@stacksjs/ts-cloud 0.7.90 → 0.7.92

package/dist/{chunk-hcdewpt6.js → chunk-29fwqkb7.js}

@@ -45,7 +45,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-gcehnzty.js";
+} from "./chunk-fbwcv2vf.js";
 import {
   artifactKey,
   buildCloudFormationTemplate,

package/dist/{chunk-gcehnzty.js → chunk-fbwcv2vf.js}

@@ -1347,6 +1347,35 @@ function writeFileHeredoc(path, content, delimiter, mode = "0644") {
     `chmod ${mode} ${path}`
   ];
 }
+function shellSingleQuote(value) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function writeRpxFragment(path, content, delimiter, options) {
+  if (!options.preserveManagementDashboardRoutes)
+    return writeFileHeredoc(path, content, delimiter, "0600");
+  const mergeScript = `
+const { readFileSync, writeFileSync } = require('node:fs')
+const currentPath = process.env.TS_CLOUD_RPX_CURRENT_FRAGMENT
+const candidatePath = process.env.TS_CLOUD_RPX_CANDIDATE_FRAGMENT
+const isDashboard = route => /^(?:dashboard|cloud)\\./i.test(String(route?.to || ''))
+const current = JSON.parse(readFileSync(currentPath, 'utf8'))
+const candidate = JSON.parse(readFileSync(candidatePath, 'utf8'))
+const retained = Array.isArray(current.proxies) ? current.proxies.filter(isDashboard) : []
+const next = Array.isArray(candidate.proxies) ? candidate.proxies.filter(route => !isDashboard(route)) : []
+candidate.proxies = [...next, ...retained]
+writeFileSync(candidatePath, JSON.stringify(candidate, null, 2) + '\\n', { mode: 0o600 })
+`.trim();
+  return [
+    `__tsc_fragment_candidate="$(mktemp "${path}.candidate.XXXXXX")"`,
+    `cat > "$__tsc_fragment_candidate" <<'${delimiter}'`,
+    content,
+    delimiter,
+    'chmod 0600 "$__tsc_fragment_candidate"',
+    `if [ -f ${path} ]; then TS_CLOUD_RPX_CURRENT_FRAGMENT=${path} TS_CLOUD_RPX_CANDIDATE_FRAGMENT="$__tsc_fragment_candidate" ${options.bunBin} -e ${shellSingleQuote(mergeScript)}; fi`,
+    `mv -f "$__tsc_fragment_candidate" ${path}`,
+    `chmod 0600 ${path}`
+  ];
+}
 function rpxCertRenewServiceName(slug) {
   const safeSlug = (slug || "app").replace(/[^a-z0-9._-]+/gi, "-");
   return `rpx-cert-renew-${safeSlug}.service`;
@@ -1459,7 +1488,10 @@ function buildRpxProvisionScript(options) {
     `mv ${RPX_INSTALL_DIR}.next ${RPX_INSTALL_DIR}`,
     `rm -rf ${RPX_INSTALL_DIR}.prev`,
     `ln -sfn ${RPX_INSTALL_DIR}/node_modules ${RPX_DIR}/node_modules`,
-    ...writeFileHeredoc(`${RPX_SITES_DIR}/${slug}.json`, fragment, "TS_CLOUD_RPX_FRAGMENT_EOF", "0600"),
+    ...writeRpxFragment(`${RPX_SITES_DIR}/${slug}.json`, fragment, "TS_CLOUD_RPX_FRAGMENT_EOF", {
+      bunBin,
+      preserveManagementDashboardRoutes: options.preserveManagementDashboardRoutes
+    }),
     ...writeFileHeredoc(RPX_LAUNCHER_PATH, assembler, "TS_CLOUD_RPX_EOF"),
     `${bunBin} build --production --compile --outfile ${RPX_BINARY_PATH}.next ${RPX_LAUNCHER_PATH}`,
     `chmod 0755 ${RPX_BINARY_PATH}.next`,
@@ -1508,7 +1540,10 @@ function buildRpxFragmentRefreshScript(options) {
   return [
     "set -euo pipefail",
     `mkdir -p ${RPX_SITES_DIR}`,
-    ...writeFileHeredoc(`${RPX_SITES_DIR}/${slug}.json`, fragment, "TS_CLOUD_RPX_FRAGMENT_EOF", "0600"),
+    ...writeRpxFragment(`${RPX_SITES_DIR}/${slug}.json`, fragment, "TS_CLOUD_RPX_FRAGMENT_EOF", {
+      bunBin: "/usr/local/bin/bun",
+      preserveManagementDashboardRoutes: options.preserveManagementDashboardRoutes
+    }),
     `systemctl restart ${RPX_SERVICE_NAME}`
   ];
 }
@@ -2649,11 +2684,17 @@ class HetznerDriver {
   sshPublicKeyPath;
   sshUser;
   location;
+  stateOnly;
   waitForBoot;
   bootWait;
   constructor(options = {}) {
