@stacksjs/ts-cloud 0.7.21 → 0.7.23

package/dist/{chunk-49nmy775.js → chunk-0tfwdnmf.js}

@@ -21901,6 +21901,8 @@ function createDashboardSite(options) {
     }
   };
 }
+var DASHBOARD_STATE_DIR = ".ts-cloud";
+var DASHBOARD_ENTRY = "./node_modules/@stacksjs/ts-cloud/dist/bin/cli.js";
 function apexOf(domain) {
   const parts = domain.split(".").filter(Boolean);
   return parts.length <= 2 ? domain : parts.slice(-2).join(".");
@@ -21963,7 +21965,7 @@ function resolveManagementDashboardSites(config, environment, opts) {
     return [];
   const auth2 = opts.password ? { auth: { username: opts.username || "admin", password: opts.password, realm: opts.realm } } : {};
   const build = opts.build === false || opts.build === undefined ? {} : { build: opts.build };
-  if (opts.live) {
+  if (opts.live !== false) {
     const domain = resolveDashboardDomain(config, environment, opts.domain);
     if (!domain)
       return [];
@@ -21972,11 +21974,12 @@ function resolveManagementDashboardSites(config, environment, opts) {
       root: opts.uiRoot,
       deploy: "server",
       domain,
-      start: `cloud dashboard:serve --box --host 127.0.0.1 --port ${port}`,
+      preStart: ["bun install --production --no-save"],
+      start: `bun ${DASHBOARD_ENTRY} dashboard:serve --box --host 127.0.0.1 --port ${port}`,
       port,
-      ssl: { provider: "letsencrypt" },
-      ...build,
-      ...auth2
+      sharedPaths: [DASHBOARD_STATE_DIR],
+      healthCheck: { path: "/login" },
+      ssl: { provider: "letsencrypt" }
     };
     return [{ name: managementDashboardSiteName(domain), site }];
   }
@@ -46152,4 +46155,4 @@ class ResourceManagementManager {
 }
 var resourceManagementManager = new ResourceManagementManager;
 
