@stacksjs/ts-cloud 0.7.6 → 0.7.9

package/dist/{chunk-p6309384.js → chunk-x07dz3sd.js}

@@ -26,7 +26,7 @@ import {
   resolveSiteFramework,
   resolveSiteKind,
   resolveUiSource
-} from "./chunk-dpkk640m.js";
+} from "./chunk-xzn0ntr0.js";
 import {
   artifactKey,
   composeServerlessAppTemplate,

package/dist/{chunk-dpkk640m.js → chunk-xzn0ntr0.js}

@@ -3204,6 +3204,230 @@ async function waitForCloudInit(host, options = {}) {
   }
   throw new Error(`cloud-init did not finish on ${host} after ${timeoutMs}ms`);
 }
+// src/drivers/shared/box-provision.ts
+var UBUNTU_2404_AMI_PARAM = "/aws/service/canonical/ubuntu/server/24.04/stable/current/amd64/hvm/ebs-gp3/ami-id";
+function buildBoxUserData(spec) {
+  const key = spec.sshPublicKey.trim();
+  const lines = [
+    "#cloud-config",
+    "disable_root: false",
+    "ssh_authorized_keys:",
+    `  - ${key}`
+  ];
+  if (spec.bootstrapScript) {
+    const path = "/var/lib/cloud/box-bootstrap.sh";
+    const indented = spec.bootstrapScript.split(`
+`).map((l) => `      ${l}`).join(`
+`);
+    lines.push("write_files:", `  - path: ${path}`, `    permissions: '0755'`, "    owner: root:root", "    content: |", indented);
+  }
+  lines.push("runcmd:", `  - mkdir -p /root/.ssh && grep -qF "${key}" /root/.ssh/authorized_keys 2>/dev/null || echo "${key}" >> /root/.ssh/authorized_keys`);
+  if (spec.bootstrapScript)
+    lines.push("  - [ bash, /var/lib/cloud/box-bootstrap.sh ]");
+  return `${lines.join(`
+`)}
+`;
+}
+function toHetznerRules(ports = []) {
+  const rules = [
+    { direction: "in", protocol: "tcp", port: "22", source_ips: ["0.0.0.0/0", "::/0"], description: "SSH" }
+  ];
+  for (const p of ports) {
+    rules.push({
+      direction: "in",
+      protocol: p.protocol,
+      ...p.protocol === "icmp" ? {} : { port: String(p.port) },
+      source_ips: ["0.0.0.0/0", "::/0"]
+    });
+  }
+  return rules;
+}
+
+class HetznerBoxProvisioner {
+  client;
+  provider = "hetzner";
+  constructor(client) {
+    this.client = client;
+  }
+  async ensureBox(spec) {
+    const key = await ensureSshKey(this.client, { name: `${spec.name}-key`, publicKey: spec.sshPublicKey });
+    const firewall = await ensureFirewall(this.client, { name: `${spec.name}-fw`, rules: toHetznerRules(spec.ports) });
+    const { server, created } = await ensureServer(this.client, {
+      name: spec.name,
+      serverType: spec.size,
+      image: spec.image ?? "ubuntu-24.04",
+      location: spec.location,
+      sshKeys: [key.id],
+      firewalls: [{ firewall: firewall.id }],
+      userData: buildBoxUserData(spec),
+      labels: spec.labels
+    });
+    return { provider: "hetzner", id: String(server.id), name: server.name, publicIp: serverPublicIpv4(server), created };
+  }
+  async destroyBox(name) {
+    const destroyed = [];
+    const server = (await this.client.listServers()).find((s) => s.name === name);
+    if (server) {
+      const action = await this.client.deleteServer(server.id);
+      await this.client.waitForAction(action.id).catch(() => {});
+      destroyed.push(`server ${name} (#${server.id})`);
+    }
+    const firewall = (await this.client.listFirewalls()).find((f) => f.name === `${name}-fw`);
+    if (firewall) {
+      for (let i = 0;i < 10; i++) {
+        try {
+          await this.client.deleteFirewall(firewall.id);
+          destroyed.push(`firewall ${name}-fw (#${firewall.id})`);
+          break;
+        } catch {
+          if (i === 9)
+            break;
+          await new Promise((resolve) => setTimeout(resolve, 3000));
+        }
+      }
+    }
+    return { destroyed };
+  }
+}
+function toIpPermissions(ports = []) {
+  const permissions = [
+    { IpProtocol: "tcp", FromPort: 22, ToPort: 22, IpRanges: [{ CidrIp: "0.0.0.0/0", Description: "SSH" }] }
+  ];
+  for (const p of ports) {
+    permissions.push(p.protocol === "icmp" ? { IpProtocol: "icmp", FromPort: -1, ToPort: -1, IpRanges: [{ CidrIp: "0.0.0.0/0" }] } : { IpProtocol: p.protocol, FromPort: p.port, ToPort: p.port, IpRanges: [{ CidrIp: "0.0.0.0/0" }] });
+  }
+  return permissions;
+}
+
+class AwsBoxProvisioner {
+  provider = "aws";
+  ec2;
+  ssm;
+  constructor(options) {
+    this.ec2 = options.ec2;
+    this.ssm = options.ssm;
+  }
+  async findInstance(name, states) {
+    const result = await this.ec2.describeInstances({
+      Filters: [
+        { Name: "tag:Name", Values: [name] },
+        { Name: "instance-state-name", Values: states }
+      ]
+    });
+    return result.Reservations?.flatMap((r) => r.Instances ?? [])[0];
+  }
+  async waitForPublicIp(instanceId, timeoutMs = 300000) {
+    const start = Date.now();
+    while (Date.now() - start < timeoutMs) {
+      const instance = await this.ec2.getInstance(instanceId);
+      if (instance?.State?.Name === "running" && instance.PublicIpAddress)
+        return instance;
+      await new Promise((resolve) => setTimeout(resolve, 5000));
+    }
