@stacksjs/ts-cloud 0.8.3 → 0.9.1

package/dist/dns/types.d.ts

@@ -20,7 +20,32 @@ export interface DnsRecord {
     priority?: number;
     weight?: number;
     port?: number;
+    /**
+     * Cloudflare only: serve this record through Cloudflare's reverse proxy (the
+     * "orange cloud") instead of publishing the origin address to the world.
+     *
+     * This is what turns a plain A/AAAA/CNAME into a CDN-fronted host — the
+     * public answer becomes a Cloudflare anycast address and requests reach the
+     * origin over Cloudflare's network, picking up its edge cache, TLS
+     * termination and DDoS protection on the way.
+     *
+     * Leave it `undefined` on an upsert to mean "don't care": the provider then
+     * PRESERVES whatever proxy state the record already has. That distinction
+     * matters because every deploy rewrites these records, and a `false` default
+     * would silently grey-cloud a proxied site on the next deploy.
+     *
+     * Ignored by every non-Cloudflare provider, and by Cloudflare itself for
+     * record types it cannot proxy (see {@link PROXIABLE_RECORD_TYPES}).
+     */
+    proxied?: boolean;
 }
+/**
+ * Record types Cloudflare is able to put behind its proxy. Anything else (TXT,
+ * MX, NS, CAA, SRV) is always served as plain DNS, and sending `proxied` for
+ * one is an API error rather than a no-op — so the provider drops the field for
+ * those types instead of forwarding it.
+ */
+export declare const PROXIABLE_RECORD_TYPES: ReadonlySet<DnsRecordType>;
 export interface DnsRecordResult extends DnsRecord {
     id?: string;
 }
@@ -95,6 +120,24 @@ export interface GoDaddyProviderConfig {
 export interface CloudflareProviderConfig {
     provider: 'cloudflare';
     apiToken: string;
+    /**
+     * Zone id for the domain being managed.
+     *
+     * Supplying it is what lets the API token be scoped to a SINGLE zone. Without
+     * it the provider has to find the zone by name through `GET /zones?name=…`,
+     * and that endpoint is an account-level listing: a token restricted to one
+     * zone gets an empty result back and every operation fails with "Zone not
+     * found", which reads like a missing domain rather than a missing permission.
+     *
+     * Only applies to the zone it belongs to; requests for any other domain fall
+     * back to the by-name lookup.
+     */
+    zoneId?: string;
+    /**
+     * Account id. Only needed for account-scoped resources (account-level
+     * rulesets); zone-scoped work never uses it.
+     */
+    accountId?: string;
 }
 export type DnsProviderConfig = Route53ProviderConfig | PorkbunProviderConfig | GoDaddyProviderConfig | CloudflareProviderConfig;
 /**

package/dist/drivers/index.js

@@ -70,7 +70,7 @@ import {
   waitForSsh,
   wrapCloudInitUserData,
   writeResizeCheckpoint
-} from "../chunk-x6137d59.js";
+} from "../chunk-hg7rhrgd.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-rds0sy87.js";

package/dist/drivers/shared/rpx-gateway.d.ts

@@ -48,6 +48,17 @@ export declare function hasAutoWwwVariant(domain: string): boolean;
 export declare function gatewayHostnames(sites: Record<string, SiteConfig | undefined>, options?: {
     autoWww?: boolean;
 }): string[];
+/**
+ * Public recursive resolvers used to decide whether a hostname is ready for an
+ * ACME http-01 challenge.
+ *
+ * The question the check has to answer is "can Let's Encrypt see this record
+ * yet", and LE resolves from the public internet — so the box's own resolver is
+ * the wrong vantage point, and a stale negative entry there blocks issuance for
+ * a record the rest of the world can already resolve. Two independent operators
+ * so one being unreachable does not stall a deploy.
