@codedrifters/constructs 0.0.72 → 0.0.74

package/lib/index.d.mts

@@ -1,10 +1,139 @@
-import { Bucket, BucketProps } from 'aws-cdk-lib/aws-s3';
+import { NodejsFunction, NodejsFunctionProps, ICommandHooks } from 'aws-cdk-lib/aws-lambda-nodejs';
 import { Construct } from 'constructs';
+import { Bucket, BucketProps } from 'aws-cdk-lib/aws-s3';
 import { StackProps } from 'aws-cdk-lib';
 import { HostedZoneAttributes } from 'aws-cdk-lib/aws-route53';
 import { HostingMode } from './static-hosting.viewer-request-handler.mjs';
 import 'aws-lambda';
 
+/**
+ * Props for `PnpmWorkspaceNodejsFunction`. Extends
+ * `NodejsFunctionProps` so the wrapper is a drop-in for any existing
+ * `NodejsFunction` call site.
+ */
+interface PnpmWorkspaceNodejsFunctionProps extends NodejsFunctionProps {
+    /**
+     * Directory to begin the upward search for `pnpm-workspace.yaml`.
+     * Defaults to the directory of the resolved entry path.
+     */
+    readonly workspaceSearchFrom?: string;
+    /**
+     * Skip the policy-mirror step entirely. Useful for tests or when the
+     * caller wants the pure `NodejsFunction` behavior.
+     *
+     * @default false
+     */
+    readonly disablePnpmPolicyMirror?: boolean;
+}
+/**
+ * Result of `mirrorPnpmWorkspacePolicy` — describes what the policy
+ * mirror did for one entry.
+ */
+interface MirrorPnpmWorkspacePolicyResult {
+    /** Resolved `.npmrc` path if a write happened, otherwise undefined. */
+    readonly npmrcPath?: string;
+    /** Reason the mirror was a no-op, if it was. */
+    readonly skippedReason?: "missing-entry" | "missing-workspace-file" | "empty-policy" | "no-change";
+}
+/**
+ * Mirror the workspace pnpm policy into an `.npmrc` adjacent to the
+ * Lambda entry. Pure side-effect helper used by
+ * `PnpmWorkspaceNodejsFunction`; exported so consumers can drive it
+ * from other call sites if desired.
+ */
+declare const mirrorPnpmWorkspacePolicy: (params: {
+    readonly entry: string;
+    readonly workspaceSearchFrom?: string;
+}) => MirrorPnpmWorkspacePolicyResult;
+/**
+ * Build an `ICommandHooks` implementation that copies an
+ * entry-adjacent `.npmrc` into the bundling input directory before
+ * `pnpm install` runs. Composes with any caller-supplied hooks so
+ * existing `beforeBundling` / `beforeInstall` / `afterBundling`
+ * commands are preserved.
+ *
+ * Exported for unit testing; the construct wires this automatically.
+ */
+declare const buildNpmrcCopyCommandHooks: (params: {
+    readonly npmrcPath: string;
+    readonly existingHooks?: ICommandHooks;
+}) => ICommandHooks;
+/**
+ * A `NodejsFunction` wrapper that mirrors the workspace's pnpm policy
+ * (currently `minimumReleaseAge` and `minimumReleaseAgeExclude`) into
+ * an `.npmrc` adjacent to the Lambda entry before bundling.
+ *
+ * CDK's bundler runs `pnpm install` in an isolated temp directory
+ * outside the workspace, which means `pnpm-workspace.yaml` settings
+ * do not apply there. CDK does **not** copy arbitrary entry-adjacent
+ * files into the bundling input directory, so the construct also
+ * wires a `bundling.commandHooks.beforeInstall` hook that copies the
+ * rendered `.npmrc` into the bundling input directory immediately
+ * before `pnpm install` runs. Caller-supplied `commandHooks` are
+ * preserved — the copy command is appended to whatever the caller
+ * already returns from `beforeInstall`.
+ *
+ * See the `pnpm-workspace-nodejs-function` documentation page for
+ * full details on what gets mirrored, merge behaviour against an
+ * existing `.npmrc`, and when to disable the mirror.
+ */
+declare class PnpmWorkspaceNodejsFunction extends NodejsFunction {
+    constructor(scope: Construct, id: string, props: PnpmWorkspaceNodejsFunctionProps);
+}
+
+/**
+ * Subset of `pnpm-workspace.yaml` fields that map to `.npmrc` keys
+ * pnpm honours when running install in a non-workspace directory.
+ */
+interface PnpmWorkspacePolicy {
+    /** `minimumReleaseAge` (minutes) — equivalent to `.npmrc` `minimum-release-age`. */
+    readonly minimumReleaseAge?: number;
+    /**
+     * `minimumReleaseAgeExclude` — equivalent to `.npmrc`
+     * `minimum-release-age-exclude` (comma-separated when serialised).
+     */
+    readonly minimumReleaseAgeExclude?: ReadonlyArray<string>;
+}
+/**
+ * Walk up from `startDir` until a `pnpm-workspace.yaml` file is found
+ * and return its absolute path. Returns `undefined` when the filesystem
+ * root is reached without finding one.
+ */
+declare const findPnpmWorkspaceFile: (startDir: string) => string | undefined;
+/**
+ * Read the policy subset (`minimumReleaseAge` and
+ * `minimumReleaseAgeExclude`) from a `pnpm-workspace.yaml` file.
+ *
+ * Returns an empty object when the file is missing, unreadable, or
+ * contains neither key. Throws when the file is present but YAML
+ * parsing fails — the caller is expected to surface a clear error.
+ */
+declare const readPnpmWorkspacePolicy: (workspaceFile: string) => PnpmWorkspacePolicy;
+/**
+ * Render an `.npmrc` body that pnpm will honour when installing in
+ * a directory outside the workspace tree. The keys emitted here are
+ * the `.npmrc` equivalents of the `pnpm-workspace.yaml` fields in
+ * {@link PnpmWorkspacePolicy} — pnpm reads `minimum-release-age` and
+ * `minimum-release-age-exclude` from `.npmrc`, not from the workspace
+ * file, when the install runs outside the workspace.
+ *
+ * Returns an empty string when the policy carries no relevant fields.
+ */
+declare const renderNpmrcLines: (policy: PnpmWorkspacePolicy) => ReadonlyArray<string>;
+/**
+ * Parse the body of an existing `.npmrc` file into a map of trimmed
+ * key/value pairs. Lines that are blank or start with `#` are dropped.
+ * Lines without an `=` are dropped.
+ */
+declare const parseNpmrc: (body: string) => Map<string, string>;
+/**
+ * Merge a set of policy-derived `.npmrc` lines into an existing
+ * `.npmrc` body. Our keys overwrite matching keys in the existing
+ * body; all other keys are preserved. Returns the new `.npmrc` body
+ * (always terminated by a trailing newline when non-empty).
+ */
+declare const mergeNpmrc: (existing: string | undefined, ourLines: ReadonlyArray<string>) => string;
+
 interface PrivateBucketProps extends BucketProps {
 }
 declare class PrivateBucket extends Bucket {
@@ -123,4 +252,4 @@ declare class StaticHosting extends Construct {
     constructor(scope: Construct, id: string, props?: StaticHostingProps);
 }
 
-export { PrivateBucket, type PrivateBucketProps, StaticContent, type StaticContentProps, type StaticDomainProps, StaticHosting, type StaticHostingProps };
+export { type MirrorPnpmWorkspacePolicyResult, PnpmWorkspaceNodejsFunction, type PnpmWorkspaceNodejsFunctionProps, type PnpmWorkspacePolicy, PrivateBucket, type PrivateBucketProps, StaticContent, type StaticContentProps, type StaticDomainProps, StaticHosting, type StaticHostingProps, buildNpmrcCopyCommandHooks, findPnpmWorkspaceFile, mergeNpmrc, mirrorPnpmWorkspacePolicy, parseNpmrc, readPnpmWorkspacePolicy, renderNpmrcLines };

package/lib/index.d.ts

@@ -1,5 +1,6 @@
-import { Bucket, BucketProps } from 'aws-cdk-lib/aws-s3';
+import { NodejsFunction, NodejsFunctionProps, ICommandHooks } from 'aws-cdk-lib/aws-lambda-nodejs';
 import { Construct } from 'constructs';
+import { Bucket, BucketProps } from 'aws-cdk-lib/aws-s3';
 import { StackProps } from 'aws-cdk-lib';
 import { HostedZoneAttributes } from 'aws-cdk-lib/aws-route53';
 
@@ -15,6 +16,134 @@ import { HostedZoneAttributes } from 'aws-cdk-lib/aws-route53';
  */
 type HostingMode = "spa" | "static";
 
+/**
+ * Props for `PnpmWorkspaceNodejsFunction`. Extends
+ * `NodejsFunctionProps` so the wrapper is a drop-in for any existing
+ * `NodejsFunction` call site.
+ */
+interface PnpmWorkspaceNodejsFunctionProps extends NodejsFunctionProps {
+    /**
+     * Directory to begin the upward search for `pnpm-workspace.yaml`.
+     * Defaults to the directory of the resolved entry path.
+     */
+    readonly workspaceSearchFrom?: string;
+    /**
+     * Skip the policy-mirror step entirely. Useful for tests or when the
+     * caller wants the pure `NodejsFunction` behavior.
+     *
+     * @default false
+     */
+    readonly disablePnpmPolicyMirror?: boolean;
+}
+/**
+ * Result of `mirrorPnpmWorkspacePolicy` — describes what the policy
+ * mirror did for one entry.
+ */
+interface MirrorPnpmWorkspacePolicyResult {
+    /** Resolved `.npmrc` path if a write happened, otherwise undefined. */
+    readonly npmrcPath?: string;
+    /** Reason the mirror was a no-op, if it was. */
+    readonly skippedReason?: "missing-entry" | "missing-workspace-file" | "empty-policy" | "no-change";
+}
+/**
+ * Mirror the workspace pnpm policy into an `.npmrc` adjacent to the
+ * Lambda entry. Pure side-effect helper used by
+ * `PnpmWorkspaceNodejsFunction`; exported so consumers can drive it
+ * from other call sites if desired.
+ */
+declare const mirrorPnpmWorkspacePolicy: (params: {
+    readonly entry: string;
+    readonly workspaceSearchFrom?: string;
+}) => MirrorPnpmWorkspacePolicyResult;
+/**
+ * Build an `ICommandHooks` implementation that copies an
+ * entry-adjacent `.npmrc` into the bundling input directory before
+ * `pnpm install` runs. Composes with any caller-supplied hooks so
+ * existing `beforeBundling` / `beforeInstall` / `afterBundling`
+ * commands are preserved.
+ *
+ * Exported for unit testing; the construct wires this automatically.
+ */
+declare const buildNpmrcCopyCommandHooks: (params: {
+    readonly npmrcPath: string;
+    readonly existingHooks?: ICommandHooks;
+}) => ICommandHooks;
+/**
+ * A `NodejsFunction` wrapper that mirrors the workspace's pnpm policy
+ * (currently `minimumReleaseAge` and `minimumReleaseAgeExclude`) into
+ * an `.npmrc` adjacent to the Lambda entry before bundling.
+ *
+ * CDK's bundler runs `pnpm install` in an isolated temp directory
+ * outside the workspace, which means `pnpm-workspace.yaml` settings
+ * do not apply there. CDK does **not** copy arbitrary entry-adjacent
+ * files into the bundling input directory, so the construct also
+ * wires a `bundling.commandHooks.beforeInstall` hook that copies the
+ * rendered `.npmrc` into the bundling input directory immediately
+ * before `pnpm install` runs. Caller-supplied `commandHooks` are
+ * preserved — the copy command is appended to whatever the caller
+ * already returns from `beforeInstall`.
+ *
+ * See the `pnpm-workspace-nodejs-function` documentation page for
+ * full details on what gets mirrored, merge behaviour against an
+ * existing `.npmrc`, and when to disable the mirror.
+ */
+declare class PnpmWorkspaceNodejsFunction extends NodejsFunction {
+    constructor(scope: Construct, id: string, props: PnpmWorkspaceNodejsFunctionProps);
+}
+
+/**
+ * Subset of `pnpm-workspace.yaml` fields that map to `.npmrc` keys
+ * pnpm honours when running install in a non-workspace directory.
+ */
+interface PnpmWorkspacePolicy {
+    /** `minimumReleaseAge` (minutes) — equivalent to `.npmrc` `minimum-release-age`. */
+    readonly minimumReleaseAge?: number;
+    /**
+     * `minimumReleaseAgeExclude` — equivalent to `.npmrc`
+     * `minimum-release-age-exclude` (comma-separated when serialised).
+     */
+    readonly minimumReleaseAgeExclude?: ReadonlyArray<string>;
+}
+/**
+ * Walk up from `startDir` until a `pnpm-workspace.yaml` file is found
+ * and return its absolute path. Returns `undefined` when the filesystem
+ * root is reached without finding one.
+ */
+declare const findPnpmWorkspaceFile: (startDir: string) => string | undefined;
+/**
+ * Read the policy subset (`minimumReleaseAge` and
+ * `minimumReleaseAgeExclude`) from a `pnpm-workspace.yaml` file.
+ *
+ * Returns an empty object when the file is missing, unreadable, or
+ * contains neither key. Throws when the file is present but YAML
+ * parsing fails — the caller is expected to surface a clear error.
+ */
+declare const readPnpmWorkspacePolicy: (workspaceFile: string) => PnpmWorkspacePolicy;
+/**
+ * Render an `.npmrc` body that pnpm will honour when installing in
+ * a directory outside the workspace tree. The keys emitted here are
+ * the `.npmrc` equivalents of the `pnpm-workspace.yaml` fields in
+ * {@link PnpmWorkspacePolicy} — pnpm reads `minimum-release-age` and
+ * `minimum-release-age-exclude` from `.npmrc`, not from the workspace
+ * file, when the install runs outside the workspace.
+ *
+ * Returns an empty string when the policy carries no relevant fields.
+ */
+declare const renderNpmrcLines: (policy: PnpmWorkspacePolicy) => ReadonlyArray<string>;
+/**
+ * Parse the body of an existing `.npmrc` file into a map of trimmed
+ * key/value pairs. Lines that are blank or start with `#` are dropped.
+ * Lines without an `=` are dropped.
+ */
+declare const parseNpmrc: (body: string) => Map<string, string>;
+/**
+ * Merge a set of policy-derived `.npmrc` lines into an existing
+ * `.npmrc` body. Our keys overwrite matching keys in the existing
+ * body; all other keys are preserved. Returns the new `.npmrc` body
+ * (always terminated by a trailing newline when non-empty).
+ */
+declare const mergeNpmrc: (existing: string | undefined, ourLines: ReadonlyArray<string>) => string;
+
 interface PrivateBucketProps extends BucketProps {
 }
 declare class PrivateBucket extends Bucket {
@@ -133,5 +262,5 @@ declare class StaticHosting extends Construct {
     constructor(scope: Construct, id: string, props?: StaticHostingProps);
 }
 
-export { PrivateBucket, StaticContent, StaticHosting };
-export type { PrivateBucketProps, StaticContentProps, StaticDomainProps, StaticHostingProps };
+export { PnpmWorkspaceNodejsFunction, PrivateBucket, StaticContent, StaticHosting, buildNpmrcCopyCommandHooks, findPnpmWorkspaceFile, mergeNpmrc, mirrorPnpmWorkspacePolicy, parseNpmrc, readPnpmWorkspacePolicy, renderNpmrcLines };
+export type { MirrorPnpmWorkspacePolicyResult, PnpmWorkspaceNodejsFunctionProps, PnpmWorkspacePolicy, PrivateBucketProps, StaticContentProps, StaticDomainProps, StaticHostingProps };

package/lib/index.js

@@ -175,12 +175,213 @@ var require_lib = __commonJS({
 // src/index.ts
 var src_exports = {};
 __export(src_exports, {
+  PnpmWorkspaceNodejsFunction: () => PnpmWorkspaceNodejsFunction,
   PrivateBucket: () => PrivateBucket,
   StaticContent: () => StaticContent,
-  StaticHosting: () => StaticHosting
+  StaticHosting: () => StaticHosting,
+  buildNpmrcCopyCommandHooks: () => buildNpmrcCopyCommandHooks,
+  findPnpmWorkspaceFile: () => findPnpmWorkspaceFile,
+  mergeNpmrc: () => mergeNpmrc,
+  mirrorPnpmWorkspacePolicy: () => mirrorPnpmWorkspacePolicy,
+  parseNpmrc: () => parseNpmrc,
+  readPnpmWorkspacePolicy: () => readPnpmWorkspacePolicy,
+  renderNpmrcLines: () => renderNpmrcLines
 });
 module.exports = __toCommonJS(src_exports);
 
+// src/lambda/pnpm-workspace-nodejs-function.ts
+var fs2 = __toESM(require("fs"));
+var path2 = __toESM(require("path"));
+var import_aws_lambda_nodejs = require("aws-cdk-lib/aws-lambda-nodejs");
+
+// src/lambda/pnpm-workspace-parser.ts
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var yaml = __toESM(require("js-yaml"));
+var findPnpmWorkspaceFile = (startDir) => {
+  let current = path.resolve(startDir);
+  while (true) {
+    const candidate = path.join(current, "pnpm-workspace.yaml");
+    if (fs.existsSync(candidate)) {
+      return candidate;
+    }
+    const parent = path.dirname(current);
+    if (parent === current) {
+      return void 0;
+    }
+    current = parent;
+  }
+};
+var readPnpmWorkspacePolicy = (workspaceFile) => {
+  if (!fs.existsSync(workspaceFile)) {
+    return {};
+  }
+  const raw = fs.readFileSync(workspaceFile, "utf8");
+  const parsed = yaml.load(raw);
+  if (!parsed || typeof parsed !== "object") {
+    return {};
+  }
+  const obj = parsed;
+  const policy = {};
+  const age = obj.minimumReleaseAge;
+  if (typeof age === "number" && Number.isFinite(age)) {
+    policy.minimumReleaseAge = age;
+  }
+  const exclude = obj.minimumReleaseAgeExclude;
+  if (Array.isArray(exclude)) {
+    const cleaned = exclude.filter(
+      (entry) => typeof entry === "string" && entry.length > 0
+    );
+    if (cleaned.length > 0) {
+      policy.minimumReleaseAgeExclude = cleaned;
+    }
+  }
+  return policy;
+};
+var renderNpmrcLines = (policy) => {
+  const lines = [];
+  if (typeof policy.minimumReleaseAge === "number") {
+    lines.push(`minimum-release-age=${policy.minimumReleaseAge}`);
+  }
+  const exclude = policy.minimumReleaseAgeExclude ?? [];
+  if (exclude.length > 0) {
+    lines.push(`minimum-release-age-exclude=${exclude.join(",")}`);
+  }
+  return lines;
+};
+var parseNpmrc = (body) => {
+  const map = /* @__PURE__ */ new Map();
+  for (const rawLine of body.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (line.length === 0 || line.startsWith("#")) {
+      continue;
+    }
+    const eq = line.indexOf("=");
+    if (eq < 0) {
+      continue;
+    }
+    const key = line.slice(0, eq).trim();
+    const value = line.slice(eq + 1).trim();
+    if (key.length > 0) {
+      map.set(key, value);
+    }
+  }
+  return map;
+};
+var mergeNpmrc = (existing, ourLines) => {
+  if (ourLines.length === 0) {
+    return existing ?? "";
+  }
+  const ourMap = /* @__PURE__ */ new Map();
+  for (const line of ourLines) {
+    const eq = line.indexOf("=");
+    if (eq < 0) {
+      continue;
+    }
+    ourMap.set(line.slice(0, eq).trim(), line.slice(eq + 1).trim());
+  }
+  const existingMap = parseNpmrc(existing ?? "");
+  for (const [key, value] of ourMap) {
+    existingMap.set(key, value);
+  }
+  const orderedKeys = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const rawLine of (existing ?? "").split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (line.length === 0 || line.startsWith("#")) {
+      continue;
+    }
+    const eq = line.indexOf("=");
+    if (eq < 0) {
+      continue;
+    }
+    const key = line.slice(0, eq).trim();
+    if (key.length > 0 && existingMap.has(key) && !seen.has(key)) {
+      orderedKeys.push(key);
+      seen.add(key);
+    }
+  }
+  for (const key of ourMap.keys()) {
+    if (!seen.has(key)) {
+      orderedKeys.push(key);
+      seen.add(key);
+    }
+  }
+  const body = orderedKeys.map((key) => `${key}=${existingMap.get(key)}`).join("\n");
+  return body.length === 0 ? "" : `${body}
+`;
+};
+
+// src/lambda/pnpm-workspace-nodejs-function.ts
+var mirrorPnpmWorkspacePolicy = (params) => {
+  const { entry, workspaceSearchFrom } = params;
+  if (!fs2.existsSync(entry)) {
+    return { skippedReason: "missing-entry" };
+  }
+  const entryDir = path2.dirname(path2.resolve(entry));
+  const searchFrom = workspaceSearchFrom ? path2.resolve(workspaceSearchFrom) : entryDir;
+  const workspaceFile = findPnpmWorkspaceFile(searchFrom);
+  if (!workspaceFile) {
+    return { skippedReason: "missing-workspace-file" };
+  }
+  const policy = readPnpmWorkspacePolicy(workspaceFile);
+  const lines = renderNpmrcLines(policy);
+  if (lines.length === 0) {
+    return { skippedReason: "empty-policy" };
+  }
+  const npmrcPath = path2.join(entryDir, ".npmrc");
+  const existing = fs2.existsSync(npmrcPath) ? fs2.readFileSync(npmrcPath, "utf8") : void 0;
+  const merged = mergeNpmrc(existing, lines);
+  if (merged === existing) {
+    return { npmrcPath, skippedReason: "no-change" };
+  }
+  fs2.writeFileSync(npmrcPath, merged);
+  return { npmrcPath };
+};
+var buildNpmrcCopyCommandHooks = (params) => {
+  const { npmrcPath, existingHooks } = params;
+  return {
+    beforeBundling(inputDir, outputDir) {
+      return existingHooks?.beforeBundling(inputDir, outputDir) ?? [];
+    },
+    beforeInstall(inputDir, outputDir) {
+      const callerCommands = existingHooks?.beforeInstall(inputDir, outputDir) ?? [];
+      const copyCommand = `cp ${npmrcPath} ${inputDir}/.npmrc`;
+      return [...callerCommands, copyCommand];
+    },
+    afterBundling(inputDir, outputDir) {
+      return existingHooks?.afterBundling(inputDir, outputDir) ?? [];
+    }
+  };
+};
+var PnpmWorkspaceNodejsFunction = class extends import_aws_lambda_nodejs.NodejsFunction {
+  constructor(scope, id, props) {
+    let mirrorResult;
+    if (!props.disablePnpmPolicyMirror && props.entry) {
+      mirrorResult = mirrorPnpmWorkspacePolicy({
+        entry: props.entry,
+        workspaceSearchFrom: props.workspaceSearchFrom
+      });
+    }
+    const { disablePnpmPolicyMirror, workspaceSearchFrom, ...rest } = props;
+    void disablePnpmPolicyMirror;
+    void workspaceSearchFrom;
+    const npmrcPath = mirrorResult?.npmrcPath;
+    const shouldWireHook = npmrcPath !== void 0 && fs2.existsSync(npmrcPath);
+    const propsWithHook = shouldWireHook ? {
+      ...rest,
+      bundling: {
+        ...rest.bundling,
+        commandHooks: buildNpmrcCopyCommandHooks({
+          npmrcPath,
+          existingHooks: rest.bundling?.commandHooks
+        })
+      }
+    } : rest;
+    super(scope, id, propsWithHook);
+  }
+};
+
 // src/s3/private-bucket.ts
 var import_aws_cdk_lib = require("aws-cdk-lib");
 var import_aws_s3 = require("aws-cdk-lib/aws-s3");
@@ -239,14 +440,14 @@ var StaticContent = class extends import_constructs.Construct {
 };
 
