@stacksjs/ts-cloud 0.7.96 → 0.7.98

package/dist/{chunk-ws3r73x9.js → chunk-1x4xrdkt.js}

@@ -9,7 +9,7 @@ import {
   step,
   success,
   warn
-} from "./chunk-7jkxqr0b.js";
+} from "./chunk-3g4r09dd.js";
 import {
   AwsBackupClient,
   CloudWatchLogsClient,
@@ -36,7 +36,9 @@ import {
   BACKUP_RUNNER_PATH,
   PANTRY_PROJECT_DIR,
   buildBackupRestoreScript,
+  buildPantryBootstrapScript,
   buildRollbackScript,
+  buildVitessProvisionScript,
   createCloudDriver,
   pgAdminCommand,
   releasePaths,
@@ -45,7 +47,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-80apz7eb.js";
+} from "./chunk-89kbfd6c.js";
 import {
   artifactKey,
   buildCloudFormationTemplate,
@@ -67,7 +69,7 @@ import {
   resolveStatePath,
   setStateDir,
   statePath
-} from "./chunk-hmehkeqx.js";
+} from "./chunk-c6db5m63.js";
 import {
   SSMClient
 } from "./chunk-7m60qnc8.js";
@@ -8375,7 +8377,7 @@ async function deployServerlessApp(config, environment2, opts = {}) {
   }
   if (imageMode) {
     step("Building + pushing container image");
-    const { buildAndPushServerlessImage } = await import("./chunk-ecc6h5nh.js");
+    const { buildAndPushServerlessImage } = await import("./chunk-fmt40tpw.js");
     const built = await buildAndPushServerlessImage({
       app,
       projectRoot,
@@ -39994,6 +39996,64 @@ async function actOnMigration(config6, environment2, uuid, action) {
   return { ...r, uuid };
 }
 
