@stacksjs/ts-cloud 0.7.59 → 0.7.60

package/dist/{chunk-vdk53yyq.js → chunk-tq46tnxv.js}

@@ -4,43 +4,44 @@ import {
 
 // ../core/dist/index.js
 import { createRequire } from "node:module";
+import { isAbsolute, join, relative } from "node:path";
 import { existsSync, readdirSync } from "node:fs";
-import { join } from "node:path";
+import { join as join2 } from "node:path";
 import { createHash } from "node:crypto";
 import { copyFileSync, existsSync as existsSync2, readdirSync as readdirSync2, readFileSync, statSync, writeFileSync } from "node:fs";
-import { basename, dirname, extname, join as join2 } from "node:path";
+import { basename, dirname, extname, join as join3 } from "node:path";
 import { existsSync as existsSync3, readFileSync as readFileSync2 } from "node:fs";
 import { homedir } from "node:os";
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 import { createHash as createHash2 } from "node:crypto";
 import { existsSync as existsSync4, mkdirSync, readdirSync as readdirSync3, readFileSync as readFileSync3, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 import { createHash as createHash3 } from "node:crypto";
 import { createReadStream, readdirSync as readdirSync4, statSync as statSync2 } from "node:fs";
-import { join as join5, relative } from "node:path";
+import { join as join6, relative as relative2 } from "node:path";
 import { deflateRawSync } from "node:zlib";
 import { execSync } from "node:child_process";
 import { createHash as createHash4 } from "node:crypto";
 import { cpSync, mkdtempSync, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname as dirname2, isAbsolute, join as join6, resolve } from "node:path";
+import { dirname as dirname2, isAbsolute as isAbsolute2, join as join7, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { execFileSync } from "node:child_process";
 import { mkdtempSync as mkdtempSync2, readFileSync as readFileSync4, rmSync as rmSync2 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname3, join as join7 } from "node:path";
+import { dirname as dirname3, join as join8 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { readFileSync as readFileSync5 } from "node:fs";
-import { dirname as dirname4, join as join8 } from "node:path";
+import { dirname as dirname4, join as join9 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { existsSync as existsSync5, mkdirSync as mkdirSync2, mkdtempSync as mkdtempSync3, readdirSync as readdirSync5, readFileSync as readFileSync6, rmSync as rmSync3, statSync as statSync3, writeFileSync as writeFileSync4 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join9, relative as relative2 } from "node:path";
+import { join as join10, relative as relative3 } from "node:path";
 import { execSync as execSync2 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
 import { readdirSync as readdirSync6, readFileSync as readFileSync7, statSync as statSync4 } from "node:fs";
-import { join as join10, relative as relative3, resolve as resolve2 } from "node:path";
+import { join as join11, relative as relative4, resolve as resolve2 } from "node:path";
 var __defProp = Object.defineProperty;
 var __returnValue = (v) => v;
 function __exportSetter(name, newValue) {
@@ -1058,6 +1059,32 @@ var RealtimePresets = {
     }
   }
 };
+var DEFAULT_STATE_DIR = ".ts-cloud";
+var STATE_DIR_ENV_VAR = "TS_CLOUD_STATE_DIR";
+var configuredStateDir = null;
+function setStateDir(dir) {
+  const trimmed = dir?.trim();
+  configuredStateDir = trimmed || null;
+}
+function stateDir() {
+  const fromEnv = process.env[STATE_DIR_ENV_VAR]?.trim();
+  return fromEnv || configuredStateDir || DEFAULT_STATE_DIR;
+}
+function statePath(...segments) {
+  return join(stateDir(), ...segments);
+}
+function resolveStatePath(cwd, ...segments) {
+  const dir = stateDir();
+  return isAbsolute(dir) ? join(dir, ...segments) : join(cwd, dir, ...segments);
+}
+function isStatePath(path, root = process.cwd()) {
+  const inside = (parent, child) => {
+    const rel = relative(parent, child);
+    return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+  };
+  const absolute = isAbsolute(path) ? path : join(root, path);
+  return inside(resolveStatePath(root), absolute);
+}
 function detectDeploymentTargets(config) {
   const server = config.infrastructure?.compute != null;
   const serverless = Object.values(config.environments ?? {}).some((env) => env?.app != null);
@@ -2169,11 +2196,11 @@ class Storage {
   static docsExist(options = {}) {
     const { projectRoot = process.cwd(), docsPaths = ["docs", "documentation", "doc"] } = options;
     for (const docsPath of docsPaths) {
-      const fullPath = join(projectRoot, docsPath);
+      const fullPath = join2(projectRoot, docsPath);
       if (existsSync(fullPath)) {
         const distPaths = ["dist", "build", ".bunpress/dist", "_site", "out", "public"];
         for (const distPath of distPaths) {
-          const fullDistPath = join(fullPath, distPath);
+          const fullDistPath = join2(fullPath, distPath);
           if (existsSync(fullDistPath)) {
             try {
               const files = readdirSync(fullDistPath);
@@ -2288,16 +2315,16 @@ class Storage {
     const privatePath = paths.private || "private";
     return {
       web: {
-        exists: existsSync(join(projectRoot, webPath)),
-        path: join(projectRoot, webPath)
+        exists: existsSync(join2(projectRoot, webPath)),
+        path: join2(projectRoot, webPath)
       },
       docs: {
-        exists: existsSync(join(projectRoot, docsPath)),
-        path: join(projectRoot, docsPath)
+        exists: existsSync(join2(projectRoot, docsPath)),
+        path: join2(projectRoot, docsPath)
       },
       private: {
-        exists: existsSync(join(projectRoot, privatePath)),
-        path: join(projectRoot, privatePath)
+        exists: existsSync(join2(projectRoot, privatePath)),
+        path: join2(projectRoot, privatePath)
       }
     };
   }
@@ -14811,7 +14838,7 @@ class AssetHasher {
     if (dir === ".") {
       return `${name}.${hash2}${ext}`;
     }
-    return join2(dir, `${name}.${hash2}${ext}`);
+    return join3(dir, `${name}.${hash2}${ext}`);
   }
   static collectFiles(directory, relativeTo) {
     const files = [];
@@ -14821,7 +14848,7 @@ class AssetHasher {
     }
     const entries = readdirSync2(directory, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join2(directory, entry.name);
+      const fullPath = join3(directory, entry.name);
       if (entry.isDirectory()) {
         files.push(...AssetHasher.collectFiles(fullPath, baseDir));
       } else if (entry.isFile()) {
@@ -14851,7 +14878,7 @@ class AssetHasher {
       assets.push(asset);
       hashMap[relativePath] = hashedRelativePath;
       if (outputDir) {
-        const destPath = join2(outputDir, hashedRelativePath);
+        const destPath = join3(outputDir, hashedRelativePath);
         const destDir = dirname(destPath);
         if (!existsSync2(destDir)) {
           const { mkdirSync: mkdirSync3 } = __require2("node:fs");
@@ -14869,7 +14896,7 @@ class AssetHasher {
       hashMap
     };
     if (outputDir) {
-      const manifestPath = join2(outputDir, "asset-manifest.json");
+      const manifestPath = join3(outputDir, "asset-manifest.json");
       writeFileSync(manifestPath, JSON.stringify(manifest, null, 2));
     }
     return manifest;
@@ -14964,7 +14991,7 @@ class AssetHasher {
         cc = cacheControl.hashed || "public, max-age=31536000, immutable";
       }
       return {
-        localPath: join2(sourceDir, asset.originalPath),
+        localPath: join3(sourceDir, asset.originalPath),
         s3Key: keyPrefix ? `${keyPrefix}/${asset.hashedPath}` : asset.hashedPath,
         contentType: asset.contentType,
         cacheControl: cc,
@@ -21869,7 +21896,7 @@ function createDashboardSite(options) {
     }
   };
 }
-var DASHBOARD_STATE_DIR = ".ts-cloud";
+var DASHBOARD_STATE_DIR = DEFAULT_STATE_DIR;
 var DASHBOARD_ENTRY = "./node_modules/@stacksjs/ts-cloud/dist/bin/cli.js";
 function apexOf(domain) {
   const parts = domain.split(".").filter(Boolean);
@@ -22065,7 +22092,7 @@ function fromEnvironment() {
 }
 function fromSharedCredentials(options) {
   const profile = options?.profile || process.env.AWS_PROFILE || "default";
-  const credentialsPath = options?.credentialsFile || join3(homedir(), ".aws", "credentials");
+  const credentialsPath = options?.credentialsFile || join4(homedir(), ".aws", "credentials");
   if (!existsSync3(credentialsPath)) {
     return null;
   }
@@ -22302,7 +22329,7 @@ function resolveRegion(profile) {
   if (envRegion) {
     return envRegion;
   }
-  const configPath = join3(homedir(), ".aws", "config");
+  const configPath = join4(homedir(), ".aws", "config");
   if (existsSync3(configPath)) {
     try {
       const content = readFileSync2(configPath, "utf-8");
@@ -23675,13 +23702,14 @@ class FileCache {
   constructor(cacheDir, options = {}) {
     this.cacheDir = cacheDir;
     this.ttl = options.ttl || 86400000;
-    if (!existsSync4(cacheDir)) {
-      mkdirSync(cacheDir, { recursive: true });
-    }
+  }
+  ensureCacheDir() {
+    if (!existsSync4(this.cacheDir))
+      mkdirSync(this.cacheDir, { recursive: true });
   }
   getCachePath(key) {
     const hash2 = createHash2("sha256").update(key).digest("hex");
-    return join4(this.cacheDir, `${hash2}.json`);
+    return join5(this.cacheDir, `${hash2}.json`);
   }
   get(key) {
     const cachePath = this.getCachePath(key);
@@ -23702,6 +23730,7 @@ class FileCache {
     }
   }
   set(key, value, hash2) {
+    this.ensureCacheDir();
     const cachePath = this.getCachePath(key);
     const entry = {
       value,
@@ -23714,16 +23743,20 @@ class FileCache {
     return this.get(key) !== undefined;
   }
   clear() {
+    if (!existsSync4(this.cacheDir))
+      return;
     const files = readdirSync3(this.cacheDir);
     for (const file of files) {
-      unlinkSync(join4(this.cacheDir, file));
+      unlinkSync(join5(this.cacheDir, file));
     }
   }
   prune() {
+    if (!existsSync4(this.cacheDir))
+      return;
     const files = readdirSync3(this.cacheDir);
     const now = Date.now();
     for (const file of files) {
-      const filePath = join4(this.cacheDir, file);
+      const filePath = join5(this.cacheDir, file);
       try {
         const data = readFileSync3(filePath, "utf-8");
         const entry = JSON.parse(data);
@@ -23739,7 +23772,7 @@ class FileCache {
 