-export { detectServiceRegion, signRequest, signRequestAsync, createPresignedUrl, createPresignedUrlAsync, makeAWSRequest, makeAWSRequestOnce, makeAWSRequestAsync, parseXMLResponse, parseJSONResponse, clearSigningKeyCache, getSigningKeyCacheSize, isNodeCryptoAvailable, isWebCryptoAvailable, QueuePresets, RealtimePresets, detectDeploymentTargets, resolveDeploymentMode, deploymentCoexistenceError, resolveCloudProvider, TemplateBuilder, Pseudo, generateResourceName, generateLogicalId, getTimestamp, sanitizeName, resolveProjectStackName, resolveSiteStackName, resolveSiteResourceName, resolveSiteBucketName, resolveStorageBucketName, resolveDeployBucketName, resolveServerlessAppStackName, resolveServerlessArtifactBucketName, resolveServerlessAssetBucketName, DependencyGraph, analyzeStackDiff, formatDiff, Storage, Registry, CDN, DNS, Security, Compute, Network, FileSystem, Email, exports_incoming_call, Phone, Queue, JobLoader, StacksIntegration, exports_send, SMS, AI, Database, Cache, Permissions, ApiGateway, Messaging, Workflow, Monitoring, Auth, Deployment, AssetHasher, Secrets, ParameterStore, Search, Redirects, Communication, Fn2, Arn, AWS_PSEUDO_PARAMETERS, CloudFormationBuilder, buildCloudFormationTemplate, createStaticSitePreset, createNodeJsServerPreset, createNodeJsServerlessPreset, createServerlessNodePreset, createFullStackAppPreset, createApiBackendPreset, createWordPressPreset, createJamstackPreset, createMicroservicesPreset, createRealtimeAppPreset, createDataPipelinePreset, createMLApiPreset, createTraditionalWebAppPreset, createLaravelPreset, createServerlessLaravelPreset, createDashboardSite, resolveDashboardDomain, resolveDashboardDomains, hasManagementDashboardSite, MANAGEMENT_DASHBOARD_SITE_PREFIX, managementDashboardSiteName, isManagementDashboardSiteName, resolveManagementDashboardSites, resolveManagementDashboardSite, extendPreset, composePresets, createPreset, mergeInfrastructure, withMonitoring, withSecurity, withDatabase, withCache, withCDN, withQueue, fromEnvironment, fromSharedCredentials, fromEC2Metadata, fromECSMetadata, fromWebIdentity, getCredentials, createCredentialProvider, resolveCredentials, resolveRegion, getAccountId, S3Error, createS3Client, CloudError, ConfigurationError, CredentialError, DeploymentError, ValidationError, AWSAPIError, ErrorCodes, getErrorDetails, createError, DebugLogger, validateConfiguration, detectMisconfigurations, validateCredentials, checkIAMPermissions, getRequiredPermissions, suggestIAMPolicy, DEFAULT_SERVICE_LIMITS, checkServiceQuotas, getQuotaUsageSummary, suggestQuotaIncrease, FileCache, TemplateCache, templateCache, hashFile, hashString, hashBuffer, hashDirectory, hashManifest, quickHash, findChangedFiles, HashCache, parallel, batch, parallelMap, parallelWithRetry, sequence, withTimeout, RateLimiter, chunk, processInChunks, diffTemplates, getDiffSummary, requiresReplacement, categorizeChanges, getDeploymentStrategy, getDiffStats, cloud_config_schema_default, validateAgainstSchema, defaultLocalConfig, getLocalConfig, isLocalDevelopment, getLocalEndpoint, getLocalCredentials, getLocalEnvVars, MockCloudFormation, MockS3, MockDynamoDB, createMockAWS, PreviewEnvironmentManager, previewManager, generatePreviewWorkflow, generateCleanupWorkflow, generateCostReportWorkflow, PreviewNotificationService, previewNotifications, formatTable, formatTree, formatProgressBar, formatBytes, formatDuration, formatList, formatKeyValue, ProgressBar, MultiStepProgress, Spinner, TaskList, suggestCommand, formatSuggestion, isLikelyTypo, getContextualHelp, searchCommands, autocomplete, suggestFlags, formatFlagSuggestions, getCommandUsage, validateCommand, REPL, REPLContext, REPLCommandBuilder, CommandHistory, formatHistory, formatHistoryStats, MultiRegionManager, multiRegionManager, CrossRegionReferenceManager, GlobalResourceManager, RegionPairManager, StackDependencyManager, crossRegionReferenceManager, globalResourceManager, regionPairManager, stackDependencyManager, AWS_REGIONS, getRegion, getAllRegions, getRegionsByLocation, getRegionsByCompliance, getRegionsByPricingTier, isValidRegion, getClosestRegion, suggestRegions, suggestRegionPairs, formatRegion, formatRegionList, getRegionStats, MultiAccountManager, OrganizationManager, multiAccountManager, organizationManager, RECOMMENDED_ACCOUNT_STRUCTURES, RECOMMENDED_SCPS, COMMON_CROSS_ACCOUNT_ROLES, getRecommendedStructure, generateCrossAccountRoleCF, validateAccountStructure, formatAccountStructure, generateDeploymentWorkflow, generateMultiEnvWorkflow, generatePRPreviewWorkflow, generateScheduledWorkflow, generateMatrixWorkflow, generateDeploymentPipeline, generateMultiEnvPipeline, generatePreviewPipeline, generateScheduledPipeline, generateManualPipeline, generateDeploymentConfig, generateMultiEnvConfig, generateScheduledConfig, generateApprovalConfig, generateParallelConfig, BackupManager, backupManager, DisasterRecoveryManager, drManager, AWSConfigManager, awsConfigManager, CloudTrailManager, cloudTrailManager, GuardDutyManager, guardDutyManager, SecurityHubManager, securityHubManager, BlueGreenManager, blueGreenManager, CanaryManager, canaryManager, ABTestManager, abTestManager, ProgressiveDeploymentManager, progressiveDeploymentManager, XRayManager, xrayManager, MetricsManager, metricsManager, LogsManager, logsManager, SyntheticsManager, syntheticsManager, MigrationManager, migrationManager, ReplicaManager, replicaManager, PerformanceManager, performanceManager, DatabaseUserManager, databaseUserManager, SecretsRotationManager, secretsRotationManager, SecretsManager, secretsManager, CertificateManager, certificateManager, SecurityScanningManager, securityScanningManager, ImageScanningManager, imageScanningManager, BuildOptimizationManager, buildOptimizationManager, ContainerRegistryManager, containerRegistryManager, ServiceMeshManager, serviceMeshManager, LambdaLayersManager, lambdaLayersManager, LambdaVersionsManager, lambdaVersionsManager, LambdaConcurrencyManager, lambdaConcurrencyManager, LambdaDestinationsManager, lambdaDestinationsManager, LambdaVPCManager, lambdaVPCManager, LambdaDLQManager, lambdaDLQManager, Route53RoutingManager, route53RoutingManager, DNSSECManager, dnssecManager, Route53ResolverManager, route53ResolverManager, BounceComplaintHandler, bounceComplaintHandler, EmailAnalyticsManager, emailAnalyticsManager, SenderReputationManager, senderReputationManager, EmailTemplateManager, emailTemplateManager, exports_advanced, exports_inbound, exports_advanced2, exports_advanced3, FIFOQueueManager, fifoQueueManager, DLQMonitoringManager, dlqMonitoringManager, BatchProcessingManager, batchProcessingManager, QueueManagementManager, queueManagementManager, createZip, generateBootstrap, runBuildHooks, sha256, artifactKey, packageServerlessApp, MANAGED_NODE_VERSIONS, resolveServerlessRuntime, resolveQueues, resolveQueueNames, composeServerlessAppTemplate, PHP_LAYER_EXTENSIONS, phpLayerPackages, phpLayerBuildStage, generatePhpLayerDockerfile, generateAppImageDockerfile, sharedRuntimeLoop, buildNodeRuntimeLayerZip, buildBunRuntimeLayerZip, resolveApp, eventToRequest, responseToResult, createHttpHandler, createQueueHandler, createCliHandler, createHandlers, generatePhpFpmConfig, phpRuntimeLayerAssets, laravelServerlessEnvDefaults, LARAVEL_SERVERLESS_BUILD_STEPS, buildPhpRuntimeLayerZip, PHP_DEFAULT_EXCLUDES, runPhpBuildHooks, collectPhpAppEntries, packagePhpApp, StaticSiteManager, staticSiteManager, StorageAdvancedManager, storageAdvancedManager, HealthCheckManager, healthCheckManager, NetworkSecurityManager, networkSecurityManager, ResourceManagementManager, resourceManagementManager };
+export { detectServiceRegion, signRequest, signRequestAsync, createPresignedUrl, createPresignedUrlAsync, makeAWSRequest, makeAWSRequestOnce, makeAWSRequestAsync, parseXMLResponse, parseJSONResponse, clearSigningKeyCache, getSigningKeyCacheSize, isNodeCryptoAvailable, isWebCryptoAvailable, QueuePresets, RealtimePresets, detectDeploymentTargets, resolveDeploymentMode, deploymentCoexistenceError, resolveCloudProvider, TemplateBuilder, Pseudo, generateResourceName, generateLogicalId, getTimestamp, sanitizeName, resolveProjectStackName, resolveSiteStackName, resolveSiteResourceName, resolveSiteBucketName, resolveStorageBucketName, resolveDeployBucketName, resolveServerlessAppStackName, resolveServerlessArtifactBucketName, resolveServerlessAssetBucketName, DependencyGraph, analyzeStackDiff, formatDiff, Storage, Registry, CDN, DNS, Security, Compute, Network, FileSystem, Email, exports_incoming_call, Phone, Queue, JobLoader, StacksIntegration, exports_send, SMS, AI, Database, Cache, Permissions, ApiGateway, Messaging, Workflow, Monitoring, Auth, Deployment, AssetHasher, Secrets, ParameterStore, Search, Redirects, Communication, Fn2, Arn, AWS_PSEUDO_PARAMETERS, CloudFormationBuilder, buildCloudFormationTemplate, createStaticSitePreset, createNodeJsServerPreset, createNodeJsServerlessPreset, createServerlessNodePreset, createFullStackAppPreset, createApiBackendPreset, createWordPressPreset, createJamstackPreset, createMicroservicesPreset, createRealtimeAppPreset, createDataPipelinePreset, createMLApiPreset, createTraditionalWebAppPreset, createLaravelPreset, createServerlessLaravelPreset, createDashboardSite, DASHBOARD_STATE_DIR, DASHBOARD_ENTRY, resolveDashboardDomain, resolveDashboardDomains, hasManagementDashboardSite, MANAGEMENT_DASHBOARD_SITE_PREFIX, managementDashboardSiteName, isManagementDashboardSiteName, resolveManagementDashboardSites, resolveManagementDashboardSite, extendPreset, composePresets, createPreset, mergeInfrastructure, withMonitoring, withSecurity, withDatabase, withCache, withCDN, withQueue, fromEnvironment, fromSharedCredentials, fromEC2Metadata, fromECSMetadata, fromWebIdentity, getCredentials, createCredentialProvider, resolveCredentials, resolveRegion, getAccountId, S3Error, createS3Client, CloudError, ConfigurationError, CredentialError, DeploymentError, ValidationError, AWSAPIError, ErrorCodes, getErrorDetails, createError, DebugLogger, validateConfiguration, detectMisconfigurations, validateCredentials, checkIAMPermissions, getRequiredPermissions, suggestIAMPolicy, DEFAULT_SERVICE_LIMITS, checkServiceQuotas, getQuotaUsageSummary, suggestQuotaIncrease, FileCache, TemplateCache, templateCache, hashFile, hashString, hashBuffer, hashDirectory, hashManifest, quickHash, findChangedFiles, HashCache, parallel, batch, parallelMap, parallelWithRetry, sequence, withTimeout, RateLimiter, chunk, processInChunks, diffTemplates, getDiffSummary, requiresReplacement, categorizeChanges, getDeploymentStrategy, getDiffStats, cloud_config_schema_default, validateAgainstSchema, defaultLocalConfig, getLocalConfig, isLocalDevelopment, getLocalEndpoint, getLocalCredentials, getLocalEnvVars, MockCloudFormation, MockS3, MockDynamoDB, createMockAWS, PreviewEnvironmentManager, previewManager, generatePreviewWorkflow, generateCleanupWorkflow, generateCostReportWorkflow, PreviewNotificationService, previewNotifications, formatTable, formatTree, formatProgressBar, formatBytes, formatDuration, formatList, formatKeyValue, ProgressBar, MultiStepProgress, Spinner, TaskList, suggestCommand, formatSuggestion, isLikelyTypo, getContextualHelp, searchCommands, autocomplete, suggestFlags, formatFlagSuggestions, getCommandUsage, validateCommand, REPL, REPLContext, REPLCommandBuilder, CommandHistory, formatHistory, formatHistoryStats, MultiRegionManager, multiRegionManager, CrossRegionReferenceManager, GlobalResourceManager, RegionPairManager, StackDependencyManager, crossRegionReferenceManager, globalResourceManager, regionPairManager, stackDependencyManager, AWS_REGIONS, getRegion, getAllRegions, getRegionsByLocation, getRegionsByCompliance, getRegionsByPricingTier, isValidRegion, getClosestRegion, suggestRegions, suggestRegionPairs, formatRegion, formatRegionList, getRegionStats, MultiAccountManager, OrganizationManager, multiAccountManager, organizationManager, RECOMMENDED_ACCOUNT_STRUCTURES, RECOMMENDED_SCPS, COMMON_CROSS_ACCOUNT_ROLES, getRecommendedStructure, generateCrossAccountRoleCF, validateAccountStructure, formatAccountStructure, generateDeploymentWorkflow, generateMultiEnvWorkflow, generatePRPreviewWorkflow, generateScheduledWorkflow, generateMatrixWorkflow, generateDeploymentPipeline, generateMultiEnvPipeline, generatePreviewPipeline, generateScheduledPipeline, generateManualPipeline, generateDeploymentConfig, generateMultiEnvConfig, generateScheduledConfig, generateApprovalConfig, generateParallelConfig, BackupManager, backupManager, DisasterRecoveryManager, drManager, AWSConfigManager, awsConfigManager, CloudTrailManager, cloudTrailManager, GuardDutyManager, guardDutyManager, SecurityHubManager, securityHubManager, BlueGreenManager, blueGreenManager, CanaryManager, canaryManager, ABTestManager, abTestManager, ProgressiveDeploymentManager, progressiveDeploymentManager, XRayManager, xrayManager, MetricsManager, metricsManager, LogsManager, logsManager, SyntheticsManager, syntheticsManager, MigrationManager, migrationManager, ReplicaManager, replicaManager, PerformanceManager, performanceManager, DatabaseUserManager, databaseUserManager, SecretsRotationManager, secretsRotationManager, SecretsManager, secretsManager, CertificateManager, certificateManager, SecurityScanningManager, securityScanningManager, ImageScanningManager, imageScanningManager, BuildOptimizationManager, buildOptimizationManager, ContainerRegistryManager, containerRegistryManager, ServiceMeshManager, serviceMeshManager, LambdaLayersManager, lambdaLayersManager, LambdaVersionsManager, lambdaVersionsManager, LambdaConcurrencyManager, lambdaConcurrencyManager, LambdaDestinationsManager, lambdaDestinationsManager, LambdaVPCManager, lambdaVPCManager, LambdaDLQManager, lambdaDLQManager, Route53RoutingManager, route53RoutingManager, DNSSECManager, dnssecManager, Route53ResolverManager, route53ResolverManager, BounceComplaintHandler, bounceComplaintHandler, EmailAnalyticsManager, emailAnalyticsManager, SenderReputationManager, senderReputationManager, EmailTemplateManager, emailTemplateManager, exports_advanced, exports_inbound, exports_advanced2, exports_advanced3, FIFOQueueManager, fifoQueueManager, DLQMonitoringManager, dlqMonitoringManager, BatchProcessingManager, batchProcessingManager, QueueManagementManager, queueManagementManager, createZip, generateBootstrap, runBuildHooks, sha256, artifactKey, packageServerlessApp, MANAGED_NODE_VERSIONS, resolveServerlessRuntime, resolveQueues, resolveQueueNames, composeServerlessAppTemplate, PHP_LAYER_EXTENSIONS, phpLayerPackages, phpLayerBuildStage, generatePhpLayerDockerfile, generateAppImageDockerfile, sharedRuntimeLoop, buildNodeRuntimeLayerZip, buildBunRuntimeLayerZip, resolveApp, eventToRequest, responseToResult, createHttpHandler, createQueueHandler, createCliHandler, createHandlers, generatePhpFpmConfig, phpRuntimeLayerAssets, laravelServerlessEnvDefaults, LARAVEL_SERVERLESS_BUILD_STEPS, buildPhpRuntimeLayerZip, PHP_DEFAULT_EXCLUDES, runPhpBuildHooks, collectPhpAppEntries, packagePhpApp, StaticSiteManager, staticSiteManager, StorageAdvancedManager, storageAdvancedManager, HealthCheckManager, healthCheckManager, NetworkSecurityManager, networkSecurityManager, ResourceManagementManager, resourceManagementManager };