 // src/static-hosting/static-hosting.ts
-var fs = __toESM(require("fs"));
-var path = __toESM(require("path"));
+var fs3 = __toESM(require("fs"));
+var path3 = __toESM(require("path"));
 var import_aws_cdk_lib2 = require("aws-cdk-lib");
 var import_aws_certificatemanager = require("aws-cdk-lib/aws-certificatemanager");
 var import_aws_cloudfront = require("aws-cdk-lib/aws-cloudfront");
 var import_aws_cloudfront_origins = require("aws-cdk-lib/aws-cloudfront-origins");
 var import_aws_lambda = require("aws-cdk-lib/aws-lambda");
-var import_aws_lambda_nodejs = require("aws-cdk-lib/aws-lambda-nodejs");
+var import_aws_lambda_nodejs2 = require("aws-cdk-lib/aws-lambda-nodejs");
 var import_aws_logs = require("aws-cdk-lib/aws-logs");
 var import_aws_route53 = require("aws-cdk-lib/aws-route53");
 var import_aws_route53_targets = require("aws-cdk-lib/aws-route53-targets");
@@ -292,16 +493,16 @@ var StaticHosting = class extends import_constructs2.Construct {
         })
       });
     }
-    const handlerJs = path.join(
+    const handlerJs = path3.join(
       __dirname,
       "static-hosting.viewer-request-handler.js"
     );
-    const handlerTs = path.join(
+    const handlerTs = path3.join(
       __dirname,
       "static-hosting.viewer-request-handler.ts"
     );
-    const handlerEntry = fs.existsSync(handlerJs) ? handlerJs : handlerTs;
-    const handler = new import_aws_lambda_nodejs.NodejsFunction(this, "viewer-request-handler", {
+    const handlerEntry = fs3.existsSync(handlerJs) ? handlerJs : handlerTs;
+    const handler = new import_aws_lambda_nodejs2.NodejsFunction(this, "viewer-request-handler", {
       entry: handlerEntry,
       handler: hostingMode === "static" ? "staticHandler" : "spaHandler",
       memorySize: 128,
@@ -383,8 +584,16 @@ var StaticHosting = class extends import_constructs2.Construct {
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  PnpmWorkspaceNodejsFunction,
   PrivateBucket,
   StaticContent,
-  StaticHosting
+  StaticHosting,
+  buildNpmrcCopyCommandHooks,
+  findPnpmWorkspaceFile,
+  mergeNpmrc,
+  mirrorPnpmWorkspacePolicy,
+  parseNpmrc,
+  readPnpmWorkspacePolicy,
+  renderNpmrcLines
 });
 //# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../utils/src/aws/aws-types.ts","../../utils/src/git/git-utils.ts","../../utils/src/string/string-utils.ts","../../utils/src/index.ts","../src/index.ts","../src/s3/private-bucket.ts","../src/static-hosting/static-content.ts","../src/static-hosting/static-hosting.ts"],"sourcesContent":["/**\n * Stage Types\n *\n * What stage of deployment is this? Dev, staging, or prod?\n */\nexport const AWS_STAGE_TYPE = {\n  /**\n   * Development environment, typically used for testing and development.\n   */\n  DEV: \"dev\",\n\n  /**\n   * Staging environment, used for pre-production testing.\n   */\n  STAGE: \"stage\",\n\n  /**\n   * Production environment, used for live deployments.\n   */\n  PROD: \"prod\",\n} as const;\n\n/**\n * Above const as a type.\n */\nexport type AwsStageType = (typeof AWS_STAGE_TYPE)[keyof typeof AWS_STAGE_TYPE];\n\n/**\n * Deployment target role: whether an (account, region) is the primary or\n * secondary deployment target (e.g. primary vs replica region).\n */\nexport const DEPLOYMENT_TARGET_ROLE = {\n  /**\n   * Account and region that represents the primary region for this service.\n   * For example, the base DynamoDB Region for global tables.\n   */\n  PRIMARY: \"primary\",\n  /**\n   * Account and region that represents a secondary region for this service.\n   * For example, a replica region for a global DynamoDB table.\n   */\n  SECONDARY: \"secondary\",\n} as const;\n\n/**\n * Type for deployment target role values.\n */\nexport type DeploymentTargetRoleType =\n  (typeof DEPLOYMENT_TARGET_ROLE)[keyof typeof DEPLOYMENT_TARGET_ROLE];\n\n/**\n * Environment types (primary/secondary).\n *\n * @deprecated Use {@link DEPLOYMENT_TARGET_ROLE} instead. This constant is maintained for backward compatibility.\n */\nexport const AWS_ENVIRONMENT_TYPE = DEPLOYMENT_TARGET_ROLE;\n\n/**\n * Type for environment type values.\n *\n * @deprecated Use {@link DeploymentTargetRoleType} instead. This type is maintained for backward compatibility.\n */\nexport type AwsEnvironmentType = DeploymentTargetRoleType;\n","import { execSync } from \"node:child_process\";\n\n/**\n * Returns the current full git branch name\n *\n * ie: feature/1234 returns feature/1234\n *\n */\nexport const findGitBranch = (): string => {\n  return execSync(\"git rev-parse --abbrev-ref HEAD\")\n    .toString(\"utf8\")\n    .replace(/[\\n\\r\\s]+$/, \"\");\n};\n\nexport const findGitRepoName = (): string => {\n  /**\n   * When running in github actions this will be populated.\n   */\n  if (process.env.GITHUB_REPOSITORY) {\n    return process.env.GITHUB_REPOSITORY;\n  }\n\n  /**\n   * locally, we need to extract the repo name from the git config.\n   */\n  const remote = execSync(\"git config --get remote.origin.url\")\n    .toString(\"utf8\")\n    .replace(/[\\n\\r\\s]+$/, \"\")\n    .trim();\n\n  const match = remote.match(/[:\\/]([^/]+\\/[^/]+?)(?:\\.git)?$/);\n  const repoName = match ? match[1] : \"error-repo-name\";\n\n  return repoName;\n};\n","import * as crypto from \"node:crypto\";\n\n/**\n *\n * @param inString - string to hash\n * @param trimLength - trim to this length (defaults to 999 chars)\n * @returns Hex-encoded sha256 digest, truncated to `trimLength` characters.\n */\nexport const hashString = (inString: string, trimLength: number = 999) => {\n  return crypto\n    .createHash(\"sha256\")\n    .update(inString)\n    .digest(\"hex\")\n    .substring(0, trimLength);\n};\n\n/**\n *\n * @param inputString - string to truncate\n * @param maxLength - max length of this string\n * @returns trimmed string\n */\nexport const trimStringLength = (inputString: string, maxLength: number) => {\n  return inputString.length < maxLength\n    ? inputString\n    : inputString.substring(0, maxLength);\n};\n","export * from \"./aws/aws-types\";\nexport * from \"./git/git-utils\";\nexport * from \"./string/string-utils\";\n","export * from \"./s3\";\nexport * from \"./static-hosting\";\n","import { RemovalPolicy } from \"aws-cdk-lib\";\nimport {\n  BlockPublicAccess,\n  Bucket,\n  BucketProps,\n  ObjectOwnership,\n} from \"aws-cdk-lib/aws-s3\";\nimport { Construct } from \"constructs\";\n\nexport interface PrivateBucketProps extends BucketProps {}\n\nexport class PrivateBucket extends Bucket {\n  constructor(scope: Construct, id: string, props: PrivateBucketProps = {}) {\n    const defaultProps = {\n      removalPolicy: props.removalPolicy ?? RemovalPolicy.RETAIN,\n      autoDeleteObjects: props.removalPolicy === RemovalPolicy.DESTROY,\n    };\n\n    const requiredProps = {\n      publicReadAccess: false,\n      blockPublicAccess: BlockPublicAccess.BLOCK_ALL,\n      enforceSSL: true,\n      objectOwnership: ObjectOwnership.BUCKET_OWNER_ENFORCED,\n    };\n\n    super(scope, id, { ...defaultProps, ...props, ...requiredProps });\n  }\n}\n","// eslint-disable-next-line import/no-extraneous-dependencies\nimport { findGitBranch } from \"@codedrifters/utils\";\nimport { Bucket } from \"aws-cdk-lib/aws-s3\";\nimport { BucketDeployment, Source } from \"aws-cdk-lib/aws-s3-deployment\";\nimport { StringParameter } from \"aws-cdk-lib/aws-ssm\";\nimport { paramCase } from \"change-case\";\nimport { Construct } from \"constructs\";\n\n/*******************************************************************************\n *\n *  STATIC CONTENT UPLOADER\n *\n *  This construct uploads a directory of content from a local location into S3.\n *\n *  To support PR and branch specific builds, each S3 bucket can store content\n *  for multiple domains and builds, using the following format:\n *\n *  S3-bucket/domain/*\n *\n *  A bucket used to store content for stage.openhi.org might have the\n *  following directory structure (all in the same bucket).\n *\n *  `/stage.openhi.org/*` serves content to stage.openhi.org\n *  `/feature-7.stage.openhi.org/*` serves content to feature-7.stage.openhi.org\n *  `/pr-123.stage.openhi.org/*` serves content to pr-123.stage.openhi.org\n *\n ******************************************************************************/\n\nexport interface StaticContentProps {\n  /**\n   * Parameter name to use when storing the static hosting bucket's ARN.\n   * This is needed in other later steps when deploying hosted content to S3.\n   */\n  readonly bucketArnParamName?: string;\n\n  /**\n   *  Absolute path to directory containing content for the website.\n   */\n  readonly contentSourceDirectory: string;\n\n  /**\n   *  Directory to place content into. Should start with a slash.\n   *  Example: '/widget'\n   */\n  readonly contentDestinationDirectory: string;\n\n  /**\n   *  The sub domain prefix (ie: images)\n   *\n   * @default git branch name\n   */\n  readonly subDomain?: string;\n\n  /**\n   *  The full domain (ie: staging.codedrifters.com)\n   */\n  readonly fullDomain: string;\n}\n\nexport class StaticContent extends Construct {\n  constructor(scope: Construct, id: string, props: StaticContentProps) {\n    super(scope, id);\n\n    /***************************************************************************\n     *\n     * Initial Setup\n     *\n     * Set some defaults, build domain information.\n     *\n     **************************************************************************/\n\n    const {\n      bucketArnParamName,\n      contentSourceDirectory,\n      contentDestinationDirectory,\n      subDomain,\n      fullDomain,\n    } = {\n      bucketArnParamName: \"/STATIC_WEBSITE/BUCKET_ARN\",\n      subDomain: findGitBranch(),\n      ...props,\n    };\n\n    /***************************************************************************\n     *\n     * Import and build some values from Param Store during deployment.\n     *\n     **************************************************************************/\n\n    const keyPrefix = [paramCase(subDomain), fullDomain].join(\".\");\n\n    const bucketArn = StringParameter.valueForStringParameter(\n      this,\n      bucketArnParamName,\n    );\n    const bucket = Bucket.fromBucketArn(this, \"bucket\", bucketArn);\n\n    /***************************************************************************\n     *\n     * Gather the sources we'll be deploying. We need to have an empty source\n     * for tests since it will change all the time and bork up the test\n     * snapshots if we don't.\n     *\n     **************************************************************************/\n\n    const isTestEnv = process.env.VITEST === \"true\";\n    const sources = isTestEnv ? [] : [Source.asset(contentSourceDirectory)];\n\n    new BucketDeployment(this, \"deploy\", {\n      sources,\n      destinationBucket: bucket,\n      retainOnDelete: false,\n      destinationKeyPrefix: `${keyPrefix}${contentDestinationDirectory}`,\n    });\n  }\n}\n","import * as fs from \"fs\";\nimport * as path from \"path\";\nimport { Duration, StackProps } from \"aws-cdk-lib\";\nimport {\n  Certificate,\n  CertificateValidation,\n} from \"aws-cdk-lib/aws-certificatemanager\";\nimport {\n  AccessLevel,\n  AllowedMethods,\n  CacheCookieBehavior,\n  CacheHeaderBehavior,\n  CachePolicy,\n  CacheQueryStringBehavior,\n  Distribution,\n  LambdaEdgeEventType,\n  S3OriginAccessControl,\n  Signing,\n  ViewerProtocolPolicy,\n} from \"aws-cdk-lib/aws-cloudfront\";\nimport { S3BucketOrigin } from \"aws-cdk-lib/aws-cloudfront-origins\";\nimport { Runtime } from \"aws-cdk-lib/aws-lambda\";\nimport { NodejsFunction } from \"aws-cdk-lib/aws-lambda-nodejs\";\nimport { LogGroup, RetentionDays } from \"aws-cdk-lib/aws-logs\";\nimport {\n  ARecord,\n  HostedZone,\n  HostedZoneAttributes,\n  IHostedZone,\n  RecordTarget,\n} from \"aws-cdk-lib/aws-route53\";\nimport { CloudFrontTarget } from \"aws-cdk-lib/aws-route53-targets\";\nimport { StringParameter } from \"aws-cdk-lib/aws-ssm\";\nimport { Construct } from \"constructs\";\nimport type { HostingMode } from \"./static-hosting.viewer-request-handler\";\nimport { PrivateBucket, PrivateBucketProps } from \"../s3/private-bucket\";\n\nexport interface StaticDomainProps {\n  /**\n   *  The base domain (ie: codedrifters.com)\n   */\n  readonly baseDomain: string;\n\n  /**\n   * Hosted zone ID for the base domain.\n   */\n  readonly hostedZoneAttributes: HostedZoneAttributes;\n}\n\nexport interface StaticHostingProps extends StackProps {\n  /**\n   * Short description used in various places for traceability.\n   */\n  readonly description?: string;\n\n  /**\n   * Values used to connect a domain name to the cloudfront distribution. If not\n   * supplied, cloudfront doesn't use a custom domain.\n   */\n  readonly staticDomainProps?: StaticDomainProps;\n\n  /**\n   * Parameter name to use when storing the static hosting bucket's ARN.\n   * This is needed in other later steps when deploying hosted content to S3.\n   */\n  readonly bucketArnParamName?: string;\n\n  /**\n   * Parameter name to use when storing the CloudFront Distribution Domain Name.\n   */\n  readonly distributionDomainParamName?: string;\n\n  /**\n   * Parameter name to use when storing the CloudFront Distribution ID.\n   */\n  readonly distributionIDParamName?: string;\n\n  /**\n   * Props to pass to the private S3 bucket.\n   */\n  readonly privateBucketProps?: PrivateBucketProps;\n\n  /**\n   * Selects how path-like URIs are rewritten by the viewer-request\n   * `Lambda@Edge` handler.\n   *\n   * - `spa` (default): path-like URIs rewrite to `/index.html` so a\n   *   single-page app can serve its one root index and let the client-side\n   *   router handle the path.\n   * - `static`: path-like URIs append `/index.html` (e.g. `/docs` →\n   *   `/docs/index.html`) so multi-page static sites can serve distinct\n   *   HTML per path.\n   *\n   * Multi-tenant domain-folder prepending runs after the rewrite in both\n   * modes and is unaffected by this prop.\n   *\n   * @default \"spa\"\n   */\n  readonly hostingMode?: HostingMode;\n}\n\nexport class StaticHosting extends Construct {\n  /**\n   * Full domain name used as basis for hosting.\n   */\n  public readonly fullDomain: string;\n\n  constructor(scope: Construct, id: string, props: StaticHostingProps = {}) {\n    super(scope, id);\n\n    /***************************************************************************\n     *\n     * Initial Setup\n     *\n     * Set some defaults, build domain information.\n     *\n     **************************************************************************/\n\n    const {\n      bucketArnParamName,\n      distributionDomainParamName,\n      distributionIDParamName,\n      staticDomainProps,\n      privateBucketProps,\n      hostingMode,\n    } = {\n      bucketArnParamName: \"/STATIC_WEBSITE/BUCKET_ARN\",\n      distributionDomainParamName: \"/STATIC_WEBSITE/DISTRIBUTION_DOMAIN\",\n      distributionIDParamName: \"/STATIC_WEBSITE/DISTRIBUTION_ID\",\n      hostingMode: \"spa\" as HostingMode,\n      ...props,\n    };\n\n    const { baseDomain, hostedZoneAttributes } = staticDomainProps ?? {};\n\n    /***************************************************************************\n     *\n     * PRIVATE BUCKET\n     *\n     * A bucket to store the files within.\n     * Save ARN for later deploys.\n     *\n     **************************************************************************/\n\n    const bucket = new PrivateBucket(\n      this,\n      \"static-hosting-bucket\",\n      privateBucketProps,\n    );\n\n    /***************************************************************************\n     *\n     * DNS & Wildcard Certificate\n     *\n     * If a zone Id as passed in, find the hosted zone and create a wildcard\n     * certificate for the domain.\n     *\n     **************************************************************************/\n\n    let zone: IHostedZone | undefined;\n    let certificate: Certificate | undefined;\n\n    if (hostedZoneAttributes && baseDomain) {\n      zone = HostedZone.fromHostedZoneAttributes(\n        this,\n        \"zone\",\n        hostedZoneAttributes,\n      );\n      certificate = new Certificate(this, \"wildcard-certificate\", {\n        domainName: `*.${baseDomain}`,\n        subjectAlternativeNames: [baseDomain],\n        validation: CertificateValidation.fromDnsMultiZone({\n          [`*.${baseDomain}`]: zone,\n          [baseDomain]: zone,\n        }),\n      });\n    }\n\n    /******************************************************************************\n     *\n     * `LAMBDA@EDGE` FUNCTION\n     *\n     * This handles rewriting the path from domain name.\n     *\n     *****************************************************************************/\n\n    // Explicit entry required: when omitted, NodejsFunction infers the path from the\n    // call site (the built lib/index.js), so it looks for index.viewer-request-handler.js\n    // in the package. That file is only emitted if we add it as a separate tsup entry.\n    // Use .js when present (built package); fall back to .ts for tests running from source.