 class TemplateCache {
   cache;
-  constructor(cacheDir = ".ts-cloud/cache/templates") {
+  constructor(cacheDir = statePath("cache", "templates")) {
     this.cache = new FileCache(cacheDir, {
       ttl: 86400000
     });
@@ -23770,7 +23803,12 @@ class TemplateCache {
     this.cache.prune();
   }
 }
-var templateCache = new TemplateCache;
+var sharedTemplateCache = null;
+function templateCache() {
+  if (!sharedTemplateCache)
+    sharedTemplateCache = new TemplateCache;
+  return sharedTemplateCache;
+}
 async function hashFile(filePath, options = {}) {
   const algorithm = options.algorithm || "sha256";
   const chunkSize = options.chunkSize || 65536;
@@ -23789,13 +23827,13 @@ function hashBuffer(buffer, algorithm = "sha256") {
   return createHash3(algorithm).update(buffer).digest("hex");
 }
 async function hashDirectory(dirPath, options = {}) {
-  const ignorePatterns = options.ignorePatterns || ["node_modules", ".git", "dist", "build", ".ts-cloud"];
+  const ignorePatterns = options.ignorePatterns || ["node_modules", ".git", "dist", "build", stateDir()];
   const files = [];
   async function walk(dir) {
     const entries = readdirSync4(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join5(dir, entry.name);
-      const relativePath = relative(dirPath, fullPath);
+      const fullPath = join6(dir, entry.name);
+      const relativePath = relative2(dirPath, fullPath);
       if (ignorePatterns.some((pattern) => relativePath.includes(pattern))) {
         continue;
       }
@@ -44333,7 +44371,7 @@ export const cli = __handlers.cli
 `;
 }
 function adapterSourcePath() {
-  return join6(dirname2(fileURLToPath(import.meta.url)), "runtime", "adapter.ts");
+  return join7(dirname2(fileURLToPath(import.meta.url)), "runtime", "adapter.ts");
 }
 function runBuildHooks(hooks, cwd, onStep) {
   for (const hook of hooks ?? []) {
@@ -44355,11 +44393,11 @@ async function packageServerlessApp(opts) {
   const entry = app.entry;
   if (!entry)
     throw new Error("serverless app: `entry` is required to package a Node/Bun application");
-  const entryPath = isAbsolute(entry) ? entry : join6(projectRoot, entry);
-  const stage = mkdtempSync(join6(tmpdir(), "tscloud-pkg-"));
+  const entryPath = isAbsolute2(entry) ? entry : join7(projectRoot, entry);
+  const stage = mkdtempSync(join7(tmpdir(), "tscloud-pkg-"));
   try {
-    cpSync(adapterSourcePath(), join6(stage, "adapter.ts"));
-    const bootstrapPath = join6(stage, "bootstrap.ts");
+    cpSync(adapterSourcePath(), join7(stage, "adapter.ts"));
+    const bootstrapPath = join7(stage, "bootstrap.ts");
     writeFileSync3(bootstrapPath, generateBootstrap({ entryImport: entryPath, adapterImport: "./adapter" }));
     opts.onStep?.("bundling application");
     const result = await Bun.build({
@@ -45345,27 +45383,27 @@ function assetsDir() {
   return dirname3(fileURLToPath2(import.meta.url));
 }
 function sharedRuntimeLoop() {
-  return readFileSync4(join7(assetsDir(), "runtime.mjs"), "utf-8");
+  return readFileSync4(join8(assetsDir(), "runtime.mjs"), "utf-8");
 }
 function bootstrap(kind) {
-  return readFileSync4(join7(assetsDir(), `${kind}-bootstrap`), "utf-8");
+  return readFileSync4(join8(assetsDir(), `${kind}-bootstrap`), "utf-8");
 }
 function buildNodeRuntimeLayerZip(options) {
   const architecture = options.architecture ?? "x86_64";
   const nodeArch = architecture === "arm64" ? "arm64" : "x64";
   const version = options.version.replace(/^v/, "");
   const step = options.onStep ?? (() => {});
-  const stage = mkdtempSync2(join7(tmpdir2(), "tscloud-node-layer-"));
+  const stage = mkdtempSync2(join8(tmpdir2(), "tscloud-node-layer-"));
   try {
     const exact = version.includes(".") ? version : resolveLatestNode(version);
     const dir = `node-v${exact}-linux-${nodeArch}`;
     const url = `https://nodejs.org/dist/v${exact}/${dir}.tar.xz`;
     step(`downloading Node ${exact} (${architecture})`);
-    const tar = join7(stage, "node.tar.xz");
+    const tar = join8(stage, "node.tar.xz");
     fetchToFile(url, tar);
     step("extracting node binary");
     execFileSync("tar", ["-xf", tar, "-C", stage, `${dir}/bin/node`], { stdio: "inherit" });
-    const nodeBin = readFileSync4(join7(stage, dir, "bin", "node"));
+    const nodeBin = readFileSync4(join8(stage, dir, "bin", "node"));
     step("packaging layer");
     const entries = [
       { name: "bootstrap", data: bootstrap("node"), mode: 493 },
@@ -45382,15 +45420,15 @@ function buildBunRuntimeLayerZip(options) {
   const bunArch = architecture === "arm64" ? "bun-linux-aarch64" : "bun-linux-x64";
   const version = options.version === "latest" ? "" : options.version.replace(/^v/, "");
   const step = options.onStep ?? (() => {});
-  const stage = mkdtempSync2(join7(tmpdir2(), "tscloud-bun-layer-"));
