@stacksjs/ts-cloud 0.7.109 → 0.7.111

package/dist/{chunk-grx1rp09.js → chunk-19bs955w.js}

@@ -462,7 +462,7 @@ function aggregateDeltas(deltas) {
 import { createHash as createHash3 } from "node:crypto";
 
 // src/control-plane/migrations.ts
-var CONTROL_PLANE_SCHEMA_VERSION = 39;
+var CONTROL_PLANE_SCHEMA_VERSION = 40;
 var controlPlaneMigrations = [
   {
     version: 1,
@@ -2126,6 +2126,20 @@ var controlPlaneMigrations = [
       DROP TABLE notification_channels;
       ALTER TABLE notification_channels_new RENAME TO notification_channels;
     `
+  },
+  {
+    version: 40,
+    name: "telemetry_kind_scope_index",
+    sql: `
+      -- Anomaly detection filters request records by (project, kind, time).
+      -- The existing scope index leads with project_id and environment_id but
+      -- never mentions kind, so every request series scanned each project's
+      -- logs, metrics, and traces too and discarded them in memory. On a
+      -- project emitting mostly logs that is several times the necessary work,
+      -- once a minute, forever.
+      CREATE INDEX telemetry_kind_scope_time_idx
+        ON telemetry_records(project_id, kind, timestamp);
+    `
   }
 ];
 // src/control-plane/store.ts
@@ -5016,21 +5030,23 @@ class AnomalyConfigStore {
 }
 // src/spend/signals.ts
 var DETECTABLE_SIGNALS = [
-  { key: "cost", label: "Cost", source: "usage", gapPolicy: "zero", minSamples: 0, unit: "cents" },
-  { key: "edge.requests", label: "Edge requests", source: "usage", gapPolicy: "zero", minSamples: 0, unit: "requests" },
-  { key: "edge.egress_gb", label: "Edge egress", source: "usage", gapPolicy: "zero", minSamples: 0, unit: "GB" },
+  { key: "cost", routeAware: false, label: "Cost", source: "usage", gapPolicy: "zero", minSamples: 0, unit: "cents" },
+  { key: "edge.requests", routeAware: false, label: "Edge requests", source: "usage", gapPolicy: "zero", minSamples: 0, unit: "requests" },
+  { key: "edge.egress_gb", routeAware: false, label: "Edge egress", source: "usage", gapPolicy: "zero", minSamples: 0, unit: "GB" },
   {
     key: "function.invocations",
+    routeAware: false,
     label: "Function invocations",
     source: "usage",
     gapPolicy: "zero",
     minSamples: 0,
     unit: "invocations"
   },
-  { key: "http.requests", label: "HTTP requests", source: "telemetry", gapPolicy: "zero", minSamples: 0, unit: "requests" },
-  { key: "http.errors", label: "HTTP 5xx", source: "telemetry", gapPolicy: "zero", minSamples: 0, unit: "responses" },
+  { key: "http.requests", routeAware: true, label: "HTTP requests", source: "telemetry", gapPolicy: "zero", minSamples: 0, unit: "requests" },
+  { key: "http.errors", routeAware: true, label: "HTTP 5xx", source: "telemetry", gapPolicy: "zero", minSamples: 0, unit: "responses" },
   {
     key: "http.error_rate",
+    routeAware: true,
     label: "HTTP error rate",
     source: "telemetry",
     gapPolicy: "gap",
@@ -5040,6 +5056,7 @@ var DETECTABLE_SIGNALS = [
   },
   {
     key: "http.client_error_rate",
+    routeAware: true,
     label: "HTTP 4xx rate",
     source: "telemetry",
     gapPolicy: "gap",
@@ -5049,6 +5066,7 @@ var DETECTABLE_SIGNALS = [
   },
   {
     key: "http.latency_p95",
+    routeAware: true,
     label: "Latency p95",
     source: "telemetry",
     gapPolicy: "gap",
@@ -5093,6 +5111,7 @@ function assemble(definition, window, values) {
 class SignalSource {
   controlPlane;
   spend;
+  counterCache = new Map;
   constructor(controlPlane, spend) {
     this.controlPlane = controlPlane;
     this.spend = spend;
@@ -5117,10 +5136,8 @@ class SignalSource {
       });
     return assemble(definition, window, values);
   }
-  telemetrySeries(definition, scope, window) {
-    if (!scope.projectId)
-      return { signal: definition.key, points: [], populated: 0, suppressed: 0, unit: definition.unit };
