@stacksjs/ts-cloud 0.7.47 → 0.7.50

package/dist/{chunk-2mw2566h.js → chunk-a4q0231r.js}

@@ -6,7 +6,7 @@ import {
   step,
   success,
   warn
-} from "./chunk-tskj9fay.js";
+} from "./chunk-f29w04w5.js";
 import {
   CloudWatchLogsClient,
   CostExplorerClient,
@@ -29,7 +29,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-3c46eypc.js";
+} from "./chunk-rrn8njr2.js";
 import {
   artifactKey,
   composeServerlessAppTemplate,
@@ -44,7 +44,7 @@ import {
   resolveServerlessArtifactBucketName,
   resolveServerlessAssetBucketName,
   resolveServerlessRuntime
-} from "./chunk-stt1z5cx.js";
+} from "./chunk-r16e02bc.js";
 import {
   deployStaticSiteWithExternalDnsFull
 } from "./chunk-jp2a8yad.js";
@@ -388,7 +388,7 @@ async function deployServerlessApp(config, environment, opts = {}) {
   }
   if (imageMode) {
     step("Building + pushing container image");
-    const { buildAndPushServerlessImage } = await import("./chunk-ebx9gjnn.js");
+    const { buildAndPushServerlessImage } = await import("./chunk-z58fqnjm.js");
     const built = await buildAndPushServerlessImage({
       app,
       projectRoot,

package/dist/{chunk-tskj9fay.js → chunk-f29w04w5.js}

@@ -8,7 +8,7 @@ import {
   phpRuntimeLayerAssets,
   runPhpBuildHooks,
   sha256
-} from "./chunk-stt1z5cx.js";
+} from "./chunk-r16e02bc.js";
 
 // src/deploy/serverless-image.ts
 import { execFileSync } from "node:child_process";

package/dist/{chunk-stt1z5cx.js → chunk-r16e02bc.js}

@@ -10449,6 +10449,135 @@ class SMS {
     return { resources, outputs };
   }
 }
+function logicalPart(value) {
+  const clean = value.replace(/[^a-zA-Z0-9]/g, " ").trim();
+  const part = clean.split(/\s+/).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join("");
+  return part || "User";
+}
+function normalizeHomeDirectory(value, username) {
+  const path = (value || username).replace(/^\/+|\/+$/g, "");
+  if (!path || path.split("/").includes(".."))
+    throw new Error(`sftp: invalid homeDirectory for user ${username}`);
+  return path;
+}
+
+class Sftp {
+  static create(options) {
+    if (!options.bucket.trim())
+      throw new Error("sftp: bucket is required");
+    const endpointType = options.endpointType ?? "PUBLIC";
+    if (endpointType === "VPC" && (!options.endpointDetails?.vpcId || !options.endpointDetails.subnetIds.length))
+      throw new Error("sftp: VPC endpoints require endpointDetails.vpcId and at least one subnet");
+    const prefix = `${logicalPart(options.slug)}${logicalPart(options.environment)}Sftp`;
+    const serverLogicalId = `${prefix}Server`;
+    const resources = {};
+    let loggingRoleArn;
+    if (options.logging !== false) {
+      const loggingRoleLogicalId = `${prefix}LoggingRole`;
+      resources[loggingRoleLogicalId] = {
+        Type: "AWS::IAM::Role",
+        Properties: {
+          AssumeRolePolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [{ Effect: "Allow", Principal: { Service: "transfer.amazonaws.com" }, Action: "sts:AssumeRole" }]
+          },
+          Policies: [{
+            PolicyName: "TransferLogging",
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [{
+                Effect: "Allow",
+                Action: ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents"],
+                Resource: "arn:aws:logs:*:*:log-group:/aws/transfer/*"
+              }]
+            }
+          }]
+        }
+      };
+      loggingRoleArn = { "Fn::GetAtt": [loggingRoleLogicalId, "Arn"] };
+    }
+    resources[serverLogicalId] = {
+      Type: "AWS::Transfer::Server",
+      Properties: {
+        Domain: "S3",
+        EndpointType: endpointType,
+        IdentityProviderType: "SERVICE_MANAGED",
+        Protocols: ["SFTP"],
+        ...endpointType === "VPC" ? {
+          EndpointDetails: {
+            VpcId: options.endpointDetails.vpcId,
+            SubnetIds: options.endpointDetails.subnetIds,
+            ...options.endpointDetails.securityGroupIds?.length ? { SecurityGroupIds: options.endpointDetails.securityGroupIds } : {},
+            ...options.endpointDetails.addressAllocationIds?.length ? { AddressAllocationIds: options.endpointDetails.addressAllocationIds } : {}
+          }
+        } : {},
+        ...options.securityPolicyName ? { SecurityPolicyName: options.securityPolicyName } : {},
+        ...loggingRoleArn ? { LoggingRole: loggingRoleArn } : {},
+        Tags: [
+          { Key: "Project", Value: options.slug },
+          { Key: "Environment", Value: options.environment },
+          { Key: "ManagedBy", Value: "ts-cloud" }
+        ]
+      }
+    };
+    for (const [username, user] of Object.entries(options.users)) {
+      if (!/^[a-zA-Z0-9_.@-]{3,100}$/.test(username))
+        throw new Error(`sftp: invalid username ${username}`);
+      if (!user.sshPublicKeys.length)
+        throw new Error(`sftp: user ${username} requires at least one SSH public key`);
+      const userPart = logicalPart(username);
+      const home = normalizeHomeDirectory(user.homeDirectory, username);
+      const userLogicalId = `${prefix}${userPart}User`;
+      let roleArn = user.roleArn;
+      if (!roleArn) {
+        const roleLogicalId = `${prefix}${userPart}Role`;
+        const bucketArn = `arn:aws:s3:::${options.bucket}`;
+        resources[roleLogicalId] = {
+          Type: "AWS::IAM::Role",
+          Properties: {
+            AssumeRolePolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [{ Effect: "Allow", Principal: { Service: "transfer.amazonaws.com" }, Action: "sts:AssumeRole" }]
+            },
+            Policies: [{
+              PolicyName: "SftpHomeDirectory",
+              PolicyDocument: {
+                Version: "2012-10-17",
+                Statement: [
+                  {
+                    Effect: "Allow",
+                    Action: ["s3:ListBucket", "s3:GetBucketLocation"],
+                    Resource: bucketArn,
+                    Condition: { StringLike: { "s3:prefix": [home, `${home}/*`] } }
+                  },
+                  {
+                    Effect: "Allow",
+                    Action: ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetObjectVersion"],
+                    Resource: `${bucketArn}/${home}/*`
+                  }
+                ]
+              }
+            }]
+          }
+        };
+        roleArn = { "Fn::GetAtt": [roleLogicalId, "Arn"] };
+      }
+      resources[userLogicalId] = {
+        Type: "AWS::Transfer::User",
+        DependsOn: [serverLogicalId],
+        Properties: {
+          ServerId: { Ref: serverLogicalId },
+          UserName: username,
+          Role: roleArn,
+          HomeDirectoryType: "PATH",
+          HomeDirectory: `/${options.bucket}/${home}`,
+          SshPublicKeys: user.sshPublicKeys
+        }
+      };
+    }
+    return { resources, serverLogicalId };
+  }
+}
 
