@stacksjs/ts-cloud 0.7.58 → 0.7.60

package/dist/{chunk-9m6b4m74.js → chunk-sd9h1baj.js}

@@ -5,8 +5,10 @@ import {
   resolveAppDatabase,
   resolveCloudProvider,
   resolveManagementDashboardSites,
-  resolveProjectStackName
-} from "./chunk-vdk53yyq.js";
+  resolveProjectStackName,
+  resolveStatePath,
+  statePath
+} from "./chunk-tq46tnxv.js";
 import {
   EC2Client,
   SSMClient
@@ -4069,6 +4071,7 @@ function redactForDashboard(config) {
   if (safe.hetzner)
     delete safe.hetzner.apiToken;
   delete safe.aws;
+  delete safe.stateDir;
   for (const site of Object.values(safe.sites ?? {})) {
     if (site?.env)
       site.env = blankValues(site.env);
@@ -4100,7 +4103,9 @@ function serializeDashboardConfig(config) {
 
 // src/deploy/management-dashboard.ts
 var MANAGEMENT_DASHBOARD_SITE = "dashboard";
-var DASHBOARD_CREDENTIALS_FILE = join4(".ts-cloud", "dashboard-credentials.json");
+function dashboardCredentialsFile() {
+  return statePath("dashboard-credentials.json");
+}
 function generatePassword() {
   return randomBytes(24).toString("base64url");
 }
@@ -4110,7 +4115,8 @@ function resolveDashboardAuth(cwd, username, logger) {
     return { password: explicit, source: "env" };
   if (truthy(process.env.TS_CLOUD_UI_PUBLIC))
     return { password: undefined, source: "public" };
-  const file = join4(cwd, DASHBOARD_CREDENTIALS_FILE);
+  const credentialsFile = dashboardCredentialsFile();
+  const file = resolveStatePath(cwd, "dashboard-credentials.json");
   try {
     if (existsSync2(file)) {
       const saved = JSON.parse(readFileSync3(file, "utf8"));
@@ -4124,10 +4130,10 @@ function resolveDashboardAuth(cwd, username, logger) {
     writeFileSync(file, `${JSON.stringify({ username, password, generatedAt: new Date().toISOString() }, null, 2)}
 `);
     chmodSync(file, 384);
-    logger.info(`Management dashboard: generated a password for '${username}' and saved it to ${DASHBOARD_CREDENTIALS_FILE} (read it there — it is not printed). Set TS_CLOUD_UI_PASSWORD to pin your own, or TS_CLOUD_UI_PUBLIC=1 to serve without auth.`);
+    logger.info(`Management dashboard: generated a password for '${username}' and saved it to ${credentialsFile} (read it there — it is not printed). Set TS_CLOUD_UI_PASSWORD to pin your own, or TS_CLOUD_UI_PUBLIC=1 to serve without auth.`);
   } catch (error) {
     logger.warn(`Management dashboard: could not persist the generated password (${error?.message ?? error}). Using it for this deploy only — pass: ${password}
-This password is now in your deploy log. Set TS_CLOUD_UI_PASSWORD to a value of your own and redeploy once ${DASHBOARD_CREDENTIALS_FILE} is writable.`);
+This password is now in your deploy log. Set TS_CLOUD_UI_PASSWORD to a value of your own and redeploy once ${credentialsFile} is writable.`);
   }
   return { password, source: "generated" };
 }
@@ -4135,7 +4141,9 @@ var noopLogger = { info: () => {}, warn: () => {} };
 function truthy(v) {
   return v != null && v !== "" && v !== "0" && v.toLowerCase() !== "false";
 }
-var LIVE_STAGE_DIR = join4(".ts-cloud", "dashboard-release");
+function liveStageDir() {
+  return statePath("dashboard-release");
+}
 function resolveDashboardVersion() {
   const explicit = process.env.TS_CLOUD_UI_VERSION?.trim();
   if (explicit)
@@ -4155,7 +4163,7 @@ function stageLiveDashboardRoot(config, cwd, logger) {
     logger.warn("Management dashboard: the cloud config has no project slug — skipping the live dashboard.");
     return null;
   }
-  const stage = join4(cwd, LIVE_STAGE_DIR);
+  const stage = resolveStatePath(cwd, "dashboard-release");
   try {
     mkdirSync(stage, { recursive: true });
     writeFileSync(join4(stage, "cloud.config.ts"), serializeDashboardConfig(config));
@@ -4167,7 +4175,7 @@ function stageLiveDashboardRoot(config, cwd, logger) {
     };
     writeFileSync(join4(stage, "package.json"), `${JSON.stringify(pkg, null, 2)}
 `);
-    return LIVE_STAGE_DIR;
+    return liveStageDir();
   } catch (error) {
     logger.warn(`Management dashboard: could not stage the live release (${error?.message ?? error}) — skipping.`);
     return null;
@@ -4246,7 +4254,7 @@ function ensureManagementDashboard(config, options = {}) {
     logger.info("Management dashboard: no domain resolved (set TS_CLOUD_UI_DOMAIN or configure a site domain) — skipping.");
     return config;
   }
-  const authNote = auth.source === "public" ? "NO AUTH — TS_CLOUD_UI_PUBLIC is set (dashboard is publicly reachable)" : auth.source === "env" ? "htpasswd-protected (TS_CLOUD_UI_PASSWORD)" : `htpasswd-protected (auto-generated — see ${DASHBOARD_CREDENTIALS_FILE})`;
+  const authNote = auth.source === "public" ? "NO AUTH — TS_CLOUD_UI_PUBLIC is set (dashboard is publicly reachable)" : auth.source === "env" ? "htpasswd-protected (TS_CLOUD_UI_PASSWORD)" : `htpasswd-protected (auto-generated — see ${dashboardCredentialsFile()})`;
   logger.warn("Management dashboard: static mode — one shared password, and no per-site collaborators. Unset TS_CLOUD_UI_STATIC for the live dashboard.");
   for (const { name, site } of resolved) {
     sites[name] = site;
@@ -5281,4 +5289,4 @@ function buildCloudFrontOriginConfig(options) {
     CustomErrorResponses: { Quantity: 0 }
   };
 }
-export { PANTRY_PROJECT_DIR, pgAdminCommand, BACKUP_RUNNER_PATH, buildBackupRestoreScript, siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, shipsARelease, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };
+export { PANTRY_PROJECT_DIR, pgAdminCommand, BACKUP_RUNNER_PATH, buildBackupRestoreScript, siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, shipsARelease, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, dashboardCredentialsFile, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };

package/dist/{chunk-vdk53yyq.js → chunk-tq46tnxv.js}

@@ -4,43 +4,44 @@ import {
 
 // ../core/dist/index.js
 import { createRequire } from "node:module";
+import { isAbsolute, join, relative } from "node:path";
 import { existsSync, readdirSync } from "node:fs";
-import { join } from "node:path";
+import { join as join2 } from "node:path";
 import { createHash } from "node:crypto";
 import { copyFileSync, existsSync as existsSync2, readdirSync as readdirSync2, readFileSync, statSync, writeFileSync } from "node:fs";
-import { basename, dirname, extname, join as join2 } from "node:path";
+import { basename, dirname, extname, join as join3 } from "node:path";
 import { existsSync as existsSync3, readFileSync as readFileSync2 } from "node:fs";
 import { homedir } from "node:os";
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 import { createHash as createHash2 } from "node:crypto";
 import { existsSync as existsSync4, mkdirSync, readdirSync as readdirSync3, readFileSync as readFileSync3, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 import { createHash as createHash3 } from "node:crypto";
 import { createReadStream, readdirSync as readdirSync4, statSync as statSync2 } from "node:fs";
-import { join as join5, relative } from "node:path";
+import { join as join6, relative as relative2 } from "node:path";
 import { deflateRawSync } from "node:zlib";
 import { execSync } from "node:child_process";
 import { createHash as createHash4 } from "node:crypto";
 import { cpSync, mkdtempSync, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname as dirname2, isAbsolute, join as join6, resolve } from "node:path";
+import { dirname as dirname2, isAbsolute as isAbsolute2, join as join7, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { execFileSync } from "node:child_process";
 import { mkdtempSync as mkdtempSync2, readFileSync as readFileSync4, rmSync as rmSync2 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname3, join as join7 } from "node:path";
+import { dirname as dirname3, join as join8 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { readFileSync as readFileSync5 } from "node:fs";
-import { dirname as dirname4, join as join8 } from "node:path";
+import { dirname as dirname4, join as join9 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { existsSync as existsSync5, mkdirSync as mkdirSync2, mkdtempSync as mkdtempSync3, readdirSync as readdirSync5, readFileSync as readFileSync6, rmSync as rmSync3, statSync as statSync3, writeFileSync as writeFileSync4 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join9, relative as relative2 } from "node:path";
+import { join as join10, relative as relative3 } from "node:path";
 import { execSync as execSync2 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
 import { readdirSync as readdirSync6, readFileSync as readFileSync7, statSync as statSync4 } from "node:fs";
-import { join as join10, relative as relative3, resolve as resolve2 } from "node:path";
+import { join as join11, relative as relative4, resolve as resolve2 } from "node:path";
 var __defProp = Object.defineProperty;
 var __returnValue = (v) => v;
 function __exportSetter(name, newValue) {
@@ -1058,6 +1059,32 @@ var RealtimePresets = {
     }
   }
 };
+var DEFAULT_STATE_DIR = ".ts-cloud";
+var STATE_DIR_ENV_VAR = "TS_CLOUD_STATE_DIR";
+var configuredStateDir = null;
+function setStateDir(dir) {
+  const trimmed = dir?.trim();
+  configuredStateDir = trimmed || null;
+}
+function stateDir() {
+  const fromEnv = process.env[STATE_DIR_ENV_VAR]?.trim();
+  return fromEnv || configuredStateDir || DEFAULT_STATE_DIR;
+}
+function statePath(...segments) {
+  return join(stateDir(), ...segments);
+}
+function resolveStatePath(cwd, ...segments) {
+  const dir = stateDir();
+  return isAbsolute(dir) ? join(dir, ...segments) : join(cwd, dir, ...segments);
+}
+function isStatePath(path, root = process.cwd()) {
+  const inside = (parent, child) => {
+    const rel = relative(parent, child);
+    return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+  };
+  const absolute = isAbsolute(path) ? path : join(root, path);
+  return inside(resolveStatePath(root), absolute);
+}
 function detectDeploymentTargets(config) {
   const server = config.infrastructure?.compute != null;
   const serverless = Object.values(config.environments ?? {}).some((env) => env?.app != null);
@@ -2169,11 +2196,11 @@ class Storage {
   static docsExist(options = {}) {
     const { projectRoot = process.cwd(), docsPaths = ["docs", "documentation", "doc"] } = options;
     for (const docsPath of docsPaths) {
-      const fullPath = join(projectRoot, docsPath);
+      const fullPath = join2(projectRoot, docsPath);
       if (existsSync(fullPath)) {
         const distPaths = ["dist", "build", ".bunpress/dist", "_site", "out", "public"];
         for (const distPath of distPaths) {
-          const fullDistPath = join(fullPath, distPath);
+          const fullDistPath = join2(fullPath, distPath);
           if (existsSync(fullDistPath)) {
             try {
               const files = readdirSync(fullDistPath);
@@ -2288,16 +2315,16 @@ class Storage {
     const privatePath = paths.private || "private";
     return {
       web: {
-        exists: existsSync(join(projectRoot, webPath)),
-        path: join(projectRoot, webPath)
+        exists: existsSync(join2(projectRoot, webPath)),
+        path: join2(projectRoot, webPath)
       },
       docs: {
-        exists: existsSync(join(projectRoot, docsPath)),
-        path: join(projectRoot, docsPath)
+        exists: existsSync(join2(projectRoot, docsPath)),
+        path: join2(projectRoot, docsPath)
       },
       private: {
-        exists: existsSync(join(projectRoot, privatePath)),
-        path: join(projectRoot, privatePath)
+        exists: existsSync(join2(projectRoot, privatePath)),
+        path: join2(projectRoot, privatePath)
       }
     };
   }
@@ -14811,7 +14838,7 @@ class AssetHasher {
     if (dir === ".") {
       return `${name}.${hash2}${ext}`;
     }
-    return join2(dir, `${name}.${hash2}${ext}`);
+    return join3(dir, `${name}.${hash2}${ext}`);
   }
   static collectFiles(directory, relativeTo) {
     const files = [];
@@ -14821,7 +14848,7 @@ class AssetHasher {
     }
     const entries = readdirSync2(directory, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join2(directory, entry.name);
+      const fullPath = join3(directory, entry.name);
       if (entry.isDirectory()) {
         files.push(...AssetHasher.collectFiles(fullPath, baseDir));
       } else if (entry.isFile()) {
@@ -14851,7 +14878,7 @@ class AssetHasher {
       assets.push(asset);
       hashMap[relativePath] = hashedRelativePath;
       if (outputDir) {
-        const destPath = join2(outputDir, hashedRelativePath);
+        const destPath = join3(outputDir, hashedRelativePath);
         const destDir = dirname(destPath);
         if (!existsSync2(destDir)) {
           const { mkdirSync: mkdirSync3 } = __require2("node:fs");
@@ -14869,7 +14896,7 @@ class AssetHasher {
       hashMap
     };
     if (outputDir) {
-      const manifestPath = join2(outputDir, "asset-manifest.json");
+      const manifestPath = join3(outputDir, "asset-manifest.json");
       writeFileSync(manifestPath, JSON.stringify(manifest, null, 2));
     }
     return manifest;
@@ -14964,7 +14991,7 @@ class AssetHasher {
         cc = cacheControl.hashed || "public, max-age=31536000, immutable";
       }
       return {
-        localPath: join2(sourceDir, asset.originalPath),
+        localPath: join3(sourceDir, asset.originalPath),
         s3Key: keyPrefix ? `${keyPrefix}/${asset.hashedPath}` : asset.hashedPath,
         contentType: asset.contentType,
         cacheControl: cc,
@@ -21869,7 +21896,7 @@ function createDashboardSite(options) {
     }
   };
 }
-var DASHBOARD_STATE_DIR = ".ts-cloud";
+var DASHBOARD_STATE_DIR = DEFAULT_STATE_DIR;
 var DASHBOARD_ENTRY = "./node_modules/@stacksjs/ts-cloud/dist/bin/cli.js";
 function apexOf(domain) {
   const parts = domain.split(".").filter(Boolean);
@@ -22065,7 +22092,7 @@ function fromEnvironment() {
 }
 function fromSharedCredentials(options) {
   const profile = options?.profile || process.env.AWS_PROFILE || "default";
-  const credentialsPath = options?.credentialsFile || join3(homedir(), ".aws", "credentials");
+  const credentialsPath = options?.credentialsFile || join4(homedir(), ".aws", "credentials");
   if (!existsSync3(credentialsPath)) {
     return null;
   }
@@ -22302,7 +22329,7 @@ function resolveRegion(profile) {
   if (envRegion) {
     return envRegion;
   }
-  const configPath = join3(homedir(), ".aws", "config");
+  const configPath = join4(homedir(), ".aws", "config");
   if (existsSync3(configPath)) {
     try {
       const content = readFileSync2(configPath, "utf-8");
@@ -23675,13 +23702,14 @@ class FileCache {
   constructor(cacheDir, options = {}) {
     this.cacheDir = cacheDir;
     this.ttl = options.ttl || 86400000;
-    if (!existsSync4(cacheDir)) {
-      mkdirSync(cacheDir, { recursive: true });
-    }
+  }
+  ensureCacheDir() {
+    if (!existsSync4(this.cacheDir))
+      mkdirSync(this.cacheDir, { recursive: true });
   }
   getCachePath(key) {
     const hash2 = createHash2("sha256").update(key).digest("hex");
-    return join4(this.cacheDir, `${hash2}.json`);
+    return join5(this.cacheDir, `${hash2}.json`);
   }
   get(key) {
     const cachePath = this.getCachePath(key);
@@ -23702,6 +23730,7 @@ class FileCache {
     }
   }
   set(key, value, hash2) {
+    this.ensureCacheDir();
     const cachePath = this.getCachePath(key);
     const entry = {
       value,
@@ -23714,16 +23743,20 @@ class FileCache {
     return this.get(key) !== undefined;
   }
   clear() {
+    if (!existsSync4(this.cacheDir))
+      return;
     const files = readdirSync3(this.cacheDir);
     for (const file of files) {
-      unlinkSync(join4(this.cacheDir, file));
+      unlinkSync(join5(this.cacheDir, file));
     }
   }
   prune() {
+    if (!existsSync4(this.cacheDir))
+      return;
     const files = readdirSync3(this.cacheDir);
     const now = Date.now();
     for (const file of files) {
-      const filePath = join4(this.cacheDir, file);
+      const filePath = join5(this.cacheDir, file);
       try {
         const data = readFileSync3(filePath, "utf-8");
         const entry = JSON.parse(data);
@@ -23739,7 +23772,7 @@ class FileCache {
 
