@ts-cloud/core 0.5.16 → 0.5.18

package/dist/aws/s3.d.ts

@@ -235,7 +235,7 @@ export declare class S3Client {
     /**
      * Abort a multipart upload
      */
-    abortMultipartUpload(bucket: string, key: string, uploadId: string): Promise<void>;
+    abortMultipartUpload(bucket: string, key: string, uploadId: string, baseUrl?: string): Promise<void>;
     /**
      * Empty all objects in a bucket and then delete the bucket
      */

package/dist/index.js

@@ -23532,18 +23532,19 @@ class S3Client {
       stream = blob.stream();
       totalSize = blob.size;
     }
-    const uploadId = await this.initiateMultipartUpload(bucket, key, options);
+    const { uploadId, baseUrl } = await this.initiateMultipartUpload(bucket, key, options);
     try {
-      const parts = await this.uploadParts(bucket, key, uploadId, stream, partSize, credentials, totalSize, options.concurrency || 4, options.onProgress);
-      return await this.completeMultipartUpload(bucket, key, uploadId, parts);
+      const parts = await this.uploadParts(bucket, key, baseUrl, uploadId, stream, partSize, credentials, totalSize, options.concurrency || 4, options.onProgress);
+      return await this.completeMultipartUpload(bucket, key, baseUrl, uploadId, parts);
     } catch (error) {
-      await this.abortMultipartUpload(bucket, key, uploadId).catch(() => {});
+      await this.abortMultipartUpload(bucket, key, uploadId, baseUrl).catch(() => {});
       throw error;
     }
   }
   async initiateMultipartUpload(bucket, key, options) {
     const credentials = await this.getCredentials();
-    const url = `${this.buildUrl(bucket, key)}?uploads`;
+    const baseUrl = this.buildUrl(bucket, key);
+    const url = `${baseUrl}?uploads`;
     const headers = {
       "Content-Type": options.contentType || detectContentType(key)
     };
@@ -23579,18 +23580,26 @@ class S3Client {
     if (!uploadIdMatch) {
       throw new S3Error("Failed to parse upload ID from response", 0, bucket, key);
     }
-    return uploadIdMatch[1];
+    let resolvedBaseUrl = baseUrl;
+    if (response.url) {
+      try {
+        const resolved = new URL(response.url);
+        resolved.search = "";
+        resolvedBaseUrl = resolved.toString();
+      } catch {}
+    }
+    return { uploadId: uploadIdMatch[1], baseUrl: resolvedBaseUrl };
   }
-  async uploadParts(bucket, key, uploadId, stream, partSize, credentials, totalSize, concurrency, onProgress) {
+  async uploadParts(bucket, key, baseUrl, uploadId, stream, partSize, credentials, totalSize, concurrency, onProgress) {
     const parts = [];
     const reader = stream.getReader();
     let partNumber = 1;
     let buffer = new Uint8Array(0);
     let loaded = 0;
     const totalParts = totalSize ? Math.ceil(totalSize / partSize) : undefined;
-    const uploadQueue = [];
+    const inFlight = new Map;
     const uploadPart = async (data, num) => {
-      const url = `${this.buildUrl(bucket, key)}?partNumber=${num}&uploadId=${encodeURIComponent(uploadId)}`;
+      const url = `${baseUrl}?partNumber=${num}&uploadId=${encodeURIComponent(uploadId)}`;
       const headers = {
         "Content-Length": String(data.byteLength),
         "x-amz-content-sha256": "UNSIGNED-PAYLOAD"
@@ -23606,15 +23615,24 @@ class S3Client {
       const response = await fetch(signed.url, {
         method: signed.method,
         headers: signed.headers,
-        body: data
+        body: data,
+        redirect: "error"
       });
       if (!response.ok) {
         const error = await response.text();
         throw new S3Error(`Failed to upload part ${num}: ${error}`, response.status, bucket, key);