 class AI {
   static createBedrockRole(servicePrincipal, options) {
@@ -24325,6 +24454,9 @@ var cloud_config_schema_default = {
         cdn: {
           $ref: "#/definitions/cdn"
         },
+        sftp: {
+          $ref: "#/definitions/sftp"
+        },
         functions: {
           type: "object",
           description: "Lambda functions configuration",
@@ -24375,6 +24507,14 @@ var cloud_config_schema_default = {
             timeout: { type: "number", description: "HTTP request timeout in seconds" },
             gatewayVersion: { type: "number", enum: [1, 2], description: "API Gateway version (2 = HTTP API, 1 = REST)" },
             warm: { type: "number", description: "Keep-warm / provisioned concurrency count" },
+            lambdaInsights: {
+              type: "object",
+              description: "CloudWatch Lambda Insights extension configuration for zip deployments",
+              required: ["layerArn"],
+              properties: {
+                layerArn: { type: "string", description: "Region- and architecture-specific Lambda Insights extension layer ARN" }
+              }
+            },
             queues: { description: "Queue names (true = single default queue, false = disabled)" },
             scheduler: { type: "string", enum: ["off", "on", "sub-minute"], description: "Task scheduler mode" },
             build: { type: "array", items: { type: "string" }, description: "Commands run locally before packaging" },
@@ -24648,6 +24788,15 @@ var cloud_config_schema_default = {
           type: "boolean",
           default: true
         },
+        originShield: {
+          type: "boolean",
+          description: "Enable CloudFront Origin Shield",
+          default: false
+        },
+        originShieldRegion: {
+          type: "string",
+          description: "AWS region used by CloudFront Origin Shield"
+        },
         compress: {
           type: "boolean",
           description: "Enable automatic compression",
@@ -24688,6 +24837,38 @@ var cloud_config_schema_default = {
         }
       }
     },
+    sftp: {
+      type: "object",
+      required: ["bucket", "users"],
+      properties: {
+        bucket: { type: "string", description: "S3 bucket backing the SFTP server" },
+        endpointType: { type: "string", enum: ["PUBLIC", "VPC"], default: "PUBLIC" },
+        endpointDetails: {
+          type: "object",
+          required: ["vpcId", "subnetIds"],
+          properties: {
+            vpcId: { type: "string" },
+            subnetIds: { type: "array", items: { type: "string" }, minItems: 1 },
+            securityGroupIds: { type: "array", items: { type: "string" } },
+            addressAllocationIds: { type: "array", items: { type: "string" } }
+          }
+        },
+        securityPolicyName: { type: "string" },
+        logging: { type: "boolean", default: true },
+        users: {
+          type: "object",
+          additionalProperties: {
+            type: "object",
+            required: ["sshPublicKeys"],
+            properties: {
+              sshPublicKeys: { type: "array", items: { type: "string" }, minItems: 1 },
+              homeDirectory: { type: "string" },
+              roleArn: { type: "string" }
+            }
+          }
+        }
+      }
+    },
     function: {
       type: "object",
       required: ["name", "runtime"],
@@ -44564,6 +44745,9 @@ function composeServerlessAppTemplate(opts) {
   const hasQueue = queueNames.length > 0;
   const logRetention = app.logRetention ?? 14;
   const imageMode = app.packaging === "image";
+  if (imageMode && app.lambdaInsights) {
+    throw new Error("serverless app: `lambdaInsights` layer attachment is only supported for zip packaging. Container images must install the Lambda Insights extension in the image.");
+  }
   const schedulerEnabled = (app.scheduler ?? "on") !== "off";
   const cacheEnabled = (app.cache?.driver ?? "dynamodb") === "dynamodb";
   const assetsEnabled = Boolean(app.assets);
@@ -44625,6 +44809,8 @@ function composeServerlessAppTemplate(opts) {
   const managedPolicies = ["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"];
   if (app.vpc?.subnets?.length)
     managedPolicies.push("arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole");
+  if (app.lambdaInsights)
+    managedPolicies.push("arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy");
   resources.AppRole = {
     Type: "AWS::IAM::Role",
     Properties: {
@@ -44680,6 +44866,7 @@ function composeServerlessAppTemplate(opts) {
       Type: "AWS::Logs::LogGroup",
       Properties: { LogGroupName: `/aws/lambda/${name}`, RetentionInDays: logRetention }
     };
+    const layers = [...opts.runtimeLayers ?? [], ...app.lambdaInsights ? [app.lambdaInsights.layerArn] : []];
     const codeProps = imageMode ? {
       PackageType: "Image",
       Code: { ImageUri: Fn2.ref("ImageUri") },
@@ -44688,7 +44875,7 @@ function composeServerlessAppTemplate(opts) {
       Runtime: runtime,
       Handler: handler8,
       Code: { S3Bucket: Fn2.ref("ArtifactBucket"), S3Key: Fn2.ref("ArtifactKey") },
-      ...opts.runtimeLayers?.length ? { Layers: opts.runtimeLayers } : {}
+      ...layers.length ? { Layers: [...new Set(layers)] } : {}
     };
     resources[logicalId] = {
       Type: "AWS::Lambda::Function",
@@ -46184,4 +46371,4 @@ class ResourceManagementManager {
 }
 var resourceManagementManager = new ResourceManagementManager;
 