 class TemplateCache {
   cache;
-  constructor(cacheDir = ".ts-cloud/cache/templates") {
+  constructor(cacheDir = statePath("cache", "templates")) {
     this.cache = new FileCache(cacheDir, {
       ttl: 86400000
     });
@@ -23770,7 +23803,12 @@ class TemplateCache {
     this.cache.prune();
   }
 }
-var templateCache = new TemplateCache;
+var sharedTemplateCache = null;
+function templateCache() {
+  if (!sharedTemplateCache)
+    sharedTemplateCache = new TemplateCache;
+  return sharedTemplateCache;
+}
 async function hashFile(filePath, options = {}) {
   const algorithm = options.algorithm || "sha256";
   const chunkSize = options.chunkSize || 65536;
@@ -23789,13 +23827,13 @@ function hashBuffer(buffer, algorithm = "sha256") {
   return createHash3(algorithm).update(buffer).digest("hex");
 }
 async function hashDirectory(dirPath, options = {}) {
-  const ignorePatterns = options.ignorePatterns || ["node_modules", ".git", "dist", "build", ".ts-cloud"];
+  const ignorePatterns = options.ignorePatterns || ["node_modules", ".git", "dist", "build", stateDir()];
   const files = [];
   async function walk(dir) {
     const entries = readdirSync4(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join5(dir, entry.name);
-      const relativePath = relative(dirPath, fullPath);
+      const fullPath = join6(dir, entry.name);
+      const relativePath = relative2(dirPath, fullPath);
       if (ignorePatterns.some((pattern) => relativePath.includes(pattern))) {
         continue;
       }
@@ -44333,7 +44371,7 @@ export const cli = __handlers.cli
 `;
 }
 function adapterSourcePath() {
-  return join6(dirname2(fileURLToPath(import.meta.url)), "runtime", "adapter.ts");
+  return join7(dirname2(fileURLToPath(import.meta.url)), "runtime", "adapter.ts");
 }
 function runBuildHooks(hooks, cwd, onStep) {
   for (const hook of hooks ?? []) {
@@ -44355,11 +44393,11 @@ async function packageServerlessApp(opts) {
   const entry = app.entry;
   if (!entry)
     throw new Error("serverless app: `entry` is required to package a Node/Bun application");
-  const entryPath = isAbsolute(entry) ? entry : join6(projectRoot, entry);
-  const stage = mkdtempSync(join6(tmpdir(), "tscloud-pkg-"));
+  const entryPath = isAbsolute2(entry) ? entry : join7(projectRoot, entry);
+  const stage = mkdtempSync(join7(tmpdir(), "tscloud-pkg-"));
   try {
-    cpSync(adapterSourcePath(), join6(stage, "adapter.ts"));
-    const bootstrapPath = join6(stage, "bootstrap.ts");
+    cpSync(adapterSourcePath(), join7(stage, "adapter.ts"));
+    const bootstrapPath = join7(stage, "bootstrap.ts");
     writeFileSync3(bootstrapPath, generateBootstrap({ entryImport: entryPath, adapterImport: "./adapter" }));
     opts.onStep?.("bundling application");
     const result = await Bun.build({
@@ -45345,27 +45383,27 @@ function assetsDir() {
   return dirname3(fileURLToPath2(import.meta.url));
 }
 function sharedRuntimeLoop() {
-  return readFileSync4(join7(assetsDir(), "runtime.mjs"), "utf-8");
+  return readFileSync4(join8(assetsDir(), "runtime.mjs"), "utf-8");
 }
 function bootstrap(kind) {
-  return readFileSync4(join7(assetsDir(), `${kind}-bootstrap`), "utf-8");
+  return readFileSync4(join8(assetsDir(), `${kind}-bootstrap`), "utf-8");
 }
 function buildNodeRuntimeLayerZip(options) {
   const architecture = options.architecture ?? "x86_64";
   const nodeArch = architecture === "arm64" ? "arm64" : "x64";
   const version = options.version.replace(/^v/, "");
   const step = options.onStep ?? (() => {});
-  const stage = mkdtempSync2(join7(tmpdir2(), "tscloud-node-layer-"));
+  const stage = mkdtempSync2(join8(tmpdir2(), "tscloud-node-layer-"));
   try {
     const exact = version.includes(".") ? version : resolveLatestNode(version);
     const dir = `node-v${exact}-linux-${nodeArch}`;
     const url = `https://nodejs.org/dist/v${exact}/${dir}.tar.xz`;
     step(`downloading Node ${exact} (${architecture})`);
-    const tar = join7(stage, "node.tar.xz");
+    const tar = join8(stage, "node.tar.xz");
     fetchToFile(url, tar);
     step("extracting node binary");
     execFileSync("tar", ["-xf", tar, "-C", stage, `${dir}/bin/node`], { stdio: "inherit" });
-    const nodeBin = readFileSync4(join7(stage, dir, "bin", "node"));
+    const nodeBin = readFileSync4(join8(stage, dir, "bin", "node"));
     step("packaging layer");
     const entries = [
       { name: "bootstrap", data: bootstrap("node"), mode: 493 },
@@ -45382,15 +45420,15 @@ function buildBunRuntimeLayerZip(options) {
   const bunArch = architecture === "arm64" ? "bun-linux-aarch64" : "bun-linux-x64";
   const version = options.version === "latest" ? "" : options.version.replace(/^v/, "");
   const step = options.onStep ?? (() => {});
-  const stage = mkdtempSync2(join7(tmpdir2(), "tscloud-bun-layer-"));
+  const stage = mkdtempSync2(join8(tmpdir2(), "tscloud-bun-layer-"));
   try {
     const url = version ? `https://github.com/oven-sh/bun/releases/download/bun-v${version}/${bunArch}.zip` : `https://github.com/oven-sh/bun/releases/latest/download/${bunArch}.zip`;
     step(`downloading Bun ${version || "latest"} (${architecture})`);
-    const zipPath = join7(stage, "bun.zip");
+    const zipPath = join8(stage, "bun.zip");
     fetchToFile(url, zipPath);
     step("extracting bun binary");
     execFileSync("unzip", ["-o", "-q", zipPath, "-d", stage], { stdio: "inherit" });
-    const bunBin = readFileSync4(join7(stage, bunArch, "bun"));
+    const bunBin = readFileSync4(join8(stage, bunArch, "bun"));
     step("packaging layer");
     const entries = [
       { name: "bootstrap", data: bootstrap("bun"), mode: 493 },
@@ -45572,11 +45610,11 @@ clear_env = no
 `;
 }
 function assetsDir2() {
-  return join8(dirname4(fileURLToPath3(import.meta.url)), "runtime-assets");
+  return join9(dirname4(fileURLToPath3(import.meta.url)), "runtime-assets");
 }
 function phpRuntimeLayerAssets() {
   const dir = assetsDir2();
-  const read = (f) => readFileSync5(join8(dir, f), "utf-8");
+  const read = (f) => readFileSync5(join9(dir, f), "utf-8");
   return [
     { path: "bootstrap", contents: read("bootstrap"), mode: 493 },
     { path: "tscloud/runtime.php", contents: read("runtime.php"), mode: 420 },
@@ -45613,7 +45651,7 @@ var LARAVEL_SERVERLESS_BUILD_STEPS = [
 ];
 function* walk(dir) {
   for (const entry of readdirSync5(dir)) {
-    const full = join9(dir, entry);
+    const full = join10(dir, entry);
     if (statSync3(full).isDirectory())
       yield* walk(full);
     else
@@ -45624,26 +45662,26 @@ function buildPhpRuntimeLayerZip(options = {}) {
   const architecture = options.architecture ?? "x86_64";
   const platform = options.platform ?? (architecture === "arm64" ? "linux/arm64" : "linux/amd64");
   const step = options.onStep ?? (() => {});
-  const stage = mkdtempSync3(join9(tmpdir3(), "tscloud-php-layer-"));
+  const stage = mkdtempSync3(join10(tmpdir3(), "tscloud-php-layer-"));
   const imageTag = "tscloud-php-layer:build";
   try {
-    writeFileSync4(join9(stage, "Dockerfile"), generatePhpLayerDockerfile(options));
+    writeFileSync4(join10(stage, "Dockerfile"), generatePhpLayerDockerfile(options));
     step("Building PHP runtime image (docker)");
     execFileSync2("docker", ["build", "--platform", platform, "-t", imageTag, stage], { stdio: "inherit" });
     step("Extracting /opt/php from image");
     const cid = execFileSync2("docker", ["create", "--platform", platform, imageTag], { encoding: "utf-8" }).trim();
-    const optDir = join9(stage, "opt");
+    const optDir = join10(stage, "opt");
     mkdirSync2(optDir, { recursive: true });
     try {
-      execFileSync2("docker", ["cp", `${cid}:/opt/php`, join9(optDir, "php")], { stdio: "inherit" });
+      execFileSync2("docker", ["cp", `${cid}:/opt/php`, join10(optDir, "php")], { stdio: "inherit" });
     } finally {
       execFileSync2("docker", ["rm", cid], { stdio: "ignore" });
     }
-    if (!existsSync5(join9(optDir, "php", "bin", "php")))
+    if (!existsSync5(join10(optDir, "php", "bin", "php")))
       throw new Error("layer build produced no /opt/php/bin/php");
     const entries = [];
     for (const file of walk(optDir)) {
-      const rel = relative2(optDir, file).replace(/\\/g, "/");
+      const rel = relative3(optDir, file).replace(/\\/g, "/");
       const mode = statSync3(file).mode & 73 ? 493 : 420;
       entries.push({ name: rel, data: readFileSync6(file), mode });
     }
@@ -45680,8 +45718,8 @@ function isExcluded(rel, excludes) {
 }
 function* walk2(dir, root, excludes) {
   for (const entry of readdirSync6(dir)) {
-    const full = join10(dir, entry);
-    const rel = relative3(root, full).replace(/\\/g, "/");
+    const full = join11(dir, entry);
+    const rel = relative4(root, full).replace(/\\/g, "/");
     if (isExcluded(rel, excludes))
       continue;
     if (statSync4(full).isDirectory())
@@ -45702,10 +45740,10 @@ function runPhpBuildHooks(opts) {
 }
 function collectPhpAppEntries(projectRoot, exclude = []) {
   const root = resolve2(projectRoot);
-  const excludes = [...PHP_DEFAULT_EXCLUDES, ...exclude];
+  const excludes = [...PHP_DEFAULT_EXCLUDES, stateDir(), ...exclude];
   const entries = [];
   for (const file of walk2(root, root, excludes)) {
-    const rel = relative3(root, file).replace(/\\/g, "/");
+    const rel = relative4(root, file).replace(/\\/g, "/");
     const executable = (statSync4(file).mode & 73) !== 0;
     entries.push({ name: rel, data: readFileSync7(file), mode: executable ? 493 : 420 });
   }
@@ -46170,4 +46208,4 @@ class ResourceManagementManager {
 }
 var resourceManagementManager = new ResourceManagementManager;
 