+  const stage = mkdtempSync2(join8(tmpdir2(), "tscloud-bun-layer-"));
   try {
     const url = version ? `https://github.com/oven-sh/bun/releases/download/bun-v${version}/${bunArch}.zip` : `https://github.com/oven-sh/bun/releases/latest/download/${bunArch}.zip`;
     step(`downloading Bun ${version || "latest"} (${architecture})`);
-    const zipPath = join7(stage, "bun.zip");
+    const zipPath = join8(stage, "bun.zip");
     fetchToFile(url, zipPath);
     step("extracting bun binary");
     execFileSync("unzip", ["-o", "-q", zipPath, "-d", stage], { stdio: "inherit" });
-    const bunBin = readFileSync4(join7(stage, bunArch, "bun"));
+    const bunBin = readFileSync4(join8(stage, bunArch, "bun"));
     step("packaging layer");
     const entries = [
       { name: "bootstrap", data: bootstrap("bun"), mode: 493 },
@@ -45572,11 +45610,11 @@ clear_env = no
 `;
 }
 function assetsDir2() {
-  return join8(dirname4(fileURLToPath3(import.meta.url)), "runtime-assets");
+  return join9(dirname4(fileURLToPath3(import.meta.url)), "runtime-assets");
 }
 function phpRuntimeLayerAssets() {
   const dir = assetsDir2();
-  const read = (f) => readFileSync5(join8(dir, f), "utf-8");
+  const read = (f) => readFileSync5(join9(dir, f), "utf-8");
   return [
     { path: "bootstrap", contents: read("bootstrap"), mode: 493 },
     { path: "tscloud/runtime.php", contents: read("runtime.php"), mode: 420 },
@@ -45613,7 +45651,7 @@ var LARAVEL_SERVERLESS_BUILD_STEPS = [
 ];
 function* walk(dir) {
   for (const entry of readdirSync5(dir)) {
-    const full = join9(dir, entry);
+    const full = join10(dir, entry);
     if (statSync3(full).isDirectory())
       yield* walk(full);
     else
@@ -45624,26 +45662,26 @@ function buildPhpRuntimeLayerZip(options = {}) {
   const architecture = options.architecture ?? "x86_64";
   const platform = options.platform ?? (architecture === "arm64" ? "linux/arm64" : "linux/amd64");
   const step = options.onStep ?? (() => {});
-  const stage = mkdtempSync3(join9(tmpdir3(), "tscloud-php-layer-"));
+  const stage = mkdtempSync3(join10(tmpdir3(), "tscloud-php-layer-"));
   const imageTag = "tscloud-php-layer:build";
   try {
-    writeFileSync4(join9(stage, "Dockerfile"), generatePhpLayerDockerfile(options));
+    writeFileSync4(join10(stage, "Dockerfile"), generatePhpLayerDockerfile(options));
     step("Building PHP runtime image (docker)");
     execFileSync2("docker", ["build", "--platform", platform, "-t", imageTag, stage], { stdio: "inherit" });
     step("Extracting /opt/php from image");
     const cid = execFileSync2("docker", ["create", "--platform", platform, imageTag], { encoding: "utf-8" }).trim();
-    const optDir = join9(stage, "opt");
+    const optDir = join10(stage, "opt");
     mkdirSync2(optDir, { recursive: true });
     try {
-      execFileSync2("docker", ["cp", `${cid}:/opt/php`, join9(optDir, "php")], { stdio: "inherit" });
+      execFileSync2("docker", ["cp", `${cid}:/opt/php`, join10(optDir, "php")], { stdio: "inherit" });
     } finally {
       execFileSync2("docker", ["rm", cid], { stdio: "ignore" });
     }
-    if (!existsSync5(join9(optDir, "php", "bin", "php")))
+    if (!existsSync5(join10(optDir, "php", "bin", "php")))
       throw new Error("layer build produced no /opt/php/bin/php");
     const entries = [];
     for (const file of walk(optDir)) {
-      const rel = relative2(optDir, file).replace(/\\/g, "/");
+      const rel = relative3(optDir, file).replace(/\\/g, "/");
       const mode = statSync3(file).mode & 73 ? 493 : 420;
       entries.push({ name: rel, data: readFileSync6(file), mode });
     }
@@ -45680,8 +45718,8 @@ function isExcluded(rel, excludes) {
 }
 function* walk2(dir, root, excludes) {
   for (const entry of readdirSync6(dir)) {
-    const full = join10(dir, entry);
-    const rel = relative3(root, full).replace(/\\/g, "/");
+    const full = join11(dir, entry);
+    const rel = relative4(root, full).replace(/\\/g, "/");
     if (isExcluded(rel, excludes))
       continue;
     if (statSync4(full).isDirectory())
@@ -45702,10 +45740,10 @@ function runPhpBuildHooks(opts) {
 }
 function collectPhpAppEntries(projectRoot, exclude = []) {
   const root = resolve2(projectRoot);
-  const excludes = [...PHP_DEFAULT_EXCLUDES, ...exclude];
+  const excludes = [...PHP_DEFAULT_EXCLUDES, stateDir(), ...exclude];
   const entries = [];
   for (const file of walk2(root, root, excludes)) {
-    const rel = relative3(root, file).replace(/\\/g, "/");
+    const rel = relative4(root, file).replace(/\\/g, "/");
     const executable = (statSync4(file).mode & 73) !== 0;
     entries.push({ name: rel, data: readFileSync7(file), mode: executable ? 493 : 420 });
   }
@@ -46170,4 +46208,4 @@ class ResourceManagementManager {
 }
 var resourceManagementManager = new ResourceManagementManager;
 