+    const apiToken = resolveHetznerApiToken(options.apiToken);
+    this.stateOnly = !options.client && !apiToken && options.allowStateOnly === true;
+    if (!options.client && !apiToken && !this.stateOnly) {
+      throw new Error("Hetzner API token required. Set hetzner.apiToken in cloud.config.ts or HCLOUD_TOKEN / HETZNER_API_TOKEN.");
+    }
     this.client = options.client ?? new HetznerClient({
-      apiToken: resolveHetznerApiToken2(options.apiToken)
+      apiToken: apiToken ?? ""
     });
     const settings = resolveHetznerSettings(undefined, {
       sshPrivateKeyPath: options.sshPrivateKeyPath,
@@ -3259,7 +3300,6 @@ class HetznerDriver {
     return { artifactRef: remotePath };
   }
   async findComputeTargets(options) {
-    const servers = await this.client.listServers();
     const role = options.role || "app";
     const toTarget = (server) => ({
       id: String(server.id),
@@ -3274,25 +3314,48 @@ class HetznerDriver {
       const pinnedIds = [
         ...new Set(role === "app" ? [state?.serverId, ...state?.appServerIds ?? []] : role === "lb" ? [state?.lbServerId] : [state?.servicesServerId])
       ].filter((id) => typeof id === "number");
+      if (this.stateOnly) {
+        if (pinnedIds.length > 0 && state?.publicIp) {
+          return pinnedIds.map((id) => ({
+            id: String(id),
+            name: id === state.serverId ? state.serverName : undefined,
+            publicIp: state.publicIp,
+            publicIpv6: state.publicIpv6,
+            status: "running"
+          }));
+        }
+        if (role !== "app")
+          return [];
+        throw new Error(`Hetzner API token required because '${options.stackName ?? `${options.slug}-${options.environment}`}' has no complete local compute state pin.`);
+      }
+      const servers2 = await this.client.listServers();
       if (pinnedIds.length > 0) {
         const pinned = [];
         for (const id of pinnedIds) {
-          const server = servers.find((candidate) => candidate.id === id) ?? await this.tryGetServer(id);
+          const server = servers2.find((candidate) => candidate.id === id) ?? await this.tryGetServer(id);
           if (server && server.status !== "off")
             pinned.push(server);
         }
         if (pinned.length > 0)
           return pinned.map(toTarget);
       }
+      const exact2 = servers2.filter((server) => matchesTsCloudLabels(server.labels, options.slug, options.environment, role));
+      if (exact2.length > 0)
+        return exact2.map(toTarget);
+      if (role === "app") {
+        const candidates = servers2.filter((server) => server.status !== "off" && server.labels?.[`${TS_CLOUD_LABEL_PREFIX}/managed-by`] === "ts-cloud" && server.labels?.[`${TS_CLOUD_LABEL_PREFIX}/environment`] === options.environment && server.labels?.[`${TS_CLOUD_LABEL_PREFIX}/role`] === "app");
+        if (candidates.length === 1)
+          return candidates.map(toTarget);
+      }
+      return [];
+    }
+    if (this.stateOnly) {
+      throw new Error(`Hetzner API token required to discover '${role}' compute targets.`);
     }
+    const servers = await this.client.listServers();
     const exact = servers.filter((server) => matchesTsCloudLabels(server.labels, options.slug, options.environment, role));
     if (exact.length > 0)
       return exact.map(toTarget);
-    if (role === "app") {
-      const candidates = servers.filter((server) => server.status !== "off" && server.labels?.[`${TS_CLOUD_LABEL_PREFIX}/managed-by`] === "ts-cloud" && server.labels?.[`${TS_CLOUD_LABEL_PREFIX}/environment`] === options.environment && server.labels?.[`${TS_CLOUD_LABEL_PREFIX}/role`] === "app");
