@stacksjs/ts-cloud 0.7.55 → 0.7.57

package/dist/maintenance/types.d.ts

@@ -0,0 +1,192 @@
+import type { JsonValue } from '../control-plane';
+export interface PlatformUpdateDocument {
+    version: string;
+    channel: 'stable' | 'preview' | 'nightly';
+    publishedAt: string;
+    minimumSchema: number;
+    maximumSchema: number;
+    minimumVersion?: string;
+    artifacts: Array<{
+        platform: string;
+        architecture: string;
+        url: string;
+        sha256: string;
+        sizeBytes: number;
+    }>;
+    migrations: Array<{
+        id: string;
+        reversible: boolean;
+        description: string;
+    }>;
+    releaseNotes?: string;
+}
+export interface TrustedUpdateKey {
+    id: string;
+    organizationId: string;
+    name: string;
+    algorithm: 'ed25519';
+    publicKeyPem: string;
+    fingerprint: string;
+    revokedAt?: string;
+    createdAt: string;
+}
+export interface PlatformUpdateManifest {
+    id: string;
+    organizationId: string;
+    version: string;
+    channel: PlatformUpdateDocument['channel'];
+    publishedAt: string;
+    keyId: string;
+    digest: string;
+    document: PlatformUpdateDocument;
+    signature: string;
+    verificationStatus: 'verified' | 'invalid' | 'revoked';
+    compatibility: {
+        compatible: boolean;
+        reasons: string[];
+    };
+    createdAt: string;
+}
+export interface MaintenanceWindow {
+    id: string;
+    projectId: string;
+    name: string;
+    schedule: string;
+    timezone: string;
+    durationMinutes: number;
+    allowedOperations: string[];
+    requireApproval: boolean;
+    enabled: boolean;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface UpgradeCampaign {
+    id: string;
+    projectId: string;
+    manifestId: string;
+    windowId?: string;
+    fromVersion: string;
+    strategy: 'canary' | 'rolling';
+    batchSize: number;
+    healthGate: Record<string, JsonValue>;
+    status: 'planned' | 'queued' | 'running' | 'paused' | 'rolling_back' | 'succeeded' | 'failed' | 'rolled_back' | 'cancelled';
+    currentStage?: string;
+    backupId?: string;
+    approvedBy?: string;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface UpgradeTarget {
+    id: string;
+    campaignId: string;
+    serverId?: string;
+    target: string;
+    cohort: number;
+    previousVersion: string;
+    status: 'pending' | 'downloading' | 'installing' | 'healthy' | 'failed' | 'rolling_back' | 'rolled_back' | 'skipped';
+    evidence: Record<string, JsonValue>;
+    error?: string;
+    startedAt?: string;
+    finishedAt?: string;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface CleanupCandidate {
+    id: string;
+    kind: string;
+    label: string;
+    bytes: number;
+    metadata?: Record<string, JsonValue>;
+}
+export interface CleanupPlan {
+    id: string;
+    projectId: string;
+    kind: 'releases' | 'artifacts' | 'operations' | 'logs' | 'previews' | 'snapshots' | 'orphaned_resources';
+    criteria: Record<string, JsonValue>;
+    candidates: CleanupCandidate[];
+    candidateDigest: string;
+    estimatedBytes: number;
+    status: 'preview' | 'approved' | 'running' | 'succeeded' | 'partial' | 'failed' | 'expired';
+    confirmation?: string;
+    expiresAt: string;
+    result: Record<string, JsonValue>;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface DisasterRecoveryDrill {
+    id: string;
+    projectId: string;
+    backupPolicyId?: string;
+    recoveryPointId?: string;
+    topologyId?: string;
+    scenario: 'control_plane' | 'database' | 'volume' | 'regional';
+    isolatedTarget: string;
+    expectedRpoMinutes: number;
+    expectedRtoMinutes: number;
+    status: 'planned' | 'queued' | 'restoring' | 'verifying' | 'cleaning' | 'passed' | 'failed' | 'cleanup_required' | 'cancelled';
+    operationId?: string;
+    evidence: Record<string, JsonValue>;
+    measuredRpoMinutes?: number;
+    measuredRtoMinutes?: number;
+    cleanupVerified: boolean;
+    error?: string;
+    startedAt?: string;
+    finishedAt?: string;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface PlatformMaintenanceDriver {
+    download(input: {
+        target: UpgradeTarget;
+        artifact: PlatformUpdateDocument['artifacts'][number];
+        signal: AbortSignal;
+    }): Promise<{
+        path: string;
+        sha256: string;
+    }>;
+    install(input: {
+        target: UpgradeTarget;
+        path: string;
+        version: string;
+        signal: AbortSignal;
+    }): Promise<void>;
+    health(input: {
+        target: UpgradeTarget;
+        gate: Record<string, JsonValue>;
+    }): Promise<{
+        healthy: boolean;
+        evidence: Record<string, JsonValue>;
+    }>;
+    rollback(input: {
+        target: UpgradeTarget;
+        version: string;
+        signal: AbortSignal;
+    }): Promise<void>;
+}
+export interface CleanupDriver {
+    kind: CleanupPlan['kind'];
+    discover(criteria: CleanupPlan['criteria']): Promise<CleanupCandidate[]>;
+    remove(candidate: CleanupCandidate): Promise<void>;
+}
+export interface DisasterRecoveryDriver {
+    scenario: DisasterRecoveryDrill['scenario'];
+    restore(input: {
+        drill: DisasterRecoveryDrill;
+        signal: AbortSignal;
+    }): Promise<{
+        target: string;
+        recoveryPointAt: string;
+        evidence: Record<string, JsonValue>;
+    }>;
+    verify(input: {
+        drill: DisasterRecoveryDrill;
+        target: string;
+    }): Promise<{
+        healthy: boolean;
+        evidence: Record<string, JsonValue>;
+    }>;
+    cleanup(input: {
+        drill: DisasterRecoveryDrill;
+        target: string;
+    }): Promise<void>;
+}