       }
       const etag = (response.headers.get("ETag") || "").replace(/"/g, "");
+      if (!etag) {
+        throw new S3Error(`Missing ETag for part ${num}`, response.status, bucket, key);
+      }
       return { partNumber: num, etag };
     };
+    const drainOne = async () => {
+      const completed = await Promise.race(inFlight.values());
+      inFlight.delete(completed.partNumber);
+      parts.push(completed);
+    };
     while (true) {
       const { done, value } = await reader.read();
       if (value) {
@@ -23627,13 +23645,10 @@ class S3Client {
         const partData = buffer.slice(0, partSize);
         buffer = buffer.slice(partSize);
         const currentPartNumber = partNumber++;
-        if (uploadQueue.length >= concurrency) {
-          const completed = await Promise.race(uploadQueue);
-          parts.push(completed);
-          uploadQueue.splice(uploadQueue.indexOf(Promise.resolve(completed)), 1);
+        if (inFlight.size >= concurrency) {
+          await drainOne();
         }
-        const uploadPromise = uploadPart(partData, currentPartNumber);
-        uploadQueue.push(uploadPromise);
+        inFlight.set(currentPartNumber, uploadPart(partData, currentPartNumber));
         loaded += partData.byteLength;
         if (onProgress) {
           onProgress({
@@ -23647,14 +23662,15 @@ class S3Client {
       if (done)
         break;
     }
-    const remaining = await Promise.all(uploadQueue);
-    parts.push(...remaining);
+    while (inFlight.size > 0) {
+      await drainOne();
+    }
     parts.sort((a, b) => a.partNumber - b.partNumber);
     return parts;
   }
-  async completeMultipartUpload(bucket, key, uploadId, parts) {
+  async completeMultipartUpload(bucket, key, baseUrl, uploadId, parts) {
     const credentials = await this.getCredentials();
-    const url = `${this.buildUrl(bucket, key)}?uploadId=${encodeURIComponent(uploadId)}`;
+    const url = `${baseUrl}?uploadId=${encodeURIComponent(uploadId)}`;
     const partsXml = parts.map((p) => `<Part><PartNumber>${p.partNumber}</PartNumber><ETag>"${p.etag}"</ETag></Part>`).join("");
     const body = `<?xml version="1.0" encoding="UTF-8"?><CompleteMultipartUpload>${partsXml}</CompleteMultipartUpload>`;
     const signed = signRequest({
@@ -23680,9 +23696,9 @@ class S3Client {
     const etag = etagMatch ? etagMatch[1] : "";
     return { etag };
   }
-  async abortMultipartUpload(bucket, key, uploadId) {
+  async abortMultipartUpload(bucket, key, uploadId, baseUrl) {
     const credentials = await this.getCredentials();
-    const url = `${this.buildUrl(bucket, key)}?uploadId=${encodeURIComponent(uploadId)}`;
+    const url = `${baseUrl ?? this.buildUrl(bucket, key)}?uploadId=${encodeURIComponent(uploadId)}`;
     const signed = signRequest({
       method: "DELETE",
       url,
@@ -45970,14 +45986,7 @@ function composeServerlessAppTemplate(opts) {
         VisibilityConfig: { SampledRequestsEnabled: true, CloudWatchMetricsEnabled: true, MetricName: `${slug}-${environment}-waf` }
       }
     };
-    resources.WebAclAssociation = {
-      Type: "AWS::WAFv2::WebACLAssociation",
-      DependsOn: ["HttpStage"],
-      Properties: {
-        ResourceArn: Fn2.sub("arn:aws:apigateway:${AWS::Region}::/apis/${HttpApi}/stages/$default"),
-        WebACLArn: Fn2.getAtt("WebAcl", "Arn")
-      }
-    };
+    outputs.WafAclArn = { Description: "WAF web ACL ARN. Attach to a CloudFront distribution fronting the API to enforce (HTTP API v2 stages do not support direct WAF association).", Value: Fn2.getAtt("WebAcl", "Arn") };
   }
   if (hasVpc && needsDataVpc) {
     if (!app.vpc?.id)

