@stacksjs/ts-cloud 0.7.104 → 0.7.108

package/dist/{chunk-6hymgy61.js → chunk-gttvakpv.js}

@@ -306,90 +306,6 @@ class PorkbunProvider {
     }
   }
 }
-// src/dns/mail-records.ts
-function buildSpfValue(options) {
-  const mechanisms = ["v=spf1"];
-  if (options.ip)
-    mechanisms.push(`ip4:${options.ip}`);
-  for (const include of options.spfIncludes || []) {
-    mechanisms.push(include.startsWith("include:") ? include : `include:${include}`);
-  }
-  mechanisms.push("~all");
-  return mechanisms.join(" ");
-}
-function normalizeDkimKey(key) {
-  return String(key || "").replace(/-----(?:BEGIN|END)[^-]*-----/g, "").replace(/\s+/g, "");
-}
-function buildDkimValue(publicKey) {
-  return `v=DKIM1; k=rsa; p=${normalizeDkimKey(publicKey)}`;
-}
-function buildDmarcValue(options) {
-  const parts = [`v=DMARC1`, `p=${options.dmarcPolicy || "none"}`];
-  if (options.dmarcReportTo)
-    parts.push(`rua=mailto:${options.dmarcReportTo}`);
-  return `${parts.join("; ")};`;
-}
-function buildMailDnsRecords(options) {
-  if (!options.domain)
-    throw new Error("A domain is required to build mail DNS records.");
-  if (!options.mailHost)
-    throw new Error("A mail host is required to build mail DNS records.");
-  const ttl = options.ttl ?? 600;
-  const selector = options.dkimSelector || "default";
-  const records = [
-    {
-      name: "@",
-      type: "MX",
-      content: options.mailHost,
-      priority: options.mxPriority ?? 10,
-      ttl
-    },
-    {
-      name: "@",
-      type: "TXT",
-      content: buildSpfValue(options),
-      ttl
-    },
-    {
-      name: "_dmarc",
-      type: "TXT",
-      content: buildDmarcValue(options),
-      ttl
-    }
-  ];
-  if (normalizeDkimKey(options.dkimPublicKey || "")) {
-    records.push({
-      name: `${selector}._domainkey`,
-      type: "TXT",
-      content: buildDkimValue(options.dkimPublicKey),
-      ttl
-    });
-  }
-  return records;
-}
-async function syncMailDns(provider, options) {
-  const records = buildMailDnsRecords(options);
-  const applied = [];
-  for (const record of records) {
-    try {
-      const result = await provider.upsertRecord(options.domain, record);
-      applied.push({
-        name: record.name,
-        type: record.type,
-        ok: Boolean(result.success),
-        message: result.message
-      });
-    } catch (error) {
-      applied.push({
-        name: record.name,
-        type: record.type,
-        ok: false,
-        message: error instanceof Error ? error.message : String(error)
-      });
-    }
-  }
-  return { domain: options.domain, applied, ok: applied.every((entry) => entry.ok) };
-}
 // src/dns/godaddy.ts
 var GODADDY_API_URL = "https://api.godaddy.com";
 var GODADDY_OTE_API_URL = "https://api.ote-godaddy.com";
@@ -1966,4 +1882,4 @@ class DnsProviderFactory {
 }
 var dnsProviders = new DnsProviderFactory;
 
-export { PorkbunProvider, buildSpfValue, normalizeDkimKey, buildDkimValue, buildDmarcValue, buildMailDnsRecords, syncMailDns, GoDaddyProvider, CloudflareProvider, Route53Provider, UnifiedDnsValidator, createPorkbunValidator, createGoDaddyValidator, createRoute53Validator, createDnsProvider, detectDnsProvider, DnsProviderFactory, dnsProviders, ACMClient, ACMDnsValidator };
+export { PorkbunProvider, GoDaddyProvider, CloudflareProvider, Route53Provider, UnifiedDnsValidator, createPorkbunValidator, createGoDaddyValidator, createRoute53Validator, createDnsProvider, detectDnsProvider, DnsProviderFactory, dnsProviders, ACMClient, ACMDnsValidator };

package/dist/{chunk-adgz2c49.js → chunk-s9c2x5jv.js}

@@ -5,9 +5,9 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "./chunk-5cz14833.js";
+} from "./chunk-ef2dwfrg.js";
 import"./chunk-01d86gt1.js";
-import"./chunk-6hymgy61.js";
+import"./chunk-gttvakpv.js";
 import"./chunk-4cjrg98a.js";
 import"./chunk-32e7ya18.js";
 import"./chunk-wj3s95p9.js";

