@stackshift-cloud/sdk 1.0.0 → 1.2.0

package/dist/upload-controller.js

@@ -0,0 +1,223 @@
+export class UploadResumeInvalidError extends Error {
+    constructor(message = 'The saved upload session is no longer valid') {
+        super(message);
+        this.name = 'UploadResumeInvalidError';
+    }
+}
+export class ChunkedUploadController {
+    transport;
+    store;
+    persistence = Promise.resolve();
+    constructor(transport, store) {
+        this.transport = transport;
+        this.store = store;
+    }
+    async upload(file, request, options = {}) {
+        throwIfAborted(options.signal);
+        const resumeKey = options.resumeKey;
+        const fingerprint = fileFingerprint(file, request);
+        let session = await this.restore(resumeKey, fingerprint);
+        if (!session)
+            session = await this.transport.create(file, request);
+        validateSession(session, file.size);
+        options.onSession?.(session);
+        await this.persist(resumeKey, fingerprint, session);
+        const completed = await verifiedCompletedParts(file, session);
+        const loadedByPart = new Map(completed);
+        const tasks = [];
+        for (let offset = 0, partNumber = 1; offset < file.size; offset += session.partSize, partNumber += 1) {
+            if (!completed.has(partNumber))
+                tasks.push({ partNumber, chunk: file.slice(offset, offset + session.partSize) });
+        }
+        const report = () => {
+            const loaded = Math.min(file.size, [...loadedByPart.values()].reduce((sum, size) => sum + size, 0));
+            options.onProgress?.({ loaded, total: file.size, percent: file.size ? Math.round(loaded / file.size * 100) : 100 });
+        };
+        report();
+        const concurrency = boundedInteger(options.concurrency, 4, 1, 8);
+        const attempts = boundedInteger(options.retryAttempts, 4, 1, 8);
+        let next = 0;
+        const worker = async () => {
+            while (next < tasks.length) {
+                throwIfAborted(options.signal);
+                const task = tasks[next++];
+                const checksum = await sha256Blob(task.chunk);
+                await retryWithBackoff(async () => {
+                    await this.transport.uploadPart(session, task.partNumber, task.chunk, checksum, {
+                        signal: options.signal,
+                        onProgress: (progress) => {
+                            loadedByPart.set(task.partNumber, progress.loaded);
+                            options.onPartProgress?.(task.partNumber, progress);
+                            report();
+                        },
+                    });
+                }, attempts, options.signal);
+                loadedByPart.set(task.partNumber, task.chunk.size);
+                session.parts = [...session.parts.filter((part) => part.partNumber !== task.partNumber), {
+                        partNumber: task.partNumber, size: task.chunk.size, checksumSHA256: checksum,
+                    }];
+                await this.persist(resumeKey, fingerprint, session);
+                report();
+            }
+        };
+        try {
+            await Promise.all(Array.from({ length: Math.min(concurrency, tasks.length || 1) }, worker));
+            const result = await retryWithBackoff(() => this.transport.complete(session), attempts, options.signal);
+            if (resumeKey)
+                await this.store?.delete(resumeKey);
+            return result;
+        }
+        catch (error) {
+            if (isAbortError(error) && options.cancelOnAbort) {
+                await this.transport.cancel(session).catch(() => undefined);
+                if (resumeKey)
+                    await this.store?.delete(resumeKey);
+            }
+            throw error;
+        }
+    }
+    async cancel(resumeKey) {
+        const record = await this.store?.get(resumeKey);
+        if (!record)
+            return;
+        try {
+            await this.transport.cancel(record.session);
+        }
+        finally {
+            await this.store?.delete(resumeKey);
+        }
+    }
+    async restore(resumeKey, fingerprint) {
+        if (!resumeKey || !this.store)
+            return undefined;
+        const record = await this.store.get(resumeKey);
+        if (!record)
+            return undefined;
+        if (record.fingerprint !== fingerprint || Date.parse(record.session.expiresAt) <= Date.now()) {
+            await this.transport.cancel(record.session).catch(() => undefined);
+            await this.store.delete(resumeKey);
+            return undefined;
+        }
+        try {
+            return await this.transport.resume(record.session.resumeContext ?? record.session.id);
