@stacksjs/ts-cloud 0.9.4 → 0.10.0

package/dist/operations/plan.d.ts

@@ -0,0 +1,136 @@
+/**
+ * Plan-then-apply scaffolding for fleet operations that change live topology.
+ *
+ * Consolidating servers — moving an app to another box, attaching one as a site,
+ * renaming a box — is a routine cleanup that is currently an afternoon of SSH.
+ * What makes it an afternoon is not the individual steps, which are small; it is
+ * that a half-finished one leaves no way to tell what already happened. So every
+ * such operation is expressed the same way here:
+ *
+ * - **Plan first.** A step says what it would change (`from → to`) before
+ *   anything is touched, and prints the same way every run so a plan can be
+ *   diffed.
+ * - **Idempotent and resumable.** Resumability comes from `satisfied()`, which
+ *   asks REALITY whether the step's intent already holds — not from a checkpoint
+ *   file, which can disagree with the world after a crash. Re-running an
+ *   operation that died halfway continues rather than starting over or
+ *   double-applying, and a fully-applied operation re-runs as a clean no-op.
+ * - **Typed confirmation for the destructive half.** Irreversible steps are
+ *   marked, counted separately, and gated on the operator typing the target's
+ *   exact name — separately from the operation itself.
+ * - **Non-interactive.** Nothing here reads stdin: a plan is data, the
+ *   confirmation is a flag, so the whole sequence is drivable from CI.
+ * - **Audited.** Each step reports through {@link ApplyPlanOptions.audit} as it
+ *   starts and finishes, so the operation log carries what actually ran.
+ *
+ * @see https://github.com/stacksjs/ts-cloud/issues/167
+ */
+/** A value a step changes, rendered in the plan as `from → to`. */
+export interface StepChange {
+    from: string;
+    to: string;
+}
+export interface OperationStep {
+    /** Stable across runs — this is what an audit log and a resumed run key on. */
+    id: string;
+    /** One line, imperative: "Rename the Hetzner server". */
+    title: string;
+    /** What the step changes. Omitted for steps that only verify. */
+    change?: StepChange;
+    /**
+     * Irreversible. Marked in the plan and gated on typed confirmation, because
+     * "delete the drained source server" and "move an app" deserve different
+     * levels of ceremony even inside one operation.
+     */
+    destructive?: boolean;
+    /**
+     * Does reality ALREADY match this step's intent? This is what makes an
+     * operation resumable: a step that is satisfied is skipped, so a run that died
+     * halfway picks up where it stopped without the caller tracking progress.
+     *
+     * Must not mutate anything, and must tolerate a partially-applied world.
+     */
+    satisfied: () => Promise<boolean>;
+    /** Perform the change. Only called when `satisfied()` returned false. */
+    apply: () => Promise<void>;
+}
+export interface OperationPlan {
+    /** Stable operation name, e.g. `server:rename`. */
+    operation: string;
+    /** What is being operated on, and what a destructive step's confirmation must match. */
+    target: string;
+    steps: OperationStep[];
+}
+/** A step paired with what resolving it against the live world found. */
+export interface ResolvedStep {
+    step: OperationStep;
+    /** `satisfied` — nothing to do; `pending` — would run; `unknown` — could not tell. */
+    state: 'satisfied' | 'pending' | 'unknown';
+    /** Why the state is `unknown`. A step that cannot be checked is never skipped. */
+    reason?: string;
+}
+/**
+ * Ask every step whether it is already satisfied.
+ *
+ * A `satisfied()` that THROWS resolves to `unknown` rather than failing the
+ * plan: not being able to check is a reason to run the step and to say so, not a
+ * reason to refuse to show the operator a plan. Steps are resolved in order,
+ * because a later step's check may depend on an earlier one's subject existing.
+ */
+export declare function resolvePlan(plan: OperationPlan): Promise<ResolvedStep[]>;
+/** Steps that would actually run — pending, plus the ones that could not be checked. */
+export declare function pendingSteps(resolved: readonly ResolvedStep[]): ResolvedStep[];
+/** Do any steps that would run make an irreversible change? */
+export declare function planIsDestructive(resolved: readonly ResolvedStep[]): boolean;
+/**
+ * The plan as lines, ready to print.
+ *
+ * Lines rather than printed output so the caller owns the stream and this stays
+ * testable, and in declaration order so two runs of an unchanged plan produce an
+ * identical diff.
+ */
+export declare function formatPlan(plan: OperationPlan, resolved: readonly ResolvedStep[]): string[];
+export interface StepOutcome {
+    id: string;
+    title: string;
+    /** `applied` — it ran; `skipped` — already satisfied; `failed` — it threw. */
+    state: 'applied' | 'skipped' | 'failed';
+    error?: string;
+}
+export interface OperationOutcome {
+    operation: string;
+    target: string;
+    steps: StepOutcome[];
+    /** False when any step failed. The steps before it stay applied — see below. */
+    success: boolean;
+}
+export interface ApplyPlanOptions {
+    /** Progress, one line per step. */
+    log?: (message: string) => void;
+    /**
+     * Append to the operation log. Called as each step starts and finishes, so a
+     * run that dies mid-step still leaves the start recorded — which is exactly
+     * the case an operator is trying to reconstruct afterwards.
+     */
+    audit?: (event: {
+        operation: string;
+        target: string;
+        step: string;
+        state: 'started' | StepOutcome['state'];
+        error?: string;
+    }) => void;
+    /**
+     * Exact target name, required before any irreversible step runs. A plan with
+     * no destructive pending step ignores this.
+     */
+    confirm?: string;
+}
+/**
+ * Run the pending steps in order.
+ *
+ * Stops at the first failure and leaves the earlier steps applied, deliberately:
+ * a topology change half-applied and reported is recoverable — re-run it, the
+ * satisfied steps skip themselves — while one silently rolled back to a state
+ * nobody has verified is not.
+ */
+export declare function applyPlan(plan: OperationPlan, resolved: readonly ResolvedStep[], options?: ApplyPlanOptions): Promise<OperationOutcome>;