package/dist/media.d.ts

@@ -0,0 +1,62 @@
+export interface CloudFrontPolicyOptions {
+    resource: string;
+    expiresAt: Date | number;
+    activeAt?: Date | number;
+    ipAddress?: string;
+}
+export interface CloudFrontSignerOptions {
+    keyPairId: string;
+    privateKey: string | Buffer;
+}
+export interface CloudFrontSignedCookies {
+    'CloudFront-Key-Pair-Id': string;
+    'CloudFront-Policy': string;
+    'CloudFront-Signature': string;
+}
+export interface MediaAccessTokenOptions {
+    resource: string;
+    secret: string | Uint8Array;
+    expiresAt: Date | number;
+    keyId?: string;
+    audience?: string;
+}
+export interface VerifiedMediaAccessToken {
+    resource: string;
+    expiresAt: number;
+    keyId?: string;
+    audience?: string;
+}
+export interface MediaCdnPlanOptions {
+    bucket: string;
+    region: string;
+    domain?: string;
+    prefix?: string;
+    protected?: boolean;
+    trustedKeyGroupIds?: string[];
+}
+export interface MediaCdnBehavior {
+    pathPattern: string;
+    cacheControl: string;
+    compress: boolean;
+    signed: boolean;
+}
+export interface MediaCdnPlan {
+    originDomain: string;
+    originPath: string;
+    domain?: string;
+    behaviors: MediaCdnBehavior[];
+    trustedKeyGroupIds: string[];
+    responseHeaders: Record<string, string>;
+}
+export declare function createCloudFrontPolicy(options: CloudFrontPolicyOptions): string;
+export declare function signCloudFrontUrl(resource: string, expiresAt: Date | number, signer: CloudFrontSignerOptions): string;
+export declare function signCloudFrontCookies(policyOptions: CloudFrontPolicyOptions, signer: CloudFrontSignerOptions): CloudFrontSignedCookies;
+export declare function createMediaAccessToken(options: MediaAccessTokenOptions): string;
+export declare function verifyMediaAccessToken(token: string, options: {
+    secret: string | Uint8Array;
+    now?: Date | number;
+    resource?: string;
+    audience?: string;
+}): VerifiedMediaAccessToken | null;
+export declare function mediaObjectHeaders(path: string, protectedMedia?: boolean): Record<string, string>;
+export declare function buildMediaCdnPlan(options: MediaCdnPlanOptions): MediaCdnPlan;

package/dist/media.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/object-storage/index.d.ts