+// src/deploy/dashboard-vitess-provision.ts
+function conflict(config6) {
+  const database = config6.infrastructure?.appDatabase;
+  if (database?.engine && database.engine !== "vitess")
+    return `This project already declares ${database.engine} as its application database.`;
+  const services = config6.infrastructure?.compute?.managedServices;
+  const other = services ? ["mysql", "mariadb", "postgres"].find((engine) => Boolean(services[engine])) : undefined;
+  if (other)
+    return `This server already declares the ${other} database service.`;
+  return;
+}
+function planDashboardVitessProvision(config6, input) {
+  const keyspace = input.keyspace.trim();
+  const username = input.username.trim();
+  const password2 = input.password;
+  const configuredConflict = conflict(config6);
+  if (configuredConflict)
+    throw new Error(configuredConflict);
+  if (!isValidDbIdentifier(keyspace))
+    throw new Error("Keyspace must contain letters, numbers, or underscores and cannot start with a number.");
+  if (!isValidDbIdentifier(username))
+    throw new Error("Username must contain letters, numbers, or underscores and cannot start with a number.");
+  if (password2.length < 16)
+    throw new Error("Password must contain at least 16 characters.");
+  if (input.confirm !== keyspace)
+    throw new Error(`Type "${keyspace}" to confirm Vitess provisioning.`);
+  const service16 = {
+    mode: "cluster",
+    cell: "zone1",
+    keyspaces: [{ name: keyspace, sharded: input.sharded === true }],
+    vtgatePort: 15306,
+    username,
+    password: password2,
+    bindAddress: "127.0.0.1"
+  };
+  return {
+    service: service16,
+    appDatabase: {
+      engine: "vitess",
+      name: keyspace,
+      username,
+      host: "127.0.0.1",
+      port: 15306,
+      ssl: false
+    },
+    commands: [...buildPantryBootstrapScript(), ...buildVitessProvisionScript(service16)]
+  };
+}
+async function provisionVitessFromDashboard(config6, environment2, input) {
+  const plan2 = planDashboardVitessProvision(config6, input);
+  const result2 = await runDb(config6, environment2, plan2.commands, `ts-cloud vitess:provision ${plan2.appDatabase.name}`);
+  return {
+    ...result2,
+    database: plan2.appDatabase,
+    service: Object.fromEntries(Object.entries(plan2.service).filter(([key2]) => key2 !== "password"))
+  };
+}
+
 // src/deploy/dashboard-policy.ts
 var FAIL_CLOSED = {
   capability: "runtime:terminal",
@@ -40235,6 +40295,7 @@ var POLICIES = {
   "GET /api/databases/vitess": { capability: "data:read" },
   "GET /api/databases/vitess/migrations": { capability: "data:read" },
   "POST /api/databases/vitess/migrations/action": { capability: "data:admin" },
+  "POST /api/databases/vitess/provision": { capability: "runtime:terminal", scope: "organization" },
   "POST /api/databases/vitess/keyspaces": { capability: "data:admin" },
   "POST /api/databases/vitess/vschema": { capability: "data:admin" },
   "POST /api/databases/vitess/schema": { capability: "data:admin" },
@@ -43616,6 +43677,9 @@ ${stderr}`);
   }
 }
 function sanitizeCloudConfig(config6) {
+  const managedServices = config6.infrastructure?.compute?.managedServices ? JSON.parse(JSON.stringify(config6.infrastructure.compute.managedServices)) : undefined;
+  if (managedServices?.vitess?.password)
+    managedServices.vitess.password = "";
   return {
     project: {
       name: config6.project?.name,
@@ -43633,7 +43697,7 @@ function sanitizeCloudConfig(config6) {
         onDemandTls: config6.infrastructure.compute.proxy.onDemandTls,
         cdn: !!config6.infrastructure.compute.proxy.cdn
       } : undefined,
-      managedServices: config6.infrastructure.compute.managedServices,
+      managedServices,
       sshKeys: describeSshKeys(computeSshKeys(config6)).map((key2) => ({
         name: key2.name,
         type: key2.type,
@@ -43903,6 +43967,13 @@ async function startLocalDashboardServer(options = {}) {
     process.env.TS_CLOUD_DASHBOARD_BOX = "1";
   await loadLocalEnv(cwd);
   const config6 = options.config ?? await loadCloudConfig();
+  const dashboardDatabasePassword = process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD;
+  const appDatabase = resolveAppDatabase(config6);
+  if (dashboardDatabasePassword && appDatabase && !appDatabase.password)
+    appDatabase.password = dashboardDatabasePassword;
+  const managedVitess = config6.infrastructure?.compute?.managedServices?.vitess;
+  if (dashboardDatabasePassword && managedVitess && typeof managedVitess === "object" && !managedVitess.password)
+    managedVitess.password = dashboardDatabasePassword;
   const controlPlane = initializeDashboardControlPlane(cwd, config6);
   if (controlPlane.reconciliation.failed > 0) {
     console.warn(`  ts-cloud dashboard: marked ${controlPlane.reconciliation.failed} orphaned operation(s) as failed after restart.`);
@@ -46971,14 +47042,14 @@ This replacement link expires ${created.invitation.expiresAt} and can be used on
               const fields = checkMemberSiteFields(body);
               if (!fields.ok)
                 return json15({ ok: false, error: fields.error }, 403);
-              const conflict = checkRouteConflict({
+              const conflict2 = checkRouteConflict({
                 siteName: name,
                 body,
                 sites: config6.sites ?? {},
                 ownSites: Object.keys(scopedUser.sites)
               });
-              if (!conflict.ok)
-                return json15({ ok: false, error: conflict.error }, 409);
+              if (!conflict2.ok)
+                return json15({ ok: false, error: conflict2.error }, 409);
             }
             if (body.port !== undefined && body.port !== null && body.port !== "" && (!Number.isInteger(Number(body.port)) || Number(body.port) < 1 || Number(body.port) > 65535))
               return json15({ ok: false, error: "Port must be a number between 1 and 65535." }, 422);
@@ -49220,6 +49291,20 @@ data: ${JSON.stringify({ cursor: position, at: new Date().toISOString() })}
               missingPrimary: shardsMissingPrimary(topology2)
             });
           }
+          if (url.pathname === "/api/databases/vitess/provision" && req.method === "POST") {
+            const body = await readJsonBody(req);
+            try {
+              return json15(await provisionVitessFromDashboard(config6, environment2, {
+                keyspace: String(body.keyspace ?? ""),
+                username: String(body.username ?? ""),
+                password: String(body.password ?? ""),
+                sharded: body.sharded === true,
+                confirm: String(body.confirm ?? "")
+              }));
+            } catch (error2) {
+              return json15({ ok: false, error: error2 instanceof Error ? error2.message : String(error2) }, 422);
+            }
+          }
           if (url.pathname === "/api/databases/vitess/migrations" && req.method === "GET") {
             const keyspace = url.searchParams.get("keyspace") ?? undefined;
             return json15(await listMigrations(config6, environment2, keyspace));

package/dist/{chunk-7jkxqr0b.js → chunk-3g4r09dd.js}

@@ -8,7 +8,7 @@ import {
   phpRuntimeLayerAssets,
   runPhpBuildHooks,
   sha256
-} from "./chunk-hmehkeqx.js";
+} from "./chunk-c6db5m63.js";
 
 // src/deploy/serverless-image.ts
 import { execFileSync } from "node:child_process";

package/dist/{chunk-80apz7eb.js → chunk-89kbfd6c.js}

@@ -8,7 +8,7 @@ import {
   resolveProjectStackName,
   resolveStatePath,
   statePath
-} from "./chunk-hmehkeqx.js";
+} from "./chunk-c6db5m63.js";
 import {
   EC2Client,
   SSMClient
@@ -2478,7 +2478,7 @@ class AwsDriver {
 }
 
