@stacksjs/ts-cloud 0.7.9 → 0.7.11

package/dist/{chunk-x07dz3sd.js → chunk-1518raqr.js}

@@ -6,7 +6,7 @@ import {
   step,
   success,
   warn
-} from "./chunk-0wxyppza.js";
+} from "./chunk-m03vddvr.js";
 import {
   CloudWatchLogsClient,
   CostExplorerClient,
@@ -26,7 +26,7 @@ import {
   resolveSiteFramework,
   resolveSiteKind,
   resolveUiSource
-} from "./chunk-xzn0ntr0.js";
+} from "./chunk-nw5nnffj.js";
 import {
   artifactKey,
   composeServerlessAppTemplate,
@@ -40,7 +40,7 @@ import {
   resolveServerlessArtifactBucketName,
   resolveServerlessAssetBucketName,
   resolveServerlessRuntime
-} from "./chunk-c6rgvg1j.js";
+} from "./chunk-vsgkcpqw.js";
 import {
   deployStaticSiteWithExternalDnsFull
 } from "./chunk-d7p84vz5.js";
@@ -345,7 +345,7 @@ async function deployServerlessApp(config, environment, opts = {}) {
   }
   if (imageMode) {
     step("Building + pushing container image");
-    const { buildAndPushServerlessImage } = await import("./chunk-pegd7rmf.js");
+    const { buildAndPushServerlessImage } = await import("./chunk-9ra8b9b4.js");
     const built = await buildAndPushServerlessImage({
       app,
       projectRoot,
@@ -8195,6 +8195,7 @@ class Logger3 {
   }
 }
 var logger3 = new Logger3("stacks");
+
 class BunfigError2 extends Error {
   timestamp;
   context;
@@ -11016,7 +11017,7 @@ async function rollbackComputeSite(ctx, options) {
   const paths = releasePaths(appBase, options.to || "unused");
   const commands = [
     "set -uo pipefail",
-    ...buildRollbackScript(paths, options.to ? { to: options.to } : {}),
+    ...buildRollbackScript(paths, { ...options.to ? { to: options.to } : {}, unitBase: `${ctx.slug}-${options.siteName}` }),
     `(cd ${PANTRY_PROJECT_DIR} && pantry restart php-fpm) 2>/dev/null || true`,
     `(cd ${paths.current} && eval "$(cd ${PANTRY_PROJECT_DIR} && pantry env 2>/dev/null)" && php artisan queue:restart) 2>/dev/null || true`
   ];

package/dist/{chunk-pegd7rmf.js → chunk-9ra8b9b4.js}

@@ -1,8 +1,8 @@
 import {
   buildAndPushServerlessImage
-} from "./chunk-0wxyppza.js";
+} from "./chunk-m03vddvr.js";
 import"./chunk-hsk6fe6x.js";
-import"./chunk-c6rgvg1j.js";
+import"./chunk-vsgkcpqw.js";
 import"./chunk-arsh1g5h.js";
 import"./chunk-v0bahtg2.js";
 export {

package/dist/{chunk-0wxyppza.js → chunk-m03vddvr.js}

@@ -8,7 +8,7 @@ import {
   phpRuntimeLayerAssets,
   runPhpBuildHooks,
   sha256
-} from "./chunk-c6rgvg1j.js";
+} from "./chunk-vsgkcpqw.js";
 
 // src/deploy/serverless-image.ts
 import { execFileSync } from "node:child_process";

package/dist/{chunk-xzn0ntr0.js → chunk-nw5nnffj.js}

@@ -1,10 +1,11 @@
 import {
   deploymentCoexistenceError,
   hasManagementDashboardSite,
+  isManagementDashboardSiteName,
   resolveCloudProvider,
-  resolveManagementDashboardSite,
+  resolveManagementDashboardSites,
   resolveProjectStackName
-} from "./chunk-c6rgvg1j.js";
+} from "./chunk-vsgkcpqw.js";
 import {
   EC2Client,
   SSMClient
@@ -194,7 +195,8 @@ function buildDatabaseSetupScript(database, services = {}) {
 function buildManagedDbEnv(database) {
   if (!database?.name)
     return {};
-  const connection = database.engine === "postgres" ? "pgsql" : "mysql";
+  const isSingleStore = database.engine === "singlestore";
+  const connection = database.engine === "postgres" ? "pgsql" : isSingleStore ? "singlestore" : "mysql";
   const port = database.port ?? (database.engine === "postgres" ? 5432 : 3306);
   const env = {
     DB_CONNECTION: connection,
@@ -206,6 +208,8 @@ function buildManagedDbEnv(database) {
     env.DB_USERNAME = database.username;
   if (database.password)
     env.DB_PASSWORD = database.password;
+  if (isSingleStore && database.ssl !== false)
+    env.DB_SSL = "true";
   return env;
 }
 
