@stacksjs/ts-cloud 0.7.59 → 0.7.61

package/dist/{chunk-9m6b4m74.js → chunk-pbh6b828.js}

@@ -5,8 +5,10 @@ import {
   resolveAppDatabase,
   resolveCloudProvider,
   resolveManagementDashboardSites,
-  resolveProjectStackName
-} from "./chunk-vdk53yyq.js";
+  resolveProjectStackName,
+  resolveStatePath,
+  statePath
+} from "./chunk-tq46tnxv.js";
 import {
   EC2Client,
   SSMClient
@@ -3806,6 +3808,40 @@ function buildEnsureReleaseLayout(paths, sharedPaths = DEFAULT_SHARED_PATHS) {
   }
   return lines;
 }
+function buildDeployLock(paths, waitSeconds = 900) {
+  const lock = `${deployMetaDir(paths.base)}/deploy.lock`;
+  return [
+    `mkdir -p "$(dirname ${lock})"`,
+    `exec 9>${lock}`,
+    `flock -w ${waitSeconds} 9 || { echo "[ts-cloud] another deploy of this site has held the lock for ${waitSeconds}s — refusing to race it" >&2; exit 1; }`
+  ];
+}
+function buildResetReleaseDir(paths) {
+  const staging = `${paths.release}.incoming`;
+  return [
+    `rm -rf ${staging}`,
+    `mkdir -p ${staging}`,
+    `if [ "$(readlink -f ${paths.current} 2>/dev/null || true)" = "${paths.release}" ]; then`,
+    `  TS_CLOUD_STAGED=${staging}`,
+    "else",
+    `  rm -rf ${paths.release}`,
+    `  mkdir -p ${paths.release}`,
+    `  rmdir ${staging}`,
+    `  TS_CLOUD_STAGED=${paths.release}`,
+    "fi"
+  ];
+}
+function buildPromoteStagedRelease(paths) {
+  const staging = `${paths.release}.incoming`;
+  return [
+    `if [ "$TS_CLOUD_STAGED" = "${staging}" ]; then`,
+    `  rm -rf ${paths.release}.previous`,
+    `  mv -T ${paths.release} ${paths.release}.previous`,
+    `  mv -T ${staging} ${paths.release}`,
+    `  rm -rf ${paths.release}.previous`,
+    "fi"
+  ];
+}
 function buildLinkSharedPaths(paths, sharedPaths = DEFAULT_SHARED_PATHS) {
   const lines = [];
   for (const p of sharedPaths) {
@@ -3919,17 +3955,18 @@ function buildSiteDeployScript(options) {
   const preStart = preStartCommands.length > 0 ? [`cd ${paths.release}`, ...preStartCommands] : [];
   const stageRelease = [
     "set -euo pipefail",
+    ...buildDeployLock(paths),
     `trap 'if [ $? -ne 0 ] && [ "$(readlink -f ${paths.current} 2>/dev/null || true)" != "${paths.release}" ]; then rm -rf ${paths.release}; fi' EXIT`,
     ...artifactFetch,
     ...buildEnsureReleaseLayout(paths, sharedPaths),
-    `rm -rf ${paths.release}`,
-    `mkdir -p ${paths.release}`,
-    `tar xzf ${tarball} -C ${paths.release}`,
+    ...buildResetReleaseDir(paths),
+    `tar xzf ${tarball} -C "$TS_CLOUD_STAGED"`,
     `rm -f ${tarball}`,
     `cat > ${paths.shared}/.env <<'TS_CLOUD_ENV_EOF'`,
     envFile,
     "TS_CLOUD_ENV_EOF",
     `chmod 600 ${paths.shared}/.env`,
+    ...buildPromoteStagedRelease(paths),
     `for TS_CLOUD_ENV in ${paths.shared}/.env ${paths.release}/.env ${paths.release}/.env.*; do [ -f "$TS_CLOUD_ENV" ] && sed -i -E '/^[[:space:]]*(PORT|PORT_BACKEND|PORT_ADMIN|PORT_FRONTEND)[[:space:]]*=/d' "$TS_CLOUD_ENV" 2>/dev/null || true; done`,
     ...buildLinkSharedPaths(paths, sharedPaths),
     ...preStart
@@ -4007,12 +4044,13 @@ function buildStaticSiteDeployScript(options) {
   const preStart = preStartCommands.length > 0 ? [`cd ${paths.release}`, ...preStartCommands] : [];
   return [
     "set -euo pipefail",
+    ...buildDeployLock(paths),
     `trap 'if [ $? -ne 0 ] && [ "$(readlink -f ${paths.current} 2>/dev/null || true)" != "${paths.release}" ]; then rm -rf ${paths.release}; fi' EXIT`,
     ...artifactFetch,
     ...buildEnsureReleaseLayout(paths, []),
-    `rm -rf ${paths.release}`,
-    `mkdir -p ${paths.release}`,
-    `tar xzf ${tarball} -C ${paths.release}`,
+    ...buildResetReleaseDir(paths),
+    `tar xzf ${tarball} -C "$TS_CLOUD_STAGED"`,
+    ...buildPromoteStagedRelease(paths),
     `rm -f ${tarball}`,
     ...preStart,
     ...buildActivateRelease(paths),
@@ -4069,6 +4107,7 @@ function redactForDashboard(config) {
   if (safe.hetzner)
     delete safe.hetzner.apiToken;
   delete safe.aws;
+  delete safe.stateDir;
   for (const site of Object.values(safe.sites ?? {})) {
     if (site?.env)
       site.env = blankValues(site.env);
@@ -4100,7 +4139,9 @@ function serializeDashboardConfig(config) {
 
