@stacksjs/ts-cloud 0.7.108 → 0.7.109

package/dist/{chunk-33sy72r8.js → chunk-d3vx2ekv.js}

@@ -1,14 +1,3 @@
-import {
-  deploymentCoexistenceError,
-  hasManagementDashboardSite,
-  isManagementDashboardSiteName,
-  resolveAppDatabase,
-  resolveCloudProvider,
-  resolveManagementDashboardSites,
-  resolveProjectStackName,
-  resolveStatePath,
-  statePath
-} from "./chunk-c6db5m63.js";
 import {
   EC2Client,
   SSMClient
@@ -19,6 +8,23 @@ import {
 import {
   S3Client
 } from "./chunk-wj3s95p9.js";
+import {
+  renderWafInstallScript
+} from "./chunk-va2yd85b.js";
+import {
+  renderDdosInstallScript
+} from "./chunk-aa2dkn7b.js";
+import {
+  deploymentCoexistenceError,
+  hasManagementDashboardSite,
+  isManagementDashboardSiteName,
+  resolveAppDatabase,
+  resolveCloudProvider,
+  resolveManagementDashboardSites,
+  resolveProjectStackName,
+  resolveStatePath,
+  statePath
+} from "./chunk-t2s3gdq6.js";
 import {
   __require
 } from "./chunk-v0bahtg2.js";
@@ -1926,6 +1932,45 @@ function escapeSed(value) {
   return value.replace(/[.*[\]\\/^$]/g, "\\$&");
 }
 