@@ -1,27 +1,3 @@
-/**
- * Multi-provider object storage.
- *
- * AWS S3, Backblaze B2 and Hetzner Object Storage all speak the S3 API and
- * authenticate with AWS Signature V4, so a single {@link S3Client} drives all
- * three — the only differences are the endpoint host, the addressing style and
- * where the credentials come from. This module resolves those differences from
- * a small config object (or environment variables) and hands back a ready
- * {@link S3Client}.
- *
- * @example
- * ```ts
- * // Backblaze B2 from explicit config
- * const s3 = createObjectStorageClient({
- *   provider: 'backblaze',
- *   region: 'us-west-004',
- *   credentials: { accessKeyId: keyId, secretAccessKey: appKey },
- * })
- * await s3.putObject({ bucket: 'my-bucket', key: 'a.txt', body: 'hi' })
- *
- * // Or entirely from env (OBJECT_STORAGE_PROVIDER=backblaze, B2_* vars set)
- * const s3 = createObjectStorageClient()
- * ```
- */
 import { S3Client } from '../aws/s3';
 export * from './migrate';
 export type ObjectStorageProvider = 'aws' | 'backblaze' | 'hetzner';

package/dist/onboarding/archive.d.ts

@@ -0,0 +1,12 @@
+export interface ArchiveInspectionOptions {
+    maxBytes?: number;
+    maxEntries?: number;
+    maxExpandedBytes?: number;
+}
+export interface ArchiveInspection {
+    format: 'zip' | 'tar';
+    entries: number;
+    expandedBytes: number;
+    paths: string[];
+}
+export declare function inspectApplicationArchive(bytes: Uint8Array, filename: string, options?: ArchiveInspectionOptions): ArchiveInspection;

package/dist/onboarding/artifact-store.d.ts

@@ -0,0 +1,22 @@
+import type { ControlPlaneStore } from '../control-plane';
+import type { ApplicationArtifactRecord } from './types';
+export declare class ApplicationArtifactStore {
+    private readonly controlPlane;
+    private readonly root;
+    private readonly idFn;
+    private readonly nowFn;
+    constructor(controlPlane: ControlPlaneStore, options: {
+        cwd: string;
+        id?: () => string;
+        now?: () => Date;
+    });
+    create(input: {
+        organizationId: string;
+        projectId: string;
+        filename: string;
+        bytes: Uint8Array;
+        actorId?: string;
+    }): ApplicationArtifactRecord;
+    get(id: string): ApplicationArtifactRecord | undefined;
+    list(projectId: string): ApplicationArtifactRecord[];
+}

package/dist/onboarding/detection.d.ts

@@ -0,0 +1,8 @@
+import type { DetectionCandidate, DetectionFile } from './types';
+/** Pure, bounded detection over caller-provided file metadata/content. */
+export declare function detectApplication(files: DetectionFile[]): DetectionCandidate[];
+/** Metadata-only directory scan: no project code is imported or executed. */
+export declare function scanApplicationDirectory(root: string, options?: {
+    maxFiles?: number;
+    maxContentBytes?: number;
+}): DetectionFile[];

package/dist/onboarding/index.d.ts

@@ -0,0 +1,9 @@
+export * from './types';
+export * from './detection';
+export * from './plan';
+export * from './archive';
+export * from './migrations';
+export * from './store';
+export * from './registry';
+export * from './artifact-store';
+export * from './service';

package/dist/onboarding/migrations.d.ts

@@ -0,0 +1,3 @@
+import type { ApplicationDraftInput } from './types';
+/** Upgrade the original prototype draft shape without inventing secret values. */
+export declare function migrateApplicationDraft(value: unknown): ApplicationDraftInput;

package/dist/onboarding/onboarding.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/onboarding/plan.d.ts

@@ -0,0 +1,3 @@
+import type { ApplicationDraftInput, ApplicationManifestV1, ApplicationPlan } from './types';
+export declare function planApplication(input: ApplicationDraftInput, suppliedSecretNames?: string[]): ApplicationPlan;
+export declare function parseApplicationManifest(serialized: string): ApplicationManifestV1;

package/dist/onboarding/registry.d.ts

@@ -0,0 +1,41 @@
+import type { ControlPlaneStore } from '../control-plane';
+import type { RegistryConnection, RegistryCredential } from './types';
+type RegistryFetch = typeof fetch;
+export declare class RegistryConnectionStore {
+    private readonly controlPlane;
+    private readonly key;
+    private readonly nowFn;
+    private readonly idFn;
+    constructor(controlPlane: ControlPlaneStore, options: {
+        encryptionKey: string;
+        now?: () => Date;
+        id?: () => string;
+    });
+    private now;
+    private encrypt;
+    private decrypt;
+    private current;
+    create(input: {
+        organizationId: string;
+        provider: RegistryConnection['provider'];
+        name: string;
+        host: string;
+        credential?: RegistryCredential;
+        credentialExpiresAt?: string;
+        actorId?: string;
+    }): RegistryConnection;
+    get(id: string): RegistryConnection | undefined;
+    list(organizationId: string): RegistryConnection[];
+    credential(id: string): RegistryCredential | undefined;
+    rotate(id: string, credential: RegistryCredential, input?: {
+        expiresAt?: string;
+        actorId?: string;
+    }): RegistryConnection;
+    disconnect(id: string, actorId?: string): RegistryConnection;
+    test(id: string, input?: {
+        image?: string;
+        fetch?: RegistryFetch;
+        timeoutMs?: number;
+    }): Promise<RegistryConnection>;
+}
+export {};

