info("Management dashboard: UI not found (no local ui/ or packaged dist/ui) — skipping auto-deploy.");
@@ -3895,17 +3974,14 @@ function ensureManagementDashboard(config, options = {}) {
   }
   const username = process.env.TS_CLOUD_UI_USERNAME?.trim() || "admin";
   const auth = resolveDashboardAuth(cwd, username, logger);
-  const environment = config.environments && Object.keys(config.environments)[0];
-  const live = truthy(process.env.TS_CLOUD_UI_LIVE);
-  const port = Number(process.env.TS_CLOUD_UI_PORT) || undefined;
   const resolved = resolveManagementDashboardSites(config, environment ?? "production", {
     uiRoot: ui.uiRoot,
     build: ui.build,
-    domain: process.env.TS_CLOUD_UI_DOMAIN?.trim() || undefined,
+    domain,
     username,
     password: auth.password,
     realm: process.env.TS_CLOUD_UI_REALM?.trim() || undefined,
-    live,
+    live: false,
     port
   });
   if (resolved.length === 0) {
@@ -3913,7 +3989,7 @@ function ensureManagementDashboard(config, options = {}) {
     return config;
   }
   const authNote = auth.source === "public" ? "NO AUTH — TS_CLOUD_UI_PUBLIC is set (dashboard is publicly reachable)" : auth.source === "env" ? "htpasswd-protected (TS_CLOUD_UI_PASSWORD)" : `htpasswd-protected (auto-generated — see ${DASHBOARD_CREDENTIALS_FILE})`;
-  const sites = { ...config.sites ?? {} };
+  logger.warn("Management dashboard: static mode — one shared password, and no per-site collaborators. Unset TS_CLOUD_UI_STATIC for the live dashboard.");
   for (const { name, site } of resolved) {
     sites[name] = site;
     logger.info(`Management dashboard → https://${site.domain} (${authNote})`);
@@ -4566,6 +4642,7 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
     envEntries: site.env || {},
     port: site.port,
     preStartCommands: site.preStart,
+    sharedPaths: site.sharedPaths,
     zeroDowntime: site.zeroDowntime !== false,
     healthCheckPath: site.healthCheck?.path
   });
@@ -4652,7 +4729,7 @@ async function deployAllComputeSites(options) {
         }
         try {
           const copy = join5(tmpdir2(), `${slug}-${name}-${sha}.tar.gz`);
-          copyFileSync(dashboardTarball, copy);
+          copyFileSync2(dashboardTarball, copy);
           dashboardTarballBySite.set(name, copy);
         } catch {
           dashboardTarballBySite.set(name, dashboardTarball);

package/dist/deploy/dashboard-site-settings.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Which site settings a member may change, and route-conflict checks.
+ *
+ * `site:settings` lets a site owner edit their own site — but a site's config
+ * is not all equally harmless on a box shared with other tenants:
+ *
+ * - `build` and `start` are **shell commands run on the box at deploy time**,
+ *   as root. A member who could set them would own the whole server, and every
+ *   other tenant's site with it.
+ * - `root` is a filesystem path. Pointed at another site's directory (or `/`),
+ *   it serves someone else's files to the internet.
+ * - `port`, `type` and `php` pick runtime and bind ports, which are the box's
+ *   to allocate, not one tenant's.
+ *
+ * Those stay with the box owner. What is left is genuinely the tenant's own:
+ * TLS, their app's env, their redirects, and their routing — and routing is
+ * still checked against other tenants, since claiming `example.com` when
+ * someone else already serves it is hijacking their traffic.
+ *
+ * An allowlist, not a blocklist: a site field added later is admin-only until
+ * someone decides it is safe to hand over.
+ */
+/** Fields a member holding `site:settings` on the site may change. */
+export declare const MEMBER_EDITABLE_SITE_FIELDS: ReadonlySet<string>;
+/**
+ * Fields only the box owner may change, with why — used to explain the refusal
+ * rather than a bare 403.
+ */
+export declare const ADMIN_ONLY_SITE_FIELDS: Readonly<Record<string, string>>;
+export interface FieldCheck {
+    ok: boolean;
+    error?: string;
+}
+/**
+ * Whether a member may apply `body` to a site. Refuses the whole request if it
+ * touches any admin-only field, rather than silently applying the safe subset —
+ * a caller who asked to set `start` should be told it did not happen.
+ */
+export declare function checkMemberSiteFields(body: Record<string, any>): FieldCheck;
+export interface RouteConflictInput {
+    /** The site being edited. */
+    siteName: string;
+    /** The requested changes (domain / path / aliases). */
+    body: Record<string, any>;
+    /** All sites on the box, by name. */
+    sites: Record<string, any>;
+    /** Site names the editor holds a grant on — conflicts with these are theirs. */
+    ownSites: string[];
+}
+/**
+ * Refuse a routing change that would claim a host another tenant already
+ * serves. Conflicts with the editor's own sites are allowed: moving a domain
+ * between two sites you control is your business.
+ */
+export declare function checkRouteConflict({ siteName, body, sites, ownSites }: RouteConflictInput): FieldCheck;