-export { detectServiceRegion, signRequest, signRequestAsync, createPresignedUrl, createPresignedUrlAsync, makeAWSRequest, makeAWSRequestOnce, makeAWSRequestAsync, parseXMLResponse, parseJSONResponse, clearSigningKeyCache, getSigningKeyCacheSize, isNodeCryptoAvailable, isWebCryptoAvailable, QueuePresets, RealtimePresets, detectDeploymentTargets, resolveDeploymentMode, deploymentCoexistenceError, resolveAppDatabase, resolveCloudProvider, TemplateBuilder, Pseudo, generateResourceName, generateLogicalId, getTimestamp, sanitizeName, resolveProjectStackName, resolveSiteStackName, resolveSiteResourceName, resolveSiteBucketName, resolveStorageBucketName, resolveDeployBucketName, resolveServerlessAppStackName, resolveServerlessArtifactBucketName, resolveServerlessAssetBucketName, DependencyGraph, analyzeStackDiff, formatDiff, Storage, Registry, CDN, DNS, Security, Compute, Network, FileSystem, Email, exports_incoming_call, Phone, Queue, JobLoader, StacksIntegration, exports_send, SMS, Sftp, AI, Database, Cache, Permissions, ApiGateway, Messaging, Workflow, Monitoring, Auth, Deployment, AssetHasher, Secrets, ParameterStore, Search, Redirects, Communication, Fn2, Arn, AWS_PSEUDO_PARAMETERS, CloudFormationBuilder, buildCloudFormationTemplate, createStaticSitePreset, createNodeJsServerPreset, createNodeJsServerlessPreset, createServerlessNodePreset, createExistingStaticFullStackPreset, createFullStackAppPreset, createApiBackendPreset, createWordPressPreset, createJamstackPreset, createMicroservicesPreset, createRealtimeAppPreset, createDataPipelinePreset, createMLApiPreset, createTraditionalWebAppPreset, createLaravelPreset, createServerlessLaravelPreset, createDashboardSite, DASHBOARD_STATE_DIR, DASHBOARD_ENTRY, DASHBOARD_PORT_BASE, DASHBOARD_PORT_SPAN, deriveManagementDashboardPort, resolveDashboardDomain, resolveDashboardDomains, hasManagementDashboardSite, MANAGEMENT_DASHBOARD_SITE_PREFIX, managementDashboardSiteName, isManagementDashboardSiteName, resolveManagementDashboardSites, resolveManagementDashboardSite, extendPreset, composePresets, createPreset, mergeInfrastructure, withMonitoring, withSecurity, withDatabase, withCache, withCDN, withQueue, fromEnvironment, fromSharedCredentials, fromEC2Metadata, fromECSMetadata, fromWebIdentity, getCredentials, createCredentialProvider, resolveCredentials, resolveRegion, getAccountId, S3Error, createS3Client, CloudError, ConfigurationError, CredentialError, DeploymentError, ValidationError, AWSAPIError, ErrorCodes, getErrorDetails, createError, DebugLogger, validateConfiguration, detectMisconfigurations, validateCredentials, checkIAMPermissions, getRequiredPermissions, suggestIAMPolicy, DEFAULT_SERVICE_LIMITS, checkServiceQuotas, getQuotaUsageSummary, suggestQuotaIncrease, FileCache, TemplateCache, templateCache, hashFile, hashString, hashBuffer, hashDirectory, hashManifest, quickHash, findChangedFiles, HashCache, parallel, batch, parallelMap, parallelWithRetry, sequence, withTimeout, RateLimiter, chunk, processInChunks, diffTemplates, getDiffSummary, requiresReplacement, categorizeChanges, getDeploymentStrategy, getDiffStats, cloud_config_schema_default, validateAgainstSchema, defaultLocalConfig, getLocalConfig, isLocalDevelopment, getLocalEndpoint, getLocalCredentials, getLocalEnvVars, MockCloudFormation, MockS3, MockDynamoDB, createMockAWS, PreviewEnvironmentManager, previewManager, generatePreviewWorkflow, generateCleanupWorkflow, generateCostReportWorkflow, PreviewNotificationService, previewNotifications, formatTable, formatTree, formatProgressBar, formatBytes, formatDuration, formatList, formatKeyValue, ProgressBar, MultiStepProgress, Spinner, TaskList, suggestCommand, formatSuggestion, isLikelyTypo, getContextualHelp, searchCommands, autocomplete, suggestFlags, formatFlagSuggestions, getCommandUsage, validateCommand, REPL, REPLContext, REPLCommandBuilder, CommandHistory, formatHistory, formatHistoryStats, MultiRegionManager, multiRegionManager, CrossRegionReferenceManager, GlobalResourceManager, RegionPairManager, StackDependencyManager, crossRegionReferenceManager, globalResourceManager, regionPairManager, stackDependencyManager, AWS_REGIONS, getRegion, getAllRegions, getRegionsByLocation, getRegionsByCompliance, getRegionsByPricingTier, isValidRegion, getClosestRegion, suggestRegions, suggestRegionPairs, formatRegion, formatRegionList, getRegionStats, MultiAccountManager, OrganizationManager, multiAccountManager, organizationManager, RECOMMENDED_ACCOUNT_STRUCTURES, RECOMMENDED_SCPS, COMMON_CROSS_ACCOUNT_ROLES, getRecommendedStructure, generateCrossAccountRoleCF, validateAccountStructure, formatAccountStructure, generateDeploymentWorkflow, generateMultiEnvWorkflow, generatePRPreviewWorkflow, generateScheduledWorkflow, generateMatrixWorkflow, generateDeploymentPipeline, generateMultiEnvPipeline, generatePreviewPipeline, generateScheduledPipeline, generateManualPipeline, generateDeploymentConfig, generateMultiEnvConfig, generateScheduledConfig, generateApprovalConfig, generateParallelConfig, BackupManager, backupManager, DisasterRecoveryManager, drManager, AWSConfigManager, awsConfigManager, CloudTrailManager, cloudTrailManager, GuardDutyManager, guardDutyManager, SecurityHubManager, securityHubManager, BlueGreenManager, blueGreenManager, CanaryManager, canaryManager, ABTestManager, abTestManager, ProgressiveDeploymentManager, progressiveDeploymentManager, XRayManager, xrayManager, MetricsManager, metricsManager, LogsManager, logsManager, SyntheticsManager, syntheticsManager, MigrationManager, migrationManager, ReplicaManager, replicaManager, PerformanceManager, performanceManager, DatabaseUserManager, databaseUserManager, SecretsRotationManager, secretsRotationManager, SecretsManager, secretsManager, CertificateManager, certificateManager, SecurityScanningManager, securityScanningManager, ImageScanningManager, imageScanningManager, BuildOptimizationManager, buildOptimizationManager, ContainerRegistryManager, containerRegistryManager, ServiceMeshManager, serviceMeshManager, LambdaLayersManager, lambdaLayersManager, LambdaVersionsManager, lambdaVersionsManager, LambdaConcurrencyManager, lambdaConcurrencyManager, LambdaDestinationsManager, lambdaDestinationsManager, LambdaVPCManager, lambdaVPCManager, LambdaDLQManager, lambdaDLQManager, Route53RoutingManager, route53RoutingManager, DNSSECManager, dnssecManager, Route53ResolverManager, route53ResolverManager, BounceComplaintHandler, bounceComplaintHandler, EmailAnalyticsManager, emailAnalyticsManager, SenderReputationManager, senderReputationManager, EmailTemplateManager, emailTemplateManager, exports_advanced, exports_inbound, exports_advanced2, exports_advanced3, FIFOQueueManager, fifoQueueManager, DLQMonitoringManager, dlqMonitoringManager, BatchProcessingManager, batchProcessingManager, QueueManagementManager, queueManagementManager, createZip, generateBootstrap, runBuildHooks, sha256, artifactKey, packageServerlessApp, MANAGED_NODE_VERSIONS, resolveServerlessRuntime, resolveQueues, resolveQueueNames, composeServerlessAppTemplate, PHP_LAYER_EXTENSIONS, phpLayerPackages, phpLayerBuildStage, generatePhpLayerDockerfile, generateAppImageDockerfile, sharedRuntimeLoop, buildNodeRuntimeLayerZip, buildBunRuntimeLayerZip, resolveApp, eventToRequest, responseToResult, createHttpHandler, createQueueHandler, createCliHandler, createHandlers, generatePhpFpmConfig, phpRuntimeLayerAssets, laravelServerlessEnvDefaults, LARAVEL_SERVERLESS_BUILD_STEPS, buildPhpRuntimeLayerZip, PHP_DEFAULT_EXCLUDES, runPhpBuildHooks, collectPhpAppEntries, packagePhpApp, StaticSiteManager, staticSiteManager, StorageAdvancedManager, storageAdvancedManager, HealthCheckManager, healthCheckManager, NetworkSecurityManager, networkSecurityManager, ResourceManagementManager, resourceManagementManager };
+export { detectServiceRegion, signRequest, signRequestAsync, createPresignedUrl, createPresignedUrlAsync, makeAWSRequest, makeAWSRequestOnce, makeAWSRequestAsync, parseXMLResponse, parseJSONResponse, clearSigningKeyCache, getSigningKeyCacheSize, isNodeCryptoAvailable, isWebCryptoAvailable, QueuePresets, RealtimePresets, DEFAULT_STATE_DIR, STATE_DIR_ENV_VAR, setStateDir, stateDir, statePath, resolveStatePath, isStatePath, detectDeploymentTargets, resolveDeploymentMode, deploymentCoexistenceError, resolveAppDatabase, resolveCloudProvider, TemplateBuilder, Pseudo, generateResourceName, generateLogicalId, getTimestamp, sanitizeName, resolveProjectStackName, resolveSiteStackName, resolveSiteResourceName, resolveSiteBucketName, resolveStorageBucketName, resolveDeployBucketName, resolveServerlessAppStackName, resolveServerlessArtifactBucketName, resolveServerlessAssetBucketName, DependencyGraph, analyzeStackDiff, formatDiff, Storage, Registry, CDN, DNS, Security, Compute, Network, FileSystem, Email, exports_incoming_call, Phone, Queue, JobLoader, StacksIntegration, exports_send, SMS, Sftp, AI, Database, Cache, Permissions, ApiGateway, Messaging, Workflow, Monitoring, Auth, Deployment, AssetHasher, Secrets, ParameterStore, Search, Redirects, Communication, Fn2, Arn, AWS_PSEUDO_PARAMETERS, CloudFormationBuilder, buildCloudFormationTemplate, createStaticSitePreset, createNodeJsServerPreset, createNodeJsServerlessPreset, createServerlessNodePreset, createExistingStaticFullStackPreset, createFullStackAppPreset, createApiBackendPreset, createWordPressPreset, createJamstackPreset, createMicroservicesPreset, createRealtimeAppPreset, createDataPipelinePreset, createMLApiPreset, createTraditionalWebAppPreset, createLaravelPreset, createServerlessLaravelPreset, createDashboardSite, DASHBOARD_STATE_DIR, DASHBOARD_ENTRY, DASHBOARD_PORT_BASE, DASHBOARD_PORT_SPAN, deriveManagementDashboardPort, resolveDashboardDomain, resolveDashboardDomains, hasManagementDashboardSite, MANAGEMENT_DASHBOARD_SITE_PREFIX, managementDashboardSiteName, isManagementDashboardSiteName, resolveManagementDashboardSites, resolveManagementDashboardSite, extendPreset, composePresets, createPreset, mergeInfrastructure, withMonitoring, withSecurity, withDatabase, withCache, withCDN, withQueue, fromEnvironment, fromSharedCredentials, fromEC2Metadata, fromECSMetadata, fromWebIdentity, getCredentials, createCredentialProvider, resolveCredentials, resolveRegion, getAccountId, S3Error, createS3Client, CloudError, ConfigurationError, CredentialError, DeploymentError, ValidationError, AWSAPIError, ErrorCodes, getErrorDetails, createError, DebugLogger, validateConfiguration, detectMisconfigurations, validateCredentials, checkIAMPermissions, getRequiredPermissions, suggestIAMPolicy, DEFAULT_SERVICE_LIMITS, checkServiceQuotas, getQuotaUsageSummary, suggestQuotaIncrease, FileCache, TemplateCache, templateCache, hashFile, hashString, hashBuffer, hashDirectory, hashManifest, quickHash, findChangedFiles, HashCache, parallel, batch, parallelMap, parallelWithRetry, sequence, withTimeout, RateLimiter, chunk, processInChunks, diffTemplates, getDiffSummary, requiresReplacement, categorizeChanges, getDeploymentStrategy, getDiffStats, cloud_config_schema_default, validateAgainstSchema, defaultLocalConfig, getLocalConfig, isLocalDevelopment, getLocalEndpoint, getLocalCredentials, getLocalEnvVars, MockCloudFormation, MockS3, MockDynamoDB, createMockAWS, PreviewEnvironmentManager, previewManager, generatePreviewWorkflow, generateCleanupWorkflow, generateCostReportWorkflow, PreviewNotificationService, previewNotifications, formatTable, formatTree, formatProgressBar, formatBytes, formatDuration, formatList, formatKeyValue, ProgressBar, MultiStepProgress, Spinner, TaskList, suggestCommand, formatSuggestion, isLikelyTypo, getContextualHelp, searchCommands, autocomplete, suggestFlags, formatFlagSuggestions, getCommandUsage, validateCommand, REPL, REPLContext, REPLCommandBuilder, CommandHistory, formatHistory, formatHistoryStats, MultiRegionManager, multiRegionManager, CrossRegionReferenceManager, GlobalResourceManager, RegionPairManager, StackDependencyManager, crossRegionReferenceManager, globalResourceManager, regionPairManager, stackDependencyManager, AWS_REGIONS, getRegion, getAllRegions, getRegionsByLocation, getRegionsByCompliance, getRegionsByPricingTier, isValidRegion, getClosestRegion, suggestRegions, suggestRegionPairs, formatRegion, formatRegionList, getRegionStats, MultiAccountManager, OrganizationManager, multiAccountManager, organizationManager, RECOMMENDED_ACCOUNT_STRUCTURES, RECOMMENDED_SCPS, COMMON_CROSS_ACCOUNT_ROLES, getRecommendedStructure, generateCrossAccountRoleCF, validateAccountStructure, formatAccountStructure, generateDeploymentWorkflow, generateMultiEnvWorkflow, generatePRPreviewWorkflow, generateScheduledWorkflow, generateMatrixWorkflow, generateDeploymentPipeline, generateMultiEnvPipeline, generatePreviewPipeline, generateScheduledPipeline, generateManualPipeline, generateDeploymentConfig, generateMultiEnvConfig, generateScheduledConfig, generateApprovalConfig, generateParallelConfig, BackupManager, backupManager, DisasterRecoveryManager, drManager, AWSConfigManager, awsConfigManager, CloudTrailManager, cloudTrailManager, GuardDutyManager, guardDutyManager, SecurityHubManager, securityHubManager, BlueGreenManager, blueGreenManager, CanaryManager, canaryManager, ABTestManager, abTestManager, ProgressiveDeploymentManager, progressiveDeploymentManager, XRayManager, xrayManager, MetricsManager, metricsManager, LogsManager, logsManager, SyntheticsManager, syntheticsManager, MigrationManager, migrationManager, ReplicaManager, replicaManager, PerformanceManager, performanceManager, DatabaseUserManager, databaseUserManager, SecretsRotationManager, secretsRotationManager, SecretsManager, secretsManager, CertificateManager, certificateManager, SecurityScanningManager, securityScanningManager, ImageScanningManager, imageScanningManager, BuildOptimizationManager, buildOptimizationManager, ContainerRegistryManager, containerRegistryManager, ServiceMeshManager, serviceMeshManager, LambdaLayersManager, lambdaLayersManager, LambdaVersionsManager, lambdaVersionsManager, LambdaConcurrencyManager, lambdaConcurrencyManager, LambdaDestinationsManager, lambdaDestinationsManager, LambdaVPCManager, lambdaVPCManager, LambdaDLQManager, lambdaDLQManager, Route53RoutingManager, route53RoutingManager, DNSSECManager, dnssecManager, Route53ResolverManager, route53ResolverManager, BounceComplaintHandler, bounceComplaintHandler, EmailAnalyticsManager, emailAnalyticsManager, SenderReputationManager, senderReputationManager, EmailTemplateManager, emailTemplateManager, exports_advanced, exports_inbound, exports_advanced2, exports_advanced3, FIFOQueueManager, fifoQueueManager, DLQMonitoringManager, dlqMonitoringManager, BatchProcessingManager, batchProcessingManager, QueueManagementManager, queueManagementManager, createZip, generateBootstrap, runBuildHooks, sha256, artifactKey, packageServerlessApp, MANAGED_NODE_VERSIONS, resolveServerlessRuntime, resolveQueues, resolveQueueNames, composeServerlessAppTemplate, PHP_LAYER_EXTENSIONS, phpLayerPackages, phpLayerBuildStage, generatePhpLayerDockerfile, generateAppImageDockerfile, sharedRuntimeLoop, buildNodeRuntimeLayerZip, buildBunRuntimeLayerZip, resolveApp, eventToRequest, responseToResult, createHttpHandler, createQueueHandler, createCliHandler, createHandlers, generatePhpFpmConfig, phpRuntimeLayerAssets, laravelServerlessEnvDefaults, LARAVEL_SERVERLESS_BUILD_STEPS, buildPhpRuntimeLayerZip, PHP_DEFAULT_EXCLUDES, runPhpBuildHooks, collectPhpAppEntries, packagePhpApp, StaticSiteManager, staticSiteManager, StorageAdvancedManager, storageAdvancedManager, HealthCheckManager, healthCheckManager, NetworkSecurityManager, networkSecurityManager, ResourceManagementManager, resourceManagementManager };