package/dist/operations/plan.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/operations/server-rename.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Rename a server in place.
+ *
+ * Renaming is purely an identity change, and today it implies destroy-and-
+ * recreate — which is not an acceptable cost for a naming-convention fix. It is
+ * the smallest of the consolidation operations and the one with no data to move:
+ * four records that all spell the same name, kept in step.
+ *
+ * The four, and why each matters:
+ *
+ * 1. **The provider record.** What the console shows and what a human greps for.
+ * 2. **The local driver state pin** (`storage/cloud/state/<stack>.json`). This
+ *    one is not cosmetic. `findComputeTargets` REJECTS a pinned server whose
+ *    live name no longer matches the recorded one — a deliberate guard against
+ *    a stale pin sending a database operation to another project's box — so a
+ *    provider-side rename that does not update the pin quietly invalidates it.
+ * 3. **The box's hostname.** What shells, logs, and the box's own reports say.
+ * 4. **The fleet inventory record.** What every `server:*` command addresses.
+ *
+ * Ordering is chosen for the failure in between: the provider is renamed BEFORE
+ * the pin is rewritten, so a crash between them leaves the pin stale (deploys
+ * fall back to label matching and keep working) rather than pointing at a name
+ * that does not exist yet. Every step re-derives its own state, so the fix for a
+ * half-finished rename is to run it again.
+ *
+ * Nothing here is destructive: a rename is undone by renaming back, and putting
+ * typed-confirmation ceremony on a reversible operation only teaches people to
+ * type confirmations without reading them.
+ *
+ * @see https://github.com/stacksjs/ts-cloud/issues/167
+ */
+import type { OperationPlan } from './plan';
+/**
+ * The side effects a rename needs, injected so the operation is testable without
+ * a provider, an SSH host, or a control-plane database — and so a second driver
+ * can supply its own without this module knowing about it.
+ *
+ * The optional members are genuinely optional: a server enrolled by hand has no
+ * provider record to rename, a project deploying purely from labels has no state
+ * pin, and a box whose host key is not pinned cannot be reached to set a
+ * hostname. Each missing capability drops its step from the plan rather than
+ * failing the operation, and the plan says which ones it left out.
+ */
+export interface ServerRenameEffects {
+    /** Every name already taken — provider project and inventory both. */
+    takenNames: () => Promise<string[]>;
+    /** Live provider-side name. */
+    providerName?: () => Promise<string | undefined>;
+    renameProvider?: (next: string) => Promise<void>;
+    /** Name recorded in the local driver state pin. */
+    stateName?: () => Promise<string | undefined>;
+    writeStateName?: (next: string) => Promise<void>;
+    /** Hostname reported by the box itself. */
+    remoteHostname?: () => Promise<string | undefined>;
+    setRemoteHostname?: (next: string) => Promise<void>;
+    /** Name on the fleet inventory record. */
+    inventoryName: () => string;
+    renameInventory: (next: string) => Promise<void> | void;
+}
+/**
+ * A server name has to be a valid hostname, because it becomes one: providers
+ * reject anything else, and the box's own `hostname` is set from it.
+ *
+ * RFC 1123 labels — letters, digits and hyphens, not starting or ending with a
+ * hyphen, at most 63 characters each — joined by dots. Checked up front so a
+ * rename fails before it has touched anything, rather than halfway through with
+ * the provider renamed and the box not.
+ */
+export declare function validateServerName(name: string): void;
+/**
+ * Build the plan that renames `current` to `next`.
+ *
+ * Async because the preconditions — a legal name, and one nobody else holds —
+ * are checked here rather than becoming steps. A precondition is not a unit of
+ * work; making it one would let a plan print as if it were runnable and then
+ * fail on its first step.
+ */
+export declare function planServerRename(current: string, next: string, effects: ServerRenameEffects): Promise<OperationPlan>;
+/**
+ * Shell that sets the box's hostname persistently and keeps `/etc/hosts` in
+ * step, so `sudo` and anything else resolving the local name does not stall on a
+ * hostname with no entry.
+ */
+export declare function buildSetHostnameScript(next: string): string;

package/dist/operations/server-rename.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/operations/site-move.d.ts

