@stacksjs/ts-cloud 0.8.0 → 0.8.2

package/dist/{chunk-grp3evq3.js → chunk-wxhrr03r.js}

@@ -50,7 +50,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-bfzhz2ed.js";
+} from "./chunk-x6137d59.js";
 import {
   SSMClient
 } from "./chunk-7m60qnc8.js";

package/dist/{chunk-bfzhz2ed.js → chunk-x6137d59.js}

@@ -1498,6 +1498,27 @@ function deployShipsFiles(config, onlySite) {
 
 // src/drivers/shared/rpx-gateway.ts
 var DEFAULT_RPX_CERTS_DIR = "/etc/rpx/certs";
+function hasAutoWwwVariant(domain) {
+  return domain.split(".").length === 2;
+}
+function gatewayHostnames(sites, options = {}) {
+  const hosts = new Set;
+  for (const site of Object.values(sites)) {
+    if (!site?.domain)
+      continue;
+    if (resolveSiteKind(site) === "bucket")
+      continue;
+    hosts.add(site.domain);
+  }
+  if (options.autoWww !== false) {
+    for (const domain of [...hosts]) {
+      if (!hasAutoWwwVariant(domain))
+        continue;
+      hosts.add(`www.${domain}`);
+    }
+  }
+  return [...hosts];
+}
 var DEFAULT_ACME_WEBROOT = "/var/www/acme-challenge";
 function normalizeSiteRedirect(input) {
   if (typeof input === "string")
@@ -1610,7 +1631,7 @@ function buildRpxConfigInternal(sites, options, appBoxes) {
   }
   if (options.proxy.autoWww !== false) {
     for (const domain of [...domains]) {
-      if (domain.split(".").length !== 2)
+      if (!hasAutoWwwVariant(domain))
         continue;
       const wwwDomain = `www.${domain}`;
       if (domains.has(wwwDomain))
@@ -7227,4 +7248,4 @@ function buildCloudFrontOriginConfig(options) {
     CustomErrorResponses: { Quantity: 0 }
   };
 }
-export { collectServerDnsDomains, removeStaleServerAddressRecords, normalizePublicIpv6, IPV6_EXCLUDED_HOST_LABELS, hostAcceptsIpv6, reconcileAddressRecords, verifyAddressRecord, PANTRY_PROJECT_DIR, buildPantryBootstrapScript, buildVitessProvisionScript, pgAdminCommand, BACKUP_RUNNER_PATH, buildBackupRestoreScript, siteInstallBase, isPhpSite, resolveProxyUpstreams, hasProxyUpstream, resolveSiteDeployTarget, resolveSiteKind, hasComputeConfigured, validateDeploymentConfig, shipsARelease, shipsToBucket, deployShipsFiles, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, planHetznerServerResize, isHetznerCapacityError, executeHetznerServerResize, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, collectHetznerResizeManifest, prepareHetznerResize, verifyHetznerResize, resolveHetznerHostOptimizationPlan, buildHetznerHostOptimizationScript, applyHetznerHostOptimization, collectHetznerHostOptimizationReport, verifyHetznerHostOptimization, resizeCheckpointPath, resizeLockPath, readResizeCheckpoint, writeResizeCheckpoint, acquireResizeLock, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, dashboardCredentialsFile, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };
+export { collectServerDnsDomains, removeStaleServerAddressRecords, normalizePublicIpv6, IPV6_EXCLUDED_HOST_LABELS, hostAcceptsIpv6, reconcileAddressRecords, verifyAddressRecord, PANTRY_PROJECT_DIR, buildPantryBootstrapScript, buildVitessProvisionScript, pgAdminCommand, BACKUP_RUNNER_PATH, buildBackupRestoreScript, siteInstallBase, isPhpSite, resolveProxyUpstreams, hasProxyUpstream, resolveSiteDeployTarget, resolveSiteKind, hasComputeConfigured, validateDeploymentConfig, shipsARelease, shipsToBucket, deployShipsFiles, DEFAULT_RPX_CERTS_DIR, hasAutoWwwVariant, gatewayHostnames, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, planHetznerServerResize, isHetznerCapacityError, executeHetznerServerResize, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, collectHetznerResizeManifest, prepareHetznerResize, verifyHetznerResize, resolveHetznerHostOptimizationPlan, buildHetznerHostOptimizationScript, applyHetznerHostOptimization, collectHetznerHostOptimizationReport, verifyHetznerHostOptimization, resizeCheckpointPath, resizeLockPath, readResizeCheckpoint, writeResizeCheckpoint, acquireResizeLock, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, dashboardCredentialsFile, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };

package/dist/deploy/index.js

@@ -36,7 +36,7 @@ import {
   synchronizeDashboardUsers,
   trackDashboardOperation,
   verifyStaticApiOrigin
-} from "../chunk-grp3evq3.js";
+} from "../chunk-wxhrr03r.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -83,7 +83,7 @@ import {
   siteInstallBase,
   validateDeploymentConfig,
   verifyAddressRecord
-} from "../chunk-bfzhz2ed.js";
+} from "../chunk-x6137d59.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-rds0sy87.js";

