@stacksjs/ts-cloud 0.7.59 → 0.7.61

package/dist/{chunk-g126cfn9.js → chunk-c82m4yzn.js}

@@ -9,7 +9,7 @@ import {
   step,
   success,
   warn
-} from "./chunk-exbcsab2.js";
+} from "./chunk-zvk0f89t.js";
 import {
   AwsBackupClient,
   CloudWatchLogsClient,
@@ -45,12 +45,13 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-9m6b4m74.js";
+} from "./chunk-pbh6b828.js";
 import {
   artifactKey,
   buildCloudFormationTemplate,
   composeServerlessAppTemplate,
   createExistingStaticFullStackPreset,
+  isStatePath,
   laravelServerlessEnvDefaults,
   packagePhpApp,
   packageServerlessApp,
@@ -62,8 +63,11 @@ import {
   resolveServerlessAppStackName,
   resolveServerlessArtifactBucketName,
   resolveServerlessAssetBucketName,
-  resolveServerlessRuntime
-} from "./chunk-vdk53yyq.js";
+  resolveServerlessRuntime,
+  resolveStatePath,
+  setStateDir,
+  statePath
+} from "./chunk-tq46tnxv.js";
 import {
   SSMClient
 } from "./chunk-703nkybg.js";
@@ -1546,7 +1550,7 @@ var controlPlaneMigrations = [
 // src/control-plane/store.ts
 import { createHash, randomBytes } from "node:crypto";
 import { chmodSync, existsSync, mkdirSync, statSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { dirname } from "node:path";
 import { Database } from "bun:sqlite";
 
 // src/control-plane/authorization.ts
@@ -1703,7 +1707,9 @@ class UnsupportedSchemaVersionError extends Error {
 }
 
 // src/control-plane/store.ts
-var CONTROL_PLANE_DATABASE_FILE = join(".ts-cloud", "control-plane.sqlite");
+function controlPlaneDatabaseFile() {
+  return statePath("control-plane.sqlite");
+}
 var MAX_CONTROL_PLANE_JSON_BYTES = 64 * 1024;
 var MAX_CONTROL_PLANE_ERROR_BYTES = 16 * 1024;
 var TERMINAL_STATES = ["succeeded", "failed", "cancelled", "timed_out"];
@@ -1978,7 +1984,7 @@ class ControlPlaneStore {
   nowFn;
   idFn;
   constructor(options = {}) {
-    this.path = options.path ?? join(options.cwd ?? process.cwd(), CONTROL_PLANE_DATABASE_FILE);
+    this.path = options.path ?? resolveStatePath(options.cwd ?? process.cwd(), "control-plane.sqlite");
     this.nowFn = options.now ?? (() => new Date);
     this.idFn = options.id ?? (() => crypto.randomUUID());
     const inMemory = this.path === ":memory:";
@@ -7980,13 +7986,15 @@ import { createHash as createHash8 } from "node:crypto";
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, mkdtempSync, readdirSync, readFileSync, rmSync, statSync as statSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename as basename2, join as join3, relative, resolve as resolve2 } from "node:path";
-var IGNORED_DIRECTORIES = new Set([".git", ".ts-cloud", "node_modules", "dist", "coverage"]);
+var IGNORED_DIRECTORIES = new Set([".git", "node_modules", "dist", "coverage"]);
 function filesIn(directory, base = directory) {
   const files = [];
   for (const name of readdirSync(directory).sort()) {
     if (IGNORED_DIRECTORIES.has(name))
       continue;
     const path = join3(directory, name);
+    if (isStatePath(path, base))
+      continue;
     const stat2 = statSync2(path);
     if (stat2.isDirectory())
       files.push(...filesIn(path, base));
@@ -8309,7 +8317,7 @@ async function deployServerlessApp(config, environment2, opts = {}) {
   }
   if (imageMode) {
     step("Building + pushing container image");
-    const { buildAndPushServerlessImage } = await import("./chunk-e05phx5f.js");
+    const { buildAndPushServerlessImage } = await import("./chunk-rxhqny6z.js");
     const built = await buildAndPushServerlessImage({
       app,
       projectRoot,
@@ -9312,7 +9320,7 @@ import { createHash as createHash33 } from "node:crypto";
 import { existsSync as existsSync20, mkdtempSync as mkdtempSync3, readdirSync as readdirSync8, rmSync as rmSync3, statSync as statSync6 } from "node:fs";
 import { readFile as readFile2, writeFile as writeFile4 } from "node:fs/promises";
 import { tmpdir as tmpdir3 } from "node:os";
-import { dirname as dirname9, extname as extname3, join as join16, normalize as normalize3, relative as relative7, resolve as resolve15, sep as sep5 } from "node:path";
+import { dirname as dirname9, extname as extname3, join as join13, normalize as normalize3, relative as relative7, resolve as resolve15, sep as sep5 } from "node:path";
 import { fileURLToPath } from "node:url";
 // src/alerts/store.ts
 import { createCipheriv, createDecipheriv, createHash as createHash9, randomBytes as randomBytes2 } from "node:crypto";
@@ -12061,7 +12069,7 @@ async function manifestRequest(fetchFn, root, image, token, signal, authorizatio
 // src/onboarding/artifact-store.ts
 import { createHash as createHash12 } from "node:crypto";