package/dist/deploy/dashboard-bundle-encoding.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-payload.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Serialize the dashboard payload for the trip through an environment variable.
+ *
+ * The UI is rebuilt by spawning stx with the resolved data in
+ * `TSCLOUD_DASHBOARD_DATA`. Environment variables are bytes, and the child
+ * decodes them using its locale — so on a box whose locale is `POSIX`/`C`
+ * (the default on most minimal server images) every non-ASCII character in the
+ * payload comes back mis-decoded and is then re-encoded as UTF-8, arriving in
+ * the built page as mojibake: `—` renders as `â€"`, `·` as `·`.
+ *
+ * That is not hypothetical or cosmetic. It corrupts any project name, domain,
+ * or status text carrying an accent or a dash, on exactly the hosts operators
+ * are most likely to provision.
+ *
+ * Escaping every non-ASCII code point makes the transport pure ASCII, which no
+ * locale can misread. `JSON.parse` on the other side turns the escapes back
+ * into the original characters, so the payload is unchanged — only its wire
+ * form is narrowed.
+ */
+export declare function encodeDashboardPayload(data: unknown): string;

package/dist/deploy/dashboard-payload.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-topology.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Derive the infrastructure topology the dashboard draws as a diagram.
+ *
+ * Deliberately built from the *resolved dashboard data* rather than straight
+ * from the cloud config: the diagram then shows what the rest of the cockpit
+ * shows — the same sites, services, functions and queues, with the same
+ * statuses — instead of a second, subtly different reading of the world.
+ *
+ * Nothing here invents a resource. A slice that could not be read simply
+ * contributes no node, and the reason lands in `notes` so the page can say so
+ * out loud. See `packages/ui/pages/infrastructure/topology.stx`.
+ */
+export type TopologyStatus = 'ok' | 'warn' | 'bad' | 'idle' | 'unknown';
+export type TopologyKind = 'internet' | 'dns' | 'waf' | 'firewall' | 'cdn' | 'gateway' | 'proxy' | 'site' | 'function' | 'worker' | 'scheduler' | 'queue' | 'cache' | 'database' | 'storage' | 'filesystem' | 'backup';
+/** How traffic or state moves along an edge — drives the edge styling. */
+export type TopologyFlow = 'request' | 'async' | 'data' | 'backup';
+export interface TopologyFact {
+    label: string;
+    value: string;
+}
+export interface TopologyNode {
+    id: string;
+    label: string;
+    kind: TopologyKind;
+    /** Row in the diagram: 0 is the internet, higher is deeper in the stack. */
+    layer: number;
+    status: TopologyStatus;
+    /** One-line subtitle: runtime, engine, instance class… */
+    sub?: string;
+    facts: TopologyFact[];
+    /** Dashboard page this resource is managed from. */
+    href?: string;
+    /** Boundary this node sits inside (a box, a VPC, a managed account). */
+    group?: string;
+    /** Outside the deployment — drawn as an open shape. */
+    external?: boolean;
+}
+export interface TopologyLink {
+    source: string;
+    target: string;
+    flow: TopologyFlow;
+    label?: string;
+    status?: TopologyStatus;
+}
+export interface TopologyGroup {
+    id: string;
+    label: string;
+    sub?: string;
+}
+export interface TopologyLayer {
+    index: number;
+    id: string;
+    label: string;
+}
+/** Identity the data bag doesn't carry on its own. */
+export interface TopologyContext {
+    project?: string;
+    environment?: string;
+}
+export interface TopologyModel {
+    mode: 'server' | 'serverless';
+    project: string;
+    environment: string;
+    provider: string;
+    region: string;
+    generatedAt: string;
+    layers: TopologyLayer[];
+    groups: TopologyGroup[];
+    nodes: TopologyNode[];
+    links: TopologyLink[];
+    /** What the diagram could not show, and why. Never left implicit. */
+    notes: string[];
+}
+/**
+ * Server-mode topology: clients → DNS → host firewall → reverse proxy → sites,
+ * with the box's workers, scheduler, data services and backups hanging off it.
+ */
+export declare function buildServerTopology(data: Record<string, any>, context?: TopologyContext): TopologyModel;
+/**
+ * Serverless-mode topology: clients → DNS → WAF/CDN → the HTTP entry point →
+ * functions, with queues, database, cache and object storage behind them.
+ */
+export declare function buildServerlessTopology(data: Record<string, any>, context?: TopologyContext): TopologyModel;
+/** Build the topology matching the dashboard mode the data was resolved for. */
+export declare function buildTopology(mode: 'server' | 'serverless', data: Record<string, any>, context?: TopologyContext): TopologyModel;

