@stacksjs/ts-cloud 0.7.109 → 0.7.110

package/dist/{chunk-grx1rp09.js → chunk-19bs955w.js}

@@ -462,7 +462,7 @@ function aggregateDeltas(deltas) {
 import { createHash as createHash3 } from "node:crypto";
 
 // src/control-plane/migrations.ts
-var CONTROL_PLANE_SCHEMA_VERSION = 39;
+var CONTROL_PLANE_SCHEMA_VERSION = 40;
 var controlPlaneMigrations = [
   {
     version: 1,
@@ -2126,6 +2126,20 @@ var controlPlaneMigrations = [
       DROP TABLE notification_channels;
       ALTER TABLE notification_channels_new RENAME TO notification_channels;
     `
+  },
+  {
+    version: 40,
+    name: "telemetry_kind_scope_index",
+    sql: `
+      -- Anomaly detection filters request records by (project, kind, time).
+      -- The existing scope index leads with project_id and environment_id but
+      -- never mentions kind, so every request series scanned each project's
+      -- logs, metrics, and traces too and discarded them in memory. On a
+      -- project emitting mostly logs that is several times the necessary work,
+      -- once a minute, forever.
+      CREATE INDEX telemetry_kind_scope_time_idx
+        ON telemetry_records(project_id, kind, timestamp);
+    `
   }
 ];
 // src/control-plane/store.ts
@@ -5016,21 +5030,23 @@ class AnomalyConfigStore {
 }
 // src/spend/signals.ts
 var DETECTABLE_SIGNALS = [
-  { key: "cost", label: "Cost", source: "usage", gapPolicy: "zero", minSamples: 0, unit: "cents" },
-  { key: "edge.requests", label: "Edge requests", source: "usage", gapPolicy: "zero", minSamples: 0, unit: "requests" },
-  { key: "edge.egress_gb", label: "Edge egress", source: "usage", gapPolicy: "zero", minSamples: 0, unit: "GB" },
+  { key: "cost", routeAware: false, label: "Cost", source: "usage", gapPolicy: "zero", minSamples: 0, unit: "cents" },
+  { key: "edge.requests", routeAware: false, label: "Edge requests", source: "usage", gapPolicy: "zero", minSamples: 0, unit: "requests" },
+  { key: "edge.egress_gb", routeAware: false, label: "Edge egress", source: "usage", gapPolicy: "zero", minSamples: 0, unit: "GB" },
   {
     key: "function.invocations",
+    routeAware: false,
     label: "Function invocations",
     source: "usage",
     gapPolicy: "zero",
     minSamples: 0,
     unit: "invocations"
   },
-  { key: "http.requests", label: "HTTP requests", source: "telemetry", gapPolicy: "zero", minSamples: 0, unit: "requests" },
-  { key: "http.errors", label: "HTTP 5xx", source: "telemetry", gapPolicy: "zero", minSamples: 0, unit: "responses" },
+  { key: "http.requests", routeAware: true, label: "HTTP requests", source: "telemetry", gapPolicy: "zero", minSamples: 0, unit: "requests" },
+  { key: "http.errors", routeAware: true, label: "HTTP 5xx", source: "telemetry", gapPolicy: "zero", minSamples: 0, unit: "responses" },
   {
     key: "http.error_rate",
+    routeAware: true,
     label: "HTTP error rate",
     source: "telemetry",
     gapPolicy: "gap",
@@ -5040,6 +5056,7 @@ var DETECTABLE_SIGNALS = [
   },
   {
     key: "http.client_error_rate",
+    routeAware: true,
     label: "HTTP 4xx rate",
     source: "telemetry",
     gapPolicy: "gap",
@@ -5049,6 +5066,7 @@ var DETECTABLE_SIGNALS = [
   },
   {
     key: "http.latency_p95",
+    routeAware: true,
     label: "Latency p95",
     source: "telemetry",
     gapPolicy: "gap",
@@ -5093,6 +5111,7 @@ function assemble(definition, window, values) {
 class SignalSource {
   controlPlane;
   spend;
+  counterCache = new Map;
   constructor(controlPlane, spend) {
     this.controlPlane = controlPlane;
     this.spend = spend;
@@ -5117,10 +5136,8 @@ class SignalSource {
       });
     return assemble(definition, window, values);
   }
-  telemetrySeries(definition, scope, window) {
-    if (!scope.projectId)
-      return { signal: definition.key, points: [], populated: 0, suppressed: 0, unit: definition.unit };