@@ -0,0 +1,263 @@
+/**
+ * Move a deployed site from one box to another.
+ *
+ * The second of the consolidation operations: three boxes with one app each
+ * should be able to become one box with three sites, and today that is an
+ * afternoon of SSH. What makes it an afternoon is not the individual steps but
+ * the fact that a half-finished one leaves nothing to tell you what already
+ * happened — so this is expressed as a plan on the same scaffolding as
+ * `server:rename` (see `./plan`), where every step re-derives its own state and
+ * a run that dies is resumed by running it again.
+ *
+ * It moves the site's on-box footprint WHOLESALE — the whole
+ * `/var/www/<slug>-<site>` tree (every release, `shared/`, and the `current`
+ * symlink) plus the systemd units that run it. Copying those units is not a
+ * parallel mechanism: they are literally the units the deploy wrote, moved. The
+ * alternative, rebuilding from the repo on the target, would not be a move — it
+ * would be a fresh deploy that happens to be preceded by a data copy, and it
+ * would silently pick up whatever the repo says today rather than what is
+ * actually running.
+ *
+ * **Nothing here is irreversible.** The source's tree is never deleted, only
+ * drained: its units are stopped and disabled and its gateway route removed, so
+ * a bad cutover is undone by starting them again and pointing DNS back. That is
+ * the reversibility the operation is required to have — it lasts until the
+ * source SERVER is deleted, which is a separate, deliberately separate,
+ * destructive operation (`server:destroy`).
+ *
+ * Ordering is chosen for what a failure in the middle leaves behind. The source
+ * keeps serving until the target has passed a health gate, DNS is cut over only
+ * after that, and the source is drained last — so every prefix of this plan is a
+ * working system, either on the old box or the new one.
+ *
+ * @see https://github.com/stacksjs/ts-cloud/issues/167
+ */
+import type { OperationPlan } from './plan';
+/** Where a snapshot archive is staged on both boxes. */
+export declare function siteMoveArchivePath(slug: string, siteName: string): string;
+/** Systemd unit-file glob covering a site's app, scheduler, queue and daemon units. */
+export declare function siteUnitGlob(slug: string, siteName: string): string;
+/**
+ * Stop the site's BACKGROUND units on the source — scheduler, queue workers,
+ * daemons — leaving the web service running.
+ *
+ * The snapshot has to be consistent, and background work is what writes to it: a
+ * queue worker committing to a SQLite database halfway through `tar` produces an
+ * archive with a torn page in it. The web service keeps serving because the
+ * source is still the live site at this point; read traffic during the copy is
+ * fine, and stopping it here would be an outage taken long before the target is
+ * ready to replace it.
+ */
+export declare function buildPauseWorkersScript(slug: string, siteName: string): string;
+/**
+ * Read-only companion to {@link buildPauseWorkersScript}. Separate because a
+ * plan's `satisfied()` must never mutate: if checking whether the workers are
+ * paused also paused them, a dry run would change the world.
+ */
+export declare function buildWorkersStateScript(slug: string, siteName: string): string;
+/** Are the site's background units all stopped on the source? */
+export declare function parseWorkersPaused(output: string): boolean;
+/**
+ * Archive the site's whole footprint on the source: its install tree and its
+ * unit files, in one tarball.
+ *
+ * `-h` is deliberately NOT passed: `current` and the shared-path symlinks must
+ * stay symlinks. Dereferencing them would flatten `current` into a second copy
+ * of the live release and turn every shared path into a per-release file again —
+ * which is the exact failure `sharedPaths` exists to prevent.
+ */
+export declare function buildSnapshotScript(slug: string, siteName: string, appBase: string): string;
+/**
+ * Unpack the archive on the target and bring the app up.
+ *
+ * The app unit is started but the gateway is not yet pointed at it: the site
+ * has to answer on loopback before anything is routed to it, and DNS is not
+ * touched until it has. Background units are enabled but NOT started — they stay
+ * paused until the source has been drained, so the two boxes can never both be
+ * running the same scheduler against the same data.
+ */
+export declare function buildRestoreScript(slug: string, siteName: string, appBase: string): string;
+/** Is the site's tree already on the target, with its app unit running? */
+export declare function buildTargetStateScript(slug: string, siteName: string, appBase: string): string;
+/** Does the target already hold the site's tree AND run its app unit? */
+export declare function parseTargetReady(output: string): boolean;
+/**
+ * Health gate on the target, before any traffic is sent to it.
+ *
+ * Polls loopback rather than the public name on purpose: the public name still
+ * points at the SOURCE at this point in the plan, so asking it would cheerfully
+ * report the old box as healthy and wave a broken target through.
+ */
+export declare function buildHealthGateScript(port: number, path?: string, attempts?: number): string;
+/**
+ * Drain the site on the source: stop and disable every unit, and drop its
+ * gateway fragment so the old box stops answering for it.
+ *
+ * The tree is left exactly where it is. That is what keeps the whole operation
+ * reversible: undoing a bad cutover is `systemctl start` plus pointing DNS back,
+ * with the data still sitting on the source. It stops being reversible when the
+ * source SERVER is deleted, which this operation deliberately does not do.
+ */
+export declare function buildDrainSourceScript(slug: string, siteName: string): string;
+/**
+ * Read-only companion to {@link buildDrainSourceScript} — see
+ * {@link buildWorkersStateScript} for why the two are not one script.
+ */
+export declare function buildSourceStateScript(slug: string, siteName: string): string;
+/** Is the site fully stopped on the source? */
+export declare function parseSourceDrained(output: string): boolean;
+/** Where a site's TLS material is staged while it crosses between boxes. */
+export declare function siteMoveCertArchivePath(slug: string, siteName: string): string;
+/**
+ * Report a checksum per hostname for the cert the box holds, or `absent`.
+ *
+ * A checksum rather than "does the file exist": the target may hold an OLDER
+ * certificate for the same hostname — an expired one from a previous tenancy,
+ * or a staging cert issued while the domain still pointed elsewhere — and
+ * treating that as "already carried" would hand the cutover a certificate
+ * browsers reject.
+ *
+ * Read-only, so a plan can use it without changing either box.
+ */
+export declare function buildCertificateStateScript(certsDir: string, domains: readonly string[]): string;
