@stacksjs/ts-cloud 0.7.31 → 0.7.32

package/dist/{chunk-0c69nbaa.js → chunk-dah449r1.js}

@@ -78,6 +78,17 @@ function buildPantryServiceScript(services) {
 }
 
 // src/drivers/shared/db-provision.ts
+function isLocalDatabase(database) {
+  return !database?.host || database.host === "127.0.0.1" || database.host === "localhost";
+}
+function pgAdminCommand(database, tool = "psql") {
+  const port = database?.port ?? 5432;
+  if (isLocalDatabase(database))
+    return `${tool} -p ${port} -U postgres`;
+  const user = database?.username || "postgres";
+  const env = database?.password ? `PGPASSWORD='${database.password.replace(/'/g, `'\\''`)}' ` : "";
+  return `${env}${tool} -h ${database.host} -p ${port} -U ${user} -w`;
+}
 function enabled(spec) {
   return spec === true || typeof spec === "object" && spec != null;
 }
@@ -121,7 +132,7 @@ function buildServicesProvisionScript(services = {}, _options = {}) {
 function buildDatabaseSetupScript(database, services = {}) {
   if (!database?.name)
     return [];
-  if (database.host && database.host !== "127.0.0.1" && database.host !== "localhost")
+  if (!isLocalDatabase(database))
     return [];
   const name = database.name;
   const user = database.username || name;
@@ -154,10 +165,11 @@ function buildDatabaseSetupScript(database, services = {}) {
       return lines;
     };
     const extraUsers2 = database.users || [];
+    const pgPort = database.port ?? 5432;
     return [
       pantryEnvActivation(),
-      "for i in $(seq 1 30); do pg_isready -h 127.0.0.1 -p 5432 -q && break; sleep 2; done",
-      "psql -h 127.0.0.1 -p 5432 -U postgres <<'TS_CLOUD_PG_EOF'",
+      `for i in $(seq 1 30); do pg_isready -p ${pgPort} -q && break; sleep 2; done`,
+      `${pgAdminCommand(database)} <<'TS_CLOUD_PG_EOF'`,
       ...pgEnsureRole(user, pass),
       `SELECT 'CREATE DATABASE ${pgIdent(name)} OWNER ${pgIdent(user)}' ` + `WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = ${pgLit(name)})\\gexec`,
       ...extraUsers2.flatMap((u) => [...pgEnsureRole(u.username, u.password), ...pgGrant(u)]),
@@ -1388,7 +1400,7 @@ function buildBackupRestoreScript(database, options = {}) {
   const name = database.name;
   const isPg = database.engine === "postgres";
   const locate = options.from ? `TS_CLOUD_DUMP="${options.from}"` : `TS_CLOUD_DUMP="$(find ${BACKUP_OUTPUT_DIR} -type f -name '*${name}*.sql' -o -type f -name '*${name}*.sql.gz' 2>/dev/null | xargs -r ls -1t 2>/dev/null | head -1)"`;
-  const client = isPg ? `psql -h 127.0.0.1 -p ${database.port ?? 5432} -U postgres -d "${name}"` : `mysql --socket=${engineSocket(database.engine)} -u root "${name}"`;
+  const client = isPg ? `${pgAdminCommand(database)} -d "${name}"` : `mysql --socket=${engineSocket(database.engine)} -u root "${name}"`;
   return [
     "set -uo pipefail",
     'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true',
@@ -5098,4 +5110,4 @@ function buildCloudFrontOriginConfig(options) {
     CustomErrorResponses: { Quantity: 0 }
   };
 }
-export { siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };
+export { siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, pgAdminCommand, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };

package/dist/{chunk-crcjdm09.js → chunk-jgenfdz6.js}

@@ -22,13 +22,14 @@ import {
   buildBackupRestoreScript,
   buildRollbackScript,
   createCloudDriver,
+  pgAdminCommand,
   releasePaths,
   resolveHetznerLocation,
   resolveSiteFramework,
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-0c69nbaa.js";
+} from "./chunk-dah449r1.js";
 import {
   artifactKey,
   composeServerlessAppTemplate,
@@ -10913,33 +10914,33 @@ function mysqlExec(engine, sql) {
   const sock = engine === "mariadb" ? SOCKETS.mariadb : SOCKETS.mysql;
   return [`mysql --socket=${sock} -u root <<'TS_CLOUD_SQL_EOF'`, ...sql, "TS_CLOUD_SQL_EOF"];
 }
-function pgExec(sql) {
-  return ["psql -h 127.0.0.1 -p 5432 -U postgres -tA <<'TS_CLOUD_PG_EOF'", ...sql, "TS_CLOUD_PG_EOF"];
+function pgExec(sql, database) {
+  return [`${pgAdminCommand(database)} -tA <<'TS_CLOUD_PG_EOF'`, ...sql, "TS_CLOUD_PG_EOF"];
 }
-function buildListScript(engine) {
+function buildListScript(engine, database) {
   if (engine === "postgres") {
     return pgExec([
       "SELECT 'DB=' || datname FROM pg_database WHERE datistemplate = false;",
       "SELECT 'USER=' || usename FROM pg_user;"
-    ]);
+    ], database);
   }
   return mysqlExec(engine, [
     "SELECT CONCAT('DB=', schema_name) FROM information_schema.schemata WHERE schema_name NOT IN ('information_schema', 'mysql', 'performance_schema', 'sys');",
     "SELECT DISTINCT CONCAT('USER=', User) FROM mysql.user WHERE User NOT IN ('root', 'mysql.sys', 'mysql.session', 'mysql.infoschema', 'debian-sys-maint');"
   ]);
 }
-function buildCreateDatabaseScript(engine, name) {
+function buildCreateDatabaseScript(engine, name, database) {
   if (engine === "postgres") {
     return pgExec([
       `SELECT 'CREATE DATABASE ${pgIdent(name)}' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = ${pgLit(name)})\\gexec`
-    ]);
+    ], database);
   }
   return mysqlExec(engine, [
     `CREATE DATABASE IF NOT EXISTS \`${mysqlIdent(name)}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`
   ]);
 }
-function buildCreateUserScript(engine, input) {
-  const { username, password, database, access: access4 } = input;
+function buildCreateUserScript(engine, input, database) {
+  const { username, password, database: grantDb, access: access4 } = input;
   if (engine === "postgres") {
     const lines2 = [
       "DO $$ BEGIN",
@@ -10947,10 +10948,10 @@ function buildCreateUserScript(engine, input) {
       `  ELSE ALTER ROLE ${pgIdent(username)} LOGIN PASSWORD ${pgLit(password)}; END IF;`,
       "END $$;"
     ];
-    if (database) {
-      lines2.push(access4 === "readonly" ? `GRANT CONNECT ON DATABASE ${pgIdent(database)} TO ${pgIdent(username)};` : `GRANT ALL PRIVILEGES ON DATABASE ${pgIdent(database)} TO ${pgIdent(username)};`);
+    if (grantDb) {
+      lines2.push(access4 === "readonly" ? `GRANT CONNECT ON DATABASE ${pgIdent(grantDb)} TO ${pgIdent(username)};` : `GRANT ALL PRIVILEGES ON DATABASE ${pgIdent(grantDb)} TO ${pgIdent(username)};`);
     }
-    return pgExec(lines2);
+    return pgExec(lines2, database);
   }
   const priv = access4 === "readonly" ? "SELECT" : "ALL PRIVILEGES";
   const lines = [
@@ -10959,8 +10960,8 @@ function buildCreateUserScript(engine, input) {
     `ALTER USER '${mysqlLit(username)}'@'%' IDENTIFIED BY '${mysqlLit(password)}';`,
     `ALTER USER '${mysqlLit(username)}'@'localhost' IDENTIFIED BY '${mysqlLit(password)}';`
   ];
-  if (database) {
-    lines.push(`GRANT ${priv} ON \`${mysqlIdent(database)}\`.* TO '${mysqlLit(username)}'@'%';`, `GRANT ${priv} ON \`${mysqlIdent(database)}\`.* TO '${mysqlLit(username)}'@'localhost';`);
+  if (grantDb) {
+    lines.push(`GRANT ${priv} ON \`${mysqlIdent(grantDb)}\`.* TO '${mysqlLit(username)}'@'%';`, `GRANT ${priv} ON \`${mysqlIdent(grantDb)}\`.* TO '${mysqlLit(username)}'@'localhost';`);
   }
   lines.push("FLUSH PRIVILEGES;");
   return mysqlExec(engine, lines);
@@ -11002,24 +11003,24 @@ async function runDb(config6, environment, commands, comment) {
 }
 async function listDatabases(config6, environment) {
   const engine = resolveDbEngine(config6);
-  const r = await runDb(config6, environment, buildListScript(engine), "ts-cloud db:list");
+  const r = await runDb(config6, environment, buildListScript(engine, resolveAppDatabase(config6)), "ts-cloud db:list");
   const parsed = r.ok && r.stdout ? parseDbList(r.stdout) : { databases: [], users: [] };
   return { ...r, engine, ...parsed };
 }
 async function createDatabase(config6, environment, name) {
   const engine = resolveDbEngine(config6);
-  return runDb(config6, environment, buildCreateDatabaseScript(engine, name), `ts-cloud db:create ${name}`);
+  return runDb(config6, environment, buildCreateDatabaseScript(engine, name, resolveAppDatabase(config6)), `ts-cloud db:create ${name}`);
 }
 async function createDatabaseUser(config6, environment, input) {
   const engine = resolveDbEngine(config6);
-  return runDb(config6, environment, buildCreateUserScript(engine, input), `ts-cloud db:user ${input.username}`);
+  return runDb(config6, environment, buildCreateUserScript(engine, input, resolveAppDatabase(config6)), `ts-cloud db:user ${input.username}`);
 }
 var DB_BACKUP_DIR = "/var/backups/ts-cloud/databases";
-function buildBackupScript(engine, name, destDir = DB_BACKUP_DIR) {
+function buildBackupScript(engine, name, destDir = DB_BACKUP_DIR, database) {
   const file = `${destDir}/${name}-$(date +%Y%m%d-%H%M%S).sql.gz`;
   const mkdir4 = `mkdir -p ${destDir}`;
   if (engine === "postgres")
-    return [mkdir4, `pg_dump -h 127.0.0.1 -p 5432 -U postgres ${name} | gzip > "${file}"`, `echo "BACKUP=${file}"`, `ls -l "${file}"`];
+    return [mkdir4, `${pgAdminCommand(database, "pg_dump")} ${name} | gzip > "${file}"`, `echo "BACKUP=${file}"`, `ls -l "${file}"`];
   const sock = engine === "mariadb" ? SOCKETS.mariadb : SOCKETS.mysql;
   return [mkdir4, `mysqldump --socket=${sock} -u root ${name} | gzip > "${file}"`, `echo "BACKUP=${file}"`, `ls -l "${file}"`];
 }
@@ -11045,7 +11046,7 @@ async function backupDatabase(config6, environment, name) {
   if (!isValidDbIdentifier(name))
     return { ok: false, error: "Database name must be a valid identifier.", database: name };
   const engine = resolveDbEngine(config6);
-  const r = await runDb(config6, environment, buildBackupScript(engine, name), `ts-cloud db:backup ${name}`);
+  const r = await runDb(config6, environment, buildBackupScript(engine, name, DB_BACKUP_DIR, resolveAppDatabase(config6)), `ts-cloud db:backup ${name}`);
   return { ...r, database: name };
 }
 async function listDatabaseBackups(config6, environment) {

