@stacksjs/ts-cloud 0.7.31 → 0.7.33

package/dist/{chunk-crcjdm09.js → chunk-1nfkggdw.js}

@@ -22,13 +22,14 @@ import {
   buildBackupRestoreScript,
   buildRollbackScript,
   createCloudDriver,
+  pgAdminCommand,
   releasePaths,
   resolveHetznerLocation,
   resolveSiteFramework,
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-0c69nbaa.js";
+} from "./chunk-m0zayf6n.js";
 import {
   artifactKey,
   composeServerlessAppTemplate,
@@ -10913,33 +10914,33 @@ function mysqlExec(engine, sql) {
   const sock = engine === "mariadb" ? SOCKETS.mariadb : SOCKETS.mysql;
   return [`mysql --socket=${sock} -u root <<'TS_CLOUD_SQL_EOF'`, ...sql, "TS_CLOUD_SQL_EOF"];
 }
-function pgExec(sql) {
-  return ["psql -h 127.0.0.1 -p 5432 -U postgres -tA <<'TS_CLOUD_PG_EOF'", ...sql, "TS_CLOUD_PG_EOF"];
+function pgExec(sql, database) {
+  return [`${pgAdminCommand(database)} -tA <<'TS_CLOUD_PG_EOF'`, ...sql, "TS_CLOUD_PG_EOF"];
 }
-function buildListScript(engine) {
+function buildListScript(engine, database) {
   if (engine === "postgres") {
     return pgExec([
       "SELECT 'DB=' || datname FROM pg_database WHERE datistemplate = false;",
       "SELECT 'USER=' || usename FROM pg_user;"
-    ]);
+    ], database);
   }
   return mysqlExec(engine, [
     "SELECT CONCAT('DB=', schema_name) FROM information_schema.schemata WHERE schema_name NOT IN ('information_schema', 'mysql', 'performance_schema', 'sys');",
     "SELECT DISTINCT CONCAT('USER=', User) FROM mysql.user WHERE User NOT IN ('root', 'mysql.sys', 'mysql.session', 'mysql.infoschema', 'debian-sys-maint');"
   ]);
 }
-function buildCreateDatabaseScript(engine, name) {
+function buildCreateDatabaseScript(engine, name, database) {
   if (engine === "postgres") {
     return pgExec([
       `SELECT 'CREATE DATABASE ${pgIdent(name)}' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = ${pgLit(name)})\\gexec`
-    ]);
+    ], database);
   }
   return mysqlExec(engine, [
     `CREATE DATABASE IF NOT EXISTS \`${mysqlIdent(name)}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`
   ]);
 }
-function buildCreateUserScript(engine, input) {
-  const { username, password, database, access: access4 } = input;
+function buildCreateUserScript(engine, input, database) {
+  const { username, password, database: grantDb, access: access4 } = input;
   if (engine === "postgres") {
     const lines2 = [
       "DO $$ BEGIN",
@@ -10947,10 +10948,10 @@ function buildCreateUserScript(engine, input) {
       `  ELSE ALTER ROLE ${pgIdent(username)} LOGIN PASSWORD ${pgLit(password)}; END IF;`,
       "END $$;"
     ];
-    if (database) {
-      lines2.push(access4 === "readonly" ? `GRANT CONNECT ON DATABASE ${pgIdent(database)} TO ${pgIdent(username)};` : `GRANT ALL PRIVILEGES ON DATABASE ${pgIdent(database)} TO ${pgIdent(username)};`);
+    if (grantDb) {
+      lines2.push(access4 === "readonly" ? `GRANT CONNECT ON DATABASE ${pgIdent(grantDb)} TO ${pgIdent(username)};` : `GRANT ALL PRIVILEGES ON DATABASE ${pgIdent(grantDb)} TO ${pgIdent(username)};`);
     }
-    return pgExec(lines2);
+    return pgExec(lines2, database);
   }
   const priv = access4 === "readonly" ? "SELECT" : "ALL PRIVILEGES";
   const lines = [
@@ -10959,8 +10960,8 @@ function buildCreateUserScript(engine, input) {
     `ALTER USER '${mysqlLit(username)}'@'%' IDENTIFIED BY '${mysqlLit(password)}';`,
     `ALTER USER '${mysqlLit(username)}'@'localhost' IDENTIFIED BY '${mysqlLit(password)}';`
   ];
-  if (database) {
-    lines.push(`GRANT ${priv} ON \`${mysqlIdent(database)}\`.* TO '${mysqlLit(username)}'@'%';`, `GRANT ${priv} ON \`${mysqlIdent(database)}\`.* TO '${mysqlLit(username)}'@'localhost';`);
+  if (grantDb) {
+    lines.push(`GRANT ${priv} ON \`${mysqlIdent(grantDb)}\`.* TO '${mysqlLit(username)}'@'%';`, `GRANT ${priv} ON \`${mysqlIdent(grantDb)}\`.* TO '${mysqlLit(username)}'@'localhost';`);
   }
   lines.push("FLUSH PRIVILEGES;");