+/** `hostname → checksum | 'absent'` from {@link buildCertificateStateScript}. */
+export declare function parseCertificateState(output: string): Map<string, string>;
+/**
+ * Is the target's TLS material already what the source holds?
+ *
+ * Only hostnames the SOURCE has a certificate for are compared. A site running
+ * behind on-demand TLS may legitimately have none yet, and a move must not
+ * block on carrying something that does not exist.
+ */
+export declare function certificatesMatch(source: Map<string, string>, target: Map<string, string>): boolean;
+/** Pack a site's certificate and private key for each hostname it serves. */
+export declare function buildCertificatePackScript(certsDir: string, domains: readonly string[], archive: string): string;
+/**
+ * Unpack the certificates on the target.
+ *
+ * The private keys are re-chmodded to 0600 after extraction. `tar` restores the
+ * modes it recorded, so this is belt-and-braces — but a world-readable private
+ * key on a shared box is the kind of mistake that is silent until it is not.
+ */
+export declare function buildCertificateUnpackScript(certsDir: string, archive: string): string;
+/**
+ * The side effects a move needs, injected so the operation is testable without
+ * two live boxes, a provider, or a DNS account.
+ */
+export interface SiteMoveEffects {
+    /** Run a script on the source box; resolves with stdout, rejects on failure. */
+    runOnSource: (script: string) => Promise<string>;
+    /** Run a script on the target box. */
+    runOnTarget: (script: string) => Promise<string>;
+    /**
+     * Carry the staged archive from the source to the target. Separate from the
+     * two exec effects because how bytes get between two boxes is a deployment
+     * decision — through the operator, over a direct SSH hop, via object storage —
+     * and none of it belongs in this plan.
+     */
+    transferArchive: () => Promise<void>;
+    /** Is the archive already staged on the target? Lets the transfer resume. */
+    archiveStaged: () => Promise<boolean>;
+    /** Point the site's hostname at the target. Resolves with any provider warnings. */
+    cutoverDns: () => Promise<string[]>;
+    /** Address the site's hostname currently publishes, for the cutover check. */
+    publishedAddress: () => Promise<string | undefined>;
+    /** Refresh the target's gateway so it routes the site. */
+    refreshTargetGateway: () => Promise<void>;
+    /** Does the target's gateway already route this site? */
+    targetRoutesSite: () => Promise<boolean>;
+    /**
+     * How to carry an ON-BOX database, when the project has one.
+     *
+     * A SQLite database rides along in the tree already — it lives under
+     * `shared/`, which is the whole point of `sharedPaths`. An engine database
+     * does not: Postgres and MySQL keep their data in the engine's own directory,
+     * which belongs to the box rather than to the site. Moving the tree and not
+     * the database would cut DNS over to a target serving an empty app, so the
+     * plan REFUSES to be built when a project has one of these and no way to
+     * carry it — see {@link SiteMoveOptions.database}.
+     *
+     * Absent when the database is external (RDS, a managed host): the target
+     * connects to the same endpoint the source did, and there is nothing to move.
+     */
+    database?: SiteMoveDatabaseEffects;
+    /**
+     * How to carry the site's TLS material, when the project terminates TLS on the
+     * box itself.
+     *
+     * Certificates live in the gateway's cert directory, which belongs to the box
+     * rather than to the site — the same shape as an on-box database, and the same
+     * failure if it is left behind. With pinned production certificates the
+     * cutover lands on a box that has no certificate for the hostname and every
+     * browser refuses it. With on-demand TLS the target re-issues on first
+     * request, so it self-heals, but only after a visible gap during which the
+     * site is down.
+     *
+     * Absent when TLS is terminated somewhere else entirely — a CDN, a managed
+     * load balancer — where the box never holds the material to begin with.
+     */
+    certificates?: SiteMoveCertificateEffects;
+}
+/** Carrying a site's TLS material between boxes. */
+export interface SiteMoveCertificateEffects {
+    /**
+     * Does the target already hold exactly what the source holds?
+     *
+     * Compared by checksum rather than existence: an older certificate for the
+     * same hostname on the target is not the one being moved.
+     */
+    inPlace: () => Promise<boolean>;
+    /** Pack on the source, carry, unpack on the target. */
+    carry: () => Promise<void>;
+}
+/** Carrying an on-box engine database between boxes, in resumable pieces. */
+export interface SiteMoveDatabaseEffects {
+    /** Dump it on the source. */
+    dump: () => Promise<void>;
+    /** Carry the dump to the target. */
+    transferDump: () => Promise<void>;
+    /** Is the dump already staged on the target? Lets the transfer resume. */
+    dumpStaged: () => Promise<boolean>;
+    /** Create the role + database on the target, then load the dump into it. */
+    restore: () => Promise<void>;
+    /**
+     * Does the target ALREADY hold a database of this name with tables in it?
+     *
+     * Checked as a precondition, not as a step: loading a dump over someone
+     * else's data is the one genuinely destructive thing a move could do, and the
+     * answer decides whether the operation may run at all.
+     */
+    targetHasData: () => Promise<boolean>;
+}
+export interface SiteMoveOptions {
+    slug: string;
+    siteName: string;
+    /** Install base on both boxes — `siteInstallBase(slug, siteName)`. */
+    appBase: string;
+    /** Source and target box names, for the plan's own prose. */
+    from: string;
+    to: string;
+    /** Target's public address, which DNS is cut over to. */
+    targetAddress: string;
+    /** Loopback port the health gate polls. Omitted for a portless site. */
+    port?: number;
+    /** Health-check path, defaulting to `/`. */
+    healthCheckPath?: string;
+    /**
+     * The on-box engine database this site's project owns, when it has one —
+     * `resolveAppDatabase(config)` narrowed by `isLocalDatabase`. Naming it here
+     * is what makes the move refuse to run without a way to carry it, rather than
+     * moving the app and quietly leaving its data behind.
+     */
+    database?: {
+        name: string;
+    };
+}
+/**
+ * Build the plan that moves `siteName` from one box to another.
+ *
+ * Async because the preconditions — the site exists on the source, the target is
+ * not already serving a different tree there — are checked here rather than
+ * becoming steps. A precondition is not a unit of work.
+ */
+export declare function planSiteMove(options: SiteMoveOptions, effects: SiteMoveEffects): Promise<OperationPlan>;