 // src/drivers/hetzner/driver.ts
-import { execSync } from "node:child_process";
+import { execFileSync, execSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { existsSync, readFileSync as readFileSync2 } from "node:fs";
 
@@ -3692,6 +3692,8 @@ class HetznerDriver {
         const pinned = [];
         for (const id of pinnedIds) {
           const server = servers2.find((candidate) => candidate.id === id) ?? await this.tryGetServer(id);
+          if (id === state?.serverId && state.serverName && server?.name !== state.serverName)
+            continue;
           if (server && server.status !== "off")
             pinned.push(server);
         }
@@ -3957,10 +3959,10 @@ ${out}`);
     }
   }
   sshExec(host, script) {
-    const escaped = script.replace(/'/g, `'\\''`);
     try {
-      return execSync(`ssh ${this.sshBaseArgs(host).map((a) => `"${a.replace(/"/g, "\\\"")}"`).join(" ")} '${escaped}'`, {
+      return execFileSync("ssh", [...this.sshBaseArgs(host), "bash -s"], {
         encoding: "utf8",
+        input: script,
         stdio: ["pipe", "pipe", "pipe"],
         maxBuffer: SSH_MAX_BUFFER
       });
@@ -5473,6 +5475,12 @@ function redactForDashboard(config) {
     if (db?.password)
       db.password = "";
   }
+  if (safe.infrastructure?.appDatabase?.password)
+    safe.infrastructure.appDatabase.password = "";
+  if (safe.infrastructure?.compute?.database?.password)
+    safe.infrastructure.compute.database.password = "";
+  if (safe.infrastructure?.compute?.managedServices?.vitess?.password)
+    safe.infrastructure.compute.managedServices.vitess.password = "";
   return safe;
 }
 function serializeDashboardConfig(config) {
@@ -6815,4 +6823,4 @@ function buildCloudFrontOriginConfig(options) {
     CustomErrorResponses: { Quantity: 0 }
   };
 }
-export { collectServerDnsDomains, removeStaleServerAddressRecords, normalizePublicIpv6, IPV6_EXCLUDED_HOST_LABELS, hostAcceptsIpv6, reconcileAddressRecords, verifyAddressRecord, PANTRY_PROJECT_DIR, pgAdminCommand, BACKUP_RUNNER_PATH, buildBackupRestoreScript, siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, shipsARelease, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, planHetznerServerResize, isHetznerCapacityError, executeHetznerServerResize, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, collectHetznerResizeManifest, prepareHetznerResize, verifyHetznerResize, resolveHetznerHostOptimizationPlan, buildHetznerHostOptimizationScript, applyHetznerHostOptimization, collectHetznerHostOptimizationReport, verifyHetznerHostOptimization, resizeCheckpointPath, resizeLockPath, readResizeCheckpoint, writeResizeCheckpoint, acquireResizeLock, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, dashboardCredentialsFile, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };
+export { collectServerDnsDomains, removeStaleServerAddressRecords, normalizePublicIpv6, IPV6_EXCLUDED_HOST_LABELS, hostAcceptsIpv6, reconcileAddressRecords, verifyAddressRecord, PANTRY_PROJECT_DIR, buildPantryBootstrapScript, buildVitessProvisionScript, pgAdminCommand, BACKUP_RUNNER_PATH, buildBackupRestoreScript, siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, shipsARelease, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, planHetznerServerResize, isHetznerCapacityError, executeHetznerServerResize, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, collectHetznerResizeManifest, prepareHetznerResize, verifyHetznerResize, resolveHetznerHostOptimizationPlan, buildHetznerHostOptimizationScript, applyHetznerHostOptimization, collectHetznerHostOptimizationReport, verifyHetznerHostOptimization, resizeCheckpointPath, resizeLockPath, readResizeCheckpoint, writeResizeCheckpoint, acquireResizeLock, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, dashboardCredentialsFile, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };

package/dist/{chunk-hmehkeqx.js → chunk-c6db5m63.js}

@@ -21992,6 +21992,7 @@ function resolveManagementDashboardSites(config, environment, opts) {
     if (!domain)
       return [];
     const port = opts.port ?? deriveManagementDashboardPort(domain);
+    const database2 = config.infrastructure?.appDatabase ?? config.infrastructure?.compute?.database;
     const site = {
       root: opts.uiRoot,
       deploy: "server",
@@ -22002,7 +22003,8 @@ function resolveManagementDashboardSites(config, environment, opts) {
       env: {
         APP_ENV: "production",
         NODE_ENV: "production",
-        TS_CLOUD_DASHBOARD_TELEMETRY: "1"
+        TS_CLOUD_DASHBOARD_TELEMETRY: "1",
+        ...database2?.password ? { TS_CLOUD_DASHBOARD_DB_PASSWORD: database2.password } : {}
       },
       zeroDowntime: false,
       sharedPaths: [DASHBOARD_STATE_DIR],