+    throw new Error(`EC2 instance ${instanceId} did not reach running with a public IP within ${timeoutMs}ms`);
+  }
+  async ensureSecurityGroup(spec) {
+    const groupName = `${spec.name}-sg`;
+    const existing = await this.ec2.describeSecurityGroups({
+      Filters: [{ Name: "group-name", Values: [groupName] }]
+    });
+    const found = existing.SecurityGroups?.[0]?.GroupId;
+    if (found)
+      return found;
+    const created = await this.ec2.createSecurityGroup({
+      GroupName: groupName,
+      Description: `box ${spec.name} (managed by ts-cloud box-provision)`
+    });
+    if (!created.GroupId)
+      throw new Error(`could not create security group ${groupName}`);
+    await this.ec2.authorizeSecurityGroupIngress({
+      GroupId: created.GroupId,
+      IpPermissions: toIpPermissions(spec.ports)
+    });
+    return created.GroupId;
+  }
+  async resolveImage(spec) {
+    if (spec.image?.startsWith("ami-"))
+      return spec.image;
+    const result = await this.ssm.getParameter({ Name: UBUNTU_2404_AMI_PARAM });
+    const ami = result.Parameter?.Value;
+    if (!ami)
+      throw new Error(`could not resolve the Ubuntu 24.04 AMI via SSM (${UBUNTU_2404_AMI_PARAM})`);
+    return ami;
+  }
+  async ensureBox(spec) {
+    const existing = await this.findInstance(spec.name, ["pending", "running"]);
+    if (existing?.InstanceId) {
+      const instance2 = await this.waitForPublicIp(existing.InstanceId);
+      return { provider: "aws", id: instance2.InstanceId, name: spec.name, publicIp: instance2.PublicIpAddress, created: false };
+    }
+    const [groupId, imageId] = await Promise.all([
+      this.ensureSecurityGroup(spec),
+      this.resolveImage(spec)
+    ]);
+    const tags = [
+      { Key: "Name", Value: spec.name },
+      ...Object.entries(spec.labels ?? {}).map(([Key, Value]) => ({ Key, Value }))
+    ];
+    const result = await this.ec2.runInstances({
+      ImageId: imageId,
+      InstanceType: spec.size,
+      MinCount: 1,
+      MaxCount: 1,
+      SecurityGroupIds: [groupId],
+      UserData: btoa(buildBoxUserData(spec)),
+      TagSpecifications: [{ ResourceType: "instance", Tags: tags }]
+    });
+    const instanceId = result.Instances?.[0]?.InstanceId;
+    if (!instanceId)
+      throw new Error(`RunInstances returned no instance for box ${spec.name}`);
+    const instance = await this.waitForPublicIp(instanceId);
+    return { provider: "aws", id: instanceId, name: spec.name, publicIp: instance.PublicIpAddress, created: true };
+  }
+  async destroyBox(name) {
+    const destroyed = [];
+    const instance = await this.findInstance(name, ["pending", "running", "stopping", "stopped"]);
+    if (instance?.InstanceId) {
+      await this.ec2.terminateInstances([instance.InstanceId]);
+      destroyed.push(`instance ${name} (${instance.InstanceId})`);
+      const start = Date.now();
+      while (Date.now() - start < 300000) {
+        const current = await this.ec2.getInstance(instance.InstanceId);
+        if (!current || current.State?.Name === "terminated")
+          break;
+        await new Promise((resolve) => setTimeout(resolve, 5000));
+      }
+    }
+    const groups = await this.ec2.describeSecurityGroups({
+      Filters: [{ Name: "group-name", Values: [`${name}-sg`] }]
+    });
+    const groupId = groups.SecurityGroups?.[0]?.GroupId;
+    if (groupId) {
+      for (let i = 0;i < 10; i++) {
+        try {
+          await this.ec2.deleteSecurityGroup(groupId);
+          destroyed.push(`security group ${name}-sg (${groupId})`);
+          break;
+        } catch {
+          if (i === 9)
+            break;
+          await new Promise((resolve) => setTimeout(resolve, 3000));
+        }
+      }
+    }
+    return { destroyed };
+  }
+}
+function createBoxProvisioner(options) {
+  if (options.provider === "hetzner") {
+    if (!options.hetzner)
+      throw new Error('createBoxProvisioner: options.hetzner (a HetznerClient) is required for provider "hetzner"');
+    return new HetznerBoxProvisioner(options.hetzner);
+  }
+  if (!options.aws)
+    throw new Error('createBoxProvisioner: options.aws ({ ec2, ssm }) is required for provider "aws"');
+  return new AwsBoxProvisioner(options.aws);
+}
 // src/drivers/shared/env-file.ts
 function formatEnvFile(env) {
   return Object.entries(env).map(([k, v]) => `${k}=${quoteEnvValue(String(v))}`).join(`
@@ -4389,4 +4613,4 @@ function buildCloudFrontOriginConfig(options) {
     CustomErrorResponses: { Quantity: 0 }
   };
 }
-export { isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, HetznerClient, resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, buildAwsArtifactFetch, buildLocalArtifactFetch, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };
+export { isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, HetznerClient, resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, buildAwsArtifactFetch, buildLocalArtifactFetch, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };

package/dist/deploy/index.js

@@ -12,7 +12,7 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "../chunk-p6309384.js";
+} from "../chunk-x07dz3sd.js";
 import {
   buildAndPushServerlessImage
 } from "../chunk-0wxyppza.js";
@@ -29,7 +29,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   validateDeploymentConfig
-} from "../chunk-dpkk640m.js";
+} from "../chunk-xzn0ntr0.js";
 import"../chunk-c6rgvg1j.js";
 import"../chunk-93hjhs78.js";
 import {

package/dist/drivers/index.d.ts

@@ -8,6 +8,8 @@ export { ensureFirewall, ensureServer, ensureSshKey, serverPublicIpv4 } from './
 export type { EnsuredResource, EnsuredServer, EnsureFirewallOptions, EnsureServerOptions, EnsureSshKeyOptions, } from './hetzner/provision';
 export { buildSshArgs, scpUpload, sshExec, sshExecOrThrow, waitForCloudInit, waitForSsh } from './shared/remote-exec';
 export type { RemoteExecOptions, RemoteExecResult, WaitOptions } from './shared/remote-exec';
+export { AwsBoxProvisioner, buildBoxUserData, createBoxProvisioner, HetznerBoxProvisioner, UBUNTU_2404_AMI_PARAM, } from './shared/box-provision';
+export type { AwsBoxProvisionerOptions, BoxPort, BoxProviderName, BoxProvisioner, BoxSpec, CreateBoxProvisionerOptions, ProvisionedBox, } from './shared/box-provision';
 export { buildAwsArtifactFetch, buildLocalArtifactFetch, buildSiteDeployScript, buildStaticSiteDeployScript, resolveExecStart, } from './shared/deploy-script';
 export { deployAllComputeSites, deploySiteRelease, reloadRpxGateway } from './shared/compute-deploy';
 export { buildRpxConfig, buildRpxLbConfig, buildRpxProvisionScript, deriveRouteId, normalizeRoutePath, renderRpxLauncher, DEFAULT_RPX_CERTS_DIR, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, } from './shared/rpx-gateway';