\n    const handlerJs = path.join(\n      __dirname,\n      \"static-hosting.viewer-request-handler.js\",\n    );\n    const handlerTs = path.join(\n      __dirname,\n      \"static-hosting.viewer-request-handler.ts\",\n    );\n    const handlerEntry = fs.existsSync(handlerJs) ? handlerJs : handlerTs;\n\n    const handler = new NodejsFunction(this, \"viewer-request-handler\", {\n      entry: handlerEntry,\n      handler: hostingMode === \"static\" ? \"staticHandler\" : \"spaHandler\",\n      memorySize: 128,\n      runtime: Runtime.NODEJS_24_X,\n      logGroup: new LogGroup(this, \"viewer-request-handler-log-group\", {\n        retention: RetentionDays.ONE_MONTH,\n      }),\n    });\n\n    /******************************************************************************\n     *\n     *  CLOUDFRONT CONFIG\n     *\n     *  Setup a CloudFront Distribution for the bucket.\n     *\n     *****************************************************************************/\n\n    const cachePolicy = new CachePolicy(this, \"cloudfront-policy\", {\n      comment: \"Relatively conservative TTL policy.\",\n      maxTtl: Duration.seconds(300),\n      minTtl: Duration.seconds(0),\n      defaultTtl: Duration.seconds(60),\n      headerBehavior: CacheHeaderBehavior.none(),\n      queryStringBehavior: CacheQueryStringBehavior.none(),\n      cookieBehavior: CacheCookieBehavior.none(),\n      enableAcceptEncodingGzip: true,\n      enableAcceptEncodingBrotli: true,\n    });\n\n    const oac = new S3OriginAccessControl(this, \"MyOAC\", {\n      signing: Signing.SIGV4_NO_OVERRIDE,\n    });\n    const origin = S3BucketOrigin.withOriginAccessControl(bucket, {\n      originAccessControl: oac,\n      originAccessLevels: [AccessLevel.READ],\n    });\n\n    const distribution = new Distribution(this, \"cloudfront-distribution\", {\n      comment: `Distribution for ${props.description ?? id}`,\n\n      /**\n       * Only if domain was supplied\n       */\n      ...(certificate && baseDomain\n        ? {\n            certificate,\n            domainNames: [baseDomain, `*.${baseDomain}`],\n          }\n        : {}),\n\n      defaultBehavior: {\n        origin,\n        viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,\n        cachePolicy,\n        allowedMethods: AllowedMethods.ALLOW_GET_HEAD_OPTIONS,\n        edgeLambdas: [\n          {\n            functionVersion: handler.currentVersion,\n            eventType: LambdaEdgeEventType.VIEWER_REQUEST,\n          },\n        ],\n      },\n      defaultRootObject: \"index.html\",\n    });\n\n    /**\n     * We finally have enough information to set the full domain.\n     */\n    this.fullDomain =\n      certificate && baseDomain ? baseDomain : distribution.domainName;\n\n    /***************************************************************************\n     *\n     *  DNS ENTRY\n     *\n     * Link cloudfront to both the root fulldomain and all possible subdomains.\n     *\n     **************************************************************************/\n\n    if (zone) {\n      new ARecord(this, \"root-dns-entry\", {\n        zone,\n        recordName: baseDomain ? baseDomain : \"\",\n        target: RecordTarget.fromAlias(new CloudFrontTarget(distribution)),\n      });\n\n      new ARecord(this, \"wc-dns-entry\", {\n        zone,\n        recordName: baseDomain ? `*.${baseDomain}` : \"*\",\n        target: RecordTarget.fromAlias(new CloudFrontTarget(distribution)),\n      });\n    }\n\n    /***************************************************************************\n     *\n     * EXPORTS\n     *\n     * Used by content uploader later.\n     *\n     **************************************************************************/\n\n    new StringParameter(this, \"dist-domain\", {\n      description: `GENERATED DO NOT CHANGE - CloudFront Distribution Details (${props.description ?? id}).`,\n      parameterName: distributionDomainParamName,\n      stringValue: distribution.domainName,\n    });\n\n    new StringParameter(this, \"dist-id\", {\n      description: `GENERATED DO NOT CHANGE - CloudFront Distribution Details (${props.description ?? id}).`,\n      parameterName: distributionIDParamName,\n      stringValue: distribution.distributionId,\n    });\n\n    new StringParameter(this, \"bucket-arn\", {\n      description: `GENERATED DO NOT CHANGE - S3 Bucket ARN for (${props.description ?? id}).`,\n      parameterName: bucketArnParamName,\n      stringValue: bucket.bucketArn,\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKa,IAAAA,SAAA,iBAAiB;;;;MAI5B,KAAK;;;;MAKL,OAAO;;;;MAKP,MAAM;;AAYK,IAAAA,SAAA,yBAAyB;;;;;MAKpC,SAAS;;;;;MAKT,WAAW;;AAcA,IAAAA,SAAA,uBAAuBA,SAAA;;;;;;;;;;ACvDpC,QAAA,uBAAA,QAAA,eAAA;AAQO,QAAMC,iBAAgB,MAAa;AACxC,cAAO,GAAA,qBAAA,UAAS,iCAAiC,EAC9C,SAAS,MAAM,EACf,QAAQ,cAAc,EAAE;IAC7B;AAJa,IAAAC,SAAA,gBAAaD;AAMnB,QAAM,kBAAkB,MAAa;AAI1C,UAAI,QAAQ,IAAI,mBAAmB;AACjC,eAAO,QAAQ,IAAI;MACrB;AAKA,YAAM,UAAS,GAAA,qBAAA,UAAS,oCAAoC,EACzD,SAAS,MAAM,EACf,QAAQ,cAAc,EAAE,EACxB,KAAI;AAEP,YAAM,QAAQ,OAAO,MAAM,iCAAiC;AAC5D,YAAM,WAAW,QAAQ,MAAM,CAAC,IAAI;AAEpC,aAAO;IACT;AApBa,IAAAC,SAAA,kBAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACd5B,QAAA,SAAA,aAAA,QAAA,QAAA,CAAA;AAQO,QAAM,aAAa,CAAC,UAAkB,aAAqB,QAAO;AACvE,aAAO,OACJ,WAAW,QAAQ,EACnB,OAAO,QAAQ,EACf,OAAO,KAAK,EACZ,UAAU,GAAG,UAAU;IAC5B;AANa,IAAAC,SAAA,aAAU;AAchB,QAAM,mBAAmB,CAAC,aAAqB,cAAqB;AACzE,aAAO,YAAY,SAAS,YACxB,cACA,YAAY,UAAU,GAAG,SAAS;IACxC;AAJa,IAAAA,SAAA,mBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;ACtB7B,iBAAA,qBAAAC,QAAA;AACA,iBAAA,qBAAAA,QAAA;AACA,iBAAA,wBAAAA,QAAA;;;;;ACFA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,yBAA8B;AAC9B,oBAKO;AAKA,IAAM,gBAAN,cAA4B,qBAAO;AAAA,EACxC,YAAY,OAAkB,IAAY,QAA4B,CAAC,GAAG;AACxE,UAAM,eAAe;AAAA,MACnB,eAAe,MAAM,iBAAiB,iCAAc;AAAA,MACpD,mBAAmB,MAAM,kBAAkB,iCAAc;AAAA,IAC3D;AAEA,UAAM,gBAAgB;AAAA,MACpB,kBAAkB;AAAA,MAClB,mBAAmB,gCAAkB;AAAA,MACrC,YAAY;AAAA,MACZ,iBAAiB,8BAAgB;AAAA,IACnC;AAEA,UAAM,OAAO,IAAI,EAAE,GAAG,cAAc,GAAG,OAAO,GAAG,cAAc,CAAC;AAAA,EAClE;AACF;;;AC1BA,mBAA8B;AAC9B,IAAAC,iBAAuB;AACvB,+BAAyC;AACzC,qBAAgC;AAChC,yBAA0B;AAC1B,wBAA0B;AAqDnB,IAAM,gBAAN,cAA4B,4BAAU;AAAA,EAC3C,YAAY,OAAkB,IAAY,OAA2B;AACnE,UAAM,OAAO,EAAE;AAUf,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IAAI;AAAA,MACF,oBAAoB;AAAA,MACpB,eAAW,4BAAc;AAAA,MACzB,GAAG;AAAA,IACL;AAQA,UAAM,YAAY,KAAC,8BAAU,SAAS,GAAG,UAAU,EAAE,KAAK,GAAG;AAE7D,UAAM,YAAY,+BAAgB;AAAA,MAChC;AAAA,MACA;AAAA,IACF;AACA,UAAM,SAAS,sBAAO,cAAc,MAAM,UAAU,SAAS;AAU7D,UAAM,YAAY,QAAQ,IAAI,WAAW;AACzC,UAAM,UAAU,YAAY,CAAC,IAAI,CAAC,gCAAO,MAAM,sBAAsB,CAAC;AAEtE,QAAI,0CAAiB,MAAM,UAAU;AAAA,MACnC;AAAA,MACA,mBAAmB;AAAA,MACnB,gBAAgB;AAAA,MAChB,sBAAsB,GAAG,SAAS,GAAG,2BAA2B;AAAA,IAClE,CAAC;AAAA,EACH;AACF;;;ACnHA,SAAoB;AACpB,WAAsB;AACtB,IAAAC,sBAAqC;AACrC,oCAGO;AACP,4BAYO;AACP,oCAA+B;AAC/B,wBAAwB;AACxB,+BAA+B;AAC/B,sBAAwC;AACxC,yBAMO;AACP,iCAAiC;AACjC,IAAAC,kBAAgC;AAChC,IAAAC,qBAA0B;AAoEnB,IAAM,gBAAN,cAA4B,6BAAU;AAAA,EAM3C,YAAY,OAAkB,IAAY,QAA4B,CAAC,GAAG;AACxE,UAAM,OAAO,EAAE;AAUf,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IAAI;AAAA,MACF,oBAAoB;AAAA,MACpB,6BAA6B;AAAA,MAC7B,yBAAyB;AAAA,MACzB,aAAa;AAAA,MACb,GAAG;AAAA,IACL;AAEA,UAAM,EAAE,YAAY,qBAAqB,IAAI,qBAAqB,CAAC;AAWnE,UAAM,SAAS,IAAI;AAAA,MACjB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAWA,QAAI;AACJ,QAAI;AAEJ,QAAI,wBAAwB,YAAY;AACtC,aAAO,8BAAW;AAAA,QAChB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,oBAAc,IAAI,0CAAY,MAAM,wBAAwB;AAAA,QAC1D,YAAY,KAAK,UAAU;AAAA,QAC3B,yBAAyB,CAAC,UAAU;AAAA,QACpC,YAAY,oDAAsB,iBAAiB;AAAA,UACjD,CAAC,KAAK,UAAU,EAAE,GAAG;AAAA,UACrB,CAAC,UAAU,GAAG;AAAA,QAChB,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AAcA,UAAM,YAAiB;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AACA,UAAM,YAAiB;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AACA,UAAM,eAAkB,cAAW,SAAS,IAAI,YAAY;AAE5D,UAAM,UAAU,IAAI,wCAAe,MAAM,0BAA0B;AAAA,MACjE,OAAO;AAAA,MACP,SAAS,gBAAgB,WAAW,kBAAkB;AAAA,MACtD,YAAY;AAAA,MACZ,SAAS,0BAAQ;AAAA,MACjB,UAAU,IAAI,yBAAS,MAAM,oCAAoC;AAAA,QAC/D,WAAW,8BAAc;AAAA,MAC3B,CAAC;AAAA,IACH,CAAC;AAUD,UAAM,cAAc,IAAI,kCAAY,MAAM,qBAAqB;AAAA,MAC7D,SAAS;AAAA,MACT,QAAQ,6BAAS,QAAQ,GAAG;AAAA,MAC5B,QAAQ,6BAAS,QAAQ,CAAC;AAAA,MAC1B,YAAY,6BAAS,QAAQ,EAAE;AAAA,MAC/B,gBAAgB,0CAAoB,KAAK;AAAA,MACzC,qBAAqB,+CAAyB,KAAK;AAAA,MACnD,gBAAgB,0CAAoB,KAAK;AAAA,MACzC,0BAA0B;AAAA,MAC1B,4BAA4B;AAAA,IAC9B,CAAC;AAED,UAAM,MAAM,IAAI,4CAAsB,MAAM,SAAS;AAAA,MACnD,SAAS,8BAAQ;AAAA,IACnB,CAAC;AACD,UAAM,SAAS,6CAAe,wBAAwB,QAAQ;AAAA,MAC5D,qBAAqB;AAAA,MACrB,oBAAoB,CAAC,kCAAY,IAAI;AAAA,IACvC,CAAC;AAED,UAAM,eAAe,IAAI,mCAAa,MAAM,2BAA2B;AAAA,MACrE,SAAS,oBAAoB,MAAM,eAAe,EAAE;AAAA;AAAA;AAAA;AAAA,MAKpD,GAAI,eAAe,aACf;AAAA,QACE;AAAA,QACA,aAAa,CAAC,YAAY,KAAK,UAAU,EAAE;AAAA,MAC7C,IACA,CAAC;AAAA,MAEL,iBAAiB;AAAA,QACf;AAAA,QACA,sBAAsB,2CAAqB;AAAA,QAC3C;AAAA,QACA,gBAAgB,qCAAe;AAAA,QAC/B,aAAa;AAAA,UACX;AAAA,YACE,iBAAiB,QAAQ;AAAA,YACzB,WAAW,0CAAoB;AAAA,UACjC;AAAA,QACF;AAAA,MACF;AAAA,MACA,mBAAmB;AAAA,IACrB,CAAC;AAKD,SAAK,aACH,eAAe,aAAa,aAAa,aAAa;AAUxD,QAAI,MAAM;AACR,UAAI,2BAAQ,MAAM,kBAAkB;AAAA,QAClC;AAAA,QACA,YAAY,aAAa,aAAa;AAAA,QACtC,QAAQ,gCAAa,UAAU,IAAI,4CAAiB,YAAY,CAAC;AAAA,MACnE,CAAC;AAED,UAAI,2BAAQ,MAAM,gBAAgB;AAAA,QAChC;AAAA,QACA,YAAY,aAAa,KAAK,UAAU,KAAK;AAAA,QAC7C,QAAQ,gCAAa,UAAU,IAAI,4CAAiB,YAAY,CAAC;AAAA,MACnE,CAAC;AAAA,IACH;AAUA,QAAI,gCAAgB,MAAM,eAAe;AAAA,MACvC,aAAa,8DAA8D,MAAM,eAAe,EAAE;AAAA,MAClG,eAAe;AAAA,MACf,aAAa,aAAa;AAAA,IAC5B,CAAC;AAED,QAAI,gCAAgB,MAAM,WAAW;AAAA,MACnC,aAAa,8DAA8D,MAAM,eAAe,EAAE;AAAA,MAClG,eAAe;AAAA,MACf,aAAa,aAAa;AAAA,IAC5B,CAAC;AAED,QAAI,gCAAgB,MAAM,cAAc;AAAA,MACtC,aAAa,gDAAgD,MAAM,eAAe,EAAE;AAAA,MACpF,eAAe;AAAA,MACf,aAAa,OAAO;AAAA,IACtB,CAAC;AAAA,EACH;AACF;","names":["exports","findGitBranch","exports","exports","exports","import_aws_s3","import_aws_cdk_lib","import_aws_ssm","import_constructs"]}
+{"version":3,"sources":["../../utils/src/aws/aws-types.ts","../../utils/src/git/git-utils.ts","../../utils/src/string/string-utils.ts","../../utils/src/index.ts","../src/index.ts","../src/lambda/pnpm-workspace-nodejs-function.ts","../src/lambda/pnpm-workspace-parser.ts","../src/s3/private-bucket.ts","../src/static-hosting/static-content.ts","../src/static-hosting/static-hosting.ts"],"sourcesContent":["/**\n * Stage Types\n *\n * What stage of deployment is this? Dev, staging, or prod?\n */\nexport const AWS_STAGE_TYPE = {\n  /**\n   * Development environment, typically used for testing and development.\n   */\n  DEV: \"dev\",\n\n  /**\n   * Staging environment, used for pre-production testing.\n   */\n  STAGE: \"stage\",\n\n  /**\n   * Production environment, used for live deployments.\n   */\n  PROD: \"prod\",\n} as const;\n\n/**\n * Above const as a type.\n */\nexport type AwsStageType = (typeof AWS_STAGE_TYPE)[keyof typeof AWS_STAGE_TYPE];\n\n/**\n * Deployment target role: whether an (account, region) is the primary or\n * secondary deployment target (e.g. primary vs replica region).\n */\nexport const DEPLOYMENT_TARGET_ROLE = {\n  /**\n   * Account and region that represents the primary region for this service.\n   * For example, the base DynamoDB Region for global tables.\n   */\n  PRIMARY: \"primary\",\n  /**\n   * Account and region that represents a secondary region for this service.\n   * For example, a replica region for a global DynamoDB table.\n   */\n  SECONDARY: \"secondary\",\n} as const;\n\n/**\n * Type for deployment target role values.\n */\nexport type DeploymentTargetRoleType =\n  (typeof DEPLOYMENT_TARGET_ROLE)[keyof typeof DEPLOYMENT_TARGET_ROLE];\n\n/**\n * Environment types (primary/secondary).\n *\n * @deprecated Use {@link DEPLOYMENT_TARGET_ROLE} instead. This constant is maintained for backward compatibility.\n */\nexport const AWS_ENVIRONMENT_TYPE = DEPLOYMENT_TARGET_ROLE;\n\n/**\n * Type for environment type values.\n *\n * @deprecated Use {@link DeploymentTargetRoleType} instead. This type is maintained for backward compatibility.\n */\nexport type AwsEnvironmentType = DeploymentTargetRoleType;\n","import { execSync } from \"node:child_process\";\n\n/**\n * Returns the current full git branch name\n *\n * ie: feature/1234 returns feature/1234\n *\n */\nexport const findGitBranch = (): string => {\n  return execSync(\"git rev-parse --abbrev-ref HEAD\")\n    .toString(\"utf8\")\n    .replace(/[\\n\\r\\s]+$/, \"\");\n};\n\nexport const findGitRepoName = (): string => {\n  /**\n   * When running in github actions this will be populated.\n   */\n  if (process.env.GITHUB_REPOSITORY) {\n    return process.env.GITHUB_REPOSITORY;\n  }\n\n  /**\n   * locally, we need to extract the repo name from the git config.\n   */\n  const remote = execSync(\"git config --get remote.origin.url\")\n    .toString(\"utf8\")\n    .replace(/[\\n\\r\\s]+$/, \"\")\n    .trim();\n\n  const match = remote.match(/[:\\/]([^/]+\\/[^/]+?)(?:\\.git)?$/);\n  const repoName = match ? match[1] : \"error-repo-name\";\n\n  return repoName;\n};\n","import * as crypto from \"node:crypto\";\n\n/**\n *\n * @param inString - string to hash\n * @param trimLength - trim to this length (defaults to 999 chars)\n * @returns Hex-encoded sha256 digest, truncated to `trimLength` characters.\n */\nexport const hashString = (inString: string, trimLength: number = 999) => {\n  return crypto\n    .createHash(\"sha256\")\n    .update(inString)\n    .digest(\"hex\")\n    .substring(0, trimLength);\n};\n\n/**\n *\n * @param inputString - string to truncate\n * @param maxLength - max length of this string\n * @returns trimmed string\n */\nexport const trimStringLength = (inputString: string, maxLength: number) => {\n  return inputString.length < maxLength\n    ? inputString\n    : inputString.substring(0, maxLength);\n};\n","export * from \"./aws/aws-types\";\nexport * from \"./git/git-utils\";\nexport * from \"./string/string-utils\";\n","export * from \"./lambda\";\nexport * from \"./s3\";\nexport * from \"./static-hosting\";\n","import * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport {\n  ICommandHooks,\n  NodejsFunction,\n  NodejsFunctionProps,\n} from \"aws-cdk-lib/aws-lambda-nodejs\";\nimport { Construct } from \"constructs\";\nimport {\n  findPnpmWorkspaceFile,\n  mergeNpmrc,\n  readPnpmWorkspacePolicy,\n  renderNpmrcLines,\n} from \"./pnpm-workspace-parser\";\n\n/**\n * Props for `PnpmWorkspaceNodejsFunction`. Extends\n * `NodejsFunctionProps` so the wrapper is a drop-in for any existing\n * `NodejsFunction` call site.\n */\nexport interface PnpmWorkspaceNodejsFunctionProps extends NodejsFunctionProps {\n  /**\n   * Directory to begin the upward search for `pnpm-workspace.yaml`.\n   * Defaults to the directory of the resolved entry path.\n   */\n  readonly workspaceSearchFrom?: string;\n\n  /**\n   * Skip the policy-mirror step entirely. Useful for tests or when the\n   * caller wants the pure `NodejsFunction` behavior.\n   *\n   * @default false\n   */\n  readonly disablePnpmPolicyMirror?: boolean;\n}\n\n/**\n * Result of `mirrorPnpmWorkspacePolicy` — describes what the policy\n * mirror did for one entry.\n */\nexport interface MirrorPnpmWorkspacePolicyResult {\n  /** Resolved `.npmrc` path if a write happened, otherwise undefined. */\n  readonly npmrcPath?: string;\n  /** Reason the mirror was a no-op, if it was. */\n  readonly skippedReason?:\n    | \"missing-entry\"\n    | \"missing-workspace-file\"\n    | \"empty-policy\"\n    | \"no-change\";\n}\n\n/**\n * Mirror the workspace pnpm policy into an `.npmrc` adjacent to the\n * Lambda entry. Pure side-effect helper used by\n * `PnpmWorkspaceNodejsFunction`; exported so consumers can drive it\n * from other call sites if desired.\n */\nexport const mirrorPnpmWorkspacePolicy = (params: {\n  readonly entry: string;\n  readonly workspaceSearchFrom?: string;\n}): MirrorPnpmWorkspacePolicyResult => {\n  const { entry, workspaceSearchFrom } = params;\n  if (!fs.existsSync(entry)) {\n    return { skippedReason: \"missing-entry\" };\n  }\n\n  const entryDir = path.dirname(path.resolve(entry));\n  const searchFrom = workspaceSearchFrom\n    ? path.resolve(workspaceSearchFrom)\n    : entryDir;\n\n  const workspaceFile = findPnpmWorkspaceFile(searchFrom);\n  if (!workspaceFile) {\n    return { skippedReason: \"missing-workspace-file\" };\n  }\n\n  const policy = readPnpmWorkspacePolicy(workspaceFile);\n  const lines = renderNpmrcLines(policy);\n  if (lines.length === 0) {\n    return { skippedReason: \"empty-policy\" };\n  }\n\n  const npmrcPath = path.join(entryDir, \".npmrc\");\n  const existing = fs.existsSync(npmrcPath)\n    ? fs.readFileSync(npmrcPath, \"utf8\")\n    : undefined;\n  const merged = mergeNpmrc(existing, lines);\n\n  if (merged === existing) {\n    return { npmrcPath, skippedReason: \"no-change\" };\n  }\n\n  fs.writeFileSync(npmrcPath, merged);\n  return { npmrcPath };\n};\n\n/**\n * Build an `ICommandHooks` implementation that copies an\n * entry-adjacent `.npmrc` into the bundling input directory before\n * `pnpm install` runs. Composes with any caller-supplied hooks so\n * existing `beforeBundling` / `beforeInstall` / `afterBundling`\n * commands are preserved.\n *\n * Exported for unit testing; the construct wires this automatically.