package/dist/{chunk-xgnxz5dz.js → chunk-5cfcv2s2.js}

@@ -5,7 +5,7 @@ import {
   resolveCloudProvider,
   resolveManagementDashboardSites,
   resolveProjectStackName
-} from "./chunk-49nmy775.js";
+} from "./chunk-0tfwdnmf.js";
 import {
   EC2Client,
   SSMClient
@@ -3579,7 +3579,9 @@ function releasePaths(base, releaseId) {
 }
 function isFileSharedPath(p) {
   const name = p.split("/").pop() || p;
-  return name.startsWith(".") || /\.[a-z0-9]+$/i.test(name);
+  if (name === ".env" || name.startsWith(".env."))
+    return true;
+  return /\.[a-z0-9]+$/i.test(name);
 }
 function buildEnsureReleaseLayout(paths, sharedPaths = DEFAULT_SHARED_PATHS) {
   const lines = [
@@ -3706,7 +3708,7 @@ function buildSiteDeployScript(options) {
   const paths = releasePaths(base, releaseId);
   const unitBase = `${slug}-${siteName}`;
   const serviceName = `${unitBase}.service`;
-  const sharedPaths = [".env"];
+  const sharedPaths = [...new Set([".env", ...options.sharedPaths ?? []])];
   const envFile = formatEnvFile(envEntries);
   const preStart = preStartCommands.length > 0 ? [`cd ${paths.release}`, ...preStartCommands] : [];
   const stageRelease = [
@@ -3827,6 +3829,48 @@ import { chmodSync, existsSync as existsSync2, mkdirSync, readFileSync as readFi
 import { tmpdir } from "node:os";
 import { dirname, isAbsolute, join as join4 } from "node:path";
 import { fileURLToPath } from "node:url";
+
+// src/deploy/dashboard-config-module.ts
+function blankValues(record) {
+  if (!record || typeof record !== "object")
+    return record;
+  return Object.fromEntries(Object.keys(record).map((key) => [key, ""]));
+}
+function redactForDashboard(config) {
+  const safe = JSON.parse(JSON.stringify(config ?? {}));
+  if (safe.hetzner)
+    delete safe.hetzner.apiToken;
+  delete safe.aws;
+  for (const site of Object.values(safe.sites ?? {})) {
+    if (site?.env)
+      site.env = blankValues(site.env);
+    if (site?.environment)
+      site.environment = blankValues(site.environment);
+  }
+  for (const env2 of Object.values(safe.environments ?? {})) {
+    if (env2?.variables)
+      env2.variables = blankValues(env2.variables);
+  }
+  for (const db of Object.values(safe.infrastructure?.databases ?? {})) {
+    if (db?.password)
+      db.password = "";
+  }
+  return safe;
+}
+function serializeDashboardConfig(config) {
+  const safe = redactForDashboard(config);
+  return [
+    "// Generated by ts-cloud for the management dashboard — do not edit.",
+    "//",
+    "// This is the project's resolved cloud config, inlined so it needs no",
+    "// imports on the box. Credentials are deliberately absent.",
+    `export default ${JSON.stringify(safe, null, 2)}`,
+    ""
+  ].join(`
+`);
+}
+
+// src/deploy/management-dashboard.ts
 var MANAGEMENT_DASHBOARD_SITE = "dashboard";
 var DASHBOARD_CREDENTIALS_FILE = join4(".ts-cloud", "dashboard-credentials.json");
 function generatePassword() {
@@ -3862,6 +3906,44 @@ var noopLogger = { info: () => {}, warn: () => {} };
 function truthy(v) {
   return v != null && v !== "" && v !== "0" && v.toLowerCase() !== "false";
 }
+var LIVE_STAGE_DIR = join4(".ts-cloud", "dashboard-release");
+function resolveDashboardVersion() {
+  const explicit = process.env.TS_CLOUD_UI_VERSION?.trim();
+  if (explicit)
+    return explicit;
+  const here = dirname(fileURLToPath(import.meta.url));
+  for (const candidate of [join4(here, "..", "..", "package.json"), join4(here, "..", "package.json")]) {
+    try {
+      const pkg = JSON.parse(readFileSync3(candidate, "utf8"));
+      if (pkg.name === "@stacksjs/ts-cloud" && pkg.version)
+        return `^${pkg.version}`;
+    } catch {}
+  }
+  return "latest";
+}
+function stageLiveDashboardRoot(config, cwd, logger) {
+  if (!config?.project?.slug) {
+    logger.warn("Management dashboard: the cloud config has no project slug — skipping the live dashboard.");
+    return null;
+  }
+  const stage = join4(cwd, LIVE_STAGE_DIR);
+  try {
+    mkdirSync(stage, { recursive: true });
+    writeFileSync(join4(stage, "cloud.config.ts"), serializeDashboardConfig(config));
+    const pkg = {
+      name: "ts-cloud-dashboard",
+      private: true,
+      type: "module",
+      dependencies: { "@stacksjs/ts-cloud": resolveDashboardVersion() }
+    };
+    writeFileSync(join4(stage, "package.json"), `${JSON.stringify(pkg, null, 2)}
+`);
+    return LIVE_STAGE_DIR;
+  } catch (error) {
+    logger.warn(`Management dashboard: could not stage the live release (${error?.message ?? error}) — skipping.`);
+    return null;
+  }
+}
 function resolveUiSource(cwd) {
   if (existsSync2(join4(cwd, "packages", "ui", "pages")) || existsSync2(join4(cwd, "packages", "ui", "package.json"))) {
     return { uiRoot: "packages/ui/dist", build: "cd packages/ui && bun install && bun run build" };
@@ -3888,6 +3970,32 @@ function ensureManagementDashboard(config, options = {}) {
   }
   if (hasManagementDashboardSite(config))
     return config;
+  const environment = config.environments && Object.keys(config.environments)[0];
+  const domain = process.env.TS_CLOUD_UI_DOMAIN?.trim() || undefined;
+  const port = Number(process.env.TS_CLOUD_UI_PORT) || undefined;
+  const sites = { ...config.sites ?? {} };
+  if (!truthy(process.env.TS_CLOUD_UI_STATIC)) {
+    const uiRoot = stageLiveDashboardRoot(config, cwd, logger);
+    if (!uiRoot)
+      return config;
+    const resolved2 = resolveManagementDashboardSites(config, environment ?? "production", {
+      uiRoot,
+      build: false,
+      domain,
+      port,
+      live: true
+    });
+    if (resolved2.length === 0) {
+      logger.info("Management dashboard: no domain resolved (set TS_CLOUD_UI_DOMAIN or configure a site domain) — skipping.");
+      return config;
+    }
+    for (const { name, site } of resolved2) {
+      sites[name] = site;
+      logger.info(`Management dashboard → https://${site.domain} (sign in with your ts-cloud account; the first deploy prints an admin password once)`);
+    }
+    config.sites = sites;
+    return config;
+  }
   const ui = resolveUiSource(cwd);
   if (!ui) {
     logger.info("Management dashboard: UI not found (no local ui/ or packaged dist/ui) — skipping auto-deploy.");
@@ -3895,17 +4003,14 @@ function ensureManagementDashboard(config, options = {}) {
   }
   const username = process.env.TS_CLOUD_UI_USERNAME?.trim() || "admin";
   const auth = resolveDashboardAuth(cwd, username, logger);
-  const environment = config.environments && Object.keys(config.environments)[0];
-  const live = truthy(process.env.TS_CLOUD_UI_LIVE);
-  const port = Number(process.env.TS_CLOUD_UI_PORT) || undefined;
   const resolved = resolveManagementDashboardSites(config, environment ?? "production", {
     uiRoot: ui.uiRoot,
     build: ui.build,
-    domain: process.env.TS_CLOUD_UI_DOMAIN?.trim() || undefined,
+    domain,
     username,
     password: auth.password,
     realm: process.env.TS_CLOUD_UI_REALM?.trim() || undefined,
-    live,
+    live: false,
     port
   });
   if (resolved.length === 0) {
@@ -3913,7 +4018,7 @@ function ensureManagementDashboard(config, options = {}) {
     return config;
   }
   const authNote = auth.source === "public" ? "NO AUTH — TS_CLOUD_UI_PUBLIC is set (dashboard is publicly reachable)" : auth.source === "env" ? "htpasswd-protected (TS_CLOUD_UI_PASSWORD)" : `htpasswd-protected (auto-generated — see ${DASHBOARD_CREDENTIALS_FILE})`;
-  const sites = { ...config.sites ?? {} };
+  logger.warn("Management dashboard: static mode — one shared password, and no per-site collaborators. Unset TS_CLOUD_UI_STATIC for the live dashboard.");
   for (const { name, site } of resolved) {
     sites[name] = site;
     logger.info(`Management dashboard → https://${site.domain} (${authNote})`);
@@ -4566,6 +4671,7 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
     envEntries: site.env || {},
     port: site.port,
     preStartCommands: site.preStart,
+    sharedPaths: site.sharedPaths,
     zeroDowntime: site.zeroDowntime !== false,
     healthCheckPath: site.healthCheck?.path
   });