-    const clauses = ["kind = 'request'", "project_id = ?", "timestamp >= ?", "timestamp < ?"];
+  requestFilter(scope, window) {
+    const clauses = ["project_id = ?", "kind = 'request'", "timestamp >= ?", "timestamp < ?"];
     const bindings = [scope.projectId, window.from, window.to];
     if (scope.environmentId) {
       clauses.push("environment_id = ?");
@@ -5130,16 +5147,35 @@ class SignalSource {
       clauses.push("path_template = ?");
       bindings.push(scope.route);
     }
+    return { clauses, bindings };
+  }
+  counters(scope, window) {
+    const key = [scope.projectId, scope.environmentId ?? "", scope.route ?? "", window.from, window.to].join("\x00");
+    const cached = this.counterCache.get(key);
+    if (cached)
+      return cached;
+    const { clauses, bindings } = this.requestFilter(scope, window);
     const rows = this.query(`SELECT
         CAST(strftime('%s', timestamp) AS INTEGER) / 3600 AS bucket,
         COUNT(*) AS total,
         SUM(CASE WHEN status_code >= 500 THEN 1 ELSE 0 END) AS server_errors,
-        SUM(CASE WHEN status_code >= 400 AND status_code < 500 THEN 1 ELSE 0 END) AS client_errors,
-        SUM(CASE WHEN duration_ms IS NOT NULL THEN 1 ELSE 0 END) AS timed
+        SUM(CASE WHEN status_code >= 400 AND status_code < 500 THEN 1 ELSE 0 END) AS client_errors
       FROM telemetry_records
       WHERE ${clauses.join(" AND ")}
       GROUP BY bucket
       ORDER BY bucket`, bindings);
+    this.counterCache.set(key, rows);
+    return rows;
+  }
+  resetCache() {
+    this.counterCache.clear();
+  }
+  telemetrySeries(definition, scope, window) {
+    if (!scope.projectId)
+      return { signal: definition.key, points: [], populated: 0, suppressed: 0, unit: definition.unit };
+    if (definition.key === "http.latency_p95")
+      return this.latencySeries(definition, scope, window);
+    const rows = this.counters(scope, window);
     const values = new Map;
     for (const row of rows) {
       const bucket = Number(row.bucket) * HOUR;
@@ -5153,11 +5189,10 @@ class SignalSource {
       else if (definition.key === "http.client_error_rate")
         values.set(bucket, { value: total > 0 ? Number(row.client_errors) / total : 0, samples: total });
     }
-    if (definition.key === "http.latency_p95")
-      return this.latencySeries(definition, clauses, bindings, window);
     return assemble(definition, window, values);
   }
-  latencySeries(definition, clauses, bindings, window) {
+  latencySeries(definition, scope, window) {
+    const { clauses, bindings } = this.requestFilter(scope, window);
     const rows = this.query(`WITH ranked AS (
         SELECT
           CAST(strftime('%s', timestamp) AS INTEGER) / 3600 AS bucket,
@@ -5415,18 +5450,23 @@ class SpendService {
     };
     const wanted = options.signals ?? DETECTABLE_SIGNALS.map((signal) => signal.key);
     const found = [];
+    let routes;
     for (const signal of wanted) {
       const hours = overrides.seasonLength ? Math.max(24 * 14, overrides.seasonLength * ((overrides.minHistory ?? 3) + 1)) : lookbackHoursForSignal(signal);
       const window = { from: new Date(new Date(to).getTime() - hours * 3600000).toISOString(), to };
       found.push(...this.detectSignal(signal, scope, window, overrides));
       if (!options.routes)
         continue;
-      for (const route of this.signals.busiestRoutes(scope, window)) {
+      if (!signalDefinition(signal)?.routeAware)
+        continue;
+      routes ??= this.signals.busiestRoutes(scope, window);
+      for (const route of routes) {
         if (this.anomalyConfigs.isSilenced(scope, { signal, route }))
           continue;
         found.push(...this.detectSignal(signal, { ...scope, route }, window, overrides, route));
       }
     }
+    this.signals.resetCache();
     return found;
   }
   detectSignal(signal, scope, window, overrides, route) {