package/dist/onboarding/service.d.ts

@@ -0,0 +1,16 @@
+import type { ControlPlaneOperation, ControlPlaneResource, ControlPlaneStore } from '../control-plane';
+import type { ApplicationDraftStore } from './store';
+import type { ApplicationPlan } from './types';
+export interface ApplyApplicationResult {
+    plan: ApplicationPlan;
+    resource: ControlPlaneResource;
+    operation: ControlPlaneOperation;
+}
+export declare function applyApplicationDraft(input: {
+    controlPlane: ControlPlaneStore;
+    drafts: ApplicationDraftStore;
+    draftId: string;
+    expectedVersion: number;
+    confirmEnvironment: string;
+    actorId?: string;
+}): ApplyApplicationResult;

package/dist/onboarding/store.d.ts

@@ -0,0 +1,30 @@
+import type { ControlPlaneStore } from '../control-plane';
+import type { ApplicationDraftInput, ApplicationDraftRecord } from './types';
+export declare class ApplicationDraftStore {
+    private readonly controlPlane;
+    private readonly nowFn;
+    private readonly idFn;
+    constructor(controlPlane: ControlPlaneStore, options?: {
+        now?: () => Date;
+        id?: () => string;
+    });
+    private now;
+    create(input: {
+        organizationId: string;
+        projectId: string;
+        name: string;
+        draft: ApplicationDraftInput;
+        step?: ApplicationDraftRecord['step'];
+        suppliedSecretNames?: string[];
+        actorId?: string;
+    }): ApplicationDraftRecord;
+    get(id: string): ApplicationDraftRecord | undefined;
+    list(projectId: string): ApplicationDraftRecord[];
+    update(id: string, expectedVersion: number, input: {
+        draft: ApplicationDraftInput;
+        step: ApplicationDraftRecord['step'];
+        suppliedSecretNames?: string[];
+        actorId?: string;
+    }): ApplicationDraftRecord;
+    markApplied(id: string, expectedVersion: number, actorId?: string): ApplicationDraftRecord;
+}