 // src/deploy/management-dashboard.ts
 var MANAGEMENT_DASHBOARD_SITE = "dashboard";
-var DASHBOARD_CREDENTIALS_FILE = join4(".ts-cloud", "dashboard-credentials.json");
+function dashboardCredentialsFile() {
+  return statePath("dashboard-credentials.json");
+}
 function generatePassword() {
   return randomBytes(24).toString("base64url");
 }
@@ -4110,7 +4151,8 @@ function resolveDashboardAuth(cwd, username, logger) {
     return { password: explicit, source: "env" };
   if (truthy(process.env.TS_CLOUD_UI_PUBLIC))
     return { password: undefined, source: "public" };
-  const file = join4(cwd, DASHBOARD_CREDENTIALS_FILE);
+  const credentialsFile = dashboardCredentialsFile();
+  const file = resolveStatePath(cwd, "dashboard-credentials.json");
   try {
     if (existsSync2(file)) {
       const saved = JSON.parse(readFileSync3(file, "utf8"));
@@ -4124,10 +4166,10 @@ function resolveDashboardAuth(cwd, username, logger) {
     writeFileSync(file, `${JSON.stringify({ username, password, generatedAt: new Date().toISOString() }, null, 2)}
 `);
     chmodSync(file, 384);
-    logger.info(`Management dashboard: generated a password for '${username}' and saved it to ${DASHBOARD_CREDENTIALS_FILE} (read it there — it is not printed). Set TS_CLOUD_UI_PASSWORD to pin your own, or TS_CLOUD_UI_PUBLIC=1 to serve without auth.`);
+    logger.info(`Management dashboard: generated a password for '${username}' and saved it to ${credentialsFile} (read it there — it is not printed). Set TS_CLOUD_UI_PASSWORD to pin your own, or TS_CLOUD_UI_PUBLIC=1 to serve without auth.`);
   } catch (error) {
     logger.warn(`Management dashboard: could not persist the generated password (${error?.message ?? error}). Using it for this deploy only — pass: ${password}
-This password is now in your deploy log. Set TS_CLOUD_UI_PASSWORD to a value of your own and redeploy once ${DASHBOARD_CREDENTIALS_FILE} is writable.`);
+This password is now in your deploy log. Set TS_CLOUD_UI_PASSWORD to a value of your own and redeploy once ${credentialsFile} is writable.`);
   }
   return { password, source: "generated" };
 }
@@ -4135,7 +4177,9 @@ var noopLogger = { info: () => {}, warn: () => {} };
 function truthy(v) {
   return v != null && v !== "" && v !== "0" && v.toLowerCase() !== "false";
 }
-var LIVE_STAGE_DIR = join4(".ts-cloud", "dashboard-release");
+function liveStageDir() {
+  return statePath("dashboard-release");
+}
 function resolveDashboardVersion() {
   const explicit = process.env.TS_CLOUD_UI_VERSION?.trim();
   if (explicit)
@@ -4155,7 +4199,7 @@ function stageLiveDashboardRoot(config, cwd, logger) {