package/dist/deploy/dashboard-database.d.ts

@@ -4,20 +4,20 @@
  * the pantry UNIX socket; Postgres over local TCP — mirroring the provisioning
  * path in {@link import('../drivers/shared/db-provision')}.
  */
-import type { CloudConfig, EnvironmentType } from '@ts-cloud/core';
+import type { CloudConfig, DatabaseConfig, EnvironmentType } from '@ts-cloud/core';
 export type DbEngine = 'mysql' | 'mariadb' | 'postgres';
 /** Valid SQL identifier for a database/user name (kept strict for safety). */
 export declare function isValidDbIdentifier(value: string): boolean;
 export declare function resolveDbEngine(config: CloudConfig): DbEngine;
-export declare function buildListScript(engine: DbEngine): string[];
-export declare function buildCreateDatabaseScript(engine: DbEngine, name: string): string[];
+export declare function buildListScript(engine: DbEngine, database?: DatabaseConfig): string[];
+export declare function buildCreateDatabaseScript(engine: DbEngine, name: string, database?: DatabaseConfig): string[];
 export interface CreateUserInput {
     username: string;
     password: string;
     database?: string;
     access?: 'all' | 'readonly';
 }
-export declare function buildCreateUserScript(engine: DbEngine, input: CreateUserInput): string[];
+export declare function buildCreateUserScript(engine: DbEngine, input: CreateUserInput, database?: DatabaseConfig): string[];
 export declare function parseDbList(output: string): {
     databases: string[];
     users: string[];
@@ -40,9 +40,11 @@ export declare const DB_BACKUP_DIR = "/var/backups/ts-cloud/databases";
 /**
  * Script that dumps a single database to a timestamped, gzipped file. The name
  * is a validated SQL identifier (no shell metacharacters), so it is safe to
- * embed directly. The timestamp is computed on the box.
+ * embed directly. The timestamp is computed on the box. Postgres connects over
+ * the local unix socket for a co-located engine, or TCP with credentials for
+ * an external host (see {@link pgAdminCommand}).
  */
-export declare function buildBackupScript(engine: DbEngine, name: string, destDir?: string): string[];
+export declare function buildBackupScript(engine: DbEngine, name: string, destDir?: string, database?: DatabaseConfig): string[];
 /** Script that lists the most recent dumps (newest first). */
 export declare function buildListBackupsScript(destDir?: string): string[];
 export declare function parseBackups(output: string): Array<{

