@stacksjs/ts-cloud 0.7.58 → 0.7.60

package/dist/deploy/dashboard-session.d.ts

@@ -1,5 +1,6 @@
 export declare const SESSION_COOKIE = "ts_cloud_session";
-export declare const SECRET_FILE: string;
+/** Project-relative location of the session signing secret. */
+export declare function secretFile(): string;
 /** Eight hours: long enough to work through a deploy, short enough to expire. */
 export declare const SESSION_TTL_MS: number;
 export interface SessionPayload {

package/dist/deploy/dashboard-users.d.ts

@@ -1,15 +1,16 @@
 /**
  * The dashboard's user store: a JSON file of {@link DashboardUser} records at
- * `.ts-cloud/dashboard-users.json` (0600), holding scrypt hashes and site
- * grants. Small on purpose — a box hosts a handful of collaborators, not a
- * directory service.
+ * `dashboard-users.json` (0600) inside the state directory, holding scrypt
+ * hashes and site grants. Small on purpose — a box hosts a handful of
+ * collaborators, not a directory service.
  *
  * On first use the store bootstraps a single admin so a freshly provisioned
  * dashboard is never reachable without credentials. The generated password is
  * returned to the caller to print once; only its hash is ever written.
  */
 import type { DashboardUser, SiteRole } from './dashboard-auth';
-export declare const USERS_FILE: string;
+/** Project-relative location of the user store, for messages and docs. */
+export declare function usersFile(): string;
 /** Usernames are used in URLs and shell-free contexts; keep them boring. */
 export declare function isValidUsername(value: string): boolean;
 export declare function parseUsersFile(text: string): DashboardUser[];

package/dist/deploy/index.d.ts

@@ -16,4 +16,4 @@ export { buildFunctionEnv, type CodeSource, deployServerlessApp, type DeployServ
 export { buildAndPushServerlessImage, type BuildImageOptions, type BuiltImage } from './serverless-image';
 export { type DashboardData, resolveDashboardData } from './dashboard-data';
 export { dashboardActions, resolveDashboardAction, sanitizeCloudConfig, startLocalDashboardServer, type DashboardAction, type LocalDashboardServer, type LocalDashboardServerOptions, } from './local-dashboard-server';
-export { buildManagementDashboardArtifact, DASHBOARD_CREDENTIALS_FILE, ensureManagementDashboard, type EnsureDashboardLogger, MANAGEMENT_DASHBOARD_SITE, resolveDashboardAuth, type ResolvedDashboardAuth, resolveUiSource, } from './management-dashboard';
+export { buildManagementDashboardArtifact, dashboardCredentialsFile, ensureManagementDashboard, type EnsureDashboardLogger, MANAGEMENT_DASHBOARD_SITE, resolveDashboardAuth, type ResolvedDashboardAuth, resolveUiSource, } from './management-dashboard';

package/dist/deploy/index.js

@@ -32,7 +32,7 @@ import {
   synchronizeDashboardUsers,
   trackDashboardOperation,
   verifyStaticApiOrigin
-} from "../chunk-fw3q88wk.js";
+} from "../chunk-cz17nhnx.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -43,19 +43,19 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "../chunk-vvkd46k1.js";
+} from "../chunk-gcsv7g83.js";
 import {
   buildAndPushServerlessImage
-} from "../chunk-exbcsab2.js";
+} from "../chunk-zvk0f89t.js";
 import"../chunk-ybcz6sxc.js";
 import"../chunk-01d86gt1.js";
 import"../chunk-50jpda9q.js";
 import"../chunk-he9a874b.js";
-import"../chunk-fv1bj3yt.js";
+import"../chunk-001z7khv.js";
 import {
-  DASHBOARD_CREDENTIALS_FILE,
   MANAGEMENT_DASHBOARD_SITE,
   buildManagementDashboardArtifact,
+  dashboardCredentialsFile,
   ensureManagementDashboard,
   isPhpSite,
   resolveDashboardAuth,
@@ -65,8 +65,8 @@ import {
   shipsARelease,
   siteInstallBase,
   validateDeploymentConfig
-} from "../chunk-9m6b4m74.js";
-import"../chunk-vdk53yyq.js";
+} from "../chunk-sd9h1baj.js";
+import"../chunk-tq46tnxv.js";
 import"../chunk-703nkybg.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-hpv68b4a.js";
@@ -119,6 +119,7 @@ export {
   deployExistingStaticFullStack,
   deleteStaticSite,
   dashboardPageRoutes,
+  dashboardCredentialsFile,
   dashboardActions,
   createStaticApiOriginDependencies,
   createExistingStaticFullStackDependencies,
@@ -128,6 +129,5 @@ export {
   buildFunctionEnv,
   buildAndPushServerlessImage,
   buildAndPushContainerImage,
-  MANAGEMENT_DASHBOARD_SITE,
-  DASHBOARD_CREDENTIALS_FILE
+  MANAGEMENT_DASHBOARD_SITE
 };