\n */\nexport const buildNpmrcCopyCommandHooks = (params: {\n  readonly npmrcPath: string;\n  readonly existingHooks?: ICommandHooks;\n}): ICommandHooks => {\n  const { npmrcPath, existingHooks } = params;\n  return {\n    beforeBundling(inputDir: string, outputDir: string): string[] {\n      return existingHooks?.beforeBundling(inputDir, outputDir) ?? [];\n    },\n    beforeInstall(inputDir: string, outputDir: string): string[] {\n      const callerCommands =\n        existingHooks?.beforeInstall(inputDir, outputDir) ?? [];\n      const copyCommand = `cp ${npmrcPath} ${inputDir}/.npmrc`;\n      return [...callerCommands, copyCommand];\n    },\n    afterBundling(inputDir: string, outputDir: string): string[] {\n      return existingHooks?.afterBundling(inputDir, outputDir) ?? [];\n    },\n  };\n};\n\n/**\n * A `NodejsFunction` wrapper that mirrors the workspace's pnpm policy\n * (currently `minimumReleaseAge` and `minimumReleaseAgeExclude`) into\n * an `.npmrc` adjacent to the Lambda entry before bundling.\n *\n * CDK's bundler runs `pnpm install` in an isolated temp directory\n * outside the workspace, which means `pnpm-workspace.yaml` settings\n * do not apply there. CDK does **not** copy arbitrary entry-adjacent\n * files into the bundling input directory, so the construct also\n * wires a `bundling.commandHooks.beforeInstall` hook that copies the\n * rendered `.npmrc` into the bundling input directory immediately\n * before `pnpm install` runs. Caller-supplied `commandHooks` are\n * preserved — the copy command is appended to whatever the caller\n * already returns from `beforeInstall`.\n *\n * See the `pnpm-workspace-nodejs-function` documentation page for\n * full details on what gets mirrored, merge behaviour against an\n * existing `.npmrc`, and when to disable the mirror.\n */\nexport class PnpmWorkspaceNodejsFunction extends NodejsFunction {\n  constructor(\n    scope: Construct,\n    id: string,\n    props: PnpmWorkspaceNodejsFunctionProps,\n  ) {\n    let mirrorResult: MirrorPnpmWorkspacePolicyResult | undefined;\n    if (!props.disablePnpmPolicyMirror && props.entry) {\n      mirrorResult = mirrorPnpmWorkspacePolicy({\n        entry: props.entry,\n        workspaceSearchFrom: props.workspaceSearchFrom,\n      });\n    }\n\n    const { disablePnpmPolicyMirror, workspaceSearchFrom, ...rest } = props;\n    void disablePnpmPolicyMirror;\n    void workspaceSearchFrom;\n\n    // Wire the beforeInstall hook only when the mirror produced (or\n    // confirmed) an .npmrc file on disk. Other skippedReason values\n    // (`missing-entry`, `missing-workspace-file`, `empty-policy`) mean\n    // there is nothing to copy; falling through to plain NodejsFunction\n    // behavior is correct in those cases.\n    const npmrcPath = mirrorResult?.npmrcPath;\n    const shouldWireHook = npmrcPath !== undefined && fs.existsSync(npmrcPath);\n\n    const propsWithHook: NodejsFunctionProps = shouldWireHook\n      ? {\n          ...rest,\n          bundling: {\n            ...rest.bundling,\n            commandHooks: buildNpmrcCopyCommandHooks({\n              npmrcPath,\n              existingHooks: rest.bundling?.commandHooks,\n            }),\n          },\n        }\n      : rest;\n\n    super(scope, id, propsWithHook);\n  }\n}\n","import * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport * as yaml from \"js-yaml\";\n\n/**\n * Subset of `pnpm-workspace.yaml` fields that map to `.npmrc` keys\n * pnpm honours when running install in a non-workspace directory.\n */\nexport interface PnpmWorkspacePolicy {\n  /** `minimumReleaseAge` (minutes) — equivalent to `.npmrc` `minimum-release-age`. */\n  readonly minimumReleaseAge?: number;\n  /**\n   * `minimumReleaseAgeExclude` — equivalent to `.npmrc`\n   * `minimum-release-age-exclude` (comma-separated when serialised).\n   */\n  readonly minimumReleaseAgeExclude?: ReadonlyArray<string>;\n}\n\n/**\n * Walk up from `startDir` until a `pnpm-workspace.yaml` file is found\n * and return its absolute path. Returns `undefined` when the filesystem\n * root is reached without finding one.\n */\nexport const findPnpmWorkspaceFile = (startDir: string): string | undefined => {\n  let current = path.resolve(startDir);\n  while (true) {\n    const candidate = path.join(current, \"pnpm-workspace.yaml\");\n    if (fs.existsSync(candidate)) {\n      return candidate;\n    }\n    const parent = path.dirname(current);\n    if (parent === current) {\n      return undefined;\n    }\n    current = parent;\n  }\n};\n\n/**\n * Read the policy subset (`minimumReleaseAge` and\n * `minimumReleaseAgeExclude`) from a `pnpm-workspace.yaml` file.\n *\n * Returns an empty object when the file is missing, unreadable, or\n * contains neither key. Throws when the file is present but YAML\n * parsing fails — the caller is expected to surface a clear error.\n */\nexport const readPnpmWorkspacePolicy = (\n  workspaceFile: string,\n): PnpmWorkspacePolicy => {\n  if (!fs.existsSync(workspaceFile)) {\n    return {};\n  }\n\n  const raw = fs.readFileSync(workspaceFile, \"utf8\");\n  const parsed = yaml.load(raw);\n\n  if (!parsed || typeof parsed !== \"object\") {\n    return {};\n  }\n\n  const obj = parsed as Record<string, unknown>;\n  const policy: {\n    -readonly [K in keyof PnpmWorkspacePolicy]: PnpmWorkspacePolicy[K];\n  } = {};\n\n  const age = obj.minimumReleaseAge;\n  if (typeof age === \"number\" && Number.isFinite(age)) {\n    policy.minimumReleaseAge = age;\n  }\n\n  const exclude = obj.minimumReleaseAgeExclude;\n  if (Array.isArray(exclude)) {\n    const cleaned = exclude.filter(\n      (entry): entry is string => typeof entry === \"string\" && entry.length > 0,\n    );\n    if (cleaned.length > 0) {\n      policy.minimumReleaseAgeExclude = cleaned;\n    }\n  }\n\n  return policy;\n};\n\n/**\n * Render an `.npmrc` body that pnpm will honour when installing in\n * a directory outside the workspace tree. The keys emitted here are\n * the `.npmrc` equivalents of the `pnpm-workspace.yaml` fields in\n * {@link PnpmWorkspacePolicy} — pnpm reads `minimum-release-age` and\n * `minimum-release-age-exclude` from `.npmrc`, not from the workspace\n * file, when the install runs outside the workspace.\n *\n * Returns an empty string when the policy carries no relevant fields.\n */\nexport const renderNpmrcLines = (\n  policy: PnpmWorkspacePolicy,\n): ReadonlyArray<string> => {\n  const lines: Array<string> = [];\n\n  if (typeof policy.minimumReleaseAge === \"number\") {\n    lines.push(`minimum-release-age=${policy.minimumReleaseAge}`);\n  }\n\n  const exclude = policy.minimumReleaseAgeExclude ?? [];\n  if (exclude.length > 0) {\n    lines.push(`minimum-release-age-exclude=${exclude.join(\",\")}`);\n  }\n\n  return lines;\n};\n\n/**\n * Parse the body of an existing `.npmrc` file into a map of trimmed\n * key/value pairs. Lines that are blank or start with `#` are dropped.\n * Lines without an `=` are dropped.\n */\nexport const parseNpmrc = (body: string): Map<string, string> => {\n  const map = new Map<string, string>();\n  for (const rawLine of body.split(/\\r?\\n/)) {\n    const line = rawLine.trim();\n    if (line.length === 0 || line.startsWith(\"#\")) {\n      continue;\n    }\n    const eq = line.indexOf(\"=\");\n    if (eq < 0) {\n      continue;\n    }\n    const key = line.slice(0, eq).trim();\n    const value = line.slice(eq + 1).trim();\n    if (key.length > 0) {\n      map.set(key, value);\n    }\n  }\n  return map;\n};\n\n/**\n * Merge a set of policy-derived `.npmrc` lines into an existing\n * `.npmrc` body. Our keys overwrite matching keys in the existing\n * body; all other keys are preserved. Returns the new `.npmrc` body\n * (always terminated by a trailing newline when non-empty).\n */\nexport const mergeNpmrc = (\n  existing: string | undefined,\n  ourLines: ReadonlyArray<string>,\n): string => {\n  if (ourLines.length === 0) {\n    return existing ?? \"\";\n  }\n\n  const ourMap = new Map<string, string>();\n  for (const line of ourLines) {\n    const eq = line.indexOf(\"=\");\n    if (eq < 0) {\n      continue;\n    }\n    ourMap.set(line.slice(0, eq).trim(), line.slice(eq + 1).trim());\n  }\n\n  const existingMap = parseNpmrc(existing ?? \"\");\n  for (const [key, value] of ourMap) {\n    existingMap.set(key, value);\n  }\n\n  const orderedKeys: Array<string> = [];\n  const seen = new Set<string>();\n\n  // Preserve the original line order for any pre-existing keys.\n  for (const rawLine of (existing ?? \"\").split(/\\r?\\n/)) {\n    const line = rawLine.trim();\n    if (line.length === 0 || line.startsWith(\"#\")) {\n      continue;\n    }\n    const eq = line.indexOf(\"=\");\n    if (eq < 0) {\n      continue;\n    }\n    const key = line.slice(0, eq).trim();\n    if (key.length > 0 && existingMap.has(key) && !seen.has(key)) {\n      orderedKeys.push(key);\n      seen.add(key);\n    }\n  }\n\n  // Append any keys we added that weren't already present.\n  for (const key of ourMap.keys()) {\n    if (!seen.has(key)) {\n      orderedKeys.push(key);\n      seen.add(key);\n    }\n  }\n\n  const body = orderedKeys\n    .map((key) => `${key}=${existingMap.get(key)}`)\n    .join(\"\\n\");\n\n  return body.length === 0 ? \"\" : `${body}\\n`;\n};\n","import { RemovalPolicy } from \"aws-cdk-lib\";\nimport {\n  BlockPublicAccess,\n  Bucket,\n  BucketProps,\n  ObjectOwnership,\n} from \"aws-cdk-lib/aws-s3\";\nimport { Construct } from \"constructs\";\n\nexport interface PrivateBucketProps extends BucketProps {}\n\nexport class PrivateBucket extends Bucket {\n  constructor(scope: Construct, id: string, props: PrivateBucketProps = {}) {\n    const defaultProps = {\n      removalPolicy: props.removalPolicy ?? RemovalPolicy.RETAIN,\n      autoDeleteObjects: props.removalPolicy === RemovalPolicy.DESTROY,\n    };\n\n    const requiredProps = {\n      publicReadAccess: false,\n      blockPublicAccess: BlockPublicAccess.BLOCK_ALL,\n      enforceSSL: true,\n      objectOwnership: ObjectOwnership.BUCKET_OWNER_ENFORCED,\n    };\n\n    super(scope, id, { ...defaultProps, ...props, ...requiredProps });\n  }\n}\n","// eslint-disable-next-line import/no-extraneous-dependencies\nimport { findGitBranch } from \"@codedrifters/utils\";\nimport { Bucket } from \"aws-cdk-lib/aws-s3\";\nimport { BucketDeployment, Source } from \"aws-cdk-lib/aws-s3-deployment\";\nimport { StringParameter } from \"aws-cdk-lib/aws-ssm\";\nimport { paramCase } from \"change-case\";\nimport { Construct } from \"constructs\";\n\n/*******************************************************************************\n *\n *  STATIC CONTENT UPLOADER\n *\n *  This construct uploads a directory of content from a local location into S3.\n *\n *  To support PR and branch specific builds, each S3 bucket can store content\n *  for multiple domains and builds, using the following format:\n *\n *  S3-bucket/domain/*\n *\n *  A bucket used to store content for stage.openhi.org might have the\n *  following directory structure (all in the same bucket).\n *\n *  `/stage.openhi.org/*` serves content to stage.openhi.org\n *  `/feature-7.stage.openhi.org/*` serves content to feature-7.stage.openhi.org\n *  `/pr-123.stage.openhi.org/*` serves content to pr-123.stage.openhi.org\n *\n ******************************************************************************/\n\nexport interface StaticContentProps {\n  /**\n   * Parameter name to use when storing the static hosting bucket's ARN.\n   * This is needed in other later steps when deploying hosted content to S3.\n   */\n  readonly bucketArnParamName?: string;\n\n  /**\n   *  Absolute path to directory containing content for the website.\n   */\n  readonly contentSourceDirectory: string;\n\n  /**\n   *  Directory to place content into. Should start with a slash.\n   *  Example: '/widget'\n   */\n  readonly contentDestinationDirectory: string;\n\n  /**\n   *  The sub domain prefix (ie: images)\n   *\n   * @default git branch name\n   */\n  readonly subDomain?: string;\n\n  /**\n   *  The full domain (ie: staging.codedrifters.com)\n   */\n  readonly fullDomain: string;\n}\n\nexport class StaticContent extends Construct {\n  constructor(scope: Construct, id: string, props: StaticContentProps) {\n    super(scope, id);\n\n    /***************************************************************************\n     *\n     * Initial Setup\n     *\n     * Set some defaults, build domain information.\n     *\n     **************************************************************************/\n\n    const {\n      bucketArnParamName,\n      contentSourceDirectory,\n      contentDestinationDirectory,\n      subDomain,\n      fullDomain,\n    } = {\n      bucketArnParamName: \"/STATIC_WEBSITE/BUCKET_ARN\",\n      subDomain: findGitBranch(),\n      ...props,\n    };\n\n    /***************************************************************************\n     *\n     * Import and build some values from Param Store during deployment.\n     *\n     **************************************************************************/\n\n    const keyPrefix = [paramCase(subDomain), fullDomain].join(\".\");\n\n    const bucketArn = StringParameter.valueForStringParameter(\n      this,\n      bucketArnParamName,\n    );\n    const bucket = Bucket.fromBucketArn(this, \"bucket\", bucketArn);\n\n    /***************************************************************************\n     *\n     * Gather the sources we'll be deploying. We need to have an empty source\n     * for tests since it will change all the time and bork up the test\n     * snapshots if we don't.\n     *\n     **************************************************************************/\n\n    const isTestEnv = process.env.VITEST === \"true\";\n    const sources = isTestEnv ? [] : [Source.asset(contentSourceDirectory)];\n\n    new BucketDeployment(this, \"deploy\", {\n      sources,\n      destinationBucket: bucket,\n      retainOnDelete: false,\n      destinationKeyPrefix: `${keyPrefix}${contentDestinationDirectory}`,\n    });\n  }\n}\n","import * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport { Duration, StackProps } from \"aws-cdk-lib\";\nimport {\n  Certificate,\n  CertificateValidation,\n} from \"aws-cdk-lib/aws-certificatemanager\";\nimport {\n  AccessLevel,\n  AllowedMethods,\n  CacheCookieBehavior,\n  CacheHeaderBehavior,\n  CachePolicy,\n  CacheQueryStringBehavior,\n  Distribution,\n  LambdaEdgeEventType,\n  S3OriginAccessControl,\n  Signing,\n  ViewerProtocolPolicy,\n} from \"aws-cdk-lib/aws-cloudfront\";\nimport { S3BucketOrigin } from \"aws-cdk-lib/aws-cloudfront-origins\";\nimport { Runtime } from \"aws-cdk-lib/aws-lambda\";\nimport { NodejsFunction } from \"aws-cdk-lib/aws-lambda-nodejs\";\nimport { LogGroup, RetentionDays } from \"aws-cdk-lib/aws-logs\";\nimport {\n  ARecord,\n  HostedZone,\n  HostedZoneAttributes,\n  IHostedZone,\n  RecordTarget,\n} from \"aws-cdk-lib/aws-route53\";\nimport { CloudFrontTarget } from \"aws-cdk-lib/aws-route53-targets\";\nimport { StringParameter } from \"aws-cdk-lib/aws-ssm\";\nimport { Construct } from \"constructs\";\nimport type { HostingMode } from \"./static-hosting.viewer-request-handler\";\nimport { PrivateBucket, PrivateBucketProps } from \"../s3/private-bucket\";\n\nexport interface StaticDomainProps {\n  /**\n   *  The base domain (ie: codedrifters.com)\n   */\n  readonly baseDomain: string;\n\n  /**\n   * Hosted zone ID for the base domain.\n   */\n  readonly hostedZoneAttributes: HostedZoneAttributes;\n}\n\nexport interface StaticHostingProps extends StackProps {\n  /**\n   * Short description used in various places for traceability.\n   */\n  readonly description?: string;\n\n  /**\n   * Values used to connect a domain name to the cloudfront distribution. If not\n   * supplied, cloudfront doesn't use a custom domain.\n   */\n  readonly staticDomainProps?: StaticDomainProps;\n\n  /**\n   * Parameter name to use when storing the static hosting bucket's ARN.\n   * This is needed in other later steps when deploying hosted content to S3.\n   */\n  readonly bucketArnParamName?: string;\n\n  /**\n   * Parameter name to use when storing the CloudFront Distribution Domain Name.\n   */\n  readonly distributionDomainParamName?: string;\n\n  /**\n   * Parameter name to use when storing the CloudFront Distribution ID.\n   */\n  readonly distributionIDParamName?: string;\n\n  /**\n   * Props to pass to the private S3 bucket.\n   */\n  readonly privateBucketProps?: PrivateBucketProps;\n\n  /**\n   * Selects how path-like URIs are rewritten by the viewer-request\n   * `Lambda@Edge` handler.\n   *\n   * - `spa` (default): path-like URIs rewrite to `/index.html` so a\n   *   single-page app can serve its one root index and let the client-side\n   *   router handle the path.\n   * - `static`: path-like URIs append `/index.html` (e.g. `/docs` →\n   *   `/docs/index.html`) so multi-page static sites can serve distinct\n   *   HTML per path.\n   *\n   * Multi-tenant domain-folder prepending runs after the rewrite in both\n   * modes and is unaffected by this prop.\n   *\n   * @default \"spa\"\n   */\n  readonly hostingMode?: HostingMode;\n}\n\nexport class StaticHosting extends Construct {\n  /**\n   * Full domain name used as basis for hosting.