 import { chmodSync as chmodSync2, existsSync as existsSync5, mkdirSync as mkdirSync3, renameSync, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { basename as basename3, join as join5, resolve as resolve4 } from "node:path";
+import { basename as basename3, join as join5 } from "node:path";
 function map2(row) {
   return {
     id: String(row.id),
@@ -12085,7 +12093,7 @@ class ApplicationArtifactStore {
   nowFn;
   constructor(controlPlane, options) {
     this.controlPlane = controlPlane;
-    this.root = resolve4(options.cwd, ".ts-cloud", "artifacts");
+    this.root = resolveStatePath(options.cwd, "artifacts");
     this.idFn = options.id ?? (() => crypto.randomUUID());
     this.nowFn = options.now ?? (() => new Date);
   }
@@ -18266,13 +18274,15 @@ async function sendAuthenticationEmail(config, message) {
 // src/auth/encryption.ts
 import { randomBytes as randomBytes6 } from "node:crypto";
 import { chmodSync as chmodSync4, existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname2, join as join7 } from "node:path";
-var AUTH_ENCRYPTION_KEY_FILE = join7(".ts-cloud", "auth-encryption-key");
+import { dirname as dirname2 } from "node:path";
+function authEncryptionKeyFile() {
+  return statePath("auth-encryption-key");
+}
 function resolveAuthEncryptionKey(cwd) {
   const configured = process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();
   if (configured)
     return configured;
-  const file = join7(cwd, AUTH_ENCRYPTION_KEY_FILE);
+  const file = resolveStatePath(cwd, "auth-encryption-key");
   try {
     if (existsSync6(file)) {
       const saved = readFileSync4(file, "utf8").trim();
@@ -21959,7 +21969,7 @@ class AwsElastiCacheTransport {
 }
 // src/data-services/docker-transport.ts
 import { mkdir as mkdir2, writeFile } from "node:fs/promises";
-import { join as join8, resolve as resolve6 } from "node:path";
+import { join as join7 } from "node:path";
 async function docker(args, stdin, allowFailure = false) {
   const process3 = Bun.spawn(["docker", ...args], {
     stdin: stdin == null ? "ignore" : "pipe",
@@ -22071,7 +22081,7 @@ function labels(inspect) {
 class DockerDataTransport {
   runtime;
   backupRoot;
-  constructor(runtime3 = new BunDockerRuntime, backupRoot = resolve6(".ts-cloud/backups/data")) {
+  constructor(runtime3 = new BunDockerRuntime, backupRoot = resolveStatePath(process.cwd(), "backups", "data")) {
     this.runtime = runtime3;
     this.backupRoot = backupRoot;
   }
@@ -22254,7 +22264,7 @@ requirepass ${credential2.replaceAll("\\", "\\\\").replaceAll(`
     if (!/^[A-Za-z0-9_.-]{2,120}$/.test(backupId))
       throw new Error("Backup identifier contains unsupported characters.");
     await mkdir2(this.backupRoot, { recursive: true, mode: 448 });
-    const path = join8(this.backupRoot, `${backupId}.sql`);
+    const path = join7(this.backupRoot, `${backupId}.sql`);
     await writeFile(path, exported.body, { mode: 384 });
     return { status: "available", backupId, path, engine, database, username };
   }
@@ -22497,7 +22507,7 @@ class FilesystemBackupSource {
   runtime;
   root;
   restoreRoot;
-  constructor(root, runtime3 = new BunFilesystemArchiveRuntime, restoreRoot = resolve7(root, ".ts-cloud", "restores", "files")) {
+  constructor(root, runtime3 = new BunFilesystemArchiveRuntime, restoreRoot = resolveStatePath(root, "restores", "files")) {
     this.runtime = runtime3;
     this.root = resolve7(root);
     this.restoreRoot = resolve7(restoreRoot);
@@ -22826,7 +22836,7 @@ class ControlPlaneBackupSource {
   controlPlane;
   root;
   restoreRoot;
-  constructor(controlPlane, root, restoreRoot = resolve8(root, ".ts-cloud", "restores", "control-plane")) {
+  constructor(controlPlane, root, restoreRoot = resolveStatePath(root, "restores", "control-plane")) {
     this.controlPlane = controlPlane;
     this.root = resolve8(root);
     this.restoreRoot = resolve8(restoreRoot);
@@ -23000,7 +23010,7 @@ class AwsInfrastructureBackupSource {
 }
 // src/config.ts
 import { existsSync as existsSync11 } from "node:fs";
-import { join as join10 } from "node:path";
+import { join as join9 } from "node:path";
 import { pathToFileURL } from "node:url";
 
 // ../../node_modules/bunfig/dist/index.js
@@ -23020,7 +23030,7 @@ import { existsSync as existsSync32, mkdirSync as mkdirSync22, readdirSync as re
 import { homedir } from "os";
 import { dirname as dirname22, resolve as resolve32 } from "path";
 import process6 from "process";
-import { join as join9, relative as relative5, resolve as resolve22 } from "path";
+import { join as join8, relative as relative5, resolve as resolve22 } from "path";