package/dist/operations/site-move.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/protection/index.js

@@ -1 +1 @@
-import{$k as H,Sk as y,Tk as z,Uk as A,Vk as B,Wk as C,Xk as D,Yk as E,Zk as F,_k as G,al as I,bl as J,cl as K,dl as L,el as M}from"../chunk-gnv3r2jg.js";import{fl as s,gl as t,hl as u,il as v,jl as w,kl as x}from"../chunk-cwkg37rs.js";import{ll as k,ml as l,nl as m,ol as n,pl as o,ql as p,rl as q,sl as r}from"../chunk-b8e5wzwn.js";import{Bs as a,Cs as b,Ds as c,Es as d,Fs as e,Gs as f,Hs as g,Is as h,Js as i,Ks as j}from"../chunk-dskvqt67.js";import"../chunk-xt3s24vr.js";export{x as wafEventTelemetry,m as sysctlHardening,A as ruleMatches,w as renderWafInstallScript,v as renderWafConfig,n as renderSysctlFile,o as renderNftablesRuleset,p as renderDdosInstallScript,j as recursionBlockedResponse,B as rateLimitKey,D as rateLimitHeaders,i as propagationHeaders,q as planMitigation,f as parseChain,M as mergeControlsIntoConfig,l as isValidCidr,t as isSafePattern,g as inspectInvocation,u as globToRegex,z as globMatches,d as functionFingerprint,s as escapeSecLang,J as describePosture,E as defaultRateLimitRules,r as applyMitigationFactor,K as applyControlsToRateLimits,L as applyControlsToDdos,c as TRACE_HEADER,h as RecursionGuard,C as RateLimiter,y as RATE_LIMIT_KEY_SEPARATOR,I as ProtectionControlStore,F as PROTECTION_SETTING,G as MAX_CONTROL_HOURS,a as DEPTH_HEADER,e as DEFAULT_RECURSION_LIMITS,k as DEFAULT_DDOS_THRESHOLDS,H as DEFAULT_ATTACK_MODE_HOURS,b as CHAIN_HEADER};
+import{$k as D,Wk as y,Xk as z,Yk as A,Zk as B,_k as C,al as E,bl as F,cl as G,dl as H,el as I,fl as J,gl as K,hl as L,il as M}from"../chunk-y26yh5zp.js";import{jl as s,kl as t,ll as u,ml as v,nl as w,ol as x}from"../chunk-xtwjt370.js";import{pl as k,ql as l,rl as m,sl as n,tl as o,ul as p,vl as q,wl as r}from"../chunk-cd0zpxhf.js";import{Js as a,Ks as b,Ls as c,Ms as d,Ns as e,Os as f,Ps as g,Qs as h,Rs as i,Ss as j}from"../chunk-06jk7ba9.js";import"../chunk-77t2ctwn.js";export{b as CHAIN_HEADER,H as DEFAULT_ATTACK_MODE_HOURS,k as DEFAULT_DDOS_THRESHOLDS,e as DEFAULT_RECURSION_LIMITS,a as DEPTH_HEADER,G as MAX_CONTROL_HOURS,F as PROTECTION_SETTING,I as ProtectionControlStore,y as RATE_LIMIT_KEY_SEPARATOR,C as RateLimiter,h as RecursionGuard,c as TRACE_HEADER,L as applyControlsToDdos,K as applyControlsToRateLimits,r as applyMitigationFactor,E as defaultRateLimitRules,J as describePosture,s as escapeSecLang,d as functionFingerprint,z as globMatches,u as globToRegex,g as inspectInvocation,t as isSafePattern,l as isValidCidr,M as mergeControlsIntoConfig,f as parseChain,q as planMitigation,i as propagationHeaders,D as rateLimitHeaders,B as rateLimitKey,j as recursionBlockedResponse,p as renderDdosInstallScript,o as renderNftablesRuleset,n as renderSysctlFile,v as renderWafConfig,w as renderWafInstallScript,A as ruleMatches,m as sysctlHardening,x as wafEventTelemetry};