package/dist/deploy/dashboard-topology.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/egress-collection.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Object-storage egress collection.
+ *
+ * Host network counters answer a different question than the one an
+ * object-storage invoice asks. When an application redirects downloads to a
+ * bucket (or to a CDN in front of one), those bytes never traverse the host's
+ * NIC — the box can sit idle while the bucket serves terabytes. The only
+ * component that knows a transfer happened, and how large it was, is the
+ * application that authorized it, so this polls it instead of guessing.
+ *
+ * The reports carry a per-day history rather than a single counter, and that is
+ * deliberately exploited here: each day becomes one metric point stamped with
+ * that day's own timestamp. Because record ids are a deterministic hash of
+ * (source, name, timestamp) and the store inserts with OR IGNORE, replaying a
+ * history is idempotent. A collector that was down for six hours — or six days
+ * — backfills what it missed on its next run instead of leaving a hole, and
+ * re-reading the same day never double-counts it.
+ */
+import type { EgressEndpointConfig, EgressReport } from '@ts-cloud/core';
+export interface EgressMetric {
+    name: string;
+    value: number;
+    unit: string;
+    /** ISO timestamp this point belongs to. */
+    timestamp: string;
+    attributes: Record<string, string>;
+}
+export interface EgressCollectionResult {
+    metrics: EgressMetric[];
+    errors: Array<{
+        source: string;
+        message: string;
+    }>;
+}
+/**
+ * Turn one report into metric points.
+ *
+ * Pure: no clock, no network. `now` is the timestamp for the point-in-time
+ * series (month-to-date, projection, allowance), which describe the moment of
+ * collection rather than a calendar day.
+ */
+export declare function egressReportMetrics(report: EgressReport | null | undefined, options: {
+    name: string;
+    now: string;
+    maxReplayDays?: number;
+}): EgressMetric[];
+/**
+ * Fetch one endpoint's report.
+ *
+ * Returns null on any failure. An egress endpoint is supplementary — it must
+ * never be able to fail a telemetry collection that is also carrying host
+ * metrics, so problems surface as an error entry rather than a throw.
+ */
+export declare function fetchEgressReport(endpoint: EgressEndpointConfig, env?: NodeJS.ProcessEnv, fetchImpl?: typeof fetch): Promise<EgressReport | null>;
+/** Poll every configured endpoint and flatten the results. */
+export declare function collectEgressMetrics(endpoints: EgressEndpointConfig[] | undefined, options: {
+    now: string;
+    env?: NodeJS.ProcessEnv;
+    fetchImpl?: typeof fetch;
+}): Promise<EgressCollectionResult>;

package/dist/deploy/index.d.ts

@@ -15,5 +15,7 @@ export * from './container-image';
 export { buildFunctionEnv, type CodeSource, deployServerlessApp, type DeployServerlessOptions, infraEnvFromOutputs, redeployServerlessApp, type ResolvedContext, rollbackServerlessApp, runRemoteCommand, setMaintenance, } from './serverless-app';
 export { buildAndPushServerlessImage, type BuildImageOptions, type BuiltImage } from './serverless-image';
 export { type DashboardData, resolveDashboardData } from './dashboard-data';
+export { buildServerlessTopology, buildServerTopology, buildTopology, type TopologyContext, type TopologyFact, type TopologyFlow, type TopologyGroup, type TopologyKind, type TopologyLayer, type TopologyLink, type TopologyModel, type TopologyNode, type TopologyStatus, } from './dashboard-topology';
+export { collectEgressMetrics, type EgressCollectionResult, egressReportMetrics, type EgressMetric, fetchEgressReport, } from './egress-collection';
 export { dashboardActions, resolveDashboardAction, sanitizeCloudConfig, startLocalDashboardServer, type DashboardAction, type LocalDashboardServer, type LocalDashboardServerOptions, } from './local-dashboard-server';
 export { buildManagementDashboardArtifact, dashboardCredentialsFile, ensureManagementDashboard, type EnsureDashboardLogger, MANAGEMENT_DASHBOARD_SITE, resolveDashboardAuth, type ResolvedDashboardAuth, resolveUiSource, } from './management-dashboard';

