@stacksjs/ts-cloud 0.7.108 → 0.7.110

package/dist/{chunk-c6db5m63.js → chunk-t2s3gdq6.js}

@@ -31,6 +31,8 @@ import { mkdtempSync as mkdtempSync2, readFileSync as readFileSync4, rmSync as r
 import { tmpdir as tmpdir2 } from "node:os";
 import { dirname as dirname3, join as join8 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { createHash as createHash5 } from "node:crypto";
 import { readFileSync as readFileSync5 } from "node:fs";
 import { dirname as dirname4, join as join9 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
@@ -39,7 +41,7 @@ import { existsSync as existsSync5, mkdirSync as mkdirSync2, mkdtempSync as mkdt
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join10, relative as relative3 } from "node:path";
 import { execSync as execSync2 } from "node:child_process";
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import { readdirSync as readdirSync6, readFileSync as readFileSync7, statSync as statSync4 } from "node:fs";
 import { join as join11, relative as relative4, resolve as resolve2 } from "node:path";
 var __defProp = Object.defineProperty;
@@ -44379,8 +44381,9 @@ export const queue = __handlers.queue
 export const cli = __handlers.cli
 `;
 }
-function adapterSourcePath() {
-  return join7(dirname2(fileURLToPath(import.meta.url)), "runtime", "adapter.ts");
+var RUNTIME_SOURCES = ["adapter.ts", "recursion.ts", "auto-recursion.ts"];
+function runtimeSourceDir() {
+  return join7(dirname2(fileURLToPath(import.meta.url)), "runtime");
 }
 function runBuildHooks(hooks, cwd, onStep) {
   for (const hook of hooks ?? []) {
@@ -44405,7 +44408,8 @@ async function packageServerlessApp(opts) {
   const entryPath = isAbsolute2(entry) ? entry : join7(projectRoot, entry);
   const stage = mkdtempSync(join7(tmpdir(), "tscloud-pkg-"));
   try {
-    cpSync(adapterSourcePath(), join7(stage, "adapter.ts"));
+    for (const source of RUNTIME_SOURCES)
+      cpSync(join7(runtimeSourceDir(), source), join7(stage, source));
     const bootstrapPath = join7(stage, "bootstrap.ts");
     writeFileSync3(bootstrapPath, generateBootstrap({ entryImport: entryPath, adapterImport: "./adapter" }));
     opts.onStep?.("bundling application");
@@ -45460,6 +45464,231 @@ function resolveLatestNode(major) {
     throw new Error(`No Node release found for major version ${major}`);
   return match.version.replace(/^v/, "");
 }
+var DEPTH_HEADER = "x-ts-cloud-invoke-depth";
+var CHAIN_HEADER = "x-ts-cloud-invoke-chain";
+var TRACE_HEADER = "x-ts-cloud-trace-id";
+function functionFingerprint(functionId) {
+  return createHash5("sha256").update(functionId).digest("hex").slice(0, 8);
+}
+var DEFAULT_RECURSION_LIMITS = {
+  maxDepth: 10,
+  maxRepeats: 3,
+  maxInvocationsPerTrace: 100,
+  traceWindowMs: 60000,
+  breakerThreshold: 5,
+  breakerCooldownMs: 60000
+};
+function readHeader(headers, name) {
+  if (typeof headers.get === "function")
+    return headers.get(name) ?? undefined;
+  const record = headers;
+  return record[name] ?? record[name.toLowerCase()] ?? record[name.toUpperCase()];
+}
+function parseChain(value, maxEntries = 64) {
+  if (!value)
+    return [];
+  return value.split(".").map((entry) => entry.trim()).filter((entry) => /^[0-9a-f]{8}$/.test(entry)).slice(-maxEntries);
+}
+function inspectInvocation(context, limits = DEFAULT_RECURSION_LIMITS) {
+  const fingerprint = functionFingerprint(context.functionId);
+  const incoming = parseChain(readHeader(context.headers, CHAIN_HEADER));
+  const traceId = context.traceId ?? readHeader(context.headers, TRACE_HEADER) ?? crypto.randomUUID();
+  const chain = [...incoming, fingerprint];
+  const repeats = incoming.filter((entry) => entry === fingerprint).length;
+  const selfInvocation = incoming[incoming.length - 1] === fingerprint;
+  const headerDepth = Number.parseInt(readHeader(context.headers, DEPTH_HEADER) ?? "", 10);
+  const depth = Math.max(chain.length, Number.isFinite(headerDepth) ? headerDepth + 1 : 0);
+  let reason = "ok";
+  if (depth > limits.maxDepth)
+    reason = "depth_exceeded";
+  else if (repeats >= limits.maxRepeats)
+    reason = "cycle_detected";
+  else if (selfInvocation && limits.maxRepeats <= 1)
+    reason = "self_invocation";
+  return {
+    reason,
+    depth,
+    chain,
+    traceId,
+    selfInvocation,
+    repeats,
+    propagate: {
+      [DEPTH_HEADER]: String(depth),
+      [CHAIN_HEADER]: chain.join("."),
+      [TRACE_HEADER]: traceId
+    }
+  };
+}
+var MESSAGES = {
+  ok: "",
+  depth_exceeded: "Invocation chain is deeper than the configured limit; the call was refused to stop a runaway loop.",
+  cycle_detected: "This function already appears in the invocation chain; the call was refused as a recursion loop.",
+  self_invocation: "This function invoked itself directly; the call was refused.",
+  trace_budget_exceeded: "This request has already made more invocations than its budget allows.",
+  breaker_open: "Recursion protection is open for this function after repeated loop detections."