+ */
+export declare const PUBLIC_DNS_RESOLVERS: readonly string[];
 /** Default webroot the gateway serves ACME http-01 challenges from on `:80`. */
 export declare const DEFAULT_ACME_WEBROOT = "/var/www/acme-challenge";
 /** A normalized redirect target on an {@link RpxRoute} (see rpx's `redirect`). */

package/dist/index.d.ts

@@ -35,16 +35,20 @@ export * from './ssl';
 export { deployStaticSite, deployStaticSiteFull, uploadStaticFiles, invalidateCache, deleteStaticSite, generateStaticSiteTemplate, deployStaticSiteWithExternalDns, deployStaticSiteWithExternalDnsFull, generateExternalDnsStaticSiteTemplate, deploySite, hasProxyUpstream, resolveProxyUpstreams, resolveSiteDeployTarget, resolveSiteKind, shipsARelease, validateDeploymentConfig, buildAndPushServerlessImage, buildFunctionEnv, deployServerlessApp, infraEnvFromOutputs, redeployServerlessApp, rollbackServerlessApp, runRemoteCommand, setMaintenance, buildManagementDashboardArtifact, dashboardCredentialsFile, ensureManagementDashboard, MANAGEMENT_DASHBOARD_SITE, resolveDashboardAuth, resolveUiSource, } from './deploy';
 export { collectServerDnsDomains, hostAcceptsIpv6, IPV6_EXCLUDED_HOST_LABELS, normalizePublicIpv6, reconcileAddressRecords, removeStaleServerAddressRecords, verifyAddressRecord, } from './deploy/server-dns';
 export type { AddressRecordReport } from './deploy/server-dns';
+export * from './cdn';
 export type { EnsureDashboardLogger, ResolvedDashboardAuth, StaticSiteConfig, DeployResult, UploadOptions, ExternalDnsStaticSiteConfig, ExternalDnsDeployResult, DeploySiteConfig, DeploySiteResult, StaticSiteDnsProvider, SiteDeployKind, DeploymentValidationResult, BuildImageOptions, BuiltImage, CodeSource, DeployServerlessOptions, ResolvedContext, } from './deploy';
 export { createCloudDriver, CloudDriverFactory, cloudDrivers, AwsDriver, HetznerDriver, HetznerClient, resolveHetznerApiToken, normalizeSshPublicKey, ensureFirewall, ensureServer, ensureSshKey, serverPublicIpv4, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, buildSshArgs, generateUbuntuAppCloudInit, wrapCloudInitUserData, buildHostCleanupScript, buildSiteDeployScript, buildStaticSiteDeployScript, resolveExecStart, deployAllComputeSites, deploySiteRelease, reloadRpxGateway, renewRpxCertificates, gatewayHostnames, hasAutoWwwVariant, } from './drivers';
 export type { CreateCloudDriverOptions } from './drivers/factory';
 export { dashboardActions, resolveDashboardAction, sanitizeCloudConfig, startLocalDashboardServer, } from './deploy/local-dashboard-server';
 export type { DashboardAction, LocalDashboardServer, LocalDashboardServerOptions, } from './deploy/local-dashboard-server';
-export { createDnsProvider, detectDnsProvider, DnsProviderFactory, dnsProviders, PorkbunProvider, GoDaddyProvider, Route53Provider, UnifiedDnsValidator, createPorkbunValidator, createGoDaddyValidator, createRoute53Validator, } from './dns';
+export { createDnsProvider, detectDnsProvider, DnsProviderFactory, dnsProviders, PorkbunProvider, GoDaddyProvider, Route53Provider, CloudflareProvider, UnifiedDnsValidator, createPorkbunValidator, createGoDaddyValidator, createRoute53Validator, } from './dns';
+export type { CloudflareProviderOptions, CloudflareRule, CloudflareRulesetPhase, CloudflareZoneSetting, } from './dns/cloudflare';
+export { CLOUDFLARE_MANAGED_RULE_PREFIX } from './dns/cloudflare';
 export * from './source';
 export * from './queue';
 export * from './backups';
 export * from './configuration';
 export type { DnsProvider, DnsProviderConfig, DnsRecord, DnsRecordType, DnsRecordResult, CreateRecordResult, DeleteRecordResult, ListRecordsResult, } from './dns';
+export { PROXIABLE_RECORD_TYPES } from './dns';
 export * from '@ts-cloud/core';
 export type { S3Bucket, S3BucketPolicy, CloudFrontDistribution, CloudFrontOriginAccessControl, CloudFrontCacheBehavior, CloudFrontOrigin, } from '@ts-cloud/aws-types';

package/dist/index.js