   return mysqlExec(engine, lines);
@@ -11002,24 +11003,24 @@ async function runDb(config6, environment, commands, comment) {
 }
 async function listDatabases(config6, environment) {
   const engine = resolveDbEngine(config6);
-  const r = await runDb(config6, environment, buildListScript(engine), "ts-cloud db:list");
+  const r = await runDb(config6, environment, buildListScript(engine, resolveAppDatabase(config6)), "ts-cloud db:list");
   const parsed = r.ok && r.stdout ? parseDbList(r.stdout) : { databases: [], users: [] };
   return { ...r, engine, ...parsed };
 }
 async function createDatabase(config6, environment, name) {
   const engine = resolveDbEngine(config6);
-  return runDb(config6, environment, buildCreateDatabaseScript(engine, name), `ts-cloud db:create ${name}`);
+  return runDb(config6, environment, buildCreateDatabaseScript(engine, name, resolveAppDatabase(config6)), `ts-cloud db:create ${name}`);
 }
 async function createDatabaseUser(config6, environment, input) {
   const engine = resolveDbEngine(config6);
-  return runDb(config6, environment, buildCreateUserScript(engine, input), `ts-cloud db:user ${input.username}`);
+  return runDb(config6, environment, buildCreateUserScript(engine, input, resolveAppDatabase(config6)), `ts-cloud db:user ${input.username}`);
 }
 var DB_BACKUP_DIR = "/var/backups/ts-cloud/databases";
-function buildBackupScript(engine, name, destDir = DB_BACKUP_DIR) {
+function buildBackupScript(engine, name, destDir = DB_BACKUP_DIR, database) {
   const file = `${destDir}/${name}-$(date +%Y%m%d-%H%M%S).sql.gz`;
   const mkdir4 = `mkdir -p ${destDir}`;
   if (engine === "postgres")
-    return [mkdir4, `pg_dump -h 127.0.0.1 -p 5432 -U postgres ${name} | gzip > "${file}"`, `echo "BACKUP=${file}"`, `ls -l "${file}"`];
+    return [mkdir4, `${pgAdminCommand(database, "pg_dump")} ${name} | gzip > "${file}"`, `echo "BACKUP=${file}"`, `ls -l "${file}"`];
   const sock = engine === "mariadb" ? SOCKETS.mariadb : SOCKETS.mysql;
   return [mkdir4, `mysqldump --socket=${sock} -u root ${name} | gzip > "${file}"`, `echo "BACKUP=${file}"`, `ls -l "${file}"`];
 }
@@ -11045,7 +11046,7 @@ async function backupDatabase(config6, environment, name) {
   if (!isValidDbIdentifier(name))
     return { ok: false, error: "Database name must be a valid identifier.", database: name };
   const engine = resolveDbEngine(config6);
-  const r = await runDb(config6, environment, buildBackupScript(engine, name), `ts-cloud db:backup ${name}`);
+  const r = await runDb(config6, environment, buildBackupScript(engine, name, DB_BACKUP_DIR, resolveAppDatabase(config6)), `ts-cloud db:backup ${name}`);
   return { ...r, database: name };
 }
 async function listDatabaseBackups(config6, environment) {
@@ -12637,7 +12638,7 @@ function renderSiteSnippet(input) {
 `);
 }
 function escapeSingle(value) {
-  return value.replace(/\\/g, "\\\\").replaceAll(String.fromCharCode(39), "\\'");
+  return value.replace(/\\/g, "\\\\").replaceAll(String.fromCharCode(39), "\\'").replace(/\r/g, "\\r").replace(/\n/g, "\\n");
 }
 function normalizeSiteName(name) {
   const normalized = name.trim();
@@ -13404,6 +13405,8 @@ async function startLocalDashboardServer(options = {}) {
           }
           if (body.port !== undefined && body.port !== null && body.port !== "" && (!Number.isInteger(Number(body.port)) || Number(body.port) < 1 || Number(body.port) > 65535))
             return json({ ok: false, error: "Port must be a number between 1 and 65535." }, 422);
+          if (typeof body.domain === "string" && body.domain.trim() && !isValidHostname(body.domain.trim()))
+            return json({ ok: false, error: `Domain '${body.domain.trim()}' is not a valid hostname.` }, 422);
           let text2 = await readFile(configPath, "utf8");
           const set = (key, valueText) => {
             text2 = setSitePropertyInCloudConfig({ configText: text2, siteName: name, key, valueText });