package/dist/{chunk-cktwk9hy.js → chunk-3ee2jav4.js}

@@ -1,6 +1,6 @@
 import {
   deployStaticSiteWithExternalDnsFull
-} from "./chunk-8kh577qh.js";
+} from "./chunk-v0vpamnf.js";
 import {
   box,
   error,
@@ -22,10 +22,10 @@ import {
   SQSClient,
   STSClient,
   SecretsManagerClient
-} from "./chunk-x6yzgv7y.js";
+} from "./chunk-6a1t7fnq.js";
 import {
   IAMClient
-} from "./chunk-hpv68b4a.js";
+} from "./chunk-nsgqsmrh.js";
 import {
   CloudFrontClient
 } from "./chunk-01d86gt1.js";
@@ -50,7 +50,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-d3vx2ekv.js";
+} from "./chunk-wh1y5rtk.js";
 import {
   SSMClient
 } from "./chunk-7m60qnc8.js";
@@ -60,7 +60,7 @@ import {
 import {
   S3Client,
   resolveCredentials
-} from "./chunk-wj3s95p9.js";
+} from "./chunk-rds0sy87.js";
 import {
   AWSClient,
   buildQueryParams
@@ -104,7 +104,7 @@ import {
   spendOpenApiPaths,
   telemetryCursor,
   telemetryEstimatedMonthlyCost
-} from "./chunk-grx1rp09.js";
+} from "./chunk-19bs955w.js";
 import {
   artifactKey,
   buildCloudFormationTemplate,
@@ -10395,7 +10395,7 @@ async function sendAuthenticationEmail(config, message) {
   if (!from)
     return false;
   try {
-    const { EmailClient } = await import("./chunk-k114qwg9.js");
+    const { EmailClient } = await import("./chunk-ttz2ra5j.js");
     const email = new EmailClient({ region: config.project.region, defaultFrom: from });
     await email.send(message);
     return true;
@@ -36403,7 +36403,7 @@ async function startLocalDashboardServer(options = {}) {
     });
   const notificationRouter = new NotificationRouter(alertStore, {
     emailImpl: async (input) => {
-      const { email } = await import("./chunk-k114qwg9.js");
+      const { email } = await import("./chunk-ttz2ra5j.js");
       return email.send(input);
     }
   });

package/dist/{chunk-x6yzgv7y.js → chunk-6a1t7fnq.js}

@@ -1,10 +1,10 @@
 import {
   SESClient
-} from "./chunk-hpv68b4a.js";
+} from "./chunk-nsgqsmrh.js";
 import {
   S3Client,
   resolveCredentials
-} from "./chunk-wj3s95p9.js";
+} from "./chunk-rds0sy87.js";
 import {
   AWSClient
 } from "./chunk-zqtpg06c.js";

package/dist/{chunk-xrtwv3v2.js → chunk-d48vtdj4.js}

@@ -417,4 +417,17 @@ function applyControlsToDdos(config, controls) {
     }
   };
 }
-export { RATE_LIMIT_KEY_SEPARATOR, globMatches, ruleMatches, rateLimitKey, RateLimiter, rateLimitHeaders, defaultRateLimitRules, PROTECTION_SETTING, MAX_CONTROL_HOURS, DEFAULT_ATTACK_MODE_HOURS, ProtectionControlStore, describePosture, applyControlsToRateLimits, applyControlsToDdos };
+function mergeControlsIntoConfig(config, controls) {
+  const compute = config?.infrastructure?.compute;
+  if (!compute || compute.ddos === false)
+    return config;
+  const base = typeof compute.ddos === "object" && compute.ddos !== null ? compute.ddos : {};
+  return {
+    ...config,
+    infrastructure: {
+      ...config.infrastructure,
+      compute: { ...compute, ddos: applyControlsToDdos(base, controls) }
+    }
+  };
+}
+export { RATE_LIMIT_KEY_SEPARATOR, globMatches, ruleMatches, rateLimitKey, RateLimiter, rateLimitHeaders, defaultRateLimitRules, PROTECTION_SETTING, MAX_CONTROL_HOURS, DEFAULT_ATTACK_MODE_HOURS, ProtectionControlStore, describePosture, applyControlsToRateLimits, applyControlsToDdos, mergeControlsIntoConfig };

