@ts-cloud/core 0.4.2 → 0.5.1

package/dist/index.d.ts

@@ -29,6 +29,7 @@ export * from './presets/traditional-web-app';
 export * from './presets/laravel';
 export * from './presets/serverless-laravel';
 export * from './presets/dashboard';
+export * from './presets/management-dashboard';
 export * from './presets/extend';
 export * from './aws/signature';
 export * from './aws/credentials';

package/dist/index.js

@@ -22307,6 +22307,57 @@ function createDashboardSite(options) {
     }
   };
 }
+// src/presets/management-dashboard.ts
+function apexOf(domain) {
+  const parts = domain.split(".").filter(Boolean);
+  return parts.length <= 2 ? domain : parts.slice(-2).join(".");
+}
+function resolveDashboardDomain(config, environment, explicit) {
+  if (explicit)
+    return explicit;
+  const candidates = [];
+  for (const site of Object.values(config.sites ?? {})) {
+    const d = site?.domain;
+    if (typeof d === "string")
+      candidates.push(d);
+    else if (Array.isArray(d))
+      candidates.push(...d.filter((x) => typeof x === "string"));
+  }
+  if (environment && config.environments?.[environment]?.domain)
+    candidates.push(config.environments[environment].domain);
+  const dnsDomain = config.infrastructure?.dns?.domain;
+  if (dnsDomain)
+    candidates.push(dnsDomain);
+  const base = candidates.find((d) => d && !d.startsWith("dashboard."));
+  if (!base)
+    return null;
+  return `dashboard.${apexOf(base)}`;
+}
+function hasManagementDashboardSite(config) {
+  return Object.entries(config.sites ?? {}).some(([name, site]) => {
+    if (!site)
+      return false;
+    const root = site.root ?? "";
+    return name === "dashboard" || root === "ui/dist" || root.endsWith("/ui/dist") || root.endsWith("/dist/ui");
+  });
+}
+function resolveManagementDashboardSite(config, environment, opts) {
+  if (hasManagementDashboardSite(config))
+    return null;
+  const domain = resolveDashboardDomain(config, environment, opts.domain);
+  if (!domain)
+    return null;
+  const site = {
+    root: opts.uiRoot,
+    deploy: "server",
+    type: "static",
+    domain,
+    ssl: { provider: "letsencrypt" },
+    ...opts.build === false || opts.build === undefined ? {} : { build: opts.build },
+    ...opts.password ? { auth: { username: opts.username || "admin", password: opts.password, realm: opts.realm } } : {}
+  };
+  return { name: "dashboard", site };
+}
 // src/presets/extend.ts
 function deepMerge(target, source) {
   const result = { ...target };
@@ -45466,6 +45517,7 @@ function composeServerlessAppTemplate(opts) {
     TSCLOUD_LAMBDA_MODE: mode,
     TSCLOUD_ENV: environment,
     ...app.octane ? { TSCLOUD_OCTANE: "1" } : {},
+    ...app.scheduler === "sub-minute" ? { TSCLOUD_SCHEDULER: "sub-minute" } : {},
     ...cacheEnabled ? { TSCLOUD_CACHE_TABLE: `${slug}-${environment}-cache` } : {},
     ...hasQueue ? { TSCLOUD_QUEUE: queueNames[0] } : {},
     ...app.env ?? {}
@@ -45485,7 +45537,7 @@ function composeServerlessAppTemplate(opts) {
       ]
     }
   } : {};
-  function addFunction(logicalId, name, handler8, mode, memory, timeout, reservedConcurrency) {
+  function addFunction(logicalId, name, handler8, mode, memory, timeout, reservedConcurrency, tmp = tmpStorage) {
     resources[`${logicalId}LogGroup`] = {
       Type: "AWS::Logs::LogGroup",
       Properties: { LogGroupName: `/aws/lambda/${name}`, RetentionInDays: 14 }
@@ -45510,17 +45562,17 @@ function composeServerlessAppTemplate(opts) {
         Timeout: timeout,
         Role: Fn2.getAtt("AppRole", "Arn"),
         Environment: { Variables: baseEnv(mode) },
-        EphemeralStorage: { Size: tmpStorage },
+        EphemeralStorage: { Size: tmp },
         ...codeProps,
         ...reservedConcurrency !== undefined ? { ReservedConcurrentExecutions: reservedConcurrency } : {},
         ...vpcConfig