+        }
+        catch (error) {
+            if (!(error instanceof UploadResumeInvalidError))
+                throw error;
+            await this.store.delete(resumeKey);
+            return undefined;
+        }
+    }
+    persist(resumeKey, fingerprint, session) {
+        if (!resumeKey || !this.store)
+            return Promise.resolve();
+        const record = {
+            key: resumeKey,
+            fingerprint,
+            session: { ...session, parts: session.parts.map((part) => ({ ...part })) },
+            updatedAt: new Date().toISOString(),
+        };
+        this.persistence = this.persistence.then(() => this.store.set(record));
+        return this.persistence;
+    }
+}
+export function putBlob(url, blob, callbacks = {}, headers = {}, fetcher = fetch) {
+    if (typeof XMLHttpRequest === 'undefined') {
+        return fetcher(url, { method: 'PUT', body: blob, signal: callbacks.signal, headers }).then((response) => {
+            if (!response.ok)
+                throw new Error(`Upload failed with ${response.status}`);
+            callbacks.onProgress?.({ loaded: blob.size, total: blob.size, percent: 100 });
+        });
+    }
+    return new Promise((resolve, reject) => {
+        const xhr = new XMLHttpRequest();
+        xhr.open('PUT', url);
+        for (const [name, value] of Object.entries(headers))
+            xhr.setRequestHeader(name, value);
+        const abort = () => xhr.abort();
+        const cleanup = () => callbacks.signal?.removeEventListener('abort', abort);
+        callbacks.signal?.addEventListener('abort', abort, { once: true });
+        xhr.upload.onprogress = (event) => {
+            const total = event.total || blob.size;
+            callbacks.onProgress?.({ loaded: event.loaded, total, percent: total ? Math.round(event.loaded / total * 100) : 0 });
+        };
+        xhr.onload = () => { cleanup(); xhr.status >= 200 && xhr.status < 300 ? resolve() : reject(new Error(`Upload failed with ${xhr.status}`)); };
+        xhr.onerror = () => { cleanup(); reject(new Error('Upload failed')); };
+        xhr.onabort = () => { cleanup(); reject(abortError()); };
+        xhr.send(blob);
+    });
+}
+export async function sha256Blob(blob) {
+    if (!globalThis.crypto?.subtle)
+        throw new Error('Web Crypto SHA-256 is required for multipart uploads');
+    const digest = await globalThis.crypto.subtle.digest('SHA-256', await blob.arrayBuffer());
+    return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, '0')).join('');
+}
+function validateSession(session, size) {
+    if (!session.id || !session.uploadToken || session.partSize <= 0)
+        throw new Error('Upload session is incomplete');
+    if (Date.parse(session.expiresAt) <= Date.now())
+        throw new Error('Upload session has expired');
+    if (size > session.maxBytes)
+        throw new Error(`File exceeds upload limit of ${session.maxBytes} bytes`);
+}
+function expectedPartSize(fileSize, partSize, partNumber) {
+    const offset = (partNumber - 1) * partSize;
+    if (partNumber < 1 || offset >= fileSize)
+        return -1;
+    return Math.min(partSize, fileSize - offset);
+}
+async function verifiedCompletedParts(file, session) {
+    const completed = new Map();
+    for (const part of session.parts) {
+        const expectedSize = expectedPartSize(file.size, session.partSize, part.partNumber);
+        if (part.size !== expectedSize || !part.checksumSHA256)
+            continue;
+        const offset = (part.partNumber - 1) * session.partSize;
+        const checksum = await sha256Blob(file.slice(offset, offset + expectedSize));
+        if (checksum.toLowerCase() === part.checksumSHA256.toLowerCase()) {
+            completed.set(part.partNumber, part.size);
+        }
+    }
+    return completed;
+}
+function fileFingerprint(file, request) {
+    const modified = file.lastModified ?? 0;
+    return [request.key, request.fileName, request.mimeType, file.size, modified].join(':');
+}
+function boundedInteger(value, fallback, minimum, maximum) {
+    if (value === undefined)
+        return fallback;
+    if (!Number.isSafeInteger(value))
+        throw new Error('Upload concurrency and retry attempts must be integers');
+    return Math.min(maximum, Math.max(minimum, value));
+}
+async function retryWithBackoff(operation, attempts, signal) {
+    let lastError;
+    for (let attempt = 0; attempt < attempts; attempt += 1) {
+        try {
+            return await operation();
+        }
+        catch (error) {
+            if (isAbortError(error) || signal?.aborted)
+                throw abortError();
+            lastError = error;
+            if (attempt + 1 < attempts)