package/dist/deploy/management-dashboard.d.ts

@@ -40,7 +40,7 @@ import type { CloudConfig } from '@ts-cloud/core';
  */
 export declare const MANAGEMENT_DASHBOARD_SITE = "dashboard";
 /** Where an auto-generated dashboard password is persisted (per project checkout). */
-export declare const DASHBOARD_CREDENTIALS_FILE: string;
+export declare function dashboardCredentialsFile(): string;
 export interface ResolvedDashboardAuth {
     /** The htpasswd password, or undefined when serving publicly (opt-out). */
     password?: string;
@@ -52,7 +52,8 @@ export interface ResolvedDashboardAuth {
  *  1. `TS_CLOUD_UI_PASSWORD` when set → use it verbatim.
  *  2. `TS_CLOUD_UI_PUBLIC` truthy → serve with NO auth (deliberate opt-out).
  *  3. Otherwise → reuse a previously-generated password from
- *     `.ts-cloud/dashboard-credentials.json`, or generate + persist a new one.
+ *     `dashboard-credentials.json` in the state directory, or generate and
+ *     persist a new one.
  *
  * Persisting the generated password keeps htpasswd stable across deploys (so a
  * saved credential keeps working) and lets the operator retrieve it locally.
@@ -63,7 +64,7 @@ export interface EnsureDashboardLogger {
     warn: (msg: string) => void;
 }
 /** Where the live dashboard's release is staged, inside the project checkout. */
-export declare const LIVE_STAGE_DIR: string;
+export declare function liveStageDir(): string;
 /**
  * The ts-cloud version the box should install. Reads this package's own version
  * so a box runs a dashboard matching the CLI that deployed it, rather than

package/dist/dns/index.js

@@ -11,7 +11,7 @@ import {
   createRoute53Validator,
   detectDnsProvider,
   dnsProviders
-} from "../chunk-fv1bj3yt.js";
+} from "../chunk-001z7khv.js";
 import"../chunk-32e7ya18.js";
 import"../chunk-zqtpg06c.js";
 import"../chunk-v0bahtg2.js";

package/dist/dns/porkbun.d.ts

@@ -23,6 +23,33 @@ export declare class PorkbunProvider implements DnsProvider {
      * e.g., "api.example.com" -> "example.com"
      */
     private getRootDomain;
+    /**
+     * Address record types that cannot coexist with an `ALIAS`/`CNAME` on the
+     * same name. Porkbun ships every new domain with a parking `ALIAS` on the
+     * apex and a wildcard `CNAME`, both pointing at `pixie.porkbun.com`.
+     */
+    private static readonly ADDRESS_TYPES;
+    /**
+     * Remove any `ALIAS`/`CNAME` occupying `record.name` before writing an
+     * address record there.
+     *
+     * Porkbun accepts `POST /dns/create` for an apex `A` while its parking
+     * `ALIAS` still owns that name, answers `SUCCESS`, and then silently
+     * discards the record — nothing is created and nothing is reported. A deploy
+     * therefore logged a successful DNS reconciliation while the domain stayed
+     * parked, which is indistinguishable from slow propagation until someone
+     * digs the zone by hand.
+     *
+     * Only conflicting ALIAS/CNAME entries on the SAME name are touched; MX, TXT,
+     * NS and records on other names are left alone.
+     */
+    private clearConflictingAliases;
+    /**
+     * Confirm an address record actually exists after a create that reported
+     * success — see {@link clearConflictingAliases} for why a `SUCCESS` from
+     * Porkbun is not sufficient evidence that anything was written.
+     */
+    private addressRecordExists;
     createRecord(domain: string, record: DnsRecord): Promise<CreateRecordResult>;
     upsertRecord(domain: string, record: DnsRecord): Promise<CreateRecordResult>;
     deleteRecord(domain: string, record: DnsRecord): Promise<DeleteRecordResult>;

