@ts-cloud/core 0.7.119 → 0.7.121

package/dist/drivers/types.d.ts

@@ -57,6 +57,13 @@ export interface FindComputeTargetsOptions {
     slug: string;
     environment: EnvironmentType;
     role?: string;
+    /**
+     * Region to search, for drivers that have one. Defaults to the driver's own.
+     * A driver method that resolved a region from config passes it here, so the
+     * lookup and whatever is done with the results cannot disagree about where
+     * the instances are.
+     */
+    region?: string;
     /**
      * Project stack name (`resolveProjectStackName(config, environment)`), used
      * by drivers that can pin targets from local state when label/tag scans

package/dist/index.js

@@ -10647,11 +10647,45 @@ function normalizeHomeDirectory(value, username) {
     throw new Error(`sftp: invalid homeDirectory for user ${username}`);
   return path;
 }
+function resolveStorage(options) {
+  const storage = options.storage;
+  if (storage?.type === "efs") {
+    const fileSystemId = "fileSystemId" in storage ? storage.fileSystemId : undefined;
+    if (!fileSystemId || typeof fileSystemId === "string" && !fileSystemId.trim())
+      throw new Error("sftp: EFS storage requires fileSystemId, or a fileSystem name defined in infrastructure.fileSystem");
+    return { type: "efs", fileSystemId, posixProfile: storage.posixProfile };
+  }
+  const bucket = (storage?.type === "s3" ? storage.bucket ?? options.bucket : options.bucket)?.trim();
+  if (!bucket)
+    throw new Error("sftp: S3 storage requires bucket, or a storageBucket name defined in infrastructure.storage");
+  return { type: "s3", bucket };
+}
+function posixProfileFor(username, user, fallback) {
+  const profile = user.posixProfile ?? fallback;
+  if (!profile)
+    throw new Error(`sftp: user ${username} requires a posixProfile (uid/gid) on an EFS-backed server`);
+  for (const id of [profile.uid, profile.gid, ...profile.secondaryGids ?? []]) {
+    if (!Number.isInteger(id) || id < 0 || id > 4294967295)
+      throw new Error(`sftp: user ${username} has an invalid posixProfile id ${id}`);
+  }
+  return {
+    Uid: profile.uid,
+    Gid: profile.gid,
+    ...profile.secondaryGids?.length ? { SecondaryGids: profile.secondaryGids } : {}
+  };
+}
+function efsHomeDirectory(fileSystemId, home) {
+  return typeof fileSystemId === "string" ? `/${fileSystemId}/${home}` : { "Fn::Sub": [`/\${FileSystemId}/${home}`, { FileSystemId: fileSystemId }] };
+}
+function efsFileSystemArn(fileSystemId) {
+  const template = "arn:aws:elasticfilesystem:${AWS::Region}:${AWS::AccountId}:file-system/${FileSystemId}";
+  return typeof fileSystemId === "string" ? { "Fn::Sub": template.replace("${FileSystemId}", fileSystemId) } : { "Fn::Sub": [template, { FileSystemId: fileSystemId }] };
+}
 