 import process22 from "process";
 import { existsSync as existsSync222, mkdirSync as mkdirSync5, readdirSync as readdirSync5, writeFileSync as writeFileSync6 } from "fs";
 import { dirname as dirname5, resolve as resolve9 } from "path";
@@ -28338,7 +28348,7 @@ var init_dist = __esm(async () => {
   };
   defaultConfigDir = resolve9(process3.cwd(), "config");
   defaultGeneratedDir = resolve9(process3.cwd(), "src/generated");
-  defaultLogDirectory = process22.env.CLARITY_LOG_DIR || join9(getProjectRoot(), "logs");
+  defaultLogDirectory = process22.env.CLARITY_LOG_DIR || join8(getProjectRoot(), "logs");
   defaultConfig = {
     level: "info",
     defaultName: "clarity",
@@ -31699,7 +31709,7 @@ function isDefaultConfig(config5) {
   return config5.project?.slug === defaultConfig4.project?.slug && Object.keys(config5.environments ?? {}).length === 1 && !!config5.environments?.production;
 }
 async function loadStacksCloudConfig() {
-  const candidates = [join10(process.cwd(), "config", "cloud.ts"), join10(process.cwd(), "config", "cloud.js")];
+  const candidates = [join9(process.cwd(), "config", "cloud.ts"), join9(process.cwd(), "config", "cloud.js")];
   for (const file of candidates) {
     if (!existsSync11(file))
       continue;
@@ -31719,6 +31729,7 @@ async function getConfig() {
     if (isDefaultConfig(_config)) {
       _config = await loadStacksCloudConfig() ?? _config;
     }
+    setStateDir(_config.stateDir);
   }
   return _config;
 }
@@ -36925,7 +36936,7 @@ class SecurityPostureStore {
 }
 // src/security/pre-deploy-scanner.ts
 import { existsSync as existsSync14, readdirSync as readdirSync7, readFileSync as readFileSync6, statSync as statSync5 } from "node:fs";
-import { extname as extname2, join as join11, relative as relative6 } from "node:path";
+import { extname as extname2, join as join10, relative as relative6 } from "node:path";
 var SECRET_PATTERNS = [
   {
     name: "AWS Access Key ID",
@@ -37357,7 +37368,7 @@ class PreDeployScanner {
     const scan = (currentDir) => {
       const entries = readdirSync7(currentDir, { withFileTypes: true });
       for (const entry2 of entries) {
-        const fullPath = join11(currentDir, entry2.name);
+        const fullPath = join10(currentDir, entry2.name);
         if (entry2.isDirectory()) {
           if (!excludeDirs.includes(entry2.name)) {
             scan(fullPath);
@@ -37675,7 +37686,7 @@ class AwsIamCapabilityScanner {
 // src/security/artifacts.ts
 import { createHash as createHash29, createVerify as createVerify2 } from "node:crypto";
 import { existsSync as existsSync16, readFileSync as readFileSync7 } from "node:fs";
-import { basename as basename5, join as join12, resolve as resolve13 } from "node:path";
+import { basename as basename5, join as join11, resolve as resolve13 } from "node:path";
 function sha256(value2) {
   return createHash29("sha256").update(value2).digest("hex");
 }
@@ -37707,7 +37718,7 @@ function packageComponents(manifest3) {
   return [...found.values()].sort((left, right) => `${left.name}@${left.version}`.localeCompare(`${right.name}@${right.version}`));
 }
 function generateCycloneDxSbom(root, options = {}) {
-  const manifestPath = join12(resolve13(root), "package.json");
+  const manifestPath = join11(resolve13(root), "package.json");
   if (!existsSync16(manifestPath))
     throw new Error(`Cannot generate an SBOM: ${manifestPath} was not found`);
   const encoded = readFileSync7(manifestPath, "utf8");
@@ -38168,7 +38179,7 @@ function generatePassword() {
 
 // src/deploy/dashboard-data-server.ts
 import { existsSync as existsSync17, readFileSync as readFileSync8 } from "node:fs";
-import { join as join13 } from "node:path";
+import { join as join12 } from "node:path";
 
 // src/deploy/ssh-config-editor.ts
 import { createHash as createHash30 } from "node:crypto";
@@ -38443,11 +38454,11 @@ function configuredRegion(config6) {
   return config6.project.region ?? "us-east-1";
 }
 function loadLocalState(config6, environment2) {
-  const statePath = join13(process.cwd(), "storage", "cloud", "state", `${config6.project.slug}-${environment2}.json`);
-  if (!existsSync17(statePath))
+  const statePath2 = join12(process.cwd(), "storage", "cloud", "state", `${config6.project.slug}-${environment2}.json`);
+  if (!existsSync17(statePath2))
     return null;
   try {
-    return JSON.parse(readFileSync8(statePath, "utf8"));
+    return JSON.parse(readFileSync8(statePath2, "utf8"));
   } catch {
     return null;
   }
@@ -39738,15 +39749,14 @@ function routePolicy(method, pathname) {
 // src/deploy/dashboard-session.ts