package/dist/{chunk-0c69nbaa.js → chunk-m0zayf6n.js}

@@ -78,6 +78,17 @@ function buildPantryServiceScript(services) {
 }
 
 // src/drivers/shared/db-provision.ts
+function isLocalDatabase(database) {
+  return !database?.host || database.host === "127.0.0.1" || database.host === "localhost";
+}
+function pgAdminCommand(database, tool = "psql") {
+  const port = database?.port ?? 5432;
+  if (isLocalDatabase(database))
+    return `${tool} -p ${port} -U postgres`;
+  const user = database?.username || "postgres";
+  const env = database?.password ? `PGPASSWORD='${database.password.replace(/'/g, `'\\''`)}' ` : "";
+  return `${env}${tool} -h ${database.host} -p ${port} -U ${user} -w`;
+}
 function enabled(spec) {
   return spec === true || typeof spec === "object" && spec != null;
 }
@@ -121,7 +132,7 @@ function buildServicesProvisionScript(services = {}, _options = {}) {
 function buildDatabaseSetupScript(database, services = {}) {
   if (!database?.name)
     return [];
-  if (database.host && database.host !== "127.0.0.1" && database.host !== "localhost")
+  if (!isLocalDatabase(database))
     return [];
   const name = database.name;
   const user = database.username || name;
@@ -154,10 +165,11 @@ function buildDatabaseSetupScript(database, services = {}) {
       return lines;
     };
     const extraUsers2 = database.users || [];
+    const pgPort = database.port ?? 5432;
     return [
       pantryEnvActivation(),
-      "for i in $(seq 1 30); do pg_isready -h 127.0.0.1 -p 5432 -q && break; sleep 2; done",
-      "psql -h 127.0.0.1 -p 5432 -U postgres <<'TS_CLOUD_PG_EOF'",
+      `for i in $(seq 1 30); do pg_isready -p ${pgPort} -q && break; sleep 2; done`,
+      `${pgAdminCommand(database)} <<'TS_CLOUD_PG_EOF'`,
       ...pgEnsureRole(user, pass),
       `SELECT 'CREATE DATABASE ${pgIdent(name)} OWNER ${pgIdent(user)}' ` + `WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = ${pgLit(name)})\\gexec`,
       ...extraUsers2.flatMap((u) => [...pgEnsureRole(u.username, u.password), ...pgGrant(u)]),
@@ -389,7 +401,14 @@ function vhostBody(options) {
   return lines;
 }
 function buildNginxVhost(options) {
-  const serverNames = [options.domain, ...options.aliases || []].filter(Boolean).join(" ");
+  const hosts = [options.domain, ...options.aliases || []].filter(Boolean);
+  for (const host of hosts) {
+    if (!/^(?=.{1,253}$)(?:\*\.)?[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/i.test(host.trim()))
+      throw new Error(`Refusing to build a vhost: '${host}' is not a valid hostname.`);
+  }
+  if (!hosts.length)
+    throw new Error("Refusing to build a vhost: no server_name (domain) was given.");
+  const serverNames = hosts.join(" ");
   const body = vhostBody(options);
   if (options.ssl) {
     const redirect = [
@@ -1388,7 +1407,7 @@ function buildBackupRestoreScript(database, options = {}) {
   const name = database.name;
   const isPg = database.engine === "postgres";
   const locate = options.from ? `TS_CLOUD_DUMP="${options.from}"` : `TS_CLOUD_DUMP="$(find ${BACKUP_OUTPUT_DIR} -type f -name '*${name}*.sql' -o -type f -name '*${name}*.sql.gz' 2>/dev/null | xargs -r ls -1t 2>/dev/null | head -1)"`;
-  const client = isPg ? `psql -h 127.0.0.1 -p ${database.port ?? 5432} -U postgres -d "${name}"` : `mysql --socket=${engineSocket(database.engine)} -u root "${name}"`;
+  const client = isPg ? `${pgAdminCommand(database)} -d "${name}"` : `mysql --socket=${engineSocket(database.engine)} -u root "${name}"`;
   return [
     "set -uo pipefail",
     'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true',
@@ -3700,7 +3719,7 @@ function buildRollbackScript(paths, options = {}) {
   return [
     ...flip,
     `TS_CLOUD_RB_ID=$(basename "$(readlink -f ${paths.current})")`,
