@ts-cloud/core 0.7.21 → 0.7.22

package/dist/index.js

@@ -22333,6 +22333,8 @@ function createDashboardSite(options) {
   };
 }
 // src/presets/management-dashboard.ts
+var DASHBOARD_STATE_DIR = ".ts-cloud";
+var DASHBOARD_ENTRY = "./node_modules/@stacksjs/ts-cloud/dist/bin/cli.js";
 function apexOf(domain) {
   const parts = domain.split(".").filter(Boolean);
   return parts.length <= 2 ? domain : parts.slice(-2).join(".");
@@ -22395,7 +22397,7 @@ function resolveManagementDashboardSites(config, environment, opts) {
     return [];
   const auth2 = opts.password ? { auth: { username: opts.username || "admin", password: opts.password, realm: opts.realm } } : {};
   const build = opts.build === false || opts.build === undefined ? {} : { build: opts.build };
-  if (opts.live) {
+  if (opts.live !== false) {
     const domain = resolveDashboardDomain(config, environment, opts.domain);
     if (!domain)
       return [];
@@ -22404,11 +22406,12 @@ function resolveManagementDashboardSites(config, environment, opts) {
       root: opts.uiRoot,
       deploy: "server",
       domain,
-      start: `cloud dashboard:serve --box --host 127.0.0.1 --port ${port}`,
+      preStart: ["bun install --production --no-save"],
+      start: `bun ${DASHBOARD_ENTRY} dashboard:serve --box --host 127.0.0.1 --port ${port}`,
       port,
-      ssl: { provider: "letsencrypt" },
-      ...build,
-      ...auth2
+      sharedPaths: [DASHBOARD_STATE_DIR],
+      healthCheck: { path: "/login" },
+      ssl: { provider: "letsencrypt" }
     };
     return [{ name: managementDashboardSiteName(domain), site }];
   }
@@ -47551,6 +47554,8 @@ export {
   DNS,
   DLQMonitoringManager,
   DEFAULT_SERVICE_LIMITS,
+  DASHBOARD_STATE_DIR,
+  DASHBOARD_ENTRY,
   CrossRegionReferenceManager,
   CredentialError,
   ContainerRegistryManager,

package/dist/presets/management-dashboard.d.ts

@@ -1,12 +1,26 @@
 import type { CloudConfig, EnvironmentType, SiteConfig } from '../types';
 /**
  * Auto-deployed management dashboard (the `@ts-cloud/ui` stx app — the Server +
- * Serverless views). When a server is provisioned, ts-cloud injects this as a
- * server-static site so the dashboard ships automatically with every box.
+ * Serverless views). When a server is provisioned, ts-cloud injects this so the
+ * dashboard ships automatically with every box.
  *
- * It is served behind HTTP Basic auth (htpasswd) whose password comes from an
- * environment value (`TS_CLOUD_UI_PASSWORD`). If that value is NOT set, the
- * dashboard is served WITHOUT auth — no password is invented.
+ * Two models:
+ *
+ * **Live (the default).** The dashboard runs as a service on the box
+ * (`cloud dashboard:serve --box`) behind the proxy, and authenticates itself:
+ * a login page, sessions, and per-site collaborator grants. No htpasswd — the
+ * app is the authentication, and a shared Basic-auth password in front of it
+ * would defeat the point, since every collaborator would need the box's one
+ * password just to reach the login page.
+ *
+ * **Static (`TS_CLOUD_UI_STATIC`).** The built UI shipped as files behind
+ * htpasswd. One shared password, all data baked into the HTML at build time,
+ * and therefore **no collaborators** — whoever holds the password sees every
+ * site on the box. Kept for boxes that cannot run the service.
+ *
+ * Live mode is single-host by design: one control panel per box, many sites,
+ * per-site grants (the Forge/Coolify model). Static mode fans out one dashboard
+ * per apex, since it is only serving the same files on each domain.
  */
 export interface ManagementDashboardOptions {
     /** Directory shipped as the static site root (built UI, or source dir + build). */
@@ -15,25 +29,42 @@ export interface ManagementDashboardOptions {
     build?: string | false;
     /** Explicit domain (e.g. from `TS_CLOUD_UI_DOMAIN`); else derived. */
     domain?: string;
-    /** Basic-auth username. @default 'admin' */
+    /** Basic-auth username, static mode only. @default 'admin' */
     username?: string;
     /**
-     * Basic-auth password. When empty/undefined the dashboard is served WITHOUT
-     * htpasswd (no default password is invented).
+     * Basic-auth password, static mode only. When empty/undefined the static
+     * dashboard is served WITHOUT htpasswd (no default password is invented).
+     * Ignored in live mode, where the app authenticates.
      */
     password?: string;
-    /** Browser auth realm. */
+    /** Browser auth realm, static mode only. */
     realm?: string;
     /**
-     * Live mode: deploy the dashboard as a server-app (a `cloud dashboard:serve
-     * --box` service on the box) instead of static files, so it serves the
-     * project's LIVE data + a working control API on the server. The proxy routes
-     * the dashboard host to its loopback port (behind Basic auth).
+     * Live mode: run the dashboard as a service on the box, serving live data,
+     * the control API, and its own login + collaborator model.
+     * @default true
      */
     live?: boolean;
     /** Loopback port for the live (box-mode) dashboard service. @default 7676 */
     port?: number;
+    /**
+     * ts-cloud version the box installs to run the dashboard. Defaults to the
+     * published range so a box always gets a dashboard matching this generation.
+     */
+    version?: string;
 }
+/** Where the live dashboard keeps its users, session key and cache. */
+export declare const DASHBOARD_STATE_DIR = ".ts-cloud";
+/**
+ * The dashboard service's entry point inside its release dir. The CLI is
+ * installed from npm by the release's `bun install`, so this path exists on the
+ * box without the deploy having to ship a binary.
+ *
+ * Called through the module path rather than the `cloud` bin shim because the
+ * systemd unit runs `/usr/local/bin/bun <args>` directly — a bare `cloud` would
+ * be resolved by bun as a FILE to execute, and the service would never start.
+ */
+export declare const DASHBOARD_ENTRY = "./node_modules/@stacksjs/ts-cloud/dist/bin/cli.js";
 /**
  * Derive the PRIMARY dashboard hostname (`dashboard.<apex>`) for the project.
  * Prefers `explicit`, else the project's canonical domain (`infrastructure.dns.domain`,

package/dist/types.d.ts

@@ -961,7 +961,12 @@ export interface SiteConfig {
      * Paths symlinked from the site's `shared/` directory into every release so
      * they persist across deploys (e.g. `storage`, uploaded files, a SQLite db).
      * `.env` is always shared and need not be listed.
-     * @default ['storage', '.env']
+     *
+     * A release is a fresh directory, so anything the app WRITES and must keep
+     * has to be listed here or the next deploy silently starts it from empty.
+     *
+     * Honored by both PHP/Laravel sites and server-app sites (`start`).
+     * @default ['storage', '.env'] for PHP sites; `['.env']` for server-app sites
      */
     sharedPaths?: string[];
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ts-cloud/core",
-  "version": "0.7.21",
+  "version": "0.7.22",
   "type": "module",
   "description": "Core CloudFormation generation library for ts-cloud",
   "author": "Chris Breuer <chris@stacksjs.com>",
@@ -31,7 +31,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@ts-cloud/aws-types": "0.7.21"
+    "@ts-cloud/aws-types": "0.7.22"
   },
   "devDependencies": {
     "typescript": "^7.0.2"