\n   */\n  public readonly fullDomain: string;\n\n  constructor(scope: Construct, id: string, props: StaticHostingProps = {}) {\n    super(scope, id);\n\n    /***************************************************************************\n     *\n     * Initial Setup\n     *\n     * Set some defaults, build domain information.\n     *\n     **************************************************************************/\n\n    const {\n      bucketArnParamName,\n      distributionDomainParamName,\n      distributionIDParamName,\n      staticDomainProps,\n      privateBucketProps,\n      hostingMode,\n    } = {\n      bucketArnParamName: \"/STATIC_WEBSITE/BUCKET_ARN\",\n      distributionDomainParamName: \"/STATIC_WEBSITE/DISTRIBUTION_DOMAIN\",\n      distributionIDParamName: \"/STATIC_WEBSITE/DISTRIBUTION_ID\",\n      hostingMode: \"spa\" as HostingMode,\n      ...props,\n    };\n\n    const { baseDomain, hostedZoneAttributes } = staticDomainProps ?? {};\n\n    /***************************************************************************\n     *\n     * PRIVATE BUCKET\n     *\n     * A bucket to store the files within.\n     * Save ARN for later deploys.\n     *\n     **************************************************************************/\n\n    const bucket = new PrivateBucket(\n      this,\n      \"static-hosting-bucket\",\n      privateBucketProps,\n    );\n\n    /***************************************************************************\n     *\n     * DNS & Wildcard Certificate\n     *\n     * If a zone Id as passed in, find the hosted zone and create a wildcard\n     * certificate for the domain.\n     *\n     **************************************************************************/\n\n    let zone: IHostedZone | undefined;\n    let certificate: Certificate | undefined;\n\n    if (hostedZoneAttributes && baseDomain) {\n      zone = HostedZone.fromHostedZoneAttributes(\n        this,\n        \"zone\",\n        hostedZoneAttributes,\n      );\n      certificate = new Certificate(this, \"wildcard-certificate\", {\n        domainName: `*.${baseDomain}`,\n        subjectAlternativeNames: [baseDomain],\n        validation: CertificateValidation.fromDnsMultiZone({\n          [`*.${baseDomain}`]: zone,\n          [baseDomain]: zone,\n        }),\n      });\n    }\n\n    /******************************************************************************\n     *\n     * `LAMBDA@EDGE` FUNCTION\n     *\n     * This handles rewriting the path from domain name.\n     *\n     *****************************************************************************/\n\n    // Explicit entry required: when omitted, NodejsFunction infers the path from the\n    // call site (the built lib/index.js), so it looks for index.viewer-request-handler.js\n    // in the package. That file is only emitted if we add it as a separate tsup entry.\n    // Use .js when present (built package); fall back to .ts for tests running from source.\n    const handlerJs = path.join(\n      __dirname,\n      \"static-hosting.viewer-request-handler.js\",\n    );\n    const handlerTs = path.join(\n      __dirname,\n      \"static-hosting.viewer-request-handler.ts\",\n    );\n    const handlerEntry = fs.existsSync(handlerJs) ? handlerJs : handlerTs;\n\n    const handler = new NodejsFunction(this, \"viewer-request-handler\", {\n      entry: handlerEntry,\n      handler: hostingMode === \"static\" ? \"staticHandler\" : \"spaHandler\",\n      memorySize: 128,\n      runtime: Runtime.NODEJS_24_X,\n      logGroup: new LogGroup(this, \"viewer-request-handler-log-group\", {\n        retention: RetentionDays.ONE_MONTH,\n      }),\n    });\n\n    /******************************************************************************\n     *\n     *  CLOUDFRONT CONFIG\n     *\n     *  Setup a CloudFront Distribution for the bucket.\n     *\n     *****************************************************************************/\n\n    const cachePolicy = new CachePolicy(this, \"cloudfront-policy\", {\n      comment: \"Relatively conservative TTL policy.\",\n      maxTtl: Duration.seconds(300),\n      minTtl: Duration.seconds(0),\n      defaultTtl: Duration.seconds(60),\n      headerBehavior: CacheHeaderBehavior.none(),\n      queryStringBehavior: CacheQueryStringBehavior.none(),\n      cookieBehavior: CacheCookieBehavior.none(),\n      enableAcceptEncodingGzip: true,\n      enableAcceptEncodingBrotli: true,\n    });\n\n    const oac = new S3OriginAccessControl(this, \"MyOAC\", {\n      signing: Signing.SIGV4_NO_OVERRIDE,\n    });\n    const origin = S3BucketOrigin.withOriginAccessControl(bucket, {\n      originAccessControl: oac,\n      originAccessLevels: [AccessLevel.READ],\n    });\n\n    const distribution = new Distribution(this, \"cloudfront-distribution\", {\n      comment: `Distribution for ${props.description ?? id}`,\n\n      /**\n       * Only if domain was supplied\n       */\n      ...(certificate && baseDomain\n        ? {\n            certificate,\n            domainNames: [baseDomain, `*.${baseDomain}`],\n          }\n        : {}),\n\n      defaultBehavior: {\n        origin,\n        viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,\n        cachePolicy,\n        allowedMethods: AllowedMethods.ALLOW_GET_HEAD_OPTIONS,\n        edgeLambdas: [\n          {\n            functionVersion: handler.currentVersion,\n            eventType: LambdaEdgeEventType.VIEWER_REQUEST,\n          },\n        ],\n      },\n      defaultRootObject: \"index.html\",\n    });\n\n    /**\n     * We finally have enough information to set the full domain.\n     */\n    this.fullDomain =\n      certificate && baseDomain ? baseDomain : distribution.domainName;\n\n    /***************************************************************************\n     *\n     *  DNS ENTRY\n     *\n     * Link cloudfront to both the root fulldomain and all possible subdomains.\n     *\n     **************************************************************************/\n\n    if (zone) {\n      new ARecord(this, \"root-dns-entry\", {\n        zone,\n        recordName: baseDomain ? baseDomain : \"\",\n        target: RecordTarget.fromAlias(new CloudFrontTarget(distribution)),\n      });\n\n      new ARecord(this, \"wc-dns-entry\", {\n        zone,\n        recordName: baseDomain ? `*.${baseDomain}` : \"*\",\n        target: RecordTarget.fromAlias(new CloudFrontTarget(distribution)),\n      });\n    }\n\n    /***************************************************************************\n     *\n     * EXPORTS\n     *\n     * Used by content uploader later.\n     *\n     **************************************************************************/\n\n    new StringParameter(this, \"dist-domain\", {\n      description: `GENERATED DO NOT CHANGE - CloudFront Distribution Details (${props.description ?? id}).`,\n      parameterName: distributionDomainParamName,\n      stringValue: distribution.domainName,\n    });\n\n    new StringParameter(this, \"dist-id\", {\n      description: `GENERATED DO NOT CHANGE - CloudFront Distribution Details (${props.description ?? id}).`,\n      parameterName: distributionIDParamName,\n      stringValue: distribution.distributionId,\n    });\n\n    new StringParameter(this, \"bucket-arn\", {\n      description: `GENERATED DO NOT CHANGE - S3 Bucket ARN for (${props.description ?? id}).`,\n      parameterName: bucketArnParamName,\n      stringValue: bucket.bucketArn,\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKa,IAAAA,SAAA,iBAAiB;;;;MAI5B,KAAK;;;;MAKL,OAAO;;;;MAKP,MAAM;;AAYK,IAAAA,SAAA,yBAAyB;;;;;MAKpC,SAAS;;;;;MAKT,WAAW;;AAcA,IAAAA,SAAA,uBAAuBA,SAAA;;;;;;;;;;ACvDpC,QAAA,uBAAA,QAAA,eAAA;AAQO,QAAMC,iBAAgB,MAAa;AACxC,cAAO,GAAA,qBAAA,UAAS,iCAAiC,EAC9C,SAAS,MAAM,EACf,QAAQ,cAAc,EAAE;IAC7B;AAJa,IAAAC,SAAA,gBAAaD;AAMnB,QAAM,kBAAkB,MAAa;AAI1C,UAAI,QAAQ,IAAI,mBAAmB;AACjC,eAAO,QAAQ,IAAI;MACrB;AAKA,YAAM,UAAS,GAAA,qBAAA,UAAS,oCAAoC,EACzD,SAAS,MAAM,EACf,QAAQ,cAAc,EAAE,EACxB,KAAI;AAEP,YAAM,QAAQ,OAAO,MAAM,iCAAiC;AAC5D,YAAM,WAAW,QAAQ,MAAM,CAAC,IAAI;AAEpC,aAAO;IACT;AApBa,IAAAC,SAAA,kBAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACd5B,QAAA,SAAA,aAAA,QAAA,QAAA,CAAA;AAQO,QAAM,aAAa,CAAC,UAAkB,aAAqB,QAAO;AACvE,aAAO,OACJ,WAAW,QAAQ,EACnB,OAAO,QAAQ,EACf,OAAO,KAAK,EACZ,UAAU,GAAG,UAAU;IAC5B;AANa,IAAAC,SAAA,aAAU;AAchB,QAAM,mBAAmB,CAAC,aAAqB,cAAqB;AACzE,aAAO,YAAY,SAAS,YACxB,cACA,YAAY,UAAU,GAAG,SAAS;IACxC;AAJa,IAAAA,SAAA,mBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;ACtB7B,iBAAA,qBAAAC,QAAA;AACA,iBAAA,qBAAAA,QAAA;AACA,iBAAA,wBAAAA,QAAA;;;;;ACFA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAC,MAAoB;AACpB,IAAAC,QAAsB;AACtB,+BAIO;;;ACNP,SAAoB;AACpB,WAAsB;AACtB,WAAsB;AAqBf,IAAM,wBAAwB,CAAC,aAAyC;AAC7E,MAAI,UAAe,aAAQ,QAAQ;AACnC,SAAO,MAAM;AACX,UAAM,YAAiB,UAAK,SAAS,qBAAqB;AAC1D,QAAO,cAAW,SAAS,GAAG;AAC5B,aAAO;AAAA,IACT;AACA,UAAM,SAAc,aAAQ,OAAO;AACnC,QAAI,WAAW,SAAS;AACtB,aAAO;AAAA,IACT;AACA,cAAU;AAAA,EACZ;AACF;AAUO,IAAM,0BAA0B,CACrC,kBACwB;AACxB,MAAI,CAAI,cAAW,aAAa,GAAG;AACjC,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,MAAS,gBAAa,eAAe,MAAM;AACjD,QAAM,SAAc,UAAK,GAAG;AAE5B,MAAI,CAAC,UAAU,OAAO,WAAW,UAAU;AACzC,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,MAAM;AACZ,QAAM,SAEF,CAAC;AAEL,QAAM,MAAM,IAAI;AAChB,MAAI,OAAO,QAAQ,YAAY,OAAO,SAAS,GAAG,GAAG;AACnD,WAAO,oBAAoB;AAAA,EAC7B;AAEA,QAAM,UAAU,IAAI;AACpB,MAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,UAAM,UAAU,QAAQ;AAAA,MACtB,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS;AAAA,IAC1E;AACA,QAAI,QAAQ,SAAS,GAAG;AACtB,aAAO,2BAA2B;AAAA,IACpC;AAAA,EACF;AAEA,SAAO;AACT;AAYO,IAAM,mBAAmB,CAC9B,WAC0B;AAC1B,QAAM,QAAuB,CAAC;AAE9B,MAAI,OAAO,OAAO,sBAAsB,UAAU;AAChD,UAAM,KAAK,uBAAuB,OAAO,iBAAiB,EAAE;AAAA,EAC9D;AAEA,QAAM,UAAU,OAAO,4BAA4B,CAAC;AACpD,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,KAAK,+BAA+B,QAAQ,KAAK,GAAG,CAAC,EAAE;AAAA,EAC/D;AAEA,SAAO;AACT;AAOO,IAAM,aAAa,CAAC,SAAsC;AAC/D,QAAM,MAAM,oBAAI,IAAoB;AACpC,aAAW,WAAW,KAAK,MAAM,OAAO,GAAG;AACzC,UAAM,OAAO,QAAQ,KAAK;AAC1B,QAAI,KAAK,WAAW,KAAK,KAAK,WAAW,GAAG,GAAG;AAC7C;AAAA,IACF;AACA,UAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,QAAI,KAAK,GAAG;AACV;AAAA,IACF;AACA,UAAM,MAAM,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK;AACnC,UAAM,QAAQ,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AACtC,QAAI,IAAI,SAAS,GAAG;AAClB,UAAI,IAAI,KAAK,KAAK;AAAA,IACpB;AAAA,EACF;AACA,SAAO;AACT;AAQO,IAAM,aAAa,CACxB,UACA,aACW;AACX,MAAI,SAAS,WAAW,GAAG;AACzB,WAAO,YAAY;AAAA,EACrB;AAEA,QAAM,SAAS,oBAAI,IAAoB;AACvC,aAAW,QAAQ,UAAU;AAC3B,UAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,QAAI,KAAK,GAAG;AACV;AAAA,IACF;AACA,WAAO,IAAI,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK,CAAC;AAAA,EAChE;AAEA,QAAM,cAAc,WAAW,YAAY,EAAE;AAC7C,aAAW,CAAC,KAAK,KAAK,KAAK,QAAQ;AACjC,gBAAY,IAAI,KAAK,KAAK;AAAA,EAC5B;AAEA,QAAM,cAA6B,CAAC;AACpC,QAAM,OAAO,oBAAI,IAAY;AAG7B,aAAW,YAAY,YAAY,IAAI,MAAM,OAAO,GAAG;AACrD,UAAM,OAAO,QAAQ,KAAK;AAC1B,QAAI,KAAK,WAAW,KAAK,KAAK,WAAW,GAAG,GAAG;AAC7C;AAAA,IACF;AACA,UAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,QAAI,KAAK,GAAG;AACV;AAAA,IACF;AACA,UAAM,MAAM,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK;AACnC,QAAI,IAAI,SAAS,KAAK,YAAY,IAAI,GAAG,KAAK,CAAC,KAAK,IAAI,GAAG,GAAG;AAC5D,kBAAY,KAAK,GAAG;AACpB,WAAK,IAAI,GAAG;AAAA,IACd;AAAA,EACF;AAGA,aAAW,OAAO,OAAO,KAAK,GAAG;AAC/B,QAAI,CAAC,KAAK,IAAI,GAAG,GAAG;AAClB,kBAAY,KAAK,GAAG;AACpB,WAAK,IAAI,GAAG;AAAA,IACd;AAAA,EACF;AAEA,QAAM,OAAO,YACV,IAAI,CAAC,QAAQ,GAAG,GAAG,IAAI,YAAY,IAAI,GAAG,CAAC,EAAE,EAC7C,KAAK,IAAI;AAEZ,SAAO,KAAK,WAAW,IAAI,KAAK,GAAG,IAAI;AAAA;AACzC;;;AD3IO,IAAM,4BAA4B,CAAC,WAGH;AACrC,QAAM,EAAE,OAAO,oBAAoB,IAAI;AACvC,MAAI,CAAI,eAAW,KAAK,GAAG;AACzB,WAAO,EAAE,eAAe,gBAAgB;AAAA,EAC1C;AAEA,QAAM,WAAgB,cAAa,cAAQ,KAAK,CAAC;AACjD,QAAM,aAAa,sBACV,cAAQ,mBAAmB,IAChC;AAEJ,QAAM,gBAAgB,sBAAsB,UAAU;AACtD,MAAI,CAAC,eAAe;AAClB,WAAO,EAAE,eAAe,yBAAyB;AAAA,EACnD;AAEA,QAAM,SAAS,wBAAwB,aAAa;AACpD,QAAM,QAAQ,iBAAiB,MAAM;AACrC,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO,EAAE,eAAe,eAAe;AAAA,EACzC;AAEA,QAAM,YAAiB,WAAK,UAAU,QAAQ;AAC9C,QAAM,WAAc,eAAW,SAAS,IACjC,iBAAa,WAAW,MAAM,IACjC;AACJ,QAAM,SAAS,WAAW,UAAU,KAAK;AAEzC,MAAI,WAAW,UAAU;AACvB,WAAO,EAAE,WAAW,eAAe,YAAY;AAAA,EACjD;AAEA,EAAG,kBAAc,WAAW,MAAM;AAClC,SAAO,EAAE,UAAU;AACrB;AAWO,IAAM,6BAA6B,CAAC,WAGtB;AACnB,QAAM,EAAE,WAAW,cAAc,IAAI;AACrC,SAAO;AAAA,IACL,eAAe,UAAkB,WAA6B;AAC5D,aAAO,eAAe,eAAe,UAAU,SAAS,KAAK,CAAC;AAAA,IAChE;AAAA,IACA,cAAc,UAAkB,WAA6B;AAC3D,YAAM,iBACJ,eAAe,cAAc,UAAU,SAAS,KAAK,CAAC;AACxD,YAAM,cAAc,MAAM,SAAS,IAAI,QAAQ;AAC/C,aAAO,CAAC,GAAG,gBAAgB,WAAW;AAAA,IACxC;AAAA,IACA,cAAc,UAAkB,WAA6B;AAC3D,aAAO,eAAe,cAAc,UAAU,SAAS,KAAK,CAAC;AAAA,IAC/D;AAAA,EACF;AACF;AAqBO,IAAM,8BAAN,cAA0C,wCAAe;AAAA,EAC9D,YACE,OACA,IACA,OACA;AACA,QAAI;AACJ,QAAI,CAAC,MAAM,2BAA2B,MAAM,OAAO;AACjD,qBAAe,0BAA0B;AAAA,QACvC,OAAO,MAAM;AAAA,QACb,qBAAqB,MAAM;AAAA,MAC7B,CAAC;AAAA,IACH;AAEA,UAAM,EAAE,yBAAyB,qBAAqB,GAAG,KAAK,IAAI;AAClE,SAAK;AACL,SAAK;AAOL,UAAM,YAAY,cAAc;AAChC,UAAM,iBAAiB,cAAc,UAAgB,eAAW,SAAS;AAEzE,UAAM,gBAAqC,iBACvC;AAAA,MACE,GAAG;AAAA,MACH,UAAU;AAAA,QACR,GAAG,KAAK;AAAA,QACR,cAAc,2BAA2B;AAAA,UACvC;AAAA,UACA,eAAe,KAAK,UAAU;AAAA,QAChC,CAAC;AAAA,MACH;AAAA,IACF,IACA;AAEJ,UAAM,OAAO,IAAI,aAAa;AAAA,EAChC;AACF;;;AE1LA,yBAA8B;AAC9B,oBAKO;AAKA,IAAM,gBAAN,cAA4B,qBAAO;AAAA,EACxC,YAAY,OAAkB,IAAY,QAA4B,CAAC,GAAG;AACxE,UAAM,eAAe;AAAA,MACnB,eAAe,MAAM,iBAAiB,iCAAc;AAAA,MACpD,mBAAmB,MAAM,kBAAkB,iCAAc;AAAA,IAC3D;AAEA,UAAM,gBAAgB;AAAA,MACpB,kBAAkB;AAAA,MAClB,mBAAmB,gCAAkB;AAAA,MACrC,YAAY;AAAA,MACZ,iBAAiB,8BAAgB;AAAA,IACnC;AAEA,UAAM,OAAO,IAAI,EAAE,GAAG,cAAc,GAAG,OAAO,GAAG,cAAc,CAAC;AAAA,EAClE;AACF;;;AC1BA,mBAA8B;AAC9B,IAAAC,iBAAuB;AACvB,+BAAyC;AACzC,qBAAgC;AAChC,yBAA0B;AAC1B,wBAA0B;AAqDnB,IAAM,gBAAN,cAA4B,4BAAU;AAAA,EAC3C,YAAY,OAAkB,IAAY,OAA2B;AACnE,UAAM,OAAO,EAAE;AAUf,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IAAI;AAAA,MACF,oBAAoB;AAAA,MACpB,eAAW,4BAAc;AAAA,MACzB,GAAG;AAAA,IACL;AAQA,UAAM,YAAY,KAAC,8BAAU,SAAS,GAAG,UAAU,EAAE,KAAK,GAAG;AAE7D,UAAM,YAAY,+BAAgB;AAAA,MAChC;AAAA,MACA;AAAA,IACF;AACA,UAAM,SAAS,sBAAO,cAAc,MAAM,UAAU,SAAS;AAU7D,UAAM,YAAY,QAAQ,IAAI,WAAW;AACzC,UAAM,UAAU,YAAY,CAAC,IAAI,CAAC,gCAAO,MAAM,sBAAsB,CAAC;AAEtE,QAAI,0CAAiB,MAAM,UAAU;AAAA,MACnC;AAAA,MACA,mBAAmB;AAAA,MACnB,gBAAgB;AAAA,MAChB,sBAAsB,GAAG,SAAS,GAAG,2BAA2B;AAAA,IAClE,CAAC;AAAA,EACH;AACF;;;ACnHA,IAAAC,MAAoB;AACpB,IAAAC,QAAsB;AACtB,IAAAC,sBAAqC;AACrC,oCAGO;AACP,4BAYO;AACP,oCAA+B;AAC/B,wBAAwB;AACxB,IAAAC,4BAA+B;AAC/B,sBAAwC;AACxC,yBAMO;AACP,iCAAiC;AACjC,IAAAC,kBAAgC;AAChC,IAAAC,qBAA0B;AAoEnB,IAAM,gBAAN,cAA4B,6BAAU;AAAA,EAM3C,YAAY,OAAkB,IAAY,QAA4B,CAAC,GAAG;AACxE,UAAM,OAAO,EAAE;AAUf,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IAAI;AAAA,MACF,oBAAoB;AAAA,MACpB,6BAA6B;AAAA,MAC7B,yBAAyB;AAAA,MACzB,aAAa;AAAA,MACb,GAAG;AAAA,IACL;AAEA,UAAM,EAAE,YAAY,qBAAqB,IAAI,qBAAqB,CAAC;AAWnE,UAAM,SAAS,IAAI;AAAA,MACjB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAWA,QAAI;AACJ,QAAI;AAEJ,QAAI,wBAAwB,YAAY;AACtC,aAAO,8BAAW;AAAA,QAChB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,oBAAc,IAAI,0CAAY,MAAM,wBAAwB;AAAA,QAC1D,YAAY,KAAK,UAAU;AAAA,QAC3B,yBAAyB,CAAC,UAAU;AAAA,QACpC,YAAY,oDAAsB,iBAAiB;AAAA,UACjD,CAAC,KAAK,UAAU,EAAE,GAAG;AAAA,UACrB,CAAC,UAAU,GAAG;AAAA,QAChB,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AAcA,UAAM,YAAiB;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AACA,UAAM,YAAiB;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AACA,UAAM,eAAkB,eAAW,SAAS,IAAI,YAAY;AAE5D,UAAM,UAAU,IAAI,yCAAe,MAAM,0BAA0B;AAAA,MACjE,OAAO;AAAA,MACP,SAAS,gBAAgB,WAAW,kBAAkB;AAAA,MACtD,YAAY;AAAA,MACZ,SAAS,0BAAQ;AAAA,MACjB,UAAU,IAAI,yBAAS,MAAM,oCAAoC;AAAA,QAC/D,WAAW,8BAAc;AAAA,MAC3B,CAAC;AAAA,IACH,CAAC;AAUD,UAAM,cAAc,IAAI,kCAAY,MAAM,qBAAqB;AAAA,MAC7D,SAAS;AAAA,MACT,QAAQ,6BAAS,QAAQ,GAAG;AAAA,MAC5B,QAAQ,6BAAS,QAAQ,CAAC;AAAA,MAC1B,YAAY,6BAAS,QAAQ,EAAE;AAAA,MAC/B,gBAAgB,0CAAoB,KAAK;AAAA,MACzC,qBAAqB,+CAAyB,KAAK;AAAA,MACnD,gBAAgB,0CAAoB,KAAK;AAAA,MACzC,0BAA0B;AAAA,MAC1B,4BAA4B;AAAA,IAC9B,CAAC;AAED,UAAM,MAAM,IAAI,4CAAsB,MAAM,SAAS;AAAA,MACnD,SAAS,8BAAQ;AAAA,IACnB,CAAC;AACD,UAAM,SAAS,6CAAe,wBAAwB,QAAQ;AAAA,MAC5D,qBAAqB;AAAA,MACrB,oBAAoB,CAAC,kCAAY,IAAI;AAAA,IACvC,CAAC;AAED,UAAM,eAAe,IAAI,mCAAa,MAAM,2BAA2B;AAAA,MACrE,SAAS,oBAAoB,MAAM,eAAe,EAAE;AAAA;AAAA;AAAA;AAAA,MAKpD,GAAI,eAAe,aACf;AAAA,QACE;AAAA,QACA,aAAa,CAAC,YAAY,KAAK,UAAU,EAAE;AAAA,MAC7C,IACA,CAAC;AAAA,MAEL,iBAAiB;AAAA,QACf;AAAA,QACA,sBAAsB,2CAAqB;AAAA,QAC3C;AAAA,QACA,gBAAgB,qCAAe;AAAA,QAC/B,aAAa;AAAA,UACX;AAAA,YACE,iBAAiB,QAAQ;AAAA,YACzB,WAAW,0CAAoB;AAAA,UACjC;AAAA,QACF;AAAA,MACF;AAAA,MACA,mBAAmB;AAAA,IACrB,CAAC;AAKD,SAAK,aACH,eAAe,aAAa,aAAa,aAAa;AAUxD,QAAI,MAAM;AACR,UAAI,2BAAQ,MAAM,kBAAkB;AAAA,QAClC;AAAA,QACA,YAAY,aAAa,aAAa;AAAA,QACtC,QAAQ,gCAAa,UAAU,IAAI,4CAAiB,YAAY,CAAC;AAAA,MACnE,CAAC;AAED,UAAI,2BAAQ,MAAM,gBAAgB;AAAA,QAChC;AAAA,QACA,YAAY,aAAa,KAAK,UAAU,KAAK;AAAA,QAC7C,QAAQ,gCAAa,UAAU,IAAI,4CAAiB,YAAY,CAAC;AAAA,MACnE,CAAC;AAAA,IACH;AAUA,QAAI,gCAAgB,MAAM,eAAe;AAAA,MACvC,aAAa,8DAA8D,MAAM,eAAe,EAAE;AAAA,MAClG,eAAe;AAAA,MACf,aAAa,aAAa;AAAA,IAC5B,CAAC;AAED,QAAI,gCAAgB,MAAM,WAAW;AAAA,MACnC,aAAa,8DAA8D,MAAM,eAAe,EAAE;AAAA,MAClG,eAAe;AAAA,MACf,aAAa,aAAa;AAAA,IAC5B,CAAC;AAED,QAAI,gCAAgB,MAAM,cAAc;AAAA,MACtC,aAAa,gDAAgD,MAAM,eAAe,EAAE;AAAA,MACpF,eAAe;AAAA,MACf,aAAa,OAAO;AAAA,IACtB,CAAC;AAAA,EACH;AACF;","names":["exports","findGitBranch","exports","exports","exports","fs","path","import_aws_s3","fs","path","import_aws_cdk_lib","import_aws_lambda_nodejs","import_aws_ssm","import_constructs"]}