-      if (candidates.length === 1)
-        return candidates.map(toTarget);
-    }
     return [];
   }
   async attachToComputeInfrastructure(ownerSlug, config, environment) {
@@ -3604,6 +3667,7 @@ function createCloudDriver(options) {
     case "hetzner":
       return new HetznerDriver({
         apiToken: options.config.hetzner?.apiToken,
+        allowStateOnly: Boolean(options.config.cloud?.attachTo),
         sshPrivateKeyPath: options.config.hetzner?.sshPrivateKeyPath,
         sshPublicKeyPath: options.config.hetzner?.sshPublicKeyPath,
         sshUser: options.config.hetzner?.sshUser,
@@ -5880,16 +5944,16 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
     perInstance: result.perInstance
   };
 }
-function shellSingleQuote(value) {
+function shellSingleQuote2(value) {
   return `'${value.replaceAll("'", "'\\''")}'`;
 }
 function buildManagementDashboardServiceReconciliationScript(slug, desiredSiteNames, serverOwner = false, desiredDomains = []) {
   const prefix = `${slug}-dashboard-`;
   const desiredUnits = desiredSiteNames.map((siteName) => `${slug}-${siteName}.service`);
   const routeReconciliation = serverOwner ? [
-    `export TS_CLOUD_DASHBOARD_KEEP_DOMAINS=${shellSingleQuote(JSON.stringify(desiredDomains))}`,
+    `export TS_CLOUD_DASHBOARD_KEEP_DOMAINS=${shellSingleQuote2(JSON.stringify(desiredDomains))}`,
     "rm -f /run/ts-cloud-dashboard-routes-changed",
-    `/usr/local/bin/bun --bun -e ${shellSingleQuote(`
+    `/usr/local/bin/bun --bun -e ${shellSingleQuote2(`
           const { chmodSync, existsSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync } = require('node:fs')
           const { basename, join } = require('node:path')
           const root = '/etc/rpx/sites.d'
@@ -5925,9 +5989,9 @@ function buildManagementDashboardServiceReconciliationScript(slug, desiredSiteNa
   ] : [];
   return [
     "set -euo pipefail",
-    `TS_CLOUD_DASHBOARD_PREFIX=${shellSingleQuote(prefix)}`,
+    `TS_CLOUD_DASHBOARD_PREFIX=${shellSingleQuote2(prefix)}`,
     `TS_CLOUD_DASHBOARD_SERVER_OWNER=${serverOwner ? "1" : "0"}`,
-    `TS_CLOUD_DASHBOARD_DESIRED=${shellSingleQuote(` ${desiredUnits.join(" ")} `)}`,
+    `TS_CLOUD_DASHBOARD_DESIRED=${shellSingleQuote2(` ${desiredUnits.join(" ")} `)}`,
     "for TS_CLOUD_UNIT_FILE in /etc/systemd/system/*.service; do",
     '  [ -e "$TS_CLOUD_UNIT_FILE" ] || continue',
     '  TS_CLOUD_UNIT=$(basename "$TS_CLOUD_UNIT_FILE")',
@@ -6140,7 +6204,11 @@ async function reloadRpxGateway(options) {
     logger.step(`Reloading the load balancer's rpx gateway with ${lbConfig.proxies.length} route(s)...`);
     const result2 = await driver.runRemoteDeploy({
       targets: lbTargets,
-      commands: buildRpxFragmentRefreshScript({ config: lbConfig, slug }),
+      commands: buildRpxFragmentRefreshScript({
+        config: lbConfig,
+        slug,
+        preserveManagementDashboardRoutes: options.managementDashboard === false
+      }),
       comment: `ts-cloud rpx gateway reload ${slug}`,
       tags: {
         Project: slug,
@@ -6171,7 +6239,12 @@ async function reloadRpxGateway(options) {
     return true;
   }
   logger.step(`Reloading rpx gateway with ${rpxConfig.proxies.length} route(s)...`);
-  const script = buildRpxProvisionScript({ proxy, config: rpxConfig, slug });
+  const script = buildRpxProvisionScript({
+    proxy,
+    config: rpxConfig,
+    slug,
+    preserveManagementDashboardRoutes: options.managementDashboard === false
+  });
   const result = await driver.runRemoteDeploy({
     targets,
     commands: script,

