@stacksjs/ts-cloud 0.7.50 → 0.7.52

package/dist/{chunk-a4q0231r.js → chunk-b17vf1g1.js}

@@ -29,7 +29,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-rrn8njr2.js";
+} from "./chunk-d5vqwj8s.js";
 import {
   artifactKey,
   composeServerlessAppTemplate,

package/dist/{chunk-rrn8njr2.js → chunk-d5vqwj8s.js}

@@ -915,6 +915,10 @@ function writeFileHeredoc(path, content, delimiter, mode = "0644") {
     `chmod ${mode} ${path}`
   ];
 }
+function rpxCertRenewServiceName(slug) {
+  const safeSlug = (slug || "app").replace(/[^a-z0-9._-]+/gi, "-");
+  return `rpx-cert-renew-${safeSlug}.service`;
+}
 function certDomainsForConfig(config) {
   const seen = new Set;
   for (const r of config.proxies) {
@@ -940,7 +944,7 @@ function buildCertManagementCommands(options) {
   const spaced = domains.join(" ");
   const slug = (options.slug || "app").replace(/[^a-z0-9._-]+/gi, "-");
   const renewScriptPath = `${RPX_DIR}/renew-certs-${slug}.sh`;
-  const renewServiceName = `rpx-cert-renew-${slug}.service`;
+  const renewServiceName = rpxCertRenewServiceName(slug);
   const renewTimerName = `rpx-cert-renew-${slug}.timer`;
   const renewScript = [
     "#!/bin/sh",
@@ -5121,6 +5125,45 @@ async function reloadRpxGateway(options) {
   logger.success(`rpx gateway reloaded on ${result.instanceCount} target(s)`);
   return true;
 }
+async function renewRpxCertificates(options) {
+  const { config, environment, driver, logger = noopLogger2 } = options;
+  const routeSource = options.rpxConfig ?? config;
+  const proxy = routeSource.infrastructure?.compute?.proxy ?? config.infrastructure?.compute?.proxy;
+  if (proxy?.engine !== "rpx" || !proxy.onDemandTls)
+    return true;
+  const rpxConfig = buildRpxConfig(routeSource.sites || {}, { proxy, slug: config.project.slug });
+  if (rpxConfig.proxies.length === 0)
+    return true;
+  const slug = config.project.slug;
+  const stackName = resolveProjectStackName(config, environment);
+  let role = "lb";
+  let targets = await driver.findComputeTargets({ slug, environment, role, stackName });
+  if (targets.length === 0) {
+    role = "app";
+    targets = await driver.findComputeTargets({ slug, environment, role, stackName });
+  }
+  if (targets.length === 0) {
+    logger.warn("rpx TLS: no gateway targets found - skipping certificate issuance.");
+    return true;
+  }
+  logger.step("Issuing rpx TLS certificates after DNS reconciliation...");
+  const result = await driver.runRemoteDeploy({
+    targets,
+    commands: [`systemctl start ${rpxCertRenewServiceName(slug)}`],
+    comment: `ts-cloud rpx TLS issuance ${slug}`,
+    tags: {
+      Project: slug,
+      Environment: environment,
+      Role: role
+    }
+  });
+  if (!result.success) {
+    logger.error(`rpx TLS issuance failed: ${result.error || "unknown error"}`);
+    return false;
+  }
+  logger.success(`rpx TLS certificates reconciled on ${result.instanceCount} gateway target(s)`);
+  return true;
+}
 // src/drivers/shared/cloudfront-origin.ts
 var MANAGED_CACHE_POLICY_OPTIMIZED = "658327ea-f89d-4fab-a63d-7e88639e58f6";
 var MANAGED_CACHE_POLICY_DISABLED = "4135ea2d-6df8-44a3-9df3-4b5a84be39ad";
@@ -5203,4 +5246,4 @@ function buildCloudFrontOriginConfig(options) {
     CustomErrorResponses: { Quantity: 0 }
   };
 }
-export { siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, pgAdminCommand, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };
+export { siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, pgAdminCommand, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };

package/dist/deploy/index.js

@@ -14,7 +14,7 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "../chunk-a4q0231r.js";
+} from "../chunk-b17vf1g1.js";
 import {
   buildAndPushServerlessImage
 } from "../chunk-f29w04w5.js";
@@ -32,7 +32,7 @@ import {
   resolveUiSource,
   siteInstallBase,
   validateDeploymentConfig
-} from "../chunk-rrn8njr2.js";
+} from "../chunk-d5vqwj8s.js";
 import"../chunk-r16e02bc.js";
 import"../chunk-93hjhs78.js";
 import {

package/dist/deploy/quick-deploy.d.ts

@@ -1,25 +1,38 @@
 /**
  * Quick Deploy (Forge's push-to-deploy): generate a CI pipeline for the app's
  * git provider that runs `cloud deploy` on push to the deploy branch. ts-cloud
- * deploys from the operator's machine/CI (git-clone-on-server), so the modern
- * equivalent of Forge's deploy webhook is a provider-native pipeline rather than
- * an inbound webhook — keyed off `site.repository.provider`.
+ * deploys from the operator's machine/CI, so the modern equivalent of Forge's
+ * deploy webhook is a provider-native pipeline rather than an inbound webhook.
+ * The provider can come from a configured site repository or from the CLI's
+ * origin-remote detection, while the branch belongs to the target environment.
  */
 import type { CloudConfig } from '@ts-cloud/core';
+export type QuickDeployProvider = 'github' | 'gitlab' | 'bitbucket';
+export interface QuickDeployOptions {
+    /** Provider override, normally inferred from the origin remote by the CLI. */
+    provider?: QuickDeployProvider;
+    /** Limit the generated deploy command to one configured site. */
+    site?: string;
+    /** Skip DNS verification when DNS is already managed or attached elsewhere. */
+    skipDnsVerification?: boolean;
+    /** Dependency setup used by the generated GitHub Actions workflow. */
+    setup?: 'bun' | 'pantry';
+}
 export interface QuickDeployFile {
     /** Repo-relative path to write the pipeline to. */
     path: string;
     /** File contents. */
     content: string;
     /** Resolved git provider. */
-    provider: 'github' | 'gitlab' | 'bitbucket';
+    provider: QuickDeployProvider;
     /** Branch the pipeline triggers on. */
     branch: string;
 }
+/** Resolve a supported CI provider from a git remote URL. */
+export declare function inferQuickDeployProvider(remoteUrl: string): QuickDeployProvider | undefined;
 /**
- * Build the CI pipeline file for the config's git provider, or `null` when no
- * site has a github/gitlab/bitbucket repository (the `custom` provider and
- * webhook-less setups have no native pipeline to generate). `environment`
- * selects which `cloud deploy <env>` runs.
+ * Build the CI pipeline file for the resolved git provider, or `null` when no
+ * github/gitlab/bitbucket provider is available. `environment` selects both the
+ * environment-specific deploy branch and the `cloud deploy --env` target.
  */
-export declare function buildQuickDeployCi(config: CloudConfig, environment?: string): QuickDeployFile | null;
+export declare function buildQuickDeployCi(config: CloudConfig, environment?: string, options?: QuickDeployOptions): QuickDeployFile | null;

