@stacksjs/ts-cloud 0.7.49 → 0.7.51

package/dist/{chunk-kshwaj48.js → chunk-b17vf1g1.js}

@@ -29,7 +29,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-9359j1an.js";
+} from "./chunk-d5vqwj8s.js";
 import {
   artifactKey,
   composeServerlessAppTemplate,

package/dist/{chunk-9359j1an.js → chunk-d5vqwj8s.js}

@@ -915,6 +915,10 @@ function writeFileHeredoc(path, content, delimiter, mode = "0644") {
     `chmod ${mode} ${path}`
   ];
 }
+function rpxCertRenewServiceName(slug) {
+  const safeSlug = (slug || "app").replace(/[^a-z0-9._-]+/gi, "-");
+  return `rpx-cert-renew-${safeSlug}.service`;
+}
 function certDomainsForConfig(config) {
   const seen = new Set;
   for (const r of config.proxies) {
@@ -940,7 +944,7 @@ function buildCertManagementCommands(options) {
   const spaced = domains.join(" ");
   const slug = (options.slug || "app").replace(/[^a-z0-9._-]+/gi, "-");
   const renewScriptPath = `${RPX_DIR}/renew-certs-${slug}.sh`;
-  const renewServiceName = `rpx-cert-renew-${slug}.service`;
+  const renewServiceName = rpxCertRenewServiceName(slug);
   const renewTimerName = `rpx-cert-renew-${slug}.timer`;
   const renewScript = [
     "#!/bin/sh",
@@ -2447,6 +2451,9 @@ class HetznerDriver {
     if (!compute) {
       throw new Error("infrastructure.compute is required to provision Hetzner compute");
     }
+    if (config.cloud?.attachTo) {
+      return this.attachToComputeInfrastructure(config.cloud.attachTo, config, environment);
+    }
     const stackName = resolveProjectStackName(config, environment);
     const serverName = `${slug}-${environment}-app`;
     const phpBox = compute.runtime === "php" || !!compute.php;
@@ -3022,9 +3029,9 @@ class HetznerDriver {
     const exact = servers.filter((server) => matchesTsCloudLabels(server.labels, options.slug, options.environment, role));
     if (exact.length > 0)
       return exact.map(toTarget);
-    if (role === "app") {
+    if (role === "app" || role === "lb" || role === "services") {
       const state = await readDriverState(options.stackName ?? `${options.slug}-${options.environment}`);
-      const pinnedIds = [state?.serverId, ...state?.appServerIds ?? []].filter((id) => typeof id === "number");
+      const pinnedIds = [...new Set(role === "app" ? [state?.serverId, ...state?.appServerIds ?? []] : role === "lb" ? [state?.lbServerId] : [state?.servicesServerId])].filter((id) => typeof id === "number");
       if (pinnedIds.length > 0) {
         const pinned = [];
         for (const id of pinnedIds) {
@@ -3043,6 +3050,34 @@ class HetznerDriver {
     }
     return [];
   }
+  async attachToComputeInfrastructure(ownerSlug, config, environment) {
+    const servers = await this.client.listServers();
+    const running = (role) => servers.filter((server) => server.status !== "off" && matchesTsCloudLabels(server.labels, ownerSlug, environment, role));
+    const appServers = running("app");
+    if (appServers.length === 0) {
+      throw new Error(`Cannot attach '${config.project.slug}' to '${ownerSlug}': no running Hetzner app server is labeled for ${ownerSlug}/${environment}. Deploy the owner project first.`);
+    }
+    const lbServer = running("lb")[0];
+    const servicesServer = running("services")[0];
+    const primaryApp = appServers[0];
+    const publicGateway = lbServer ?? primaryApp;
+    const stackName = resolveProjectStackName(config, environment);
+    const state = {
+      provider: "hetzner",
+      stackName,
+      serverId: primaryApp.id,
+      serverName: primaryApp.name,
+      appServerIds: appServers.map((server) => server.id),
+      lbServerId: lbServer?.id,
+      servicesServerId: servicesServer?.id,
+      servicesPrivateIp: servicesServer?.private_net?.[0]?.ip,
+      publicIp: publicGateway.public_net.ipv4?.ip,
+      deployStoragePath: "/var/ts-cloud/staging",
+      sshUser: this.sshUser
+    };
+    await writeDriverState(stackName, state);
+    return this.outputsFromState(state);
+  }
   async runRemoteDeploy(options) {
     if (options.targets.length === 0) {
       return { success: false, instanceCount: 0, perInstance: [], error: "No targets provided" };
@@ -5090,6 +5125,45 @@ async function reloadRpxGateway(options) {
   logger.success(`rpx gateway reloaded on ${result.instanceCount} target(s)`);
   return true;
 }
+async function renewRpxCertificates(options) {
+  const { config, environment, driver, logger = noopLogger2 } = options;
+  const routeSource = options.rpxConfig ?? config;
+  const proxy = routeSource.infrastructure?.compute?.proxy ?? config.infrastructure?.compute?.proxy;
+  if (proxy?.engine !== "rpx" || !proxy.onDemandTls)
+    return true;
+  const rpxConfig = buildRpxConfig(routeSource.sites || {}, { proxy, slug: config.project.slug });
+  if (rpxConfig.proxies.length === 0)
+    return true;
+  const slug = config.project.slug;
+  const stackName = resolveProjectStackName(config, environment);
+  let role = "lb";
+  let targets = await driver.findComputeTargets({ slug, environment, role, stackName });
+  if (targets.length === 0) {
+    role = "app";
+    targets = await driver.findComputeTargets({ slug, environment, role, stackName });
+  }
+  if (targets.length === 0) {
+    logger.warn("rpx TLS: no gateway targets found - skipping certificate issuance.");
+    return true;
+  }
+  logger.step("Issuing rpx TLS certificates after DNS reconciliation...");
+  const result = await driver.runRemoteDeploy({
+    targets,
+    commands: [`systemctl start ${rpxCertRenewServiceName(slug)}`],
+    comment: `ts-cloud rpx TLS issuance ${slug}`,
+    tags: {
+      Project: slug,
+      Environment: environment,
+      Role: role
+    }
+  });
+  if (!result.success) {
+    logger.error(`rpx TLS issuance failed: ${result.error || "unknown error"}`);
+    return false;
+  }
+  logger.success(`rpx TLS certificates reconciled on ${result.instanceCount} gateway target(s)`);
+  return true;
+}
 // src/drivers/shared/cloudfront-origin.ts
 var MANAGED_CACHE_POLICY_OPTIMIZED = "658327ea-f89d-4fab-a63d-7e88639e58f6";
 var MANAGED_CACHE_POLICY_DISABLED = "4135ea2d-6df8-44a3-9df3-4b5a84be39ad";
@@ -5172,4 +5246,4 @@ function buildCloudFrontOriginConfig(options) {
     CustomErrorResponses: { Quantity: 0 }
   };
 }
-export { siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, pgAdminCommand, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };
+export { siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, pgAdminCommand, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };

package/dist/deploy/index.js

@@ -14,7 +14,7 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "../chunk-kshwaj48.js";
+} from "../chunk-b17vf1g1.js";
 import {
   buildAndPushServerlessImage
 } from "../chunk-f29w04w5.js";
@@ -32,7 +32,7 @@ import {
   resolveUiSource,
   siteInstallBase,
   validateDeploymentConfig
-} from "../chunk-9359j1an.js";
+} from "../chunk-d5vqwj8s.js";
 import"../chunk-r16e02bc.js";
 import"../chunk-93hjhs78.js";
 import {

package/dist/drivers/hetzner/driver.d.ts

@@ -83,6 +83,14 @@ export declare class HetznerDriver implements CloudDriver {
     getComputeOutputs(options: ProvisionComputeOptions): Promise<ComputeStackOutputs>;
     uploadRelease(options: UploadReleaseOptions): Promise<UploadReleaseResult>;
     findComputeTargets(options: FindComputeTargetsOptions): Promise<ComputeTarget[]>;
+    /**
+     * Attach this project to compute owned by another ts-cloud project.
+     *
+     * The owner's Hetzner labels are the source of truth. We write a tenant-local
+     * state pin so all later deploy operations resolve the same app/LB targets,
+     * even when several unrelated managed boxes exist in the Hetzner project.
+     */
+    private attachToComputeInfrastructure;
     runRemoteDeploy(options: RunRemoteDeployOptions): Promise<RemoteDeployResult>;
     /**
      * Ensure the local SSH public key is registered in the Hetzner project and