-    const clauses = ["kind = 'request'", "project_id = ?", "timestamp >= ?", "timestamp < ?"];
+  requestFilter(scope, window) {
+    const clauses = ["project_id = ?", "kind = 'request'", "timestamp >= ?", "timestamp < ?"];
     const bindings = [scope.projectId, window.from, window.to];
     if (scope.environmentId) {
       clauses.push("environment_id = ?");
@@ -5130,16 +5147,35 @@ class SignalSource {
       clauses.push("path_template = ?");
       bindings.push(scope.route);
     }
+    return { clauses, bindings };
+  }
+  counters(scope, window) {
+    const key = [scope.projectId, scope.environmentId ?? "", scope.route ?? "", window.from, window.to].join("\x00");
+    const cached = this.counterCache.get(key);
+    if (cached)
+      return cached;
+    const { clauses, bindings } = this.requestFilter(scope, window);
     const rows = this.query(`SELECT
         CAST(strftime('%s', timestamp) AS INTEGER) / 3600 AS bucket,
         COUNT(*) AS total,
         SUM(CASE WHEN status_code >= 500 THEN 1 ELSE 0 END) AS server_errors,
-        SUM(CASE WHEN status_code >= 400 AND status_code < 500 THEN 1 ELSE 0 END) AS client_errors,
-        SUM(CASE WHEN duration_ms IS NOT NULL THEN 1 ELSE 0 END) AS timed
+        SUM(CASE WHEN status_code >= 400 AND status_code < 500 THEN 1 ELSE 0 END) AS client_errors
       FROM telemetry_records
       WHERE ${clauses.join(" AND ")}
       GROUP BY bucket
       ORDER BY bucket`, bindings);
+    this.counterCache.set(key, rows);
+    return rows;
+  }
+  resetCache() {
+    this.counterCache.clear();
+  }
+  telemetrySeries(definition, scope, window) {
+    if (!scope.projectId)
+      return { signal: definition.key, points: [], populated: 0, suppressed: 0, unit: definition.unit };
+    if (definition.key === "http.latency_p95")
+      return this.latencySeries(definition, scope, window);
+    const rows = this.counters(scope, window);
     const values = new Map;
     for (const row of rows) {
       const bucket = Number(row.bucket) * HOUR;
@@ -5153,11 +5189,10 @@ class SignalSource {
       else if (definition.key === "http.client_error_rate")
         values.set(bucket, { value: total > 0 ? Number(row.client_errors) / total : 0, samples: total });
     }
-    if (definition.key === "http.latency_p95")
-      return this.latencySeries(definition, clauses, bindings, window);
     return assemble(definition, window, values);
   }
-  latencySeries(definition, clauses, bindings, window) {
+  latencySeries(definition, scope, window) {
+    const { clauses, bindings } = this.requestFilter(scope, window);
     const rows = this.query(`WITH ranked AS (
         SELECT
           CAST(strftime('%s', timestamp) AS INTEGER) / 3600 AS bucket,
@@ -5415,18 +5450,23 @@ class SpendService {
     };
     const wanted = options.signals ?? DETECTABLE_SIGNALS.map((signal) => signal.key);
     const found = [];
+    let routes;
     for (const signal of wanted) {
       const hours = overrides.seasonLength ? Math.max(24 * 14, overrides.seasonLength * ((overrides.minHistory ?? 3) + 1)) : lookbackHoursForSignal(signal);
       const window = { from: new Date(new Date(to).getTime() - hours * 3600000).toISOString(), to };
       found.push(...this.detectSignal(signal, scope, window, overrides));
       if (!options.routes)
         continue;
-      for (const route of this.signals.busiestRoutes(scope, window)) {
+      if (!signalDefinition(signal)?.routeAware)
+        continue;
+      routes ??= this.signals.busiestRoutes(scope, window);
+      for (const route of routes) {
         if (this.anomalyConfigs.isSilenced(scope, { signal, route }))
           continue;
         found.push(...this.detectSignal(signal, { ...scope, route }, window, overrides, route));
       }
     }
+    this.signals.resetCache();
     return found;
   }
   detectSignal(signal, scope, window, overrides, route) {