     logger.warn("Management dashboard: the cloud config has no project slug — skipping the live dashboard.");
     return null;
   }
-  const stage = join4(cwd, LIVE_STAGE_DIR);
+  const stage = resolveStatePath(cwd, "dashboard-release");
   try {
     mkdirSync(stage, { recursive: true });
     writeFileSync(join4(stage, "cloud.config.ts"), serializeDashboardConfig(config));
@@ -4167,7 +4211,7 @@ function stageLiveDashboardRoot(config, cwd, logger) {
     };
     writeFileSync(join4(stage, "package.json"), `${JSON.stringify(pkg, null, 2)}
 `);
-    return LIVE_STAGE_DIR;
+    return liveStageDir();
   } catch (error) {
     logger.warn(`Management dashboard: could not stage the live release (${error?.message ?? error}) — skipping.`);
     return null;
@@ -4246,7 +4290,7 @@ function ensureManagementDashboard(config, options = {}) {
     logger.info("Management dashboard: no domain resolved (set TS_CLOUD_UI_DOMAIN or configure a site domain) — skipping.");
     return config;
   }
-  const authNote = auth.source === "public" ? "NO AUTH — TS_CLOUD_UI_PUBLIC is set (dashboard is publicly reachable)" : auth.source === "env" ? "htpasswd-protected (TS_CLOUD_UI_PASSWORD)" : `htpasswd-protected (auto-generated — see ${DASHBOARD_CREDENTIALS_FILE})`;
+  const authNote = auth.source === "public" ? "NO AUTH — TS_CLOUD_UI_PUBLIC is set (dashboard is publicly reachable)" : auth.source === "env" ? "htpasswd-protected (TS_CLOUD_UI_PASSWORD)" : `htpasswd-protected (auto-generated — see ${dashboardCredentialsFile()})`;
   logger.warn("Management dashboard: static mode — one shared password, and no per-site collaborators. Unset TS_CLOUD_UI_STATIC for the live dashboard.");
   for (const { name, site } of resolved) {
     sites[name] = site;
@@ -5281,4 +5325,4 @@ function buildCloudFrontOriginConfig(options) {
     CustomErrorResponses: { Quantity: 0 }
   };
 }
-export { PANTRY_PROJECT_DIR, pgAdminCommand, BACKUP_RUNNER_PATH, buildBackupRestoreScript, siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, shipsARelease, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };
+export { PANTRY_PROJECT_DIR, pgAdminCommand, BACKUP_RUNNER_PATH, buildBackupRestoreScript, siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, shipsARelease, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, dashboardCredentialsFile, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };

package/dist/{chunk-e05phx5f.js → chunk-rxhqny6z.js}

@@ -1,8 +1,8 @@
 import {
   buildAndPushServerlessImage
-} from "./chunk-exbcsab2.js";
+} from "./chunk-zvk0f89t.js";
 import"./chunk-50jpda9q.js";
-import"./chunk-vdk53yyq.js";
+import"./chunk-tq46tnxv.js";
 import"./chunk-zqtpg06c.js";
 import"./chunk-v0bahtg2.js";
 export {