-export { detectServiceRegion, signRequest, signRequestAsync, createPresignedUrl, createPresignedUrlAsync, makeAWSRequest, makeAWSRequestOnce, makeAWSRequestAsync, parseXMLResponse, parseJSONResponse, clearSigningKeyCache, getSigningKeyCacheSize, isNodeCryptoAvailable, isWebCryptoAvailable, QueuePresets, RealtimePresets, detectDeploymentTargets, resolveDeploymentMode, deploymentCoexistenceError, resolveAppDatabase, resolveCloudProvider, TemplateBuilder, Pseudo, generateResourceName, generateLogicalId, getTimestamp, sanitizeName, resolveProjectStackName, resolveSiteStackName, resolveSiteResourceName, resolveSiteBucketName, resolveStorageBucketName, resolveDeployBucketName, resolveServerlessAppStackName, resolveServerlessArtifactBucketName, resolveServerlessAssetBucketName, DependencyGraph, analyzeStackDiff, formatDiff, Storage, Registry, CDN, DNS, Security, Compute, Network, FileSystem, Email, exports_incoming_call, Phone, Queue, JobLoader, StacksIntegration, exports_send, SMS, AI, Database, Cache, Permissions, ApiGateway, Messaging, Workflow, Monitoring, Auth, Deployment, AssetHasher, Secrets, ParameterStore, Search, Redirects, Communication, Fn2, Arn, AWS_PSEUDO_PARAMETERS, CloudFormationBuilder, buildCloudFormationTemplate, createStaticSitePreset, createNodeJsServerPreset, createNodeJsServerlessPreset, createServerlessNodePreset, createFullStackAppPreset, createApiBackendPreset, createWordPressPreset, createJamstackPreset, createMicroservicesPreset, createRealtimeAppPreset, createDataPipelinePreset, createMLApiPreset, createTraditionalWebAppPreset, createLaravelPreset, createServerlessLaravelPreset, createDashboardSite, DASHBOARD_STATE_DIR, DASHBOARD_ENTRY, DASHBOARD_PORT_BASE, DASHBOARD_PORT_SPAN, deriveManagementDashboardPort, resolveDashboardDomain, resolveDashboardDomains, hasManagementDashboardSite, MANAGEMENT_DASHBOARD_SITE_PREFIX, managementDashboardSiteName, isManagementDashboardSiteName, resolveManagementDashboardSites, resolveManagementDashboardSite, extendPreset, composePresets, createPreset, mergeInfrastructure, withMonitoring, withSecurity, withDatabase, withCache, withCDN, withQueue, fromEnvironment, fromSharedCredentials, fromEC2Metadata, fromECSMetadata, fromWebIdentity, getCredentials, createCredentialProvider, resolveCredentials, resolveRegion, getAccountId, S3Error, createS3Client, CloudError, ConfigurationError, CredentialError, DeploymentError, ValidationError, AWSAPIError, ErrorCodes, getErrorDetails, createError, DebugLogger, validateConfiguration, detectMisconfigurations, validateCredentials, checkIAMPermissions, getRequiredPermissions, suggestIAMPolicy, DEFAULT_SERVICE_LIMITS, checkServiceQuotas, getQuotaUsageSummary, suggestQuotaIncrease, FileCache, TemplateCache, templateCache, hashFile, hashString, hashBuffer, hashDirectory, hashManifest, quickHash, findChangedFiles, HashCache, parallel, batch, parallelMap, parallelWithRetry, sequence, withTimeout, RateLimiter, chunk, processInChunks, diffTemplates, getDiffSummary, requiresReplacement, categorizeChanges, getDeploymentStrategy, getDiffStats, cloud_config_schema_default, validateAgainstSchema, defaultLocalConfig, getLocalConfig, isLocalDevelopment, getLocalEndpoint, getLocalCredentials, getLocalEnvVars, MockCloudFormation, MockS3, MockDynamoDB, createMockAWS, PreviewEnvironmentManager, previewManager, generatePreviewWorkflow, generateCleanupWorkflow, generateCostReportWorkflow, PreviewNotificationService, previewNotifications, formatTable, formatTree, formatProgressBar, formatBytes, formatDuration, formatList, formatKeyValue, ProgressBar, MultiStepProgress, Spinner, TaskList, suggestCommand, formatSuggestion, isLikelyTypo, getContextualHelp, searchCommands, autocomplete, suggestFlags, formatFlagSuggestions, getCommandUsage, validateCommand, REPL, REPLContext, REPLCommandBuilder, CommandHistory, formatHistory, formatHistoryStats, MultiRegionManager, multiRegionManager, CrossRegionReferenceManager, GlobalResourceManager, RegionPairManager, StackDependencyManager, crossRegionReferenceManager, globalResourceManager, regionPairManager, stackDependencyManager, AWS_REGIONS, getRegion, getAllRegions, getRegionsByLocation, getRegionsByCompliance, getRegionsByPricingTier, isValidRegion, getClosestRegion, suggestRegions, suggestRegionPairs, formatRegion, formatRegionList, getRegionStats, MultiAccountManager, OrganizationManager, multiAccountManager, organizationManager, RECOMMENDED_ACCOUNT_STRUCTURES, RECOMMENDED_SCPS, COMMON_CROSS_ACCOUNT_ROLES, getRecommendedStructure, generateCrossAccountRoleCF, validateAccountStructure, formatAccountStructure, generateDeploymentWorkflow, generateMultiEnvWorkflow, generatePRPreviewWorkflow, generateScheduledWorkflow, generateMatrixWorkflow, generateDeploymentPipeline, generateMultiEnvPipeline, generatePreviewPipeline, generateScheduledPipeline, generateManualPipeline, generateDeploymentConfig, generateMultiEnvConfig, generateScheduledConfig, generateApprovalConfig, generateParallelConfig, BackupManager, backupManager, DisasterRecoveryManager, drManager, AWSConfigManager, awsConfigManager, CloudTrailManager, cloudTrailManager, GuardDutyManager, guardDutyManager, SecurityHubManager, securityHubManager, BlueGreenManager, blueGreenManager, CanaryManager, canaryManager, ABTestManager, abTestManager, ProgressiveDeploymentManager, progressiveDeploymentManager, XRayManager, xrayManager, MetricsManager, metricsManager, LogsManager, logsManager, SyntheticsManager, syntheticsManager, MigrationManager, migrationManager, ReplicaManager, replicaManager, PerformanceManager, performanceManager, DatabaseUserManager, databaseUserManager, SecretsRotationManager, secretsRotationManager, SecretsManager, secretsManager, CertificateManager, certificateManager, SecurityScanningManager, securityScanningManager, ImageScanningManager, imageScanningManager, BuildOptimizationManager, buildOptimizationManager, ContainerRegistryManager, containerRegistryManager, ServiceMeshManager, serviceMeshManager, LambdaLayersManager, lambdaLayersManager, LambdaVersionsManager, lambdaVersionsManager, LambdaConcurrencyManager, lambdaConcurrencyManager, LambdaDestinationsManager, lambdaDestinationsManager, LambdaVPCManager, lambdaVPCManager, LambdaDLQManager, lambdaDLQManager, Route53RoutingManager, route53RoutingManager, DNSSECManager, dnssecManager, Route53ResolverManager, route53ResolverManager, BounceComplaintHandler, bounceComplaintHandler, EmailAnalyticsManager, emailAnalyticsManager, SenderReputationManager, senderReputationManager, EmailTemplateManager, emailTemplateManager, exports_advanced, exports_inbound, exports_advanced2, exports_advanced3, FIFOQueueManager, fifoQueueManager, DLQMonitoringManager, dlqMonitoringManager, BatchProcessingManager, batchProcessingManager, QueueManagementManager, queueManagementManager, createZip, generateBootstrap, runBuildHooks, sha256, artifactKey, packageServerlessApp, MANAGED_NODE_VERSIONS, resolveServerlessRuntime, resolveQueues, resolveQueueNames, composeServerlessAppTemplate, PHP_LAYER_EXTENSIONS, phpLayerPackages, phpLayerBuildStage, generatePhpLayerDockerfile, generateAppImageDockerfile, sharedRuntimeLoop, buildNodeRuntimeLayerZip, buildBunRuntimeLayerZip, resolveApp, eventToRequest, responseToResult, createHttpHandler, createQueueHandler, createCliHandler, createHandlers, generatePhpFpmConfig, phpRuntimeLayerAssets, laravelServerlessEnvDefaults, LARAVEL_SERVERLESS_BUILD_STEPS, buildPhpRuntimeLayerZip, PHP_DEFAULT_EXCLUDES, runPhpBuildHooks, collectPhpAppEntries, packagePhpApp, StaticSiteManager, staticSiteManager, StorageAdvancedManager, storageAdvancedManager, HealthCheckManager, healthCheckManager, NetworkSecurityManager, networkSecurityManager, ResourceManagementManager, resourceManagementManager };