package/dist/{chunk-exbcsab2.js → chunk-zvk0f89t.js}

@@ -8,7 +8,7 @@ import {
   phpRuntimeLayerAssets,
   runPhpBuildHooks,
   sha256
-} from "./chunk-vdk53yyq.js";
+} from "./chunk-tq46tnxv.js";
 
 // src/deploy/serverless-image.ts
 import { execFileSync } from "node:child_process";

package/dist/control-plane/index.d.ts

@@ -1,6 +1,6 @@
 export { CONTROL_PLANE_SCHEMA_VERSION, controlPlaneMigrations } from './migrations';
 export type { ControlPlaneMigration } from './migrations';
-export { CONTROL_PLANE_DATABASE_FILE, ControlPlaneStore, MAX_CONTROL_PLANE_ERROR_BYTES, MAX_CONTROL_PLANE_JSON_BYTES, sanitizeControlPlaneValue, } from './store';
+export { controlPlaneDatabaseFile, ControlPlaneStore, MAX_CONTROL_PLANE_ERROR_BYTES, MAX_CONTROL_PLANE_JSON_BYTES, sanitizeControlPlaneValue, } from './store';
 export * from './types';
 export { searchControlPlane } from './search';
 export type { ControlPlaneSearchOptions, ControlPlaneSearchResult, ControlPlaneSearchResultType } from './search';

package/dist/control-plane/store.d.ts

@@ -1,6 +1,7 @@
 import type { AppendEventInput, AuthorizationGrant, AuthorizationScope, AuthorizationTarget, CompactResult, ControlPlaneActor, ControlPlaneEnvironment, ControlPlaneEvent, ControlPlaneHealth, ControlPlaneOperation, ControlPlaneOrganization, ControlPlaneProject, ControlPlaneResource, ControlPlaneSnapshot, ControlPlaneStoreOptions, ControlPlaneTag, CreateActorInput, CreateEnvironmentInput, CreateGrantInput, CreateInvitationInput, CreateMembershipInput, CreateOperationInput, CreateOrganizationInput, CreateProjectInput, CreateResourceInput, EventListOptions, ImportSnapshotOptions, JsonValue, NavigationPreference, OperationListOptions, OrganizationInvitation, OrganizationMembership, ReconcileResult, SavedFilter, TransitionOperationInput, UpdateProjectInput, UpdateResourceInput } from './types';
 import { Database } from 'bun:sqlite';
-export declare const CONTROL_PLANE_DATABASE_FILE: string;
+/** Project-relative location of the control-plane database. */
+export declare function controlPlaneDatabaseFile(): string;
 export declare const MAX_CONTROL_PLANE_JSON_BYTES: number;
 export declare const MAX_CONTROL_PLANE_ERROR_BYTES: number;
 export declare function sanitizeControlPlaneValue(value: unknown, maxBytes?: number): JsonValue;

package/dist/deploy/dashboard-config-module.d.ts

@@ -18,7 +18,7 @@ import type { CloudConfig } from '@ts-cloud/core';
 /**
  * Strip everything the dashboard does not need to read.
  *
- * Two rules:
+ * Three rules:
  *
  * 1. **No credentials.** The Hetzner API token is the big one: it controls the
  *    whole cloud account (create and destroy any server), and unlike a site's
@@ -30,6 +30,12 @@ import type { CloudConfig } from '@ts-cloud/core';
  *    vars a site defines, never their values — so ship the keys and blank the
  *    values. The running site has its own `.env` on the box regardless; there
  *    is no reason for a second copy to sit in the dashboard's directory.
+ *
+ * 3. **No local paths.** `stateDir` says where the operator's machine keeps
+ *    ts-cloud state; it means nothing on the box, whose dashboard state lives
+ *    in the release's `DASHBOARD_STATE_DIR` (the path the deploy preserves
+ *    across releases via `sharedPaths`). Shipping it would move the box's users
+ *    and session key outside that shared path and wipe them every deploy.
  */
 export declare function redactForDashboard(config: CloudConfig): Record<string, any>;
 /**