package/dist/deploy/index.js

@@ -1,6 +1,10 @@
 import {
   buildAndPushContainerImage,
   buildFunctionEnv,
+  buildServerTopology,
+  buildServerlessTopology,
+  buildTopology,
+  collectEgressMetrics,
   createContainerImageDependencies,
   createExistingStaticFullStackDependencies,
   createStaticApiOriginDependencies,
@@ -10,9 +14,11 @@ import {
   deployServerlessApp,
   deploySite,
   deployStaticApiOrigin,
+  egressReportMetrics,
   ensureDashboardActor,
   estimateExistingStaticFullStackMonthlyCost,
   estimateStaticApiOriginMonthlyCost,
+  fetchEgressReport,
   generateExistingStaticFullStackTemplate,
   hashContainerContext,
   infraEnvFromOutputs,
@@ -30,7 +36,7 @@ import {
   synchronizeDashboardUsers,
   trackDashboardOperation,
   verifyStaticApiOrigin
-} from "../chunk-gtz4jar2.js";
+} from "../chunk-eg8ck25v.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -41,7 +47,7 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "../chunk-5cz14833.js";
+} from "../chunk-ef2dwfrg.js";
 import {
   buildAndPushServerlessImage
 } from "../chunk-3g4r09dd.js";
@@ -49,7 +55,7 @@ import"../chunk-ybcz6sxc.js";
 import"../chunk-01d86gt1.js";
 import"../chunk-50jpda9q.js";
 import"../chunk-he9a874b.js";
-import"../chunk-6hymgy61.js";
+import"../chunk-gttvakpv.js";
 import {
   IPV6_EXCLUDED_HOST_LABELS,
   MANAGEMENT_DASHBOARD_SITE,
@@ -70,7 +76,7 @@ import {
   siteInstallBase,
   validateDeploymentConfig,
   verifyAddressRecord
-} from "../chunk-dmzez5f8.js";
+} from "../chunk-33sy72r8.js";
 import"../chunk-c6db5m63.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
@@ -114,10 +120,12 @@ export {
   generateStaticSiteTemplate,
   generateExternalDnsStaticSiteTemplate,
   generateExistingStaticFullStackTemplate,
+  fetchEgressReport,
   estimateStaticApiOriginMonthlyCost,
   estimateExistingStaticFullStackMonthlyCost,
   ensureManagementDashboard,
   ensureDashboardActor,
+  egressReportMetrics,
   deployStaticSiteWithExternalDnsFull,
   deployStaticSiteWithExternalDns,
   deployStaticSiteFull,
@@ -134,6 +142,10 @@ export {
   createExistingStaticFullStackDependencies,
   createContainerImageDependencies,
   collectServerDnsDomains,
+  collectEgressMetrics,
+  buildTopology,
+  buildServerlessTopology,
+  buildServerTopology,
   buildManagementDashboardArtifact,
   buildFunctionEnv,
   buildAndPushServerlessImage,

package/dist/dns/index.d.ts

@@ -4,8 +4,6 @@
  */
 export * from './types';
 export { PorkbunProvider } from './porkbun';
-export { buildDkimValue, buildDmarcValue, buildMailDnsRecords, buildSpfValue, normalizeDkimKey, syncMailDns, } from './mail-records';
-export type { MailDnsOptions, MailDnsSyncResult } from './mail-records';
 export { GoDaddyProvider } from './godaddy';
 export { CloudflareProvider } from './cloudflare';
 export { Route53Provider } from './route53-adapter';

package/dist/dns/index.js

@@ -5,35 +5,23 @@ import {
   PorkbunProvider,
   Route53Provider,
   UnifiedDnsValidator,
-  buildDkimValue,
-  buildDmarcValue,
-  buildMailDnsRecords,
-  buildSpfValue,
   createDnsProvider,
   createGoDaddyValidator,
   createPorkbunValidator,
   createRoute53Validator,
   detectDnsProvider,
-  dnsProviders,
-  normalizeDkimKey,
-  syncMailDns
-} from "../chunk-6hymgy61.js";
+  dnsProviders
+} from "../chunk-gttvakpv.js";
 import"../chunk-32e7ya18.js";
 import"../chunk-zqtpg06c.js";
 import"../chunk-v0bahtg2.js";
 export {
-  syncMailDns,
-  normalizeDkimKey,
   dnsProviders,
   detectDnsProvider,
   createRoute53Validator,
   createPorkbunValidator,
   createGoDaddyValidator,
   createDnsProvider,
-  buildSpfValue,
-  buildMailDnsRecords,
-  buildDmarcValue,
-  buildDkimValue,
   UnifiedDnsValidator,
   Route53Provider,
   PorkbunProvider,