+export { detectServiceRegion, signRequest, signRequestAsync, createPresignedUrl, createPresignedUrlAsync, makeAWSRequest, makeAWSRequestOnce, makeAWSRequestAsync, parseXMLResponse, parseJSONResponse, clearSigningKeyCache, getSigningKeyCacheSize, isNodeCryptoAvailable, isWebCryptoAvailable, QueuePresets, RealtimePresets, detectDeploymentTargets, resolveDeploymentMode, deploymentCoexistenceError, resolveAppDatabase, resolveCloudProvider, TemplateBuilder, Pseudo, generateResourceName, generateLogicalId, getTimestamp, sanitizeName, resolveProjectStackName, resolveSiteStackName, resolveSiteResourceName, resolveSiteBucketName, resolveStorageBucketName, resolveDeployBucketName, resolveServerlessAppStackName, resolveServerlessArtifactBucketName, resolveServerlessAssetBucketName, DependencyGraph, analyzeStackDiff, formatDiff, Storage, Registry, CDN, DNS, Security, Compute, Network, FileSystem, Email, exports_incoming_call, Phone, Queue, JobLoader, StacksIntegration, exports_send, SMS, Sftp, AI, Database, Cache, Permissions, ApiGateway, Messaging, Workflow, Monitoring, Auth, Deployment, AssetHasher, Secrets, ParameterStore, Search, Redirects, Communication, Fn2, Arn, AWS_PSEUDO_PARAMETERS, CloudFormationBuilder, buildCloudFormationTemplate, createStaticSitePreset, createNodeJsServerPreset, createNodeJsServerlessPreset, createServerlessNodePreset, createFullStackAppPreset, createApiBackendPreset, createWordPressPreset, createJamstackPreset, createMicroservicesPreset, createRealtimeAppPreset, createDataPipelinePreset, createMLApiPreset, createTraditionalWebAppPreset, createLaravelPreset, createServerlessLaravelPreset, createDashboardSite, DASHBOARD_STATE_DIR, DASHBOARD_ENTRY, DASHBOARD_PORT_BASE, DASHBOARD_PORT_SPAN, deriveManagementDashboardPort, resolveDashboardDomain, resolveDashboardDomains, hasManagementDashboardSite, MANAGEMENT_DASHBOARD_SITE_PREFIX, managementDashboardSiteName, isManagementDashboardSiteName, resolveManagementDashboardSites, resolveManagementDashboardSite, extendPreset, composePresets, createPreset, mergeInfrastructure, withMonitoring, withSecurity, withDatabase, withCache, withCDN, withQueue, fromEnvironment, fromSharedCredentials, fromEC2Metadata, fromECSMetadata, fromWebIdentity, getCredentials, createCredentialProvider, resolveCredentials, resolveRegion, getAccountId, S3Error, createS3Client, CloudError, ConfigurationError, CredentialError, DeploymentError, ValidationError, AWSAPIError, ErrorCodes, getErrorDetails, createError, DebugLogger, validateConfiguration, detectMisconfigurations, validateCredentials, checkIAMPermissions, getRequiredPermissions, suggestIAMPolicy, DEFAULT_SERVICE_LIMITS, checkServiceQuotas, getQuotaUsageSummary, suggestQuotaIncrease, FileCache, TemplateCache, templateCache, hashFile, hashString, hashBuffer, hashDirectory, hashManifest, quickHash, findChangedFiles, HashCache, parallel, batch, parallelMap, parallelWithRetry, sequence, withTimeout, RateLimiter, chunk, processInChunks, diffTemplates, getDiffSummary, requiresReplacement, categorizeChanges, getDeploymentStrategy, getDiffStats, cloud_config_schema_default, validateAgainstSchema, defaultLocalConfig, getLocalConfig, isLocalDevelopment, getLocalEndpoint, getLocalCredentials, getLocalEnvVars, MockCloudFormation, MockS3, MockDynamoDB, createMockAWS, PreviewEnvironmentManager, previewManager, generatePreviewWorkflow, generateCleanupWorkflow, generateCostReportWorkflow, PreviewNotificationService, previewNotifications, formatTable, formatTree, formatProgressBar, formatBytes, formatDuration, formatList, formatKeyValue, ProgressBar, MultiStepProgress, Spinner, TaskList, suggestCommand, formatSuggestion, isLikelyTypo, getContextualHelp, searchCommands, autocomplete, suggestFlags, formatFlagSuggestions, getCommandUsage, validateCommand, REPL, REPLContext, REPLCommandBuilder, CommandHistory, formatHistory, formatHistoryStats, MultiRegionManager, multiRegionManager, CrossRegionReferenceManager, GlobalResourceManager, RegionPairManager, StackDependencyManager, crossRegionReferenceManager, globalResourceManager, regionPairManager, stackDependencyManager, AWS_REGIONS, getRegion, getAllRegions, getRegionsByLocation, getRegionsByCompliance, getRegionsByPricingTier, isValidRegion, getClosestRegion, suggestRegions, suggestRegionPairs, formatRegion, formatRegionList, getRegionStats, MultiAccountManager, OrganizationManager, multiAccountManager, organizationManager, RECOMMENDED_ACCOUNT_STRUCTURES, RECOMMENDED_SCPS, COMMON_CROSS_ACCOUNT_ROLES, getRecommendedStructure, generateCrossAccountRoleCF, validateAccountStructure, formatAccountStructure, generateDeploymentWorkflow, generateMultiEnvWorkflow, generatePRPreviewWorkflow, generateScheduledWorkflow, generateMatrixWorkflow, generateDeploymentPipeline, generateMultiEnvPipeline, generatePreviewPipeline, generateScheduledPipeline, generateManualPipeline, generateDeploymentConfig, generateMultiEnvConfig, generateScheduledConfig, generateApprovalConfig, generateParallelConfig, BackupManager, backupManager, DisasterRecoveryManager, drManager, AWSConfigManager, awsConfigManager, CloudTrailManager, cloudTrailManager, GuardDutyManager, guardDutyManager, SecurityHubManager, securityHubManager, BlueGreenManager, blueGreenManager, CanaryManager, canaryManager, ABTestManager, abTestManager, ProgressiveDeploymentManager, progressiveDeploymentManager, XRayManager, xrayManager, MetricsManager, metricsManager, LogsManager, logsManager, SyntheticsManager, syntheticsManager, MigrationManager, migrationManager, ReplicaManager, replicaManager, PerformanceManager, performanceManager, DatabaseUserManager, databaseUserManager, SecretsRotationManager, secretsRotationManager, SecretsManager, secretsManager, CertificateManager, certificateManager, SecurityScanningManager, securityScanningManager, ImageScanningManager, imageScanningManager, BuildOptimizationManager, buildOptimizationManager, ContainerRegistryManager, containerRegistryManager, ServiceMeshManager, serviceMeshManager, LambdaLayersManager, lambdaLayersManager, LambdaVersionsManager, lambdaVersionsManager, LambdaConcurrencyManager, lambdaConcurrencyManager, LambdaDestinationsManager, lambdaDestinationsManager, LambdaVPCManager, lambdaVPCManager, LambdaDLQManager, lambdaDLQManager, Route53RoutingManager, route53RoutingManager, DNSSECManager, dnssecManager, Route53ResolverManager, route53ResolverManager, BounceComplaintHandler, bounceComplaintHandler, EmailAnalyticsManager, emailAnalyticsManager, SenderReputationManager, senderReputationManager, EmailTemplateManager, emailTemplateManager, exports_advanced, exports_inbound, exports_advanced2, exports_advanced3, FIFOQueueManager, fifoQueueManager, DLQMonitoringManager, dlqMonitoringManager, BatchProcessingManager, batchProcessingManager, QueueManagementManager, queueManagementManager, createZip, generateBootstrap, runBuildHooks, sha256, artifactKey, packageServerlessApp, MANAGED_NODE_VERSIONS, resolveServerlessRuntime, resolveQueues, resolveQueueNames, composeServerlessAppTemplate, PHP_LAYER_EXTENSIONS, phpLayerPackages, phpLayerBuildStage, generatePhpLayerDockerfile, generateAppImageDockerfile, sharedRuntimeLoop, buildNodeRuntimeLayerZip, buildBunRuntimeLayerZip, resolveApp, eventToRequest, responseToResult, createHttpHandler, createQueueHandler, createCliHandler, createHandlers, generatePhpFpmConfig, phpRuntimeLayerAssets, laravelServerlessEnvDefaults, LARAVEL_SERVERLESS_BUILD_STEPS, buildPhpRuntimeLayerZip, PHP_DEFAULT_EXCLUDES, runPhpBuildHooks, collectPhpAppEntries, packagePhpApp, StaticSiteManager, staticSiteManager, StorageAdvancedManager, storageAdvancedManager, HealthCheckManager, healthCheckManager, NetworkSecurityManager, networkSecurityManager, ResourceManagementManager, resourceManagementManager };