+};
+
+class RecursionGuard {
+  limits;
+  clock;
+  traces = new Map;
+  breakers = new Map;
+  constructor(limits = DEFAULT_RECURSION_LIMITS, clock = () => Date.now()) {
+    this.limits = limits;
+    this.clock = clock;
+  }
+  check(context) {
+    const now = this.clock();
+    this.expireTraces(now);
+    const inspected = inspectInvocation(context, this.limits);
+    const breaker = this.breakers.get(context.functionId);
+    if (breaker?.openUntil != null && breaker.openUntil > now)
+      return this.deny(context.functionId, inspected, "breaker_open", now, false);
+    if (inspected.reason !== "ok")
+      return this.deny(context.functionId, inspected, inspected.reason, now, true);
+    const tally = this.traces.get(inspected.traceId) ?? { count: 0, firstAt: now };
+    if (tally.count >= this.limits.maxInvocationsPerTrace) {
+      this.traces.set(inspected.traceId, tally);
+      return this.deny(context.functionId, inspected, "trace_budget_exceeded", now, true);
+    }
+    this.traces.set(inspected.traceId, { count: tally.count + 1, firstAt: tally.firstAt });
+    if (breaker)
+      this.breakers.set(context.functionId, { consecutiveBlocks: 0 });
+    return { ...inspected, allowed: true, reason: "ok", propagate: inspected.propagate };
+  }
+  deny(functionId, inspected, reason, now, countTowardBreaker) {
+    if (countTowardBreaker) {
+      const state = this.breakers.get(functionId) ?? { consecutiveBlocks: 0 };
+      const consecutiveBlocks = state.consecutiveBlocks + 1;
+      this.breakers.set(functionId, {
+        consecutiveBlocks,
+        openUntil: consecutiveBlocks >= this.limits.breakerThreshold ? now + this.limits.breakerCooldownMs : state.openUntil
+      });
+    }
+    return { ...inspected, allowed: false, reason, message: MESSAGES[reason] };
+  }
+  breakerOpen(functionId) {
+    const state = this.breakers.get(functionId);
+    return state?.openUntil != null && state.openUntil > this.clock();
+  }
+  reset(functionId) {
+    if (functionId) {
+      this.breakers.delete(functionId);
+      return;
+    }
+    this.breakers.clear();
+    this.traces.clear();
+  }
+  expireTraces(now) {
+    if (this.traces.size === 0)
+      return;
+    for (const [traceId, tally] of this.traces)
+      if (now - tally.firstAt > this.limits.traceWindowMs)
+        this.traces.delete(traceId);
+  }
+  get trackedTraces() {
+    return this.traces.size;
+  }
+}
+function propagationHeaders(verdict) {
+  return { ...verdict.propagate };
+}
+function recursionBlockedResponse(verdict) {
+  return {
+    status: 508,
+    headers: { "content-type": "application/json", "x-ts-cloud-recursion-blocked": verdict.reason },
+    body: {
+      error: "recursion_blocked",
+      reason: verdict.reason,
+      message: verdict.message ?? MESSAGES[verdict.reason],
+      depth: verdict.depth,
+      traceId: verdict.traceId
+    }
+  };
+}
+var invocationContext = new AsyncLocalStorage;
+function envFlag(name) {
+  const raw = globalThis.process?.env?.[name];
+  if (raw == null || raw === "")
+    return;
+  return raw !== "0" && raw.toLowerCase() !== "false";
+}
+function defaultFunctionId() {
+  const env = globalThis.process?.env ?? {};
+  return env.TS_CLOUD_FUNCTION_ID || env.AWS_LAMBDA_FUNCTION_NAME || env.FUNCTION_NAME || "function";
+}
+function resolveRecursionConfig(config2) {
+  const explicit = config2 === false ? { enabled: false } : config2 ?? {};
+  const envEnabled = envFlag("TS_CLOUD_RECURSION_PROTECTION");
+  const envDetectionOnly = envFlag("TS_CLOUD_RECURSION_DETECTION_ONLY");
+  return {
+    enabled: envEnabled ?? explicit.enabled ?? true,
+    detectionOnly: envDetectionOnly ?? explicit.detectionOnly ?? false,
+    limits: { ...DEFAULT_RECURSION_LIMITS, ...explicit.limits },
+    functionId: explicit.functionId ?? defaultFunctionId()
+  };
+}
+var installedFetch;
+var originalFetch;
+function installRecursionFetch() {
+  const current = globalThis.fetch;
+  if (!current || installedFetch === current)
+    return () => {};
+  originalFetch = current;
+  const wrapped = async (input, init) => {
+    const verdict = invocationContext.getStore();
+    if (!verdict)
+      return originalFetch(input, init);
+    const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));
+    for (const [key, value] of Object.entries(propagationHeaders(verdict)))
+      headers.set(key, value);
+    if (input instanceof Request)
+      return originalFetch(new Request(input, { headers }), init);
+    return originalFetch(input, { ...init, headers });
+  };
+  Object.assign(wrapped, current);
+  globalThis.fetch = wrapped;
+  installedFetch = wrapped;
+  return () => {
+    if (globalThis.fetch === installedFetch && originalFetch)
+      globalThis.fetch = originalFetch;
