@stacksjs/ts-cloud 0.7.105 → 0.7.109

package/dist/{chunk-dmzez5f8.js → chunk-d3vx2ekv.js}

@@ -1,14 +1,3 @@
-import {
-  deploymentCoexistenceError,
-  hasManagementDashboardSite,
-  isManagementDashboardSiteName,
-  resolveAppDatabase,
-  resolveCloudProvider,
-  resolveManagementDashboardSites,
-  resolveProjectStackName,
-  resolveStatePath,
-  statePath
-} from "./chunk-c6db5m63.js";
 import {
   EC2Client,
   SSMClient
@@ -19,6 +8,23 @@ import {
 import {
   S3Client
 } from "./chunk-wj3s95p9.js";
+import {
+  renderWafInstallScript
+} from "./chunk-va2yd85b.js";
+import {
+  renderDdosInstallScript
+} from "./chunk-aa2dkn7b.js";
+import {
+  deploymentCoexistenceError,
+  hasManagementDashboardSite,
+  isManagementDashboardSiteName,
+  resolveAppDatabase,
+  resolveCloudProvider,
+  resolveManagementDashboardSites,
+  resolveProjectStackName,
+  resolveStatePath,
+  statePath
+} from "./chunk-t2s3gdq6.js";
 import {
   __require
 } from "./chunk-v0bahtg2.js";
@@ -752,9 +758,12 @@ function buildAutoUpdatesScript(enabled3 = true) {
 // src/drivers/shared/monitoring.ts
 var METRICS_PATH = "/var/lib/ts-cloud/metrics.json";
 var ALERT_STATE_PATH = "/var/lib/ts-cloud/alert-state";
+var BANDWIDTH_STATE_PATH = "/var/lib/ts-cloud/bandwidth-state";
+var BANDWIDTH_ALERT_STATE_PATH = "/var/lib/ts-cloud/bandwidth-alert-state";
 var DEFAULT_CPU_LOAD_PER_CORE = 2;
 var DEFAULT_MEM_PERCENT = 90;
 var DEFAULT_DISK_PERCENT = 90;
+var DEFAULT_BANDWIDTH_PERCENT = 80;
 var SERVICE_PROBES = [
   ["nginx", 80],
   ["https", 443],
@@ -769,17 +778,21 @@ var SERVICE_PROBES = [
 function resolveMonitoring(monitoring = true) {
   const obj = typeof monitoring === "object" ? monitoring : {};
   const enabled3 = typeof monitoring === "boolean" ? monitoring : monitoring.enabled !== false;
+  const bandwidthTb = Number(obj.alerts?.bandwidthTb ?? 0);
   return {
     enabled: enabled3,
     cpuLoadPerCore: obj.alerts?.cpuLoadPerCore ?? DEFAULT_CPU_LOAD_PER_CORE,
     memPercent: obj.alerts?.memPercent ?? DEFAULT_MEM_PERCENT,
-    diskPercent: obj.alerts?.diskPercent ?? DEFAULT_DISK_PERCENT
+    diskPercent: obj.alerts?.diskPercent ?? DEFAULT_DISK_PERCENT,
+    bandwidthTb: Number.isFinite(bandwidthTb) && bandwidthTb > 0 ? bandwidthTb : 0,
+    bandwidthPercent: obj.alerts?.bandwidthPercent ?? DEFAULT_BANDWIDTH_PERCENT
   };
 }
 function buildMonitoringScript(monitoring = true) {
-  const { enabled: enabled3, cpuLoadPerCore, memPercent, diskPercent } = resolveMonitoring(monitoring);
+  const { enabled: enabled3, cpuLoadPerCore, memPercent, diskPercent, bandwidthTb, bandwidthPercent } = resolveMonitoring(monitoring);
   if (!enabled3)
     return [];
+  const bandwidthBudgetBytes = Math.round(bandwidthTb * 1000 ** 4);
   const probeLines = SERVICE_PROBES.map(([name, port]) => `SVC_${name.toUpperCase()}=$(probe ${port})`);
   const servicesJson = SERVICE_PROBES.map(([name]) => `"${name}":"$SVC_${name.toUpperCase()}"`).join(",");
   return [
@@ -798,6 +811,36 @@ EOF`,
     `UPTIME_SEC=$(cut -d' ' -f1 /proc/uptime | cut -d. -f1)`,
     `RX_BYTES=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{rx+=$3} END{print rx+0}' /proc/net/dev)`,