package/dist/drivers/index.js

@@ -1,7 +1,9 @@
 import {
+  AwsBoxProvisioner,
   AwsDriver,
   CloudDriverFactory,
   DEFAULT_RPX_CERTS_DIR,
+  HetznerBoxProvisioner,
   HetznerClient,
   HetznerDriver,
   LocalBoxDriver,
@@ -11,7 +13,9 @@ import {
   RPX_DIR,
   RPX_LAUNCHER_PATH,
   RPX_SERVICE_NAME,
+  UBUNTU_2404_AMI_PARAM,
   buildAwsArtifactFetch,
+  buildBoxUserData,
   buildCloudFrontOriginConfig,
   buildLocalArtifactFetch,
   buildRpxConfig,
@@ -22,6 +26,7 @@ import {
   buildStaticSiteDeployScript,
   buildUbuntuBootstrapScript,
   cloudDrivers,
+  createBoxProvisioner,
   createCloudDriver,
   deployAllComputeSites,
   deploySiteRelease,
@@ -43,7 +48,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "../chunk-dpkk640m.js";
+} from "../chunk-xzn0ntr0.js";
 import"../chunk-c6rgvg1j.js";
 import"../chunk-93hjhs78.js";
 import"../chunk-qpj3edwz.js";
@@ -73,6 +78,7 @@ export {
   deploySiteRelease,
   deployAllComputeSites,
   createCloudDriver,
+  createBoxProvisioner,
   cloudDrivers,
   buildStaticSiteDeployScript,
   buildSshArgs,
@@ -82,7 +88,9 @@ export {
   buildRpxConfig,
   buildLocalArtifactFetch,
   buildCloudFrontOriginConfig,
+  buildBoxUserData,
   buildAwsArtifactFetch,
+  UBUNTU_2404_AMI_PARAM,
   RPX_SERVICE_NAME,
   RPX_LAUNCHER_PATH,
   RPX_DIR,
@@ -92,7 +100,9 @@ export {
   LocalBoxDriver,
   HetznerDriver,
   HetznerClient,
+  HetznerBoxProvisioner,
   DEFAULT_RPX_CERTS_DIR,
   CloudDriverFactory,
-  AwsDriver
+  AwsDriver,
+  AwsBoxProvisioner
 };