package/dist/{chunk-xrtwv3v2.js → chunk-d48vtdj4.js}

@@ -417,4 +417,17 @@ function applyControlsToDdos(config, controls) {
     }
   };
 }
-export { RATE_LIMIT_KEY_SEPARATOR, globMatches, ruleMatches, rateLimitKey, RateLimiter, rateLimitHeaders, defaultRateLimitRules, PROTECTION_SETTING, MAX_CONTROL_HOURS, DEFAULT_ATTACK_MODE_HOURS, ProtectionControlStore, describePosture, applyControlsToRateLimits, applyControlsToDdos };
+function mergeControlsIntoConfig(config, controls) {
+  const compute = config?.infrastructure?.compute;
+  if (!compute || compute.ddos === false)
+    return config;
+  const base = typeof compute.ddos === "object" && compute.ddos !== null ? compute.ddos : {};
+  return {
+    ...config,
+    infrastructure: {
+      ...config.infrastructure,
+      compute: { ...compute, ddos: applyControlsToDdos(base, controls) }
+    }
+  };
+}
+export { RATE_LIMIT_KEY_SEPARATOR, globMatches, ruleMatches, rateLimitKey, RateLimiter, rateLimitHeaders, defaultRateLimitRules, PROTECTION_SETTING, MAX_CONTROL_HOURS, DEFAULT_ATTACK_MODE_HOURS, ProtectionControlStore, describePosture, applyControlsToRateLimits, applyControlsToDdos, mergeControlsIntoConfig };

package/dist/{chunk-cktwk9hy.js → chunk-wmz8x3cy.js}

@@ -104,7 +104,7 @@ import {
   spendOpenApiPaths,
   telemetryCursor,
   telemetryEstimatedMonthlyCost
-} from "./chunk-grx1rp09.js";
+} from "./chunk-19bs955w.js";
 import {
   artifactKey,
   buildCloudFormationTemplate,

package/dist/deploy/index.js

@@ -36,7 +36,7 @@ import {
   synchronizeDashboardUsers,
   trackDashboardOperation,
   verifyStaticApiOrigin
-} from "../chunk-cktwk9hy.js";
+} from "../chunk-wmz8x3cy.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -83,7 +83,7 @@ import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-wj3s95p9.js";
 import"../chunk-zqtpg06c.js";
-import"../chunk-grx1rp09.js";
+import"../chunk-19bs955w.js";
 import"../chunk-va2yd85b.js";
 import"../chunk-aa2dkn7b.js";
 import"../chunk-t2s3gdq6.js";

package/dist/index.js

@@ -208,7 +208,7 @@ import {
   verifyUpdateSignature,
   webhookEndpoint,
   zeroCapacity
-} from "./chunk-cktwk9hy.js";
+} from "./chunk-wmz8x3cy.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -511,7 +511,7 @@ import {
   zeroFill,
   zoneOffsetMs,
   zonedParts
-} from "./chunk-grx1rp09.js";
+} from "./chunk-19bs955w.js";
 import {
   DEFAULT_ATTACK_MODE_HOURS,
   MAX_CONTROL_HOURS,
@@ -526,7 +526,7 @@ import {
   rateLimitHeaders,
   rateLimitKey,
   ruleMatches
-} from "./chunk-xrtwv3v2.js";
+} from "./chunk-d48vtdj4.js";
 import {
   escapeSecLang,
   globToRegex,