package/lib/index.mjs

@@ -146,6 +146,201 @@ var require_lib = __commonJS({
   }
 });
 
+// src/lambda/pnpm-workspace-nodejs-function.ts
+import * as fs2 from "fs";
+import * as path2 from "path";
+import {
+  NodejsFunction
+} from "aws-cdk-lib/aws-lambda-nodejs";
+
+// src/lambda/pnpm-workspace-parser.ts
+import * as fs from "fs";
+import * as path from "path";
+import * as yaml from "js-yaml";
+var findPnpmWorkspaceFile = (startDir) => {
+  let current = path.resolve(startDir);
+  while (true) {
+    const candidate = path.join(current, "pnpm-workspace.yaml");
+    if (fs.existsSync(candidate)) {
+      return candidate;
+    }
+    const parent = path.dirname(current);
+    if (parent === current) {
+      return void 0;
+    }
+    current = parent;
+  }
+};
+var readPnpmWorkspacePolicy = (workspaceFile) => {
+  if (!fs.existsSync(workspaceFile)) {
+    return {};
+  }
+  const raw = fs.readFileSync(workspaceFile, "utf8");
+  const parsed = yaml.load(raw);
+  if (!parsed || typeof parsed !== "object") {
+    return {};
+  }
+  const obj = parsed;
+  const policy = {};
+  const age = obj.minimumReleaseAge;
+  if (typeof age === "number" && Number.isFinite(age)) {
+    policy.minimumReleaseAge = age;
+  }
+  const exclude = obj.minimumReleaseAgeExclude;
+  if (Array.isArray(exclude)) {
+    const cleaned = exclude.filter(
+      (entry) => typeof entry === "string" && entry.length > 0
+    );
+    if (cleaned.length > 0) {
+      policy.minimumReleaseAgeExclude = cleaned;
+    }
+  }
+  return policy;
+};
+var renderNpmrcLines = (policy) => {
+  const lines = [];
+  if (typeof policy.minimumReleaseAge === "number") {
+    lines.push(`minimum-release-age=${policy.minimumReleaseAge}`);
+  }
+  const exclude = policy.minimumReleaseAgeExclude ?? [];
+  if (exclude.length > 0) {
+    lines.push(`minimum-release-age-exclude=${exclude.join(",")}`);
+  }
+  return lines;
+};
+var parseNpmrc = (body) => {
+  const map = /* @__PURE__ */ new Map();
+  for (const rawLine of body.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (line.length === 0 || line.startsWith("#")) {
+      continue;
+    }
+    const eq = line.indexOf("=");
+    if (eq < 0) {
+      continue;
+    }
+    const key = line.slice(0, eq).trim();
+    const value = line.slice(eq + 1).trim();
+    if (key.length > 0) {
+      map.set(key, value);
+    }
+  }
+  return map;
+};
+var mergeNpmrc = (existing, ourLines) => {
+  if (ourLines.length === 0) {
+    return existing ?? "";
+  }
+  const ourMap = /* @__PURE__ */ new Map();
+  for (const line of ourLines) {
+    const eq = line.indexOf("=");
+    if (eq < 0) {
+      continue;
+    }
+    ourMap.set(line.slice(0, eq).trim(), line.slice(eq + 1).trim());
+  }
+  const existingMap = parseNpmrc(existing ?? "");
+  for (const [key, value] of ourMap) {
+    existingMap.set(key, value);
+  }
+  const orderedKeys = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const rawLine of (existing ?? "").split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (line.length === 0 || line.startsWith("#")) {
+      continue;
+    }
+    const eq = line.indexOf("=");
+    if (eq < 0) {
+      continue;
+    }
+    const key = line.slice(0, eq).trim();
+    if (key.length > 0 && existingMap.has(key) && !seen.has(key)) {
+      orderedKeys.push(key);
+      seen.add(key);
+    }
+  }
+  for (const key of ourMap.keys()) {
+    if (!seen.has(key)) {
+      orderedKeys.push(key);
+      seen.add(key);
+    }
+  }
+  const body = orderedKeys.map((key) => `${key}=${existingMap.get(key)}`).join("\n");
+  return body.length === 0 ? "" : `${body}
+`;
+};
+
+// src/lambda/pnpm-workspace-nodejs-function.ts
+var mirrorPnpmWorkspacePolicy = (params) => {
+  const { entry, workspaceSearchFrom } = params;
+  if (!fs2.existsSync(entry)) {
+    return { skippedReason: "missing-entry" };
+  }
+  const entryDir = path2.dirname(path2.resolve(entry));
+  const searchFrom = workspaceSearchFrom ? path2.resolve(workspaceSearchFrom) : entryDir;
+  const workspaceFile = findPnpmWorkspaceFile(searchFrom);
+  if (!workspaceFile) {
+    return { skippedReason: "missing-workspace-file" };
+  }
+  const policy = readPnpmWorkspacePolicy(workspaceFile);
+  const lines = renderNpmrcLines(policy);
+  if (lines.length === 0) {
+    return { skippedReason: "empty-policy" };
+  }
+  const npmrcPath = path2.join(entryDir, ".npmrc");
+  const existing = fs2.existsSync(npmrcPath) ? fs2.readFileSync(npmrcPath, "utf8") : void 0;
+  const merged = mergeNpmrc(existing, lines);
+  if (merged === existing) {
+    return { npmrcPath, skippedReason: "no-change" };
+  }
+  fs2.writeFileSync(npmrcPath, merged);
+  return { npmrcPath };
+};
+var buildNpmrcCopyCommandHooks = (params) => {
+  const { npmrcPath, existingHooks } = params;
+  return {
+    beforeBundling(inputDir, outputDir) {
+      return existingHooks?.beforeBundling(inputDir, outputDir) ?? [];
+    },
+    beforeInstall(inputDir, outputDir) {
+      const callerCommands = existingHooks?.beforeInstall(inputDir, outputDir) ?? [];
+      const copyCommand = `cp ${npmrcPath} ${inputDir}/.npmrc`;
+      return [...callerCommands, copyCommand];
+    },
+    afterBundling(inputDir, outputDir) {
+      return existingHooks?.afterBundling(inputDir, outputDir) ?? [];
+    }
+  };
+};
+var PnpmWorkspaceNodejsFunction = class extends NodejsFunction {
+  constructor(scope, id, props) {
+    let mirrorResult;
+    if (!props.disablePnpmPolicyMirror && props.entry) {
+      mirrorResult = mirrorPnpmWorkspacePolicy({
+        entry: props.entry,
+        workspaceSearchFrom: props.workspaceSearchFrom
+      });
+    }
+    const { disablePnpmPolicyMirror, workspaceSearchFrom, ...rest } = props;
+    void disablePnpmPolicyMirror;
+    void workspaceSearchFrom;
+    const npmrcPath = mirrorResult?.npmrcPath;
+    const shouldWireHook = npmrcPath !== void 0 && fs2.existsSync(npmrcPath);
+    const propsWithHook = shouldWireHook ? {
+      ...rest,
+      bundling: {
+        ...rest.bundling,
+        commandHooks: buildNpmrcCopyCommandHooks({
+          npmrcPath,
+          existingHooks: rest.bundling?.commandHooks
+        })
+      }
+    } : rest;
+    super(scope, id, propsWithHook);
+  }
+};
+
 // src/s3/private-bucket.ts
 import { RemovalPolicy } from "aws-cdk-lib";
 import {
@@ -208,8 +403,8 @@ var StaticContent = class extends Construct {
 };
 
 // src/static-hosting/static-hosting.ts
-import * as fs from "fs";
-import * as path from "path";
+import * as fs3 from "fs";
+import * as path3 from "path";
 import { Duration } from "aws-cdk-lib";
 import {
   Certificate,
@@ -230,7 +425,7 @@ import {
 } from "aws-cdk-lib/aws-cloudfront";
 import { S3BucketOrigin } from "aws-cdk-lib/aws-cloudfront-origins";
 import { Runtime } from "aws-cdk-lib/aws-lambda";
-import { NodejsFunction } from "aws-cdk-lib/aws-lambda-nodejs";
+import { NodejsFunction as NodejsFunction2 } from "aws-cdk-lib/aws-lambda-nodejs";
 import { LogGroup, RetentionDays } from "aws-cdk-lib/aws-logs";
 import {
   ARecord,
@@ -280,16 +475,16 @@ var StaticHosting = class extends Construct2 {
         })
       });
     }
-    const handlerJs = path.join(
+    const handlerJs = path3.join(
       __dirname,
       "static-hosting.viewer-request-handler.js"
     );
-    const handlerTs = path.join(
+    const handlerTs = path3.join(
       __dirname,
       "static-hosting.viewer-request-handler.ts"
     );
-    const handlerEntry = fs.existsSync(handlerJs) ? handlerJs : handlerTs;
-    const handler = new NodejsFunction(this, "viewer-request-handler", {
+    const handlerEntry = fs3.existsSync(handlerJs) ? handlerJs : handlerTs;
+    const handler = new NodejsFunction2(this, "viewer-request-handler", {
       entry: handlerEntry,
       handler: hostingMode === "static" ? "staticHandler" : "spaHandler",
       memorySize: 128,
@@ -370,8 +565,16 @@ var StaticHosting = class extends Construct2 {
   }
 };
 export {
+  PnpmWorkspaceNodejsFunction,
   PrivateBucket,
   StaticContent,
-  StaticHosting
+  StaticHosting,
+  buildNpmrcCopyCommandHooks,
+  findPnpmWorkspaceFile,
+  mergeNpmrc,
+  mirrorPnpmWorkspacePolicy,
+  parseNpmrc,
+  readPnpmWorkspacePolicy,
+  renderNpmrcLines
 };
 //# sourceMappingURL=index.mjs.map

