@stacksjs/ts-cloud 0.7.22 → 0.7.24

package/dist/{chunk-kcxxwg3j.js → chunk-5cfcv2s2.js}

@@ -3818,17 +3818,59 @@ function buildLocalArtifactFetch(localPath, siteName) {
   ];
 }
 // src/drivers/shared/compute-deploy.ts
-import { copyFileSync as copyFileSync2 } from "node:fs";
+import { copyFileSync } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
 import { join as join5 } from "node:path";
 
 // src/deploy/management-dashboard.ts
 import { execSync as execSync2 } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { chmodSync, copyFileSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync3, writeFileSync } from "node:fs";
+import { chmodSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync3, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, isAbsolute, join as join4 } from "node:path";
 import { fileURLToPath } from "node:url";
+
+// src/deploy/dashboard-config-module.ts
+function blankValues(record) {
+  if (!record || typeof record !== "object")
+    return record;
+  return Object.fromEntries(Object.keys(record).map((key) => [key, ""]));
+}
+function redactForDashboard(config) {
+  const safe = JSON.parse(JSON.stringify(config ?? {}));
+  if (safe.hetzner)
+    delete safe.hetzner.apiToken;
+  delete safe.aws;
+  for (const site of Object.values(safe.sites ?? {})) {
+    if (site?.env)
+      site.env = blankValues(site.env);
+    if (site?.environment)
+      site.environment = blankValues(site.environment);
+  }
+  for (const env2 of Object.values(safe.environments ?? {})) {
+    if (env2?.variables)
+      env2.variables = blankValues(env2.variables);
+  }
+  for (const db of Object.values(safe.infrastructure?.databases ?? {})) {
+    if (db?.password)
+      db.password = "";
+  }
+  return safe;
+}
+function serializeDashboardConfig(config) {
+  const safe = redactForDashboard(config);
+  return [
+    "// Generated by ts-cloud for the management dashboard — do not edit.",
+    "//",
+    "// This is the project's resolved cloud config, inlined so it needs no",
+    "// imports on the box. Credentials are deliberately absent.",
+    `export default ${JSON.stringify(safe, null, 2)}`,
+    ""
+  ].join(`
+`);
+}
+
+// src/deploy/management-dashboard.ts
 var MANAGEMENT_DASHBOARD_SITE = "dashboard";
 var DASHBOARD_CREDENTIALS_FILE = join4(".ts-cloud", "dashboard-credentials.json");
 function generatePassword() {
@@ -3865,12 +3907,6 @@ function truthy(v) {
   return v != null && v !== "" && v !== "0" && v.toLowerCase() !== "false";
 }
 var LIVE_STAGE_DIR = join4(".ts-cloud", "dashboard-release");
-var CONFIG_CANDIDATES = [
-  ["config", "cloud.ts"],
-  ["config", "cloud.js"],
-  ["cloud.config.ts"],
-  ["cloud.config.js"]
-];
 function resolveDashboardVersion() {
   const explicit = process.env.TS_CLOUD_UI_VERSION?.trim();
   if (explicit)
@@ -3885,22 +3921,15 @@ function resolveDashboardVersion() {
   }
   return "latest";
 }
-function stageLiveDashboardRoot(cwd, logger) {
-  const source = CONFIG_CANDIDATES.map((parts) => join4(cwd, ...parts)).find((file) => existsSync2(file));
-  if (!source) {
-    logger.warn("Management dashboard: no cloud config found to ship — skipping the live dashboard.");
+function stageLiveDashboardRoot(config, cwd, logger) {
+  if (!config?.project?.slug) {
+    logger.warn("Management dashboard: the cloud config has no project slug — skipping the live dashboard.");
     return null;
   }
   const stage = join4(cwd, LIVE_STAGE_DIR);
   try {
     mkdirSync(stage, { recursive: true });
-    const isStacksLayout = source.endsWith(join4("config", "cloud.ts")) || source.endsWith(join4("config", "cloud.js"));
-    if (isStacksLayout) {
-      mkdirSync(join4(stage, "config"), { recursive: true });
-      copyFileSync(source, join4(stage, "config", source.endsWith(".ts") ? "cloud.ts" : "cloud.js"));
-    } else {
-      copyFileSync(source, join4(stage, source.endsWith(".ts") ? "cloud.config.ts" : "cloud.config.js"));
-    }
+    writeFileSync(join4(stage, "cloud.config.ts"), serializeDashboardConfig(config));
     const pkg = {
       name: "ts-cloud-dashboard",
       private: true,
@@ -3946,7 +3975,7 @@ function ensureManagementDashboard(config, options = {}) {
   const port = Number(process.env.TS_CLOUD_UI_PORT) || undefined;
   const sites = { ...config.sites ?? {} };
   if (!truthy(process.env.TS_CLOUD_UI_STATIC)) {
-    const uiRoot = stageLiveDashboardRoot(cwd, logger);
+    const uiRoot = stageLiveDashboardRoot(config, cwd, logger);
     if (!uiRoot)
       return config;
     const resolved2 = resolveManagementDashboardSites(config, environment ?? "production", {
@@ -4729,7 +4758,7 @@ async function deployAllComputeSites(options) {
         }
         try {
           const copy = join5(tmpdir2(), `${slug}-${name}-${sha}.tar.gz`);
-          copyFileSync2(dashboardTarball, copy);
+          copyFileSync(dashboardTarball, copy);
           dashboardTarballBySite.set(name, copy);
         } catch {
           dashboardTarballBySite.set(name, dashboardTarball);