package/dist/drivers/shared/box-provision.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Provider-agnostic single-box provisioning.
+ *
+ * `createBoxProvisioner` gives deploy scripts one interface — ensure a named
+ * box exists (running, reachable, firewall open, SSH key authorized, bootstrap
+ * script run) and tear it down again — regardless of whether the box lives on
+ * Hetzner Cloud or AWS EC2. Idempotent like the underlying `ensure*` helpers:
+ * re-running converges instead of duplicating resources.
+ *
+ * SSH access is normalized to `root@<publicIp>`: the public key is injected
+ * via cloud-init (`disable_root: false` plus an authorized_keys append) so the
+ * same `sshExec(host, cmd)` calls work on both providers, even though AWS
+ * Ubuntu images default to the `ubuntu` user.
+ */
+import type { EC2Client } from '../../aws/ec2';
+import type { SSMClient } from '../../aws/ssm';
+import type { HetznerClient } from '../hetzner/client';
+export type BoxProviderName = 'hetzner' | 'aws';
+export interface BoxPort {
+    protocol: 'tcp' | 'udp' | 'icmp';
+    /** Port number; omit for icmp. */
+    port?: number;
+}
+export interface BoxSpec {
+    /** Resource name; also names the firewall/security group (`<name>-fw`/`<name>-sg`). */
+    name: string;
+    /** Provider-native size (Hetzner server type like `cx23`, EC2 instance type like `t3.micro`). */
+    size: string;
+    /** Hetzner image name or an `ami-...` id. Defaults to Ubuntu 24.04 on both providers. */
+    image?: string;
+    /** Hetzner location (e.g. `fsn1`). AWS placement follows the provisioner's region. */
+    location?: string;
+    /** Ingress to open in addition to tcp/22. */
+    ports?: BoxPort[];
+    /** OpenSSH public key authorized for root. */
+    sshPublicKey: string;
+    /** Plain bash bootstrap script, run once at first boot via cloud-init. */
+    bootstrapScript?: string;
+    labels?: Record<string, string>;
+}
+export interface ProvisionedBox {
+    provider: BoxProviderName;
+    id: string;
+    name: string;
+    publicIp: string;
+    created: boolean;
+}
+export interface BoxProvisioner {
+    readonly provider: BoxProviderName;
+    ensureBox(spec: BoxSpec): Promise<ProvisionedBox>;
+    /** Tear down the box and its firewall/security group. */
+    destroyBox(name: string): Promise<{
+        destroyed: string[];
+    }>;
+}
+/** SSM parameter for the current Ubuntu 24.04 amd64 gp3 AMI (Canonical-published). */
+export declare const UBUNTU_2404_AMI_PARAM = "/aws/service/canonical/ubuntu/server/24.04/stable/current/amd64/hvm/ebs-gp3/ami-id";
+/**
+ * Cloud-config shared by both providers: root SSH access with the given key
+ * (AWS Ubuntu images otherwise lock root and point at the `ubuntu` user) and
+ * the optional bootstrap script.
+ */
+export declare function buildBoxUserData(spec: Pick<BoxSpec, 'sshPublicKey' | 'bootstrapScript'>): string;
+export declare class HetznerBoxProvisioner implements BoxProvisioner {
+    private client;
+    readonly provider: "hetzner";
+    constructor(client: HetznerClient);
+    ensureBox(spec: BoxSpec): Promise<ProvisionedBox>;
+    destroyBox(name: string): Promise<{
+        destroyed: string[];
+    }>;
+}
+/** The EC2 surface the AWS provisioner uses (injectable for tests). */
+export type BoxEc2Client = Pick<EC2Client, 'describeInstances' | 'describeSecurityGroups' | 'createSecurityGroup' | 'authorizeSecurityGroupIngress' | 'runInstances' | 'terminateInstances' | 'deleteSecurityGroup' | 'getInstance'>;
+/** The SSM surface the AWS provisioner uses (injectable for tests). */
+export type BoxSsmClient = Pick<SSMClient, 'getParameter'>;
+export interface AwsBoxProvisionerOptions {
+    ec2: BoxEc2Client;
+    ssm: BoxSsmClient;
+}
+export declare class AwsBoxProvisioner implements BoxProvisioner {
+    readonly provider: "aws";
+    private ec2;
+    private ssm;
+    constructor(options: AwsBoxProvisionerOptions);
+    private findInstance;
+    private waitForPublicIp;
+    private ensureSecurityGroup;
+    private resolveImage;
+    ensureBox(spec: BoxSpec): Promise<ProvisionedBox>;
+    destroyBox(name: string): Promise<{
+        destroyed: string[];
+    }>;
+}
+export interface CreateBoxProvisionerOptions {
+    provider: BoxProviderName;
+    /** Required for provider 'hetzner'. */
+    hetzner?: HetznerClient;
+    /** Required for provider 'aws'. */
+    aws?: AwsBoxProvisionerOptions;
+}
+export declare function createBoxProvisioner(options: CreateBoxProvisionerOptions): BoxProvisioner;

package/dist/index.js

@@ -55,7 +55,7 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "./chunk-p6309384.js";
+} from "./chunk-x07dz3sd.js";
 import {
   buildAndPushServerlessImage
 } from "./chunk-0wxyppza.js";
@@ -105,7 +105,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-dpkk640m.js";
+} from "./chunk-xzn0ntr0.js";
 import {
   ABTestManager,
   AI,