@@ -208,7 +208,7 @@ import {
   verifyUpdateSignature,
   webhookEndpoint,
   zeroCapacity
-} from "./chunk-wxhrr03r.js";
+} from "./chunk-hygwq9y2.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -219,7 +219,7 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "./chunk-v0vpamnf.js";
+} from "./chunk-5nr95wpj.js";
 import {
   buildAndPushServerlessImage
 } from "./chunk-fgk8cqew.js";
@@ -278,8 +278,11 @@ import {
 import {
   ACMClient,
   ACMDnsValidator,
+  CLOUDFLARE_MANAGED_RULE_PREFIX,
+  CloudflareProvider,
   DnsProviderFactory,
   GoDaddyProvider,
+  PROXIABLE_RECORD_TYPES,
   PorkbunProvider,
   Route53Provider,
   UnifiedDnsValidator,
@@ -289,7 +292,7 @@ import {
   createRoute53Validator,
   detectDnsProvider,
   dnsProviders
-} from "./chunk-gttvakpv.js";
+} from "./chunk-atbgd8wz.js";
 import {
   Route53Client
 } from "./chunk-32e7ya18.js";
@@ -343,7 +346,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-x6137d59.js";
+} from "./chunk-hg7rhrgd.js";
 import {
   EC2Client,
   SSMClient
@@ -5284,6 +5287,353 @@ class AcmeClient {
     return this.accountKey;
   }
 }
+// src/cdn/cloudflare-rules.ts
+var DEFAULT_STATIC_ASSET_EXTENSIONS = [
+  "js",
+  "mjs",
+  "cjs",
+  "css",
+  "map",
+  "woff",
+  "woff2",
+  "ttf",
+  "otf",
+  "eot",
+  "png",
+  "jpg",
+  "jpeg",
+  "gif",
+  "webp",
+  "avif",
+  "svg",
+  "ico",
+  "mp4",
+  "webm",
+  "ogg",
+  "mp3",
+  "wav",
+  "pdf",
+  "wasm"
+];
+function quote(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+function set(values) {
+  return `{${values.map(quote).join(" ")}}`;
+}
+function hostCondition(hosts) {
+  if (hosts.length === 1)
+    return `http.host eq ${quote(hosts[0])}`;
+  return `http.host in ${set(hosts)}`;
+}
+function buildStaticSiteCacheRules(hosts, settings = {}) {
+  if (settings.enabled === false || hosts.length === 0)
+    return [];
+  const host = hostCondition(hosts);
+  const rules = [];
+  const bypassPaths = settings.bypassPaths ?? [];
+  const bypassClause = bypassPaths.length > 0 ? `(${bypassPaths.map((path) => `starts_with(http.request.uri.path, ${quote(path)})`).join(" or ")})` : undefined;
+  if (bypassClause) {
+    rules.push({
+      action: "set_cache_settings",
+      description: "bypass cache",
+      expression: `(${host} and ${bypassClause})`,
+      enabled: true,
+      action_parameters: { cache: false }
+    });
+  }
+  const cacheable = bypassClause ? `${host} and not ${bypassClause}` : host;
+  const extensions = settings.assetExtensions ?? DEFAULT_STATIC_ASSET_EXTENSIONS;
+  const assetClause = extensions.length > 0 ? `lower(http.request.uri.path.extension) in ${set([...extensions])}` : undefined;
+  if (assetClause) {
+    rules.push({
+      action: "set_cache_settings",
+      description: "cache fingerprinted assets",
+      expression: `(${cacheable} and ${assetClause})`,
+      enabled: true,
+      action_parameters: {
+        cache: true,
+        edge_ttl: { mode: "override_origin", default: settings.assetEdgeTtl ?? 2592000 },
+        browser_ttl: { mode: "override_origin", default: settings.assetBrowserTtl ?? 31536000 }
+      }
+    });
+  }
+  rules.push({
+    action: "set_cache_settings",
+    description: "cache documents",
+    expression: assetClause ? `(${cacheable} and not ${assetClause})` : `(${cacheable})`,
+    enabled: true,
+    action_parameters: {
+      cache: true,
+      edge_ttl: { mode: "override_origin", default: settings.documentEdgeTtl ?? 3600 },
+      browser_ttl: { mode: "override_origin", default: settings.documentBrowserTtl ?? 0 }
+    }
+  });
+  return rules;
+}
+function buildOriginGuardRule(hosts, header, value) {
+  if (hosts.length === 0 || !header || !value)
+    return [];
+  return [
+    {
+      action: "rewrite",
+      description: "origin guard header",
+      expression: `(${hostCondition(hosts)})`,
+      enabled: true,
+      action_parameters: {
+        headers: {