package/dist/deploy/dashboard-site-settings.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-throttle.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Login throttling.
+ *
+ * The dashboard's login is internet-facing, and it is the door to a box that
+ * hosts other people's sites. scrypt makes each guess cost ~50ms, which slows
+ * an attacker but does not stop one — and while generated passwords are strong,
+ * an operator can set their own via `TS_CLOUD_UI_PASSWORD`.
+ *
+ * Failures are counted per key (username + client address) and lock that key
+ * out for a window once they pass a threshold. In-memory on purpose: the
+ * dashboard is a single process per box, and a restart clearing the counters is
+ * an acceptable trade for having no store to keep.
+ *
+ * Keyed on username *and* address so one attacker cannot lock a legitimate
+ * operator out of their own box by failing logins against their username
+ * (a denial of service dressed up as a security control).
+ */
+/** Failures before a key is locked out. */
+export declare const MAX_ATTEMPTS: number;
+/** How long a locked key stays locked. */
+export declare const LOCKOUT_MS: number;
+/** Failures older than this stop counting, so occasional typos never lock. */
+export declare const WINDOW_MS: number;
+export interface ThrottleDecision {
+    allowed: boolean;
+    /** Seconds until the caller may try again. Only set when blocked. */
+    retryAfterSeconds?: number;
+}
+export declare class LoginThrottle {
+    private readonly maxAttempts;
+    private readonly lockoutMs;
+    private readonly windowMs;
+    private attempts;
+    constructor(maxAttempts?: number, lockoutMs?: number, windowMs?: number);
+    private key;
+    /** Whether a login attempt for this key may proceed. */
+    check(username: string, address: string, now?: number): ThrottleDecision;
+    /** Record a failed attempt, locking the key once it passes the threshold. */
+    recordFailure(username: string, address: string, now?: number): void;
+    /** Clear the counter for a key after a successful login. */
+    recordSuccess(username: string, address: string): void;
+    /** Drop expired entries so the map cannot grow without bound. */
+    prune(now?: number): void;
+    /** Tracked keys. For tests and diagnostics. */
+    get size(): number;
+}

package/dist/deploy/dashboard-throttle.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/index.js

@@ -12,10 +12,10 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "../chunk-qdhn1s7j.js";
+} from "../chunk-js3vrvvn.js";
 import {
   buildAndPushServerlessImage
-} from "../chunk-qgnyzfmx.js";
+} from "../chunk-5mejsd43.js";
 import"../chunk-b82pbxyp.js";
 import"../chunk-hsk6fe6x.js";
 import {
@@ -30,8 +30,8 @@ import {
   resolveUiSource,
   siteInstallBase,
   validateDeploymentConfig
-} from "../chunk-xgnxz5dz.js";
-import"../chunk-49nmy775.js";
+} from "../chunk-kcxxwg3j.js";
+import"../chunk-0tfwdnmf.js";
 import"../chunk-93hjhs78.js";
 import {
   deleteStaticSite,