 import { createHmac as createHmac5, randomBytes as randomBytes13, timingSafeEqual as timingSafeEqual5 } from "node:crypto";
 import { chmodSync as chmodSync5, existsSync as existsSync18, mkdirSync as mkdirSync6, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "node:fs";
-import { dirname as dirname7, join as join14 } from "node:path";
+import { dirname as dirname7 } from "node:path";
 var SESSION_COOKIE = "ts_cloud_session";
-var SECRET_FILE = join14(".ts-cloud", "dashboard-secret");
 var SESSION_TTL_MS = 8 * 60 * 60 * 1000;
 function resolveSessionSecret(cwd) {
   const fromEnv = process.env.TS_CLOUD_DASHBOARD_SECRET?.trim();
   if (fromEnv)
     return fromEnv;
-  const file = join14(cwd, SECRET_FILE);
+  const file = resolveStatePath(cwd, "dashboard-secret");
   try {
     if (existsSync18(file)) {
       const saved = readFileSync9(file, "utf8").trim();
@@ -39826,8 +39836,10 @@ function clearSessionCookie(options = { secure: true }) {
 
 // src/deploy/dashboard-users.ts
 import { chmodSync as chmodSync6, existsSync as existsSync19, mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync10 } from "node:fs";
-import { dirname as dirname8, join as join15 } from "node:path";
-var USERS_FILE = join15(".ts-cloud", "dashboard-users.json");
+import { dirname as dirname8 } from "node:path";
+function usersFile() {
+  return statePath("dashboard-users.json");
+}
 function isValidUsername(value2) {
   return /^[a-z0-9][a-z0-9._-]{1,31}$/i.test(value2);
 }
@@ -39863,7 +39875,7 @@ function parseUsersFile(text2) {
   }
 }
 function usersFilePath(cwd) {
-  return join15(cwd, USERS_FILE);
+  return resolveStatePath(cwd, "dashboard-users.json");
 }
 function loadUsers(cwd) {
   const file = usersFilePath(cwd);
@@ -42355,7 +42367,7 @@ function pruneDashboardTempRoots(root = tmpdir3(), running = isProcessRunning) {
   for (const entry2 of readdirSync8(root, { withFileTypes: true })) {
     if (!entry2.isDirectory() || !entry2.name.startsWith(DASHBOARD_TEMP_PREFIX))
       continue;
-    const path = join16(root, entry2.name);
+    const path = join13(root, entry2.name);
     const owned = entry2.name.match(/^ts-cloud-dashboard-(\d+)-/);
     if (owned) {
       const pid = Number(owned[1]);
@@ -42531,10 +42543,10 @@ function resolveDashboardEnvironment(available2, fallback, requested) {
 }
 async function loadLocalEnv(cwd) {
   const candidates = [
-    join16(here, "..", "..", "..", "..", ".env"),
-    join16(cwd, ".env"),
-    join16(cwd, ".env.local"),
-    join16(cwd, ".env.production")
+    join13(here, "..", "..", "..", "..", ".env"),
+    join13(cwd, ".env"),
+    join13(cwd, ".env.local"),
+    join13(cwd, ".env.production")
   ];
   for (const file of candidates) {
     if (!existsSync20(file))
@@ -42558,10 +42570,10 @@ async function loadLocalEnv(cwd) {
 }
 function resolveCloudConfigPath(cwd) {
   const candidates = [
-    join16(cwd, "config", "cloud.ts"),
-    join16(cwd, "config", "cloud.js"),
-    join16(cwd, "cloud.config.ts"),
-    join16(cwd, "cloud.config.js")
+    join13(cwd, "config", "cloud.ts"),
+    join13(cwd, "config", "cloud.js"),
+    join13(cwd, "cloud.config.ts"),
+    join13(cwd, "cloud.config.js")
   ];
   return candidates.find((file) => existsSync20(file)) ?? null;
 }
@@ -42747,15 +42759,15 @@ async function resolveLiveDashboardData(config6, environment2) {
 }
 function resolveUiSourceDir(cwd) {
   const candidates = [
-    join16(cwd, "packages", "ui"),
-    join16(here, "..", "..", "..", "ui"),
-    join16(here, "..", "..", "ui"),
-    join16(here, "..", "ui-src"),
-    join16(here, "..", "..", "ui-src"),
-    join16(here, "..", "..", "dist", "ui-src")
+    join13(cwd, "packages", "ui"),
+    join13(here, "..", "..", "..", "ui"),
+    join13(here, "..", "..", "ui"),
+    join13(here, "..", "ui-src"),
+    join13(here, "..", "..", "ui-src"),
+    join13(here, "..", "..", "dist", "ui-src")
   ];
   for (const dir of candidates) {
-    if (existsSync20(join16(dir, "pages")) && existsSync20(join16(dir, "package.json")))
+    if (existsSync20(join13(dir, "pages")) && existsSync20(join13(dir, "package.json")))
       return dir;
   }
   return null;
@@ -42766,8 +42778,8 @@ async function buildLiveUi(cwd, data) {
     return null;
   let outDir;
   try {
-    outDir = mkdtempSync3(join16(tmpdir3(), `${DASHBOARD_TEMP_PREFIX}${process.pid}-`));
-    const localStx = join16(uiDir, "node_modules", ".bin", "stx");
+    outDir = mkdtempSync3(join13(tmpdir3(), `${DASHBOARD_TEMP_PREFIX}${process.pid}-`));
+    const localStx = join13(uiDir, "node_modules", ".bin", "stx");