package/dist/{chunk-qgnyzfmx.js → chunk-5mejsd43.js}

@@ -8,7 +8,7 @@ import {
   phpRuntimeLayerAssets,
   runPhpBuildHooks,
   sha256
-} from "./chunk-49nmy775.js";
+} from "./chunk-0tfwdnmf.js";
 
 // src/deploy/serverless-image.ts
 import { execFileSync } from "node:child_process";

package/dist/{chunk-296n8hvt.js → chunk-c3yy2xyq.js}

@@ -1,8 +1,8 @@
 import {
   buildAndPushServerlessImage
-} from "./chunk-qgnyzfmx.js";
+} from "./chunk-5mejsd43.js";
 import"./chunk-hsk6fe6x.js";
-import"./chunk-49nmy775.js";
+import"./chunk-0tfwdnmf.js";
 import"./chunk-arsh1g5h.js";
 import"./chunk-v0bahtg2.js";
 export {

package/dist/{chunk-eapb9et8.js → chunk-khfnaap2.js}

@@ -6,7 +6,7 @@ import {
   step,
   success,
   warn
-} from "./chunk-qgnyzfmx.js";
+} from "./chunk-5mejsd43.js";
 import {
   CloudWatchLogsClient,
   CostExplorerClient,
@@ -28,7 +28,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-xgnxz5dz.js";
+} from "./chunk-5cfcv2s2.js";
 import {
   artifactKey,
   composeServerlessAppTemplate,
@@ -42,7 +42,7 @@ import {
   resolveServerlessArtifactBucketName,
   resolveServerlessAssetBucketName,
   resolveServerlessRuntime
-} from "./chunk-49nmy775.js";
+} from "./chunk-0tfwdnmf.js";
 import {
   deployStaticSiteWithExternalDnsFull
 } from "./chunk-d7p84vz5.js";
@@ -347,7 +347,7 @@ async function deployServerlessApp(config, environment, opts = {}) {
   }
   if (imageMode) {
     step("Building + pushing container image");
-    const { buildAndPushServerlessImage } = await import("./chunk-296n8hvt.js");
+    const { buildAndPushServerlessImage } = await import("./chunk-c3yy2xyq.js");
     const built = await buildAndPushServerlessImage({
       app,
       projectRoot,