@@ -3496,15 +3500,11 @@ function buildActivateRelease(paths) {
   ];
 }
 function buildRollbackScript(paths, options = {}) {
-  if (options.to) {
-    const target = `${paths.releases}/${options.to}`;
-    return [
-      `[ -d ${target} ] || { echo "rollback target ${target} not found" >&2; exit 1; }`,
-      `ln -sfn ${target} ${paths.current}.tmp`,
-      `mv -Tf ${paths.current}.tmp ${paths.current}`
-    ];
-  }
-  return [
+  const flip = options.to ? [
+    `[ -d ${paths.releases}/${options.to} ] || { echo "rollback target ${paths.releases}/${options.to} not found" >&2; exit 1; }`,
+    `ln -sfn ${paths.releases}/${options.to} ${paths.current}.tmp`,
+    `mv -Tf ${paths.current}.tmp ${paths.current}`
+  ] : [
     `TS_CLOUD_CURRENT=$(readlink -f ${paths.current} 2>/dev/null || true)`,
     `TS_CLOUD_PREV=$(ls -1dt ${paths.releases}/*/ 2>/dev/null | sed 's#/$##' | while read -r r; do ` + '[ "$(readlink -f "$r")" != "$TS_CLOUD_CURRENT" ] && { echo "$r"; break; }; done)',
     '[ -n "$TS_CLOUD_PREV" ] || { echo "no previous release to roll back to" >&2; exit 1; }',
@@ -3512,6 +3512,14 @@ function buildRollbackScript(paths, options = {}) {
     `mv -Tf ${paths.current}.tmp ${paths.current}`,
     'echo "rolled back to $TS_CLOUD_PREV"'
   ];
+  if (!options.unitBase)
+    return flip;
+  const unitBase = options.unitBase;
+  return [
+    ...flip,
+    `TS_CLOUD_RB_ID=$(basename "$(readlink -f ${paths.current})")`,
+    `if [ -f /etc/systemd/system/${unitBase}@.service ]; then ` + `systemctl start "${unitBase}@\${TS_CLOUD_RB_ID}.service"; sleep 2; ` + `systemctl is-active --quiet "${unitBase}@\${TS_CLOUD_RB_ID}.service" || { echo "rolled-back release failed to start" >&2; exit 1; }; ` + `systemctl enable "${unitBase}@\${TS_CLOUD_RB_ID}.service" 2>/dev/null || true; ` + `systemctl list-units --plain --no-legend --type=service "${unitBase}@*.service" 2>/dev/null | awk '{print $1}' | grep -v "^${unitBase}@\${TS_CLOUD_RB_ID}.service$" | while read -r TS_CLOUD_U; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done; ` + `elif [ -f /etc/systemd/system/${unitBase}.service ]; then systemctl restart ${unitBase}.service; fi`
+  ];
 }
 function buildPruneReleases(paths, keep = DEFAULT_KEEP_RELEASES) {
   const n = Math.max(1, keep);
@@ -3559,15 +3567,19 @@ function buildSiteDeployScript(options) {
     envEntries,
     port,
     keepReleases = DEFAULT_KEEP_RELEASES,
-    preStartCommands = []
+    preStartCommands = [],
+    healthCheckPath,
+    healthGateSeconds = 5
   } = options;
+  const zeroDowntime = options.zeroDowntime ?? port != null;
   const base = options.appDir ?? `/var/www/${siteName}`;
   const paths = releasePaths(base, releaseId);
-  const serviceName = `${slug}-${siteName}.service`;
+  const unitBase = `${slug}-${siteName}`;
+  const serviceName = `${unitBase}.service`;
   const sharedPaths = [".env"];
   const envFile = formatEnvFile(envEntries);
   const preStart = preStartCommands.length > 0 ? [`cd ${paths.release}`, ...preStartCommands] : [];
-  return [
+  const stageRelease = [
     "set -euo pipefail",
     ...artifactFetch,
     ...buildEnsureReleaseLayout(paths, sharedPaths),
@@ -3579,7 +3591,48 @@ function buildSiteDeployScript(options) {
     "TS_CLOUD_ENV_EOF",
     `chmod 600 ${paths.shared}/.env`,
     ...buildLinkSharedPaths(paths, sharedPaths),
-    ...preStart,
+    ...preStart
+  ];
+  if (zeroDowntime && port != null) {
+    const instance = `${unitBase}@${releaseId}.service`;
+    const gatePath = healthCheckPath ? healthCheckPath.startsWith("/") ? healthCheckPath : `/${healthCheckPath}` : null;
+    const failGate = `{ echo "[ts-cloud] release ${releaseId} failed its health gate — previous release keeps serving" >&2; journalctl -u ${instance} -n 50 --no-pager >&2 || true; systemctl stop ${instance} 2>/dev/null || true; exit 1; }`;
+    return [
+      ...stageRelease,
+      `cat > /etc/systemd/system/${unitBase}@.service <<'TS_CLOUD_UNIT_EOF'`,
+      "[Unit]",
+      `Description=${siteName} release %i (managed by ts-cloud)`,
+      "After=network.target",
+      "",
+      "[Service]",
+      "Type=simple",
+      `WorkingDirectory=${paths.releases}/%i`,
+      `ExecStart=${execStart}`,
+      "Restart=always",
+      "RestartSec=5",
+      `EnvironmentFile=${paths.releases}/%i/.env`,
+      `Environment=PORT=${port}`,
+      "",
+      "[Install]",
+      "WantedBy=multi-user.target",
+      "TS_CLOUD_UNIT_EOF",
+      "systemctl daemon-reload",
+      `TS_CLOUD_OLD_UNITS=$(systemctl list-units --plain --no-legend --type=service "${unitBase}@*.service" 2>/dev/null | awk '{print $1}' | grep -v "^${instance}$" || true)`,
+      `if [ -f /etc/systemd/system/${serviceName} ] && systemctl is-active --quiet ${serviceName}; then echo "[ts-cloud] retiring pre-zero-downtime unit ${serviceName} (one-time restart cutover)"; systemctl stop ${serviceName}; fi`,
+      `systemctl start ${instance}`,
+      `TS_CLOUD_GATE_OK=1; for TS_CLOUD_I in $(seq 1 ${Math.max(1, healthGateSeconds)}); do sleep 1; systemctl is-active --quiet ${instance} || { TS_CLOUD_GATE_OK=0; break; }; done`,
+      `if [ "$TS_CLOUD_GATE_OK" -ne 1 ]; then echo "[ts-cloud] release ${releaseId} could not overlap the previous release (no SO_REUSEPORT?) — retiring old instances and retrying" >&2; for TS_CLOUD_RU in \${TS_CLOUD_OLD_UNITS}; do systemctl stop "$TS_CLOUD_RU" 2>/dev/null || true; done; systemctl restart ${instance}; for TS_CLOUD_I in $(seq 1 ${Math.max(1, healthGateSeconds)}); do sleep 1; systemctl is-active --quiet ${instance} || ${failGate}; done; fi`,
+      ...gatePath ? [`curl -sf -o /dev/null --max-time 10 "http://127.0.0.1:${port}${gatePath}" || ${failGate}`] : [],
+      ...buildActivateRelease(paths),
+      `systemctl enable ${instance} 2>/dev/null || true`,
+      `for TS_CLOUD_U in \${TS_CLOUD_OLD_UNITS}; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done`,
+      `systemctl list-unit-files --plain --no-legend "${unitBase}@*.service" 2>/dev/null | awk '{print $1}' | grep -v "^${instance}$" | while read -r TS_CLOUD_U; do systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done`,