package/dist/dns/types.d.ts

@@ -2,7 +2,14 @@
  * DNS Provider Types
  * Common interfaces for DNS provider abstraction
  */
-export type DnsRecordType = 'A' | 'AAAA' | 'CNAME' | 'TXT' | 'MX' | 'NS' | 'SRV' | 'CAA';
+/**
+ * `ALIAS` is a provider-specific CNAME-like record permitted at a zone apex
+ * (Porkbun, DNSimple, Route53's ALIAS). It is included because ts-cloud has to
+ * *see* one to manage a zone correctly, not because it writes them: Porkbun
+ * puts a parking `ALIAS` on the apex of every new domain, and an apex `A`
+ * written while that exists is accepted and then silently discarded.
+ */
+export type DnsRecordType = 'A' | 'AAAA' | 'ALIAS' | 'CNAME' | 'TXT' | 'MX' | 'NS' | 'SRV' | 'CAA';
 export interface DnsRecord {
     name: string;
     type: DnsRecordType;

package/dist/drivers/index.js

@@ -52,8 +52,8 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "../chunk-9m6b4m74.js";
-import"../chunk-vdk53yyq.js";
+} from "../chunk-sd9h1baj.js";
+import"../chunk-tq46tnxv.js";
 import"../chunk-703nkybg.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-wj3s95p9.js";

package/dist/index.d.ts

@@ -29,7 +29,7 @@ export type { ObjectStorageConfig, ObjectStorageCredentials, ObjectStorageProvid
 export { keyMatchesFilters, migrateObjectStorage, remapKey } from './object-storage/migrate';
 export type { MigrateEndpoint, MigrateError, MigrateOptions, MigratePlanItem, MigrateProgress, MigrateResult, MigrateVerification, } from './object-storage/migrate';
 export * from './ssl';
-export { deployStaticSite, deployStaticSiteFull, uploadStaticFiles, invalidateCache, deleteStaticSite, generateStaticSiteTemplate, deployStaticSiteWithExternalDns, deployStaticSiteWithExternalDnsFull, generateExternalDnsStaticSiteTemplate, deploySite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, buildAndPushServerlessImage, buildFunctionEnv, deployServerlessApp, infraEnvFromOutputs, redeployServerlessApp, rollbackServerlessApp, runRemoteCommand, setMaintenance, buildManagementDashboardArtifact, DASHBOARD_CREDENTIALS_FILE, ensureManagementDashboard, MANAGEMENT_DASHBOARD_SITE, resolveDashboardAuth, resolveUiSource, } from './deploy';
+export { deployStaticSite, deployStaticSiteFull, uploadStaticFiles, invalidateCache, deleteStaticSite, generateStaticSiteTemplate, deployStaticSiteWithExternalDns, deployStaticSiteWithExternalDnsFull, generateExternalDnsStaticSiteTemplate, deploySite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, buildAndPushServerlessImage, buildFunctionEnv, deployServerlessApp, infraEnvFromOutputs, redeployServerlessApp, rollbackServerlessApp, runRemoteCommand, setMaintenance, buildManagementDashboardArtifact, dashboardCredentialsFile, ensureManagementDashboard, MANAGEMENT_DASHBOARD_SITE, resolveDashboardAuth, resolveUiSource, } from './deploy';
 export { collectServerDnsDomains, removeStaleServerAddressRecords } from './deploy/server-dns';
 export type { EnsureDashboardLogger, ResolvedDashboardAuth, StaticSiteConfig, DeployResult, UploadOptions, ExternalDnsStaticSiteConfig, ExternalDnsDeployResult, DeploySiteConfig, DeploySiteResult, StaticSiteDnsProvider, SiteDeployKind, DeploymentValidationResult, BuildImageOptions, BuiltImage, CodeSource, DeployServerlessOptions, ResolvedContext, } from './deploy';
 export { createCloudDriver, CloudDriverFactory, cloudDrivers, AwsDriver, HetznerDriver, HetznerClient, resolveHetznerApiToken, normalizeSshPublicKey, ensureFirewall, ensureServer, ensureSshKey, serverPublicIpv4, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, buildSshArgs, generateUbuntuAppCloudInit, wrapCloudInitUserData, buildHostCleanupScript, buildSiteDeployScript, buildStaticSiteDeployScript, resolveExecStart, deployAllComputeSites, deploySiteRelease, } from './drivers';