package/dist/types.d.ts

@@ -932,9 +932,11 @@ export interface SiteConfig {
     redirects?: Record<string, string>;
     /**
      * Give this site a dedicated php-fpm pool (isolated user/process) rather than
-     * sharing the default pool.
+     * sharing the default pool (Forge's "User Isolation").
      */
     isolation?: boolean;
+    /** Per-site nginx access control (IP allow/deny — Forge "Security Rules"). */
+    security?: SiteSecurityConfig;
     /** Post-deploy health check (Forge-style) pinged after `current` is flipped. */
     healthCheck?: {
         path?: string;
@@ -1059,6 +1061,33 @@ export interface SiteSslConfig {
      * domain resolves to the box. The plugin + credentials are wired on the box.
      */
     dns?: SslDnsConfig;
+    /**
+     * Emit an HSTS (`Strict-Transport-Security`) header so browsers force HTTPS.
+     * `true` uses a 1-year max-age with `includeSubDomains`; an object customizes
+     * it. Only meaningful when the site serves TLS.
+     */
+    hsts?: boolean | {
+        maxAge?: number;
+        includeSubDomains?: boolean;
+        preload?: boolean;
+    };
+    /**
+     * `ssl_protocols` for the vhost (e.g. `['TLSv1.2', 'TLSv1.3']`). Applied to
+     * the `custom`-cert :443 block; for Let's Encrypt the protocols are managed by
+     * certbot's options file.
+     */
+    tlsProtocols?: string[];
+}
+/**
+ * Per-site access control at the nginx layer (Forge's "Security Rules"). IPs/
+ * CIDRs in {@link allow} are permitted and everything else denied; {@link deny}
+ * blocks specific IPs/CIDRs. `allow` takes precedence (allow-list mode).
+ */
+export interface SiteSecurityConfig {
+    /** Allow only these IPs/CIDRs (everything else gets 403). */
+    allow?: string[];
+    /** Block these IPs/CIDRs. */
+    deny?: string[];
 }
 /** certbot DNS-01 plugin configuration for DNS-validated / wildcard certs. */
 export interface SslDnsConfig {
@@ -2169,10 +2198,12 @@ export interface ComputeConfig {
      */
     sshKey?: string;
     /**
-     * Enable detailed monitoring
-     * @default false
+     * On-box server monitoring (Forge-style). `true`/`false` toggles the metrics
+     * collector; pass a {@link ComputeMonitoringConfig} to also set resource
+     * alert thresholds that notify the configured channels on breach.
+     * @default true for PHP boxes
      */
-    monitoring?: boolean;
+    monitoring?: boolean | ComputeMonitoringConfig;
     /**
      * Spot/preemptible instance settings (when using fleet)
      */
@@ -2287,6 +2318,25 @@ export interface SshKeyConfig {
     /** The public key line (e.g. `ssh-ed25519 AAAA… user@host`). */
     publicKey: string;
 }
+/**
+ * On-box monitoring + resource alerts. See {@link ComputeConfig.monitoring}.
+ * The collector writes a metrics snapshot every minute; when a threshold is
+ * breached it calls the on-box notifier (Slack/Discord/Telegram/webhook) once
+ * per OK→alert transition (and again on recovery), so channels aren't spammed.
+ */
+export interface ComputeMonitoringConfig {
+    /** Enable the metrics collector. @default true */
+    enabled?: boolean;
+    /** Alert thresholds; omit a field to keep its default. */
+    alerts?: {
+        /** Alert when 1-min load average per CPU exceeds this. @default 2 */
+        cpuLoadPerCore?: number;
+        /** Alert when used memory percentage is ≥ this. @default 90 */
+        memPercent?: number;
+        /** Alert when root-filesystem usage percentage is ≥ this. @default 90 */
+        diskPercent?: number;
+    };
+}
 /** Host firewall (UFW) configuration. See {@link ComputeConfig.firewall}. */
 export interface ComputeFirewallConfig {
     /** Enable UFW. @default true */
@@ -2393,6 +2443,27 @@ export interface ComputeProxyConfig {
      * served per-SNI by rpx. @default '/etc/rpx/certs'
      */
     certsDir?: string;
+    /**
+     * Inactivity timeout (seconds) for rpx's pooled upstream connections, surfaced
+     * to the gateway as `RPX_UPSTREAM_TIMEOUT`. rpx leaves this **off by default**
+     * because it commonly fronts dev servers doing SSE/HMR/long-poll, but a
+     * production gateway fronting real apps must bound it: the pool caps
+     * connections per upstream and queues requests for a free slot, so a single
+     * stalled upstream socket with no timeout holds its slot forever — enough of
+     * them leak the pool and the gateway wedges (TLS handshakes succeed but no
+     * request is ever answered). The timer resets on every byte, so a stream that
+     * emits data periodically never trips it; only a fully-stalled upstream does.
+     * Set `0` to disable (match rpx's dev default for streaming-heavy upstreams).
+     * @default 60
+     */
+    upstreamTimeout?: number;
+    /**
+     * Max open connections rpx keeps per upstream `host:port`, surfaced as
+     * `RPX_MAX_UPSTREAM_CONNS`. Requests beyond this queue for a free slot rather
+     * than churning sockets into TIME_WAIT. Raise for higher peak parallelism per
+     * upstream; omit to use rpx's built-in default (256).
+     */
+    maxUpstreamConns?: number;
     /**
      * Enable rpx on-demand TLS: lazily issue a real (Let's Encrypt) cert for an
      * approved host the first time it's needed. The site domains are used as the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ts-cloud/core",
-  "version": "0.5.16",
+  "version": "0.5.18",
   "type": "module",
   "description": "Core CloudFormation generation library for ts-cloud",
   "author": "Chris Breuer <chris@stacksjs.com>",
@@ -31,7 +31,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@ts-cloud/aws-types": "0.5.16"
+    "@ts-cloud/aws-types": "0.5.18"
   },
   "devDependencies": {
     "typescript": "^5.9.3"