- Add start/stop/reboot endpoints for server power management
- Add D1-based logging system (logs table + db-logger utility)
- Add idempotency_key validation for order deduplication
- Extend VPS provider interface with lifecycle methods
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Security:
- Add CSP headers for HTML reports (style-src 'unsafe-inline')
- Restrict origin validation to specific .kappa-d8e.workers.dev domain
- Add base64 size limit (100KB) for report data parameter
- Implement rejection sampling for unbiased password generation
- Add SQL LIKE pattern escaping for tech specs query
- Add security warning for plaintext password storage (TODO: encrypt)
Performance:
- Add Telegram API timeout (10s) with AbortController
- Fix rate limiter sorting by resetTime for proper cleanup
- Use centralized TIMEOUTS config for VPS provider APIs
Features:
- Add admin SSH key support for server recovery access
- ADMIN_SSH_PUBLIC_KEY for Linode (public key string)
- ADMIN_SSH_KEY_ID_VULTR for Vultr (pre-registered key ID)
- Add origin validation middleware
- Add idempotency key migration
Code Quality:
- Return 404 status when no servers found
- Consolidate error logging to single JSON.stringify call
- Import TECH_CATEGORY_WEIGHTS from config.ts
- Add escapeLikePattern utility function
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add os_images table with linode_image_id and vultr_os_id columns
- Support Ubuntu (24.04, 22.04), Debian (11-13), AlmaLinux (8-9),
Rocky Linux (8-9), and Fedora 42
- AlmaLinux and Rocky Linux added as CentOS migration alternatives
- Default OS changed from ubuntu_22_04 to ubuntu_24_04
- Fix Vultr OS IDs (1743=22.04, 2284=24.04)
- Remove hardcoded OS validation, validate against DB
- Return available OS list in error message for invalid image
Migration: migrations/003_os_images.sql
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Update PricingWithProvider type with source_provider and source_region_code
- Update getPricingWithProvider query to JOIN instance_types for actual plan_id
- Use source_provider (linode/vultr) instead of provider_name (Anvil)
- Use source_region_code for actual provider region (ap-northeast, nrt, icn)
Mapping: anvil_regions.source_provider + anvil_pricing.source_instance_id
→ instance_types.instance_id (actual Linode/Vultr plan)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add Cloudflare Queue for async server provisioning workflow
- Implement VPS provider abstraction (Linode, Vultr)
- Add provisioning API endpoints with API key authentication
- Fix race condition in balance deduction (atomic query)
- Remove root_password from Queue for security (fetch from DB)
- Add IP assignment wait logic after server creation
- Add rollback/refund on all failure cases
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