+          [header]: { operation: "set", value }
+        }
+      }
+    }
+  ];
+}
+
+// src/cdn/cloudflare-settings.ts
+var onOff = (value) => value === undefined ? undefined : value ? "on" : "off";
+function toCloudflareZoneSettings(settings) {
+  const mapped = {
+    ssl: settings.ssl,
+    always_use_https: onOff(settings.alwaysUseHttps),
+    automatic_https_rewrites: onOff(settings.automaticHttpsRewrites),
+    min_tls_version: settings.minTlsVersion,
+    tls_1_3: onOff(settings.tls13),
+    brotli: onOff(settings.brotli),
+    http3: onOff(settings.http3),
+    "0rtt": onOff(settings.zeroRtt),
+    early_hints: onOff(settings.earlyHints),
+    browser_cache_ttl: settings.browserCacheTtl,
+    always_online: onOff(settings.alwaysOnline),
+    websockets: onOff(settings.websockets)
+  };
+  if (settings.hsts) {
+    mapped.security_header = {
+      strict_transport_security: {
+        enabled: settings.hsts.enabled,
+        max_age: settings.hsts.maxAge ?? 31536000,
+        include_subdomains: settings.hsts.includeSubdomains ?? false,
+        preload: settings.hsts.preload ?? false,
+        nosniff: settings.hsts.noSniff ?? true
+      }
+    };
+  }
+  for (const key of Object.keys(mapped)) {
+    if (mapped[key] === undefined)
+      delete mapped[key];
+  }
+  return { ...mapped, ...settings.raw ?? {} };
+}
+var STATIC_SITE_ZONE_SETTINGS = {
+  ssl: "strict",
+  alwaysUseHttps: true,
+  automaticHttpsRewrites: true,
+  minTlsVersion: "1.2",
+  tls13: true,
+  brotli: true,
+  http3: true,
+  earlyHints: true,
+  alwaysOnline: true,
+  browserCacheTtl: 0
+};
+
+// src/cdn/origin-tls.ts
+import { connect } from "node:tls";
+async function probeOriginTls(options) {
+  const { address, serverName, port = 443, timeoutMs = 5000 } = options;
+  return new Promise((resolve) => {
+    let settled = false;
+    const finish = (result) => {
+      if (settled)
+        return;
+      settled = true;
+      try {
+        socket.destroy();
+      } catch {}
+      resolve(result);
+    };
+    const socket = connect({
+      host: address,
+      port,
+      servername: serverName,
+      rejectUnauthorized: false,
+      timeout: timeoutMs
+    });
+    socket.once("secureConnect", () => {
+      if (socket.authorized) {
+        finish({ reachable: true, trusted: true });
+        return;
+      }
+      finish({
+        reachable: true,
+        trusted: false,
+        reason: socket.authorizationError ? String(socket.authorizationError) : "origin certificate is not trusted for this hostname"
+      });
+    });
+    socket.once("timeout", () => {
+      finish({ reachable: false, trusted: false, reason: `no TLS handshake within ${timeoutMs}ms` });
+    });
+    socket.once("error", (error) => {
+      finish({ reachable: false, trusted: false, reason: error.message });
+    });
+  });
+}
+
+// src/cdn/cloudflare.ts
+async function reconcileCloudflareCdn(options) {
+  const {
+    provider,
+    zone,
+    hosts,
+    ipv4,
+    ipv6,
+    proxied = true,
+    settings = STATIC_SITE_ZONE_SETTINGS,
+    cache,
+    originGuard,
+    purge = true,
+    ttl = 300,
+    skipOriginProbe = false
+  } = options;
+  const report = {
+    records: [],
+    settingsChanged: [],
+    cacheRules: 0,
+    originGuard: false,
+    purged: false,
+    deferredProxy: [],
+    warnings: []
+  };
+  if (hosts.length === 0)
+    return report;
+  const proxiedHosts = [];
+  for (const host of hosts) {
+    let hostProxied = proxied;
+    if (proxied && !skipOriginProbe) {
+      const probe = await probeOriginTls({ address: ipv4, serverName: host });
+      if (!probe.trusted) {
+        hostProxied = false;
+        const reason = probe.reason || "origin is not serving a trusted certificate";
+        report.deferredProxy.push({ host, reason });