+      `if [ -f /etc/systemd/system/${serviceName} ]; then systemctl disable ${serviceName} 2>/dev/null || true; rm -f /etc/systemd/system/${serviceName}; systemctl daemon-reload; fi`,
+      ...buildPruneReleases(paths, keepReleases)
+    ];
+  }
+  return [
+    ...stageRelease,
     `cat > /etc/systemd/system/${serviceName} <<'TS_CLOUD_UNIT_EOF'`,
     "[Unit]",
     `Description=${siteName} (managed by ts-cloud)`,
@@ -3632,6 +3685,11 @@ function buildLocalArtifactFetch(localPath, siteName) {
     `cp "${localPath}" /tmp/${siteName}-release.tar.gz`
   ];
 }
+// src/drivers/shared/compute-deploy.ts
+import { copyFileSync } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { join as join5 } from "node:path";
+
 // src/deploy/management-dashboard.ts
 import { execSync as execSync2 } from "node:child_process";
 import { randomBytes } from "node:crypto";
@@ -3710,7 +3768,7 @@ function ensureManagementDashboard(config, options = {}) {
   const environment = config.environments && Object.keys(config.environments)[0];
   const live = truthy(process.env.TS_CLOUD_UI_LIVE);
   const port = Number(process.env.TS_CLOUD_UI_PORT) || undefined;
-  const resolved = resolveManagementDashboardSite(config, environment ?? "production", {
+  const resolved = resolveManagementDashboardSites(config, environment ?? "production", {
     uiRoot: ui.uiRoot,
     build: ui.build,
     domain: process.env.TS_CLOUD_UI_DOMAIN?.trim() || undefined,
@@ -3720,15 +3778,22 @@ function ensureManagementDashboard(config, options = {}) {
     live,
     port
   });
-  if (!resolved) {
+  if (resolved.length === 0) {
     logger.info("Management dashboard: no domain resolved (set TS_CLOUD_UI_DOMAIN or configure a site domain) — skipping.");
     return config;
   }
-  config.sites = { ...config.sites ?? {}, [resolved.name]: resolved.site };
   const authNote = auth.source === "public" ? "NO AUTH — TS_CLOUD_UI_PUBLIC is set (dashboard is publicly reachable)" : auth.source === "env" ? "htpasswd-protected (TS_CLOUD_UI_PASSWORD)" : `htpasswd-protected (auto-generated — see ${DASHBOARD_CREDENTIALS_FILE})`;
-  logger.info(`Management dashboard → https://${resolved.site.domain} (${authNote})`);
+  const sites = { ...config.sites ?? {} };
+  for (const { name, site } of resolved) {
+    sites[name] = site;
+    logger.info(`Management dashboard → https://${site.domain} (${authNote})`);
+  }
+  config.sites = sites;
   return config;
 }
+function managementDashboardSiteNames(config) {
+  return Object.keys(config.sites ?? {}).filter(isManagementDashboardSiteName);
+}
 function buildManagementDashboardArtifact(site, options) {
   if (!site?.root)
     return null;
@@ -4367,7 +4432,9 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
     execStart: resolveExecStart(site.start, runtime),
     envEntries: site.env || {},
     port: site.port,
-    preStartCommands: site.preStart
+    preStartCommands: site.preStart,
+    zeroDowntime: site.zeroDowntime !== false,
+    healthCheckPath: site.healthCheck?.path
   });
   const compute = config.infrastructure?.compute;
   const wantsNginxStatic = kind === "server-static" && compute?.webServer !== "rpx" && !!site.domain;
@@ -4430,16 +4497,33 @@ async function deployAllComputeSites(options) {
   const cwd = options.cwd ?? process.cwd();
   const hadDashboard = hasManagementDashboardSite(config);
   ensureManagementDashboard(config, { cwd, logger: { info: logger.info, warn: logger.warn } });
-  const injectedDashboard = !hadDashboard && hasManagementDashboardSite(config);
+  const injectedDashboardSites = hadDashboard ? [] : managementDashboardSiteNames(config);
   if (options.rpxConfig && options.rpxConfig !== config && !hasManagementDashboardSite(options.rpxConfig))
     ensureManagementDashboard(options.rpxConfig, { cwd, logger: { info: () => {}, warn: () => {} } });
   let dashboardTarball = null;
-  if (injectedDashboard) {
-    dashboardTarball = buildManagementDashboardArtifact(config.sites?.[MANAGEMENT_DASHBOARD_SITE], { cwd, slug, sha, logger: { info: logger.info, warn: logger.warn } });
+  const dashboardTarballBySite = new Map;
+  if (injectedDashboardSites.length > 0) {
+    dashboardTarball = buildManagementDashboardArtifact(config.sites?.[injectedDashboardSites[0]], { cwd, slug, sha, logger: { info: logger.info, warn: logger.warn } });
     if (!dashboardTarball) {
-      logger.warn("Management dashboard: no artifact available — skipping dashboard site for this deploy.");
-      if (config.sites)
-        delete config.sites[MANAGEMENT_DASHBOARD_SITE];
+      logger.warn("Management dashboard: no artifact available — skipping dashboard site(s) for this deploy.");
+      for (const name of injectedDashboardSites) {
+        if (config.sites)
+          delete config.sites[name];
+      }
+    } else {
+      for (const name of injectedDashboardSites) {
+        if (name === MANAGEMENT_DASHBOARD_SITE) {
+          dashboardTarballBySite.set(name, dashboardTarball);
+          continue;
+        }
+        try {
+          const copy = join5(tmpdir2(), `${slug}-${name}-${sha}.tar.gz`);
+          copyFileSync(dashboardTarball, copy);
+          dashboardTarballBySite.set(name, copy);
+        } catch {
+          dashboardTarballBySite.set(name, dashboardTarball);
+        }
+      }
     }
   }
   const sites = config.sites || {};
@@ -4457,7 +4541,7 @@ async function deployAllComputeSites(options) {
   });
   if (deployable.length === 0)
     return true;
-  const tarballFor = (siteName) => siteName === MANAGEMENT_DASHBOARD_SITE && dashboardTarball ? dashboardTarball : tarballForSite(siteName);
+  const tarballFor = (siteName) => dashboardTarballBySite.get(siteName) ?? tarballForSite(siteName);
   for (const [siteName, site] of deployable) {
     logger.step(`Deploying site: ${siteName}`);
     const localTarballPath = isPhpSite(site) ? undefined : tarballFor(siteName);