     `TX_BYTES=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{tx+=$11} END{print tx+0}' /proc/net/dev)`,
+    "NOW_EPOCH=$(date -u +%s); TODAY=$(date -u +%Y-%m-%d); MONTH=$(date -u +%Y-%m)",
+    `if [ -r ${BANDWIDTH_STATE_PATH} ]; then . ${BANDWIDTH_STATE_PATH}; fi`,
+    "PREV_EPOCH=${PREV_EPOCH:-0}; PREV_RX=${PREV_RX:-0}; PREV_TX=${PREV_TX:-0}",
+    "DAY_KEY=${DAY_KEY:-$TODAY}; MONTH_KEY=${MONTH_KEY:-$MONTH}",
+    "DAY_RX=${DAY_RX:-0}; DAY_TX=${DAY_TX:-0}; MONTH_RX=${MONTH_RX:-0}; MONTH_TX=${MONTH_TX:-0}",
+    "ELAPSED=$(( NOW_EPOCH - PREV_EPOCH ))",
+    'if [ "$PREV_EPOCH" -le 0 ] || [ "$ELAPSED" -le 0 ] || [ "$RX_BYTES" -lt "$PREV_RX" ] || [ "$TX_BYTES" -lt "$PREV_TX" ]; then',
+    "  DELTA_RX=0; DELTA_TX=0; ELAPSED=0",
+    "else",
+    "  DELTA_RX=$(( RX_BYTES - PREV_RX )); DELTA_TX=$(( TX_BYTES - PREV_TX ))",
+    "fi",
+    'if [ "$DAY_KEY" != "$TODAY" ]; then DAY_KEY=$TODAY; DAY_RX=0; DAY_TX=0; fi',
+    'if [ "$MONTH_KEY" != "$MONTH" ]; then MONTH_KEY=$MONTH; MONTH_RX=0; MONTH_TX=0; fi',
+    "DAY_RX=$(( DAY_RX + DELTA_RX )); DAY_TX=$(( DAY_TX + DELTA_TX ))",
+    "MONTH_RX=$(( MONTH_RX + DELTA_RX )); MONTH_TX=$(( MONTH_TX + DELTA_TX ))",
+    'if [ "$ELAPSED" -gt 0 ]; then RX_RATE=$(( DELTA_RX / ELAPSED )); TX_RATE=$(( DELTA_TX / ELAPSED )); else RX_RATE=0; TX_RATE=0; fi',
+    `cat > ${BANDWIDTH_STATE_PATH}.tmp <<BWSTATE`,
+    "PREV_EPOCH=$NOW_EPOCH",
+    "PREV_RX=$RX_BYTES",
+    "PREV_TX=$TX_BYTES",
+    "RX_RATE=$RX_RATE",
+    "TX_RATE=$TX_RATE",
+    "DAY_KEY=$DAY_KEY",
+    "DAY_RX=$DAY_RX",
+    "DAY_TX=$DAY_TX",
+    "MONTH_KEY=$MONTH_KEY",
+    "MONTH_RX=$MONTH_RX",
+    "MONTH_TX=$MONTH_TX",
+    "BWSTATE",
+    `mv -f ${BANDWIDTH_STATE_PATH}.tmp ${BANDWIDTH_STATE_PATH}`,
     "probe(){ (exec 3<>/dev/tcp/127.0.0.1/$1) 2>/dev/null && echo up || echo down; }",
     ...probeLines,
     "LOAD=${LOAD:-0}; CPUS=${CPUS:-1}; MEM_TOTAL=${MEM_TOTAL:-0}; MEM_USED=${MEM_USED:-0}",
@@ -805,7 +848,7 @@ EOF`,
     "UPTIME_SEC=${UPTIME_SEC:-0}; RX_BYTES=${RX_BYTES:-0}; TX_BYTES=${TX_BYTES:-0}",
     "MEM_PCT=$(( MEM_TOTAL > 0 ? MEM_USED * 100 / MEM_TOTAL : 0 ))",
     `cat > ${METRICS_PATH}.tmp <<JSON`,
-    '{"load":$LOAD,"cpus":$CPUS,"memTotalMb":$MEM_TOTAL,"memUsedMb":$MEM_USED,"memUsedPct":$MEM_PCT,"swapTotalMb":$SWAP_TOTAL,"swapUsedMb":$SWAP_USED,"diskUsedPct":$DISK_PCT,"uptimeSec":$UPTIME_SEC,"network":{"rxBytes":$RX_BYTES,"txBytes":$TX_BYTES},"services":{' + servicesJson + "}}",
+    '{"load":$LOAD,"cpus":$CPUS,"memTotalMb":$MEM_TOTAL,"memUsedMb":$MEM_USED,"memUsedPct":$MEM_PCT,"swapTotalMb":$SWAP_TOTAL,"swapUsedMb":$SWAP_USED,"diskUsedPct":$DISK_PCT,"uptimeSec":$UPTIME_SEC,' + '"network":{"rxBytes":$RX_BYTES,"txBytes":$TX_BYTES,"rxBytesPerSec":$RX_RATE,"txBytesPerSec":$TX_RATE,' + '"dayKey":"$DAY_KEY","rxBytesToday":$DAY_RX,"txBytesToday":$DAY_TX,' + `"monthKey":"$MONTH_KEY","rxBytesMonth":$MONTH_RX,"txBytesMonth":$MONTH_TX,"budgetBytes":${bandwidthBudgetBytes}},"services":{` + servicesJson + "}}",
     "JSON",
     `mv -f ${METRICS_PATH}.tmp ${METRICS_PATH}`,
     'ALERTS=""',
@@ -820,6 +863,18 @@ EOF`,