+    installedFetch = undefined;
+  };
+}
+var sharedGuard;
+var sharedLimits;
+function sharedRecursionGuard(limits) {
+  if (!sharedGuard || JSON.stringify(sharedLimits) !== JSON.stringify(limits)) {
+    sharedGuard = new RecursionGuard(limits);
+    sharedLimits = limits;
+  }
+  return sharedGuard;
+}
+function resetRecursionRuntime() {
+  sharedGuard = undefined;
+  sharedLimits = undefined;
+  if (installedFetch && originalFetch && globalThis.fetch === installedFetch)
+    globalThis.fetch = originalFetch;
+  installedFetch = undefined;
+  originalFetch = undefined;
+}
+function checkInvocation(headers, config2) {
+  const resolved = resolveRecursionConfig(config2);
+  if (!resolved.enabled)
+    return;
+  const guard = sharedRecursionGuard(resolved.limits);
+  const context = { functionId: resolved.functionId, headers };
+  const verdict = guard.check(context);
+  return {
+    verdict,
+    blocked: !verdict.allowed && !resolved.detectionOnly,
+    observed: !verdict.allowed && resolved.detectionOnly
+  };
+}
+function withInvocation(verdict, work) {
+  installRecursionFetch();
+  return invocationContext.run(verdict, work);
+}
 function resolveApp(mod) {
   const m = mod;
   const def = m?.default ?? m;
@@ -45550,9 +45779,25 @@ function createHttpHandler(handler8, opts) {
         };
       }
     }
+    const recursion = checkInvocation(event.headers ?? {}, opts?.recursionProtection);
+    if (recursion?.blocked) {
+      const blocked = recursionBlockedResponse(recursion.verdict);
+      return {
+        statusCode: blocked.status,
+        headers: { ...blocked.headers, "retry-after": "60" },
+        body: JSON.stringify(blocked.body),
+        isBase64Encoded: false
+      };
+    }
     const request = eventToRequest(event);
-    const response = await handler8(request);
-    return responseToResult(response);
+    if (!recursion) {
+      const response = await handler8(request);
+      return responseToResult(response);
+    }
+    if (recursion.observed) {
+      console.warn(`[ts-cloud] recursion detected (${recursion.verdict.reason}) at depth ${recursion.verdict.depth}; detection-only mode let it run`);
+    }
+    return withInvocation(recursion.verdict, async () => responseToResult(await handler8(request)));
   };
 }
 function parseRecordBody(body) {
@@ -45769,7 +46014,7 @@ function packagePhpApp(opts) {
   const handler8 = opts.app.handlers?.http ?? "public/index.php";
   return {
     zip: zip2,
-    sha256: createHash5("sha256").update(zip2).digest("hex"),
+    sha256: createHash6("sha256").update(zip2).digest("hex"),
     handlers: {
       http: handler8,
       queue: opts.app.handlers?.queue ?? handler8,
@@ -46217,4 +46462,4 @@ class ResourceManagementManager {
 }
 var resourceManagementManager = new ResourceManagementManager;
 
-export { detectServiceRegion, signRequest, signRequestAsync, createPresignedUrl, createPresignedUrlAsync, makeAWSRequest, makeAWSRequestOnce, makeAWSRequestAsync, parseXMLResponse, parseJSONResponse, clearSigningKeyCache, getSigningKeyCacheSize, isNodeCryptoAvailable, isWebCryptoAvailable, QueuePresets, RealtimePresets, DEFAULT_STATE_DIR, STATE_DIR_ENV_VAR, setStateDir, stateDir, statePath, resolveStatePath, isStatePath, detectDeploymentTargets, resolveDeploymentMode, deploymentCoexistenceError, resolveAppDatabase, resolveCloudProvider, TemplateBuilder, Pseudo, generateResourceName, generateLogicalId, getTimestamp, sanitizeName, resolveProjectStackName, resolveSiteStackName, resolveSiteResourceName, resolveSiteBucketName, resolveStorageBucketName, resolveDeployBucketName, resolveServerlessAppStackName, resolveServerlessArtifactBucketName, resolveServerlessAssetBucketName, DependencyGraph, analyzeStackDiff, formatDiff, Storage, Registry, CDN, DNS, Security, Compute, Network, FileSystem, Email, exports_incoming_call, Phone, Queue, JobLoader, StacksIntegration, exports_send, SMS, Sftp, AI, Database, Cache, Permissions, ApiGateway, Messaging, Workflow, Monitoring, Auth, Deployment, AssetHasher, Secrets, ParameterStore, Search, Redirects, Communication, Fn2, Arn, AWS_PSEUDO_PARAMETERS, CloudFormationBuilder, buildCloudFormationTemplate, createStaticSitePreset, createNodeJsServerPreset, createNodeJsServerlessPreset, createServerlessNodePreset, createExistingStaticFullStackPreset, createFullStackAppPreset, createApiBackendPreset, createWordPressPreset, createJamstackPreset, createMicroservicesPreset, createRealtimeAppPreset, createDataPipelinePreset, createMLApiPreset, createTraditionalWebAppPreset, createLaravelPreset, createServerlessLaravelPreset, createDashboardSite, DASHBOARD_STATE_DIR, DASHBOARD_ENTRY, DASHBOARD_PORT_BASE, DASHBOARD_PORT_SPAN, deriveManagementDashboardPort, resolveDashboardDomain, resolveDashboardDomains, hasManagementDashboardSite, MANAGEMENT_DASHBOARD_SITE_PREFIX, managementDashboardSiteName, isManagementDashboardSiteName, resolveManagementDashboardSites, resolveManagementDashboardSite, extendPreset, composePresets, createPreset, mergeInfrastructure, withMonitoring, withSecurity, withDatabase, withCache, withCDN, withQueue, fromEnvironment, fromSharedCredentials, fromEC2Metadata, fromECSMetadata, fromWebIdentity, getCredentials, createCredentialProvider, resolveCredentials, resolveRegion, getAccountId, S3Error, createS3Client, CloudError, ConfigurationError, CredentialError, DeploymentError, ValidationError, AWSAPIError, ErrorCodes, getErrorDetails, createError, DebugLogger, validateConfiguration, detectMisconfigurations, validateCredentials, checkIAMPermissions, getRequiredPermissions, suggestIAMPolicy, DEFAULT_SERVICE_LIMITS, checkServiceQuotas, getQuotaUsageSummary, suggestQuotaIncrease, FileCache, TemplateCache, templateCache, hashFile, hashString, hashBuffer, hashDirectory, hashManifest, quickHash, findChangedFiles, HashCache, parallel, batch, parallelMap, parallelWithRetry, sequence, withTimeout, RateLimiter, chunk, processInChunks, diffTemplates, getDiffSummary, requiresReplacement, categorizeChanges, getDeploymentStrategy, getDiffStats, cloud_config_schema_default, validateAgainstSchema, defaultLocalConfig, getLocalConfig, isLocalDevelopment, getLocalEndpoint, getLocalCredentials, getLocalEnvVars, MockCloudFormation, MockS3, MockDynamoDB, createMockAWS, PreviewEnvironmentManager, previewManager, generatePreviewWorkflow, generateCleanupWorkflow, generateCostReportWorkflow, PreviewNotificationService, previewNotifications, formatTable, formatTree, formatProgressBar, formatBytes, formatDuration, formatList, formatKeyValue, ProgressBar, MultiStepProgress, Spinner, TaskList, suggestCommand, formatSuggestion, isLikelyTypo, getContextualHelp, searchCommands, autocomplete, suggestFlags, formatFlagSuggestions, getCommandUsage, validateCommand, REPL, REPLContext, REPLCommandBuilder, CommandHistory, formatHistory, formatHistoryStats, MultiRegionManager, multiRegionManager, CrossRegionReferenceManager, GlobalResourceManager, RegionPairManager, StackDependencyManager, crossRegionReferenceManager, globalResourceManager, regionPairManager, stackDependencyManager, AWS_REGIONS, getRegion, getAllRegions, getRegionsByLocation, getRegionsByCompliance, getRegionsByPricingTier, isValidRegion, getClosestRegion, suggestRegions, suggestRegionPairs, formatRegion, formatRegionList, getRegionStats, MultiAccountManager, OrganizationManager, multiAccountManager, organizationManager, RECOMMENDED_ACCOUNT_STRUCTURES, RECOMMENDED_SCPS, COMMON_CROSS_ACCOUNT_ROLES, getRecommendedStructure, generateCrossAccountRoleCF, validateAccountStructure, formatAccountStructure, generateDeploymentWorkflow, generateMultiEnvWorkflow, generatePRPreviewWorkflow, generateScheduledWorkflow, generateMatrixWorkflow, generateDeploymentPipeline, generateMultiEnvPipeline, generatePreviewPipeline, generateScheduledPipeline, generateManualPipeline, generateDeploymentConfig, generateMultiEnvConfig, generateScheduledConfig, generateApprovalConfig, generateParallelConfig, BackupManager, backupManager, DisasterRecoveryManager, drManager, AWSConfigManager, awsConfigManager, CloudTrailManager, cloudTrailManager, GuardDutyManager, guardDutyManager, SecurityHubManager, securityHubManager, BlueGreenManager, blueGreenManager, CanaryManager, canaryManager, ABTestManager, abTestManager, ProgressiveDeploymentManager, progressiveDeploymentManager, XRayManager, xrayManager, MetricsManager, metricsManager, LogsManager, logsManager, SyntheticsManager, syntheticsManager, MigrationManager, migrationManager, ReplicaManager, replicaManager, PerformanceManager, performanceManager, DatabaseUserManager, databaseUserManager, SecretsRotationManager, secretsRotationManager, SecretsManager, secretsManager, CertificateManager, certificateManager, SecurityScanningManager, securityScanningManager, ImageScanningManager, imageScanningManager, BuildOptimizationManager, buildOptimizationManager, ContainerRegistryManager, containerRegistryManager, ServiceMeshManager, serviceMeshManager, LambdaLayersManager, lambdaLayersManager, LambdaVersionsManager, lambdaVersionsManager, LambdaConcurrencyManager, lambdaConcurrencyManager, LambdaDestinationsManager, lambdaDestinationsManager, LambdaVPCManager, lambdaVPCManager, LambdaDLQManager, lambdaDLQManager, Route53RoutingManager, route53RoutingManager, DNSSECManager, dnssecManager, Route53ResolverManager, route53ResolverManager, BounceComplaintHandler, bounceComplaintHandler, EmailAnalyticsManager, emailAnalyticsManager, SenderReputationManager, senderReputationManager, EmailTemplateManager, emailTemplateManager, exports_advanced, exports_inbound, exports_advanced2, exports_advanced3, FIFOQueueManager, fifoQueueManager, DLQMonitoringManager, dlqMonitoringManager, BatchProcessingManager, batchProcessingManager, QueueManagementManager, queueManagementManager, createZip, generateBootstrap, runBuildHooks, sha256, artifactKey, packageServerlessApp, MANAGED_NODE_VERSIONS, resolveServerlessRuntime, resolveQueues, resolveQueueNames, composeServerlessAppTemplate, PHP_LAYER_EXTENSIONS, phpLayerPackages, phpLayerBuildStage, generatePhpLayerDockerfile, generateAppImageDockerfile, sharedRuntimeLoop, buildNodeRuntimeLayerZip, buildBunRuntimeLayerZip, resolveApp, eventToRequest, responseToResult, createHttpHandler, createQueueHandler, createCliHandler, createHandlers, generatePhpFpmConfig, phpRuntimeLayerAssets, laravelServerlessEnvDefaults, LARAVEL_SERVERLESS_BUILD_STEPS, buildPhpRuntimeLayerZip, PHP_DEFAULT_EXCLUDES, runPhpBuildHooks, collectPhpAppEntries, packagePhpApp, StaticSiteManager, staticSiteManager, StorageAdvancedManager, storageAdvancedManager, HealthCheckManager, healthCheckManager, NetworkSecurityManager, networkSecurityManager, ResourceManagementManager, resourceManagementManager };
+export { detectServiceRegion, signRequest, signRequestAsync, createPresignedUrl, createPresignedUrlAsync, makeAWSRequest, makeAWSRequestOnce, makeAWSRequestAsync, parseXMLResponse, parseJSONResponse, clearSigningKeyCache, getSigningKeyCacheSize, isNodeCryptoAvailable, isWebCryptoAvailable, QueuePresets, RealtimePresets, DEFAULT_STATE_DIR, STATE_DIR_ENV_VAR, setStateDir, stateDir, statePath, resolveStatePath, isStatePath, detectDeploymentTargets, resolveDeploymentMode, deploymentCoexistenceError, resolveAppDatabase, resolveCloudProvider, TemplateBuilder, Pseudo, generateResourceName, generateLogicalId, getTimestamp, sanitizeName, resolveProjectStackName, resolveSiteStackName, resolveSiteResourceName, resolveSiteBucketName, resolveStorageBucketName, resolveDeployBucketName, resolveServerlessAppStackName, resolveServerlessArtifactBucketName, resolveServerlessAssetBucketName, DependencyGraph, analyzeStackDiff, formatDiff, Storage, Registry, CDN, DNS, Security, Compute, Network, FileSystem, Email, exports_incoming_call, Phone, Queue, JobLoader, StacksIntegration, exports_send, SMS, Sftp, AI, Database, Cache, Permissions, ApiGateway, Messaging, Workflow, Monitoring, Auth, Deployment, AssetHasher, Secrets, ParameterStore, Search, Redirects, Communication, Fn2, Arn, AWS_PSEUDO_PARAMETERS, CloudFormationBuilder, buildCloudFormationTemplate, createStaticSitePreset, createNodeJsServerPreset, createNodeJsServerlessPreset, createServerlessNodePreset, createExistingStaticFullStackPreset, createFullStackAppPreset, createApiBackendPreset, createWordPressPreset, createJamstackPreset, createMicroservicesPreset, createRealtimeAppPreset, createDataPipelinePreset, createMLApiPreset, createTraditionalWebAppPreset, createLaravelPreset, createServerlessLaravelPreset, createDashboardSite, DASHBOARD_STATE_DIR, DASHBOARD_ENTRY, DASHBOARD_PORT_BASE, DASHBOARD_PORT_SPAN, deriveManagementDashboardPort, resolveDashboardDomain, resolveDashboardDomains, hasManagementDashboardSite, MANAGEMENT_DASHBOARD_SITE_PREFIX, managementDashboardSiteName, isManagementDashboardSiteName, resolveManagementDashboardSites, resolveManagementDashboardSite, extendPreset, composePresets, createPreset, mergeInfrastructure, withMonitoring, withSecurity, withDatabase, withCache, withCDN, withQueue, fromEnvironment, fromSharedCredentials, fromEC2Metadata, fromECSMetadata, fromWebIdentity, getCredentials, createCredentialProvider, resolveCredentials, resolveRegion, getAccountId, S3Error, createS3Client, CloudError, ConfigurationError, CredentialError, DeploymentError, ValidationError, AWSAPIError, ErrorCodes, getErrorDetails, createError, DebugLogger, validateConfiguration, detectMisconfigurations, validateCredentials, checkIAMPermissions, getRequiredPermissions, suggestIAMPolicy, DEFAULT_SERVICE_LIMITS, checkServiceQuotas, getQuotaUsageSummary, suggestQuotaIncrease, FileCache, TemplateCache, templateCache, hashFile, hashString, hashBuffer, hashDirectory, hashManifest, quickHash, findChangedFiles, HashCache, parallel, batch, parallelMap, parallelWithRetry, sequence, withTimeout, RateLimiter, chunk, processInChunks, diffTemplates, getDiffSummary, requiresReplacement, categorizeChanges, getDeploymentStrategy, getDiffStats, cloud_config_schema_default, validateAgainstSchema, defaultLocalConfig, getLocalConfig, isLocalDevelopment, getLocalEndpoint, getLocalCredentials, getLocalEnvVars, MockCloudFormation, MockS3, MockDynamoDB, createMockAWS, PreviewEnvironmentManager, previewManager, generatePreviewWorkflow, generateCleanupWorkflow, generateCostReportWorkflow, PreviewNotificationService, previewNotifications