package/dist/{chunk-3c46eypc.js → chunk-rrn8njr2.js}

@@ -6,7 +6,7 @@ import {
   resolveCloudProvider,
   resolveManagementDashboardSites,
   resolveProjectStackName
-} from "./chunk-stt1z5cx.js";
+} from "./chunk-r16e02bc.js";
 import {
   EC2Client,
   SSMClient
@@ -2447,6 +2447,9 @@ class HetznerDriver {
     if (!compute) {
       throw new Error("infrastructure.compute is required to provision Hetzner compute");
     }
+    if (config.cloud?.attachTo) {
+      return this.attachToComputeInfrastructure(config.cloud.attachTo, config, environment);
+    }
     const stackName = resolveProjectStackName(config, environment);
     const serverName = `${slug}-${environment}-app`;
     const phpBox = compute.runtime === "php" || !!compute.php;
@@ -3022,9 +3025,9 @@ class HetznerDriver {
     const exact = servers.filter((server) => matchesTsCloudLabels(server.labels, options.slug, options.environment, role));
     if (exact.length > 0)
       return exact.map(toTarget);
-    if (role === "app") {
+    if (role === "app" || role === "lb" || role === "services") {
       const state = await readDriverState(options.stackName ?? `${options.slug}-${options.environment}`);
-      const pinnedIds = [state?.serverId, ...state?.appServerIds ?? []].filter((id) => typeof id === "number");
+      const pinnedIds = [...new Set(role === "app" ? [state?.serverId, ...state?.appServerIds ?? []] : role === "lb" ? [state?.lbServerId] : [state?.servicesServerId])].filter((id) => typeof id === "number");
       if (pinnedIds.length > 0) {
         const pinned = [];
         for (const id of pinnedIds) {
@@ -3043,6 +3046,34 @@ class HetznerDriver {
     }
     return [];
   }
+  async attachToComputeInfrastructure(ownerSlug, config, environment) {
+    const servers = await this.client.listServers();
+    const running = (role) => servers.filter((server) => server.status !== "off" && matchesTsCloudLabels(server.labels, ownerSlug, environment, role));
+    const appServers = running("app");
+    if (appServers.length === 0) {
+      throw new Error(`Cannot attach '${config.project.slug}' to '${ownerSlug}': no running Hetzner app server is labeled for ${ownerSlug}/${environment}. Deploy the owner project first.`);
+    }
+    const lbServer = running("lb")[0];
+    const servicesServer = running("services")[0];
+    const primaryApp = appServers[0];
+    const publicGateway = lbServer ?? primaryApp;
+    const stackName = resolveProjectStackName(config, environment);
+    const state = {
+      provider: "hetzner",
+      stackName,
+      serverId: primaryApp.id,
+      serverName: primaryApp.name,
+      appServerIds: appServers.map((server) => server.id),
+      lbServerId: lbServer?.id,
+      servicesServerId: servicesServer?.id,
+      servicesPrivateIp: servicesServer?.private_net?.[0]?.ip,
+      publicIp: publicGateway.public_net.ipv4?.ip,
+      deployStoragePath: "/var/ts-cloud/staging",
+      sshUser: this.sshUser
+    };
+    await writeDriverState(stackName, state);
+    return this.outputsFromState(state);
+  }
   async runRemoteDeploy(options) {
     if (options.targets.length === 0) {
       return { success: false, instanceCount: 0, perInstance: [], error: "No targets provided" };
@@ -5120,6 +5151,8 @@ function buildCloudFrontOriginConfig(options) {
     throw new Error("buildCloudFrontOriginConfig: at least one alias is required");
   if (aliases.includes(options.originDomain))
     throw new Error(`buildCloudFrontOriginConfig: originDomain ${options.originDomain} must not be one of the aliases (it would loop)`);
+  if (options.originShield && !options.originShieldRegion)
+    throw new Error("buildCloudFrontOriginConfig: originShieldRegion is required when originShield is enabled");
   const header = options.originSecretHeader ?? "X-Origin-Verify";
   const customHeaders = options.originSecret ? { Quantity: 1, Items: [{ HeaderName: header, HeaderValue: options.originSecret }] } : { Quantity: 0 };
   const behaviors = [...options.behaviors ?? []].sort((a, b) => b.pathPattern.length - a.pathPattern.length);
@@ -5146,7 +5179,7 @@ function buildCloudFrontOriginConfig(options) {
         },
         ConnectionAttempts: 3,
         ConnectionTimeout: 10,
-        OriginShield: { Enabled: false },
+        OriginShield: options.originShield ? { Enabled: true, OriginShieldRegion: options.originShieldRegion } : { Enabled: false },
         OriginAccessControlId: ""
       }]
     },

package/dist/{chunk-ebx9gjnn.js → chunk-z58fqnjm.js}

@@ -1,8 +1,8 @@
 import {
   buildAndPushServerlessImage
-} from "./chunk-tskj9fay.js";
+} from "./chunk-f29w04w5.js";
 import"./chunk-hsk6fe6x.js";
-import"./chunk-stt1z5cx.js";
+import"./chunk-r16e02bc.js";
 import"./chunk-arsh1g5h.js";
 import"./chunk-v0bahtg2.js";
 export {

package/dist/deploy/index.js

@@ -14,10 +14,10 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "../chunk-2mw2566h.js";
+} from "../chunk-a4q0231r.js";
 import {
   buildAndPushServerlessImage
-} from "../chunk-tskj9fay.js";
+} from "../chunk-f29w04w5.js";
 import"../chunk-b82pbxyp.js";
 import"../chunk-hsk6fe6x.js";
 import {
@@ -32,8 +32,8 @@ import {
   resolveUiSource,
   siteInstallBase,
   validateDeploymentConfig
-} from "../chunk-3c46eypc.js";
-import"../chunk-stt1z5cx.js";
+} from "../chunk-rrn8njr2.js";
+import"../chunk-r16e02bc.js";
 import"../chunk-93hjhs78.js";
 import {
   deleteStaticSite,