+// src/drivers/shared/protection.ts
+function runAsScript(name, script) {
+  const path = `/tmp/ts-cloud-${name}.sh`;
+  const marker = `TS_CLOUD_${name.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_EOF`;
+  return [
+    `cat > ${path} <<'${marker}'`,
+    script.replace(/\n$/, ""),
+    marker,
+    `chmod +x ${path}`,
+    `bash ${path} || echo "ts-cloud: ${name} setup did not complete; continuing" >&2`,
+    `rm -f ${path}`
+  ];
+}
+function resolve(setting, fallback) {
+  if (setting === false)
+    return;
+  if (setting === true || setting === undefined)
+    return fallback;
+  return setting;
+}
+var DEFAULT_COMPUTE_DDOS = { enabled: true, ports: [80, 443] };
+var DEFAULT_COMPUTE_WAF = { mode: "detection", paranoiaLevel: 1 };
+function buildDdosScript(setting = true, extraPorts = []) {
+  const config = resolve(setting, DEFAULT_COMPUTE_DDOS);
+  if (!config || config.enabled === false)
+    return [];
+  const ports = [...new Set([...config.ports ?? DEFAULT_COMPUTE_DDOS.ports ?? [], ...extraPorts])].sort((a, b) => a - b);
+  return runAsScript("ddos", renderDdosInstallScript({ ...config, ports }));
+}
+function buildWafScript(setting = true) {
+  const config = resolve(setting, DEFAULT_COMPUTE_WAF);
+  if (!config || config.mode === "off")
+    return [];
+  return runAsScript("waf", renderWafInstallScript(config));
+}
+function buildProtectionScript(protection = {}, extraPorts = []) {
+  return [...buildDdosScript(protection.ddos, extraPorts), ...buildWafScript(protection.waf)];
+}
+
 // src/drivers/shared/ufw.ts
 var UFW_BASE_PORTS = [80, 443];
 function buildUfwScript(firewall = {}) {
@@ -1974,6 +2019,7 @@ function buildComputeProvisionScripts(config) {
     extras.push(...buildServicesProvisionScript(compute.managedServices), ...buildDatabaseSetupScript(appDatabase, compute.managedServices));
   }
   extras.push(...buildUfwScript(compute.firewall ?? (phpBox ? { enabled: true } : { enabled: false })));
+  extras.push(...buildProtectionScript({ ddos: compute.ddos, waf: compute.waf }, compute.firewall?.allowedPorts ?? []));
   extras.push(...buildAutoUpdatesScript(compute.autoUpdates ?? phpBox));
   extras.push(...buildMonitoringScript(compute.monitoring ?? phpBox));
   extras.push(...buildAuthorizedKeysScript(compute.sshKeys));
@@ -2507,7 +2553,7 @@ class AwsDriver {
     const terminalStatuses = new Set(["Success", "Failed", "Cancelled", "TimedOut"]);
     let lastInvocations = [];
     while (Date.now() - startTime < maxWait) {
-      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+      await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
       try {
         const invocations = await ssm.listCommandInvocations({ CommandId: commandId, Details: true });
         lastInvocations = invocations;
@@ -2886,7 +2932,7 @@ class HetznerClient {
     while (Date.now() - start < grace) {
       if ((await this.getServer(serverId)).status === "off")
         return;
-      await new Promise((resolve) => setTimeout(resolve, poll));
+      await new Promise((resolve2) => setTimeout(resolve2, poll));
     }
     const action = await this.powerOffServer(serverId);
     await this.waitForAction(action.id);
@@ -2941,7 +2987,7 @@ class HetznerClient {
       if (action.status === "error") {
         throw new HetznerActionError(action.error?.message || "Hetzner action failed", action);
       }
-      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+      await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
     }
     throw new Error(`Timed out waiting for Hetzner action ${actionId}`);
   }
@@ -2953,7 +2999,7 @@ class HetznerClient {
       const server = await this.getServer(serverId);
       if (server.status === "running")
         return server;
-      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+      await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
     }
     throw new Error(`Timed out waiting for server ${serverId} to reach running state`);
   }
@@ -2965,7 +3011,7 @@ class HetznerClient {
       const server = await this.getServer(serverId);
       if (server.status === status)
         return server;
-      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+      await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
     }
     throw new Error(`Timed out waiting for server ${serverId} to reach ${status} state`);
   }
@@ -3913,7 +3959,7 @@ class HetznerDriver {
     return [...ports].filter((port) => ![80, 443].includes(port));
   }
   async sleep(ms) {
-    await new Promise((resolve) => setTimeout(resolve, ms));
+    await new Promise((resolve2) => setTimeout(resolve2, ms));
   }
   async waitForSshReady(host) {
     const { sshIntervalMs, sshTimeoutMs } = this.bootWait;
@@ -4324,7 +4370,7 @@ async function waitForSsh(host, options = {}) {
     const r = await sshExec(host, "echo ready", options);
     if (r.code === 0 && r.stdout.includes("ready"))
       return;
-    await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+    await new Promise((resolve2) => setTimeout(resolve2, pollIntervalMs));
   }
   throw new Error(`SSH not ready on ${host} after ${timeoutMs}ms`);
 }
@@ -4338,7 +4384,7 @@ async function waitForCloudInit(host, options = {}) {
       return;
     if (r.stdout.includes("status: error"))
       throw new Error(`cloud-init reported an error on ${host}; check /var/log/cloud-init-output.log`);
-    await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+    await new Promise((resolve2) => setTimeout(resolve2, pollIntervalMs));
   }
   throw new Error(`cloud-init did not finish on ${host} after ${timeoutMs}ms`);
 }
@@ -4934,7 +4980,7 @@ class HetznerBoxProvisioner {
         } catch {
           if (i === 9)
             break;
-          await new Promise((resolve) => setTimeout(resolve, 3000));
+          await new Promise((resolve2) => setTimeout(resolve2, 3000));
         }
       }
     }
@@ -4974,7 +5020,7 @@ class AwsBoxProvisioner {
       const instance = await this.ec2.getInstance(instanceId);
       if (instance?.State?.Name === "running" && instance.PublicIpAddress)
         return instance;
-      await new Promise((resolve) => setTimeout(resolve, 5000));
+      await new Promise((resolve2) => setTimeout(resolve2, 5000));
     }
     throw new Error(`EC2 instance ${instanceId} did not reach running with a public IP within ${timeoutMs}ms`);
   }
@@ -5050,7 +5096,7 @@ class AwsBoxProvisioner {
         const current = await this.ec2.getInstance(instance.InstanceId);
         if (!current || current.State?.Name === "terminated")
           break;
-        await new Promise((resolve) => setTimeout(resolve, 5000));
+        await new Promise((resolve2) => setTimeout(resolve2, 5000));
       }
     }
     const groups = await this.ec2.describeSecurityGroups({
@@ -5066,7 +5112,7 @@ class AwsBoxProvisioner {
         } catch {
           if (i === 9)
             break;
-          await new Promise((resolve) => setTimeout(resolve, 3000));
+          await new Promise((resolve2) => setTimeout(resolve2, 3000));
         }
       }
     }
@@ -5501,7 +5547,7 @@ import { execSync as execSync2 } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { chmodSync, copyFileSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync3, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { basename, dirname, isAbsolute, join as join5, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join as join5, resolve as resolve2 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // src/deploy/dashboard-config-module.ts
@@ -5621,7 +5667,7 @@ function stageLiveDashboardRoot(config, cwd, logger) {
     let dependency = resolveDashboardVersion();
     if (dependency.startsWith("file:")) {
       const requested = dependency.slice("file:".length);
-      const source = isAbsolute(requested) ? requested : resolve(cwd, requested);
+      const source = isAbsolute(requested) ? requested : resolve2(cwd, requested);
       if (!existsSync2(source) || !statSync(source).isFile()) {
         dependency = resolvePackagedDashboardVersion();
         logger.warn(`Management dashboard: TS_CLOUD_UI_VERSION points to a missing package file (${source}); using the deploying ts-cloud version ${dependency} instead.`);