     '  if [ "$PREV" = alert ] && [ -x /usr/local/bin/ts-cloud-notify ]; then /usr/local/bin/ts-cloud-notify "✅ $(hostname): resource usage back to normal" || true; fi',
     `  echo ok > ${ALERT_STATE_PATH}`,
     "fi",
+    ...bandwidthBudgetBytes > 0 ? [
+      "BW_TOTAL=$(( MONTH_RX + MONTH_TX ))",
+      `BW_PCT=$(( BW_TOTAL * 100 / ${bandwidthBudgetBytes} ))`,
+      `BW_PREV=$(cat ${BANDWIDTH_ALERT_STATE_PATH} 2>/dev/null || echo ok)`,
+      `if [ "$BW_PCT" -ge ${bandwidthPercent} ]; then`,
+      `  if [ "$BW_PREV" != alert ] && [ -x /usr/local/bin/ts-cloud-notify ]; then /usr/local/bin/ts-cloud-notify "⚠️ $(hostname): bandwidth at \${BW_PCT}% of the ${bandwidthTb} TB monthly allowance ($MONTH_KEY)" || true; fi`,
+      `  echo alert > ${BANDWIDTH_ALERT_STATE_PATH}`,
+      "else",
+      `  if [ "$BW_PREV" = alert ] && [ -x /usr/local/bin/ts-cloud-notify ]; then /usr/local/bin/ts-cloud-notify "✅ $(hostname): bandwidth back under the monthly allowance (\${BW_PCT}%)" || true; fi`,
+      `  echo ok > ${BANDWIDTH_ALERT_STATE_PATH}`,
+      "fi"
+    ] : [],
     "TS_CLOUD_METRICS_EOF",
     "chmod +x /usr/local/bin/ts-cloud-metrics.sh",
     `cat > /etc/systemd/system/ts-cloud-metrics.service <<'TS_CLOUD_METRICS_SVC_EOF'`,
@@ -1877,6 +1932,45 @@ function escapeSed(value) {
   return value.replace(/[.*[\]\\/^$]/g, "\\$&");
 }
 
+// src/drivers/shared/protection.ts
+function runAsScript(name, script) {
+  const path = `/tmp/ts-cloud-${name}.sh`;
+  const marker = `TS_CLOUD_${name.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_EOF`;
+  return [
+    `cat > ${path} <<'${marker}'`,
+    script.replace(/\n$/, ""),
+    marker,
+    `chmod +x ${path}`,
+    `bash ${path} || echo "ts-cloud: ${name} setup did not complete; continuing" >&2`,
+    `rm -f ${path}`
+  ];
+}
+function resolve(setting, fallback) {
+  if (setting === false)
+    return;
+  if (setting === true || setting === undefined)
+    return fallback;
+  return setting;
+}
+var DEFAULT_COMPUTE_DDOS = { enabled: true, ports: [80, 443] };
+var DEFAULT_COMPUTE_WAF = { mode: "detection", paranoiaLevel: 1 };
+function buildDdosScript(setting = true, extraPorts = []) {
+  const config = resolve(setting, DEFAULT_COMPUTE_DDOS);
+  if (!config || config.enabled === false)
+    return [];
+  const ports = [...new Set([...config.ports ?? DEFAULT_COMPUTE_DDOS.ports ?? [], ...extraPorts])].sort((a, b) => a - b);
+  return runAsScript("ddos", renderDdosInstallScript({ ...config, ports }));
+}
+function buildWafScript(setting = true) {
+  const config = resolve(setting, DEFAULT_COMPUTE_WAF);
+  if (!config || config.mode === "off")
+    return [];
+  return runAsScript("waf", renderWafInstallScript(config));
+}
+function buildProtectionScript(protection = {}, extraPorts = []) {
+  return [...buildDdosScript(protection.ddos, extraPorts), ...buildWafScript(protection.waf)];
+}
+
 // src/drivers/shared/ufw.ts
 var UFW_BASE_PORTS = [80, 443];
 function buildUfwScript(firewall = {}) {
@@ -1925,6 +2019,7 @@ function buildComputeProvisionScripts(config) {
     extras.push(...buildServicesProvisionScript(compute.managedServices), ...buildDatabaseSetupScript(appDatabase, compute.managedServices));
   }