+                await abortableDelay(250 * 2 ** attempt, signal);
+        }
+    }
+    throw lastError;
+}
+function abortableDelay(milliseconds, signal) {
+    throwIfAborted(signal);
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => { cleanup(); resolve(); }, milliseconds);
+        const abort = () => { clearTimeout(timer); cleanup(); reject(abortError()); };
+        const cleanup = () => signal?.removeEventListener('abort', abort);
+        signal?.addEventListener('abort', abort, { once: true });
+    });
+}
+function throwIfAborted(signal) { if (signal?.aborted)
+    throw abortError(); }
+function abortError() { return typeof DOMException === 'undefined' ? Object.assign(new Error('Upload cancelled'), { name: 'AbortError' }) : new DOMException('Upload cancelled', 'AbortError'); }
+function isAbortError(error) { return error instanceof Error && error.name === 'AbortError'; }

package/dist/workload-security.d.ts

@@ -0,0 +1,172 @@
+import type { StackShift } from './client.js';
+export type AdmissionDecision = 'allow' | 'review' | 'block';
+export type SecurityResourceStatus = 'pending' | 'approved' | 'rejected' | 'revoked' | 'expired';
+export type SecurityIncidentStatus = 'open' | 'reviewing' | 'quarantined' | 'released' | 'dismissed';
+export interface WorkloadAdmission {
+    id: string;
+    project_id?: string;
+    deployment_id?: string;
+    environment: string;
+    execution_kind: string;
+    image_reference: string;
+    image_digest: string;
+    policy_version: string;
+    decision: AdmissionDecision;
+    sanitized_evidence: unknown;
+    receipt_digest: string;
+    issued_at: string;
+    expires_at: string;
+    revoked_at?: string;
+}
+export interface ExternalDependency {
+    id: string;
+    project_id: string;
+    environment: string;
+    hostname: string;
+    port: number;
+    protocol: string;
+    purpose: string;
+    tls_required: boolean;
+    private_route_required: boolean;
+    detected: boolean;
+    status: string;
+    created_at: string;
+    updated_at: string;
+}
+export interface EgressGrant {
+    id: string;
+    project_id: string;
+    dependency_id?: string;
+    environment: string;
+    protocol: string;
+    hostname?: string;
+    cidr?: string;
+    port_start: number;
+    port_end: number;
+    purpose: string;
+    status: SecurityResourceStatus;
+    broad_public_egress: boolean;
+    expires_at: string;
+    resolved_cidrs?: string[];
+    created_at: string;
+    updated_at: string;
+}
+export interface PrivateRoute {
+    id: string;
+    project_id: string;
+    node_id: string;
+    environment: string;
+    route_kind: string;
+    cidr: string;
+    hostname?: string;
+    purpose: string;
+    status: SecurityResourceStatus;
+    expires_at: string;
+    created_at: string;
+    updated_at: string;
+}
+export interface NetworkDestination {
+    protocol: string;
+    hostname?: string;
+    cidrs?: string[];
+    port_start: number;
+    port_end: number;
+    purpose: string;
+    grant_id?: string;
+    expires_at?: string;
+}
+export interface NetworkPolicy {
+    version: string;
+    mode: 'restricted' | 'quarantined';
+    allow_stackshift_dns: boolean;
+    allow_public_web: boolean;
+    destinations: NetworkDestination[];
+    block_private_ranges: boolean;
+    block_metadata: boolean;
+    block_alternate_dns: boolean;
+    block_unexpected_udp: boolean;
+}
+export interface PolicyInspection {
+    effective: boolean;
+    policy?: NetworkPolicy;
+    pending_dependencies?: ExternalDependency[];
+}
+export interface SecurityIncident {
+    id: string;
+    project_id: string;
+    deployment_id?: string;
+    environment: string;
+    category: string;
+    confidence: 'low' | 'medium' | 'high';
+    status: SecurityIncidentStatus;
+    sanitized_summary: string;
+    sanitized_evidence: unknown;
+    quarantined_at?: string;
+    enforcement_status: string;
+    released_at?: string;
+    resolution_note?: string;
+    created_at: string;
+    updated_at: string;
+}
+export interface DeclareDependencyInput {
+    environment: string;
+    hostname: string;
+    port: number;
+    protocol: string;
+    purpose: string;
+    tls_required?: boolean;
+}
+export interface RequestGrantInput {
+    dependency_id?: string;
+    environment: string;
+    protocol: string;
+    hostname?: string;
+    cidr?: string;
+    port_start: number;
+    port_end: number;
+    purpose: string;
+    broad_public_egress?: boolean;
+    expires_at: string;
+}
+export interface RequestPrivateRouteInput {
+    node_id: string;
+    environment: string;
+    route_kind: string;
+    cidr: string;
+    hostname?: string;
+    purpose: string;
+    expires_at: string;
+}
+export declare class WorkloadSecurityClient {