package/dist/push/index.js

@@ -1 +1 @@
-import"../chunk-xt3s24vr.js";import*as K from"node:http2";import{createSign as U}from"node:crypto";var q="api.push.apple.com",D="api.sandbox.push.apple.com",M=2700000;class E{config;token=null;tokenGeneratedAt=0;client=null;host;constructor(z){this.config=z,this.host=z.production?q:D}generateToken(){let z=Math.floor(Date.now()/1000);if(this.token&&Date.now()-this.tokenGeneratedAt<M)return this.token;let J={alg:"ES256",kid:this.config.keyId},Q={iss:this.config.teamId,iat:z},V=Buffer.from(JSON.stringify(J)).toString("base64url"),W=Buffer.from(JSON.stringify(Q)).toString("base64url"),Z=`${V}.${W}`,$=U("SHA256");$.update(Z);let B=$.sign(this.config.privateKey),x=this.derToRaw(B).toString("base64url");return this.token=`${Z}.${x}`,this.tokenGeneratedAt=Date.now(),this.token}derToRaw(z){let J=2;if(z[J]!==2)throw Error("Invalid DER signature: expected 0x02 for R");J++;let Q=z[J];J++;let V=z.subarray(J,J+Q);if(J+=Q,z[J]!==2)throw Error("Invalid DER signature: expected 0x02 for S");J++;let W=z[J];J++;let Z=z.subarray(J,J+W);if(V[0]===0&&V.length===33)V=V.subarray(1);if(Z[0]===0&&Z.length===33)Z=Z.subarray(1);let $=Buffer.alloc(64);return V.copy($,32-V.length),Z.copy($,64-Z.length),$}async getClient(){if(this.client&&!this.client.destroyed)return this.client;return new Promise((z,J)=>{this.client=K.connect(`https://${this.host}`),this.client.on("error",(Q)=>{J(Q)}),this.client.on("connect",()=>{z(this.client)}),this.client.on("close",()=>{this.client=null})})}buildPayload(z){let J={};if(z.title||z.body||z.subtitle){if(J.alert={},z.title)J.alert.title=z.title;if(z.subtitle)J.alert.subtitle=z.subtitle;if(z.body)J.alert.body=z.body}if(z.badge!==void 0)J.badge=z.badge;if(z.sound!==void 0)J.sound=z.sound;if(z.category)J.category=z.category;if(z.threadId)J["thread-id"]=z.threadId;if(z.contentAvailable)J["content-available"]=1;if(z.mutableContent)J["mutable-content"]=1;if(z.targetContentId)J["target-content-id"]=z.targetContentId;let Q={aps:J};if(z.data)Object.assign(Q,z.data);return Q}async send(z){try{let J=await this.getClient(),Q=this.generateToken(),V=JSON.stringify(this.buildPayload(z)),W={":method":"POST",":path":`/3/device/${z.deviceToken}`,authorization:`bearer ${Q}`,"apns-topic":this.config.bundleId,"apns-push-type":z.pushType||"alert","apns-priority":String(z.priority||10)};if(z.expiration!==void 0)W["apns-expiration"]=String(z.expiration);if(z.collapseId)W["apns-collapse-id"]=z.collapseId;return new Promise((Z)=>{let $=J.request(W),B="",j=0,x;$.on("response",(Y)=>{j=Y[":status"],x=Y["apns-id"]}),$.on("data",(Y)=>{B+=Y.toString()}),$.on("end",()=>{if(j===200)Z({success:!0,deviceToken:z.deviceToken,apnsId:x,statusCode:j});else{let Y="Unknown error",X,w;if(B)try{let G=JSON.parse(B);X=G.reason,w=G.timestamp,Y=X||Y}catch{Y=B}Z({success:!1,deviceToken:z.deviceToken,apnsId:x,statusCode:j,error:Y,reason:X,timestamp:w})}}),$.on("error",(Y)=>{Z({success:!1,deviceToken:z.deviceToken,error:Y.message})}),$.write(V),$.end()})}catch(J){return{success:!1,deviceToken:z.deviceToken,error:J.message}}}async sendBatch(z,J){let Q=J?.concurrency||10,V=[];for(let W=0;W<z.length;W+=Q){let Z=z.slice(W,W+Q),$=await Promise.all(Z.map((B)=>this.send(B)));V.push(...$)}return{sent:V.filter((W)=>W.success).length,failed:V.filter((W)=>!W.success).length,results:V}}async sendSimple(z,J,Q,V){return this.send({deviceToken:z,title:J,body:Q,data:V})}async sendSilent(z,J){return this.send({deviceToken:z,contentAvailable:!0,pushType:"background",priority:5,data:J})}close(){if(this.client)this.client.close(),this.client=null;this.token=null,this.tokenGeneratedAt=0}}import{createSign as L}from"node:crypto";var R="https://fcm.googleapis.com/v1/projects",F="https://oauth2.googleapis.com/token",b=3300000;class H{config;accessToken=null;tokenExpiresAt=0;constructor(z){this.config=z}static fromServiceAccount(z){return new H({projectId:z.project_id,clientEmail:z.client_email,privateKey:z.private_key})}generateJWT(){let z=Math.floor(Date.now()/1000),J=z+3600,Q={alg:"RS256",typ:"JWT"},V={iss:this.config.clientEmail,sub:this.config.clientEmail,aud:F,iat:z,exp:J,scope:"https://www.googleapis.com/auth/firebase.messaging"},W=Buffer.from(JSON.stringify(Q)).toString("base64url"),Z=Buffer.from(JSON.stringify(V)).toString("base64url"),$=`${W}.${Z}`,B=L("SHA256");B.update($);let j=B.sign(this.config.privateKey,"base64url");return`${$}.${j}`}async getAccessToken(){if(this.accessToken&&Date.now()<this.tokenExpiresAt)return this.accessToken;let z=this.generateJWT(),J=await fetch(F,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:z}).toString()});if(!J.ok){let V=await J.text();throw Error(`Failed to get access token: ${V}`)}let Q=await J.json();return this.accessToken=Q.access_token,this.tokenExpiresAt=Date.now()+b,this.accessToken}buildMessage(z){let J={};if(z.token)J.token=z.token;else if(z.topic)J.topic=z.topic;else if(z.condition)J.condition=z.condition;if(z.title||z.body||z.imageUrl){if(J.notification={},z.title)J.notification.title=z.title;if(z.body)J.notification.body=z.body;if(z.imageUrl)J.notification.image=z.imageUrl}if(z.data&&Object.keys(z.data).length>0)J.data=z.data;if(z.android){if(J.android={priority:z.android.priority||"high"},z.android.ttl)J.android.ttl=`${z.android.ttl}s`;if(z.android.collapseKey)J.android.collapse_key=z.android.collapseKey;if(z.android.directBootOk)J.android.direct_boot_ok=z.android.directBootOk;let Q={};if(z.android.channelId)Q.channel_id=z.android.channelId;if(z.android.icon)Q.icon=z.android.icon;if(z.android.color)Q.color=z.android.color;if(z.android.sound)Q.sound=z.android.sound;if(z.android.clickAction)Q.click_action=z.android.clickAction;if(z.android.tag)Q.tag=z.android.tag;if(z.android.visibility)Q.visibility=z.android.visibility;if(z.android.notificationCount!==void 0)Q.notification_count=z.android.notificationCount;if(Object.keys(Q).length>0)J.android.notification=Q}if(z.webpush)J.webpush=z.webpush;if(z.apns)J.apns=z.apns;if(z.fcmOptions)J.fcm_options=z.fcmOptions;return{message:J}}async send(z){try{let J=await this.getAccessToken(),Q=this.buildMessage(z),V=await fetch(`${R}/${this.config.projectId}/messages:send`,{method:"POST",headers:{Authorization:`Bearer ${J}`,"Content-Type":"application/json"},body:JSON.stringify(Q)}),W=await V.json();if(V.ok)return{success:!0,messageId:W.name};else return{success:!1,error:W.error?.message||"Unknown error",errorCode:W.error?.status}}catch(J){return{success:!1,error:J.message}}}async sendBatch(z,J,Q){let V=Q?.concurrency||10,W=[];for(let Z=0;Z<z.length;Z+=V){let B=z.slice(Z,Z+V).map(async(x)=>{return{...await this.send({...J,token:x}),token:x}}),j=await Promise.all(B);W.push(...j)}return{sent:W.filter((Z)=>Z.success).length,failed:W.filter((Z)=>!Z.success).length,results:W}}async sendToTopic(z,J){return this.send({...J,topic:z})}async sendToCondition(z,J){return this.send({...J,condition:z})}async sendSimple(z,J,Q,V){return this.send({token:z,title:J,body:Q,data:V})}async sendSilent(z,J){return this.send({token:z,data:J,android:{priority:"high"}})}async subscribeToTopic(z,J){try{let Q=await this.getAccessToken(),V=await fetch("https://iid.googleapis.com/iid/v1:batchAdd",{method:"POST",headers:{Authorization:`Bearer ${Q}`,"Content-Type":"application/json"},body:JSON.stringify({to:`/topics/${J}`,registration_tokens:z})});if(V.ok)return{success:!0};else return{success:!1,error:(await V.json()).error?.message||"Failed to subscribe"}}catch(Q){return{success:!1,error:Q.message}}}async unsubscribeFromTopic(z,J){try{let Q=await this.getAccessToken(),V=await fetch("https://iid.googleapis.com/iid/v1:batchRemove",{method:"POST",headers:{Authorization:`Bearer ${Q}`,"Content-Type":"application/json"},body:JSON.stringify({to:`/topics/${J}`,registration_tokens:z})});if(V.ok)return{success:!0};else return{success:!1,error:(await V.json()).error?.message||"Failed to unsubscribe"}}catch(Q){return{success:!1,error:Q.message}}}}export{H as FCMClient,E as APNsClient};