     const cmd = existsSync20(localStx) ? [localStx, "build", "--pages", "pages", "--out", outDir, "--no-sitemap", "--no-cache"] : ["bunx", "--bun", "@stacksjs/stx", "build", "--pages", "pages", "--out", outDir, "--no-sitemap", "--no-cache"];
     const proc = Bun.spawn(cmd, {
       cwd: uiDir,
@@ -43037,19 +43049,19 @@ function staticPath(uiRoot, pathname) {
   const normalized = normalize3(wanted);
   if (normalized.startsWith("..") || normalized.includes("/../"))
     return null;
-  const base = join16(uiRoot, normalized);
+  const base = join13(uiRoot, normalized);
   if (existsSync20(base) && !statSync6(base).isDirectory())
     return base;
   if (!extname3(base) && existsSync20(`${base}.html`))
     return `${base}.html`;
-  if (!extname3(base) && existsSync20(join16(base, "index.html")))
-    return join16(base, "index.html");
+  if (!extname3(base) && existsSync20(join13(base, "index.html")))
+    return join13(base, "index.html");
   return null;
 }
 async function serveStatic(uiRoot, pathname) {
   const file = staticPath(uiRoot, pathname);
   if (!file) {
-    const notFound = join16(uiRoot, "404.html");
+    const notFound = join13(uiRoot, "404.html");
     if (existsSync20(notFound))
       return new Response(await readFile2(notFound), {
         status: 404,
@@ -43255,7 +43267,7 @@ async function startLocalDashboardServer(options = {}) {
   const resolveBackupSource = (policy3) => backupSources[policy3.resourceKind];
   const resolveBackupDestination = (destination2) => destination2.provider === "aws_backup" ? undefined : backupDestination;
   const volumeStore = new VolumeStore(controlPlane.store);
-  const volumeDrivers = [new DockerNamedVolumeDriver, new ServerPathVolumeDriver(join16(cwd, ".ts-cloud", "volumes"))];
+  const volumeDrivers = [new DockerNamedVolumeDriver, new ServerPathVolumeDriver(resolveStatePath(cwd, "volumes"))];
   const volumeService = new VolumeService(volumeStore, volumeDrivers, operationQueue);
   const fleetStore = new FleetStore(controlPlane.store);
   const fleetService = new FleetService(fleetStore, [new SshFleetDriver("aws"), new SshFleetDriver("hetzner"), new SshFleetDriver("ssh")], operationQueue);
@@ -43427,12 +43439,12 @@ async function startLocalDashboardServer(options = {}) {
               };
               await publishStatus("pending", `Preview deployment started for ${String(source.commitSha).slice(0, 12)}`);
             }
-            checkoutRoot = mkdtempSync3(join16(tmpdir3(), "ts-cloud-queued-source-"));
+            checkoutRoot = mkdtempSync3(join13(tmpdir3(), "ts-cloud-queued-source-"));
             context.log(`Checking out immutable source commit ${source.commitSha}.`, { stream: "system" });
             const cloned = await cloneSourceBinding({
               remote,
               binding,
-              destination: join16(checkoutRoot, "checkout"),
+              destination: join13(checkoutRoot, "checkout"),
               ref: String(source.branch ?? binding.defaultBranch),
               commitSha: String(source.commitSha)
             }, { credential: sourceConnections.getCredential(connection.id), deployKey });
@@ -43607,7 +43619,7 @@ async function startLocalDashboardServer(options = {}) {
   ts-cloud dashboard: created the first admin.
     username: ${bootstrap.generated.username}
     password: ${bootstrap.generated.password}
-  Saved (hashed) to .ts-cloud/dashboard-users.json. This password is shown once.
+  Saved (hashed) to ${usersFile()}. This password is shown once.
 `);
     }
   } else {
@@ -44300,11 +44312,11 @@ This link expires in one hour and can be used once.`
                 const deployKey = typeof body.source.deployKeyId === "string" ? sourceConnections.getDeployKey(body.source.deployKeyId) : undefined;
                 if (deployKey && deployKey.connectionId !== connection.id)
                   throw new Error("Deploy key does not belong to this connection");
-                const temporary = mkdtempSync3(join16(tmpdir3(), "ts-cloud-onboarding-git-"));
+                const temporary = mkdtempSync3(join13(tmpdir3(), "ts-cloud-onboarding-git-"));
                 try {
                   const cloned = await cloneSourceBinding({
                     remote: repository.cloneUrl,
-                    destination: join16(temporary, "checkout"),
+                    destination: join13(temporary, "checkout"),
                     ref: String(body.source.ref ?? repository.defaultBranch),
                     sparsePaths: Array.isArray(body.source.sparsePaths) ? body.source.sparsePaths.map(String) : undefined,
                     binding: {