 class Sftp {
   static create(options) {
-    if (!options.bucket.trim())
-      throw new Error("sftp: bucket is required");
+    const storage = resolveStorage(options);
+    const domain = storage.type === "efs" ? "EFS" : "S3";
     const endpointType = options.endpointType ?? "PUBLIC";
     if (endpointType === "VPC" && (!options.endpointDetails?.vpcId || !options.endpointDetails.subnetIds.length))
       throw new Error("sftp: VPC endpoints require endpointDetails.vpcId and at least one subnet");
@@ -10697,7 +10731,7 @@ class Sftp {
     resources[serverLogicalId] = {
       Type: "AWS::Transfer::Server",
       Properties: {
-        Domain: "S3",
+        Domain: domain,
         EndpointType: endpointType,
         IdentityProviderType: "SERVICE_MANAGED",
         Protocols: ["SFTP"],
@@ -10729,7 +10763,35 @@ class Sftp {
       let roleArn = user.roleArn;
       if (!roleArn) {
         const roleLogicalId = `${prefix}${userPart}Role`;
-        const bucketArn = `arn:aws:s3:::${options.bucket}`;
+        let statements;
+        if (storage.type === "efs") {
+          statements = [
+            {
+              Effect: "Allow",
+              Action: [
+                "elasticfilesystem:ClientMount",
+                "elasticfilesystem:ClientWrite",
+                "elasticfilesystem:DescribeMountTargets"
+              ],
+              Resource: efsFileSystemArn(storage.fileSystemId)
+            }
+          ];
+        } else {
+          const bucketArn = `arn:aws:s3:::${storage.bucket}`;
+          statements = [
+            {
+              Effect: "Allow",
+              Action: ["s3:ListBucket", "s3:GetBucketLocation"],
+              Resource: bucketArn,
+              Condition: { StringLike: { "s3:prefix": [home, `${home}/*`] } }
+            },
+            {
+              Effect: "Allow",
+              Action: ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetObjectVersion"],
+              Resource: `${bucketArn}/${home}/*`
+            }
+          ];
+        }
         resources[roleLogicalId] = {
           Type: "AWS::IAM::Role",
           Properties: {
@@ -10742,22 +10804,7 @@ class Sftp {
             Policies: [
               {
                 PolicyName: "SftpHomeDirectory",
-                PolicyDocument: {
-                  Version: "2012-10-17",
-                  Statement: [
-                    {
-                      Effect: "Allow",
-                      Action: ["s3:ListBucket", "s3:GetBucketLocation"],
-                      Resource: bucketArn,
-                      Condition: { StringLike: { "s3:prefix": [home, `${home}/*`] } }
-                    },
-                    {
-                      Effect: "Allow",
-                      Action: ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetObjectVersion"],
-                      Resource: `${bucketArn}/${home}/*`
-                    }
-                  ]
-                }
+                PolicyDocument: { Version: "2012-10-17", Statement: statements }
               }
             ]
           }
@@ -10772,12 +10819,13 @@ class Sftp {
           UserName: username,
           Role: roleArn,
           HomeDirectoryType: "PATH",
-          HomeDirectory: `/${options.bucket}/${home}`,
+          HomeDirectory: storage.type === "efs" ? efsHomeDirectory(storage.fileSystemId, home) : `/${storage.bucket}/${home}`,
+          ...storage.type === "efs" ? { PosixProfile: posixProfileFor(username, user, storage.posixProfile) } : {},
           SshPublicKeys: user.sshPublicKeys
         }
       };
     }
-    return { resources, serverLogicalId };
+    return { resources, serverLogicalId, domain };
   }
 }
 // src/modules/ai.ts

package/dist/modules/sftp.d.ts

@@ -1,12 +1,33 @@
-import type { EnvironmentType, SftpConfig } from '../types';
+import type { EnvironmentType, SftpConfig, SftpPosixProfile } from '../types';
 export interface SftpResources {
     resources: Record<string, any>;
     serverLogicalId: string;
+    /** Storage backend the server was built with. */
+    domain: 'S3' | 'EFS';
+}
+/**
+ * An EFS file system ID: either a literal `fs-…` or a CloudFormation intrinsic
+ * (`{ Ref: '…' }`) pointing at a file system created in the same stack.
+ */
+export type SftpFileSystemRef = string | Record<string, any>;
+/**
+ * Storage the module resolved down to a concrete backend. The generator turns
+ * `storageBucket`/`fileSystem` references into these before calling `create`.
+ */
+export type ResolvedSftpStorage = {
+    type: 's3';
+    bucket: string;
+} | {
+    type: 'efs';
+    fileSystemId: SftpFileSystemRef;
+    posixProfile?: SftpPosixProfile;
+};
+export interface SftpCreateOptions extends Omit<SftpConfig, 'storage'> {
+    slug: string;
+    environment: EnvironmentType;
+    storage?: SftpConfig['storage'] | ResolvedSftpStorage;
 }
 /** Build an AWS Transfer Family SFTP server with service-managed users. */
 export declare class Sftp {
-    static create(options: SftpConfig & {
-        slug: string;
-        environment: EnvironmentType;
-    }): SftpResources;
+    static create(options: SftpCreateOptions): SftpResources;
 }

