@stacksjs/ts-cloud 0.7.105 → 0.7.109

package/dist/deploy/index.js

@@ -1,6 +1,10 @@
 import {
   buildAndPushContainerImage,
   buildFunctionEnv,
+  buildServerTopology,
+  buildServerlessTopology,
+  buildTopology,
+  collectEgressMetrics,
   createContainerImageDependencies,
   createExistingStaticFullStackDependencies,
   createStaticApiOriginDependencies,
@@ -10,9 +14,11 @@ import {
   deployServerlessApp,
   deploySite,
   deployStaticApiOrigin,
+  egressReportMetrics,
   ensureDashboardActor,
   estimateExistingStaticFullStackMonthlyCost,
   estimateStaticApiOriginMonthlyCost,
+  fetchEgressReport,
   generateExistingStaticFullStackTemplate,
   hashContainerContext,
   infraEnvFromOutputs,
@@ -30,7 +36,7 @@ import {
   synchronizeDashboardUsers,
   trackDashboardOperation,
   verifyStaticApiOrigin
-} from "../chunk-vkd2y0fs.js";
+} from "../chunk-cktwk9hy.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -41,15 +47,17 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "../chunk-ef2dwfrg.js";
+} from "../chunk-8kh577qh.js";
 import {
   buildAndPushServerlessImage
-} from "../chunk-3g4r09dd.js";
-import"../chunk-ybcz6sxc.js";
+} from "../chunk-wmbep3b5.js";
+import"../chunk-x6yzgv7y.js";
+import"../chunk-hpv68b4a.js";
 import"../chunk-01d86gt1.js";
 import"../chunk-50jpda9q.js";
 import"../chunk-he9a874b.js";
 import"../chunk-gttvakpv.js";
+import"../chunk-32e7ya18.js";
 import {
   IPV6_EXCLUDED_HOST_LABELS,
   MANAGEMENT_DASHBOARD_SITE,
@@ -70,14 +78,15 @@ import {
   siteInstallBase,
   validateDeploymentConfig,
   verifyAddressRecord
-} from "../chunk-dmzez5f8.js";
-import"../chunk-c6db5m63.js";
+} from "../chunk-d3vx2ekv.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
-import"../chunk-hpv68b4a.js";
-import"../chunk-32e7ya18.js";
 import"../chunk-wj3s95p9.js";
 import"../chunk-zqtpg06c.js";
+import"../chunk-grx1rp09.js";
+import"../chunk-va2yd85b.js";
+import"../chunk-aa2dkn7b.js";
+import"../chunk-t2s3gdq6.js";
 import"../chunk-v0bahtg2.js";
 export {
   verifyStaticApiOrigin,
@@ -114,10 +123,12 @@ export {
   generateStaticSiteTemplate,
   generateExternalDnsStaticSiteTemplate,
   generateExistingStaticFullStackTemplate,
+  fetchEgressReport,
   estimateStaticApiOriginMonthlyCost,
   estimateExistingStaticFullStackMonthlyCost,
   ensureManagementDashboard,
   ensureDashboardActor,
+  egressReportMetrics,
   deployStaticSiteWithExternalDnsFull,
   deployStaticSiteWithExternalDns,
   deployStaticSiteFull,
@@ -134,6 +145,10 @@ export {
   createExistingStaticFullStackDependencies,
   createContainerImageDependencies,
   collectServerDnsDomains,
+  collectEgressMetrics,
+  buildTopology,
+  buildServerlessTopology,
+  buildServerTopology,
   buildManagementDashboardArtifact,
   buildFunctionEnv,
   buildAndPushServerlessImage,

package/dist/deploy/local-dashboard-server.d.ts

@@ -22,6 +22,8 @@ export interface LocalDashboardServerOptions {
     oidcFetch?: OidcFetch;
     /** Run the persistent deployment worker in this process. Defaults off in tests. */
     queueWorker?: boolean;
+    /** Evaluate spend budgets on a timer. Off in tests, like the queue worker. */
+    spendLoop?: boolean;
     /** Maximum number of operations this process may execute in parallel. */
     queueParallelism?: number;
     /** Resolve the provider-specific immutable activation primitive for release jobs. */

package/dist/drivers/index.js

@@ -68,12 +68,14 @@ import {
   waitForSsh,
   wrapCloudInitUserData,
   writeResizeCheckpoint
-} from "../chunk-dmzez5f8.js";
-import"../chunk-c6db5m63.js";
+} from "../chunk-d3vx2ekv.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-wj3s95p9.js";
 import"../chunk-zqtpg06c.js";
+import"../chunk-va2yd85b.js";
+import"../chunk-aa2dkn7b.js";
+import"../chunk-t2s3gdq6.js";
 import"../chunk-v0bahtg2.js";
 export {
   writeResizeCheckpoint,