package/dist/drivers/index.d.ts

@@ -20,7 +20,7 @@ export { AwsBoxProvisioner, buildBoxUserData, createBoxProvisioner, HetznerBoxPr
 export type { AwsBoxProvisionerOptions, BoxPort, BoxProviderName, BoxProvisioner, BoxSpec, CreateBoxProvisionerOptions, ProvisionedBox, } from './shared/box-provision';
 export { buildAwsArtifactFetch, buildHostCleanupScript, buildLocalArtifactFetch, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, resolveExecStart, } from './shared/deploy-script';
 export { deployAllComputeSites, deploySiteRelease, reloadRpxGateway, renewRpxCertificates, } from './shared/compute-deploy';
-export { buildRpxConfig, buildRpxFragmentRefreshScript, buildRpxLbConfig, buildRpxProvisionScript, deriveRouteId, normalizeRoutePath, renderRpxLauncher, DEFAULT_RPX_CERTS_DIR, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, } from './shared/rpx-gateway';
+export { buildRpxConfig, buildRpxFragmentRefreshScript, buildRpxLbConfig, buildRpxProvisionScript, deriveRouteId, gatewayHostnames, hasAutoWwwVariant, normalizeRoutePath, renderRpxLauncher, DEFAULT_RPX_CERTS_DIR, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, } from './shared/rpx-gateway';
 export type { BuildRpxConfigOptions, BuildRpxFragmentRefreshOptions, BuildRpxProvisionOptions, RpxGatewayConfig, RpxLbAppBox, RpxRoute, } from './shared/rpx-gateway';
 export { buildCloudFrontOriginConfig, MANAGED_CACHE_POLICY_DISABLED, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, } from './shared/cloudfront-origin';
 export type { BuildCloudFrontOriginOptions, OriginFrontedBehavior } from './shared/cloudfront-origin';

package/dist/drivers/index.js

@@ -42,6 +42,8 @@ import {
   ensureServer,
   ensureSshKey,
   executeHetznerServerResize,
+  gatewayHostnames,
+  hasAutoWwwVariant,
   isBoxMode,
   isHetznerCapacityError,
   normalizeRoutePath,
@@ -68,7 +70,7 @@ import {
   waitForSsh,
   wrapCloudInitUserData,
   writeResizeCheckpoint
-} from "../chunk-bfzhz2ed.js";
+} from "../chunk-x6137d59.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-rds0sy87.js";
@@ -104,7 +106,9 @@ export {
   normalizeRoutePath,
   isHetznerCapacityError,
   isBoxMode,
+  hasAutoWwwVariant,
   buildUbuntuBootstrapScript as generateUbuntuAppCloudInit,
+  gatewayHostnames,
   executeHetznerServerResize,
   ensureSshKey,
   ensureServer,

package/dist/drivers/shared/rpx-gateway.d.ts

@@ -22,6 +22,32 @@
 import type { ComputeProxyConfig, RpxLoadBalancerConfig, SiteConfig, SiteRedirectConfig } from '@ts-cloud/core';
 /** Default directory on the box that holds real per-domain TLS certs. */
 export declare const DEFAULT_RPX_CERTS_DIR = "/etc/rpx/certs";
+/** Whether the gateway adds a `www.` redirect for `domain` on its own. */
+export declare function hasAutoWwwVariant(domain: string): boolean;
+/**
+ * Every hostname the gateway will answer for a sites config.
+ *
+ * This is the set DNS has to publish, and it is deliberately derived from the
+ * same rules {@link buildRpxConfig} routes by, because the two drifting apart
+ * produces a specific and nasty failure: a name that resolves, has no route or
+ * certificate, and so is served the gateway's fallback cert — which on a shared
+ * box belongs to whichever *other* tenant sorts first. A visitor gets someone
+ * else's certificate and a browser warning, which is strictly worse than the
+ * name not existing.
+ *
+ * Two rules, both mirroring the route builder:
+ *  - every site's literal `domain`, including an explicitly declared
+ *    `www.<sub>.<apex>` (that host gets a real route here, so it needs a real
+ *    record — collapsing it to its apex is what left `www.ps1.stacksjs.com`
+ *    resolving onto another tenant's cert);
+ *  - plus `www.<domain>` for two-label apexes, which the gateway synthesizes
+ *    itself unless `autoWww` is off.
+ *
+ * `bucket` sites are excluded: they live on object storage + CDN, not this box.
+ */
+export declare function gatewayHostnames(sites: Record<string, SiteConfig | undefined>, options?: {
+    autoWww?: boolean;
+}): string[];
 /** Default webroot the gateway serves ACME http-01 challenges from on `:80`. */
 export declare const DEFAULT_ACME_WEBROOT = "/var/www/acme-challenge";
 /** A normalized redirect target on an {@link RpxRoute} (see rpx's `redirect`). */

package/dist/index.js

@@ -208,7 +208,7 @@ import {
   verifyUpdateSignature,
   webhookEndpoint,
   zeroCapacity
-} from "./chunk-grp3evq3.js";
+} from "./chunk-wxhrr03r.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -341,7 +341,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-bfzhz2ed.js";
+} from "./chunk-x6137d59.js";
 import {
   EC2Client,
   SSMClient