   extras.push(...buildUfwScript(compute.firewall ?? (phpBox ? { enabled: true } : { enabled: false })));
+  extras.push(...buildProtectionScript({ ddos: compute.ddos, waf: compute.waf }, compute.firewall?.allowedPorts ?? []));
   extras.push(...buildAutoUpdatesScript(compute.autoUpdates ?? phpBox));
   extras.push(...buildMonitoringScript(compute.monitoring ?? phpBox));
   extras.push(...buildAuthorizedKeysScript(compute.sshKeys));
@@ -2458,7 +2553,7 @@ class AwsDriver {
     const terminalStatuses = new Set(["Success", "Failed", "Cancelled", "TimedOut"]);
     let lastInvocations = [];
     while (Date.now() - startTime < maxWait) {
-      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+      await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
       try {
         const invocations = await ssm.listCommandInvocations({ CommandId: commandId, Details: true });
         lastInvocations = invocations;
@@ -2837,7 +2932,7 @@ class HetznerClient {
     while (Date.now() - start < grace) {
       if ((await this.getServer(serverId)).status === "off")
         return;
-      await new Promise((resolve) => setTimeout(resolve, poll));
+      await new Promise((resolve2) => setTimeout(resolve2, poll));
     }
     const action = await this.powerOffServer(serverId);
     await this.waitForAction(action.id);
@@ -2892,7 +2987,7 @@ class HetznerClient {
       if (action.status === "error") {
         throw new HetznerActionError(action.error?.message || "Hetzner action failed", action);
       }
-      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+      await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
     }
     throw new Error(`Timed out waiting for Hetzner action ${actionId}`);
   }
@@ -2904,7 +2999,7 @@ class HetznerClient {
       const server = await this.getServer(serverId);
       if (server.status === "running")
         return server;
-      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+      await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
     }
     throw new Error(`Timed out waiting for server ${serverId} to reach running state`);
   }
@@ -2916,7 +3011,7 @@ class HetznerClient {
       const server = await this.getServer(serverId);
       if (server.status === status)
         return server;
-      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+      await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
     }
     throw new Error(`Timed out waiting for server ${serverId} to reach ${status} state`);
   }
@@ -3864,7 +3959,7 @@ class HetznerDriver {
     return [...ports].filter((port) => ![80, 443].includes(port));
   }
   async sleep(ms) {
-    await new Promise((resolve) => setTimeout(resolve, ms));
+    await new Promise((resolve2) => setTimeout(resolve2, ms));
   }
   async waitForSshReady(host) {
     const { sshIntervalMs, sshTimeoutMs } = this.bootWait;
@@ -4275,7 +4370,7 @@ async function waitForSsh(host, options = {}) {
     const r = await sshExec(host, "echo ready", options);
     if (r.code === 0 && r.stdout.includes("ready"))
       return;
-    await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+    await new Promise((resolve2) => setTimeout(resolve2, pollIntervalMs));