package/dist/drivers/shared/protection.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Edge protection at provision time.
+ *
+ * UFW (see `ufw.ts`) decides which ports are open. This decides what happens to
+ * the traffic that arrives on them: kernel-level flood mitigation, and the WAF.
+ *
+ * Both are **on by default**. A protection that has to be switched on protects
+ * only the people who already knew they needed it, which is never the box that
+ * gets hit. The escape hatches are explicit (`ddos: false`, `waf: false`) and
+ * the WAF starts in detection-only, so the default posture is "see everything,
+ * block only floods".
+ */
+import type { DdosConfig } from '../../protection/ddos';
+import type { WafConfig } from '../../protection/waf';
+/** `true` for defaults, `false` to skip, or an object to tune. */
+export type ProtectionSetting<T> = boolean | T | undefined;
+/** L3/L4 defaults: protect the web ports, count-and-drop, ten-minute bans. */
+export declare const DEFAULT_COMPUTE_DDOS: DdosConfig;
+/**
+ * WAF defaults: paranoia 1, detection only.
+ *
+ * Detection rather than blocking because zig-waf is pre-alpha and because a
+ * ruleset nobody has read their own logs against will block real traffic. The
+ * operator promotes it once they have looked.
+ */
+export declare const DEFAULT_COMPUTE_WAF: WafConfig;
+/** Kernel-level flood mitigation. Returns no lines when disabled. */
+export declare function buildDdosScript(setting?: ProtectionSetting<DdosConfig>, extraPorts?: number[]): string[];
+/** WAF configuration. Returns no lines when disabled or when the binary is absent. */
+export declare function buildWafScript(setting?: ProtectionSetting<WafConfig>): string[];
+export interface ComputeProtectionConfig {
+    ddos?: ProtectionSetting<DdosConfig>;
+    waf?: ProtectionSetting<WafConfig>;
+}
+/**
+ * Both layers, in order: kernel first, then application.
+ *
+ * Order matters on a box that is already being hit. The packet filter costs
+ * nothing per request and starts dropping immediately; the WAF has to parse
+ * every request it inspects, so bringing it up first would spend CPU on
+ * traffic the kernel was about to discard anyway.
+ */
+export declare function buildProtectionScript(protection?: ComputeProtectionConfig, extraPorts?: number[]): string[];

package/dist/drivers/shared/protection.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/index.d.ts

@@ -9,6 +9,9 @@ export * from './compose';
 export * from './release';
 export * from './runtime';
 export * from './telemetry';
+export * from './spend';
+export { applyControlsToDdos, applyControlsToRateLimits, applyMitigationFactor, DEFAULT_ATTACK_MODE_HOURS, defaultRateLimitRules, describePosture, MAX_CONTROL_HOURS, ProtectionControlStore, DEFAULT_DDOS_THRESHOLDS, DEFAULT_RECURSION_LIMITS, escapeSecLang, functionFingerprint, globMatches, globToRegex, inspectInvocation, isSafePattern, isValidCidr, parseChain, planMitigation, propagationHeaders, rateLimitHeaders, rateLimitKey, RateLimiter as EdgeRateLimiter, RATE_LIMIT_KEY_SEPARATOR, RecursionGuard, recursionBlockedResponse, renderDdosInstallScript, renderNftablesRuleset, renderSysctlFile, renderWafConfig, renderWafInstallScript, ruleMatches, sysctlHardening, wafEventTelemetry, CHAIN_HEADER, DEPTH_HEADER, TRACE_HEADER, } from './protection';
+export type { DdosConfig, DdosThresholds, IpRules, ProtectionControls, ProtectionPosture, TimeBoxedControl, InvocationContext, MitigationLevel, MitigationPlan, ParanoiaLevel, RateLimitAction, RateLimitAlgorithm, RateLimitDecision, RateLimitKeySource, RateLimitKeySpec, RateLimitRule as EdgeRateLimitRule, RecursionLimits, RecursionReason, RecursionVerdict, RequestDescriptor, TrafficSignals, WafConfig as EdgeWafConfig, WafEvent, WafGenerationResult, WafMode, WafRuleExclusion, } from './protection';
 export { AlertEvaluator, AlertStore, HealthCheckRunner, NotificationRouter, evaluateTelemetryAlertRules, isQuietHours, } from './alerts';
 export type { Alert, AlertEvaluation, AlertRule, AlertSample, AlertSeverity, AlertState, HealthCheck as AlertHealthCheck, HealthResult as AlertHealthResult, HealthStatus as AlertHealthStatus, NotificationChannel as AlertNotificationChannel, NotificationDelivery as AlertNotificationDelivery, NotificationRoute as AlertNotificationRoute, } from './alerts';
 export * from './jobs';