package/dist/index.js

@@ -5,7 +5,6 @@ import {
   API_VERSION,
   AUTHORIZATION_CAPABILITIES,
   AUTH_ACTION_TOKEN_TTL_MS,
-  AUTH_ENCRYPTION_KEY_FILE,
   AUTH_MFA_CHALLENGE_TTL_MS,
   AUTH_OIDC_TRANSACTION_TTL_MS,
   AUTH_SESSION_ABSOLUTE_TTL_MS,
@@ -34,7 +33,6 @@ import {
   BunDockerRuntime,
   BunDockerVolumeRuntime,
   BunFilesystemArchiveRuntime,
-  CONTROL_PLANE_DATABASE_FILE,
   CONTROL_PLANE_SCHEMA_VERSION,
   CloudBlockVolumeDriver,
   ComposeApplicationService,
@@ -126,6 +124,7 @@ import {
   attachProvenanceToRelease,
   attachSbomToRelease,
   attachVulnerabilitySummary,
+  authEncryptionKeyFile,
   authorizeOrganization,
   authorizeRuntimePath,
   backupCredentialStatus,
@@ -147,6 +146,7 @@ import {
   compressBackup,
   config,
   connectionGuidance,
+  controlPlaneDatabaseFile,
   controlPlaneMigrations,
   createApiV1Handler,
   createAsgBuildDriver,
@@ -285,7 +285,7 @@ import {
   volumeCapabilities,
   webhookEndpoint,
   zeroCapacity
-} from "./chunk-fw3q88wk.js";
+} from "./chunk-cz17nhnx.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -296,10 +296,10 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "./chunk-vvkd46k1.js";
+} from "./chunk-gcsv7g83.js";
 import {
   buildAndPushServerlessImage
-} from "./chunk-exbcsab2.js";
+} from "./chunk-zvk0f89t.js";
 import {
   ApplicationAutoScalingClient,
   BedrockClient,
@@ -361,11 +361,10 @@ import {
   createRoute53Validator,
   detectDnsProvider,
   dnsProviders
-} from "./chunk-fv1bj3yt.js";
+} from "./chunk-001z7khv.js";
 import {
   AwsDriver,
   CloudDriverFactory,
-  DASHBOARD_CREDENTIALS_FILE,
   HetznerClient,
   HetznerDriver,
   MANAGEMENT_DASHBOARD_SITE,
@@ -377,6 +376,7 @@ import {
   buildUbuntuBootstrapScript,
   cloudDrivers,
   createCloudDriver,
+  dashboardCredentialsFile,
   deployAllComputeSites,
   deploySiteRelease,
   ensureFirewall,
@@ -398,7 +398,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-9m6b4m74.js";
+} from "./chunk-sd9h1baj.js";
 import {
   ABTestManager,
   AI,
@@ -435,6 +435,7 @@ import {
   DASHBOARD_PORT_SPAN,
   DASHBOARD_STATE_DIR,
   DEFAULT_SERVICE_LIMITS,
+  DEFAULT_STATE_DIR,
   DLQMonitoringManager,
   DNS,
   DNSSECManager,
@@ -512,6 +513,7 @@ import {
   Route53RoutingManager,
   S3Error,
   SMS,
+  STATE_DIR_ENV_VAR,
   Search,
   Secrets,
   SecretsManager,
@@ -699,6 +701,7 @@ import {
   isLocalDevelopment,
   isManagementDashboardSiteName,
   isNodeCryptoAvailable,
+  isStatePath,
   isValidRegion,
   isWebCryptoAvailable,
   lambdaConcurrencyManager,
@@ -761,6 +764,7 @@ import {
   resolveSiteBucketName,
   resolveSiteResourceName,
   resolveSiteStackName,
+  resolveStatePath,
   resolveStorageBucketName,
   resourceManagementManager,
   responseToResult,
@@ -777,11 +781,14 @@ import {