package/dist/{chunk-c6rgvg1j.js → chunk-vsgkcpqw.js}

@@ -21905,27 +21905,44 @@ function apexOf(domain) {
   const parts = domain.split(".").filter(Boolean);
   return parts.length <= 2 ? domain : parts.slice(-2).join(".");
 }
-function resolveDashboardDomain(config, environment, explicit) {
-  if (explicit)
-    return explicit;
+function collectDomains(config, environment) {
   const candidates = [];
+  const dnsDomain = config.infrastructure?.dns?.domain;
+  if (dnsDomain)
+    candidates.push(dnsDomain);
+  if (environment && config.environments?.[environment]?.domain)
+    candidates.push(config.environments[environment].domain);
   for (const site of Object.values(config.sites ?? {})) {
-    const d = site?.domain;
+    const s = site;
+    if (!s || s.redirect)
+      continue;
+    const d = s.domain;
     if (typeof d === "string")
       candidates.push(d);
     else if (Array.isArray(d))
       candidates.push(...d.filter((x) => typeof x === "string"));
   }
-  if (environment && config.environments?.[environment]?.domain)
-    candidates.push(config.environments[environment].domain);
-  const dnsDomain = config.infrastructure?.dns?.domain;
-  if (dnsDomain)
-    candidates.push(dnsDomain);
-  const base = candidates.find((d) => d && !d.startsWith("dashboard."));
+  return candidates.filter((d) => d && !d.startsWith("dashboard."));
+}
+function resolveDashboardDomain(config, environment, explicit) {
+  if (explicit)
+    return explicit;
+  const base = collectDomains(config, environment)[0];
   if (!base)
     return null;
   return `dashboard.${apexOf(base)}`;
 }
+function resolveDashboardDomains(config, environment, explicit) {
+  if (explicit)
+    return [explicit];
+  const apexes = [];
+  for (const d of collectDomains(config, environment)) {
+    const apex = apexOf(d);
+    if (!apexes.includes(apex))
+      apexes.push(apex);
+  }
+  return apexes.map((apex) => `dashboard.${apex}`);
+}
 function hasManagementDashboardSite(config) {
   return Object.entries(config.sites ?? {}).some(([name, site]) => {
     if (!site)
@@ -21934,37 +21951,53 @@ function hasManagementDashboardSite(config) {
     return name === "dashboard" || root === "ui/dist" || root.endsWith("/ui/dist") || root.endsWith("/dist/ui");
   });
 }
-function resolveManagementDashboardSite(config, environment, opts) {
+var MANAGEMENT_DASHBOARD_SITE_PREFIX = "dashboard-";
+function dashboardSiteName(domain, primary) {
+  if (primary)
+    return "dashboard";
+  return MANAGEMENT_DASHBOARD_SITE_PREFIX + domain.replace(/^dashboard\./, "").replace(/\./g, "-");
+}
+function isManagementDashboardSiteName(name) {
+  return name === "dashboard" || name.startsWith(MANAGEMENT_DASHBOARD_SITE_PREFIX);
+}
+function resolveManagementDashboardSites(config, environment, opts) {
   if (hasManagementDashboardSite(config))
-    return null;
-  const domain = resolveDashboardDomain(config, environment, opts.domain);
-  if (!domain)
-    return null;
+    return [];
   const auth2 = opts.password ? { auth: { username: opts.username || "admin", password: opts.password, realm: opts.realm } } : {};
+  const build = opts.build === false || opts.build === undefined ? {} : { build: opts.build };
   if (opts.live) {
+    const domain = resolveDashboardDomain(config, environment, opts.domain);
+    if (!domain)
+      return [];
     const port = opts.port ?? 7676;
-    const site2 = {
+    const site = {
       root: opts.uiRoot,
       deploy: "server",
       domain,
       start: `cloud dashboard:serve --box --host 127.0.0.1 --port ${port}`,
       port,
       ssl: { provider: "letsencrypt" },
-      ...opts.build === false || opts.build === undefined ? {} : { build: opts.build },
+      ...build,
       ...auth2
     };
-    return { name: "dashboard", site: site2 };
+    return [{ name: "dashboard", site }];
   }
-  const site = {
-    root: opts.uiRoot,
-    deploy: "server",
-    type: "static",
-    domain,
-    ssl: { provider: "letsencrypt" },
-    ...opts.build === false || opts.build === undefined ? {} : { build: opts.build },
-    ...auth2
-  };
-  return { name: "dashboard", site };
+  const domains = resolveDashboardDomains(config, environment, opts.domain);
+  return domains.map((domain, i) => ({
+    name: dashboardSiteName(domain, i === 0),
+    site: {
+      root: opts.uiRoot,
+      deploy: "server",
+      type: "static",
+      domain,
+      ssl: { provider: "letsencrypt" },
+      ...build,
+      ...auth2
+    }
+  }));
+}
+function resolveManagementDashboardSite(config, environment, opts) {
+  return resolveManagementDashboardSites(config, environment, opts)[0] ?? null;
 }
 function deepMerge(target, source) {
   const result = { ...target };
@@ -46121,4 +46154,4 @@ class ResourceManagementManager {
 }
 var resourceManagementManager = new ResourceManagementManager;
 