+        report.warnings.push(`${host}: publishing DNS-only for now — the origin does not yet serve a certificate this proxy can verify (${reason}). ` + `The origin issues certificates over HTTP-01, which needs the name to reach it directly; re-run the deploy once it has one and the record will be proxied.`);
+      }
+    }
+    if (hostProxied)
+      proxiedHosts.push(host);
+    const families = [{ type: "A", content: ipv4 }];
+    if (ipv6 && hostAcceptsIpv6(host))
+      families.push({ type: "AAAA", content: ipv6 });
+    for (const { type, content } of families) {
+      const result = await provider.upsertRecord(zone, {
+        name: host,
+        type,
+        content,
+        ttl,
+        proxied: hostProxied
+      });
+      if (result.success)
+        report.records.push({ host, type, content, proxied: hostProxied });
+      else
+        report.warnings.push(`${host} ${type} → ${content} failed: ${result.message || "unknown provider error"}`);
+    }
+  }
+  if (proxiedHosts.length === 0) {
+    if (proxied) {
+      report.warnings.push("No host is proxied yet, so zone settings, cache rules and purge were skipped — they only take effect through the proxy.");
+    }
+    return report;
+  }
+  try {
+    const desired = toCloudflareZoneSettings(settings);
+    const applied = await provider.applyZoneSettings(zone, desired);
+    report.settingsChanged = applied.changed;
+    for (const failure of applied.failed) {
+      report.warnings.push(`zone setting '${failure.id}' could not be applied: ${failure.error}`);
+    }
+  } catch (error) {
+    report.warnings.push(`zone settings could not be read: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  const cacheRules = buildStaticSiteCacheRules(proxiedHosts, cache);
+  if (cacheRules.length > 0) {
+    const written = await provider.putManagedPhaseRules(zone, "http_request_cache_settings", cacheRules);
+    if (written.success)
+      report.cacheRules = cacheRules.length;
+    else
+      report.warnings.push(`cache rules could not be written: ${written.message}`);
+  }
+  if (originGuard) {
+    const rules = buildOriginGuardRule(proxiedHosts, originGuard.header, originGuard.value);
+    if (rules.length > 0) {
+      const written = await provider.putManagedPhaseRules(zone, "http_request_late_transform", rules);
+      if (written.success)
+        report.originGuard = true;
+      else {
+        report.warnings.push(`origin guard header could not be written: ${written.message}. ` + `The gateway will reject requests that lack it — disable the guard or grant the token Transform Rules: Edit.`);
+      }
+    }
+  }
+  if (purge) {
+    report.purged = await provider.purgeCache(zone, { hosts: proxiedHosts });
+    if (!report.purged)
+      report.warnings.push("edge cache purge failed — new content may take until TTL expiry to appear.");
+  }
+  return report;
+}
+// src/cdn/cloudflare-plan.ts
+var defaultEnv = (key) => process.env[key];
+function resolveZoneApex(host, configuredDomain) {
+  const hostname = host.replace(/\.$/, "").toLowerCase();
+  if (configuredDomain) {
+    const domain = configuredDomain.replace(/\.$/, "").toLowerCase();
+    if (hostname === domain || hostname.endsWith(`.${domain}`))
+      return domain;
+  }
+  return hostname.split(".").slice(-2).join(".");
+}
+function resolveCloudflareCdnPlan(config2, options = {}) {
+  const env = options.env ?? defaultEnv;
+  const cdn = config2.infrastructure?.compute?.proxy?.cdn;
+  const errors = [];
+  if (!cdn || cdn.provider !== "cloudflare")
+    return { plan: null, errors };
+  if (cdn.originDomain) {
+    errors.push(`compute.proxy.cdn.originDomain (${cdn.originDomain}) is ignored for Cloudflare: the proxy forwards to the address in the record it fronts, ` + `so no separate origin hostname is needed — and publishing one gives clients a documented way around the edge.`);
+  }
+  const apiToken = env("CLOUDFLARE_API_TOKEN");
+  if (!apiToken) {
+    errors.push("CLOUDFLARE_API_TOKEN is not set — the Cloudflare CDN cannot be reconciled.");
+    return { plan: null, errors };
+  }
+  const sites = config2.sites ?? {};
+  const hosts = cdn.frontedHosts?.length ? [...new Set(cdn.frontedHosts.map((host) => host.toLowerCase()))] : gatewayHostnames(sites, { autoWww: config2.infrastructure?.compute?.proxy?.autoWww !== false });
+  if (hosts.length === 0) {
+    errors.push("No hostnames to front — set compute.proxy.cdn.frontedHosts, or give a site a domain.");
+    return { plan: null, errors };
+  }
+  const configuredDomain = config2.infrastructure?.dns?.domain;
+  const zones = new Set(hosts.map((host) => resolveZoneApex(host, configuredDomain)));
+  if (zones.size > 1) {
+    errors.push(`Fronted hosts span more than one zone (${[...zones].join(", ")}). ` + `A Cloudflare zone is configured as a unit, so run one CDN config per zone.`);
+    return { plan: null, errors };
+  }
+  const cf = cdn.cloudflare ?? {};
+  const guard = cdn.secret ? { header: cdn.secretHeader ?? "X-Origin-Verify", value: cdn.secret } : undefined;
+  return {
+    plan: {
+      zone: [...zones][0],
+      hosts,
+      apiToken,
+      zoneId: cf.zoneId ?? env("CLOUDFLARE_ZONE_ID"),
+      accountId: cf.accountId ?? env("CLOUDFLARE_ACCOUNT_ID"),
+      proxied: cf.proxied !== false,
+      settings: cf.settings ?? STATIC_SITE_ZONE_SETTINGS,
+      cache: cf.cache,
+      originGuard: guard,
+      purge: cf.purgeOnDeploy !== false,
+      skipOriginProbe: cf.skipOriginProbe === true
+    },
+    errors
+  };
+}
 export {
   zonedParts,
   zoneOffsetMs,
@@ -5331,6 +5681,7 @@ export {
   totp,
   toFocusRecords,
   toFocusJsonl,
+  toCloudflareZoneSettings,
   tieredMicroCents,
   testSourceConnection,
   templateCache,
@@ -5416,6 +5767,7 @@ export {
   robustZScore,
   responseToResult,
   resourceManagementManager,
+  resolveZoneApex,
   resolveUiSource,
   resolveStorageBucketName,
   resolveStatePath,
@@ -5448,6 +5800,7 @@ export {
   resolveDashboardAuth,
   resolveDashboardAction,
   resolveCredentials,
+  resolveCloudflareCdnPlan,
   resolveCloudProvider,
   resolveAuthEncryptionKey,
   resolveAppDatabase,
@@ -5481,6 +5834,7 @@ export {
   recordDashboardHostPosture,
   reconcileSourceWebhook,
   reconcileJobObservation,
+  reconcileCloudflareCdn,
   reconcileAddressRecords,
   rateLimitKey,
   rateLimitHeaders,
@@ -5494,6 +5848,7 @@ export {
   productionChangeReview,
   processSourceWebhook,
   processInChunks,
+  probeOriginTls,
   priceUsageLines,
   priceUsage,
   previousBudgetWindow,
@@ -5590,6 +5945,7 @@ export {
   hourBucketsBetween,
   hourBucket,
   hotp,
+  hostCondition,
   hostAcceptsIpv6,
   healthCheckManager,
   hashString,
@@ -5840,9 +6196,11 @@ export {
   canaryManager,
   bytes,
   buildStaticSiteDeployScript,
+  buildStaticSiteCacheRules,
   buildSshArgs,
   buildSiteDeployScript,
   buildPhpRuntimeLayerZip,
+  buildOriginGuardRule,
   buildOptimizationManager,
   buildNodeRuntimeLayerZip,
   buildMediaCdnPlan,
@@ -5952,6 +6310,7 @@ export {
   Search,
   SchedulerClient,
   STSClient,
+  STATIC_SITE_ZONE_SETTINGS,
   STATE_DIR_ENV_VAR,
   SSMClient,
   SQSClient,
@@ -6022,6 +6381,7 @@ export {
   Permissions,
   PerformanceManager,
   ParameterStore,
+  PROXIABLE_RECORD_TYPES,
   PHP_LAYER_EXTENSIONS,
   PHP_DEFAULT_EXCLUDES,
   OrganizationManager,
@@ -6141,6 +6501,7 @@ export {
   DEPLOYMENT_QUEUE_KINDS,
   DEFAULT_THRESHOLDS,
   DEFAULT_TELEMETRY_POLICY,
+  DEFAULT_STATIC_ASSET_EXTENSIONS,
   DEFAULT_STATE_DIR,
   DEFAULT_SERVICE_LIMITS,
   DEFAULT_RECURSION_LIMITS,
@@ -6171,6 +6532,7 @@ export {
   ComposeApplicationService,
   Communication,
   CommandHistory,
+  CloudflareProvider,
   CloudWatchLogsClient,
   CloudTrailManager,
   CloudFrontClient,
@@ -6184,6 +6546,7 @@ export {
   Cache,
   CONTROL_PLANE_SCHEMA_VERSION,
   COMMON_CROSS_ACCOUNT_ROLES,
+  CLOUDFLARE_MANAGED_RULE_PREFIX,
   CHAIN_HEADER,
   CDN,
   BunFilesystemArchiveRuntime,