package/dist/{chunk-js3vrvvn.js → chunk-khfnaap2.js}

@@ -28,7 +28,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-kcxxwg3j.js";
+} from "./chunk-5cfcv2s2.js";
 import {
   artifactKey,
   composeServerlessAppTemplate,

package/dist/deploy/dashboard-config-module.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Serialize the resolved cloud config into a self-contained module for the
+ * dashboard to read on the box.
+ *
+ * Copying the project's `cloud.config.ts` verbatim does not work: a real config
+ * imports things. Stacks' does
+ * `import { servers } from '~/cloud/servers'` and `import { env } from
+ * '@stacksjs/env'` — neither the path alias nor the package exists in the
+ * dashboard's release dir, so the import would throw and the dashboard would
+ * come up describing nothing.
+ *
+ * The deploy machine has already resolved the config to a plain object, so we
+ * ship THAT as a literal. No imports, no aliases, nothing to resolve.
+ *
+ * Credentials are stripped on the way out (see {@link redactForDashboard}).
+ */
+import type { CloudConfig } from '@ts-cloud/core';
+/**
+ * Strip everything the dashboard does not need to read.
+ *
+ * Two rules:
+ *
+ * 1. **No credentials.** The Hetzner API token is the big one: it controls the
+ *    whole cloud account (create and destroy any server), and unlike a site's
+ *    own secrets it is otherwise NOT on the box at all. Putting it in the
+ *    dashboard's release would turn a dashboard compromise into an account
+ *    compromise. AWS credentials go for the same reason.
+ *
+ * 2. **Env keys, not env values.** The dashboard only ever displays which env
+ *    vars a site defines, never their values — so ship the keys and blank the
+ *    values. The running site has its own `.env` on the box regardless; there
+ *    is no reason for a second copy to sit in the dashboard's directory.
+ */
+export declare function redactForDashboard(config: CloudConfig): Record<string, any>;
+/**
+ * The `cloud.config.ts` module text shipped in the dashboard's release. Reads
+ * as a plain literal so bun can import it on the box with nothing installed
+ * beyond the ts-cloud package itself.
+ */
+export declare function serializeDashboardConfig(config: CloudConfig): string;

package/dist/deploy/dashboard-config-module.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/index.js

@@ -12,7 +12,7 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "../chunk-js3vrvvn.js";
+} from "../chunk-khfnaap2.js";
 import {
   buildAndPushServerlessImage
 } from "../chunk-5mejsd43.js";
@@ -30,7 +30,7 @@ import {
   resolveUiSource,
   siteInstallBase,
   validateDeploymentConfig
-} from "../chunk-kcxxwg3j.js";
+} from "../chunk-5cfcv2s2.js";
 import"../chunk-0tfwdnmf.js";
 import"../chunk-93hjhs78.js";
 import {

package/dist/deploy/management-dashboard.d.ts

@@ -71,15 +71,18 @@ export declare const LIVE_STAGE_DIR: string;
  */
 export declare function resolveDashboardVersion(): string;
 /**
- * Stage the live dashboard's release: the project's cloud config (so the box
- * can resolve the same sites) plus a `package.json` whose install pulls the CLI
- * and UI from npm.
+ * Stage the live dashboard's release: the RESOLVED cloud config inlined as a
+ * self-contained module, plus a `package.json` whose install pulls the CLI and
+ * UI from npm.
  *
- * Returns the staged directory relative to `cwd`, or null when the project has
- * no cloud config to ship — without one the dashboard on the box would have
- * nothing to describe.
+ * The config is serialized rather than copied because a real one imports things
+ * that do not exist on the box — Stacks' does `import { servers } from
+ * '~/cloud/servers'` — and the import would throw, leaving the dashboard with
+ * nothing to describe. Credentials are stripped on the way out.
+ *
+ * Returns the staged directory relative to `cwd`, or null when staging fails.
  */
-export declare function stageLiveDashboardRoot(cwd: string, logger: EnsureDashboardLogger): string | null;
+export declare function stageLiveDashboardRoot(config: CloudConfig, cwd: string, logger: EnsureDashboardLogger): string | null;
 /**
  * Resolve the UI source to ship (STATIC mode only — the live dashboard gets its
  * UI from the npm package it installs on the box). Prefers the repo's local

package/dist/drivers/index.js

@@ -48,7 +48,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "../chunk-kcxxwg3j.js";
+} from "../chunk-5cfcv2s2.js";
 import"../chunk-0tfwdnmf.js";
 import"../chunk-93hjhs78.js";
 import"../chunk-qpj3edwz.js";

package/dist/index.js

@@ -55,7 +55,7 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "./chunk-js3vrvvn.js";
+} from "./chunk-khfnaap2.js";
 import {
   buildAndPushServerlessImage
 } from "./chunk-5mejsd43.js";
@@ -105,7 +105,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-kcxxwg3j.js";
+} from "./chunk-5cfcv2s2.js";
 import {
   ABTestManager,
   AI,