-export { detectServiceRegion, signRequest, signRequestAsync, createPresignedUrl, createPresignedUrlAsync, makeAWSRequest, makeAWSRequestOnce, makeAWSRequestAsync, parseXMLResponse, parseJSONResponse, clearSigningKeyCache, getSigningKeyCacheSize, isNodeCryptoAvailable, isWebCryptoAvailable, QueuePresets, RealtimePresets, detectDeploymentTargets, resolveDeploymentMode, deploymentCoexistenceError, resolveCloudProvider, TemplateBuilder, Pseudo, generateResourceName, generateLogicalId, getTimestamp, sanitizeName, resolveProjectStackName, resolveSiteStackName, resolveSiteResourceName, resolveSiteBucketName, resolveStorageBucketName, resolveDeployBucketName, resolveServerlessAppStackName, resolveServerlessArtifactBucketName, resolveServerlessAssetBucketName, DependencyGraph, analyzeStackDiff, formatDiff, Storage, Registry, CDN, DNS, Security, Compute, Network, FileSystem, Email, exports_incoming_call, Phone, Queue, JobLoader, StacksIntegration, exports_send, SMS, AI, Database, Cache, Permissions, ApiGateway, Messaging, Workflow, Monitoring, Auth, Deployment, AssetHasher, Secrets, ParameterStore, Search, Redirects, Communication, Fn2, Arn, AWS_PSEUDO_PARAMETERS, CloudFormationBuilder, buildCloudFormationTemplate, createStaticSitePreset, createNodeJsServerPreset, createNodeJsServerlessPreset, createServerlessNodePreset, createFullStackAppPreset, createApiBackendPreset, createWordPressPreset, createJamstackPreset, createMicroservicesPreset, createRealtimeAppPreset, createDataPipelinePreset, createMLApiPreset, createTraditionalWebAppPreset, createLaravelPreset, createServerlessLaravelPreset, createDashboardSite, resolveDashboardDomain, hasManagementDashboardSite, resolveManagementDashboardSite, extendPreset, composePresets, createPreset, mergeInfrastructure, withMonitoring, withSecurity, withDatabase, withCache, withCDN, withQueue, fromEnvironment, fromSharedCredentials, fromEC2Metadata, fromECSMetadata, fromWebIdentity, getCredentials, createCredentialProvider, resolveCredentials, resolveRegion, getAccountId, S3Error, createS3Client, CloudError, ConfigurationError, CredentialError, DeploymentError, ValidationError, AWSAPIError, ErrorCodes, getErrorDetails, createError, DebugLogger, validateConfiguration, detectMisconfigurations, validateCredentials, checkIAMPermissions, getRequiredPermissions, suggestIAMPolicy, DEFAULT_SERVICE_LIMITS, checkServiceQuotas, getQuotaUsageSummary, suggestQuotaIncrease, FileCache, TemplateCache, templateCache, hashFile, hashString, hashBuffer, hashDirectory, hashManifest, quickHash, findChangedFiles, HashCache, parallel, batch, parallelMap, parallelWithRetry, sequence, withTimeout, RateLimiter, chunk, processInChunks, diffTemplates, getDiffSummary, requiresReplacement, categorizeChanges, getDeploymentStrategy, getDiffStats, cloud_config_schema_default, validateAgainstSchema, defaultLocalConfig, getLocalConfig, isLocalDevelopment, getLocalEndpoint, getLocalCredentials, getLocalEnvVars, MockCloudFormation, MockS3, MockDynamoDB, createMockAWS, PreviewEnvironmentManager, previewManager, generatePreviewWorkflow, generateCleanupWorkflow, generateCostReportWorkflow, PreviewNotificationService, previewNotifications, formatTable, formatTree, formatProgressBar, formatBytes, formatDuration, formatList, formatKeyValue, ProgressBar, MultiStepProgress, Spinner, TaskList, suggestCommand, formatSuggestion, isLikelyTypo, getContextualHelp, searchCommands, autocomplete, suggestFlags, formatFlagSuggestions, getCommandUsage, validateCommand, REPL, REPLContext, REPLCommandBuilder, CommandHistory, formatHistory, formatHistoryStats, MultiRegionManager, multiRegionManager, CrossRegionReferenceManager, GlobalResourceManager, RegionPairManager, StackDependencyManager, crossRegionReferenceManager, globalResourceManager, regionPairManager, stackDependencyManager, AWS_REGIONS, getRegion, getAllRegions, getRegionsByLocation, getRegionsByCompliance, getRegionsByPricingTier, isValidRegion, getClosestRegion, suggestRegions, suggestRegionPairs, formatRegion, formatRegionList, getRegionStats, MultiAccountManager, OrganizationManager, multiAccountManager, organizationManager, RECOMMENDED_ACCOUNT_STRUCTURES, RECOMMENDED_SCPS, COMMON_CROSS_ACCOUNT_ROLES, getRecommendedStructure, generateCrossAccountRoleCF, validateAccountStructure, formatAccountStructure, generateDeploymentWorkflow, generateMultiEnvWorkflow, generatePRPreviewWorkflow, generateScheduledWorkflow, generateMatrixWorkflow, generateDeploymentPipeline, generateMultiEnvPipeline, generatePreviewPipeline, generateScheduledPipeline, generateManualPipeline, generateDeploymentConfig, generateMultiEnvConfig, generateScheduledConfig, generateApprovalConfig, generateParallelConfig, BackupManager, backupManager, DisasterRecoveryManager, drManager, AWSConfigManager, awsConfigManager, CloudTrailManager, cloudTrailManager, GuardDutyManager, guardDutyManager, SecurityHubManager, securityHubManager, BlueGreenManager, blueGreenManager, CanaryManager, canaryManager, ABTestManager, abTestManager, ProgressiveDeploymentManager, progressiveDeploymentManager, XRayManager, xrayManager, MetricsManager, metricsManager, LogsManager, logsManager, SyntheticsManager, syntheticsManager, MigrationManager, migrationManager, ReplicaManager, replicaManager, PerformanceManager, performanceManager, DatabaseUserManager, databaseUserManager, SecretsRotationManager, secretsRotationManager, SecretsManager, secretsManager, CertificateManager, certificateManager, SecurityScanningManager, securityScanningManager, ImageScanningManager, imageScanningManager, BuildOptimizationManager, buildOptimizationManager, ContainerRegistryManager, containerRegistryManager, ServiceMeshManager, serviceMeshManager, LambdaLayersManager, lambdaLayersManager, LambdaVersionsManager, lambdaVersionsManager, LambdaConcurrencyManager, lambdaConcurrencyManager, LambdaDestinationsManager, lambdaDestinationsManager, LambdaVPCManager, lambdaVPCManager, LambdaDLQManager, lambdaDLQManager, Route53RoutingManager, route53RoutingManager, DNSSECManager, dnssecManager, Route53ResolverManager, route53ResolverManager, BounceComplaintHandler, bounceComplaintHandler, EmailAnalyticsManager, emailAnalyticsManager, SenderReputationManager, senderReputationManager, EmailTemplateManager, emailTemplateManager, exports_advanced, exports_inbound, exports_advanced2, exports_advanced3, FIFOQueueManager, fifoQueueManager, DLQMonitoringManager, dlqMonitoringManager, BatchProcessingManager, batchProcessingManager, QueueManagementManager, queueManagementManager, createZip, generateBootstrap, runBuildHooks, sha256, artifactKey, packageServerlessApp, MANAGED_NODE_VERSIONS, resolveServerlessRuntime, resolveQueues, resolveQueueNames, composeServerlessAppTemplate, PHP_LAYER_EXTENSIONS, phpLayerPackages, phpLayerBuildStage, generatePhpLayerDockerfile, generateAppImageDockerfile, sharedRuntimeLoop, buildNodeRuntimeLayerZip, buildBunRuntimeLayerZip, resolveApp, eventToRequest, responseToResult, createHttpHandler, createQueueHandler, createCliHandler, createHandlers, generatePhpFpmConfig, phpRuntimeLayerAssets, laravelServerlessEnvDefaults, LARAVEL_SERVERLESS_BUILD_STEPS, buildPhpRuntimeLayerZip, PHP_DEFAULT_EXCLUDES, runPhpBuildHooks, collectPhpAppEntries, packagePhpApp, StaticSiteManager, staticSiteManager, StorageAdvancedManager, storageAdvancedManager, HealthCheckManager, healthCheckManager, NetworkSecurityManager, networkSecurityManager, ResourceManagementManager, resourceManagementManager };
+export { detectServiceRegion, signRequest, signRequestAsync, createPresignedUrl, createPresignedUrlAsync, makeAWSRequest, makeAWSRequestOnce, makeAWSRequestAsync, parseXMLResponse, parseJSONResponse, clearSigningKeyCache, getSigningKeyCacheSize, isNodeCryptoAvailable, isWebCryptoAvailable, QueuePresets, RealtimePresets, detectDeploymentTargets, resolveDeploymentMode, deploymentCoexistenceError, resolveCloudProvider, TemplateBuilder, Pseudo, generateResourceName, generateLogicalId, getTimestamp, sanitizeName, resolveProjectStackName, resolveSiteStackName, resolveSiteResourceName, resolveSiteBucketName, resolveStorageBucketName, resolveDeployBucketName, resolveServerlessAppStackName, resolveServerlessArtifactBucketName, resolveServerlessAssetBucketName, DependencyGraph, analyzeStackDiff, formatDiff, Storage, Registry, CDN, DNS, Security, Compute, Network, FileSystem, Email, exports_incoming_call, Phone, Queue, JobLoader, StacksIntegration, exports_send, SMS, AI, Database, Cache, Permissions, ApiGateway, Messaging, Workflow, Monitoring, Auth, Deployment, AssetHasher, Secrets, ParameterStore, Search, Redirects, Communication, Fn2, Arn, AWS_PSEUDO_PARAMETERS, CloudFormationBuilder, buildCloudFormationTemplate, createStaticSitePreset, createNodeJsServerPreset, createNodeJsServerlessPreset, createServerlessNodePreset, createFullStackAppPreset, createApiBackendPreset, createWordPressPreset, createJamstackPreset, createMicroservicesPreset, createRealtimeAppPreset, createDataPipelinePreset, createMLApiPreset, createTraditionalWebAppPreset, createLaravelPreset, createServerlessLaravelPreset, createDashboardSite, resolveDashboardDomain, resolveDashboardDomains, hasManagementDashboardSite, MANAGEMENT_DASHBOARD_SITE_PREFIX, isManagementDashboardSiteName, resolveManagementDashboardSites, resolveManagementDashboardSite, extendPreset, composePresets, createPreset, mergeInfrastructure, withMonitoring, withSecurity, withDatabase, withCache, withCDN, withQueue, fromEnvironment, fromSharedCredentials, fromEC2Metadata, fromECSMetadata, fromWebIdentity, getCredentials, createCredentialProvider, resolveCredentials, resolveRegion, getAccountId, S3Error, createS3Client, CloudError, ConfigurationError, CredentialError, DeploymentError, ValidationError, AWSAPIError, ErrorCodes, getErrorDetails, createError, DebugLogger, validateConfiguration, detectMisconfigurations, validateCredentials, checkIAMPermissions, getRequiredPermissions, suggestIAMPolicy, DEFAULT_SERVICE_LIMITS, checkServiceQuotas, getQuotaUsageSummary, suggestQuotaIncrease, FileCache, TemplateCache, templateCache, hashFile, hashString, hashBuffer, hashDirectory, hashManifest, quickHash, findChangedFiles, HashCache, parallel, batch, parallelMap, parallelWithRetry, sequence, withTimeout, RateLimiter, chunk, processInChunks, diffTemplates, getDiffSummary, requiresReplacement, categorizeChanges, getDeploymentStrategy, getDiffStats, cloud_config_schema_default, validateAgainstSchema, defaultLocalConfig, getLocalConfig, isLocalDevelopment, getLocalEndpoint, getLocalCredentials, getLocalEnvVars, MockCloudFormation, MockS3, MockDynamoDB, createMockAWS, PreviewEnvironmentManager, previewManager, generatePreviewWorkflow, generateCleanupWorkflow, generateCostReportWorkflow, PreviewNotificationService, previewNotifications, formatTable, formatTree, formatProgressBar, formatBytes, formatDuration, formatList, formatKeyValue, ProgressBar, MultiStepProgress, Spinner, TaskList, suggestCommand, formatSuggestion, isLikelyTypo, getContextualHelp, searchCommands, autocomplete, suggestFlags, formatFlagSuggestions, getCommandUsage, validateCommand, REPL, REPLContext, REPLCommandBuilder, CommandHistory, formatHistory, formatHistoryStats, MultiRegionManager, multiRegionManager, CrossRegionReferenceManager, GlobalResourceManager, RegionPairManager, StackDependencyManager, crossRegionReferenceManager, globalResourceManager, regionPairManager, stackDependencyManager, AWS_REGIONS, getRegion, getAllRegions, getRegionsByLocation, getRegionsByCompliance, getRegionsByPricingTier, isValidRegion, getClosestRegion, suggestRegions, suggestRegionPairs, formatRegion, formatRegionList, getRegionStats, MultiAccountManager, OrganizationManager, multiAccountManager, organizationManager, RECOMMENDED_ACCOUNT_STRUCTURES, RECOMMENDED_SCPS, COMMON_CROSS_ACCOUNT_ROLES, getRecommendedStructure, generateCrossAccountRoleCF, validateAccountStructure, formatAccountStructure, generateDeploymentWorkflow, generateMultiEnvWorkflow, generatePRPreviewWorkflow, generateScheduledWorkflow, generateMatrixWorkflow, generateDeploymentPipeline, generateMultiEnvPipeline, generatePreviewPipeline, generateScheduledPipeline, generateManualPipeline, generateDeploymentConfig, generateMultiEnvConfig, generateScheduledConfig, generateApprovalConfig, generateParallelConfig, BackupManager, backupManager, DisasterRecoveryManager, drManager, AWSConfigManager, awsConfigManager, CloudTrailManager, cloudTrailManager, GuardDutyManager, guardDutyManager, SecurityHubManager, securityHubManager, BlueGreenManager, blueGreenManager, CanaryManager, canaryManager, ABTestManager, abTestManager, ProgressiveDeploymentManager, progressiveDeploymentManager, XRayManager, xrayManager, MetricsManager, metricsManager, LogsManager, logsManager, SyntheticsManager, syntheticsManager, MigrationManager, migrationManager, ReplicaManager, replicaManager, PerformanceManager, performanceManager, DatabaseUserManager, databaseUserManager, SecretsRotationManager, secretsRotationManager, SecretsManager, secretsManager, CertificateManager, certificateManager, SecurityScanningManager, securityScanningManager, ImageScanningManager, imageScanningManager, BuildOptimizationManager, buildOptimizationManager, ContainerRegistryManager, containerRegistryManager, ServiceMeshManager, serviceMeshManager, LambdaLayersManager, lambdaLayersManager, LambdaVersionsManager, lambdaVersionsManager, LambdaConcurrencyManager, lambdaConcurrencyManager, LambdaDestinationsManager, lambdaDestinationsManager, LambdaVPCManager, lambdaVPCManager, LambdaDLQManager, lambdaDLQManager, Route53RoutingManager, route53RoutingManager, DNSSECManager, dnssecManager, Route53ResolverManager, route53ResolverManager, BounceComplaintHandler, bounceComplaintHandler, EmailAnalyticsManager, emailAnalyticsManager, SenderReputationManager, senderReputationManager, EmailTemplateManager, emailTemplateManager, exports_advanced, exports_inbound, exports_advanced2, exports_advanced3, FIFOQueueManager, fifoQueueManager, DLQMonitoringManager, dlqMonitoringManager, BatchProcessingManager, batchProcessingManager, QueueManagementManager, queueManagementManager, createZip, generateBootstrap, runBuildHooks, sha256, artifactKey, packageServerlessApp, MANAGED_NODE_VERSIONS, resolveServerlessRuntime, resolveQueues, resolveQueueNames, composeServerlessAppTemplate, PHP_LAYER_EXTENSIONS, phpLayerPackages, phpLayerBuildStage, generatePhpLayerDockerfile, generateAppImageDockerfile, sharedRuntimeLoop, buildNodeRuntimeLayerZip, buildBunRuntimeLayerZip, resolveApp, eventToRequest, responseToResult, createHttpHandler, createQueueHandler, createCliHandler, createHandlers, generatePhpFpmConfig, phpRuntimeLayerAssets, laravelServerlessEnvDefaults, LARAVEL_SERVERLESS_BUILD_STEPS, buildPhpRuntimeLayerZip, PHP_DEFAULT_EXCLUDES, runPhpBuildHooks, collectPhpAppEntries, packagePhpApp, StaticSiteManager, staticSiteManager, StorageAdvancedManager, storageAdvancedManager, HealthCheckManager, healthCheckManager, NetworkSecurityManager, networkSecurityManager, ResourceManagementManager, resourceManagementManager };