package/dist/drivers/index.d.ts

@@ -11,7 +11,7 @@ export type { RemoteExecOptions, RemoteExecResult, WaitOptions } from './shared/
 export { AwsBoxProvisioner, buildBoxUserData, createBoxProvisioner, HetznerBoxProvisioner, UBUNTU_2404_AMI_PARAM, } from './shared/box-provision';
 export type { AwsBoxProvisionerOptions, BoxPort, BoxProviderName, BoxProvisioner, BoxSpec, CreateBoxProvisionerOptions, ProvisionedBox, } from './shared/box-provision';
 export { buildAwsArtifactFetch, buildHostCleanupScript, buildLocalArtifactFetch, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, resolveExecStart, } from './shared/deploy-script';
-export { deployAllComputeSites, deploySiteRelease, reloadRpxGateway } from './shared/compute-deploy';
+export { deployAllComputeSites, deploySiteRelease, reloadRpxGateway, renewRpxCertificates } from './shared/compute-deploy';
 export { buildRpxConfig, buildRpxFragmentRefreshScript, buildRpxLbConfig, buildRpxProvisionScript, deriveRouteId, normalizeRoutePath, renderRpxLauncher, DEFAULT_RPX_CERTS_DIR, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, } from './shared/rpx-gateway';
 export type { BuildRpxConfigOptions, BuildRpxFragmentRefreshOptions, BuildRpxProvisionOptions, RpxGatewayConfig, RpxLbAppBox, RpxRoute, } from './shared/rpx-gateway';
 export { buildCloudFrontOriginConfig, MANAGED_CACHE_POLICY_DISABLED, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, } from './shared/cloudfront-origin';

package/dist/drivers/index.js

@@ -42,6 +42,7 @@ import {
   releaseTarballTmpPath,
   reloadRpxGateway,
   renderRpxLauncher,
+  renewRpxCertificates,
   resolveExecStart,
   resolveHetznerApiToken,
   scpUpload,
@@ -51,7 +52,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "../chunk-rrn8njr2.js";
+} from "../chunk-d5vqwj8s.js";
 import"../chunk-r16e02bc.js";
 import"../chunk-93hjhs78.js";
 import"../chunk-qpj3edwz.js";
@@ -68,6 +69,7 @@ export {
   scpUpload,
   resolveHetznerApiToken,
   resolveExecStart,
+  renewRpxCertificates,
   renderRpxLauncher,
   reloadRpxGateway,
   releaseTarballTmpPath,

package/dist/drivers/shared/compute-deploy.d.ts

@@ -47,3 +47,10 @@ export declare function deployAllComputeSites(options: DeployAllSitesOptions): P
  *    launcher + unit and `systemctl restart`s, reloading the new routes.
  */
 export declare function reloadRpxGateway(options: DeployAllSitesOptions): Promise<boolean>;
+/**
+ * Request the first production certificates after DNS has been reconciled.
+ * Provisioning installs the per-project renewal unit, but ACME HTTP-01 cannot
+ * succeed until the domain points at the new box. This deliberately runs after
+ * DNS and targets the same gateway box selected by reloadRpxGateway.
+ */
+export declare function renewRpxCertificates(options: Pick<DeployAllSitesOptions, 'config' | 'environment' | 'driver' | 'logger' | 'rpxConfig'>): Promise<boolean>;

package/dist/drivers/shared/rpx-gateway.d.ts

@@ -273,6 +273,7 @@ export interface BuildRpxProvisionOptions {
 export declare const RPX_CERT_RENEW_SCRIPT = "/etc/rpx/renew-certs.sh";
 export declare const RPX_CERT_RENEW_SERVICE = "rpx-cert-renew.service";
 export declare const RPX_CERT_RENEW_TIMER = "rpx-cert-renew.timer";
+export declare function rpxCertRenewServiceName(slug: string): string;
 /** The routable FQDNs in a gateway config — each terminates TLS so each needs a cert. */
 export declare function certDomainsForConfig(config: RpxGatewayConfig): string[];
 /**

package/dist/index.js

@@ -57,7 +57,7 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "./chunk-a4q0231r.js";
+} from "./chunk-b17vf1g1.js";
 import {
   buildAndPushServerlessImage
 } from "./chunk-f29w04w5.js";
@@ -108,7 +108,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-rrn8njr2.js";
+} from "./chunk-d5vqwj8s.js";
 import {
   ABTestManager,
   AI,