   }
   throw new Error(`SSH not ready on ${host} after ${timeoutMs}ms`);
 }
@@ -4289,7 +4384,7 @@ async function waitForCloudInit(host, options = {}) {
       return;
     if (r.stdout.includes("status: error"))
       throw new Error(`cloud-init reported an error on ${host}; check /var/log/cloud-init-output.log`);
-    await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+    await new Promise((resolve2) => setTimeout(resolve2, pollIntervalMs));
   }
   throw new Error(`cloud-init did not finish on ${host} after ${timeoutMs}ms`);
 }
@@ -4885,7 +4980,7 @@ class HetznerBoxProvisioner {
         } catch {
           if (i === 9)
             break;
-          await new Promise((resolve) => setTimeout(resolve, 3000));
+          await new Promise((resolve2) => setTimeout(resolve2, 3000));
         }
       }
     }
@@ -4925,7 +5020,7 @@ class AwsBoxProvisioner {
       const instance = await this.ec2.getInstance(instanceId);
       if (instance?.State?.Name === "running" && instance.PublicIpAddress)
         return instance;
-      await new Promise((resolve) => setTimeout(resolve, 5000));
+      await new Promise((resolve2) => setTimeout(resolve2, 5000));
     }
     throw new Error(`EC2 instance ${instanceId} did not reach running with a public IP within ${timeoutMs}ms`);
   }
@@ -5001,7 +5096,7 @@ class AwsBoxProvisioner {
         const current = await this.ec2.getInstance(instance.InstanceId);
         if (!current || current.State?.Name === "terminated")
           break;
-        await new Promise((resolve) => setTimeout(resolve, 5000));
+        await new Promise((resolve2) => setTimeout(resolve2, 5000));
       }
     }
     const groups = await this.ec2.describeSecurityGroups({
@@ -5017,7 +5112,7 @@ class AwsBoxProvisioner {
         } catch {
           if (i === 9)
             break;
-          await new Promise((resolve) => setTimeout(resolve, 3000));
+          await new Promise((resolve2) => setTimeout(resolve2, 3000));
         }
       }
     }
@@ -5452,7 +5547,7 @@ import { execSync as execSync2 } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { chmodSync, copyFileSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync3, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { basename, dirname, isAbsolute, join as join5, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join as join5, resolve as resolve2 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // src/deploy/dashboard-config-module.ts
@@ -5572,7 +5667,7 @@ function stageLiveDashboardRoot(config, cwd, logger) {
     let dependency = resolveDashboardVersion();
     if (dependency.startsWith("file:")) {
       const requested = dependency.slice("file:".length);
-      const source = isAbsolute(requested) ? requested : resolve(cwd, requested);
+      const source = isAbsolute(requested) ? requested : resolve2(cwd, requested);
       if (!existsSync2(source) || !statSync(source).isFile()) {
         dependency = resolvePackagedDashboardVersion();
         logger.warn(`Management dashboard: TS_CLOUD_UI_VERSION points to a missing package file (${source}); using the deploying ts-cloud version ${dependency} instead.`);