@stacksjs/ts-cloud 0.7.35 → 0.7.37

package/dist/{chunk-k9se7m8j.js → chunk-3c46eypc.js}

@@ -2320,7 +2320,7 @@ function buildFleetServicesBoxProvision(config) {
 
 // src/drivers/hetzner/firewall-rules.ts
 function buildHetznerFirewallRules(config) {
-  const openPorts = new Set([80, 443, ...config.sitePorts]);
+  const openPorts = new Set([80, 443, ...config.sitePorts, ...config.allowedPorts ?? []]);
   if (config.allowSsh) {
     openPorts.add(22);
   }
@@ -2460,7 +2460,8 @@ class HetznerDriver {
     const firewallName = `${slug}-${environment}-app-fw`;
     const { firewall } = await this.ensureFirewall(firewallName, labels, buildHetznerFirewallRules({
       allowSsh: compute.allowSsh !== false,
-      sitePorts
+      sitePorts,
+      allowedPorts: compute.firewall?.allowedPorts
     }));
     const sshKeyId = await this.ensureSshKey(slug, environment, labels);
     const existing = await readDriverState(stackName);
@@ -2563,7 +2564,7 @@ class HetznerDriver {
     const netName = `${slug}-${environment}-net`;
     const networks = await this.client.listNetworks().catch(() => []);
     const network = networks.find((n) => n.name === netName) ?? await this.client.createNetwork({ name: netName, labels: tsCloudLabels(slug, environment, "app") });
-    const { firewall: appFw } = await this.ensureFirewall(`${slug}-${environment}-app-fw`, tsCloudLabels(slug, environment, "app"), buildHetznerFirewallRules({ allowSsh: true, sitePorts: [] }));
+    const { firewall: appFw } = await this.ensureFirewall(`${slug}-${environment}-app-fw`, tsCloudLabels(slug, environment, "app"), buildHetznerFirewallRules({ allowSsh: true, sitePorts: [], allowedPorts: compute.firewall?.allowedPorts }));
     const { firewall: svcFw } = await this.ensureFirewall(`${slug}-${environment}-services-fw`, tsCloudLabels(slug, environment, "services"), [
       { direction: "in", protocol: "tcp", port: "22", source_ips: ["0.0.0.0/0", "::/0"] },
       { direction: "in", protocol: "tcp", port: "3306", source_ips: [network.ip_range] },
@@ -2726,7 +2727,7 @@ class HetznerDriver {
         description: `ts-cloud port ${port} (private, LB-only)`
       }))
     ]);
-    const { firewall: lbFw } = await this.ensureFirewall(`${slug}-${environment}-lb-fw`, tsCloudLabels(slug, environment, "lb"), buildHetznerFirewallRules({ allowSsh: true, sitePorts: [] }));
+    const { firewall: lbFw } = await this.ensureFirewall(`${slug}-${environment}-lb-fw`, tsCloudLabels(slug, environment, "lb"), buildHetznerFirewallRules({ allowSsh: true, sitePorts: [], allowedPorts: compute.firewall?.allowedPorts }));
     const all = await this.client.listServers().catch(() => []);
     const newServerIds = [];
     let servicesServerId;
@@ -3948,7 +3949,21 @@ function buildAwsArtifactFetch(bucket, key, region, destPath) {
 }
 function buildLocalArtifactFetch(localPath, destPath) {
   return [
-    `cp "${localPath}" ${destPath}`
+    `mv "${localPath}" ${destPath}`
+  ];
+}
+function buildHostCleanupScript() {
+  return [
+    'echo "[ts-cloud] host cleanup (disk before): $(df -h / | tail -1)"',
+    "find /var/ts-cloud/staging -xdev -maxdepth 1 -type f -mmin +60 -delete 2>/dev/null || true",
+    'find /tmp -xdev -maxdepth 1 -type f -name "*-release.tar.gz" -mmin +60 -delete 2>/dev/null || true',
+    "find /root/.bun/install/cache -xdev -type f -mtime +7 -delete 2>/dev/null || true",
+    "find /root/.bun/install/cache -xdev -depth -type d -empty -delete 2>/dev/null || true",
+    "journalctl --vacuum-time=14d --vacuum-size=512M >/dev/null 2>&1 || true",
+    'if command -v docker >/dev/null 2>&1; then docker image prune --all --force --filter "until=168h" >/dev/null 2>&1 || true; fi',
+    'if command -v podman >/dev/null 2>&1; then podman image prune --all --force --filter "until=168h" >/dev/null 2>&1 || true; fi',
+    "if command -v apt-get >/dev/null 2>&1; then apt-get clean >/dev/null 2>&1 || true; fi",
+    'echo "[ts-cloud] host cleanup (disk after): $(df -h / | tail -1)"'
   ];
 }
 // src/drivers/shared/compute-deploy.ts
@@ -4842,7 +4857,8 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
     ...baseScript,
     ...staticVhost,
     ...staticSsl,
-    ...servicesScript
+    ...servicesScript,
+    ...buildHostCleanupScript()
   ];
   logger.step(`Deploying to ${targets.length} target(s)...`);
   const result = await driver.runRemoteDeploy({
@@ -5154,4 +5170,4 @@ function buildCloudFrontOriginConfig(options) {
     CustomErrorResponses: { Quantity: 0 }
   };
 }
-export { siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, pgAdminCommand, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };
+export { siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, pgAdminCommand, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };

package/dist/{chunk-94myv1cx.js → chunk-ndwv4y6c.js}

@@ -29,7 +29,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-k9se7m8j.js";
+} from "./chunk-3c46eypc.js";
 import {
   artifactKey,
   composeServerlessAppTemplate,

package/dist/deploy/index.js

@@ -12,7 +12,7 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "../chunk-94myv1cx.js";
+} from "../chunk-ndwv4y6c.js";
 import {
   buildAndPushServerlessImage
 } from "../chunk-tskj9fay.js";
@@ -30,7 +30,7 @@ import {
   resolveUiSource,
   siteInstallBase,
   validateDeploymentConfig
-} from "../chunk-k9se7m8j.js";
+} from "../chunk-3c46eypc.js";
 import"../chunk-stt1z5cx.js";
 import"../chunk-93hjhs78.js";
 import {

package/dist/drivers/hetzner/firewall-rules.d.ts

@@ -1,6 +1,8 @@
 export interface HetznerFirewallRuleInput {
     allowSsh?: boolean;
     sitePorts: number[];
+    /** Operator-owned public TCP ports from compute.firewall.allowedPorts. */
+    allowedPorts?: number[];
 }
 export type HetznerInboundFirewallRule = {
     direction: 'in';

package/dist/drivers/index.d.ts

@@ -10,7 +10,7 @@ export { buildSshArgs, scpUpload, sshExec, sshExecOrThrow, waitForCloudInit, wai
 export type { RemoteExecOptions, RemoteExecResult, WaitOptions } from './shared/remote-exec';
 export { AwsBoxProvisioner, buildBoxUserData, createBoxProvisioner, HetznerBoxProvisioner, UBUNTU_2404_AMI_PARAM, } from './shared/box-provision';
 export type { AwsBoxProvisionerOptions, BoxPort, BoxProviderName, BoxProvisioner, BoxSpec, CreateBoxProvisionerOptions, ProvisionedBox, } from './shared/box-provision';
-export { buildAwsArtifactFetch, buildLocalArtifactFetch, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, resolveExecStart, } from './shared/deploy-script';
+export { buildAwsArtifactFetch, buildHostCleanupScript, buildLocalArtifactFetch, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, resolveExecStart, } from './shared/deploy-script';
 export { deployAllComputeSites, deploySiteRelease, reloadRpxGateway } from './shared/compute-deploy';
 export { buildRpxConfig, buildRpxFragmentRefreshScript, buildRpxLbConfig, buildRpxProvisionScript, deriveRouteId, normalizeRoutePath, renderRpxLauncher, DEFAULT_RPX_CERTS_DIR, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, } from './shared/rpx-gateway';
 export type { BuildRpxConfigOptions, BuildRpxFragmentRefreshOptions, BuildRpxProvisionOptions, RpxGatewayConfig, RpxLbAppBox, RpxRoute, } from './shared/rpx-gateway';

package/dist/drivers/index.js

@@ -17,6 +17,7 @@ import {
   buildAwsArtifactFetch,
   buildBoxUserData,
   buildCloudFrontOriginConfig,
+  buildHostCleanupScript,
   buildLocalArtifactFetch,
   buildRpxConfig,
   buildRpxFragmentRefreshScript,
@@ -50,7 +51,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "../chunk-k9se7m8j.js";
+} from "../chunk-3c46eypc.js";
 import"../chunk-stt1z5cx.js";
 import"../chunk-93hjhs78.js";
 import"../chunk-qpj3edwz.js";
@@ -91,6 +92,7 @@ export {
   buildRpxFragmentRefreshScript,
   buildRpxConfig,
   buildLocalArtifactFetch,
+  buildHostCleanupScript,
   buildCloudFrontOriginConfig,
   buildBoxUserData,
   buildAwsArtifactFetch,

