@stacksjs/ts-cloud 0.7.108 → 0.7.110

package/dist/{chunk-ybcz6sxc.js → chunk-x6yzgv7y.js}

@@ -2569,6 +2569,39 @@ class LambdaClient {
       body: JSON.stringify({ ProvisionedConcurrentExecutions })
     });
   }
+  async getFunctionConcurrency(functionName) {
+    try {
+      const result = await this.client.request({
+        service: "lambda",
+        region: this.region,
+        method: "GET",
+        path: `/2019-10-31/functions/${encodeURIComponent(functionName)}/concurrency`
+      });
+      return result?.ReservedConcurrentExecutions ?? null;
+    } catch (err) {
+      if (/ResourceNotFound|ProvisionedConcurrencyConfigNotFound/i.test(String(err?.message)))
+        return null;
+      throw err;
+    }
+  }
+  async putFunctionConcurrency(functionName, reservedConcurrentExecutions) {
+    await this.client.request({
+      service: "lambda",
+      region: this.region,
+      method: "PUT",
+      path: `/2019-10-31/functions/${encodeURIComponent(functionName)}/concurrency`,
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ ReservedConcurrentExecutions: reservedConcurrentExecutions })
+    });
+  }
+  async deleteFunctionConcurrency(functionName) {
+    await this.client.request({
+      service: "lambda",
+      region: this.region,
+      method: "DELETE",
+      path: `/2019-10-31/functions/${encodeURIComponent(functionName)}/concurrency`
+    });
+  }
   async deleteProvisionedConcurrencyConfig(functionName, qualifier) {
     await this.client.request({
       service: "lambda",

package/dist/control-plane/types.d.ts

@@ -9,7 +9,7 @@ export type OrganizationRoleTemplate = 'owner' | 'admin' | 'deployer' | 'operato
 export type AuthorizationScopeType = 'organization' | 'project' | 'environment' | 'resource';
 export type AuthorizationEffect = 'allow' | 'deny';
 export type AuthorizationRecordSource = 'manual' | 'legacy' | 'invitation';
-export type AuthorizationCapability = 'project:read' | 'config:read' | 'config:write' | 'deployments:read' | 'deployments:create' | 'deployments:cancel' | 'deployments:rollback' | 'runtime:read' | 'runtime:restart' | 'runtime:logs' | 'runtime:terminal' | 'data:read' | 'data:write' | 'data:admin' | 'backups:read' | 'backups:create' | 'backups:restore' | 'secrets:read' | 'secrets:write' | 'fleet:read' | 'fleet:manage' | 'users:read' | 'users:manage' | 'users:transfer-ownership' | 'audit:read' | 'security:read' | 'security:manage' | 'security:waive' | 'sources:read' | 'sources:manage' | 'applications:read' | 'applications:manage' | 'automation:read' | 'automation:manage' | 'tags:manage';
+export type AuthorizationCapability = 'project:read' | 'config:read' | 'config:write' | 'deployments:read' | 'deployments:create' | 'deployments:cancel' | 'deployments:rollback' | 'runtime:read' | 'runtime:restart' | 'runtime:logs' | 'runtime:terminal' | 'data:read' | 'data:write' | 'data:admin' | 'backups:read' | 'backups:create' | 'backups:restore' | 'secrets:read' | 'secrets:write' | 'fleet:read' | 'fleet:manage' | 'users:read' | 'users:manage' | 'users:transfer-ownership' | 'audit:read' | 'billing:read' | 'billing:manage' | 'security:read' | 'security:manage' | 'security:waive' | 'sources:read' | 'sources:manage' | 'applications:read' | 'applications:manage' | 'automation:read' | 'automation:manage' | 'tags:manage';
 export interface AuthorizationScope {
     type: AuthorizationScopeType;
     id?: ControlPlaneId;

package/dist/deploy/dashboard-protection.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-spend.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/index.js

@@ -36,7 +36,7 @@ import {
   synchronizeDashboardUsers,
   trackDashboardOperation,
   verifyStaticApiOrigin
-} from "../chunk-eg8ck25v.js";
+} from "../chunk-wmz8x3cy.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -47,15 +47,17 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "../chunk-ef2dwfrg.js";
+} from "../chunk-8kh577qh.js";
 import {
   buildAndPushServerlessImage
-} from "../chunk-3g4r09dd.js";
-import"../chunk-ybcz6sxc.js";
+} from "../chunk-wmbep3b5.js";
+import"../chunk-x6yzgv7y.js";
+import"../chunk-hpv68b4a.js";
 import"../chunk-01d86gt1.js";
 import"../chunk-50jpda9q.js";
 import"../chunk-he9a874b.js";
 import"../chunk-gttvakpv.js";
+import"../chunk-32e7ya18.js";
 import {
   IPV6_EXCLUDED_HOST_LABELS,
   MANAGEMENT_DASHBOARD_SITE,
@@ -76,14 +78,15 @@ import {
   siteInstallBase,
   validateDeploymentConfig,
   verifyAddressRecord
-} from "../chunk-33sy72r8.js";
-import"../chunk-c6db5m63.js";
+} from "../chunk-d3vx2ekv.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
-import"../chunk-hpv68b4a.js";
-import"../chunk-32e7ya18.js";
 import"../chunk-wj3s95p9.js";
 import"../chunk-zqtpg06c.js";
+import"../chunk-19bs955w.js";
+import"../chunk-va2yd85b.js";
+import"../chunk-aa2dkn7b.js";
+import"../chunk-t2s3gdq6.js";
 import"../chunk-v0bahtg2.js";
 export {
   verifyStaticApiOrigin,