, formatTable, formatTree, formatProgressBar, formatBytes, formatDuration, formatList, formatKeyValue, ProgressBar, MultiStepProgress, Spinner, TaskList, suggestCommand, formatSuggestion, isLikelyTypo, getContextualHelp, searchCommands, autocomplete, suggestFlags, formatFlagSuggestions, getCommandUsage, validateCommand, REPL, REPLContext, REPLCommandBuilder, CommandHistory, formatHistory, formatHistoryStats, MultiRegionManager, multiRegionManager, CrossRegionReferenceManager, GlobalResourceManager, RegionPairManager, StackDependencyManager, crossRegionReferenceManager, globalResourceManager, regionPairManager, stackDependencyManager, AWS_REGIONS, getRegion, getAllRegions, getRegionsByLocation, getRegionsByCompliance, getRegionsByPricingTier, isValidRegion, getClosestRegion, suggestRegions, suggestRegionPairs, formatRegion, formatRegionList, getRegionStats, MultiAccountManager, OrganizationManager, multiAccountManager, organizationManager, RECOMMENDED_ACCOUNT_STRUCTURES, RECOMMENDED_SCPS, COMMON_CROSS_ACCOUNT_ROLES, getRecommendedStructure, generateCrossAccountRoleCF, validateAccountStructure, formatAccountStructure, generateDeploymentWorkflow, generateMultiEnvWorkflow, generatePRPreviewWorkflow, generateScheduledWorkflow, generateMatrixWorkflow, generateDeploymentPipeline, generateMultiEnvPipeline, generatePreviewPipeline, generateScheduledPipeline, generateManualPipeline, generateDeploymentConfig, generateMultiEnvConfig, generateScheduledConfig, generateApprovalConfig, generateParallelConfig, BackupManager, backupManager, DisasterRecoveryManager, drManager, AWSConfigManager, awsConfigManager, CloudTrailManager, cloudTrailManager, GuardDutyManager, guardDutyManager, SecurityHubManager, securityHubManager, BlueGreenManager, blueGreenManager, CanaryManager, canaryManager, ABTestManager, abTestManager, ProgressiveDeploymentManager, progressiveDeploymentManager, XRayManager, xrayManager, MetricsManager, metricsManager, LogsManager, logsManager, SyntheticsManager, syntheticsManager, MigrationManager, migrationManager, ReplicaManager, replicaManager, PerformanceManager, performanceManager, DatabaseUserManager, databaseUserManager, SecretsRotationManager, secretsRotationManager, SecretsManager, secretsManager, CertificateManager, certificateManager, SecurityScanningManager, securityScanningManager, ImageScanningManager, imageScanningManager, BuildOptimizationManager, buildOptimizationManager, ContainerRegistryManager, containerRegistryManager, ServiceMeshManager, serviceMeshManager, LambdaLayersManager, lambdaLayersManager, LambdaVersionsManager, lambdaVersionsManager, LambdaConcurrencyManager, lambdaConcurrencyManager, LambdaDestinationsManager, lambdaDestinationsManager, LambdaVPCManager, lambdaVPCManager, LambdaDLQManager, lambdaDLQManager, Route53RoutingManager, route53RoutingManager, DNSSECManager, dnssecManager, Route53ResolverManager, route53ResolverManager, BounceComplaintHandler, bounceComplaintHandler, EmailAnalyticsManager, emailAnalyticsManager, SenderReputationManager, senderReputationManager, EmailTemplateManager, emailTemplateManager, exports_advanced, exports_inbound, exports_advanced2, exports_advanced3, FIFOQueueManager, fifoQueueManager, DLQMonitoringManager, dlqMonitoringManager, BatchProcessingManager, batchProcessingManager, QueueManagementManager, queueManagementManager, createZip, generateBootstrap, runBuildHooks, sha256, artifactKey, packageServerlessApp, MANAGED_NODE_VERSIONS, resolveServerlessRuntime, resolveQueues, resolveQueueNames, composeServerlessAppTemplate, PHP_LAYER_EXTENSIONS, phpLayerPackages, phpLayerBuildStage, generatePhpLayerDockerfile, generateAppImageDockerfile, sharedRuntimeLoop, buildNodeRuntimeLayerZip, buildBunRuntimeLayerZip, DEPTH_HEADER, CHAIN_HEADER, TRACE_HEADER, functionFingerprint, DEFAULT_RECURSION_LIMITS, parseChain, inspectInvocation, RecursionGuard, propagationHeaders, recursionBlockedResponse, invocationContext, resolveRecursionConfig, installRecursionFetch, sharedRecursionGuard, resetRecursionRuntime, checkInvocation, withInvocation, resolveApp, eventToRequest, responseToResult, createHttpHandler, createQueueHandler, createCliHandler, createHandlers, generatePhpFpmConfig, phpRuntimeLayerAssets, laravelServerlessEnvDefaults, LARAVEL_SERVERLESS_BUILD_STEPS, buildPhpRuntimeLayerZip, PHP_DEFAULT_EXCLUDES, runPhpBuildHooks, collectPhpAppEntries, packagePhpApp, StaticSiteManager, staticSiteManager, StorageAdvancedManager, storageAdvancedManager, HealthCheckManager, healthCheckManager, NetworkSecurityManager, networkSecurityManager, ResourceManagementManager, resourceManagementManager };

package/dist/chunk-va2yd85b.js

@@ -0,0 +1,200 @@
+// src/protection/waf.ts
+var DEFAULTS = {
+  mode: "detection",
+  paranoiaLevel: 1,