-    `if [ -f /etc/systemd/system/${unitBase}@.service ]; then ` + `systemctl start "${unitBase}@\${TS_CLOUD_RB_ID}.service"; sleep 2; ` + `systemctl is-active --quiet "${unitBase}@\${TS_CLOUD_RB_ID}.service" || { echo "rolled-back release failed to start" >&2; exit 1; }; ` + `systemctl enable "${unitBase}@\${TS_CLOUD_RB_ID}.service" 2>/dev/null || true; ` + `systemctl list-units --plain --no-legend --type=service "${unitBase}@*.service" 2>/dev/null | awk '{print $1}' | grep -v "^${unitBase}@\${TS_CLOUD_RB_ID}.service$" | while read -r TS_CLOUD_U; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done; ` + `elif [ -f /etc/systemd/system/${unitBase}.service ]; then systemctl restart ${unitBase}.service; fi`
+    `if [ -f /etc/systemd/system/${unitBase}@.service ]; then ` + `systemctl start "${unitBase}@\${TS_CLOUD_RB_ID}.service"; sleep 2; ` + `systemctl is-active --quiet "${unitBase}@\${TS_CLOUD_RB_ID}.service" || { echo "rolled-back release failed to start" >&2; exit 1; }; ` + `systemctl enable "${unitBase}@\${TS_CLOUD_RB_ID}.service" 2>/dev/null || true; ` + `systemctl list-units --plain --no-legend --type=service "${unitBase}@*.service" 2>/dev/null | awk '{print $1}' | { grep -v "^${unitBase}@\${TS_CLOUD_RB_ID}.service$" || true; } | while read -r TS_CLOUD_U; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done; ` + `elif [ -f /etc/systemd/system/${unitBase}.service ]; then systemctl restart ${unitBase}.service; fi`
   ];
 }
 function buildPruneReleases(paths, keep = DEFAULT_KEEP_RELEASES) {
@@ -3830,7 +3849,7 @@ function buildSiteDeployScript(options) {
       ...buildActivateRelease(paths),
       `systemctl enable ${instance} 2>/dev/null || true`,
       `for TS_CLOUD_U in \${TS_CLOUD_OLD_UNITS}; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done`,
-      `systemctl list-unit-files --plain --no-legend "${unitBase}@*.service" 2>/dev/null | awk '{print $1}' | grep -v -e "^${instance}$" -e "^${unitBase}@\\.service$" | while read -r TS_CLOUD_U; do systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done`,
+      `systemctl list-unit-files --plain --no-legend "${unitBase}@*.service" 2>/dev/null | awk '{print $1}' | { grep -v -e "^${instance}$" -e "^${unitBase}@\\.service$" || true; } | while read -r TS_CLOUD_U; do systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done`,
       `if [ -f /etc/systemd/system/${serviceName} ]; then systemctl disable ${serviceName} 2>/dev/null || true; rm -f /etc/systemd/system/${serviceName}; systemctl daemon-reload; fi`,
       ...buildPruneReleases(paths, keepReleases)
     ];
@@ -3975,9 +3994,10 @@ function resolveDashboardAuth(cwd, username, logger) {
     writeFileSync(file, `${JSON.stringify({ username, password, generatedAt: new Date().toISOString() }, null, 2)}
 `);
     chmodSync(file, 384);
-    logger.info(`Management dashboard: generated a password and saved it to ${DASHBOARD_CREDENTIALS_FILE} (user: ${username}, pass: ${password}). Set TS_CLOUD_UI_PASSWORD to pin your own, or TS_CLOUD_UI_PUBLIC=1 to serve without auth.`);
+    logger.info(`Management dashboard: generated a password for '${username}' and saved it to ${DASHBOARD_CREDENTIALS_FILE} (read it there — it is not printed). Set TS_CLOUD_UI_PASSWORD to pin your own, or TS_CLOUD_UI_PUBLIC=1 to serve without auth.`);
   } catch (error) {
-    logger.warn(`Management dashboard: could not persist the generated password (${error?.message ?? error}). Using it for this deploy only — pass: ${password}`);
+    logger.warn(`Management dashboard: could not persist the generated password (${error?.message ?? error}). Using it for this deploy only — pass: ${password}
+This password is now in your deploy log. Set TS_CLOUD_UI_PASSWORD to a value of your own and redeploy once ${DASHBOARD_CREDENTIALS_FILE} is writable.`);
   }
   return { password, source: "generated" };
 }
@@ -5098,4 +5118,4 @@ function buildCloudFrontOriginConfig(options) {
     CustomErrorResponses: { Quantity: 0 }
   };
 }
-export { siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };
+export { siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, pgAdminCommand, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };

package/dist/deploy/dashboard-database.d.ts

@@ -4,20 +4,20 @@
  * the pantry UNIX socket; Postgres over local TCP — mirroring the provisioning
  * path in {@link import('../drivers/shared/db-provision')}.
  */
-import type { CloudConfig, EnvironmentType } from '@ts-cloud/core';
+import type { CloudConfig, DatabaseConfig, EnvironmentType } from '@ts-cloud/core';
 export type DbEngine = 'mysql' | 'mariadb' | 'postgres';
 /** Valid SQL identifier for a database/user name (kept strict for safety). */
 export declare function isValidDbIdentifier(value: string): boolean;
 export declare function resolveDbEngine(config: CloudConfig): DbEngine;
-export declare function buildListScript(engine: DbEngine): string[];
-export declare function buildCreateDatabaseScript(engine: DbEngine, name: string): string[];
+export declare function buildListScript(engine: DbEngine, database?: DatabaseConfig): string[];
+export declare function buildCreateDatabaseScript(engine: DbEngine, name: string, database?: DatabaseConfig): string[];
 export interface CreateUserInput {
     username: string;
     password: string;
     database?: string;
     access?: 'all' | 'readonly';
 }
-export declare function buildCreateUserScript(engine: DbEngine, input: CreateUserInput): string[];
+export declare function buildCreateUserScript(engine: DbEngine, input: CreateUserInput, database?: DatabaseConfig): string[];
 export declare function parseDbList(output: string): {
     databases: string[];
     users: string[];
@@ -40,9 +40,11 @@ export declare const DB_BACKUP_DIR = "/var/backups/ts-cloud/databases";
 /**
  * Script that dumps a single database to a timestamped, gzipped file. The name
  * is a validated SQL identifier (no shell metacharacters), so it is safe to
- * embed directly. The timestamp is computed on the box.
+ * embed directly. The timestamp is computed on the box. Postgres connects over
+ * the local unix socket for a co-located engine, or TCP with credentials for
+ * an external host (see {@link pgAdminCommand}).
  */
-export declare function buildBackupScript(engine: DbEngine, name: string, destDir?: string): string[];
+export declare function buildBackupScript(engine: DbEngine, name: string, destDir?: string, database?: DatabaseConfig): string[];
 /** Script that lists the most recent dumps (newest first). */
 export declare function buildListBackupsScript(destDir?: string): string[];
 export declare function parseBackups(output: string): Array<{