package/dist/deploy/dashboard-config-module.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Serialize the resolved cloud config into a self-contained module for the
+ * dashboard to read on the box.
+ *
+ * Copying the project's `cloud.config.ts` verbatim does not work: a real config
+ * imports things. Stacks' does
+ * `import { servers } from '~/cloud/servers'` and `import { env } from
+ * '@stacksjs/env'` — neither the path alias nor the package exists in the
+ * dashboard's release dir, so the import would throw and the dashboard would
+ * come up describing nothing.
+ *
+ * The deploy machine has already resolved the config to a plain object, so we
+ * ship THAT as a literal. No imports, no aliases, nothing to resolve.
+ *
+ * Credentials are stripped on the way out (see {@link redactForDashboard}).
+ */
+import type { CloudConfig } from '@ts-cloud/core';
+/**
+ * Strip everything the dashboard does not need to read.
+ *
+ * Two rules:
+ *
+ * 1. **No credentials.** The Hetzner API token is the big one: it controls the
+ *    whole cloud account (create and destroy any server), and unlike a site's
+ *    own secrets it is otherwise NOT on the box at all. Putting it in the
+ *    dashboard's release would turn a dashboard compromise into an account
+ *    compromise. AWS credentials go for the same reason.
+ *
+ * 2. **Env keys, not env values.** The dashboard only ever displays which env
+ *    vars a site defines, never their values — so ship the keys and blank the
+ *    values. The running site has its own `.env` on the box regardless; there
+ *    is no reason for a second copy to sit in the dashboard's directory.
+ */
+export declare function redactForDashboard(config: CloudConfig): Record<string, any>;
+/**
+ * The `cloud.config.ts` module text shipped in the dashboard's release. Reads
+ * as a plain literal so bun can import it on the box with nothing installed
+ * beyond the ts-cloud package itself.
+ */
+export declare function serializeDashboardConfig(config: CloudConfig): string;

package/dist/deploy/dashboard-config-module.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/index.js

@@ -12,10 +12,10 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "../chunk-eapb9et8.js";
+} from "../chunk-khfnaap2.js";
 import {
   buildAndPushServerlessImage
-} from "../chunk-qgnyzfmx.js";
+} from "../chunk-5mejsd43.js";
 import"../chunk-b82pbxyp.js";
 import"../chunk-hsk6fe6x.js";
 import {
@@ -30,8 +30,8 @@ import {
   resolveUiSource,
   siteInstallBase,
   validateDeploymentConfig
-} from "../chunk-xgnxz5dz.js";
-import"../chunk-49nmy775.js";
+} from "../chunk-5cfcv2s2.js";
+import"../chunk-0tfwdnmf.js";
 import"../chunk-93hjhs78.js";
 import {
   deleteStaticSite,