package/dist/drivers/index.d.ts

@@ -11,7 +11,7 @@ export type { RemoteExecOptions, RemoteExecResult, WaitOptions } from './shared/
 export { AwsBoxProvisioner, buildBoxUserData, createBoxProvisioner, HetznerBoxProvisioner, UBUNTU_2404_AMI_PARAM, } from './shared/box-provision';
 export type { AwsBoxProvisionerOptions, BoxPort, BoxProviderName, BoxProvisioner, BoxSpec, CreateBoxProvisionerOptions, ProvisionedBox, } from './shared/box-provision';
 export { buildAwsArtifactFetch, buildHostCleanupScript, buildLocalArtifactFetch, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, resolveExecStart, } from './shared/deploy-script';
-export { deployAllComputeSites, deploySiteRelease, reloadRpxGateway } from './shared/compute-deploy';
+export { deployAllComputeSites, deploySiteRelease, reloadRpxGateway, renewRpxCertificates } from './shared/compute-deploy';
 export { buildRpxConfig, buildRpxFragmentRefreshScript, buildRpxLbConfig, buildRpxProvisionScript, deriveRouteId, normalizeRoutePath, renderRpxLauncher, DEFAULT_RPX_CERTS_DIR, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, } from './shared/rpx-gateway';
 export type { BuildRpxConfigOptions, BuildRpxFragmentRefreshOptions, BuildRpxProvisionOptions, RpxGatewayConfig, RpxLbAppBox, RpxRoute, } from './shared/rpx-gateway';
 export { buildCloudFrontOriginConfig, MANAGED_CACHE_POLICY_DISABLED, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, } from './shared/cloudfront-origin';

package/dist/drivers/index.js

@@ -42,6 +42,7 @@ import {
   releaseTarballTmpPath,
   reloadRpxGateway,
   renderRpxLauncher,
+  renewRpxCertificates,
   resolveExecStart,
   resolveHetznerApiToken,
   scpUpload,
@@ -51,7 +52,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "../chunk-9359j1an.js";
+} from "../chunk-d5vqwj8s.js";
 import"../chunk-r16e02bc.js";
 import"../chunk-93hjhs78.js";
 import"../chunk-qpj3edwz.js";
@@ -68,6 +69,7 @@ export {
   scpUpload,
   resolveHetznerApiToken,
   resolveExecStart,
+  renewRpxCertificates,
   renderRpxLauncher,
   reloadRpxGateway,
   releaseTarballTmpPath,

package/dist/drivers/shared/compute-deploy.d.ts

@@ -47,3 +47,10 @@ export declare function deployAllComputeSites(options: DeployAllSitesOptions): P
  *    launcher + unit and `systemctl restart`s, reloading the new routes.
  */
 export declare function reloadRpxGateway(options: DeployAllSitesOptions): Promise<boolean>;
+/**
+ * Request the first production certificates after DNS has been reconciled.
+ * Provisioning installs the per-project renewal unit, but ACME HTTP-01 cannot
+ * succeed until the domain points at the new box. This deliberately runs after
+ * DNS and targets the same gateway box selected by reloadRpxGateway.
+ */
+export declare function renewRpxCertificates(options: Pick<DeployAllSitesOptions, 'config' | 'environment' | 'driver' | 'logger' | 'rpxConfig'>): Promise<boolean>;

package/dist/drivers/shared/rpx-gateway.d.ts

@@ -273,6 +273,7 @@ export interface BuildRpxProvisionOptions {
 export declare const RPX_CERT_RENEW_SCRIPT = "/etc/rpx/renew-certs.sh";
 export declare const RPX_CERT_RENEW_SERVICE = "rpx-cert-renew.service";
 export declare const RPX_CERT_RENEW_TIMER = "rpx-cert-renew.timer";
+export declare function rpxCertRenewServiceName(slug: string): string;
 /** The routable FQDNs in a gateway config — each terminates TLS so each needs a cert. */
 export declare function certDomainsForConfig(config: RpxGatewayConfig): string[];
 /**

package/dist/index.js

@@ -57,7 +57,7 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "./chunk-kshwaj48.js";
+} from "./chunk-b17vf1g1.js";
 import {
   buildAndPushServerlessImage
 } from "./chunk-f29w04w5.js";
@@ -108,7 +108,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-9359j1an.js";
+} from "./chunk-d5vqwj8s.js";
 import {
   ABTestManager,
   AI,