+  inboundThreshold: 5,
+  outboundThreshold: 4,
+  maxBodyBytes: 13107200,
+  rejectOversizedBody: true,
+  auditLogPath: "/var/log/ts-cloud/waf-audit.log",
+  blockStatus: 403
+};
+var RULE_IDS = {
+  bypassBase: 1e5,
+  exclusionBase: 101000,
+  rateLimitBase: 102000,
+  customBase: 109000
+};
+function escapeSecLang(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/[\r\n]+/g, " ");
+}
+function isSafePattern(pattern) {
+  if (pattern.length > 1000)
+    return false;
+  if (/\([^)]*[+*]\)[+*]/.test(pattern))
+    return false;
+  if (/\[[^\]]*\][+*]\{/.test(pattern))
+    return false;
+  try {
+    new RegExp(pattern);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function rateLimitMarkers(rules, startId) {
+  const lines = [];
+  const unmapped = [];
+  let id = startId;
+  for (const rule of rules) {
+    if (rule.enabled === false)
+      continue;
+    if (rule.key && (rule.key.source === "cookie" || rule.key.source === "header") && !rule.key.name) {
+      unmapped.push({ ruleId: rule.id, reason: "The rule keys on a header or cookie but names none." });
+      continue;
+    }
+    const pattern = rule.path ? globToRegex(rule.path) : ".*";
+    if (!isSafePattern(pattern)) {
+      unmapped.push({ ruleId: rule.id, reason: "The path pattern compiles to an unsafe regular expression." });
+      continue;
+    }
+    const conditions = [`SecRule REQUEST_URI "@rx ${escapeSecLang(pattern)}"`];
+    if (rule.methods?.length)
+      conditions.push(`  "chain,id:${id},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${escapeSecLang(rule.id)}'"`);
+    else
+      conditions.push(`  "id:${id},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${escapeSecLang(rule.id)}'"`);
+    lines.push(`# Marks requests governed by the ts-cloud rate limit "${escapeSecLang(rule.id)}".`);
+    lines.push(conditions.join(" \\\n"));
+    if (rule.methods?.length)
+      lines.push(`  SecRule REQUEST_METHOD "@within ${escapeSecLang(rule.methods.join(" ").toUpperCase())}" "t:none"`);
+    lines.push("");
+    id++;
+  }
+  return { lines, unmapped };
+}
+function globToRegex(glob) {
+  const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "\x01").replace(/\*/g, "[^/]*").replace(/\u0001/g, ".*");
+  return `^${escaped}$`;
+}
+function renderWafConfig(config = {}, rateLimits = []) {
+  const mode = config.mode ?? DEFAULTS.mode;
+  const warnings = [];
+  const paranoia = config.paranoiaLevel ?? DEFAULTS.paranoiaLevel;
+  const inbound = config.inboundThreshold ?? DEFAULTS.inboundThreshold;
+  const outbound = config.outboundThreshold ?? DEFAULTS.outboundThreshold;
+  const maxBody = config.maxBodyBytes ?? DEFAULTS.maxBodyBytes;
+  const rejectOversized = config.rejectOversizedBody !== false;
+  if (mode === "blocking" && paranoia >= 3)
+    warnings.push(`Paranoia level ${paranoia} blocks legitimate traffic on most applications until it is tuned. Run it in detection mode first.`);
+  if (mode === "blocking")
+    warnings.push("zig-waf is pre-alpha. Blocking mode makes it a failure path for every request.");
+  if (!rejectOversized)
+    warnings.push("Oversized bodies are passed through uninspected, so padding a request bypasses every rule.");
+  if (config.bypassPaths?.length)
+    warnings.push(`${config.bypassPaths.length} path(s) bypass inspection entirely.`);
+  const lines = [
+    "# Managed by ts-cloud. Edits are overwritten on the next deploy.",
+    `# Mode: ${mode}. Paranoia level: ${paranoia}.`,
+    ""
+  ];
+  if (mode === "off") {
+    lines.push("SecRuleEngine Off", "");
+    return { config: `${lines.join(`
+`)}
+`, unmappedRateLimits: [], warnings, mode };
+  }
+  lines.push(`SecRuleEngine ${mode === "blocking" ? "On" : "DetectionOnly"}`, "SecRequestBodyAccess On", "SecResponseBodyAccess Off", `SecRequestBodyLimit ${maxBody}`, `SecRequestBodyNoFilesLimit ${Math.min(maxBody, 131072)}`, `SecRequestBodyLimitAction ${rejectOversized ? "Reject" : "ProcessPartial"}`, "SecRequestBodyInMemoryLimit 131072", `SecAuditEngine ${mode === "blocking" ? "RelevantOnly" : "On"}`, "SecAuditLogParts ABIJDEFHZ", `SecAuditLog ${escapeSecLang(config.auditLogPath ?? DEFAULTS.auditLogPath)}`, "SecAuditLogType Serial", `SecDefaultAction "phase:1,log,auditlog,${mode === "blocking" ? `deny,status:${config.blockStatus ?? DEFAULTS.blockStatus}` : "pass"}"`, "", "# CRS anomaly scoring setup.", `SecAction "id:900000,phase:1,pass,nolog,t:none,setvar:tx.paranoia_level=${paranoia}"`, `SecAction "id:900001,phase:1,pass,nolog,t:none,setvar:tx.inbound_anomaly_score_threshold=${inbound}"`, `SecAction "id:900002,phase:1,pass,nolog,t:none,setvar:tx.outbound_anomaly_score_threshold=${outbound}"`, 'SecAction "id:900003,phase:1,pass,nolog,t:none,setvar:tx.critical_anomaly_score=5,setvar:tx.error_anomaly_score=4,setvar:tx.warning_anomaly_score=3,setvar:tx.notice_anomaly_score=2"', 'SecAction "id:900004,phase:1,pass,nolog,t:none,setvar:tx.anomaly_score=0"', "");