package/dist/deploy/local-dashboard-server.d.ts

@@ -22,6 +22,8 @@ export interface LocalDashboardServerOptions {
     oidcFetch?: OidcFetch;
     /** Run the persistent deployment worker in this process. Defaults off in tests. */
     queueWorker?: boolean;
+    /** Evaluate spend budgets on a timer. Off in tests, like the queue worker. */
+    spendLoop?: boolean;
     /** Maximum number of operations this process may execute in parallel. */
     queueParallelism?: number;
     /** Resolve the provider-specific immutable activation primitive for release jobs. */

package/dist/drivers/index.js

@@ -68,12 +68,14 @@ import {
   waitForSsh,
   wrapCloudInitUserData,
   writeResizeCheckpoint
-} from "../chunk-33sy72r8.js";
-import"../chunk-c6db5m63.js";
+} from "../chunk-d3vx2ekv.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-wj3s95p9.js";
 import"../chunk-zqtpg06c.js";
+import"../chunk-va2yd85b.js";
+import"../chunk-aa2dkn7b.js";
+import"../chunk-t2s3gdq6.js";
 import"../chunk-v0bahtg2.js";
 export {
   writeResizeCheckpoint,

package/dist/drivers/shared/protection.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Edge protection at provision time.
+ *
+ * UFW (see `ufw.ts`) decides which ports are open. This decides what happens to
+ * the traffic that arrives on them: kernel-level flood mitigation, and the WAF.
+ *
+ * Both are **on by default**. A protection that has to be switched on protects
+ * only the people who already knew they needed it, which is never the box that
+ * gets hit. The escape hatches are explicit (`ddos: false`, `waf: false`) and
+ * the WAF starts in detection-only, so the default posture is "see everything,
+ * block only floods".
+ */
+import type { DdosConfig } from '../../protection/ddos';
+import type { WafConfig } from '../../protection/waf';
+/** `true` for defaults, `false` to skip, or an object to tune. */
+export type ProtectionSetting<T> = boolean | T | undefined;
+/** L3/L4 defaults: protect the web ports, count-and-drop, ten-minute bans. */
+export declare const DEFAULT_COMPUTE_DDOS: DdosConfig;
+/**
+ * WAF defaults: paranoia 1, detection only.
+ *
+ * Detection rather than blocking because zig-waf is pre-alpha and because a
+ * ruleset nobody has read their own logs against will block real traffic. The
+ * operator promotes it once they have looked.
+ */
+export declare const DEFAULT_COMPUTE_WAF: WafConfig;
+/** Kernel-level flood mitigation. Returns no lines when disabled. */
+export declare function buildDdosScript(setting?: ProtectionSetting<DdosConfig>, extraPorts?: number[]): string[];
+/** WAF configuration. Returns no lines when disabled or when the binary is absent. */
+export declare function buildWafScript(setting?: ProtectionSetting<WafConfig>): string[];
+export interface ComputeProtectionConfig {
+    ddos?: ProtectionSetting<DdosConfig>;
+    waf?: ProtectionSetting<WafConfig>;
+}
+/**
+ * Both layers, in order: kernel first, then application.
+ *
+ * Order matters on a box that is already being hit. The packet filter costs
+ * nothing per request and starts dropping immediately; the WAF has to parse
+ * every request it inspects, so bringing it up first would spend CPU on
+ * traffic the kernel was about to discard anyway.
+ */
+export declare function buildProtectionScript(protection?: ComputeProtectionConfig, extraPorts?: number[]): string[];

package/dist/drivers/shared/protection.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/index.d.ts

@@ -9,6 +9,9 @@ export * from './compose';
 export * from './release';
 export * from './runtime';
 export * from './telemetry';
+export * from './spend';
+export { applyControlsToDdos, applyControlsToRateLimits, applyMitigationFactor, DEFAULT_ATTACK_MODE_HOURS, defaultRateLimitRules, describePosture, MAX_CONTROL_HOURS, ProtectionControlStore, DEFAULT_DDOS_THRESHOLDS, DEFAULT_RECURSION_LIMITS, escapeSecLang, functionFingerprint, globMatches, globToRegex, inspectInvocation, isSafePattern, isValidCidr, parseChain, planMitigation, propagationHeaders, rateLimitHeaders, rateLimitKey, RateLimiter as EdgeRateLimiter, RATE_LIMIT_KEY_SEPARATOR, RecursionGuard, recursionBlockedResponse, renderDdosInstallScript, renderNftablesRuleset, renderSysctlFile, renderWafConfig, renderWafInstallScript, ruleMatches, sysctlHardening, wafEventTelemetry, CHAIN_HEADER, DEPTH_HEADER, TRACE_HEADER, } from './protection';
+export type { DdosConfig, DdosThresholds, IpRules, ProtectionControls, ProtectionPosture, TimeBoxedControl, InvocationContext, MitigationLevel, MitigationPlan, ParanoiaLevel, RateLimitAction, RateLimitAlgorithm, RateLimitDecision, RateLimitKeySource, RateLimitKeySpec, RateLimitRule as EdgeRateLimitRule, RecursionLimits, RecursionReason, RecursionVerdict, RequestDescriptor, TrafficSignals, WafConfig as EdgeWafConfig, WafEvent, WafGenerationResult, WafMode, WafRuleExclusion, } from './protection';
 export { AlertEvaluator, AlertStore, HealthCheckRunner, NotificationRouter, evaluateTelemetryAlertRules, isQuietHours, } from './alerts';
 export type { Alert, AlertEvaluation, AlertRule, AlertSample, AlertSeverity, AlertState, HealthCheck as AlertHealthCheck, HealthResult as AlertHealthResult, HealthStatus as AlertHealthStatus, NotificationChannel as AlertNotificationChannel, NotificationDelivery as AlertNotificationDelivery, NotificationRoute as AlertNotificationRoute, } from './alerts';
 export * from './jobs';