@ts-cloud/core 0.4.1 → 0.5.0

package/dist/index.d.ts

@@ -29,6 +29,7 @@ export * from './presets/traditional-web-app';
 export * from './presets/laravel';
 export * from './presets/serverless-laravel';
 export * from './presets/dashboard';
+export * from './presets/management-dashboard';
 export * from './presets/extend';
 export * from './aws/signature';
 export * from './aws/credentials';

package/dist/index.js

@@ -22307,6 +22307,57 @@ function createDashboardSite(options) {
     }
   };
 }
+// src/presets/management-dashboard.ts
+function apexOf(domain) {
+  const parts = domain.split(".").filter(Boolean);
+  return parts.length <= 2 ? domain : parts.slice(-2).join(".");
+}
+function resolveDashboardDomain(config, environment, explicit) {
+  if (explicit)
+    return explicit;
+  const candidates = [];
+  for (const site of Object.values(config.sites ?? {})) {
+    const d = site?.domain;
+    if (typeof d === "string")
+      candidates.push(d);
+    else if (Array.isArray(d))
+      candidates.push(...d.filter((x) => typeof x === "string"));
+  }
+  if (environment && config.environments?.[environment]?.domain)
+    candidates.push(config.environments[environment].domain);
+  const dnsDomain = config.infrastructure?.dns?.domain;
+  if (dnsDomain)
+    candidates.push(dnsDomain);
+  const base = candidates.find((d) => d && !d.startsWith("dashboard."));
+  if (!base)
+    return null;
+  return `dashboard.${apexOf(base)}`;
+}
+function hasManagementDashboardSite(config) {
+  return Object.entries(config.sites ?? {}).some(([name, site]) => {
+    if (!site)
+      return false;
+    const root = site.root ?? "";
+    return name === "dashboard" || root === "ui/dist" || root.endsWith("/ui/dist") || root.endsWith("/dist/ui");
+  });
+}
+function resolveManagementDashboardSite(config, environment, opts) {
+  if (hasManagementDashboardSite(config))
+    return null;
+  const domain = resolveDashboardDomain(config, environment, opts.domain);
+  if (!domain)
+    return null;
+  const site = {
+    root: opts.uiRoot,
+    deploy: "server",
+    type: "static",
+    domain,
+    ssl: { provider: "letsencrypt" },
+    ...opts.build === false || opts.build === undefined ? {} : { build: opts.build },
+    ...opts.password ? { auth: { username: opts.username || "admin", password: opts.password, realm: opts.realm } } : {}
+  };
+  return { name: "dashboard", site };
+}
 // src/presets/extend.ts
 function deepMerge(target, source) {
   const result = { ...target };
@@ -45909,6 +45960,7 @@ function composeServerlessAppTemplate(opts) {
 var PHP_LAYER_EXTENSIONS = [
   "cli",
   "fpm",
+  "curl",
   "mbstring",
   "xml",
   "pdo",
@@ -45931,13 +45983,18 @@ function phpLayerBuildStage(phpVersion, asName) {
   const scl = `php${phpVersion.replace(".", "")}`;
   const packages = phpLayerPackages(phpVersion).join(" \\\n      ");
   const sclRoot = `/opt/remi/${scl}/root`;
-  const from = asName ? `FROM amazonlinux:2023 AS ${asName}` : "FROM amazonlinux:2023";
+  const sclEtc = `/etc/opt/remi/${scl}`;
+  const from = asName ? `FROM almalinux:9 AS ${asName}` : "FROM almalinux:9";
   return `${from}
 