package/dist/deploy/index.js

@@ -12,10 +12,10 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "../chunk-x07dz3sd.js";
+} from "../chunk-1518raqr.js";
 import {
   buildAndPushServerlessImage
-} from "../chunk-0wxyppza.js";
+} from "../chunk-m03vddvr.js";
 import"../chunk-b82pbxyp.js";
 import"../chunk-hsk6fe6x.js";
 import {
@@ -29,8 +29,8 @@ import {
   resolveSiteKind,
   resolveUiSource,
   validateDeploymentConfig
-} from "../chunk-xzn0ntr0.js";
-import"../chunk-c6rgvg1j.js";
+} from "../chunk-nw5nnffj.js";
+import"../chunk-vsgkcpqw.js";
 import"../chunk-93hjhs78.js";
 import {
   deleteStaticSite,

package/dist/deploy/management-dashboard.d.ts

@@ -62,6 +62,8 @@ export declare function ensureManagementDashboard(config: CloudConfig, options?:
     cwd?: string;
     logger?: EnsureDashboardLogger;
 }): CloudConfig;
+/** Names of the management-dashboard sites currently present in `config`. */
+export declare function managementDashboardSiteNames(config: CloudConfig): string[];
 export interface BuildDashboardArtifactOptions {
     cwd?: string;
     slug: string;

package/dist/drivers/index.js

@@ -48,8 +48,8 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "../chunk-xzn0ntr0.js";
-import"../chunk-c6rgvg1j.js";
+} from "../chunk-nw5nnffj.js";
+import"../chunk-vsgkcpqw.js";
 import"../chunk-93hjhs78.js";
 import"../chunk-qpj3edwz.js";
 import"../chunk-vd87cpvn.js";

package/dist/drivers/shared/db-provision.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/drivers/shared/deploy-script.d.ts

@@ -25,13 +25,47 @@ export interface BuildSiteDeployScriptOptions {
      * `node_modules`.
      */
     preStartCommands?: string[];
+    /**
+     * True zero-downtime cutover for ported sites: the new release runs as its
+     * own systemd instance (`<slug>-<site>@<releaseId>`) that binds the same
+     * port via SO_REUSEPORT while the old instance still serves, must pass a
+     * health gate, and only then is the old instance stopped. A release that
+     * crashes on boot fails the deploy with the old release still serving.
+     *
+     * Requires the app to bind with `reusePort` (Stacks' server does in
+     * production). Defaults to true when `port` is set; portless sites
+     * (queue workers, schedulers) always use the stop/start flow because two
+     * overlapping instances would double-process their work.
+     */
+    zeroDowntime?: boolean;
+    /**
+     * HTTP path polled on `127.0.0.1:<port>` as part of the health gate (e.g.
+     * `/health`). Optional — without it the gate is "the instance stays
+     * active for {@link BuildSiteDeployScriptOptions.healthGateSeconds}".
+     */
+    healthCheckPath?: string;
+    /**
+     * Seconds the new instance must stay active (and, with
+     * {@link BuildSiteDeployScriptOptions.healthCheckPath}, respond 2xx/3xx)
+     * before the old instance is stopped.
+     * @default 5
+     */
+    healthGateSeconds?: number;
 }
 /**
  * Build the remote shell commands that install/refresh a server-app site on a
- * compute target with a **zero-downtime atomic release** (Envoyer-style): unpack
- * into `releases/<id>`, link the shared `.env`, build, then atomically repoint
- * `current` and restart the systemd service (which runs from `current`). Old
- * releases are pruned for rollback.
+ * compute target with an atomic release (Envoyer-style): unpack into
+ * `releases/<id>`, link the shared `.env`, build, then cut over.
+ *
+ * The cutover has two modes:
+ * - **zero-downtime** (default for ported sites): the new release starts as a
+ *   templated systemd instance that shares the port via SO_REUSEPORT with the
+ *   still-running old instance, must pass a health gate, and only then does
+ *   the old instance stop — no dropped connections, and a crash-on-boot
+ *   release fails the deploy with the old one still serving.
+ * - **restart** (portless sites, or `zeroDowntime: false`): the classic flip
+ *   `current` + `systemctl restart` — correct for workers/schedulers where two
+ *   overlapping instances would double-process work.
  */
 export declare function buildSiteDeployScript(options: BuildSiteDeployScriptOptions): string[];
 export interface BuildStaticSiteDeployScriptOptions {

package/dist/drivers/shared/releases.d.ts

@@ -58,11 +58,19 @@ export declare function buildActivateRelease(paths: ReleasePaths): string[];
  * `to` set, points `current` at `releases/<to>`; otherwise picks the most recent
  * release that isn't the one `current` resolves to. Atomic (temp symlink + `mv
  * -T`), and a no-op-safe guard fails loudly if the target is missing rather than
- * leaving `current` dangling. The caller appends the engine reload
- * (php-fpm/queues) — see {@link import('./laravel-deploy')}.
+ * leaving `current` dangling.
+ *
+ * With `unitBase` set (e.g. `myapp-api`), the script also swaps the running
+ * systemd release instance for sites deployed zero-downtime style (templated
+ * `<unitBase>@<releaseId>` units pinned to their release dirs): it starts the
+ * instance for the rolled-back release — overlapping on the SO_REUSEPORT port —
+ * then stops the newer one, so even the rollback itself is zero-downtime. Sites
+ * on the legacy single unit just get a restart. The caller appends any engine
+ * reload (php-fpm/queues) — see {@link import('./laravel-deploy')}.
  */
 export declare function buildRollbackScript(paths: ReleasePaths, options?: {
     to?: string;
+    unitBase?: string;
 }): string[];
 /**
  * Remove all but the newest `keep` releases (by mtime). `current` always points