package/dist/{chunk-9v2pwxv9.js → chunk-kpeb5rcs.js}

@@ -5,12 +5,12 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "./chunk-8kh577qh.js";
+} from "./chunk-v0vpamnf.js";
 import"./chunk-01d86gt1.js";
 import"./chunk-gttvakpv.js";
 import"./chunk-32e7ya18.js";
 import"./chunk-4cjrg98a.js";
-import"./chunk-wj3s95p9.js";
+import"./chunk-rds0sy87.js";
 import"./chunk-zqtpg06c.js";
 import"./chunk-v0bahtg2.js";
 export {

package/dist/{chunk-hpv68b4a.js → chunk-nsgqsmrh.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-32e7ya18.js";
 import {
   S3Client
-} from "./chunk-wj3s95p9.js";
+} from "./chunk-rds0sy87.js";
 import {
   AWSClient
 } from "./chunk-zqtpg06c.js";

package/dist/{chunk-wj3s95p9.js → chunk-rds0sy87.js}

@@ -1407,7 +1407,8 @@ host:${host}
       queryParams: { uploads: "" },
       headers
     });
-    return { UploadId: result?.InitiateMultipartUploadResult?.UploadId };
+    const root = result?.InitiateMultipartUploadResult ?? result;
+    return { UploadId: root?.UploadId };
   }
   async uploadPart(bucket, key, uploadId, partNumber, body) {
     const { accessKeyId, secretAccessKey, sessionToken } = this.getCredentials();
@@ -1504,7 +1505,7 @@ host:${host}
       bucket,
       queryParams: { uploads: "" }
     });
-    const uploads = result?.ListMultipartUploadsResult?.Upload;
+    const uploads = (result?.ListMultipartUploadsResult ?? result)?.Upload;
     if (!uploads)
       return [];
     const list = Array.isArray(uploads) ? uploads : [uploads];

package/dist/{chunk-k114qwg9.js → chunk-ttz2ra5j.js}

@@ -1,9 +1,9 @@
 import {
   EmailClient,
   email
-} from "./chunk-hpv68b4a.js";
+} from "./chunk-nsgqsmrh.js";
 import"./chunk-32e7ya18.js";
-import"./chunk-wj3s95p9.js";
+import"./chunk-rds0sy87.js";
 import"./chunk-zqtpg06c.js";
 import"./chunk-v0bahtg2.js";
 export {

package/dist/{chunk-8kh577qh.js → chunk-v0vpamnf.js}

@@ -16,7 +16,7 @@ import {
 } from "./chunk-4cjrg98a.js";
 import {
   S3Client
-} from "./chunk-wj3s95p9.js";
+} from "./chunk-rds0sy87.js";
 import {
   __require
 } from "./chunk-v0bahtg2.js";
@@ -815,7 +815,7 @@ async function deployStaticSiteWithExternalDnsFull(config) {
     }
   }
   onProgress?.("upload", "Uploading files to S3...");
-  const { uploadStaticFiles } = await import("./chunk-9v2pwxv9.js");
+  const { uploadStaticFiles } = await import("./chunk-kpeb5rcs.js");
   const uploadResult = await uploadStaticFiles({
     sourceDir,
     bucket: infraResult.bucket,
@@ -835,7 +835,7 @@ async function deployStaticSiteWithExternalDnsFull(config) {
   }
   if (infraResult.distributionId && uploadResult.uploaded > 0) {
     onProgress?.("invalidate", "Invalidating CloudFront cache...");
-    const { invalidateCache } = await import("./chunk-9v2pwxv9.js");
+    const { invalidateCache } = await import("./chunk-kpeb5rcs.js");
     await invalidateCache(infraResult.distributionId);
   }
   onProgress?.("complete", "Deployment complete!");