package/dist/deploy/dashboard-session.d.ts

@@ -1,5 +1,6 @@
 export declare const SESSION_COOKIE = "ts_cloud_session";
-export declare const SECRET_FILE: string;
+/** Project-relative location of the session signing secret. */
+export declare function secretFile(): string;
 /** Eight hours: long enough to work through a deploy, short enough to expire. */
 export declare const SESSION_TTL_MS: number;
 export interface SessionPayload {

package/dist/deploy/dashboard-users.d.ts

@@ -1,15 +1,16 @@
 /**
  * The dashboard's user store: a JSON file of {@link DashboardUser} records at
- * `.ts-cloud/dashboard-users.json` (0600), holding scrypt hashes and site
- * grants. Small on purpose — a box hosts a handful of collaborators, not a
- * directory service.
+ * `dashboard-users.json` (0600) inside the state directory, holding scrypt
+ * hashes and site grants. Small on purpose — a box hosts a handful of
+ * collaborators, not a directory service.
  *
  * On first use the store bootstraps a single admin so a freshly provisioned
  * dashboard is never reachable without credentials. The generated password is
  * returned to the caller to print once; only its hash is ever written.
  */
 import type { DashboardUser, SiteRole } from './dashboard-auth';
-export declare const USERS_FILE: string;
+/** Project-relative location of the user store, for messages and docs. */
+export declare function usersFile(): string;
 /** Usernames are used in URLs and shell-free contexts; keep them boring. */
 export declare function isValidUsername(value: string): boolean;
 export declare function parseUsersFile(text: string): DashboardUser[];

package/dist/deploy/index.d.ts

@@ -16,4 +16,4 @@ export { buildFunctionEnv, type CodeSource, deployServerlessApp, type DeployServ
 export { buildAndPushServerlessImage, type BuildImageOptions, type BuiltImage } from './serverless-image';
 export { type DashboardData, resolveDashboardData } from './dashboard-data';
 export { dashboardActions, resolveDashboardAction, sanitizeCloudConfig, startLocalDashboardServer, type DashboardAction, type LocalDashboardServer, type LocalDashboardServerOptions, } from './local-dashboard-server';
-export { buildManagementDashboardArtifact, DASHBOARD_CREDENTIALS_FILE, ensureManagementDashboard, type EnsureDashboardLogger, MANAGEMENT_DASHBOARD_SITE, resolveDashboardAuth, type ResolvedDashboardAuth, resolveUiSource, } from './management-dashboard';
+export { buildManagementDashboardArtifact, dashboardCredentialsFile, ensureManagementDashboard, type EnsureDashboardLogger, MANAGEMENT_DASHBOARD_SITE, resolveDashboardAuth, type ResolvedDashboardAuth, resolveUiSource, } from './management-dashboard';

package/dist/deploy/index.js

@@ -32,7 +32,7 @@ import {
   synchronizeDashboardUsers,
   trackDashboardOperation,
   verifyStaticApiOrigin
-} from "../chunk-g126cfn9.js";
+} from "../chunk-cz17nhnx.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -46,16 +46,16 @@ import {
 } from "../chunk-gcsv7g83.js";
 import {
   buildAndPushServerlessImage
-} from "../chunk-exbcsab2.js";
+} from "../chunk-zvk0f89t.js";
 import"../chunk-ybcz6sxc.js";
 import"../chunk-01d86gt1.js";
 import"../chunk-50jpda9q.js";
 import"../chunk-he9a874b.js";
 import"../chunk-001z7khv.js";
 import {
-  DASHBOARD_CREDENTIALS_FILE,
   MANAGEMENT_DASHBOARD_SITE,
   buildManagementDashboardArtifact,
+  dashboardCredentialsFile,
   ensureManagementDashboard,
   isPhpSite,
   resolveDashboardAuth,
@@ -65,8 +65,8 @@ import {
   shipsARelease,
   siteInstallBase,
   validateDeploymentConfig
-} from "../chunk-9m6b4m74.js";
-import"../chunk-vdk53yyq.js";
+} from "../chunk-sd9h1baj.js";
+import"../chunk-tq46tnxv.js";
 import"../chunk-703nkybg.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-hpv68b4a.js";
@@ -119,6 +119,7 @@ export {
   deployExistingStaticFullStack,
   deleteStaticSite,
   dashboardPageRoutes,
+  dashboardCredentialsFile,
   dashboardActions,
   createStaticApiOriginDependencies,
   createExistingStaticFullStackDependencies,
@@ -128,6 +129,5 @@ export {
   buildFunctionEnv,
   buildAndPushServerlessImage,
   buildAndPushContainerImage,
-  MANAGEMENT_DASHBOARD_SITE,
-  DASHBOARD_CREDENTIALS_FILE
+  MANAGEMENT_DASHBOARD_SITE
 };

package/dist/deploy/management-dashboard.d.ts

@@ -40,7 +40,7 @@ import type { CloudConfig } from '@ts-cloud/core';
  */
 export declare const MANAGEMENT_DASHBOARD_SITE = "dashboard";
 /** Where an auto-generated dashboard password is persisted (per project checkout). */
-export declare const DASHBOARD_CREDENTIALS_FILE: string;
+export declare function dashboardCredentialsFile(): string;
 export interface ResolvedDashboardAuth {
     /** The htpasswd password, or undefined when serving publicly (opt-out). */
     password?: string;
@@ -52,7 +52,8 @@ export interface ResolvedDashboardAuth {
  *  1. `TS_CLOUD_UI_PASSWORD` when set → use it verbatim.
  *  2. `TS_CLOUD_UI_PUBLIC` truthy → serve with NO auth (deliberate opt-out).
  *  3. Otherwise → reuse a previously-generated password from
- *     `.ts-cloud/dashboard-credentials.json`, or generate + persist a new one.
+ *     `dashboard-credentials.json` in the state directory, or generate and
+ *     persist a new one.
  *
  * Persisting the generated password keeps htpasswd stable across deploys (so a
  * saved credential keeps working) and lets the operator retrieve it locally.
@@ -63,7 +64,7 @@ export interface EnsureDashboardLogger {
     warn: (msg: string) => void;
 }
 /** Where the live dashboard's release is staged, inside the project checkout. */
-export declare const LIVE_STAGE_DIR: string;
+export declare function liveStageDir(): string;
 /**
  * The ts-cloud version the box should install. Reads this package's own version
  * so a box runs a dashboard matching the CLI that deployed it, rather than