package/dist/deploy/index.js

@@ -12,7 +12,7 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "../chunk-crcjdm09.js";
+} from "../chunk-jgenfdz6.js";
 import {
   buildAndPushServerlessImage
 } from "../chunk-tskj9fay.js";
@@ -30,7 +30,7 @@ import {
   resolveUiSource,
   siteInstallBase,
   validateDeploymentConfig
-} from "../chunk-0c69nbaa.js";
+} from "../chunk-dah449r1.js";
 import"../chunk-stt1z5cx.js";
 import"../chunk-93hjhs78.js";
 import {

package/dist/drivers/index.js

@@ -50,7 +50,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "../chunk-0c69nbaa.js";
+} from "../chunk-dah449r1.js";
 import"../chunk-stt1z5cx.js";
 import"../chunk-93hjhs78.js";
 import"../chunk-qpj3edwz.js";

package/dist/drivers/shared/backups.d.ts

@@ -34,7 +34,9 @@ export interface BackupRestoreOptions {
  * Build the commands that restore a database from a ts-backups dump on the box.
  * With no `from`, the newest dump under {@link BACKUP_OUTPUT_DIR} matching the
  * database name is used. Handles plain `.sql` and gzipped `.sql.gz`. MySQL/
- * MariaDB restore over the root unix socket; Postgres via `psql -U postgres`.
+ * MariaDB restore over the root unix socket; Postgres over the local unix
+ * socket for a co-located engine, or TCP with credentials for an external
+ * host (see {@link pgAdminCommand}).
  * Returns `[]` when the database has no name.
  */
 export declare function buildBackupRestoreScript(database: DatabaseConfig | undefined, options?: BackupRestoreOptions): string[];

package/dist/drivers/shared/db-provision.d.ts

@@ -6,10 +6,32 @@
  * install nothing and just wire `.env` — see {@link buildManagedDbEnv}.
  *
  * pantry services listen on TCP localhost ports (mysql/mariadb 3306, postgres
- * 5432, redis 6379, memcached 11211, meilisearch 7700); DB setup connects over
- * TCP, and the engine clients are on PATH via `pantry env`.
+ * 5432, redis 6379, memcached 11211, meilisearch 7700) and the engine clients
+ * are on PATH via `pantry env`. Admin commands (db setup, dumps, restores)
+ * connect over the engine's local unix socket — see {@link pgAdminCommand}.
  */
 import type { ComputeServicesConfig, DatabaseConfig } from '@ts-cloud/core';
+/**
+ * True when the database is co-located with the box (the managed-services
+ * engine): no host configured, or an explicit loopback host. Anything else is
+ * an external/managed database reached over TCP.
+ */
+export declare function isLocalDatabase(database: DatabaseConfig | undefined): boolean;
+/**
+ * Build the connection prefix for a postgres admin command (`psql`/`pg_dump`)
+ * run on the box.
+ *
+ * The pantry postgres pg_hba grants `trust` on the local unix socket but
+ * requires md5 password auth over TCP loopback — and the `postgres` superuser
+ * has no password — so against the co-located engine admin clients MUST use
+ * the socket: omit `-h` entirely and the pantry client uses its compiled-in
+ * default socket dir, which matches the server's by construction (verified
+ * on-box: `psql -U postgres` from root connects passwordless). Against an
+ * external/managed host, use TCP with the configured credentials
+ * (`PGPASSWORD` inline + `-w`, so a missing password fails fast instead of
+ * prompting forever).
+ */
+export declare function pgAdminCommand(database: DatabaseConfig | undefined, tool?: 'psql' | 'pg_dump'): string;
 /**
  * Build pantry install + enable/start commands for each requested on-box
  * service. Idempotent (pantry install/enable/start are no-ops when satisfied).

package/dist/index.js

@@ -55,7 +55,7 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "./chunk-crcjdm09.js";
+} from "./chunk-jgenfdz6.js";
 import {
   buildAndPushServerlessImage
 } from "./chunk-tskj9fay.js";
@@ -105,7 +105,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-0c69nbaa.js";
+} from "./chunk-dah449r1.js";
 import {
   ABTestManager,
   AI,