+  let bypassId = RULE_IDS.bypassBase;
+  for (const path of config.bypassPaths ?? []) {
+    const pattern = globToRegex(path);
+    if (!isSafePattern(pattern)) {
+      warnings.push(`Bypass path "${path}" was dropped: it compiles to an unsafe regular expression.`);
+      continue;
+    }
+    lines.push(`# Inspection bypass for ${escapeSecLang(path)}. Every bypass is an unguarded route.`, `SecRule REQUEST_URI "@rx ${escapeSecLang(pattern)}" "id:${bypassId},phase:1,pass,nolog,ctl:ruleEngine=Off"`, "");
+    bypassId++;
+  }
+  let exclusionId = RULE_IDS.exclusionBase;
+  for (const exclusion of config.exclusions ?? []) {
+    if (!Number.isInteger(exclusion.ruleId) || exclusion.ruleId <= 0) {
+      warnings.push(`Exclusion with rule id "${exclusion.ruleId}" was dropped: the id is not a positive integer.`);
+      continue;
+    }
+    lines.push(`# ${escapeSecLang(exclusion.reason)}`);
+    if (exclusion.pathPattern) {
+      if (!isSafePattern(exclusion.pathPattern)) {
+        warnings.push(`Exclusion for rule ${exclusion.ruleId} was dropped: its path pattern is unsafe.`);
+        continue;
+      }
+      lines.push(`SecRule REQUEST_URI "@rx ${escapeSecLang(exclusion.pathPattern)}" "id:${exclusionId},phase:1,pass,nolog,ctl:ruleRemoveById=${exclusion.ruleId}"`);
+      exclusionId++;
+    } else {
+      lines.push(`SecRuleRemoveById ${exclusion.ruleId}`);
+    }
+    lines.push("");
+  }
+  const markers = rateLimitMarkers(rateLimits, RULE_IDS.rateLimitBase);
+  if (markers.lines.length > 0) {
+    lines.push("# Rate-limit route markers. SecLang has no counters, so the tag is set", "# here and the counting stays in the ts-cloud limiter.", ...markers.lines);
+  }
+  let customId = RULE_IDS.customBase;
+  for (const rule of config.customRules ?? []) {
+    lines.push(`# Operator-supplied rule ${customId}.`, rule.trim(), "");
+    customId++;
+  }
+  if (mode === "blocking")
+    lines.push("# Blocking decision: one rule, at the end, on the accumulated score.", `SecRule TX:ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" "id:949110,phase:2,deny,status:${config.blockStatus ?? DEFAULTS.blockStatus},log,msg:'Inbound anomaly score exceeded (total: %{tx.anomaly_score})'"`, "");
+  return { config: `${lines.join(`
+`)}
+`, unmappedRateLimits: markers.unmapped, warnings, mode };
+}
+function renderWafInstallScript(config = {}, rateLimits = [], options = {}) {
+  const binary = options.binary ?? "/usr/local/bin/zig-waf";
+  const configPath = options.configPath ?? "/etc/ts-cloud/waf.conf";
+  const rendered = renderWafConfig(config, rateLimits);
+  return `#!/usr/bin/env bash
+# Managed by ts-cloud. Installs the zig-waf ruleset.
+set -euo pipefail
+
+if [ ! -x "${binary}" ]; then
+  echo "ts-cloud: ${binary} is not installed; skipping WAF configuration" >&2
+  exit 0
+fi
+
+install -d -m 0755 "$(dirname "${configPath}")"
+install -d -m 0750 /var/log/ts-cloud
+
+cat > "${configPath}.new" <<'WAF_EOF'
+${rendered.config}WAF_EOF
+
+# Compile the config before it goes live. A config that does not validate
+# would leave the engine with no rules while still reporting itself enabled.
+if ! "${binary}" validate "${configPath}.new"; then
+  echo "ts-cloud: generated WAF config failed validation, keeping the previous one" >&2
+  rm -f "${configPath}.new"
+  exit 1
+fi
+
+if [ -f "${configPath}" ] && cmp -s "${configPath}.new" "${configPath}"; then
+  rm -f "${configPath}.new"
+  echo "ts-cloud: WAF config unchanged"
+  exit 0
+fi
+
+mv "${configPath}.new" "${configPath}"
+echo "ts-cloud: WAF config installed (mode: ${rendered.mode})"
+`;
+}
+function wafEventTelemetry(events, scope) {
+  return events.map((event) => ({
+    projectId: scope.projectId,
+    environmentId: scope.environmentId,
+    resourceId: scope.resourceId,
+    kind: "event",
+    source: "zig-waf",
+    name: event.action === "blocked" ? "waf.blocked" : "waf.matched",
+    timestamp: event.timestamp,
+    value: 1,
+    host: event.host,
+    pathTemplate: event.path,
+    method: event.method,
+    attributes: {
+      ruleId: event.ruleId ?? null,
+      anomalyScore: event.anomalyScore,
+      action: event.action,
+      messages: event.messages.slice(0, 5)
+    }
+  }));
+}
+
+export { escapeSecLang, isSafePattern, globToRegex, renderWafConfig, renderWafInstallScript, wafEventTelemetry };

package/dist/{chunk-3g4r09dd.js → chunk-wmbep3b5.js}

@@ -8,7 +8,7 @@ import {
   phpRuntimeLayerAssets,
   runPhpBuildHooks,
   sha256
-} from "./chunk-c6db5m63.js";
+} from "./chunk-t2s3gdq6.js";
 
 // src/deploy/serverless-image.ts
 import { execFileSync } from "node:child_process";