@@ -48638,4 +48650,4 @@ data: ${JSON.stringify({ cursor: position, at: new Date().toISOString() })}
   };
   return { server, url: `http://${host2}:${server.port}/` };
 }
-export { defaultConfig4 as defaultConfig, getConfig, loadCloudConfig, config5 as config, encodeBase32, decodeBase32, hotp, totp, verifyTotp, matchTotpCounter, totpUri, AUTH_SESSION_IDLE_TTL_MS, AUTH_SESSION_ABSOLUTE_TTL_MS, AUTH_ACTION_TOKEN_TTL_MS, AUTH_MFA_CHALLENGE_TTL_MS, AUTH_OIDC_TRANSACTION_TTL_MS, AuthenticationStore, sendAuthenticationEmail, AUTH_ENCRYPTION_KEY_FILE, resolveAuthEncryptionKey, sanitizeOidcReturnPath, discoverOidcProvider, beginOidcAuthorization, completeOidcAuthorization, CONTROL_PLANE_SCHEMA_VERSION, controlPlaneMigrations, AUTHORIZATION_CAPABILITIES, roleCapabilities, scopeContains, authorizeOrganization, effectiveCapabilities, OptimisticConcurrencyError, InvalidOperationTransitionError, UnsupportedSchemaVersionError, CONTROL_PLANE_DATABASE_FILE, MAX_CONTROL_PLANE_JSON_BYTES, MAX_CONTROL_PLANE_ERROR_BYTES, sanitizeControlPlaneValue, ControlPlaneStore, searchControlPlane, API_TOKEN_DEFAULT_TTL_MS, API_TOKEN_MAX_TTL_MS, API_IDEMPOTENCY_TTL_MS, AutomationIdentityStore, TsCloudApiError, TsCloudClient, parseCompose, exportCompose, diffCompose, listComposeTemplates, getComposeTemplate, renderComposeTemplate, parseComposeCatalog, planComposeTemplateUpgrade, composeProjectName, buildComposeRuntimeCommand, buildComposeScaleCommand, buildComposeLogsCommand, buildComposeShellCommand, QueueCancellationError, QueueTimeoutError, RetryableOperationError, DurableOperationQueue, DurableQueueWorker, PreviewEnvironmentStore, PreviewEnvironmentService, DEPLOYMENT_QUEUE_KINDS, resolveQueuedDeploymentCommand, createDeploymentQueueHandlers, unsupportedVolumeCapabilities, volumeCapabilities, validateMountPath, validateAttachment, VolumeService, createVolumeQueueHandlers, DockerNamedVolumeDriver, ServerPathVolumeDriver, CloudBlockVolumeDriver, VolumeStore, synchronizeComposeVolumes, completeComposeVolumeDeletion, ComposeApplicationStore, ComposeApplicationService, releaseStrategyCapabilities, assertReleaseStrategy, ReleaseStore, ReleaseService, releaseTrafficPlan, activateImmutableRelease, rollbackImmutableRelease, RELEASE_QUEUE_KINDS, createReleaseQueueHandlers, SourceConnectionStore, SourceProviderError, GithubSourceAdapter, GitlabSourceAdapter, BitbucketSourceAdapter, GiteaSourceAdapter, createSourceAdapter, normalizeSourceEvent, processSourceWebhook, webhookEndpoint, discoverGitRefs, cloneSourceBinding, testSourceConnection, syncSourceRepositories, listSourceReferences, reconcileSourceWebhook, removeSourceWebhook, API_VERSION, openApiDocument, ApiServiceError, requestHash, AutomationApiService, createApiV1Handler, SecurityPostureStore, SECRET_PATTERNS, PreDeployScanner, scanForSecrets, formatScanResults, SecurityScannerRunner, SecretFindingScanner, TrivyImageScanner, AwsIamCapabilityScanner, generateCycloneDxSbom, generateImageSbom, attachSbomToRelease, attachVulnerabilitySummary, createReleaseProvenance, attachProvenanceToRelease, verifyArtifactSignature, securityScope, ensureDefaultSecurityPolicies, recordPreDeploySecretScan, recordSkippedSecretScan, recordDashboardHostPosture, productionChangeReview, secureContainerRelease, runtimeId2 as runtimeId, unsupportedCapabilities, capabilities2 as capabilities, normalizeRuntimeStatus, redactRuntimeConfig, ageSeconds, bytes, discoverRuntimeInventory, ecsWorkloads, lambdaWorkloads, parseDockerInspect, dockerWorkloads, DockerDiscoveryAdapter, parseSystemdRecords, systemdWorkloads, SystemdDiscoveryAdapter, EcsRuntimeAdapter, LambdaRuntimeAdapter, createRuntimeAdapters, resolveRuntimeInventory, authorizeRuntimePath, DIAGNOSTIC_PRESETS, RuntimeOperationService, RuntimeStreamRegistry, DEFAULT_TELEMETRY_POLICY, normalizeTelemetryPolicy, telemetryPolicyKey, loadTelemetryPolicy, saveTelemetryPolicy, telemetryEstimatedMonthlyCost, redactTelemetryText, redactTelemetryValue, pathTemplate, telemetryCursor, telemetryPercentile, telemetryBucketLabel, TelemetryStore, AlertStore, AlertEvaluator, isQuietHours, NotificationRouter, HealthCheckRunner, evaluateTelemetryAlertRules, normalizeScheduleExpression, nextScheduleRuns, previewSchedule, jobProviderCapability, renderServerCron, eventBridgeScheduleInput, reconcileJobObservation, desiredState, ServerCronJobAdapter, EventBridgeJobAdapter, JobProviderReconciler, synchronizeConfiguredJobs, JobService, createJobQueueHandlers, JobStore, dataServiceCapabilities, DataServiceStore, connectionGuidance, DataServiceLifecycle, createDataServiceQueueHandlers, AwsRdsDataAdapter, AwsAuroraDataAdapter, AwsElastiCacheDataAdapter, ServerDataAdapter, ContainerDataAdapter, AwsRdsTransport, AwsAuroraTransport, AwsElastiCacheTransport, BunDockerRuntime, DockerDataTransport, EncryptedDataSecretStore, SystemFleetSshTransport, SshFleetDriver, createFleetQueueHandlers, FleetStore, FleetService, zeroCapacity, capacity, PlacementStore, PlacementService, RemoteBuildService, createRemoteBuildQueueHandlers, TransportRemoteBuildDriver, createServerBuildDriver, createEcsBuildDriver, createAsgBuildDriver, RegionStore, RegionService, createRegionQueueHandlers, AwsRegionalDriver, UnavailableRegionalDriver, canonicalJson, manifestDigest, documentDigest, publicKeyFingerprint, verifyUpdateSignature, updateCompatibility, MaintenanceStore, maintenanceWindowOpen, MaintenanceService, createMaintenanceQueueHandlers, TransportPlatformMaintenanceDriver, ControlPlaneCleanupDriver, TransportDisasterRecoveryDriver, collectServerDnsDomains, removeStaleServerAddressRecords, ensureDashboardActor, initializeDashboardControlPlane, synchronizeDashboardUsers, trackDashboardOperation, dashboardPageRoutes, resolveLegacyDashboardRoute, routesForDashboard, deploySite, createStaticApiOriginDependencies, deployStaticApiOrigin, verifyStaticApiOrigin, estimateStaticApiOriginMonthlyCost, createExistingStaticFullStackDependencies, generateExistingStaticFullStackTemplate, deployExistingStaticFullStack, estimateExistingStaticFullStackMonthlyCost, hashContainerContext, createContainerImageDependencies, buildAndPushContainerImage, infraEnvFromOutputs, buildFunctionEnv, deployServerlessApp, redeployServerlessApp, rollbackServerlessApp, setMaintenance, runRemoteCommand, resolveDashboardData, validateBackupDestination, BackupStore, encryptBackup, decryptBackup, backupCredentialStatus, S3BackupDestinationAdapter, BackupCoordinator, createBackupQueueHandlers, AwsDatabaseBackupSource, compressBackup, decompressBackup, BunFilesystemArchiveRuntime, FilesystemBackupSource, LogicalDatabaseBackupSource, BunDockerVolumeRuntime, DockerVolumeBackupSource, ControlPlaneBackupSource, AwsInfrastructureBackupSource, ConfigurationStore, parseDotenv, serializeDotenv, LocalEncryptedConfigurationBackend, AwsSecretsManagerConfigurationBackend, AwsSsmConfigurationBackend, ExternalConfigurationBackend, ConfigurationService, synchronizeConfiguredConfiguration, sanitizeCloudConfig, dashboardActions, resolveDashboardAction, startLocalDashboardServer };
+export { defaultConfig4 as defaultConfig, getConfig, loadCloudConfig, config5 as config, encodeBase32, decodeBase32, hotp, totp, verifyTotp, matchTotpCounter, totpUri, AUTH_SESSION_IDLE_TTL_MS, AUTH_SESSION_ABSOLUTE_TTL_MS, AUTH_ACTION_TOKEN_TTL_MS, AUTH_MFA_CHALLENGE_TTL_MS, AUTH_OIDC_TRANSACTION_TTL_MS, AuthenticationStore, sendAuthenticationEmail, authEncryptionKeyFile, resolveAuthEncryptionKey, sanitizeOidcReturnPath, discoverOidcProvider, beginOidcAuthorization, completeOidcAuthorization, CONTROL_PLANE_SCHEMA_VERSION, controlPlaneMigrations, AUTHORIZATION_CAPABILITIES, roleCapabilities, scopeContains, authorizeOrganization, effectiveCapabilities, OptimisticConcurrencyError, InvalidOperationTransitionError, UnsupportedSchemaVersionError, controlPlaneDatabaseFile, MAX_CONTROL_PLANE_JSON_BYTES, MAX_CONTROL_PLANE_ERROR_BYTES, sanitizeControlPlaneValue, ControlPlaneStore, searchControlPlane, API_TOKEN_DEFAULT_TTL_MS, API_TOKEN_MAX_TTL_MS, API_IDEMPOTENCY_TTL_MS, AutomationIdentityStore, TsCloudApiError, TsCloudClient, parseCompose, exportCompose, diffCompose, listComposeTemplates, getComposeTemplate, renderComposeTemplate, parseComposeCatalog, planComposeTemplateUpgrade, composeProjectName, buildComposeRuntimeCommand, buildComposeScaleCommand, buildComposeLogsCommand, buildComposeShellCommand, QueueCancellationError, QueueTimeoutError, RetryableOperationError, DurableOperationQueue, DurableQueueWorker, PreviewEnvironmentStore, PreviewEnvironmentService, DEPLOYMENT_QUEUE_KINDS, resolveQueuedDeploymentCommand, createDeploymentQueueHandlers, unsupportedVolumeCapabilities, volumeCapabilities, validateMountPath, validateAttachment, VolumeService, createVolumeQueueHandlers, DockerNamedVolumeDriver, ServerPathVolumeDriver, CloudBlockVolumeDriver, VolumeStore, synchronizeComposeVolumes, completeComposeVolumeDeletion, ComposeApplicationStore, ComposeApplicationService, releaseStrategyCapabilities, assertReleaseStrategy, ReleaseStore, ReleaseService, releaseTrafficPlan, activateImmutableRelease, rollbackImmutableRelease, RELEASE_QUEUE_KINDS, createReleaseQueueHandlers, SourceConnectionStore, SourceProviderError, GithubSourceAdapter, GitlabSourceAdapter, BitbucketSourceAdapter, GiteaSourceAdapter, createSourceAdapter, normalizeSourceEvent, processSourceWebhook, webhookEndpoint, discoverGitRefs, cloneSourceBinding, testSourceConnection, syncSourceRepositories, listSourceReferences, reconcileSourceWebhook, removeSourceWebhook, API_VERSION, openApiDocument, ApiServiceError, requestHash, AutomationApiService, createApiV1Handler, SecurityPostureStore, SECRET_PATTERNS, PreDeployScanner, scanForSecrets, formatScanResults, SecurityScannerRunner, SecretFindingScanner, TrivyImageScanner, AwsIamCapabilityScanner, generateCycloneDxSbom, generateImageSbom, attachSbomToRelease, attachVulnerabilitySummary, createReleaseProvenance, attachProvenanceToRelease, verifyArtifactSignature, securityScope, ensureDefaultSecurityPolicies, recordPreDeploySecretScan, recordSkippedSecretScan, recordDashboardHostPosture, productionChangeReview, secureContainerRelease, runtimeId2 as runtimeId, unsupportedCapabilities, capabilities2 as capabilities, normalizeRuntimeStatus, redactRuntimeConfig, ageSeconds, bytes, discoverRuntimeInventory, ecsWorkloads, lambdaWorkloads, parseDockerInspect, dockerWorkloads, DockerDiscoveryAdapter, parseSystemdRecords, systemdWorkloads, SystemdDiscoveryAdapter, EcsRuntimeAdapter, LambdaRuntimeAdapter, createRuntimeAdapters, resolveRuntimeInventory, authorizeRuntimePath, DIAGNOSTIC_PRESETS, RuntimeOperationService, RuntimeStreamRegistry, DEFAULT_TELEMETRY_POLICY, normalizeTelemetryPolicy, telemetryPolicyKey, loadTelemetryPolicy, saveTelemetryPolicy, telemetryEstimatedMonthlyCost, redactTelemetryText, redactTelemetryValue, pathTemplate, telemetryCursor, telemetryPercentile, telemetryBucketLabel, TelemetryStore, AlertStore, AlertEvaluator, isQuietHours, NotificationRouter, HealthCheckRunner, evaluateTelemetryAlertRules, normalizeScheduleExpression, nextScheduleRuns, previewSchedule, jobProviderCapability, renderServerCron, eventBridgeScheduleInput, reconcileJobObservation, desiredState, ServerCronJobAdapter, EventBridgeJobAdapter, JobProviderReconciler, synchronizeConfiguredJobs, JobService, createJobQueueHandlers, JobStore, dataServiceCapabilities, DataServiceStore, connectionGuidance, DataServiceLifecycle, createDataServiceQueueHandlers, AwsRdsDataAdapter, AwsAuroraDataAdapter, AwsElastiCacheDataAdapter, ServerDataAdapter, ContainerDataAdapter, AwsRdsTransport, AwsAuroraTransport, AwsElastiCacheTransport, BunDockerRuntime, DockerDataTransport, EncryptedDataSecretStore, SystemFleetSshTransport, SshFleetDriver, createFleetQueueHandlers, FleetStore, FleetService, zeroCapacity, capacity, PlacementStore, PlacementService, RemoteBuildService, createRemoteBuildQueueHandlers, TransportRemoteBuildDriver, createServerBuildDriver, createEcsBuildDriver, createAsgBuildDriver, RegionStore, RegionService, createRegionQueueHandlers, AwsRegionalDriver, UnavailableRegionalDriver, canonicalJson, manifestDigest, documentDigest, publicKeyFingerprint, verifyUpdateSignature, updateCompatibility, MaintenanceStore, maintenanceWindowOpen, MaintenanceService, createMaintenanceQueueHandlers, TransportPlatformMaintenanceDriver, ControlPlaneCleanupDriver, TransportDisasterRecoveryDriver, collectServerDnsDomains, removeStaleServerAddressRecords, ensureDashboardActor, initializeDashboardControlPlane, synchronizeDashboardUsers, trackDashboardOperation, dashboardPageRoutes, resolveLegacyDashboardRoute, routesForDashboard, deploySite, createStaticApiOriginDependencies, deployStaticApiOrigin, verifyStaticApiOrigin, estimateStaticApiOriginMonthlyCost, createExistingStaticFullStackDependencies, generateExistingStaticFullStackTemplate, deployExistingStaticFullStack, estimateExistingStaticFullStackMonthlyCost, hashContainerContext, createContainerImageDependencies, buildAndPushContainerImage, infraEnvFromOutputs, buildFunctionEnv, deployServerlessApp, redeployServerlessApp, rollbackServerlessApp, setMaintenance, runRemoteCommand, resolveDashboardData, validateBackupDestination, BackupStore, encryptBackup, decryptBackup, backupCredentialStatus, S3BackupDestinationAdapter, BackupCoordinator, createBackupQueueHandlers, AwsDatabaseBackupSource, compressBackup, decompressBackup, BunFilesystemArchiveRuntime, FilesystemBackupSource, LogicalDatabaseBackupSource, BunDockerVolumeRuntime, DockerVolumeBackupSource, ControlPlaneBackupSource, AwsInfrastructureBackupSource, ConfigurationStore, parseDotenv, serializeDotenv, LocalEncryptedConfigurationBackend, AwsSecretsManagerConfigurationBackend, AwsSsmConfigurationBackend, ExternalConfigurationBackend, ConfigurationService, synchronizeConfiguredConfiguration, sanitizeCloudConfig, dashboardActions, resolveDashboardAction, startLocalDashboardServer };