package/dist/types.d.ts

@@ -984,6 +984,35 @@ export interface SiteConfig {
      * Example: ['bun install --frozen-lockfile', 'bun run build']
      */
     preStart?: string[];
+    /**
+     * systemd `MemoryHigh` for this site's app unit — the soft limit at which
+     * the kernel starts reclaiming the service's own memory, throttling it
+     * rather than letting pressure build box-wide.
+     *
+     * This is the same containment the rpx gateway has carried for a while, and
+     * app units are where it was missing. On a shared box a single tenant that
+     * leaks takes down every other tenant: memory fills, swap fills, and the
+     * kernel's OOM killer starts picking arbitrary victims. Squeezing the
+     * offender's own cgroup first keeps the blast radius on the service that
+     * actually grew.
+     *
+     * Accepts systemd size values (`512M`, `2G`, …), or `'infinity'` to opt a
+     * site out. Applies to the app unit only; queue workers have their own
+     * `--memory` restart threshold. @default '2G'
+     */
+    memoryHigh?: string;
+    /**
+     * systemd `MemoryMax` for this site's app unit — the hard limit. Crossing it
+     * invokes the OOM killer INSIDE this service's cgroup, so the unit's
+     * `Restart=always` brings it straight back rather than the kernel killing a
+     * co-tenant.
+     *
+     * Unset by default, deliberately: a hard cap turns a slow leak into a
+     * restart loop for an app that legitimately needs the memory, and the
+     * default has to be safe for workloads nobody has measured. Set it once you
+     * know a site's real ceiling. Should be higher than {@link memoryHigh}.
+     */
+    memoryMax?: string;
     /**
      * SSR only. tar `--exclude` patterns applied when packaging the release
      * tarball. Keep host-specific / heavy paths out of the artifact — most
@@ -1507,13 +1536,65 @@ export interface CdnConfig {
     customDomain?: string;
     certificateArn?: string;
 }
+/**
+ * POSIX identity a user is mapped to on an EFS-backed server.
+ * Files the user writes are owned by this uid/gid.
+ */
+export interface SftpPosixProfile {
+    uid: number;
+    gid: number;
+    secondaryGids?: number[];
+}
+/** Files live in an S3 bucket. */
+export interface SftpS3Storage {
+    type: 's3';
+    /** Physical bucket name of an existing bucket. */
+    bucket?: string;
+    /**
+     * Key from `infrastructure.storage`. ts-cloud points the server at the
+     * bucket it generates for that entry, so the bucket is created with the stack.
+     */
+    storageBucket?: string;
+}
+/**
+ * Files live on an EFS file system attached to the server, so users get a real
+ * POSIX filesystem (directories, renames, symlinks) instead of object storage.
+ */
+export interface SftpEfsStorage {
+    type: 'efs';
+    /**
+     * Directory served on box providers (Hetzner, local), where storage on the
+     * server is a directory rather than an EFS file system.
+     * Defaults to `/var/sftp/<slug>`.
+     */
+    path?: string;
+    /** File system ID (`fs-…`) of an existing EFS file system. */
+    fileSystemId?: string;
+    /**
+     * Key from `infrastructure.fileSystem`. ts-cloud points the server at the
+     * file system it generates for that entry, so storage is created with the stack.
+     */
+    fileSystem?: string;
+    /** Default POSIX identity for users that do not set their own. */
+    posixProfile?: SftpPosixProfile;
+}
+export type SftpStorageConfig = SftpS3Storage | SftpEfsStorage;
+export interface SftpUserConfig {
+    sshPublicKeys: string[];
+    homeDirectory?: string;
+    roleArn?: string;
+    /** POSIX identity for this user. Required on EFS-backed servers. */
+    posixProfile?: SftpPosixProfile;
+}
 export interface SftpConfig {
-    bucket: string;
-    users: Record<string, {
-        sshPublicKeys: string[];
-        homeDirectory?: string;
-        roleArn?: string;
-    }>;
+    /**
+     * Where uploaded files are stored: an EFS file system on the server
+     * (`{ type: 'efs' }`) or an S3 bucket (`{ type: 's3' }`).
+     */
+    storage?: SftpStorageConfig;
+    /** Shorthand for `storage: { type: 's3', bucket }`. */
+    bucket?: string;
+    users: Record<string, SftpUserConfig>;
     endpointType?: 'PUBLIC' | 'VPC';
     endpointDetails?: {
         vpcId: string;
@@ -1523,6 +1604,17 @@ export interface SftpConfig {
     };
     securityPolicyName?: string;
     logging?: boolean;
+    /**
+     * Port the server listens on. Box providers only — AWS Transfer Family is
+     * always reached on port 22. Defaults to 2222, since sshd owns 22 on a box.
+     */
+    port?: number;
+    /** Reject every write. Box providers only. */
+    readOnly?: boolean;
+    /** ts-sftp version installed on the box. Defaults to the latest release. */
+    version?: string;
+    /** System account the box server runs as. Defaults to `ts-sftp`. */
+    serviceUser?: string;
 }
 export interface DnsConfig {
     domain?: string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ts-cloud/core",
   "type": "module",
-  "version": "0.7.119",
+  "version": "0.7.121",
   "description": "Core CloudFormation generation library for ts-cloud",
   "author": "Chris Breuer <chris@stacksjs.com>",
   "license": "MIT",
@@ -31,7 +31,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@ts-cloud/aws-types": "0.7.119"
+    "@ts-cloud/aws-types": "0.7.121"
   },
   "devDependencies": {
     "typescript": "^7.0.2"