+import"../chunk-77t2ctwn.js";import*as h from"node:http2";import{createSign as b}from"node:crypto";var f="api.push.apple.com",k="api.sandbox.push.apple.com",S=2700000;class R{config;token=null;tokenGeneratedAt=0;client=null;host;constructor(e){this.config=e,this.host=e.production?f:k}generateToken(){let e=Math.floor(Date.now()/1000);if(this.token&&Date.now()-this.tokenGeneratedAt<S)return this.token;let t={alg:"ES256",kid:this.config.keyId},s={iss:this.config.teamId,iat:e},r=Buffer.from(JSON.stringify(t)).toString("base64url"),n=Buffer.from(JSON.stringify(s)).toString("base64url"),i=`${r}.${n}`,o=b("SHA256");o.update(i);let a=o.sign(this.config.privateKey),l=this.derToRaw(a).toString("base64url");return this.token=`${i}.${l}`,this.tokenGeneratedAt=Date.now(),this.token}derToRaw(e){let t=2;if(e[t]!==2)throw Error("Invalid DER signature: expected 0x02 for R");t++;let s=e[t];t++;let r=e.subarray(t,t+s);if(t+=s,e[t]!==2)throw Error("Invalid DER signature: expected 0x02 for S");t++;let n=e[t];t++;let i=e.subarray(t,t+n);if(r[0]===0&&r.length===33)r=r.subarray(1);if(i[0]===0&&i.length===33)i=i.subarray(1);let o=Buffer.alloc(64);return r.copy(o,32-r.length),i.copy(o,64-i.length),o}async getClient(){if(this.client&&!this.client.destroyed)return this.client;return new Promise((e,t)=>{this.client=h.connect(`https://${this.host}`),this.client.on("error",(s)=>{t(s)}),this.client.on("connect",()=>{e(this.client)}),this.client.on("close",()=>{this.client=null})})}buildPayload(e){let t={};if(e.title||e.body||e.subtitle){if(t.alert={},e.title)t.alert.title=e.title;if(e.subtitle)t.alert.subtitle=e.subtitle;if(e.body)t.alert.body=e.body}if(e.badge!==void 0)t.badge=e.badge;if(e.sound!==void 0)t.sound=e.sound;if(e.category)t.category=e.category;if(e.threadId)t["thread-id"]=e.threadId;if(e.contentAvailable)t["content-available"]=1;if(e.mutableContent)t["mutable-content"]=1;if(e.targetContentId)t["target-content-id"]=e.targetContentId;let s={aps:t};if(e.data)Object.assign(s,e.data);return s}async send(e){try{let t=await this.getClient(),s=this.generateToken(),r=JSON.stringify(this.buildPayload(e)),n={":method":"POST",":path":`/3/device/${e.deviceToken}`,authorization:`bearer ${s}`,"apns-topic":this.config.bundleId,"apns-push-type":e.pushType||"alert","apns-priority":String(e.priority||10)};if(e.expiration!==void 0)n["apns-expiration"]=String(e.expiration);if(e.collapseId)n["apns-collapse-id"]=e.collapseId;return new Promise((i)=>{let o=t.request(n),a="",d=0,l;o.on("response",(c)=>{d=c[":status"],l=c["apns-id"]}),o.on("data",(c)=>{a+=c.toString()}),o.on("end",()=>{if(d===200)i({success:!0,deviceToken:e.deviceToken,apnsId:l,statusCode:d});else{let c="Unknown error",g,u;if(a)try{let p=JSON.parse(a);g=p.reason,u=p.timestamp,c=g||c}catch{c=a}i({success:!1,deviceToken:e.deviceToken,apnsId:l,statusCode:d,error:c,reason:g,timestamp:u})}}),o.on("error",(c)=>{i({success:!1,deviceToken:e.deviceToken,error:c.message})}),o.write(r),o.end()})}catch(t){return{success:!1,deviceToken:e.deviceToken,error:t.message}}}async sendBatch(e,t){let s=t?.concurrency||10,r=[];for(let n=0;n<e.length;n+=s){let i=e.slice(n,n+s),o=await Promise.all(i.map((a)=>this.send(a)));r.push(...o)}return{sent:r.filter((n)=>n.success).length,failed:r.filter((n)=>!n.success).length,results:r}}async sendSimple(e,t,s,r){return this.send({deviceToken:e,title:t,body:s,data:r})}async sendSilent(e,t){return this.send({deviceToken:e,contentAvailable:!0,pushType:"background",priority:5,data:t})}close(){if(this.client)this.client.close(),this.client=null;this.token=null,this.tokenGeneratedAt=0}}import{createSign as T}from"node:crypto";var C="https://fcm.googleapis.com/v1/projects",y="https://oauth2.googleapis.com/token",P=3300000;class m{config;accessToken=null;tokenExpiresAt=0;constructor(e){this.config=e}static fromServiceAccount(e){return new m({projectId:e.project_id,clientEmail:e.client_email,privateKey:e.private_key})}generateJWT(){let e=Math.floor(Date.now()/1000),t=e+3600,s={alg:"RS256",typ:"JWT"},r={iss:this.config.clientEmail,sub:this.config.clientEmail,aud:y,iat:e,exp:t,scope:"https://www.googleapis.com/auth/firebase.messaging"},n=Buffer.from(JSON.stringify(s)).toString("base64url"),i=Buffer.from(JSON.stringify(r)).toString("base64url"),o=`${n}.${i}`,a=T("SHA256");a.update(o);let d=a.sign(this.config.privateKey,"base64url");return`${o}.${d}`}async getAccessToken(){if(this.accessToken&&Date.now()<this.tokenExpiresAt)return this.accessToken;let e=this.generateJWT(),t=await fetch(y,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:e}).toString()});if(!t.ok){let r=await t.text();throw Error(`Failed to get access token: ${r}`)}let s=await t.json();return this.accessToken=s.access_token,this.tokenExpiresAt=Date.now()+P,this.accessToken}buildMessage(e){let t={};if(e.token)t.token=e.token;else if(e.topic)t.topic=e.topic;else if(e.condition)t.condition=e.condition;if(e.title||e.body||e.imageUrl){if(t.notification={},e.title)t.notification.title=e.title;if(e.body)t.notification.body=e.body;if(e.imageUrl)t.notification.image=e.imageUrl}if(e.data&&Object.keys(e.data).length>0)t.data=e.data;if(e.android){if(t.android={priority:e.android.priority||"high"},e.android.ttl)t.android.ttl=`${e.android.ttl}s`;if(e.android.collapseKey)t.android.collapse_key=e.android.collapseKey;if(e.android.directBootOk)t.android.direct_boot_ok=e.android.directBootOk;let s={};if(e.android.channelId)s.channel_id=e.android.channelId;if(e.android.icon)s.icon=e.android.icon;if(e.android.color)s.color=e.android.color;if(e.android.sound)s.sound=e.android.sound;if(e.android.clickAction)s.click_action=e.android.clickAction;if(e.android.tag)s.tag=e.android.tag;if(e.android.visibility)s.visibility=e.android.visibility;if(e.android.notificationCount!==void 0)s.notification_count=e.android.notificationCount;if(Object.keys(s).length>0)t.android.notification=s}if(e.webpush)t.webpush=e.webpush;if(e.apns)t.apns=e.apns;if(e.fcmOptions)t.fcm_options=e.fcmOptions;return{message:t}}async send(e){try{let t=await this.getAccessToken(),s=this.buildMessage(e),r=await fetch(`${C}/${this.config.projectId}/messages:send`,{method:"POST",headers:{Authorization:`Bearer ${t}`,"Content-Type":"application/json"},body:JSON.stringify(s)}),n=await r.json();if(r.ok)return{success:!0,messageId:n.name};else return{success:!1,error:n.error?.message||"Unknown error",errorCode:n.error?.status}}catch(t){return{success:!1,error:t.message}}}async sendBatch(e,t,s){let r=s?.concurrency||10,n=[];for(let i=0;i<e.length;i+=r){let a=e.slice(i,i+r).map(async(l)=>({...await this.send({...t,token:l}),token:l})),d=await Promise.all(a);n.push(...d)}return{sent:n.filter((i)=>i.success).length,failed:n.filter((i)=>!i.success).length,results:n}}async sendToTopic(e,t){return this.send({...t,topic:e})}async sendToCondition(e,t){return this.send({...t,condition:e})}async sendSimple(e,t,s,r){return this.send({token:e,title:t,body:s,data:r})}async sendSilent(e,t){return this.send({token:e,data:t,android:{priority:"high"}})}async subscribeToTopic(e,t){try{let s=await this.getAccessToken(),r=await fetch("https://iid.googleapis.com/iid/v1:batchAdd",{method:"POST",headers:{Authorization:`Bearer ${s}`,"Content-Type":"application/json"},body:JSON.stringify({to:`/topics/${t}`,registration_tokens:e})});if(r.ok)return{success:!0};else return{success:!1,error:(await r.json()).error?.message||"Failed to subscribe"}}catch(s){return{success:!1,error:s.message}}}async unsubscribeFromTopic(e,t){try{let s=await this.getAccessToken(),r=await fetch("https://iid.googleapis.com/iid/v1:batchRemove",{method:"POST",headers:{Authorization:`Bearer ${s}`,"Content-Type":"application/json"},body:JSON.stringify({to:`/topics/${t}`,registration_tokens:e})});if(r.ok)return{success:!0};else return{success:!1,error:(await r.json()).error?.message||"Failed to unsubscribe"}}catch(s){return{success:!1,error:s.message}}}}export{R as APNsClient,m as FCMClient};