       }
     };
   }
-  addFunction("HttpFunction", functionNames.http, handlers.http, "http", app.memory ?? 1024, app.timeout ?? 28, app.concurrency);
-  addFunction("CliFunction", functionNames.cli, handlers.cli, "cli", app.cliMemory ?? 1024, app.cliTimeout ?? 900);
+  addFunction("HttpFunction", functionNames.http, handlers.http, "http", app.memory ?? 1024, app.timeout ?? 28, app.concurrency, tmpStorage);
+  addFunction("CliFunction", functionNames.cli, handlers.cli, "cli", app.cliMemory ?? 1024, app.cliTimeout ?? 900, undefined, app.cliTmpStorage ?? tmpStorage);
   if (hasQueue)
-    addFunction("QueueFunction", functionNames.queue, handlers.queue, "queue", app.queueMemory ?? 1024, app.queueTimeout ?? 120);
+    addFunction("QueueFunction", functionNames.queue, handlers.queue, "queue", app.queueMemory ?? 1024, app.queueTimeout ?? 120, undefined, app.queueTmpStorage ?? tmpStorage);
   resources.HttpApi = {
     Type: "AWS::ApiGatewayV2::Api",
     Properties: {
@@ -45567,6 +45619,59 @@ function composeServerlessAppTemplate(opts) {
     Value: Fn2.getAtt("HttpApi", "ApiEndpoint")
   };
   outputs.HttpApiId = { Description: "HTTP API id", Value: Fn2.ref("HttpApi") };
+  const domains = (Array.isArray(app.domain) ? app.domain : app.domain ? [app.domain] : []).filter(Boolean);
+  if (domains.length) {
+    if (!app.certificateArn && !app.hostedZoneId) {
+      throw new Error("serverless app: a custom `domain` needs either `certificateArn` (pre-issued, regional) or `hostedZoneId` (to auto-issue + validate an ACM cert).");
+    }
+    let certRef = app.certificateArn;
+    if (!certRef) {
+      resources.HttpCertificate = {
+        Type: "AWS::CertificateManager::Certificate",
+        Properties: {
+          DomainName: domains[0],
+          ...domains.length > 1 ? { SubjectAlternativeNames: domains.slice(1) } : {},
+          ValidationMethod: "DNS",
+          DomainValidationOptions: domains.map((d) => ({ DomainName: d, HostedZoneId: app.hostedZoneId }))
+        }
+      };
+      certRef = Fn2.ref("HttpCertificate");
+    }
+    domains.forEach((d, i) => {
+      const dn = `HttpDomain${i}`;
+      resources[dn] = {
+        Type: "AWS::ApiGatewayV2::DomainName",
+        Properties: {
+          DomainName: d,
+          DomainNameConfigurations: [{ CertificateArn: certRef, EndpointType: "REGIONAL" }]
+        }
+      };
+      resources[`HttpApiMapping${i}`] = {
+        Type: "AWS::ApiGatewayV2::ApiMapping",
+        DependsOn: ["HttpStage"],
+        Properties: { ApiId: Fn2.ref("HttpApi"), DomainName: Fn2.ref(dn), Stage: "$default" }
+      };
+      if (app.hostedZoneId) {
+        resources[`HttpDomainRecord${i}`] = {
+          Type: "AWS::Route53::RecordSet",
+          Properties: {
+            HostedZoneId: app.hostedZoneId,
+            Name: d,
+            Type: "A",
+            AliasTarget: {
+              DNSName: Fn2.getAtt(dn, "RegionalDomainName"),
+              HostedZoneId: Fn2.getAtt(dn, "RegionalHostedZoneId")
+            }
+          }
+        };
+      }
+      outputs[`CustomDomain${i}`] = { Description: `Custom domain ${d}`, Value: d };
+      outputs[`CustomDomainTarget${i}`] = {
+        Description: `Point ${d} (CNAME/alias) at this APIGW regional domain`,
+        Value: Fn2.getAtt(dn, "RegionalDomainName")
+      };
+    });
+  }
   if (hasQueue) {
     resources.AppQueueDlq = {
       Type: "AWS::SQS::Queue",
@@ -46910,7 +47015,9 @@ export {
   resolveRegion,
   resolveQueueNames,
   resolveProjectStackName,
+  resolveManagementDashboardSite,
   resolveDeployBucketName,
+  resolveDashboardDomain,
   resolveCredentials,
   resolveCloudProvider,
   resolveApp,
@@ -46964,6 +47071,7 @@ export {
   hashFile,
   hashDirectory,
   hashBuffer,
+  hasManagementDashboardSite,
   guardDutyManager,
   globalResourceManager,
   getTimestamp,