package/dist/drivers/shared/deploy-script.d.ts

@@ -113,3 +113,10 @@ export declare function buildStaticSiteDeployScript(options: BuildStaticSiteDepl
 export declare function releaseTarballTmpPath(slug: string | undefined, siteName: string, releaseId: string): string;
 export declare function buildAwsArtifactFetch(bucket: string, key: string, region: string, destPath: string): string[];
 export declare function buildLocalArtifactFetch(localPath: string, destPath: string): string[];
+/**
+ * Bounded, multi-tenant-safe host maintenance run after a successful deploy.
+ * Current and rollback releases are deliberately out of scope: their retention
+ * is managed by buildPruneReleases. This only removes abandoned staging/temp
+ * archives, aged package caches, unused container images, and old journals.
+ */
+export declare function buildHostCleanupScript(): string[];

package/dist/index.d.ts

@@ -11,7 +11,7 @@ export type { MigrateEndpoint, MigrateError, MigrateOptions, MigratePlanItem, Mi
 export * from './ssl';
 export { deployStaticSite, deployStaticSiteFull, uploadStaticFiles, invalidateCache, deleteStaticSite, generateStaticSiteTemplate, deployStaticSiteWithExternalDns, deployStaticSiteWithExternalDnsFull, generateExternalDnsStaticSiteTemplate, deploySite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, buildAndPushServerlessImage, buildFunctionEnv, deployServerlessApp, infraEnvFromOutputs, redeployServerlessApp, rollbackServerlessApp, runRemoteCommand, setMaintenance, buildManagementDashboardArtifact, DASHBOARD_CREDENTIALS_FILE, ensureManagementDashboard, MANAGEMENT_DASHBOARD_SITE, resolveDashboardAuth, resolveUiSource, } from './deploy';
 export type { EnsureDashboardLogger, ResolvedDashboardAuth, StaticSiteConfig, DeployResult, UploadOptions, ExternalDnsStaticSiteConfig, ExternalDnsDeployResult, DeploySiteConfig, DeploySiteResult, StaticSiteDnsProvider, SiteDeployKind, DeploymentValidationResult, BuildImageOptions, BuiltImage, CodeSource, DeployServerlessOptions, ResolvedContext, } from './deploy';
-export { createCloudDriver, CloudDriverFactory, cloudDrivers, AwsDriver, HetznerDriver, HetznerClient, resolveHetznerApiToken, normalizeSshPublicKey, ensureFirewall, ensureServer, ensureSshKey, serverPublicIpv4, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, buildSshArgs, generateUbuntuAppCloudInit, wrapCloudInitUserData, buildSiteDeployScript, buildStaticSiteDeployScript, resolveExecStart, deployAllComputeSites, deploySiteRelease, } from './drivers';
+export { createCloudDriver, CloudDriverFactory, cloudDrivers, AwsDriver, HetznerDriver, HetznerClient, resolveHetznerApiToken, normalizeSshPublicKey, ensureFirewall, ensureServer, ensureSshKey, serverPublicIpv4, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, buildSshArgs, generateUbuntuAppCloudInit, wrapCloudInitUserData, buildHostCleanupScript, buildSiteDeployScript, buildStaticSiteDeployScript, resolveExecStart, deployAllComputeSites, deploySiteRelease, } from './drivers';
 export type { CreateCloudDriverOptions } from './drivers/factory';
 export { dashboardActions, resolveDashboardAction, sanitizeCloudConfig, startLocalDashboardServer, } from './deploy/local-dashboard-server';
 export type { DashboardAction, LocalDashboardServer, LocalDashboardServerOptions, } from './deploy/local-dashboard-server';

package/dist/index.js

@@ -55,7 +55,7 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "./chunk-94myv1cx.js";
+} from "./chunk-ndwv4y6c.js";
 import {
   buildAndPushServerlessImage
 } from "./chunk-tskj9fay.js";
@@ -77,6 +77,7 @@ import {
   HetznerClient,
   HetznerDriver,
   MANAGEMENT_DASHBOARD_SITE,
+  buildHostCleanupScript,
   buildManagementDashboardArtifact,
   buildSiteDeployScript,
   buildSshArgs,
@@ -105,7 +106,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-k9se7m8j.js";
+} from "./chunk-3c46eypc.js";
 import {
   ABTestManager,
   AI,
@@ -4964,6 +4965,7 @@ export {
   buildOptimizationManager,
   buildNodeRuntimeLayerZip,
   buildManagementDashboardArtifact,
+  buildHostCleanupScript,
   buildFunctionEnv,
   buildCloudFormationTemplate,
   buildBunRuntimeLayerZip,