package/dist/drivers/hetzner/driver.d.ts

@@ -83,6 +83,14 @@ export declare class HetznerDriver implements CloudDriver {
     getComputeOutputs(options: ProvisionComputeOptions): Promise<ComputeStackOutputs>;
     uploadRelease(options: UploadReleaseOptions): Promise<UploadReleaseResult>;
     findComputeTargets(options: FindComputeTargetsOptions): Promise<ComputeTarget[]>;
+    /**
+     * Attach this project to compute owned by another ts-cloud project.
+     *
+     * The owner's Hetzner labels are the source of truth. We write a tenant-local
+     * state pin so all later deploy operations resolve the same app/LB targets,
+     * even when several unrelated managed boxes exist in the Hetzner project.
+     */
+    private attachToComputeInfrastructure;
     runRemoteDeploy(options: RunRemoteDeployOptions): Promise<RemoteDeployResult>;
     /**
      * Ensure the local SSH public key is registered in the Hetzner project and

package/dist/drivers/index.js

@@ -51,8 +51,8 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "../chunk-3c46eypc.js";
-import"../chunk-stt1z5cx.js";
+} from "../chunk-rrn8njr2.js";
+import"../chunk-r16e02bc.js";
 import"../chunk-93hjhs78.js";
 import"../chunk-qpj3edwz.js";
 import"../chunk-vd87cpvn.js";

package/dist/drivers/shared/cloudfront-origin.d.ts

@@ -53,6 +53,10 @@ export interface BuildCloudFrontOriginOptions {
     comment?: string;
     /** `PriceClass_All` | `PriceClass_200` | `PriceClass_100`. @default 'PriceClass_All' */
     priceClass?: string;
+    /** Enable CloudFront Origin Shield for the custom origin. @default false */
+    originShield?: boolean;
+    /** AWS region used by Origin Shield. Required when {@link originShield} is enabled. */
+    originShieldRegion?: string;
 }
 /**
  * Build a complete CloudFront `DistributionConfig` for a self-hosted origin.

package/dist/index.js

@@ -57,10 +57,10 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "./chunk-2mw2566h.js";
+} from "./chunk-a4q0231r.js";
 import {
   buildAndPushServerlessImage
-} from "./chunk-tskj9fay.js";
+} from "./chunk-f29w04w5.js";
 import {
   CloudWatchLogsClient,
   EFSClient,
@@ -108,7 +108,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-3c46eypc.js";
+} from "./chunk-rrn8njr2.js";
 import {
   ABTestManager,
   AI,
@@ -231,6 +231,7 @@ import {
   SecurityScanningManager,
   SenderReputationManager,
   ServiceMeshManager,
+  Sftp,
   Spinner,
   StackDependencyManager,
   StacksIntegration,
@@ -513,7 +514,7 @@ import {
   withSecurity,
   withTimeout,
   xrayManager
-} from "./chunk-stt1z5cx.js";
+} from "./chunk-r16e02bc.js";
 import {
   EC2Client,
   SSMClient
@@ -592,6 +593,7 @@ class InfrastructureGenerator {
         servers: { ...this.config.infrastructure?.servers, ...envInfra.servers },
         databases: { ...this.config.infrastructure?.databases, ...envInfra.databases },
         cdn: { ...this.config.infrastructure?.cdn, ...envInfra.cdn },
+        sftp: envInfra.sftp ?? this.config.infrastructure?.sftp,
         queues: { ...this.config.infrastructure?.queues, ...envInfra.queues },
         redirects: { ...this.config.infrastructure?.redirects, ...envInfra.redirects },
         realtime: { ...this.config.infrastructure?.realtime, ...envInfra.realtime },
@@ -1921,6 +1923,23 @@ else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`
         }
       }
     }
+    if (this.mergedConfig.infrastructure?.sftp) {
+      const result = Sftp.create({
+        ...this.mergedConfig.infrastructure.sftp,
+        slug,
+        environment: env
+      });
+      for (const [logicalId, resource] of Object.entries(result.resources))
+        this.builder.addResource(logicalId, resource);
+      this.builder.addOutput("SftpServerId", {
+        Value: { Ref: result.serverLogicalId },
+        Description: "AWS Transfer Family SFTP server ID"
+      });
+      this.builder.addOutput("SftpEndpoint", {
+        Value: { "Fn::Sub": `\${${result.serverLogicalId}}.server.transfer.\${AWS::Region}.amazonaws.com` },
+        Description: "AWS Transfer Family SFTP endpoint"
+      });
+    }
     if (hostedZoneId && websiteBucketDistributions.length > 0) {
       for (const { name, distLogicalId, aliases } of websiteBucketDistributions) {
         for (const alias of aliases) {
@@ -2008,7 +2027,11 @@ else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`
           OriginPath: "",
           S3OriginConfig: {
             OriginAccessIdentity: ""
-          }
+          },
+          OriginShield: cdnConfig.originShield ? {
+            Enabled: true,
+            OriginShieldRegion: cdnConfig.originShieldRegion || this.mergedConfig.environments[env]?.region || this.mergedConfig.project.region || "us-east-1"
+          } : { Enabled: false }
         }];
         const cacheBehaviors = [];
         const extraDependsOn = [];
@@ -5006,6 +5029,7 @@ export {
   exports_send as SmsHandlers,
   SmsClient,
   exports_advanced3 as SmsAdvanced,
+  Sftp,
   ServiceMeshManager,
   SenderReputationManager,
   SecurityScanningManager,