-# Remi provides version-isolated PHP SCL packages for EL9 (AL2023 compatible).
-RUN dnf -y install dnf-plugins-core 'dnf-command(config-manager)' && \\
+# Build PHP on AlmaLinux 9 (where Remi's version-isolated SCL packages install
+# cleanly — Remi's release RPM rejects Amazon Linux 2023). AlmaLinux 9 shares
+# glibc 2.34 with the provided.al2023 Lambda runtime, and the relocation step
+# below bundles every non-glibc shared lib under /opt/php/lib, so the resulting
+# /opt tree runs on Lambda's provided.al2023.
+RUN dnf -y install epel-release dnf-plugins-core 'dnf-command(config-manager)' && \\
+    dnf config-manager --set-enabled crb && \\
     dnf -y install https://rpms.remirepo.net/enterprise/remi-release-9.rpm && \\
-    dnf -y update && \\
     dnf -y install \\
       ${packages} \\
       findutils tar gzip && \\
@@ -45950,7 +46007,10 @@ RUN set -eux; \\
     cp ${sclRoot}/usr/sbin/php-fpm /opt/php/sbin/php-fpm; \\
     EXT_DIR="$(${sclRoot}/usr/bin/php -r 'echo ini_get("extension_dir");')"; \\
     cp -a "$EXT_DIR"/*.so /opt/php/lib/php/modules/ || true; \\
-    cp -a ${sclRoot}/etc/php.d/*.ini /opt/php/etc/php.d/ 2>/dev/null || true; \\
+    cp -a ${sclEtc}/php.d/*.ini /opt/php/etc/php.d/ 2>/dev/null || true; \\
+    # Rewrite any absolute extension/zend_extension paths to bare names so they
+    # resolve against the relocated extension_dir.
+    sed -i -E "s#(zend_)?extension *= *.*/([^/]+\\.so)#\\1extension=\\2#" /opt/php/etc/php.d/*.ini 2>/dev/null || true; \\
     # Copy shared-library dependencies of php, php-fpm, and the extension modules.
     for bin in /opt/php/bin/php /opt/php/sbin/php-fpm /opt/php/lib/php/modules/*.so; do \\
       ldd "$bin" 2>/dev/null | awk '/=>/{print $3}/ld-linux/{print $1}' | sort -u | while read -r lib; do \\
@@ -45958,10 +46018,9 @@ RUN set -eux; \\
       done; \\
     done
 
-# Point PHP at the relocated config + extension dir.
+# Build the relocated main php.ini: extension_dir + every per-extension directive.
 RUN printf 'extension_dir=/opt/php/lib/php/modules\\n' > /opt/php/etc/php.ini && \\
     cat /opt/php/etc/php.d/*.ini >> /opt/php/etc/php.ini 2>/dev/null || true
-ENV PHP_INI_SCAN_DIR=/opt/php/etc/php.d
 
 # Runtime assets (bootstrap, runtime loops, fpm config) are added by the build
 # orchestrator after the image is produced. Export /opt as the layer payload.
@@ -46278,7 +46337,7 @@ var LARAVEL_SERVERLESS_BUILD_STEPS = [
 ];
 // src/serverless-php/layer-build.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync5, mkdtempSync as mkdtempSync3, readdirSync as readdirSync5, readFileSync as readFileSync6, rmSync as rmSync3, statSync as statSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, mkdtempSync as mkdtempSync3, readdirSync as readdirSync5, readFileSync as readFileSync6, rmSync as rmSync3, statSync as statSync3, writeFileSync as writeFileSync5 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join9, relative as relative2 } from "node:path";
 function* walk(dir) {
@@ -46300,16 +46359,17 @@ function buildPhpRuntimeLayerZip(options = {}) {
     writeFileSync5(join9(stage, "Dockerfile"), generatePhpLayerDockerfile(options));
     step("Building PHP runtime image (docker)");
     execFileSync2("docker", ["build", "--platform", platform, "-t", imageTag, stage], { stdio: "inherit" });
-    step("Extracting /opt from image");
+    step("Extracting /opt/php from image");
     const cid = execFileSync2("docker", ["create", "--platform", platform, imageTag], { encoding: "utf-8" }).trim();
     const optDir = join9(stage, "opt");
+    mkdirSync2(optDir, { recursive: true });
     try {
-      execFileSync2("docker", ["cp", `${cid}:/opt/.`, optDir], { stdio: "inherit" });
+      execFileSync2("docker", ["cp", `${cid}:/opt/php`, join9(optDir, "php")], { stdio: "inherit" });
     } finally {
       execFileSync2("docker", ["rm", cid], { stdio: "ignore" });
     }
-    if (!existsSync5(optDir))
-      throw new Error("layer build produced no /opt directory");
+    if (!existsSync5(join9(optDir, "php", "bin", "php")))
+      throw new Error("layer build produced no /opt/php/bin/php");
     const entries = [];
     for (const file of walk(optDir)) {
       const rel = relative2(optDir, file).replace(/\\/g, "/");
@@ -46901,7 +46961,9 @@ export {
   resolveRegion,
   resolveQueueNames,
   resolveProjectStackName,
+  resolveManagementDashboardSite,
   resolveDeployBucketName,
+  resolveDashboardDomain,
   resolveCredentials,
   resolveCloudProvider,
   resolveApp,
@@ -46955,6 +47017,7 @@ export {
   hashFile,
   hashDirectory,
   hashBuffer,
+  hasManagementDashboardSite,
   guardDutyManager,
   globalResourceManager,
   getTimestamp,