package/dist/drivers/index.js

@@ -68,7 +68,7 @@ import {
   waitForSsh,
   wrapCloudInitUserData,
   writeResizeCheckpoint
-} from "../chunk-dmzez5f8.js";
+} from "../chunk-33sy72r8.js";
 import"../chunk-c6db5m63.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";

package/dist/index.d.ts

@@ -37,8 +37,7 @@ export { createCloudDriver, CloudDriverFactory, cloudDrivers, AwsDriver, Hetzner
 export type { CreateCloudDriverOptions } from './drivers/factory';
 export { dashboardActions, resolveDashboardAction, sanitizeCloudConfig, startLocalDashboardServer, } from './deploy/local-dashboard-server';
 export type { DashboardAction, LocalDashboardServer, LocalDashboardServerOptions, } from './deploy/local-dashboard-server';
-export { createDnsProvider, detectDnsProvider, DnsProviderFactory, dnsProviders, PorkbunProvider, GoDaddyProvider, Route53Provider, UnifiedDnsValidator, createPorkbunValidator, createGoDaddyValidator, createRoute53Validator, buildMailDnsRecords, buildSpfValue, buildDkimValue, buildDmarcValue, normalizeDkimKey, syncMailDns, } from './dns';
-export type { MailDnsOptions, MailDnsSyncResult } from './dns';
+export { createDnsProvider, detectDnsProvider, DnsProviderFactory, dnsProviders, PorkbunProvider, GoDaddyProvider, Route53Provider, UnifiedDnsValidator, createPorkbunValidator, createGoDaddyValidator, createRoute53Validator, } from './dns';
 export * from './source';
 export * from './queue';
 export * from './backups';

package/dist/index.js

@@ -283,7 +283,7 @@ import {
   volumeCapabilities,
   webhookEndpoint,
   zeroCapacity
-} from "./chunk-gtz4jar2.js";
+} from "./chunk-eg8ck25v.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -294,7 +294,7 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "./chunk-5cz14833.js";
+} from "./chunk-ef2dwfrg.js";
 import {
   buildAndPushServerlessImage
 } from "./chunk-3g4r09dd.js";
@@ -353,19 +353,13 @@ import {
   PorkbunProvider,
   Route53Provider,
   UnifiedDnsValidator,
-  buildDkimValue,
-  buildDmarcValue,
-  buildMailDnsRecords,
-  buildSpfValue,
   createDnsProvider,
   createGoDaddyValidator,
   createPorkbunValidator,
   createRoute53Validator,
   detectDnsProvider,
-  dnsProviders,
-  normalizeDkimKey,
-  syncMailDns
-} from "./chunk-6hymgy61.js";
+  dnsProviders
+} from "./chunk-gttvakpv.js";
 import {
   AwsDriver,
   CloudDriverFactory,
@@ -411,7 +405,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-dmzez5f8.js";
+} from "./chunk-33sy72r8.js";
 import {
   ABTestManager,
   AI,
@@ -5169,7 +5163,6 @@ export {
   synchronizeConfiguredConfiguration,
   synchronizeComposeVolumes,
   syncSourceRepositories,
-  syncMailDns,
   suggestRegions,
   suggestRegionPairs,
   suggestQuotaIncrease,
@@ -5320,7 +5313,6 @@ export {
   normalizeScheduleExpression,
   normalizeRuntimeStatus,
   normalizePublicIpv6,
-  normalizeDkimKey,
   nextScheduleRuns,
   networkSecurityManager,
   needsRenewal,
@@ -5594,18 +5586,14 @@ export {
   bytes,
   buildStaticSiteDeployScript,
   buildSshArgs,
-  buildSpfValue,
   buildSiteDeployScript,
   buildPhpRuntimeLayerZip,
   buildOptimizationManager,
   buildNodeRuntimeLayerZip,
   buildMediaCdnPlan,
   buildManagementDashboardArtifact,
-  buildMailDnsRecords,
   buildHostCleanupScript,
   buildFunctionEnv,
-  buildDmarcValue,
-  buildDkimValue,
   buildComposeShellCommand,
   buildComposeScaleCommand,
   buildComposeRuntimeCommand,

package/dist/ui/404.html

@@ -793,6 +793,7 @@ video {
       
         <section class="nav-group">
           <h2>Infrastructure</h2>
+          <a class="" href="/infrastructure/topology?env=production">Infrastructure map</a>
           <a class="" href="/data/services?env=production">Data services</a>
           <a class="" href="/data/volumes?env=production">Persistent volumes</a>
           <a href="/server/firewall?env=production">Network & firewall</a><a href="/server/ssh-keys?env=production">SSH keys</a>