+    private readonly client;
+    constructor(client: StackShift);
+    private root;
+    admissions(projectId: string, limit?: number): Promise<{
+        admissions: WorkloadAdmission[];
+    }>;
+    policy(projectId: string, environment?: string): Promise<PolicyInspection>;
+    dependencies(projectId: string, environment?: string): Promise<{
+        dependencies: ExternalDependency[];
+    }>;
+    declareDependency(projectId: string, input: DeclareDependencyInput): Promise<{
+        dependencies: ExternalDependency[];
+    }>;
+    refreshDependencies(projectId: string, environment: string): Promise<{
+        dependencies: ExternalDependency[];
+    }>;
+    grants(projectId: string, environment?: string): Promise<{
+        grants: EgressGrant[];
+    }>;
+    requestGrant(projectId: string, input: RequestGrantInput): Promise<EgressGrant>;
+    privateRoutes(projectId: string, environment?: string): Promise<{
+        private_routes: PrivateRoute[];
+    }>;
+    requestPrivateRoute(projectId: string, input: RequestPrivateRouteInput): Promise<PrivateRoute>;
+    incidents(projectId: string, status?: SecurityIncidentStatus, limit?: number): Promise<{
+        incidents: SecurityIncident[];
+    }>;
+    incident(projectId: string, incidentId: string): Promise<{
+        incident: SecurityIncident;
+        notifications: unknown[];
+    }>;
+}

package/dist/workload-security.js

@@ -0,0 +1,50 @@
+export class WorkloadSecurityClient {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    root(projectId) {
+        return `/projects/${encodeURIComponent(projectId)}/security`;
+    }
+    admissions(projectId, limit) {
+        return this.client.request(withQuery(`${this.root(projectId)}/admissions`, { limit }));
+    }
+    policy(projectId, environment) {
+        return this.client.request(withQuery(`${this.root(projectId)}/policy`, { environment }));
+    }
+    dependencies(projectId, environment) {
+        return this.client.request(withQuery(`${this.root(projectId)}/dependencies`, { environment }));
+    }
+    declareDependency(projectId, input) {
+        return this.client.request(`${this.root(projectId)}/dependencies`, { method: 'POST', body: input });
+    }
+    refreshDependencies(projectId, environment) {
+        return this.client.request(`${this.root(projectId)}/dependencies/refresh`, { method: 'POST', body: { environment } });
+    }
+    grants(projectId, environment) {
+        return this.client.request(withQuery(`${this.root(projectId)}/grants`, { environment }));
+    }
+    requestGrant(projectId, input) {
+        return this.client.request(`${this.root(projectId)}/grants`, { method: 'POST', body: input });
+    }
+    privateRoutes(projectId, environment) {
+        return this.client.request(withQuery(`${this.root(projectId)}/private-routes`, { environment }));
+    }
+    requestPrivateRoute(projectId, input) {
+        return this.client.request(`${this.root(projectId)}/private-routes`, { method: 'POST', body: input });
+    }
+    incidents(projectId, status, limit) {
+        return this.client.request(withQuery(`${this.root(projectId)}/incidents`, { status, limit }));
+    }
+    incident(projectId, incidentId) {
+        return this.client.request(`${this.root(projectId)}/incidents/${encodeURIComponent(incidentId)}`);
+    }
+}
+function withQuery(path, values) {
+    const query = new URLSearchParams();
+    for (const [key, value] of Object.entries(values)) {
+        if (value !== undefined && value !== '')
+            query.set(key, String(value));
+    }
+    return query.size ? `${path}?${query}` : path;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stackshift-cloud/sdk",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "Official JavaScript and TypeScript SDK for StackShift.",
   "type": "module",
   "main": "./dist/index.js",
@@ -17,7 +17,7 @@
   ],
   "scripts": {
     "build": "tsc -p tsconfig.json",
-    "test": "npm run build && node test/mail.test.mjs && node test/mail-webhooks.test.mjs && node test/mail-advanced.test.mjs && node test/mail-exports.test.mjs && node test/mail-diagnostics.test.mjs && node test/assets.test.mjs"
+    "test": "npm run build && node test/mail.test.mjs && node test/mail-simulation.test.mjs && node test/mail-platform.test.mjs && node test/mail-webhooks.test.mjs && node test/mail-advanced.test.mjs && node test/mail-tracking.test.mjs && node test/mail-subscribers.test.mjs && node test/mail-exports.test.mjs && node test/mail-diagnostics.test.mjs && node test/assets.test.mjs && node test/assets-platform.test.mjs && node test/assets-video.test.mjs && node test/assets-dam.test.mjs"
   },
   "devDependencies": {
     "typescript": "^5.4.0"