package/dist/deploy/index.js

@@ -30,7 +30,7 @@ import {
   synchronizeDashboardUsers,
   trackDashboardOperation,
   verifyStaticApiOrigin
-} from "../chunk-hcdewpt6.js";
+} from "../chunk-29fwqkb7.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -70,7 +70,7 @@ import {
   siteInstallBase,
   validateDeploymentConfig,
   verifyAddressRecord
-} from "../chunk-gcehnzty.js";
+} from "../chunk-fbwcv2vf.js";
 import"../chunk-hmehkeqx.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";

package/dist/drivers/hetzner/driver.d.ts

@@ -3,6 +3,12 @@ import { HetznerClient } from './client';
 export declare function formatSshFailure(error: unknown): string;
 export interface HetznerDriverOptions {
     apiToken?: string;
+    /**
+     * Permit SSH-only deploy operations to use an existing local state pin when
+     * no provider token is available. Intended for tenants attached to compute
+     * owned and provisioned by another project.
+     */
+    allowStateOnly?: boolean;
     sshPrivateKeyPath?: string;
     sshPublicKeyPath?: string;
     sshUser?: string;
@@ -38,6 +44,7 @@ export declare class HetznerDriver implements CloudDriver {
     private sshPublicKeyPath;
     private sshUser;
     private location;
+    private stateOnly;
     private waitForBoot;
     private bootWait;
     constructor(options?: HetznerDriverOptions);

package/dist/drivers/index.js

@@ -68,7 +68,7 @@ import {
   waitForSsh,
   wrapCloudInitUserData,
   writeResizeCheckpoint
-} from "../chunk-gcehnzty.js";
+} from "../chunk-fbwcv2vf.js";
 import"../chunk-hmehkeqx.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";

package/dist/drivers/shared/rpx-gateway.d.ts

@@ -272,6 +272,8 @@ export interface BuildRpxProvisionOptions {
     slug?: string;
     /** Absolute path to the `bun` binary on the box. @default '/usr/local/bin/bun' */
     bunBin?: string;
+    /** Keep the dashboard route currently running on the box during an app-only deploy. */
+    preserveManagementDashboardRoutes?: boolean;
 }
 export declare const RPX_CERT_RENEW_SCRIPT = "/etc/rpx/renew-certs.sh";
 export declare const RPX_CERT_RENEW_SERVICE = "rpx-cert-renew.service";
@@ -310,6 +312,8 @@ export interface BuildRpxFragmentRefreshOptions {
      * Defaults to `'app'`.
      */
     slug?: string;
+    /** Keep the dashboard route currently running on the box during an app-only deploy. */
+    preserveManagementDashboardRoutes?: boolean;
 }
 /**
  * Build the shell commands that rewrite ONLY this app's rpx route fragment

package/dist/index.js

@@ -283,7 +283,7 @@ import {
   volumeCapabilities,
   webhookEndpoint,
   zeroCapacity
-} from "./chunk-hcdewpt6.js";
+} from "./chunk-29fwqkb7.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -403,7 +403,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-gcehnzty.js";
+} from "./chunk-fbwcv2vf.js";
 import {
   ABTestManager,
   AI,