package/dist/{chunk-d3vx2ekv.js → chunk-wh1y5rtk.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-4cjrg98a.js";
 import {
   S3Client
-} from "./chunk-wj3s95p9.js";
+} from "./chunk-rds0sy87.js";
 import {
   renderWafInstallScript
 } from "./chunk-va2yd85b.js";
@@ -1287,7 +1287,7 @@ async function sendNotifications(config, event, message, options = {}) {
 }
 async function sendEmailNotification(email, event, message) {
   try {
-    const mod = await import("./chunk-k114qwg9.js");
+    const mod = await import("./chunk-ttz2ra5j.js");
     await mod.email.send({
       to: email.to,
       from: email.from,
@@ -1877,6 +1877,9 @@ function buildRpxProvisionScript(options) {
       "OOMPolicy=stop",
       "Restart=always",
       "RestartSec=5",
+      "StartLimitIntervalSec=120",
+      "StartLimitBurst=5",
+      `ExecStartPre=/bin/sh -c 'for p in 80 443; do fuser -k -n tcp "$p" 2>/dev/null || true; done; sleep 1'`,
       "LimitNOFILE=1048576",
       "AmbientCapabilities=CAP_NET_BIND_SERVICE",
       "",

package/dist/deploy/index.js

@@ -36,7 +36,7 @@ import {
   synchronizeDashboardUsers,
   trackDashboardOperation,
   verifyStaticApiOrigin
-} from "../chunk-cktwk9hy.js";
+} from "../chunk-3ee2jav4.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -47,12 +47,12 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "../chunk-8kh577qh.js";
+} from "../chunk-v0vpamnf.js";
 import {
   buildAndPushServerlessImage
 } from "../chunk-wmbep3b5.js";
-import"../chunk-x6yzgv7y.js";
-import"../chunk-hpv68b4a.js";
+import"../chunk-6a1t7fnq.js";
+import"../chunk-nsgqsmrh.js";
 import"../chunk-01d86gt1.js";
 import"../chunk-50jpda9q.js";
 import"../chunk-he9a874b.js";
@@ -78,12 +78,12 @@ import {
   siteInstallBase,
   validateDeploymentConfig,
   verifyAddressRecord
-} from "../chunk-d3vx2ekv.js";
+} from "../chunk-wh1y5rtk.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
-import"../chunk-wj3s95p9.js";
+import"../chunk-rds0sy87.js";
 import"../chunk-zqtpg06c.js";
-import"../chunk-grx1rp09.js";
+import"../chunk-19bs955w.js";
 import"../chunk-va2yd85b.js";
 import"../chunk-aa2dkn7b.js";
 import"../chunk-t2s3gdq6.js";

package/dist/drivers/index.js

@@ -68,10 +68,10 @@ import {
   waitForSsh,
   wrapCloudInitUserData,
   writeResizeCheckpoint
-} from "../chunk-d3vx2ekv.js";
+} from "../chunk-wh1y5rtk.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
-import"../chunk-wj3s95p9.js";
+import"../chunk-rds0sy87.js";
 import"../chunk-zqtpg06c.js";
 import"../chunk-va2yd85b.js";
 import"../chunk-aa2dkn7b.js";

package/dist/index.js

@@ -208,7 +208,7 @@ import {
   verifyUpdateSignature,
   webhookEndpoint,
   zeroCapacity
-} from "./chunk-cktwk9hy.js";
+} from "./chunk-3ee2jav4.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -219,7 +219,7 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "./chunk-8kh577qh.js";
+} from "./chunk-v0vpamnf.js";
 import {
   buildAndPushServerlessImage
 } from "./chunk-wmbep3b5.js";
@@ -260,12 +260,12 @@ import {
   providerEndpoint,
   remapKey,
   resolveObjectStorage
-} from "./chunk-x6yzgv7y.js";
+} from "./chunk-6a1t7fnq.js";
 import {
   EmailClient,
   IAMClient,
   SESClient
-} from "./chunk-hpv68b4a.js";
+} from "./chunk-nsgqsmrh.js";
 import {
   CloudFrontClient
 } from "./chunk-01d86gt1.js";
@@ -338,7 +338,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-d3vx2ekv.js";
+} from "./chunk-wh1y5rtk.js";
 import {
   EC2Client,
   SSMClient
@@ -348,7 +348,7 @@ import {
 } from "./chunk-4cjrg98a.js";
 import {
   S3Client
-} from "./chunk-wj3s95p9.js";
+} from "./chunk-rds0sy87.js";
 import {
   AWSClient
 } from "./chunk-zqtpg06c.js";
@@ -511,7 +511,7 @@ import {
   zeroFill,
   zoneOffsetMs,
   zonedParts
-} from "./chunk-grx1rp09.js";
+} from "./chunk-19bs955w.js";
 import {
   DEFAULT_ATTACK_MODE_HOURS,
   MAX_CONTROL_HOURS,
@@ -526,7 +526,7 @@ import {
   rateLimitHeaders,
   rateLimitKey,
   ruleMatches
-} from "./chunk-xrtwv3v2.js";
+} from "./chunk-d48vtdj4.js";
 import {
   escapeSecLang,
   globToRegex,