package/dist/onboarding/types.d.ts

@@ -0,0 +1,204 @@
+import type { JsonValue } from '../control-plane';
+export type ApplicationSource = {
+    kind: 'git';
+    connectionId: string;
+    repositoryId: string;
+    repositoryFullName: string;
+    ref: string;
+    monorepoRoot?: string;
+    includePaths?: string[];
+    excludePaths?: string[];
+    submodules?: boolean;
+    sparsePaths?: string[];
+    deployKeyId?: string;
+} | {
+    kind: 'local';
+    root: string;
+} | {
+    kind: 'artifact';
+    artifactId: string;
+    filename: string;
+    sha256: string;
+    size: number;
+} | {
+    kind: 'image';
+    image: string;
+    registryConnectionId?: string;
+    digest?: string;
+};
+export type BuildStrategy = {
+    kind: 'dockerfile';
+    context: string;
+    dockerfile: string;
+    target?: string;
+    buildArgs?: Record<string, string>;
+    secretNames?: string[];
+} | {
+    kind: 'buildpack';
+    runtime: 'bun' | 'node' | 'php';
+    runtimeVersion?: string;
+    installCommand?: string;
+    buildCommand?: string;
+    startCommand?: string;
+    publishDirectory?: string;
+} | {
+    kind: 'static';
+    publishDirectory: string;
+    installCommand?: string;
+    buildCommand?: string;
+} | {
+    kind: 'server';
+    runtime: 'bun' | 'node' | 'php';
+    runtimeVersion?: string;
+    installCommand?: string;
+    buildCommand?: string;
+    startCommand: string;
+} | {
+    kind: 'serverless';
+    runtime: 'bun' | 'node' | 'php';
+    runtimeVersion?: string;
+    handler?: string;
+    packageRoot?: string;
+} | {
+    kind: 'prebuilt_image';
+    image: string;
+    registryConnectionId?: string;
+    digest?: string;
+};
+export interface ApplicationRuntime {
+    architecture: 'x86_64' | 'arm64';
+    port?: number;
+    healthCheck?: {
+        protocol: 'http' | 'https' | 'tcp';
+        path?: string;
+        intervalSeconds?: number;
+        timeoutSeconds?: number;
+    };
+    cpu?: number;
+    memoryMb?: number;
+    minInstances?: number;
+    maxInstances?: number;
+    target: 'server' | 'serverless' | 'container';
+}
+export interface ApplicationDraftInput {
+    schemaVersion: 1;
+    name: string;
+    slug: string;
+    projectId: string;
+    environmentId: string;
+    source: ApplicationSource;
+    build: BuildStrategy;
+    runtime: ApplicationRuntime;
+    environment?: Record<string, string | {
+        secretRef: string;
+    }>;
+    requiredSecretNames?: string[];
+    domain?: {
+        hostname: string;
+        path?: string;
+        tls?: boolean;
+    };
+}
+export interface DetectionFile {
+    path: string;
+    content?: string;
+    size?: number;
+}
+export interface DetectionEvidence {
+    path: string;
+    reason: string;
+    weight: number;
+}
+export interface DetectionCandidate {
+    framework: 'bun' | 'node' | 'laravel' | 'php' | 'static' | 'dockerfile' | 'unknown';
+    strategy: BuildStrategy['kind'];
+    confidence: number;
+    evidence: DetectionEvidence[];
+    defaults: Partial<Pick<ApplicationDraftInput, 'build' | 'runtime'>>;
+    description: string;
+}
+export interface ApplicationValidationIssue {
+    path: string;
+    code: string;
+    message: string;
+    alternatives?: string[];
+}
+export interface ApplicationManifestV1 {
+    apiVersion: 'ts-cloud.dev/v1';
+    kind: 'Application';
+    metadata: {
+        name: string;
+        slug: string;
+        projectId: string;
+        environmentId: string;
+    };
+    spec: {
+        source: ApplicationSource;
+        build: BuildStrategy;
+        runtime: ApplicationRuntime;
+        environment: Record<string, string | {
+            secretRef: string;
+        }>;
+        domain?: ApplicationDraftInput['domain'];
+    };
+}
+export interface ApplicationPlan {
+    valid: boolean;
+    issues: ApplicationValidationIssue[];
+    missingSecrets: string[];
+    manifest: ApplicationManifestV1;
+    configPatch: JsonValue;
+    capabilityRequirements: string[];
+    costDrivers: string[];
+    serializedManifest: string;
+}
+export interface ApplicationDraftRecord {
+    id: string;
+    organizationId: string;
+    projectId: string;
+    schemaVersion: number;
+    name: string;
+    step: 'source' | 'build' | 'runtime' | 'environment' | 'domain' | 'review';
+    input: ApplicationDraftInput;
+    suppliedSecretNames: string[];
+    status: 'draft' | 'ready' | 'applied';
+    version: number;
+    createdByActorId?: string;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface RegistryConnection {
+    id: string;
+    organizationId: string;
+    provider: 'docker_hub' | 'ghcr' | 'ecr' | 'gcr' | 'generic';
+    name: string;
+    host: string;
+    credentialConfigured: boolean;
+    credentialFingerprint?: string;
+    credentialExpiresAt?: string;
+    status: 'pending' | 'healthy' | 'degraded' | 'expired' | 'disconnected';
+    healthMessage?: string;
+    lastTestedAt?: string;
+    version: number;
+    createdByActorId?: string;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface RegistryCredential {
+    username?: string;
+    password?: string;
+    token?: string;
+}
+export interface ApplicationArtifactRecord {
+    id: string;
+    organizationId: string;
+    projectId: string;
+    filename: string;
+    sha256: string;
+    size: number;
+    format: 'zip' | 'tar';
+    entryCount: number;
+    expandedBytes: number;
+    createdByActorId?: string;
+    createdAt: string;
+}

package/dist/placement/builds.d.ts

@@ -0,0 +1,20 @@
+import type { JsonValue } from '../control-plane';
+import type { PlacementRequirements, RemoteBuild } from './types';
+import { DurableOperationQueue } from '../queue';
+import { PlacementService } from './service';
+import { PlacementStore } from './store';
+export declare class RemoteBuildService {
+    readonly store: PlacementStore;
+    readonly placement: PlacementService;
+    private now;
+    readonly queue: DurableOperationQueue;
+    constructor(store: PlacementStore, placement: PlacementService, queue?: DurableOperationQueue, now?: () => Date);
+    enqueue(input: {
+        projectId: string;
+        resourceId: string;
+        sourceSha: string;
+        buildSpec: JsonValue;
+        requirements?: Partial<PlacementRequirements>;
+    }): RemoteBuild;
+    cancel(id: string): RemoteBuild;
+}