package/dist/presets/management-dashboard.d.ts

@@ -0,0 +1,44 @@
+import type { CloudConfig, EnvironmentType, SiteConfig } from '../types';
+/**
+ * Auto-deployed management dashboard (the `@ts-cloud/ui` stx app — the Server +
+ * Serverless views). When a server is provisioned, ts-cloud injects this as a
+ * server-static site so the dashboard ships automatically with every box.
+ *
+ * It is served behind HTTP Basic auth (htpasswd) whose password comes from an
+ * environment value (`TS_CLOUD_UI_PASSWORD`). If that value is NOT set, the
+ * dashboard is served WITHOUT auth — no password is invented.
+ */
+export interface ManagementDashboardOptions {
+    /** Directory shipped as the static site root (built UI, or source dir + build). */
+    uiRoot: string;
+    /** Build command producing {@link uiRoot}, or false when it is already built. */
+    build?: string | false;
+    /** Explicit domain (e.g. from `TS_CLOUD_UI_DOMAIN`); else derived. */
+    domain?: string;
+    /** Basic-auth username. @default 'admin' */
+    username?: string;
+    /**
+     * Basic-auth password. When empty/undefined the dashboard is served WITHOUT
+     * htpasswd (no default password is invented).
+     */
+    password?: string;
+    /** Browser auth realm. */
+    realm?: string;
+}
+/**
+ * Derive a dashboard hostname (`dashboard.<apex>`) from the project's configured
+ * domains. Prefers `explicit`, then any site domain, then the environment domain,
+ * then `infrastructure.dns.domain`. Returns null when nothing is available.
+ */
+export declare function resolveDashboardDomain(config: Pick<CloudConfig, 'sites' | 'environments' | 'infrastructure'>, environment?: EnvironmentType, explicit?: string): string | null;
+/** Does the config already define the management dashboard as a site? */
+export declare function hasManagementDashboardSite(config: Pick<CloudConfig, 'sites'>): boolean;
+/**
+ * Build the management-dashboard site to auto-inject on server deploys, or null
+ * when no domain can be resolved (the static-site model is domain-routed) or it
+ * is already configured.
+ */
+export declare function resolveManagementDashboardSite(config: Pick<CloudConfig, 'sites' | 'environments' | 'infrastructure'>, environment: EnvironmentType, opts: ManagementDashboardOptions): {
+    name: string;
+    site: SiteConfig;
+} | null;

package/dist/presets/management-dashboard.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types.d.ts

@@ -949,6 +949,23 @@ export interface SiteConfig {
      * process.env.UI_PASSWORD }`. The htpasswd file is generated on the box.
      */
     auth?: SiteAuthConfig;
+    /**
+     * Package-registry credentials written into the release before
+     * `composer install` / `npm install` so private packages resolve (Forge's
+     * Composer/npm credentials feature).
+     */
+    credentials?: SiteCredentialsConfig;
+}
+/** Private package-registry credentials for a site's build. */
+export interface SiteCredentialsConfig {
+    /**
+     * Composer `auth.json` contents — an object (serialized to JSON) or a
+     * ready-made JSON string. Written to the release root before `composer
+     * install` (e.g. `{ 'github-oauth': { 'github.com': '<token>' } }`).
+     */
+    composerAuth?: Record<string, unknown> | string;
+    /** `.npmrc` contents written to the release root before `npm install`. */
+    npmrc?: string;
 }
 /** HTTP Basic auth for a site's nginx vhost. See {@link SiteConfig.auth}. */
 export interface SiteAuthConfig {
@@ -1006,6 +1023,32 @@ export interface SiteSslConfig {
     certPath?: string;
     /** Path to the private key (PEM) when `provider: 'custom'`. */
     keyPath?: string;
+    /**
+     * Issue a **wildcard** certificate (`*.<domain>` + `<domain>`). Requires
+     * DNS-01 validation, so {@link dns} must be set. The nginx plugin can't do
+     * wildcards (that needs HTTP-01 per host).
+     */
+    wildcard?: boolean;
+    /**
+     * Use DNS-01 validation via a certbot DNS plugin instead of the nginx
+     * (HTTP-01) challenge. Needed for wildcard certs and for issuing before the
+     * domain resolves to the box. The plugin + credentials are wired on the box.
+     */
+    dns?: SslDnsConfig;
+}
+/** certbot DNS-01 plugin configuration for DNS-validated / wildcard certs. */
+export interface SslDnsConfig {
+    /** DNS provider whose certbot plugin handles the `_acme-challenge` records. */
+    provider: 'cloudflare' | 'route53' | 'digitalocean' | 'google';
+    /**
+     * Provider credentials written to a root-only INI certbot reads
+     * (`--dns-<provider>-credentials`). For route53, AWS env/instance-role creds
+     * are used instead, so this may be omitted. Keys are provider-specific, e.g.
+     * `{ dns_cloudflare_api_token: '…' }`.
+     */
+    credentials?: Record<string, string>;
+    /** Seconds to wait for DNS propagation before certbot asks the CA to verify. */
+    propagationSeconds?: number;
 }
 /**
  * A Laravel queue worker (or Horizon supervisor) run as a systemd service.
@@ -1123,6 +1166,34 @@ export interface DatabaseConfig {
     host?: string;
     /** Port (defaults: mysql/mariadb 3306, postgres 5432). */
     port?: number;
+    /**
+     * Additional database users to create beyond the app {@link username}
+     * (the Forge Database Users feature). Each can be granted full or read-only
+     * access to one or more databases. Created at provision time on the on-box
+     * engine.
+     */
+    users?: DatabaseUserConfig[];
+}
+/**
+ * An extra database user provisioned on the on-box engine (per-user grants).
+ * Beyond the application user, you can create reporting/read-only accounts or
+ * service-specific logins with their own access scope.
+ */
+export interface DatabaseUserConfig {
+    /** User name to create. */
+    username: string;
+    /** Password for the user. */
+    password: string;
+    /**
+     * Databases this user may access. Defaults to the app database
+     * ({@link DatabaseConfig.name}) when omitted.
+     */
+    databases?: string[];
+    /**
+     * Access level granted on {@link databases}. `all` (default) is full
+     * read/write; `readonly` grants SELECT only (plus connect on Postgres).
+     */
+    access?: 'all' | 'readonly';
 }
 export interface CacheConfig {
     type?: 'redis' | 'memcached';
@@ -1530,8 +1601,12 @@ export interface ServerlessAppConfig {
     rdsProxy?: boolean | {
         name?: string;
     };
-    /** Ephemeral `/tmp` size in MB (512–10240). @default 512 */
+    /** Ephemeral storage in MB (512 to 10240) for the HTTP function. @default 512 */
     tmpStorage?: number;
+    /** Ephemeral storage in MB for the CLI function. @default tmpStorage */
+    cliTmpStorage?: number;
+    /** Ephemeral storage in MB for the queue function. @default tmpStorage */
+    queueTmpStorage?: number;
     /** Database attachment. */
     database?: {
         connection?: 'rds-proxy' | 'aurora-serverless' | 'rds';
@@ -1548,10 +1623,17 @@ export interface ServerlessAppConfig {
     };
     /** Managed WAF in front of the HTTP API / CloudFront. */
     firewall?: WafConfig;
-    /** Custom domain for the app (overrides {@link EnvironmentConfig.domain}). */
+    /** Custom domain(s) for the app's HTTP API (overrides {@link EnvironmentConfig.domain}). */
     domain?: string | string[];
-    /** Pre-issued ACM certificate ARN for the custom domain. */
+    /** Pre-issued ACM certificate ARN for the custom domain (regional, same region). */
     certificateArn?: string;
+    /**
+     * Route53 hosted zone ID for the custom domain. When set (and no
+     * `certificateArn`), ts-cloud issues + DNS-validates an ACM cert and creates
+     * the alias record automatically. Without it, supply `certificateArn` and
+     * point your DNS at the API's regional domain (emitted as a stack output).
+     */
+    hostedZoneId?: string;
     /** Local directory whose contents are uploaded to S3/CloudFront as versioned assets. */
     assets?: string;
     /** PHP version for the runtime layer. @default '8.3' */
@@ -3191,7 +3273,7 @@ export interface RealtimeHooksConfig {
  * })
  *
  * // Private channel
- * Echo.private(`user.${userId}`).listen('notification', (e) => {
+ * Echo.private('user.' + userId).listen('notification', (e) => {
  *   console.log('Private notification:', e)
  * })
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ts-cloud/core",
-  "version": "0.4.2",
+  "version": "0.5.1",
   "type": "module",
   "description": "Core CloudFormation generation library for ts-cloud",
   "author": "Chris Breuer <chris@stacksjs.com>",
@@ -31,7 +31,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@ts-cloud/aws-types": "0.4.2"
+    "@ts-cloud/aws-types": "0.5.1"
   },
   "devDependencies": {
     "typescript": "^5.9.3"