package/dist/deploy/management-dashboard.d.ts

@@ -1,23 +1,34 @@
 /**
- * Auto-deploy of the ts-cloud management dashboard (the `@ts-cloud/ui` stx app)
- * on every server provision/deploy.
+ * Auto-deploy of the ts-cloud management dashboard on every server
+ * provision/deploy, so every box ships with a cockpit.
  *
- * Resolves the UI directory (the repo's local `packages/ui/`, else the prebuilt
- * UI that ships inside the installed package at `dist/ui`), derives a `dashboard.<apex>`
- * host, and injects it into `config.sites` as a server-static site. It is served
- * SECURE BY DEFAULT: the dashboard is served behind htpasswd on every deploy.
- * The password is resolved as: `TS_CLOUD_UI_PASSWORD` when set, else a strong
- * auto-generated one (persisted to `.ts-cloud/dashboard-credentials.json` so it
- * stays stable across deploys and printed once in the deploy log). Serving the
- * dashboard publicly is an explicit, deliberate opt-in via `TS_CLOUD_UI_PUBLIC`.
+ * **Live (the default).** The dashboard runs as a service on the box
+ * (`cloud dashboard:serve --box`) behind the proxy. It serves live data and the
+ * control API, and authenticates itself: a login page, sessions, and per-site
+ * collaborator grants. The release is tiny — the project's cloud config plus a
+ * `package.json` — and the box installs `@stacksjs/ts-cloud` from npm, which
+ * carries both the CLI and the UI it serves.
+ *
+ * On the first live deploy the box mints an admin and prints the password once
+ * into the deploy log. Users and the session key live in the site's shared
+ * `.ts-cloud/`, so they survive later deploys.
+ *
+ * **Static (`TS_CLOUD_UI_STATIC`).** The built UI shipped as files behind
+ * htpasswd. One shared password, all data baked in at build time, and therefore
+ * no collaborators. Kept for boxes that cannot run the service.
  *
  * Env:
+ * - `TS_CLOUD_UI_STATIC`    set truthy for the old static + htpasswd model
+ * - `TS_CLOUD_UI_DOMAIN`    explicit dashboard host (else `dashboard.<apex>`)
+ * - `TS_CLOUD_UI_PORT`      loopback port for the live service (default 7676)
+ * - `TS_CLOUD_UI_VERSION`   ts-cloud version the box installs (default: this one)
+ * - `TS_CLOUD_UI_DISABLE`   set truthy to skip auto-deploy
+ *
+ * Static mode only:
  * - `TS_CLOUD_UI_PASSWORD`  htpasswd password (unset ⇒ auto-generated + saved)
  * - `TS_CLOUD_UI_PUBLIC`    set truthy to serve WITHOUT auth (opt-out, insecure)
  * - `TS_CLOUD_UI_USERNAME`  htpasswd user (default `admin`)
- * - `TS_CLOUD_UI_DOMAIN`    explicit dashboard host (else `dashboard.<apex>`)
  * - `TS_CLOUD_UI_REALM`     browser auth realm
- * - `TS_CLOUD_UI_DISABLE`   set truthy to skip auto-deploy
  */
 import type { CloudConfig } from '@ts-cloud/core';
 /**
@@ -51,10 +62,32 @@ export interface EnsureDashboardLogger {
     info: (msg: string) => void;
     warn: (msg: string) => void;
 }
+/** Where the live dashboard's release is staged, inside the project checkout. */
+export declare const LIVE_STAGE_DIR: string;
+/**
+ * The ts-cloud version the box should install. Reads this package's own version
+ * so a box runs a dashboard matching the CLI that deployed it, rather than
+ * drifting to whatever `latest` happens to be mid-deploy.
+ */
+export declare function resolveDashboardVersion(): string;
+/**
+ * Stage the live dashboard's release: the RESOLVED cloud config inlined as a
+ * self-contained module, plus a `package.json` whose install pulls the CLI and
+ * UI from npm.
+ *
+ * The config is serialized rather than copied because a real one imports things
+ * that do not exist on the box — Stacks' does `import { servers } from
+ * '~/cloud/servers'` — and the import would throw, leaving the dashboard with
+ * nothing to describe. Credentials are stripped on the way out.
+ *
+ * Returns the staged directory relative to `cwd`, or null when staging fails.
+ */
+export declare function stageLiveDashboardRoot(config: CloudConfig, cwd: string, logger: EnsureDashboardLogger): string | null;
 /**
- * Resolve the UI source to ship. Prefers the repo's local `packages/ui/` (built
- * on the deploy machine), then the prebuilt UI bundled in the installed package.
- * Returns `{ uiRoot, build }` or null when no UI is available.
+ * Resolve the UI source to ship (STATIC mode only — the live dashboard gets its
+ * UI from the npm package it installs on the box). Prefers the repo's local
+ * `packages/ui/` (built on the deploy machine), then the prebuilt UI bundled in
+ * the installed package. Returns `{ uiRoot, build }` or null when unavailable.
  */
 export declare function resolveUiSource(cwd: string): {
     uiRoot: string;

package/dist/drivers/index.js

@@ -48,8 +48,8 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "../chunk-xgnxz5dz.js";
-import"../chunk-49nmy775.js";
+} from "../chunk-5cfcv2s2.js";
+import"../chunk-0tfwdnmf.js";
 import"../chunk-93hjhs78.js";
 import"../chunk-qpj3edwz.js";
 import"../chunk-vd87cpvn.js";

package/dist/drivers/shared/deploy-script.d.ts

@@ -25,6 +25,13 @@ export interface BuildSiteDeployScriptOptions {
      * `node_modules`.
      */
     preStartCommands?: string[];
+    /**
+     * Extra paths kept in `shared/` and symlinked into each release, so they
+     * survive a deploy. `.env` is always shared; anything the app WRITES and must
+     * keep (a state directory, a database file) has to be listed here or the next
+     * release silently starts from empty.
+     */
+    sharedPaths?: readonly string[];
     /**
      * True zero-downtime cutover for ported sites: the new release runs as its
      * own systemd instance (`<slug>-<site>@<releaseId>`) that binds the same

package/dist/index.js

@@ -55,10 +55,10 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "./chunk-eapb9et8.js";
+} from "./chunk-khfnaap2.js";
 import {
   buildAndPushServerlessImage
-} from "./chunk-qgnyzfmx.js";
+} from "./chunk-5mejsd43.js";
 import {
   CloudWatchLogsClient,
   EFSClient,
@@ -105,7 +105,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-xgnxz5dz.js";
+} from "./chunk-5cfcv2s2.js";
 import {
   ABTestManager,
   AI,
@@ -137,6 +137,8 @@ import {
   ContainerRegistryManager,
   CredentialError,
   CrossRegionReferenceManager,
+  DASHBOARD_ENTRY,
+  DASHBOARD_STATE_DIR,
   DEFAULT_SERVICE_LIMITS,
   DLQMonitoringManager,
   DNS,
@@ -504,7 +506,7 @@ import {
   withSecurity,
   withTimeout,
   xrayManager
-} from "./chunk-49nmy775.js";
+} from "./chunk-0tfwdnmf.js";
 import {
   EC2Client,
   SSMClient
@@ -5118,6 +5120,8 @@ export {
   DNS,
   DLQMonitoringManager,
   DEFAULT_SERVICE_LIMITS,
+  DASHBOARD_STATE_DIR,
+  DASHBOARD_ENTRY,
   DASHBOARD_CREDENTIALS_FILE,
   CrossRegionReferenceManager,
   CredentialError,