-export { detectServiceRegion, signRequest, signRequestAsync, createPresignedUrl, createPresignedUrlAsync, makeAWSRequest, makeAWSRequestOnce, makeAWSRequestAsync, parseXMLResponse, parseJSONResponse, clearSigningKeyCache, getSigningKeyCacheSize, isNodeCryptoAvailable, isWebCryptoAvailable, QueuePresets, RealtimePresets, detectDeploymentTargets, resolveDeploymentMode, deploymentCoexistenceError, resolveAppDatabase, resolveCloudProvider, TemplateBuilder, Pseudo, generateResourceName, generateLogicalId, getTimestamp, sanitizeName, resolveProjectStackName, resolveSiteStackName, resolveSiteResourceName, resolveSiteBucketName, resolveStorageBucketName, resolveDeployBucketName, resolveServerlessAppStackName, resolveServerlessArtifactBucketName, resolveServerlessAssetBucketName, DependencyGraph, analyzeStackDiff, formatDiff, Storage, Registry, CDN, DNS, Security, Compute, Network, FileSystem, Email, exports_incoming_call, Phone, Queue, JobLoader, StacksIntegration, exports_send, SMS, Sftp, AI, Database, Cache, Permissions, ApiGateway, Messaging, Workflow, Monitoring, Auth, Deployment, AssetHasher, Secrets, ParameterStore, Search, Redirects, Communication, Fn2, Arn, AWS_PSEUDO_PARAMETERS, CloudFormationBuilder, buildCloudFormationTemplate, createStaticSitePreset, createNodeJsServerPreset, createNodeJsServerlessPreset, createServerlessNodePreset, createExistingStaticFullStackPreset, createFullStackAppPreset, createApiBackendPreset, createWordPressPreset, createJamstackPreset, createMicroservicesPreset, createRealtimeAppPreset, createDataPipelinePreset, createMLApiPreset, createTraditionalWebAppPreset, createLaravelPreset, createServerlessLaravelPreset, createDashboardSite, DASHBOARD_STATE_DIR, DASHBOARD_ENTRY, DASHBOARD_PORT_BASE, DASHBOARD_PORT_SPAN, deriveManagementDashboardPort, resolveDashboardDomain, resolveDashboardDomains, hasManagementDashboardSite, MANAGEMENT_DASHBOARD_SITE_PREFIX, managementDashboardSiteName, isManagementDashboardSiteName, resolveManagementDashboardSites, resolveManagementDashboardSite, extendPreset, composePresets, createPreset, mergeInfrastructure, withMonitoring, withSecurity, withDatabase, withCache, withCDN, withQueue, fromEnvironment, fromSharedCredentials, fromEC2Metadata, fromECSMetadata, fromWebIdentity, getCredentials, createCredentialProvider, resolveCredentials, resolveRegion, getAccountId, S3Error, createS3Client, CloudError, ConfigurationError, CredentialError, DeploymentError, ValidationError, AWSAPIError, ErrorCodes, getErrorDetails, createError, DebugLogger, validateConfiguration, detectMisconfigurations, validateCredentials, checkIAMPermissions, getRequiredPermissions, suggestIAMPolicy, DEFAULT_SERVICE_LIMITS, checkServiceQuotas, getQuotaUsageSummary, suggestQuotaIncrease, FileCache, TemplateCache, templateCache, hashFile, hashString, hashBuffer, hashDirectory, hashManifest, quickHash, findChangedFiles, HashCache, parallel, batch, parallelMap, parallelWithRetry, sequence, withTimeout, RateLimiter, chunk, processInChunks, diffTemplates, getDiffSummary, requiresReplacement, categorizeChanges, getDeploymentStrategy, getDiffStats, cloud_config_schema_default, validateAgainstSchema, defaultLocalConfig, getLocalConfig, isLocalDevelopment, getLocalEndpoint, getLocalCredentials, getLocalEnvVars, MockCloudFormation, MockS3, MockDynamoDB, createMockAWS, PreviewEnvironmentManager, previewManager, generatePreviewWorkflow, generateCleanupWorkflow, generateCostReportWorkflow, PreviewNotificationService, previewNotifications, formatTable, formatTree, formatProgressBar, formatBytes, formatDuration, formatList, formatKeyValue, ProgressBar, MultiStepProgress, Spinner, TaskList, suggestCommand, formatSuggestion, isLikelyTypo, getContextualHelp, searchCommands, autocomplete, suggestFlags, formatFlagSuggestions, getCommandUsage, validateCommand, REPL, REPLContext, REPLCommandBuilder, CommandHistory, formatHistory, formatHistoryStats, MultiRegionManager, multiRegionManager, CrossRegionReferenceManager, GlobalResourceManager, RegionPairManager, StackDependencyManager, crossRegionReferenceManager, globalResourceManager, regionPairManager, stackDependencyManager, AWS_REGIONS, getRegion, getAllRegions, getRegionsByLocation, getRegionsByCompliance, getRegionsByPricingTier, isValidRegion, getClosestRegion, suggestRegions, suggestRegionPairs, formatRegion, formatRegionList, getRegionStats, MultiAccountManager, OrganizationManager, multiAccountManager, organizationManager, RECOMMENDED_ACCOUNT_STRUCTURES, RECOMMENDED_SCPS, COMMON_CROSS_ACCOUNT_ROLES, getRecommendedStructure, generateCrossAccountRoleCF, validateAccountStructure, formatAccountStructure, generateDeploymentWorkflow, generateMultiEnvWorkflow, generatePRPreviewWorkflow, generateScheduledWorkflow, generateMatrixWorkflow, generateDeploymentPipeline, generateMultiEnvPipeline, generatePreviewPipeline, generateScheduledPipeline, generateManualPipeline, generateDeploymentConfig, generateMultiEnvConfig, generateScheduledConfig, generateApprovalConfig, generateParallelConfig, BackupManager, backupManager, DisasterRecoveryManager, drManager, AWSConfigManager, awsConfigManager, CloudTrailManager, cloudTrailManager, GuardDutyManager, guardDutyManager, SecurityHubManager, securityHubManager, BlueGreenManager, blueGreenManager, CanaryManager, canaryManager, ABTestManager, abTestManager, ProgressiveDeploymentManager, progressiveDeploymentManager, XRayManager, xrayManager, MetricsManager, metricsManager, LogsManager, logsManager, SyntheticsManager, syntheticsManager, MigrationManager, migrationManager, ReplicaManager, replicaManager, PerformanceManager, performanceManager, DatabaseUserManager, databaseUserManager, SecretsRotationManager, secretsRotationManager, SecretsManager, secretsManager, CertificateManager, certificateManager, SecurityScanningManager, securityScanningManager, ImageScanningManager, imageScanningManager, BuildOptimizationManager, buildOptimizationManager, ContainerRegistryManager, containerRegistryManager, ServiceMeshManager, serviceMeshManager, LambdaLayersManager, lambdaLayersManager, LambdaVersionsManager, lambdaVersionsManager, LambdaConcurrencyManager, lambdaConcurrencyManager, LambdaDestinationsManager, lambdaDestinationsManager, LambdaVPCManager, lambdaVPCManager, LambdaDLQManager, lambdaDLQManager, Route53RoutingManager, route53RoutingManager, DNSSECManager, dnssecManager, Route53ResolverManager, route53ResolverManager, BounceComplaintHandler, bounceComplaintHandler, EmailAnalyticsManager, emailAnalyticsManager, SenderReputationManager, senderReputationManager, EmailTemplateManager, emailTemplateManager, exports_advanced, exports_inbound, exports_advanced2, exports_advanced3, FIFOQueueManager, fifoQueueManager, DLQMonitoringManager, dlqMonitoringManager, BatchProcessingManager, batchProcessingManager, QueueManagementManager, queueManagementManager, createZip, generateBootstrap, runBuildHooks, sha256, artifactKey, packageServerlessApp, MANAGED_NODE_VERSIONS, resolveServerlessRuntime, resolveQueues, resolveQueueNames, composeServerlessAppTemplate, PHP_LAYER_EXTENSIONS, phpLayerPackages, phpLayerBuildStage, generatePhpLayerDockerfile, generateAppImageDockerfile, sharedRuntimeLoop, buildNodeRuntimeLayerZip, buildBunRuntimeLayerZip, resolveApp, eventToRequest, responseToResult, createHttpHandler, createQueueHandler, createCliHandler, createHandlers, generatePhpFpmConfig, phpRuntimeLayerAssets, laravelServerlessEnvDefaults, LARAVEL_SERVERLESS_BUILD_STEPS, buildPhpRuntimeLayerZip, PHP_DEFAULT_EXCLUDES, runPhpBuildHooks, collectPhpAppEntries, packagePhpApp, StaticSiteManager, staticSiteManager, StorageAdvancedManager, storageAdvancedManager, HealthCheckManager, healthCheckManager, NetworkSecurityManager, networkSecurityManager, ResourceManagementManager, resourceManagementManager };
+export { detectServiceRegion, signRequest, signRequestAsync, createPresignedUrl, createPresignedUrlAsync, makeAWSRequest, makeAWSRequestOnce, makeAWSRequestAsync, parseXMLResponse, parseJSONResponse, clearSigningKeyCache, getSigningKeyCacheSize, isNodeCryptoAvailable, isWebCryptoAvailable, QueuePresets, RealtimePresets, DEFAULT_STATE_DIR, STATE_DIR_ENV_VAR, setStateDir, stateDir, statePath, resolveStatePath, isStatePath, detectDeploymentTargets, resolveDeploymentMode, deploymentCoexistenceError, resolveAppDatabase, resolveCloudProvider, TemplateBuilder, Pseudo, generateResourceName, generateLogicalId, getTimestamp, sanitizeName, resolveProjectStackName, resolveSiteStackName, resolveSiteResourceName, resolveSiteBucketName, resolveStorageBucketName, resolveDeployBucketName, resolveServerlessAppStackName, resolveServerlessArtifactBucketName, resolveServerlessAssetBucketName, DependencyGraph, analyzeStackDiff, formatDiff, Storage, Registry, CDN, DNS, Security, Compute, Network, FileSystem, Email, exports_incoming_call, Phone, Queue, JobLoader, StacksIntegration, exports_send, SMS, Sftp, AI, Database, Cache, Permissions, ApiGateway, Messaging, Workflow, Monitoring, Auth, Deployment, AssetHasher, Secrets, ParameterStore, Search, Redirects, Communication, Fn2, Arn, AWS_PSEUDO_PARAMETERS, CloudFormationBuilder, buildCloudFormationTemplate, createStaticSitePreset, createNodeJsServerPreset, createNodeJsServerlessPreset, createServerlessNodePreset, createExistingStaticFullStackPreset, createFullStackAppPreset, createApiBackendPreset, createWordPressPreset, createJamstackPreset, createMicroservicesPreset, createRealtimeAppPreset, createDataPipelinePreset, createMLApiPreset, createTraditionalWebAppPreset, createLaravelPreset, createServerlessLaravelPreset, createDashboardSite, DASHBOARD_STATE_DIR, DASHBOARD_ENTRY, DASHBOARD_PORT_BASE, DASHBOARD_PORT_SPAN, deriveManagementDashboardPort, resolveDashboardDomain, resolveDashboardDomains, hasManagementDashboardSite, MANAGEMENT_DASHBOARD_SITE_PREFIX, managementDashboardSiteName, isManagementDashboardSiteName, resolveManagementDashboardSites, resolveManagementDashboardSite, extendPreset, composePresets, createPreset, mergeInfrastructure, withMonitoring, withSecurity, withDatabase, withCache, withCDN, withQueue, fromEnvironment, fromSharedCredentials, fromEC2Metadata, fromECSMetadata, fromWebIdentity, getCredentials, createCredentialProvider, resolveCredentials, resolveRegion, getAccountId, S3Error, createS3Client, CloudError, ConfigurationError, CredentialError, DeploymentError, ValidationError, AWSAPIError, ErrorCodes, getErrorDetails, createError, DebugLogger, validateConfiguration, detectMisconfigurations, validateCredentials, checkIAMPermissions, getRequiredPermissions, suggestIAMPolicy, DEFAULT_SERVICE_LIMITS, checkServiceQuotas, getQuotaUsageSummary, suggestQuotaIncrease, FileCache, TemplateCache, templateCache, hashFile, hashString, hashBuffer, hashDirectory, hashManifest, quickHash, findChangedFiles, HashCache, parallel, batch, parallelMap, parallelWithRetry, sequence, withTimeout, RateLimiter, chunk, processInChunks, diffTemplates, getDiffSummary, requiresReplacement, categorizeChanges, getDeploymentStrategy, getDiffStats, cloud_config_schema_default, validateAgainstSchema, defaultLocalConfig, getLocalConfig, isLocalDevelopment, getLocalEndpoint, getLocalCredentials, getLocalEnvVars, MockCloudFormation, MockS3, MockDynamoDB, createMockAWS, PreviewEnvironmentManager, previewManager, generatePreviewWorkflow, generateCleanupWorkflow, generateCostReportWorkflow, PreviewNotificationService, previewNotifications, formatTable, formatTree, formatProgressBar, formatBytes, formatDuration, formatList, formatKeyValue, ProgressBar, MultiStepProgress, Spinner, TaskList, suggestCommand, formatSuggestion, isLikelyTypo, getContextualHelp, searchCommands, autocomplete, suggestFlags, formatFlagSuggestions, getCommandUsage, validateCommand, REPL, REPLContext, REPLCommandBuilder, CommandHistory, formatHistory, formatHistoryStats, MultiRegionManager, multiRegionManager, CrossRegionReferenceManager, GlobalResourceManager, RegionPairManager, StackDependencyManager, crossRegionReferenceManager, globalResourceManager, regionPairManager, stackDependencyManager, AWS_REGIONS, getRegion, getAllRegions, getRegionsByLocation, getRegionsByCompliance, getRegionsByPricingTier, isValidRegion, getClosestRegion, suggestRegions, suggestRegionPairs, formatRegion, formatRegionList, getRegionStats, MultiAccountManager, OrganizationManager, multiAccountManager, organizationManager, RECOMMENDED_ACCOUNT_STRUCTURES, RECOMMENDED_SCPS, COMMON_CROSS_ACCOUNT_ROLES, getRecommendedStructure, generateCrossAccountRoleCF, validateAccountStructure, formatAccountStructure, generateDeploymentWorkflow, generateMultiEnvWorkflow, generatePRPreviewWorkflow, generateScheduledWorkflow, generateMatrixWorkflow, generateDeploymentPipeline, generateMultiEnvPipeline, generatePreviewPipeline, generateScheduledPipeline, generateManualPipeline, generateDeploymentConfig, generateMultiEnvConfig, generateScheduledConfig, generateApprovalConfig, generateParallelConfig, BackupManager, backupManager, DisasterRecoveryManager, drManager, AWSConfigManager, awsConfigManager, CloudTrailManager, cloudTrailManager, GuardDutyManager, guardDutyManager, SecurityHubManager, securityHubManager, BlueGreenManager, blueGreenManager, CanaryManager, canaryManager, ABTestManager, abTestManager, ProgressiveDeploymentManager, progressiveDeploymentManager, XRayManager, xrayManager, MetricsManager, metricsManager, LogsManager, logsManager, SyntheticsManager, syntheticsManager, MigrationManager, migrationManager, ReplicaManager, replicaManager, PerformanceManager, performanceManager, DatabaseUserManager, databaseUserManager, SecretsRotationManager, secretsRotationManager, SecretsManager, secretsManager, CertificateManager, certificateManager, SecurityScanningManager, securityScanningManager, ImageScanningManager, imageScanningManager, BuildOptimizationManager, buildOptimizationManager, ContainerRegistryManager, containerRegistryManager, ServiceMeshManager, serviceMeshManager, LambdaLayersManager, lambdaLayersManager, LambdaVersionsManager, lambdaVersionsManager, LambdaConcurrencyManager, lambdaConcurrencyManager, LambdaDestinationsManager, lambdaDestinationsManager, LambdaVPCManager, lambdaVPCManager, LambdaDLQManager, lambdaDLQManager, Route53RoutingManager, route53RoutingManager, DNSSECManager, dnssecManager, Route53ResolverManager, route53ResolverManager, BounceComplaintHandler, bounceComplaintHandler, EmailAnalyticsManager, emailAnalyticsManager, SenderReputationManager, senderReputationManager, EmailTemplateManager, emailTemplateManager, exports_advanced, exports_inbound, exports_advanced2, exports_advanced3, FIFOQueueManager, fifoQueueManager, DLQMonitoringManager, dlqMonitoringManager, BatchProcessingManager, batchProcessingManager, QueueManagementManager, queueManagementManager, createZip, generateBootstrap, runBuildHooks, sha256, artifactKey, packageServerlessApp, MANAGED_NODE_VERSIONS, resolveServerlessRuntime, resolveQueues, resolveQueueNames, composeServerlessAppTemplate, PHP_LAYER_EXTENSIONS, phpLayerPackages, phpLayerBuildStage, generatePhpLayerDockerfile, generateAppImageDockerfile, sharedRuntimeLoop, buildNodeRuntimeLayerZip, buildBunRuntimeLayerZip, resolveApp, eventToRequest, responseToResult, createHttpHandler, createQueueHandler, createCliHandler, createHandlers, generatePhpFpmConfig, phpRuntimeLayerAssets, laravelServerlessEnvDefaults, LARAVEL_SERVERLESS_BUILD_STEPS, buildPhpRuntimeLayerZip, PHP_DEFAULT_EXCLUDES, runPhpBuildHooks, collectPhpAppEntries, packagePhpApp, StaticSiteManager, staticSiteManager, StorageAdvancedManager, storageAdvancedManager, HealthCheckManager, healthCheckManager, NetworkSecurityManager, networkSecurityManager, ResourceManagementManager, resourceManagementManager };