package/dist/protection/controls.d.ts

@@ -111,3 +111,17 @@ export declare function describePosture(controls: ReturnType<ProtectionControlSt
 export declare function applyControlsToRateLimits(rules: readonly RateLimitRule[], controls: ReturnType<ProtectionControlStore['current']>): RateLimitRule[];
 /** Apply the controls to a firewall config before it is rendered. */
 export declare function applyControlsToDdos(config: DdosConfig, controls: ReturnType<ProtectionControlStore['current']>): DdosConfig;
+/**
+ * Fold live operator controls into a cloud config before it reaches a driver.
+ *
+ * The provisioning path takes a `CloudConfig` and nothing else, deliberately:
+ * it also builds golden images, and baking one operator's live blocklist into a
+ * reusable image would be wrong. So the merge happens here, at the deploy call
+ * site that has a control plane, rather than inside the builder.
+ *
+ * Without this, `cloud protect:block` writes a rule that the next deploy
+ * silently renders without - the control appears to work and does nothing.
+ *
+ * Returns a shallow copy; the caller's config is not mutated.
+ */
+export declare function mergeControlsIntoConfig<T extends Record<string, any>>(config: T, controls: ReturnType<ProtectionControlStore['current']>): T;

package/dist/protection/index.js

@@ -10,10 +10,11 @@ import {
   defaultRateLimitRules,
   describePosture,
   globMatches,
+  mergeControlsIntoConfig,
   rateLimitHeaders,
   rateLimitKey,
   ruleMatches
-} from "../chunk-xrtwv3v2.js";
+} from "../chunk-d48vtdj4.js";
 import {
   escapeSecLang,
   globToRegex,
@@ -60,6 +61,7 @@ export {
   propagationHeaders,
   planMitigation,
   parseChain,
+  mergeControlsIntoConfig,
   isValidCidr,
   isSafePattern,
   inspectInvocation,

package/dist/spend/index.js

@@ -82,7 +82,7 @@ import {
   zeroFill,
   zoneOffsetMs,
   zonedParts
-} from "../chunk-grx1rp09.js";
+} from "../chunk-19bs955w.js";
 import"../chunk-aa2dkn7b.js";
 import"../chunk-t2s3gdq6.js";
 import"../chunk-v0bahtg2.js";

package/dist/spend/signals.d.ts

@@ -18,6 +18,15 @@ export interface SignalDefinition {
     unit: string;
     /** True when the signal is a ratio in 0-1. */
     ratio?: boolean;
+    /**
+     * True when the signal can be narrowed to a route.
+     *
+     * Usage rollups have no route dimension: they are priced per meter, not per
+     * path. Running route detection over them produces a series that is actually
+     * project-wide and records it under a route's name, which is worse than
+     * useless - it is a confidently mislabelled anomaly.
+     */
+    routeAware: boolean;
 }
 /**
  * The signals detection can run on.
@@ -53,10 +62,22 @@ export interface SignalSeries {
 export declare class SignalSource {
     private readonly controlPlane;
     private readonly spend;
+    private readonly counterCache;
     constructor(controlPlane: ControlPlaneStore, spend: SpendStore);
     private query;
     /** Usage-backed series: cost, or one meter's quantity. */
     private usageSeries;
+    private requestFilter;
+    /**
+     * Per-bucket request counters for a scope and window.
+     *
+     * Memoized because four signals derive from the same numbers. Computing them
+     * separately meant four full passes over the request history every cycle, and
+     * with per-route detection that multiplied by the route count.
+     */
+    private counters;
+    /** Drop the memo so a long-lived source re-reads on the next cycle. */
+    resetCache(): void;
     /**
      * Telemetry-backed series, aggregated in SQL.
      *