package/dist/spend/index.js

@@ -1 +1 @@
-import{$i as g,$j as ga,Aj as H,Bj as I,Bk as pa,Cj as J,Ck as qa,Dj as K,Dk as ra,Ej as L,Ek as sa,Fj as M,Fk as ta,Gj as N,Gk as ua,Hj as O,Hk as va,Ij as P,Ik as wa,Jj as Q,Jk as xa,Kj as R,Kk as ya,Lj as S,Lk as za,Mj as T,Mk as Aa,Nj as U,Oj as V,Pj as W,Qj as X,Qk as Ba,Rj as Y,Rk as Ca,Sj as Z,Tj as _,Uj as $,Vi as a,Vj as aa,Wi as b,Wj as ba,Xi as c,Xj as ca,Yi as d,Yj as da,Zi as e,Zj as ea,_i as f,_j as fa,aj as h,ak as ha,bj as i,bk as ia,cj as j,ck as ja,dj as k,dk as ka,ej as l,ek as la,fj as m,fk as ma,gj as n,gk as na,hj as o,hk as oa,ij as p,jj as q,kj as r,lj as s,mj as t,nj as u,oj as v,pj as w,qj as x,rj as y,sj as z,tj as A,uj as B,vj as C,wj as D,xj as E,yj as F,zj as G}from"../chunk-gahsdmxf.js";import"../chunk-b8e5wzwn.js";import"../chunk-dskvqt67.js";import"../chunk-xt3s24vr.js";export{n as zonedParts,o as zoneOffsetMs,ia as zeroFill,p as utcInstantOfLocal,w as usageDeltaKey,ea as toFocusRecords,fa as toFocusJsonl,f as tieredMicroCents,O as strongestActiveAction,ga as streamFocusJsonl,xa as startSpendLoop,Ca as spendOpenApiPaths,ra as spendNotificationText,$ as signalDefinition,A as scopeKey,N as runEnforcement,Y as routeMatches,j as roundCents,S as robustZScore,D as projectSpend,i as priceUsageLines,h as priceUsage,r as previousBudgetWindow,M as planEnforcement,E as percentOfLimit,ba as optionsForSignal,y as meterTelemetry,k as mergePriceBooks,J as mergeDecisions,R as medianAbsoluteDeviation,Q as median,ca as lookbackHoursForSignal,m as isValidTimeZone,P as isOperationAllowed,t as hourBucketsBetween,s as hourBucket,Ba as handleSpendRequest,H as governingLimitCents,F as formatTimeToExhaustion,qa as formatCents,g as findPriceEntry,v as findMapping,T as ewma,I as evaluateBudget,V as detectLatestAnomaly,U as detectAnomalies,na as createEnforcementHandlers,Aa as compositeSpendTransport,q as budgetWindow,ma as assertSpendAllows,W as anomalyOptionsForSignal,z as aggregateDeltas,L as USER_VISIBLE_ACTIONS,pa as URGENT_SPEND_EVENTS,C as SpendStore,ha as SpendService,va as SpendRunner,sa as SpendNotificationRouter,ua as SpendLoopLease,ka as SpendGate,la as SpendCapError,aa as SignalSource,ta as SPEND_LEASE_SETTING,ja as SPEND_GATE_SETTING,wa as SPEND_CYCLE_SECONDS,X as SENSITIVITY_THRESHOLDS,oa as RecordingSpendTransport,G as MIN_PROJECTION_CONFIDENCE,e as MICRO_CENTS,a as METER_KEYS,b as METERS,da as FOCUS_VERSION,d as ENFORCEMENT_SEVERITY,K as ENFORCEMENT_DESCRIPTIONS,c as ENFORCEMENT_ACTIONS,_ as DETECTABLE_SIGNALS,B as DEFAULT_THRESHOLDS,l as DEFAULT_PRICE_BOOK,u as DEFAULT_METER_MAPPINGS,x as CounterTracker,za as ComputeSpendTransport,ya as AwsSpendTransport,Z as AnomalyConfigStore};
+import{$i as c,$j as da,Aj as D,Bj as E,Cj as F,Dj as G,Ej as H,Fj as I,Fk as qa,Gj as J,Gk as ra,Hj as K,Hk as sa,Ij as L,Ik as ta,Jj as M,Jk as ua,Kj as N,Kk as va,Lj as O,Lk as wa,Mj as P,Mk as xa,Nj as Q,Nk as ya,Oj as R,Ok as za,Pj as S,Pk as Aa,Qj as T,Qk as Ba,Rj as U,Sj as V,Tj as W,Uj as X,Uk as Ca,Vj as Y,Vk as Da,Wj as Z,Xj as _,Yj as aa,Zi as a,Zj as ba,_i as b,_j as ca,aj as d,ak as ea,bj as e,bk as fa,cj as f,ck as ga,dj as g,dk as ha,ej as h,ek as ia,fj as i,fk as ja,gj as j,gk as ka,hj as k,hk as la,ij as l,ik as ma,jj as m,jk as na,kj as n,kk as oa,lj as o,lk as pa,mj as p,nj as q,oj as r,pj as s,qj as t,rj as u,sj as v,tj as w,uj as x,vj as y,wj as z,xj as A,yj as B,zj as C}from"../chunk-kv2ztkp4.js";import"../chunk-cd0zpxhf.js";import"../chunk-06jk7ba9.js";import"../chunk-77t2ctwn.js";export{Z as AnomalyConfigStore,za as AwsSpendTransport,Aa as ComputeSpendTransport,x as CounterTracker,u as DEFAULT_METER_MAPPINGS,l as DEFAULT_PRICE_BOOK,B as DEFAULT_THRESHOLDS,_ as DETECTABLE_SIGNALS,c as ENFORCEMENT_ACTIONS,K as ENFORCEMENT_DESCRIPTIONS,d as ENFORCEMENT_SEVERITY,ea as FOCUS_VERSION,b as METERS,a as METER_KEYS,e as MICRO_CENTS,G as MIN_PROJECTION_CONFIDENCE,pa as RecordingSpendTransport,X as SENSITIVITY_THRESHOLDS,xa as SPEND_CYCLE_SECONDS,ka as SPEND_GATE_SETTING,ua as SPEND_LEASE_SETTING,ba as SignalSource,ma as SpendCapError,la as SpendGate,va as SpendLoopLease,ta as SpendNotificationRouter,wa as SpendRunner,ia as SpendService,C as SpendStore,qa as URGENT_SPEND_EVENTS,L as USER_VISIBLE_ACTIONS,z as aggregateDeltas,W as anomalyOptionsForSignal,na as assertSpendAllows,q as budgetWindow,Ba as compositeSpendTransport,oa as createEnforcementHandlers,U as detectAnomalies,V as detectLatestAnomaly,I as evaluateBudget,T as ewma,v as findMapping,g as findPriceEntry,ra as formatCents,F as formatTimeToExhaustion,H as governingLimitCents,Ca as handleSpendRequest,s as hourBucket,t as hourBucketsBetween,P as isOperationAllowed,m as isValidTimeZone,da as lookbackHoursForSignal,Q as median,R as medianAbsoluteDeviation,J as mergeDecisions,k as mergePriceBooks,y as meterTelemetry,ca as optionsForSignal,E as percentOfLimit,M as planEnforcement,r as previousBudgetWindow,h as priceUsage,i as priceUsageLines,D as projectSpend,S as robustZScore,j as roundCents,Y as routeMatches,N as runEnforcement,A as scopeKey,aa as signalDefinition,sa as spendNotificationText,Da as spendOpenApiPaths,ya as startSpendLoop,ha as streamFocusJsonl,O as strongestActiveAction,f as tieredMicroCents,ga as toFocusJsonl,fa as toFocusRecords,w as usageDeltaKey,p as utcInstantOfLocal,ja as zeroFill,o as zoneOffsetMs,n as zonedParts};

package/dist/ui/404.html

@@ -2,7 +2,7 @@
 <html lang="en" data-theme="dark">
 <head>
   <meta charset="UTF-8">
-  <meta name="stx-build" content="mszji87v4fjr13">
+  <meta name="stx-build" content="mt3hxejaann6gz">
 
 <!-- stx SEO Tags -->
 <meta name="title" content="Page not found · ts-cloud">

package/dist/ui/accept-invitation.html

@@ -1,4 +1,4 @@
-<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mszjhoqdmbbes1"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - Accept invitation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.616c25f3.css"></head><body class="auth-page"><main class="auth-card" id="main-content"><a class="brand" href="/"><span class="dot"></span><span>ts-cloud</span></a><div><span class="context-label">Organization invitation</span><h1>Join your team</h1><p>Choose the dashboard username and password you will use after this invitation is accepted.</p></div><form id="accept-invitation-form" class="auth-form"><div class="field-block"><label for="invite-name">Name</label><input id="invite-name" name="name" autocomplete="name" placeholder="Chris Breuer"></div><div class="field-block"><label for="invite-username">Username</label><input id="invite-username" name="username" autocomplete="username" minlength="2" maxlength="32" required></div><div class="field-block"><label for="invite-password">Password</label><input id="invite-password" name="password" type="password" autocomplete="new-password" minlength="12" required><small>At least 12 characters.</small></div><button class="btn" type="submit">Accept invitation</button><div id="invitation-status" class="auth-status" role="status"></div></form><p class="note">If this link expired or was already used, ask an organization owner to resend the invitation.</p></main> <script data-stx-scoped data-stx-run="always">
+<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mt3hwv4ydcyeyt"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - Accept invitation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.616c25f3.css"></head><body class="auth-page"><main class="auth-card" id="main-content"><a class="brand" href="/"><span class="dot"></span><span>ts-cloud</span></a><div><span class="context-label">Organization invitation</span><h1>Join your team</h1><p>Choose the dashboard username and password you will use after this invitation is accepted.</p></div><form id="accept-invitation-form" class="auth-form"><div class="field-block"><label for="invite-name">Name</label><input id="invite-name" name="name" autocomplete="name" placeholder="Chris Breuer"></div><div class="field-block"><label for="invite-username">Username</label><input id="invite-username" name="username" autocomplete="username" minlength="2" maxlength="32" required></div><div class="field-block"><label for="invite-password">Password</label><input id="invite-password" name="password" type="password" autocomplete="new-password" minlength="12" required><small>At least 12 characters.</small></div><button class="btn" type="submit">Accept invitation</button><div id="invitation-status" class="auth-status" role="status"></div></form><p class="note">If this link expired or was already used, ask an organization owner to resend the invitation.</p></main> <script data-stx-scoped data-stx-run="always">
 ;(function() {
   'use strict';
 (() => {