package/lib/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../utils/src/aws/aws-types.ts","../../utils/src/git/git-utils.ts","../../utils/src/string/string-utils.ts","../../utils/src/index.ts","../src/s3/private-bucket.ts","../src/static-hosting/static-content.ts","../src/static-hosting/static-hosting.ts"],"sourcesContent":["/**\n * Stage Types\n *\n * What stage of deployment is this? Dev, staging, or prod?\n */\nexport const AWS_STAGE_TYPE = {\n  /**\n   * Development environment, typically used for testing and development.\n   */\n  DEV: \"dev\",\n\n  /**\n   * Staging environment, used for pre-production testing.\n   */\n  STAGE: \"stage\",\n\n  /**\n   * Production environment, used for live deployments.\n   */\n  PROD: \"prod\",\n} as const;\n\n/**\n * Above const as a type.\n */\nexport type AwsStageType = (typeof AWS_STAGE_TYPE)[keyof typeof AWS_STAGE_TYPE];\n\n/**\n * Deployment target role: whether an (account, region) is the primary or\n * secondary deployment target (e.g. primary vs replica region).\n */\nexport const DEPLOYMENT_TARGET_ROLE = {\n  /**\n   * Account and region that represents the primary region for this service.\n   * For example, the base DynamoDB Region for global tables.\n   */\n  PRIMARY: \"primary\",\n  /**\n   * Account and region that represents a secondary region for this service.\n   * For example, a replica region for a global DynamoDB table.\n   */\n  SECONDARY: \"secondary\",\n} as const;\n\n/**\n * Type for deployment target role values.\n */\nexport type DeploymentTargetRoleType =\n  (typeof DEPLOYMENT_TARGET_ROLE)[keyof typeof DEPLOYMENT_TARGET_ROLE];\n\n/**\n * Environment types (primary/secondary).\n *\n * @deprecated Use {@link DEPLOYMENT_TARGET_ROLE} instead. This constant is maintained for backward compatibility.\n */\nexport const AWS_ENVIRONMENT_TYPE = DEPLOYMENT_TARGET_ROLE;\n\n/**\n * Type for environment type values.\n *\n * @deprecated Use {@link DeploymentTargetRoleType} instead. This type is maintained for backward compatibility.\n */\nexport type AwsEnvironmentType = DeploymentTargetRoleType;\n","import { execSync } from \"node:child_process\";\n\n/**\n * Returns the current full git branch name\n *\n * ie: feature/1234 returns feature/1234\n *\n */\nexport const findGitBranch = (): string => {\n  return execSync(\"git rev-parse --abbrev-ref HEAD\")\n    .toString(\"utf8\")\n    .replace(/[\\n\\r\\s]+$/, \"\");\n};\n\nexport const findGitRepoName = (): string => {\n  /**\n   * When running in github actions this will be populated.\n   */\n  if (process.env.GITHUB_REPOSITORY) {\n    return process.env.GITHUB_REPOSITORY;\n  }\n\n  /**\n   * locally, we need to extract the repo name from the git config.\n   */\n  const remote = execSync(\"git config --get remote.origin.url\")\n    .toString(\"utf8\")\n    .replace(/[\\n\\r\\s]+$/, \"\")\n    .trim();\n\n  const match = remote.match(/[:\\/]([^/]+\\/[^/]+?)(?:\\.git)?$/);\n  const repoName = match ? match[1] : \"error-repo-name\";\n\n  return repoName;\n};\n","import * as crypto from \"node:crypto\";\n\n/**\n *\n * @param inString - string to hash\n * @param trimLength - trim to this length (defaults to 999 chars)\n * @returns Hex-encoded sha256 digest, truncated to `trimLength` characters.\n */\nexport const hashString = (inString: string, trimLength: number = 999) => {\n  return crypto\n    .createHash(\"sha256\")\n    .update(inString)\n    .digest(\"hex\")\n    .substring(0, trimLength);\n};\n\n/**\n *\n * @param inputString - string to truncate\n * @param maxLength - max length of this string\n * @returns trimmed string\n */\nexport const trimStringLength = (inputString: string, maxLength: number) => {\n  return inputString.length < maxLength\n    ? inputString\n    : inputString.substring(0, maxLength);\n};\n","export * from \"./aws/aws-types\";\nexport * from \"./git/git-utils\";\nexport * from \"./string/string-utils\";\n","import { RemovalPolicy } from \"aws-cdk-lib\";\nimport {\n  BlockPublicAccess,\n  Bucket,\n  BucketProps,\n  ObjectOwnership,\n} from \"aws-cdk-lib/aws-s3\";\nimport { Construct } from \"constructs\";\n\nexport interface PrivateBucketProps extends BucketProps {}\n\nexport class PrivateBucket extends Bucket {\n  constructor(scope: Construct, id: string, props: PrivateBucketProps = {}) {\n    const defaultProps = {\n      removalPolicy: props.removalPolicy ?? RemovalPolicy.RETAIN,\n      autoDeleteObjects: props.removalPolicy === RemovalPolicy.DESTROY,\n    };\n\n    const requiredProps = {\n      publicReadAccess: false,\n      blockPublicAccess: BlockPublicAccess.BLOCK_ALL,\n      enforceSSL: true,\n      objectOwnership: ObjectOwnership.BUCKET_OWNER_ENFORCED,\n    };\n\n    super(scope, id, { ...defaultProps, ...props, ...requiredProps });\n  }\n}\n","// eslint-disable-next-line import/no-extraneous-dependencies\nimport { findGitBranch } from \"@codedrifters/utils\";\nimport { Bucket } from \"aws-cdk-lib/aws-s3\";\nimport { BucketDeployment, Source } from \"aws-cdk-lib/aws-s3-deployment\";\nimport { StringParameter } from \"aws-cdk-lib/aws-ssm\";\nimport { paramCase } from \"change-case\";\nimport { Construct } from \"constructs\";\n\n/*******************************************************************************\n *\n *  STATIC CONTENT UPLOADER\n *\n *  This construct uploads a directory of content from a local location into S3.\n *\n *  To support PR and branch specific builds, each S3 bucket can store content\n *  for multiple domains and builds, using the following format:\n *\n *  S3-bucket/domain/*\n *\n *  A bucket used to store content for stage.openhi.org might have the\n *  following directory structure (all in the same bucket).\n *\n *  `/stage.openhi.org/*` serves content to stage.openhi.org\n *  `/feature-7.stage.openhi.org/*` serves content to feature-7.stage.openhi.org\n *  `/pr-123.stage.openhi.org/*` serves content to pr-123.stage.openhi.org\n *\n ******************************************************************************/\n\nexport interface StaticContentProps {\n  /**\n   * Parameter name to use when storing the static hosting bucket's ARN.\n   * This is needed in other later steps when deploying hosted content to S3.\n   */\n  readonly bucketArnParamName?: string;\n\n  /**\n   *  Absolute path to directory containing content for the website.\n   */\n  readonly contentSourceDirectory: string;\n\n  /**\n   *  Directory to place content into. Should start with a slash.\n   *  Example: '/widget'\n   */\n  readonly contentDestinationDirectory: string;\n\n  /**\n   *  The sub domain prefix (ie: images)\n   *\n   * @default git branch name\n   */\n  readonly subDomain?: string;\n\n  /**\n   *  The full domain (ie: staging.codedrifters.com)\n   */\n  readonly fullDomain: string;\n}\n\nexport class StaticContent extends Construct {\n  constructor(scope: Construct, id: string, props: StaticContentProps) {\n    super(scope, id);\n\n    /***************************************************************************\n     *\n     * Initial Setup\n     *\n     * Set some defaults, build domain information.\n     *\n     **************************************************************************/\n\n    const {\n      bucketArnParamName,\n      contentSourceDirectory,\n      contentDestinationDirectory,\n      subDomain,\n      fullDomain,\n    } = {\n      bucketArnParamName: \"/STATIC_WEBSITE/BUCKET_ARN\",\n      subDomain: findGitBranch(),\n      ...props,\n    };\n\n    /***************************************************************************\n     *\n     * Import and build some values from Param Store during deployment.\n     *\n     **************************************************************************/\n\n    const keyPrefix = [paramCase(subDomain), fullDomain].join(\".\");\n\n    const bucketArn = StringParameter.valueForStringParameter(\n      this,\n      bucketArnParamName,\n    );\n    const bucket = Bucket.fromBucketArn(this, \"bucket\", bucketArn);\n\n    /***************************************************************************\n     *\n     * Gather the sources we'll be deploying. We need to have an empty source\n     * for tests since it will change all the time and bork up the test\n     * snapshots if we don't.\n     *\n     **************************************************************************/\n\n    const isTestEnv = process.env.VITEST === \"true\";\n    const sources = isTestEnv ? [] : [Source.asset(contentSourceDirectory)];\n\n    new BucketDeployment(this, \"deploy\", {\n      sources,\n      destinationBucket: bucket,\n      retainOnDelete: false,\n      destinationKeyPrefix: `${keyPrefix}${contentDestinationDirectory}`,\n    });\n  }\n}\n","import * as fs from \"fs\";\nimport * as path from \"path\";\nimport { Duration, StackProps } from \"aws-cdk-lib\";\nimport {\n  Certificate,\n  CertificateValidation,\n} from \"aws-cdk-lib/aws-certificatemanager\";\nimport {\n  AccessLevel,\n  AllowedMethods,\n  CacheCookieBehavior,\n  CacheHeaderBehavior,\n  CachePolicy,\n  CacheQueryStringBehavior,\n  Distribution,\n  LambdaEdgeEventType,\n  S3OriginAccessControl,\n  Signing,\n  ViewerProtocolPolicy,\n} from \"aws-cdk-lib/aws-cloudfront\";\nimport { S3BucketOrigin } from \"aws-cdk-lib/aws-cloudfront-origins\";\nimport { Runtime } from \"aws-cdk-lib/aws-lambda\";\nimport { NodejsFunction } from \"aws-cdk-lib/aws-lambda-nodejs\";\nimport { LogGroup, RetentionDays } from \"aws-cdk-lib/aws-logs\";\nimport {\n  ARecord,\n  HostedZone,\n  HostedZoneAttributes,\n  IHostedZone,\n  RecordTarget,\n} from \"aws-cdk-lib/aws-route53\";\nimport { CloudFrontTarget } from \"aws-cdk-lib/aws-route53-targets\";\nimport { StringParameter } from \"aws-cdk-lib/aws-ssm\";\nimport { Construct } from \"constructs\";\nimport type { HostingMode } from \"./static-hosting.viewer-request-handler\";\nimport { PrivateBucket, PrivateBucketProps } from \"../s3/private-bucket\";\n\nexport interface StaticDomainProps {\n  /**\n   *  The base domain (ie: codedrifters.com)\n   */\n  readonly baseDomain: string;\n\n  /**\n   * Hosted zone ID for the base domain.\n   */\n  readonly hostedZoneAttributes: HostedZoneAttributes;\n}\n\nexport interface StaticHostingProps extends StackProps {\n  /**\n   * Short description used in various places for traceability.\n   */\n  readonly description?: string;\n\n  /**\n   * Values used to connect a domain name to the cloudfront distribution. If not\n   * supplied, cloudfront doesn't use a custom domain.\n   */\n  readonly staticDomainProps?: StaticDomainProps;\n\n  /**\n   * Parameter name to use when storing the static hosting bucket's ARN.\n   * This is needed in other later steps when deploying hosted content to S3.\n   */\n  readonly bucketArnParamName?: string;\n\n  /**\n   * Parameter name to use when storing the CloudFront Distribution Domain Name.\n   */\n  readonly distributionDomainParamName?: string;\n\n  /**\n   * Parameter name to use when storing the CloudFront Distribution ID.\n   */\n  readonly distributionIDParamName?: string;\n\n  /**\n   * Props to pass to the private S3 bucket.\n   */\n  readonly privateBucketProps?: PrivateBucketProps;\n\n  /**\n   * Selects how path-like URIs are rewritten by the viewer-request\n   * `Lambda@Edge` handler.\n   *\n   * - `spa` (default): path-like URIs rewrite to `/index.html` so a\n   *   single-page app can serve its one root index and let the client-side\n   *   router handle the path.\n   * - `static`: path-like URIs append `/index.html` (e.g. `/docs` →\n   *   `/docs/index.html`) so multi-page static sites can serve distinct\n   *   HTML per path.\n   *\n   * Multi-tenant domain-folder prepending runs after the rewrite in both\n   * modes and is unaffected by this prop.\n   *\n   * @default \"spa\"\n   */\n  readonly hostingMode?: HostingMode;\n}\n\nexport class StaticHosting extends Construct {\n  /**\n   * Full domain name used as basis for hosting.\n   */\n  public readonly fullDomain: string;\n\n  constructor(scope: Construct, id: string, props: StaticHostingProps = {}) {\n    super(scope, id);\n\n    /***************************************************************************\n     *\n     * Initial Setup\n     *\n     * Set some defaults, build domain information.\n     *\n     **************************************************************************/\n\n    const {\n      bucketArnParamName,\n      distributionDomainParamName,\n      distributionIDParamName,\n      staticDomainProps,\n      privateBucketProps,\n      hostingMode,\n    } = {\n      bucketArnParamName: \"/STATIC_WEBSITE/BUCKET_ARN\",\n      distributionDomainParamName: \"/STATIC_WEBSITE/DISTRIBUTION_DOMAIN\",\n      distributionIDParamName: \"/STATIC_WEBSITE/DISTRIBUTION_ID\",\n      hostingMode: \"spa\" as HostingMode,\n      ...props,\n    };\n\n    const { baseDomain, hostedZoneAttributes } = staticDomainProps ?? {};\n\n    /***************************************************************************\n     *\n     * PRIVATE BUCKET\n     *\n     * A bucket to store the files within.\n     * Save ARN for later deploys.\n     *\n     **************************************************************************/\n\n    const bucket = new PrivateBucket(\n      this,\n      \"static-hosting-bucket\",\n      privateBucketProps,\n    );\n\n    /***************************************************************************\n     *\n     * DNS & Wildcard Certificate\n     *\n     * If a zone Id as passed in, find the hosted zone and create a wildcard\n     * certificate for the domain.\n     *\n     **************************************************************************/\n\n    let zone: IHostedZone | undefined;\n    let certificate: Certificate | undefined;\n\n    if (hostedZoneAttributes && baseDomain) {\n      zone = HostedZone.fromHostedZoneAttributes(\n        this,\n        \"zone\",\n        hostedZoneAttributes,\n      );\n      certificate = new Certificate(this, \"wildcard-certificate\", {\n        domainName: `*.${baseDomain}`,\n        subjectAlternativeNames: [baseDomain],\n        validation: CertificateValidation.fromDnsMultiZone({\n          [`*.${baseDomain}`]: zone,\n          [baseDomain]: zone,\n        }),\n      });\n    }\n\n    /******************************************************************************\n     *\n     * `LAMBDA@EDGE` FUNCTION\n     *\n     * This handles rewriting the path from domain name.\n     *\n     *****************************************************************************/\n\n    // Explicit entry required: when omitted, NodejsFunction infers the path from the\n    // call site (the built lib/index.js), so it looks for index.viewer-request-handler.js\n    // in the package. That file is only emitted if we add it as a separate tsup entry.\n    // Use .js when present (built package); fall back to .ts for tests running from source.\n    const handlerJs = path.join(\n      __dirname,\n      \"static-hosting.viewer-request-handler.js\",\n    );\n    const handlerTs = path.join(\n      __dirname,\n      \"static-hosting.viewer-request-handler.ts\",\n    );\n    const handlerEntry = fs.existsSync(handlerJs) ? handlerJs : handlerTs;\n\n    const handler = new NodejsFunction(this, \"viewer-request-handler\", {\n      entry: handlerEntry,\n      handler: hostingMode === \"static\" ? \"staticHandler\" : \"spaHandler\",\n      memorySize: 128,\n      runtime: Runtime.NODEJS_24_X,\n      logGroup: new LogGroup(this, \"viewer-request-handler-log-group\", {\n        retention: RetentionDays.ONE_MONTH,\n      }),\n    });\n\n    /******************************************************************************\n     *\n     *  CLOUDFRONT CONFIG\n     *\n     *  Setup a CloudFront Distribution for the bucket.\n     *\n     *****************************************************************************/\n\n    const cachePolicy = new CachePolicy(this, \"cloudfront-policy\", {\n      comment: \"Relatively conservative TTL policy.\",\n      maxTtl: Duration.seconds(300),\n      minTtl: Duration.seconds(0),\n      defaultTtl: Duration.seconds(60),\n      headerBehavior: CacheHeaderBehavior.none(),\n      queryStringBehavior: CacheQueryStringBehavior.none(),\n      cookieBehavior: CacheCookieBehavior.none(),\n      enableAcceptEncodingGzip: true,\n      enableAcceptEncodingBrotli: true,\n    });\n\n    const oac = new S3OriginAccessControl(this, \"MyOAC\", {\n      signing: Signing.SIGV4_NO_OVERRIDE,\n    });\n    const origin = S3BucketOrigin.withOriginAccessControl(bucket, {\n      originAccessControl: oac,\n      originAccessLevels: [AccessLevel.READ],\n    });\n\n    const distribution = new Distribution(this, \"cloudfront-distribution\", {\n      comment: `Distribution for ${props.description ?? id}`,\n\n      /**\n       * Only if domain was supplied\n       */\n      ...(certificate && baseDomain\n        ? {\n            certificate,\n            domainNames: [baseDomain, `*.${baseDomain}`],\n          }\n        : {}),\n\n      defaultBehavior: {\n        origin,\n        viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,\n        cachePolicy,\n        allowedMethods: AllowedMethods.ALLOW_GET_HEAD_OPTIONS,\n        edgeLambdas: [\n          {\n            functionVersion: handler.currentVersion,\n            eventType: LambdaEdgeEventType.VIEWER_REQUEST,\n          },\n        ],\n      },\n      defaultRootObject: \"index.html\",\n    });\n\n    /**\n     * We finally have enough information to set the full domain.\n     */\n    this.fullDomain =\n      certificate && baseDomain ? baseDomain : distribution.domainName;\n\n    /***************************************************************************\n     *\n     *  DNS ENTRY\n     *\n     * Link cloudfront to both the root fulldomain and all possible subdomains.\n     *\n     **************************************************************************/\n\n    if (zone) {\n      new ARecord(this, \"root-dns-entry\", {\n        zone,\n        recordName: baseDomain ? baseDomain : \"\",\n        target: RecordTarget.fromAlias(new CloudFrontTarget(distribution)),\n      });\n\n      new ARecord(this, \"wc-dns-entry\", {\n        zone,\n        recordName: baseDomain ? `*.${baseDomain}` : \"*\",\n        target: RecordTarget.fromAlias(new CloudFrontTarget(distribution)),\n      });\n    }\n\n    /***************************************************************************\n     *\n     * EXPORTS\n     *\n     * Used by content uploader later.\n     *\n     **************************************************************************/\n\n    new StringParameter(this, \"dist-domain\", {\n      description: `GENERATED DO NOT CHANGE - CloudFront Distribution Details (${props.description ?? id}).`,\n      parameterName: distributionDomainParamName,\n      stringValue: distribution.domainName,\n    });\n\n    new StringParameter(this, \"dist-id\", {\n      description: `GENERATED DO NOT CHANGE - CloudFront Distribution Details (${props.description ?? id}).`,\n      parameterName: distributionIDParamName,\n      stringValue: distribution.distributionId,\n    });\n\n    new StringParameter(this, \"bucket-arn\", {\n      description: `GENERATED DO NOT CHANGE - S3 Bucket ARN for (${props.description ?? id}).`,\n      parameterName: bucketArnParamName,\n      stringValue: bucket.bucketArn,\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAKa,YAAA,iBAAiB;;;;MAI5B,KAAK;;;;MAKL,OAAO;;;;MAKP,MAAM;;AAYK,YAAA,yBAAyB;;;;;MAKpC,SAAS;;;;;MAKT,WAAW;;AAcA,YAAA,uBAAuB,QAAA;;;;;;;;;;ACvDpC,QAAA,uBAAA,UAAA,eAAA;AAQO,QAAMA,iBAAgB,MAAa;AACxC,cAAO,GAAA,qBAAA,UAAS,iCAAiC,EAC9C,SAAS,MAAM,EACf,QAAQ,cAAc,EAAE;IAC7B;AAJa,YAAA,gBAAaA;AAMnB,QAAM,kBAAkB,MAAa;AAI1C,UAAI,QAAQ,IAAI,mBAAmB;AACjC,eAAO,QAAQ,IAAI;MACrB;AAKA,YAAM,UAAS,GAAA,qBAAA,UAAS,oCAAoC,EACzD,SAAS,MAAM,EACf,QAAQ,cAAc,EAAE,EACxB,KAAI;AAEP,YAAM,QAAQ,OAAO,MAAM,iCAAiC;AAC5D,YAAM,WAAW,QAAQ,MAAM,CAAC,IAAI;AAEpC,aAAO;IACT;AApBa,YAAA,kBAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACd5B,QAAA,SAAA,aAAA,UAAA,QAAA,CAAA;AAQO,QAAM,aAAa,CAAC,UAAkB,aAAqB,QAAO;AACvE,aAAO,OACJ,WAAW,QAAQ,EACnB,OAAO,QAAQ,EACf,OAAO,KAAK,EACZ,UAAU,GAAG,UAAU;IAC5B;AANa,YAAA,aAAU;AAchB,QAAM,mBAAmB,CAAC,aAAqB,cAAqB;AACzE,aAAO,YAAY,SAAS,YACxB,cACA,YAAY,UAAU,GAAG,SAAS;IACxC;AAJa,YAAA,mBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;ACtB7B,iBAAA,qBAAA,OAAA;AACA,iBAAA,qBAAA,OAAA;AACA,iBAAA,wBAAA,OAAA;;;;;ACFA,SAAS,qBAAqB;AAC9B;AAAA,EACE;AAAA,EACA;AAAA,EAEA;AAAA,OACK;AAKA,IAAM,gBAAN,cAA4B,OAAO;AAAA,EACxC,YAAY,OAAkB,IAAY,QAA4B,CAAC,GAAG;AACxE,UAAM,eAAe;AAAA,MACnB,eAAe,MAAM,iBAAiB,cAAc;AAAA,MACpD,mBAAmB,MAAM,kBAAkB,cAAc;AAAA,IAC3D;AAEA,UAAM,gBAAgB;AAAA,MACpB,kBAAkB;AAAA,MAClB,mBAAmB,kBAAkB;AAAA,MACrC,YAAY;AAAA,MACZ,iBAAiB,gBAAgB;AAAA,IACnC;AAEA,UAAM,OAAO,IAAI,EAAE,GAAG,cAAc,GAAG,OAAO,GAAG,cAAc,CAAC;AAAA,EAClE;AACF;;;AC1BA,mBAA8B;AAC9B,SAAS,UAAAC,eAAc;AACvB,SAAS,kBAAkB,cAAc;AACzC,SAAS,uBAAuB;AAChC,SAAS,iBAAiB;AAC1B,SAAS,iBAAiB;AAqDnB,IAAM,gBAAN,cAA4B,UAAU;AAAA,EAC3C,YAAY,OAAkB,IAAY,OAA2B;AACnE,UAAM,OAAO,EAAE;AAUf,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IAAI;AAAA,MACF,oBAAoB;AAAA,MACpB,eAAW,4BAAc;AAAA,MACzB,GAAG;AAAA,IACL;AAQA,UAAM,YAAY,CAAC,UAAU,SAAS,GAAG,UAAU,EAAE,KAAK,GAAG;AAE7D,UAAM,YAAY,gBAAgB;AAAA,MAChC;AAAA,MACA;AAAA,IACF;AACA,UAAM,SAASA,QAAO,cAAc,MAAM,UAAU,SAAS;AAU7D,UAAM,YAAY,QAAQ,IAAI,WAAW;AACzC,UAAM,UAAU,YAAY,CAAC,IAAI,CAAC,OAAO,MAAM,sBAAsB,CAAC;AAEtE,QAAI,iBAAiB,MAAM,UAAU;AAAA,MACnC;AAAA,MACA,mBAAmB;AAAA,MACnB,gBAAgB;AAAA,MAChB,sBAAsB,GAAG,SAAS,GAAG,2BAA2B;AAAA,IAClE,CAAC;AAAA,EACH;AACF;;;ACnHA,YAAY,QAAQ;AACpB,YAAY,UAAU;AACtB,SAAS,gBAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB;AAC/B,SAAS,eAAe;AACxB,SAAS,sBAAsB;AAC/B,SAAS,UAAU,qBAAqB;AACxC;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,OACK;AACP,SAAS,wBAAwB;AACjC,SAAS,mBAAAC,wBAAuB;AAChC,SAAS,aAAAC,kBAAiB;AAoEnB,IAAM,gBAAN,cAA4BC,WAAU;AAAA,EAM3C,YAAY,OAAkB,IAAY,QAA4B,CAAC,GAAG;AACxE,UAAM,OAAO,EAAE;AAUf,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IAAI;AAAA,MACF,oBAAoB;AAAA,MACpB,6BAA6B;AAAA,MAC7B,yBAAyB;AAAA,MACzB,aAAa;AAAA,MACb,GAAG;AAAA,IACL;AAEA,UAAM,EAAE,YAAY,qBAAqB,IAAI,qBAAqB,CAAC;AAWnE,UAAM,SAAS,IAAI;AAAA,MACjB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAWA,QAAI;AACJ,QAAI;AAEJ,QAAI,wBAAwB,YAAY;AACtC,aAAO,WAAW;AAAA,QAChB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,oBAAc,IAAI,YAAY,MAAM,wBAAwB;AAAA,QAC1D,YAAY,KAAK,UAAU;AAAA,QAC3B,yBAAyB,CAAC,UAAU;AAAA,QACpC,YAAY,sBAAsB,iBAAiB;AAAA,UACjD,CAAC,KAAK,UAAU,EAAE,GAAG;AAAA,UACrB,CAAC,UAAU,GAAG;AAAA,QAChB,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AAcA,UAAM,YAAiB;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AACA,UAAM,YAAiB;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AACA,UAAM,eAAkB,cAAW,SAAS,IAAI,YAAY;AAE5D,UAAM,UAAU,IAAI,eAAe,MAAM,0BAA0B;AAAA,MACjE,OAAO;AAAA,MACP,SAAS,gBAAgB,WAAW,kBAAkB;AAAA,MACtD,YAAY;AAAA,MACZ,SAAS,QAAQ;AAAA,MACjB,UAAU,IAAI,SAAS,MAAM,oCAAoC;AAAA,QAC/D,WAAW,cAAc;AAAA,MAC3B,CAAC;AAAA,IACH,CAAC;AAUD,UAAM,cAAc,IAAI,YAAY,MAAM,qBAAqB;AAAA,MAC7D,SAAS;AAAA,MACT,QAAQ,SAAS,QAAQ,GAAG;AAAA,MAC5B,QAAQ,SAAS,QAAQ,CAAC;AAAA,MAC1B,YAAY,SAAS,QAAQ,EAAE;AAAA,MAC/B,gBAAgB,oBAAoB,KAAK;AAAA,MACzC,qBAAqB,yBAAyB,KAAK;AAAA,MACnD,gBAAgB,oBAAoB,KAAK;AAAA,MACzC,0BAA0B;AAAA,MAC1B,4BAA4B;AAAA,IAC9B,CAAC;AAED,UAAM,MAAM,IAAI,sBAAsB,MAAM,SAAS;AAAA,MACnD,SAAS,QAAQ;AAAA,IACnB,CAAC;AACD,UAAM,SAAS,eAAe,wBAAwB,QAAQ;AAAA,MAC5D,qBAAqB;AAAA,MACrB,oBAAoB,CAAC,YAAY,IAAI;AAAA,IACvC,CAAC;AAED,UAAM,eAAe,IAAI,aAAa,MAAM,2BAA2B;AAAA,MACrE,SAAS,oBAAoB,MAAM,eAAe,EAAE;AAAA;AAAA;AAAA;AAAA,MAKpD,GAAI,eAAe,aACf;AAAA,QACE;AAAA,QACA,aAAa,CAAC,YAAY,KAAK,UAAU,EAAE;AAAA,MAC7C,IACA,CAAC;AAAA,MAEL,iBAAiB;AAAA,QACf;AAAA,QACA,sBAAsB,qBAAqB;AAAA,QAC3C;AAAA,QACA,gBAAgB,eAAe;AAAA,QAC/B,aAAa;AAAA,UACX;AAAA,YACE,iBAAiB,QAAQ;AAAA,YACzB,WAAW,oBAAoB;AAAA,UACjC;AAAA,QACF;AAAA,MACF;AAAA,MACA,mBAAmB;AAAA,IACrB,CAAC;AAKD,SAAK,aACH,eAAe,aAAa,aAAa,aAAa;AAUxD,QAAI,MAAM;AACR,UAAI,QAAQ,MAAM,kBAAkB;AAAA,QAClC;AAAA,QACA,YAAY,aAAa,aAAa;AAAA,QACtC,QAAQ,aAAa,UAAU,IAAI,iBAAiB,YAAY,CAAC;AAAA,MACnE,CAAC;AAED,UAAI,QAAQ,MAAM,gBAAgB;AAAA,QAChC;AAAA,QACA,YAAY,aAAa,KAAK,UAAU,KAAK;AAAA,QAC7C,QAAQ,aAAa,UAAU,IAAI,iBAAiB,YAAY,CAAC;AAAA,MACnE,CAAC;AAAA,IACH;AAUA,QAAIC,iBAAgB,MAAM,eAAe;AAAA,MACvC,aAAa,8DAA8D,MAAM,eAAe,EAAE;AAAA,MAClG,eAAe;AAAA,MACf,aAAa,aAAa;AAAA,IAC5B,CAAC;AAED,QAAIA,iBAAgB,MAAM,WAAW;AAAA,MACnC,aAAa,8DAA8D,MAAM,eAAe,EAAE;AAAA,MAClG,eAAe;AAAA,MACf,aAAa,aAAa;AAAA,IAC5B,CAAC;AAED,QAAIA,iBAAgB,MAAM,cAAc;AAAA,MACtC,aAAa,gDAAgD,MAAM,eAAe,EAAE;AAAA,MACpF,eAAe;AAAA,MACf,aAAa,OAAO;AAAA,IACtB,CAAC;AAAA,EACH;AACF;","names":["findGitBranch","Bucket","StringParameter","Construct","Construct","StringParameter"]}