package/dist/deploy/index.js

@@ -12,7 +12,7 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "../chunk-crcjdm09.js";
+} from "../chunk-1nfkggdw.js";
 import {
   buildAndPushServerlessImage
 } from "../chunk-tskj9fay.js";
@@ -30,7 +30,7 @@ import {
   resolveUiSource,
   siteInstallBase,
   validateDeploymentConfig
-} from "../chunk-0c69nbaa.js";
+} from "../chunk-m0zayf6n.js";
 import"../chunk-stt1z5cx.js";
 import"../chunk-93hjhs78.js";
 import {

package/dist/drivers/index.js

@@ -50,7 +50,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "../chunk-0c69nbaa.js";
+} from "../chunk-m0zayf6n.js";
 import"../chunk-stt1z5cx.js";
 import"../chunk-93hjhs78.js";
 import"../chunk-qpj3edwz.js";

package/dist/drivers/shared/backups.d.ts

@@ -34,7 +34,9 @@ export interface BackupRestoreOptions {
  * Build the commands that restore a database from a ts-backups dump on the box.
  * With no `from`, the newest dump under {@link BACKUP_OUTPUT_DIR} matching the
  * database name is used. Handles plain `.sql` and gzipped `.sql.gz`. MySQL/
- * MariaDB restore over the root unix socket; Postgres via `psql -U postgres`.
+ * MariaDB restore over the root unix socket; Postgres over the local unix
+ * socket for a co-located engine, or TCP with credentials for an external
+ * host (see {@link pgAdminCommand}).
  * Returns `[]` when the database has no name.
  */
 export declare function buildBackupRestoreScript(database: DatabaseConfig | undefined, options?: BackupRestoreOptions): string[];

package/dist/drivers/shared/db-provision.d.ts

@@ -6,10 +6,32 @@
  * install nothing and just wire `.env` — see {@link buildManagedDbEnv}.
  *
  * pantry services listen on TCP localhost ports (mysql/mariadb 3306, postgres
- * 5432, redis 6379, memcached 11211, meilisearch 7700); DB setup connects over
- * TCP, and the engine clients are on PATH via `pantry env`.
+ * 5432, redis 6379, memcached 11211, meilisearch 7700) and the engine clients
+ * are on PATH via `pantry env`. Admin commands (db setup, dumps, restores)
+ * connect over the engine's local unix socket — see {@link pgAdminCommand}.
  */
 import type { ComputeServicesConfig, DatabaseConfig } from '@ts-cloud/core';
+/**
+ * True when the database is co-located with the box (the managed-services
+ * engine): no host configured, or an explicit loopback host. Anything else is
+ * an external/managed database reached over TCP.
+ */
+export declare function isLocalDatabase(database: DatabaseConfig | undefined): boolean;
+/**
+ * Build the connection prefix for a postgres admin command (`psql`/`pg_dump`)
+ * run on the box.
+ *
+ * The pantry postgres pg_hba grants `trust` on the local unix socket but
+ * requires md5 password auth over TCP loopback — and the `postgres` superuser
+ * has no password — so against the co-located engine admin clients MUST use
+ * the socket: omit `-h` entirely and the pantry client uses its compiled-in
+ * default socket dir, which matches the server's by construction (verified
+ * on-box: `psql -U postgres` from root connects passwordless). Against an
+ * external/managed host, use TCP with the configured credentials
+ * (`PGPASSWORD` inline + `-w`, so a missing password fails fast instead of
+ * prompting forever).
+ */
+export declare function pgAdminCommand(database: DatabaseConfig | undefined, tool?: 'psql' | 'pg_dump'): string;
 /**
  * Build pantry install + enable/start commands for each requested on-box
  * service. Idempotent (pantry install/enable/start are no-ops when satisfied).

package/dist/index.js

@@ -55,7 +55,7 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "./chunk-crcjdm09.js";
+} from "./chunk-1nfkggdw.js";
 import {
   buildAndPushServerlessImage
 } from "./chunk-tskj9fay.js";
@@ -105,7 +105,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-0c69nbaa.js";
+} from "./chunk-m0zayf6n.js";
 import {
   ABTestManager,
   AI,