package/dist/{chunk-0z43x8re.js → chunk-z3bakpnh.js}

@@ -5,9 +5,9 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "./chunk-vvkd46k1.js";
+} from "./chunk-gcsv7g83.js";
 import"./chunk-01d86gt1.js";
-import"./chunk-fv1bj3yt.js";
+import"./chunk-001z7khv.js";
 import"./chunk-4cjrg98a.js";
 import"./chunk-32e7ya18.js";
 import"./chunk-wj3s95p9.js";

package/dist/{chunk-exbcsab2.js → chunk-zvk0f89t.js}

@@ -8,7 +8,7 @@ import {
   phpRuntimeLayerAssets,
   runPhpBuildHooks,
   sha256
-} from "./chunk-vdk53yyq.js";
+} from "./chunk-tq46tnxv.js";
 
 // src/deploy/serverless-image.ts
 import { execFileSync } from "node:child_process";

package/dist/control-plane/index.d.ts

@@ -1,6 +1,6 @@
 export { CONTROL_PLANE_SCHEMA_VERSION, controlPlaneMigrations } from './migrations';
 export type { ControlPlaneMigration } from './migrations';
-export { CONTROL_PLANE_DATABASE_FILE, ControlPlaneStore, MAX_CONTROL_PLANE_ERROR_BYTES, MAX_CONTROL_PLANE_JSON_BYTES, sanitizeControlPlaneValue, } from './store';
+export { controlPlaneDatabaseFile, ControlPlaneStore, MAX_CONTROL_PLANE_ERROR_BYTES, MAX_CONTROL_PLANE_JSON_BYTES, sanitizeControlPlaneValue, } from './store';
 export * from './types';
 export { searchControlPlane } from './search';
 export type { ControlPlaneSearchOptions, ControlPlaneSearchResult, ControlPlaneSearchResultType } from './search';

package/dist/control-plane/store.d.ts

@@ -1,6 +1,7 @@
 import type { AppendEventInput, AuthorizationGrant, AuthorizationScope, AuthorizationTarget, CompactResult, ControlPlaneActor, ControlPlaneEnvironment, ControlPlaneEvent, ControlPlaneHealth, ControlPlaneOperation, ControlPlaneOrganization, ControlPlaneProject, ControlPlaneResource, ControlPlaneSnapshot, ControlPlaneStoreOptions, ControlPlaneTag, CreateActorInput, CreateEnvironmentInput, CreateGrantInput, CreateInvitationInput, CreateMembershipInput, CreateOperationInput, CreateOrganizationInput, CreateProjectInput, CreateResourceInput, EventListOptions, ImportSnapshotOptions, JsonValue, NavigationPreference, OperationListOptions, OrganizationInvitation, OrganizationMembership, ReconcileResult, SavedFilter, TransitionOperationInput, UpdateProjectInput, UpdateResourceInput } from './types';
 import { Database } from 'bun:sqlite';
-export declare const CONTROL_PLANE_DATABASE_FILE: string;
+/** Project-relative location of the control-plane database. */
+export declare function controlPlaneDatabaseFile(): string;
 export declare const MAX_CONTROL_PLANE_JSON_BYTES: number;
 export declare const MAX_CONTROL_PLANE_ERROR_BYTES: number;
 export declare function sanitizeControlPlaneValue(value: unknown, maxBytes?: number): JsonValue;

package/dist/deploy/dashboard-config-module.d.ts

@@ -18,7 +18,7 @@ import type { CloudConfig } from '@ts-cloud/core';
 /**
  * Strip everything the dashboard does not need to read.
  *
- * Two rules:
+ * Three rules:
  *
  * 1. **No credentials.** The Hetzner API token is the big one: it controls the
  *    whole cloud account (create and destroy any server), and unlike a site's
@@ -30,6 +30,12 @@ import type { CloudConfig } from '@ts-cloud/core';
  *    vars a site defines, never their values — so ship the keys and blank the
  *    values. The running site has its own `.env` on the box regardless; there
  *    is no reason for a second copy to sit in the dashboard's directory.
+ *
+ * 3. **No local paths.** `stateDir` says where the operator's machine keeps
+ *    ts-cloud state; it means nothing on the box, whose dashboard state lives
+ *    in the release's `DASHBOARD_STATE_DIR` (the path the deploy preserves
+ *    across releases via `sharedPaths`). Shipping it would move the box's users
+ *    and session key outside that shared path and wipe them every deploy.
  */
 export declare function redactForDashboard(config: CloudConfig): Record<string, any>;
 /**