package/dist/protection/controls.d.ts

@@ -111,3 +111,17 @@ export declare function describePosture(controls: ReturnType<ProtectionControlSt
 export declare function applyControlsToRateLimits(rules: readonly RateLimitRule[], controls: ReturnType<ProtectionControlStore['current']>): RateLimitRule[];
 /** Apply the controls to a firewall config before it is rendered. */
 export declare function applyControlsToDdos(config: DdosConfig, controls: ReturnType<ProtectionControlStore['current']>): DdosConfig;
+/**
+ * Fold live operator controls into a cloud config before it reaches a driver.
+ *
+ * The provisioning path takes a `CloudConfig` and nothing else, deliberately:
+ * it also builds golden images, and baking one operator's live blocklist into a
+ * reusable image would be wrong. So the merge happens here, at the deploy call
+ * site that has a control plane, rather than inside the builder.
+ *
+ * Without this, `cloud protect:block` writes a rule that the next deploy
+ * silently renders without - the control appears to work and does nothing.
+ *
+ * Returns a shallow copy; the caller's config is not mutated.
+ */
+export declare function mergeControlsIntoConfig<T extends Record<string, any>>(config: T, controls: ReturnType<ProtectionControlStore['current']>): T;

package/dist/protection/index.js

@@ -10,10 +10,11 @@ import {
   defaultRateLimitRules,
   describePosture,
   globMatches,
+  mergeControlsIntoConfig,
   rateLimitHeaders,
   rateLimitKey,
   ruleMatches
-} from "../chunk-xrtwv3v2.js";
+} from "../chunk-d48vtdj4.js";
 import {
   escapeSecLang,
   globToRegex,
@@ -60,6 +61,7 @@ export {
   propagationHeaders,
   planMitigation,
   parseChain,
+  mergeControlsIntoConfig,
   isValidCidr,
   isSafePattern,
   inspectInvocation,

package/dist/spend/index.js

@@ -82,7 +82,7 @@ import {
   zeroFill,
   zoneOffsetMs,
   zonedParts
-} from "../chunk-grx1rp09.js";
+} from "../chunk-19bs955w.js";
 import"../chunk-aa2dkn7b.js";
 import"../chunk-t2s3gdq6.js";
 import"../chunk-v0bahtg2.js";

package/dist/spend/signals.d.ts

@@ -18,6 +18,15 @@ export interface SignalDefinition {
     unit: string;
     /** True when the signal is a ratio in 0-1. */
     ratio?: boolean;
+    /**
+     * True when the signal can be narrowed to a route.
+     *
+     * Usage rollups have no route dimension: they are priced per meter, not per
+     * path. Running route detection over them produces a series that is actually
+     * project-wide and records it under a route's name, which is worse than
+     * useless - it is a confidently mislabelled anomaly.
+     */
+    routeAware: boolean;
 }
 /**
  * The signals detection can run on.
@@ -53,10 +62,22 @@ export interface SignalSeries {
 export declare class SignalSource {
     private readonly controlPlane;
     private readonly spend;
+    private readonly counterCache;
     constructor(controlPlane: ControlPlaneStore, spend: SpendStore);
     private query;
     /** Usage-backed series: cost, or one meter's quantity. */
     private usageSeries;
+    private requestFilter;
+    /**
+     * Per-bucket request counters for a scope and window.
+     *
+     * Memoized because four signals derive from the same numbers. Computing them
+     * separately meant four full passes over the request history every cycle, and
+     * with per-route detection that multiplied by the route count.
+     */
+    private counters;
+    /** Drop the memo so a long-lived source re-reads on the next cycle. */
+    resetCache(): void;
     /**
      * Telemetry-backed series, aggregated in SQL.
      *