   senderReputationManager,
   sequence,
   serviceMeshManager,
+  setStateDir,
   sha256,
   sharedRuntimeLoop,
   signRequest,
   signRequestAsync,
   stackDependencyManager,
+  stateDir,
+  statePath,
   staticSiteManager,
   storageAdvancedManager,
   suggestCommand,
@@ -805,7 +812,7 @@ import {
   withSecurity,
   withTimeout,
   xrayManager
-} from "./chunk-vdk53yyq.js";
+} from "./chunk-tq46tnxv.js";
 import {
   EC2Client,
   SSMClient
@@ -5156,6 +5163,8 @@ export {
   suggestCommand,
   storageAdvancedManager,
   staticSiteManager,
+  statePath,
+  stateDir,
   startLocalDashboardServer,
   stackDependencyManager,
   sshExecOrThrow,
@@ -5167,6 +5176,7 @@ export {
   sharedRuntimeLoop,
   sha256,
   setupDns01Challenge,
+  setStateDir,
   setMaintenance,
   serviceMeshManager,
   serverPublicIpv4,
@@ -5203,6 +5213,7 @@ export {
   resourceManagementManager,
   resolveUiSource,
   resolveStorageBucketName,
+  resolveStatePath,
   resolveSiteStackName,
   resolveSiteResourceName,
   resolveSiteKind,
@@ -5324,6 +5335,7 @@ export {
   jobProviderCapability,
   isWebCryptoAvailable,
   isValidRegion,
+  isStatePath,
   isQuietHours,
   isNodeCryptoAvailable,
   isManagementDashboardSiteName,
@@ -5473,6 +5485,7 @@ export {
   decodeBase32,
   databaseUserManager,
   dataServiceCapabilities,
+  dashboardCredentialsFile,
   dashboardActions,
   crossRegionReferenceManager,
   createZip,
@@ -5530,6 +5543,7 @@ export {
   createApiV1Handler,
   createApiBackendPreset,
   controlPlaneMigrations,
+  controlPlaneDatabaseFile,
   containerRegistryManager,
   connectionGuidance,
   config,
@@ -5585,6 +5599,7 @@ export {
   autocomplete,
   authorizeRuntimePath,
   authorizeOrganization,
+  authEncryptionKeyFile,
   attachVulnerabilitySummary,
   attachSbomToRelease,
   attachProvenanceToRelease,
@@ -5651,6 +5666,7 @@ export {
   Search,
   SchedulerClient,
   STSClient,
+  STATE_DIR_ENV_VAR,
   SSMClient,
   SQSClient,
   SNSClient,
@@ -5817,12 +5833,12 @@ export {
   DIAGNOSTIC_PRESETS,
   DEPLOYMENT_QUEUE_KINDS,
   DEFAULT_TELEMETRY_POLICY,
+  DEFAULT_STATE_DIR,
   DEFAULT_SERVICE_LIMITS,
   DASHBOARD_STATE_DIR,
   DASHBOARD_PORT_SPAN,
   DASHBOARD_PORT_BASE,
   DASHBOARD_ENTRY,
-  DASHBOARD_CREDENTIALS_FILE,
   CrossRegionReferenceManager,
   CredentialError,
   ControlPlaneStore,
@@ -5852,7 +5868,6 @@ export {
   CanaryManager,
   Cache,
   CONTROL_PLANE_SCHEMA_VERSION,
-  CONTROL_PLANE_DATABASE_FILE,
   COMMON_CROSS_ACCOUNT_ROLES,
   CDN,
   BunFilesystemArchiveRuntime,
@@ -5904,7 +5919,6 @@ export {
   AUTH_SESSION_ABSOLUTE_TTL_MS,
   AUTH_OIDC_TRANSACTION_TTL_MS,
   AUTH_MFA_CHALLENGE_TTL_MS,
-  AUTH_ENCRYPTION_KEY_FILE,
   AUTH_ACTION_TOKEN_TTL_MS,
   AUTHORIZATION_CAPABILITIES,
   API_VERSION,