package/dist/presets/management-dashboard.d.ts

@@ -0,0 +1,44 @@
+import type { CloudConfig, EnvironmentType, SiteConfig } from '../types';
+/**
+ * Auto-deployed management dashboard (the `@ts-cloud/ui` stx app — the Server +
+ * Serverless views). When a server is provisioned, ts-cloud injects this as a
+ * server-static site so the dashboard ships automatically with every box.
+ *
+ * It is served behind HTTP Basic auth (htpasswd) whose password comes from an
+ * environment value (`TS_CLOUD_UI_PASSWORD`). If that value is NOT set, the
+ * dashboard is served WITHOUT auth — no password is invented.
+ */
+export interface ManagementDashboardOptions {
+    /** Directory shipped as the static site root (built UI, or source dir + build). */
+    uiRoot: string;
+    /** Build command producing {@link uiRoot}, or false when it is already built. */
+    build?: string | false;
+    /** Explicit domain (e.g. from `TS_CLOUD_UI_DOMAIN`); else derived. */
+    domain?: string;
+    /** Basic-auth username. @default 'admin' */
+    username?: string;
+    /**
+     * Basic-auth password. When empty/undefined the dashboard is served WITHOUT
+     * htpasswd (no default password is invented).
+     */
+    password?: string;
+    /** Browser auth realm. */
+    realm?: string;
+}
+/**
+ * Derive a dashboard hostname (`dashboard.<apex>`) from the project's configured
+ * domains. Prefers `explicit`, then any site domain, then the environment domain,
+ * then `infrastructure.dns.domain`. Returns null when nothing is available.
+ */
+export declare function resolveDashboardDomain(config: Pick<CloudConfig, 'sites' | 'environments' | 'infrastructure'>, environment?: EnvironmentType, explicit?: string): string | null;
+/** Does the config already define the management dashboard as a site? */
+export declare function hasManagementDashboardSite(config: Pick<CloudConfig, 'sites'>): boolean;
+/**
+ * Build the management-dashboard site to auto-inject on server deploys, or null
+ * when no domain can be resolved (the static-site model is domain-routed) or it
+ * is already configured.
+ */
+export declare function resolveManagementDashboardSite(config: Pick<CloudConfig, 'sites' | 'environments' | 'infrastructure'>, environment: EnvironmentType, opts: ManagementDashboardOptions): {
+    name: string;
+    site: SiteConfig;
+} | null;

package/dist/presets/management-dashboard.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/serverless-php/dockerfile.d.ts

@@ -1,13 +1,13 @@
 /**
  * Generates the Dockerfile that builds the ts-cloud PHP runtime layer for AWS
- * Lambda (`provided.al2023`). Built against Amazon Linux 2023 so glibc and the
- * shared libraries match the Lambda execution environment.
+ * Lambda (`provided.al2023`). Built on AlmaLinux 9 — it shares glibc 2.34 with
+ * the Lambda runtime, and (unlike Amazon Linux 2023) the Remi repository's
+ * release RPM installs there, giving version-isolated PHP SCL packages
+ * (`php83-php-*` under `/opt/remi/php83/`) so the same recipe builds PHP 8.1–8.4.
  *
- * AL2023's default repos can't select an arbitrary PHP minor version, so we use
- * the Remi repository's SCL-style packages (`php83-php-*`, installed under
- * `/opt/remi/php83/`), which lets the same recipe build PHP 8.1–8.4. The PHP
- * binary, php-fpm, extensions, and their shared-library dependencies are then
- * relocated under `/opt` so the archive works as a Lambda layer.
+ * The PHP binary, php-fpm, extensions, and all their non-glibc shared-library
+ * dependencies are relocated + bundled under `/opt` so the archive runs as a
+ * provided.al2023 Lambda layer.
  *
  * Build it in CI (Docker required) — see {@link buildPhpRuntimeLayerZip}. The
  * resulting /opt tree is published as a Lambda layer.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ts-cloud/core",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "type": "module",
   "description": "Core CloudFormation generation library for ts-cloud",
   "author": "Chris Breuer <chris@stacksjs.com>",
@@ -31,7 +31,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@ts-cloud/aws-types": "0.4.1"
+    "@ts-cloud/aws-types": "0.5.0"
   },
   "devDependencies": {
     "typescript": "^5.9.3"