package/dist/{chunk-ecc6h5nh.js → chunk-fmt40tpw.js}

@@ -1,8 +1,8 @@
 import {
   buildAndPushServerlessImage
-} from "./chunk-7jkxqr0b.js";
+} from "./chunk-3g4r09dd.js";
 import"./chunk-50jpda9q.js";
-import"./chunk-hmehkeqx.js";
+import"./chunk-c6db5m63.js";
 import"./chunk-zqtpg06c.js";
 import"./chunk-v0bahtg2.js";
 export {

package/dist/deploy/dashboard-vitess-provision.d.ts

@@ -0,0 +1,32 @@
+import type { CloudConfig, EnvironmentType, VitessServiceConfig } from '@ts-cloud/core';
+import type { DbRunResult } from './dashboard-database';
+export interface DashboardVitessProvisionInput {
+    keyspace: string;
+    username: string;
+    password: string;
+    sharded?: boolean;
+    confirm: string;
+}
+export interface DashboardVitessProvisionPlan {
+    service: VitessServiceConfig;
+    appDatabase: {
+        engine: 'vitess';
+        name: string;
+        username: string;
+        host: '127.0.0.1';
+        port: 15306;
+        ssl: false;
+    };
+    commands: string[];
+}
+export interface DashboardVitessProvisionResult extends DbRunResult {
+    database: DashboardVitessProvisionPlan['appDatabase'];
+    service: Omit<VitessServiceConfig, 'password'>;
+}
+/**
+ * Build the exact same typed Vitess service consumed by cold-boot provisioning.
+ * The dashboard only supplies the few application-specific values; topology,
+ * bind address, and vtgate port stay on production-safe defaults.
+ */
+export declare function planDashboardVitessProvision(config: CloudConfig, input: DashboardVitessProvisionInput): DashboardVitessProvisionPlan;
+export declare function provisionVitessFromDashboard(config: CloudConfig, environment: EnvironmentType, input: DashboardVitessProvisionInput): Promise<DashboardVitessProvisionResult>;

package/dist/deploy/dashboard-vitess-provision.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/index.js

@@ -30,7 +30,7 @@ import {
   synchronizeDashboardUsers,
   trackDashboardOperation,
   verifyStaticApiOrigin
-} from "../chunk-ws3r73x9.js";
+} from "../chunk-1x4xrdkt.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -44,7 +44,7 @@ import {
 } from "../chunk-ef2dwfrg.js";
 import {
   buildAndPushServerlessImage
-} from "../chunk-7jkxqr0b.js";
+} from "../chunk-3g4r09dd.js";
 import"../chunk-ybcz6sxc.js";
 import"../chunk-01d86gt1.js";
 import"../chunk-50jpda9q.js";
@@ -70,8 +70,8 @@ import {
   siteInstallBase,
   validateDeploymentConfig,
   verifyAddressRecord
-} from "../chunk-80apz7eb.js";
-import"../chunk-hmehkeqx.js";
+} from "../chunk-89kbfd6c.js";
+import"../chunk-c6db5m63.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-hpv68b4a.js";

package/dist/drivers/index.js

@@ -68,8 +68,8 @@ import {
   waitForSsh,
   wrapCloudInitUserData,
   writeResizeCheckpoint
-} from "../chunk-80apz7eb.js";
-import"../chunk-hmehkeqx.js";
+} from "../chunk-89kbfd6c.js";
+import"../chunk-c6db5m63.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-wj3s95p9.js";

package/dist/index.js

@@ -283,7 +283,7 @@ import {
   volumeCapabilities,
   webhookEndpoint,
   zeroCapacity
-} from "./chunk-ws3r73x9.js";
+} from "./chunk-1x4xrdkt.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -297,7 +297,7 @@ import {
 } from "./chunk-ef2dwfrg.js";
 import {
   buildAndPushServerlessImage
-} from "./chunk-7jkxqr0b.js";
+} from "./chunk-3g4r09dd.js";
 import {
   ApplicationAutoScalingClient,
   BedrockClient,
@@ -405,7 +405,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-80apz7eb.js";
+} from "./chunk-89kbfd6c.js";
 import {
   ABTestManager,
   AI,
@@ -819,7 +819,7 @@ import {
   withSecurity,
   withTimeout,
   xrayManager
-} from "./chunk-hmehkeqx.js";
+} from "./chunk-c6db5m63.js";
 import {
   EC2Client,
   SSMClient