+{"version":3,"sources":["../../utils/src/aws/aws-types.ts","../../utils/src/git/git-utils.ts","../../utils/src/string/string-utils.ts","../../utils/src/index.ts","../src/lambda/pnpm-workspace-nodejs-function.ts","../src/lambda/pnpm-workspace-parser.ts","../src/s3/private-bucket.ts","../src/static-hosting/static-content.ts","../src/static-hosting/static-hosting.ts"],"sourcesContent":["/**\n * Stage Types\n *\n * What stage of deployment is this? Dev, staging, or prod?\n */\nexport const AWS_STAGE_TYPE = {\n  /**\n   * Development environment, typically used for testing and development.\n   */\n  DEV: \"dev\",\n\n  /**\n   * Staging environment, used for pre-production testing.\n   */\n  STAGE: \"stage\",\n\n  /**\n   * Production environment, used for live deployments.\n   */\n  PROD: \"prod\",\n} as const;\n\n/**\n * Above const as a type.\n */\nexport type AwsStageType = (typeof AWS_STAGE_TYPE)[keyof typeof AWS_STAGE_TYPE];\n\n/**\n * Deployment target role: whether an (account, region) is the primary or\n * secondary deployment target (e.g. primary vs replica region).\n */\nexport const DEPLOYMENT_TARGET_ROLE = {\n  /**\n   * Account and region that represents the primary region for this service.\n   * For example, the base DynamoDB Region for global tables.\n   */\n  PRIMARY: \"primary\",\n  /**\n   * Account and region that represents a secondary region for this service.\n   * For example, a replica region for a global DynamoDB table.\n   */\n  SECONDARY: \"secondary\",\n} as const;\n\n/**\n * Type for deployment target role values.\n */\nexport type DeploymentTargetRoleType =\n  (typeof DEPLOYMENT_TARGET_ROLE)[keyof typeof DEPLOYMENT_TARGET_ROLE];\n\n/**\n * Environment types (primary/secondary).\n *\n * @deprecated Use {@link DEPLOYMENT_TARGET_ROLE} instead. This constant is maintained for backward compatibility.\n */\nexport const AWS_ENVIRONMENT_TYPE = DEPLOYMENT_TARGET_ROLE;\n\n/**\n * Type for environment type values.\n *\n * @deprecated Use {@link DeploymentTargetRoleType} instead. This type is maintained for backward compatibility.\n */\nexport type AwsEnvironmentType = DeploymentTargetRoleType;\n","import { execSync } from \"node:child_process\";\n\n/**\n * Returns the current full git branch name\n *\n * ie: feature/1234 returns feature/1234\n *\n */\nexport const findGitBranch = (): string => {\n  return execSync(\"git rev-parse --abbrev-ref HEAD\")\n    .toString(\"utf8\")\n    .replace(/[\\n\\r\\s]+$/, \"\");\n};\n\nexport const findGitRepoName = (): string => {\n  /**\n   * When running in github actions this will be populated.\n   */\n  if (process.env.GITHUB_REPOSITORY) {\n    return process.env.GITHUB_REPOSITORY;\n  }\n\n  /**\n   * locally, we need to extract the repo name from the git config.\n   */\n  const remote = execSync(\"git config --get remote.origin.url\")\n    .toString(\"utf8\")\n    .replace(/[\\n\\r\\s]+$/, \"\")\n    .trim();\n\n  const match = remote.match(/[:\\/]([^/]+\\/[^/]+?)(?:\\.git)?$/);\n  const repoName = match ? match[1] : \"error-repo-name\";\n\n  return repoName;\n};\n","import * as crypto from \"node:crypto\";\n\n/**\n *\n * @param inString - string to hash\n * @param trimLength - trim to this length (defaults to 999 chars)\n * @returns Hex-encoded sha256 digest, truncated to `trimLength` characters.\n */\nexport const hashString = (inString: string, trimLength: number = 999) => {\n  return crypto\n    .createHash(\"sha256\")\n    .update(inString)\n    .digest(\"hex\")\n    .substring(0, trimLength);\n};\n\n/**\n *\n * @param inputString - string to truncate\n * @param maxLength - max length of this string\n * @returns trimmed string\n */\nexport const trimStringLength = (inputString: string, maxLength: number) => {\n  return inputString.length < maxLength\n    ? inputString\n    : inputString.substring(0, maxLength);\n};\n","export * from \"./aws/aws-types\";\nexport * from \"./git/git-utils\";\nexport * from \"./string/string-utils\";\n","import * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport {\n  ICommandHooks,\n  NodejsFunction,\n  NodejsFunctionProps,\n} from \"aws-cdk-lib/aws-lambda-nodejs\";\nimport { Construct } from \"constructs\";\nimport {\n  findPnpmWorkspaceFile,\n  mergeNpmrc,\n  readPnpmWorkspacePolicy,\n  renderNpmrcLines,\n} from \"./pnpm-workspace-parser\";\n\n/**\n * Props for `PnpmWorkspaceNodejsFunction`. Extends\n * `NodejsFunctionProps` so the wrapper is a drop-in for any existing\n * `NodejsFunction` call site.\n */\nexport interface PnpmWorkspaceNodejsFunctionProps extends NodejsFunctionProps {\n  /**\n   * Directory to begin the upward search for `pnpm-workspace.yaml`.\n   * Defaults to the directory of the resolved entry path.\n   */\n  readonly workspaceSearchFrom?: string;\n\n  /**\n   * Skip the policy-mirror step entirely. Useful for tests or when the\n   * caller wants the pure `NodejsFunction` behavior.\n   *\n   * @default false\n   */\n  readonly disablePnpmPolicyMirror?: boolean;\n}\n\n/**\n * Result of `mirrorPnpmWorkspacePolicy` — describes what the policy\n * mirror did for one entry.\n */\nexport interface MirrorPnpmWorkspacePolicyResult {\n  /** Resolved `.npmrc` path if a write happened, otherwise undefined. */\n  readonly npmrcPath?: string;\n  /** Reason the mirror was a no-op, if it was. */\n  readonly skippedReason?:\n    | \"missing-entry\"\n    | \"missing-workspace-file\"\n    | \"empty-policy\"\n    | \"no-change\";\n}\n\n/**\n * Mirror the workspace pnpm policy into an `.npmrc` adjacent to the\n * Lambda entry. Pure side-effect helper used by\n * `PnpmWorkspaceNodejsFunction`; exported so consumers can drive it\n * from other call sites if desired.\n */\nexport const mirrorPnpmWorkspacePolicy = (params: {\n  readonly entry: string;\n  readonly workspaceSearchFrom?: string;\n}): MirrorPnpmWorkspacePolicyResult => {\n  const { entry, workspaceSearchFrom } = params;\n  if (!fs.existsSync(entry)) {\n    return { skippedReason: \"missing-entry\" };\n  }\n\n  const entryDir = path.dirname(path.resolve(entry));\n  const searchFrom = workspaceSearchFrom\n    ? path.resolve(workspaceSearchFrom)\n    : entryDir;\n\n  const workspaceFile = findPnpmWorkspaceFile(searchFrom);\n  if (!workspaceFile) {\n    return { skippedReason: \"missing-workspace-file\" };\n  }\n\n  const policy = readPnpmWorkspacePolicy(workspaceFile);\n  const lines = renderNpmrcLines(policy);\n  if (lines.length === 0) {\n    return { skippedReason: \"empty-policy\" };\n  }\n\n  const npmrcPath = path.join(entryDir, \".npmrc\");\n  const existing = fs.existsSync(npmrcPath)\n    ? fs.readFileSync(npmrcPath, \"utf8\")\n    : undefined;\n  const merged = mergeNpmrc(existing, lines);\n\n  if (merged === existing) {\n    return { npmrcPath, skippedReason: \"no-change\" };\n  }\n\n  fs.writeFileSync(npmrcPath, merged);\n  return { npmrcPath };\n};\n\n/**\n * Build an `ICommandHooks` implementation that copies an\n * entry-adjacent `.npmrc` into the bundling input directory before\n * `pnpm install` runs. Composes with any caller-supplied hooks so\n * existing `beforeBundling` / `beforeInstall` / `afterBundling`\n * commands are preserved.\n *\n * Exported for unit testing; the construct wires this automatically.\n */\nexport const buildNpmrcCopyCommandHooks = (params: {\n  readonly npmrcPath: string;\n  readonly existingHooks?: ICommandHooks;\n}): ICommandHooks => {\n  const { npmrcPath, existingHooks } = params;\n  return {\n    beforeBundling(inputDir: string, outputDir: string): string[] {\n      return existingHooks?.beforeBundling(inputDir, outputDir) ?? [];\n    },\n    beforeInstall(inputDir: string, outputDir: string): string[] {\n      const callerCommands =\n        existingHooks?.beforeInstall(inputDir, outputDir) ?? [];\n      const copyCommand = `cp ${npmrcPath} ${inputDir}/.npmrc`;\n      return [...callerCommands, copyCommand];\n    },\n    afterBundling(inputDir: string, outputDir: string): string[] {\n      return existingHooks?.afterBundling(inputDir, outputDir) ?? [];\n    },\n  };\n};\n\n/**\n * A `NodejsFunction` wrapper that mirrors the workspace's pnpm policy\n * (currently `minimumReleaseAge` and `minimumReleaseAgeExclude`) into\n * an `.npmrc` adjacent to the Lambda entry before bundling.\n *\n * CDK's bundler runs `pnpm install` in an isolated temp directory\n * outside the workspace, which means `pnpm-workspace.yaml` settings\n * do not apply there. CDK does **not** copy arbitrary entry-adjacent\n * files into the bundling input directory, so the construct also\n * wires a `bundling.commandHooks.beforeInstall` hook that copies the\n * rendered `.npmrc` into the bundling input directory immediately\n * before `pnpm install` runs. Caller-supplied `commandHooks` are\n * preserved — the copy command is appended to whatever the caller\n * already returns from `beforeInstall`.\n *\n * See the `pnpm-workspace-nodejs-function` documentation page for\n * full details on what gets mirrored, merge behaviour against an\n * existing `.npmrc`, and when to disable the mirror.\n */\nexport class PnpmWorkspaceNodejsFunction extends NodejsFunction {\n  constructor(\n    scope: Construct,\n    id: string,\n    props: PnpmWorkspaceNodejsFunctionProps,\n  ) {\n    let mirrorResult: MirrorPnpmWorkspacePolicyResult | undefined;\n    if (!props.disablePnpmPolicyMirror && props.entry) {\n      mirrorResult = mirrorPnpmWorkspacePolicy({\n        entry: props.entry,\n        workspaceSearchFrom: props.workspaceSearchFrom,\n      });\n    }\n\n    const { disablePnpmPolicyMirror, workspaceSearchFrom, ...rest } = props;\n    void disablePnpmPolicyMirror;\n    void workspaceSearchFrom;\n\n    // Wire the beforeInstall hook only when the mirror produced (or\n    // confirmed) an .npmrc file on disk. Other skippedReason values\n    // (`missing-entry`, `missing-workspace-file`, `empty-policy`) mean\n    // there is nothing to copy; falling through to plain NodejsFunction\n    // behavior is correct in those cases.\n    const npmrcPath = mirrorResult?.npmrcPath;\n    const shouldWireHook = npmrcPath !== undefined && fs.existsSync(npmrcPath);\n\n    const propsWithHook: NodejsFunctionProps = shouldWireHook\n      ? {\n          ...rest,\n          bundling: {\n            ...rest.bundling,\n            commandHooks: buildNpmrcCopyCommandHooks({\n              npmrcPath,\n              existingHooks: rest.bundling?.commandHooks,\n            }),\n          },\n        }\n      : rest;\n\n    super(scope, id, propsWithHook);\n  }\n}\n","import * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport * as yaml from \"js-yaml\";\n\n/**\n * Subset of `pnpm-workspace.yaml` fields that map to `.npmrc` keys\n * pnpm honours when running install in a non-workspace directory.\n */\nexport interface PnpmWorkspacePolicy {\n  /** `minimumReleaseAge` (minutes) — equivalent to `.npmrc` `minimum-release-age`. */\n  readonly minimumReleaseAge?: number;\n  /**\n   * `minimumReleaseAgeExclude` — equivalent to `.npmrc`\n   * `minimum-release-age-exclude` (comma-separated when serialised).\n   */\n  readonly minimumReleaseAgeExclude?: ReadonlyArray<string>;\n}\n\n/**\n * Walk up from `startDir` until a `pnpm-workspace.yaml` file is found\n * and return its absolute path. Returns `undefined` when the filesystem\n * root is reached without finding one.\n */\nexport const findPnpmWorkspaceFile = (startDir: string): string | undefined => {\n  let current = path.resolve(startDir);\n  while (true) {\n    const candidate = path.join(current, \"pnpm-workspace.yaml\");\n    if (fs.existsSync(candidate)) {\n      return candidate;\n    }\n    const parent = path.dirname(current);\n    if (parent === current) {\n      return undefined;\n    }\n    current = parent;\n  }\n};\n\n/**\n * Read the policy subset (`minimumReleaseAge` and\n * `minimumReleaseAgeExclude`) from a `pnpm-workspace.yaml` file.\n *\n * Returns an empty object when the file is missing, unreadable, or\n * contains neither key. Throws when the file is present but YAML\n * parsing fails — the caller is expected to surface a clear error.\n */\nexport const readPnpmWorkspacePolicy = (\n  workspaceFile: string,\n): PnpmWorkspacePolicy => {\n  if (!fs.existsSync(workspaceFile)) {\n    return {};\n  }\n\n  const raw = fs.readFileSync(workspaceFile, \"utf8\");\n  const parsed = yaml.load(raw);\n\n  if (!parsed || typeof parsed !== \"object\") {\n    return {};\n  }\n\n  const obj = parsed as Record<string, unknown>;\n  const policy: {\n    -readonly [K in keyof PnpmWorkspacePolicy]: PnpmWorkspacePolicy[K];\n  } = {};\n\n  const age = obj.minimumReleaseAge;\n  if (typeof age === \"number\" && Number.isFinite(age)) {\n    policy.minimumReleaseAge = age;\n  }\n\n  const exclude = obj.minimumReleaseAgeExclude;\n  if (Array.isArray(exclude)) {\n    const cleaned = exclude.filter(\n      (entry): entry is string => typeof entry === \"string\" && entry.length > 0,\n    );\n    if (cleaned.length > 0) {\n      policy.minimumReleaseAgeExclude = cleaned;\n    }\n  }\n\n  return policy;\n};\n\n/**\n * Render an `.npmrc` body that pnpm will honour when installing in\n * a directory outside the workspace tree. The keys emitted here are\n * the `.npmrc` equivalents of the `pnpm-workspace.yaml` fields in\n * {@link PnpmWorkspacePolicy} — pnpm reads `minimum-release-age` and\n * `minimum-release-age-exclude` from `.npmrc`, not from the workspace\n * file, when the install runs outside the workspace.\n *\n * Returns an empty string when the policy carries no relevant fields.\n */\nexport const renderNpmrcLines = (\n  policy: PnpmWorkspacePolicy,\n): ReadonlyArray<string> => {\n  const lines: Array<string> = [];\n\n  if (typeof policy.minimumReleaseAge === \"number\") {\n    lines.push(`minimum-release-age=${policy.minimumReleaseAge}`);\n  }\n\n  const exclude = policy.minimumReleaseAgeExclude ?? [];\n  if (exclude.length > 0) {\n    lines.push(`minimum-release-age-exclude=${exclude.join(\",\")}`);\n  }\n\n  return lines;\n};\n\n/**\n * Parse the body of an existing `.npmrc` file into a map of trimmed\n * key/value pairs. Lines that are blank or start with `#` are dropped.\n * Lines without an `=` are dropped.\n */\nexport const parseNpmrc = (body: string): Map<string, string> => {\n  const map = new Map<string, string>();\n  for (const rawLine of body.split(/\\r?\\n/)) {\n    const line = rawLine.trim();\n    if (line.length === 0 || line.startsWith(\"#\")) {\n      continue;\n    }\n    const eq = line.indexOf(\"=\");\n    if (eq < 0) {\n      continue;\n    }\n    const key = line.slice(0, eq).trim();\n    const value = line.slice(eq + 1).trim();\n    if (key.length > 0) {\n      map.set(key, value);\n    }\n  }\n  return map;\n};\n\n/**\n * Merge a set of policy-derived `.npmrc` lines into an existing\n * `.npmrc` body. Our keys overwrite matching keys in the existing\n * body; all other keys are preserved. Returns the new `.npmrc` body\n * (always terminated by a trailing newline when non-empty).\n */\nexport const mergeNpmrc = (\n  existing: string | undefined,\n  ourLines: ReadonlyArray<string>,\n): string => {\n  if (ourLines.length === 0) {\n    return existing ?? \"\";\n  }\n\n  const ourMap = new Map<string, string>();\n  for (const line of ourLines) {\n    const eq = line.indexOf(\"=\");\n    if (eq < 0) {\n      continue;\n    }\n    ourMap.set(line.slice(0, eq).trim(), line.slice(eq + 1).trim());\n  }\n\n  const existingMap = parseNpmrc(existing ?? \"\");\n  for (const [key, value] of ourMap) {\n    existingMap.set(key, value);\n  }\n\n  const orderedKeys: Array<string> = [];\n  const seen = new Set<string>();\n\n  // Preserve the original line order for any pre-existing keys.\n  for (const rawLine of (existing ?? \"\").split(/\\r?\\n/)) {\n    const line = rawLine.trim();\n    if (line.length === 0 || line.startsWith(\"#\")) {\n      continue;\n    }\n    const eq = line.indexOf(\"=\");\n    if (eq < 0) {\n      continue;\n    }\n    const key = line.slice(0, eq).trim();\n    if (key.length > 0 && existingMap.has(key) && !seen.has(key)) {\n      orderedKeys.push(key);\n      seen.add(key);\n    }\n  }\n\n  // Append any keys we added that weren't already present.\n  for (const key of ourMap.keys()) {\n    if (!seen.has(key)) {\n      orderedKeys.push(key);\n      seen.add(key);\n    }\n  }\n\n  const body = orderedKeys\n    .map((key) => `${key}=${existingMap.get(key)}`)\n    .join(\"\\n\");\n\n  return body.length === 0 ? \"\" : `${body}\\n`;\n};\n","import { RemovalPolicy } from \"aws-cdk-lib\";\nimport {\n  BlockPublicAccess,\n  Bucket,\n  BucketProps,\n  ObjectOwnership,\n} from \"aws-cdk-lib/aws-s3\";\nimport { Construct } from \"constructs\";\n\nexport interface PrivateBucketProps extends BucketProps {}\n\nexport class PrivateBucket extends Bucket {\n  constructor(scope: Construct, id: string, props: PrivateBucketProps = {}) {\n    const defaultProps = {\n      removalPolicy: props.removalPolicy ?? RemovalPolicy.RETAIN,\n      autoDeleteObjects: props.removalPolicy === RemovalPolicy.DESTROY,\n    };\n\n    const requiredProps = {\n      publicReadAccess: false,\n      blockPublicAccess: BlockPublicAccess.BLOCK_ALL,\n      enforceSSL: true,\n      objectOwnership: ObjectOwnership.BUCKET_OWNER_ENFORCED,\n    };\n\n    super(scope, id, { ...defaultProps, ...props, ...requiredProps });\n  }\n}\n","// eslint-disable-next-line import/no-extraneous-dependencies\nimport { findGitBranch } from \"@codedrifters/utils\";\nimport { Bucket } from \"aws-cdk-lib/aws-s3\";\nimport { BucketDeployment, Source } from \"aws-cdk-lib/aws-s3-deployment\";\nimport { StringParameter } from \"aws-cdk-lib/aws-ssm\";\nimport { paramCase } from \"change-case\";\nimport { Construct } from \"constructs\";\n\n/*******************************************************************************\n *\n *  STATIC CONTENT UPLOADER\n *\n *  This construct uploads a directory of content from a local location into S3.\n *\n *  To support PR and branch specific builds, each S3 bucket can store content\n *  for multiple domains and builds, using the following format:\n *\n *  S3-bucket/domain/*\n *\n *  A bucket used to store content for stage.openhi.org might have the\n *  following directory structure (all in the same bucket).\n *\n *  `/stage.openhi.org/*` serves content to stage.openhi.org\n *  `/feature-7.stage.openhi.org/*` serves content to feature-7.stage.openhi.org\n *  `/pr-123.stage.openhi.org/*` serves content to pr-123.stage.openhi.org\n *\n ******************************************************************************/\n\nexport interface StaticContentProps {\n  /**\n   * Parameter name to use when storing the static hosting bucket's ARN.\n   * This is needed in other later steps when deploying hosted content to S3.\n   */\n  readonly bucketArnParamName?: string;\n\n  /**\n   *  Absolute path to directory containing content for the website.\n   */\n  readonly contentSourceDirectory: string;\n\n  /**\n   *  Directory to place content into. Should start with a slash.\n   *  Example: '/widget'\n   */\n  readonly contentDestinationDirectory: string;\n\n  /**\n   *  The sub domain prefix (ie: images)\n   *\n   * @default git branch name\n   */\n  readonly subDomain?: string;\n\n  /**\n   *  The full domain (ie: staging.codedrifters.com)\n   */\n  readonly fullDomain: string;\n}\n\nexport class StaticContent extends Construct {\n  constructor(scope: Construct, id: string, props: StaticContentProps) {\n    super(scope, id);\n\n    /***************************************************************************\n     *\n     * Initial Setup\n     *\n     * Set some defaults, build domain information.\n     *\n     **************************************************************************/\n\n    const {\n      bucketArnParamName,\n      contentSourceDirectory,\n      contentDestinationDirectory,\n      subDomain,\n      fullDomain,\n    } = {\n      bucketArnParamName: \"/STATIC_WEBSITE/BUCKET_ARN\",\n      subDomain: findGitBranch(),\n      ...props,\n    };\n\n    /***************************************************************************\n     *\n     * Import and build some values from Param Store during deployment.\n     *\n     **************************************************************************/\n\n    const keyPrefix = [paramCase(subDomain), fullDomain].join(\".\");\n\n    const bucketArn = StringParameter.valueForStringParameter(\n      this,\n      bucketArnParamName,\n    );\n    const bucket = Bucket.fromBucketArn(this, \"bucket\", bucketArn);\n\n    /***************************************************************************\n     *\n     * Gather the sources we'll be deploying. We need to have an empty source\n     * for tests since it will change all the time and bork up the test\n     * snapshots if we don't.\n     *\n     **************************************************************************/\n\n    const isTestEnv = process.env.VITEST === \"true\";\n    const sources = isTestEnv ? [] : [Source.asset(contentSourceDirectory)];\n\n    new BucketDeployment(this, \"deploy\", {\n      sources,\n      destinationBucket: bucket,\n      retainOnDelete: false,\n      destinationKeyPrefix: `${keyPrefix}${contentDestinationDirectory}`,\n    });\n  }\n}\n","import * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport { Duration, StackProps } from \"aws-cdk-lib\";\nimport {\n  Certificate,\n  CertificateValidation,\n} from \"aws-cdk-lib/aws-certificatemanager\";\nimport {\n  AccessLevel,\n  AllowedMethods,\n  CacheCookieBehavior,\n  CacheHeaderBehavior,\n  CachePolicy,\n  CacheQueryStringBehavior,\n  Distribution,\n  LambdaEdgeEventType,\n  S3OriginAccessControl,\n  Signing,\n  ViewerProtocolPolicy,\n} from \"aws-cdk-lib/aws-cloudfront\";\nimport { S3BucketOrigin } from \"aws-cdk-lib/aws-cloudfront-origins\";\nimport { Runtime } from \"aws-cdk-lib/aws-lambda\";\nimport { NodejsFunction } from \"aws-cdk-lib/aws-lambda-nodejs\";\nimport { LogGroup, RetentionDays } from \"aws-cdk-lib/aws-logs\";\nimport {\n  ARecord,\n  HostedZone,\n  HostedZoneAttributes,\n  IHostedZone,\n  RecordTarget,\n} from \"aws-cdk-lib/aws-route53\";\nimport { CloudFrontTarget } from \"aws-cdk-lib/aws-route53-targets\";\nimport { StringParameter } from \"aws-cdk-lib/aws-ssm\";\nimport { Construct } from \"constructs\";\nimport type { HostingMode } from \"./static-hosting.viewer-request-handler\";\nimport { PrivateBucket, PrivateBucketProps } from \"../s3/private-bucket\";\n\nexport interface StaticDomainProps {\n  /**\n   *  The base domain (ie: codedrifters.com)\n   */\n  readonly baseDomain: string;\n\n  /**\n   * Hosted zone ID for the base domain.\n   */\n  readonly hostedZoneAttributes: HostedZoneAttributes;\n}\n\nexport interface StaticHostingProps extends StackProps {\n  /**\n   * Short description used in various places for traceability.\n   */\n  readonly description?: string;\n\n  /**\n   * Values used to connect a domain name to the cloudfront distribution. If not\n   * supplied, cloudfront doesn't use a custom domain.\n   */\n  readonly staticDomainProps?: StaticDomainProps;\n\n  /**\n   * Parameter name to use when storing the static hosting bucket's ARN.\n   * This is needed in other later steps when deploying hosted content to S3.\n   */\n  readonly bucketArnParamName?: string;\n\n  /**\n   * Parameter name to use when storing the CloudFront Distribution Domain Name.\n   */\n  readonly distributionDomainParamName?: string;\n\n  /**\n   * Parameter name to use when storing the CloudFront Distribution ID.\n   */\n  readonly distributionIDParamName?: string;\n\n  /**\n   * Props to pass to the private S3 bucket.\n   */\n  readonly privateBucketProps?: PrivateBucketProps;\n\n  /**\n   * Selects how path-like URIs are rewritten by the viewer-request\n   * `Lambda@Edge` handler.\n   *\n   * - `spa` (default): path-like URIs rewrite to `/index.html` so a\n   *   single-page app can serve its one root index and let the client-side\n   *   router handle the path.\n   * - `static`: path-like URIs append `/index.html` (e.g. `/docs` →\n   *   `/docs/index.html`) so multi-page static sites can serve distinct\n   *   HTML per path.\n   *\n   * Multi-tenant domain-folder prepending runs after the rewrite in both\n   * modes and is unaffected by this prop.\n   *\n   * @default \"spa\"\n   */\n  readonly hostingMode?: HostingMode;\n}\n\nexport class StaticHosting extends Construct {\n  /**\n   * Full domain name used as basis for hosting.\n   */\n  public readonly fullDomain: string;\n\n  constructor(scope: Construct, id: string, props: StaticHostingProps = {}) {\n    super(scope, id);\n\n    /***************************************************************************\n     *\n     * Initial Setup\n     *\n     * Set some defaults, build domain information.\n     *\n     **************************************************************************/\n\n    const {\n      bucketArnParamName,\n      distributionDomainParamName,\n      distributionIDParamName,\n      staticDomainProps,\n      privateBucketProps,\n      hostingMode,\n    } = {\n      bucketArnParamName: \"/STATIC_WEBSITE/BUCKET_ARN\",\n      distributionDomainParamName: \"/STATIC_WEBSITE/DISTRIBUTION_DOMAIN\",\n      distributionIDParamName: \"/STATIC_WEBSITE/DISTRIBUTION_ID\",\n      hostingMode: \"spa\" as HostingMode,\n      ...props,\n    };\n\n    const { baseDomain, hostedZoneAttributes } = staticDomainProps ?? {};\n\n    /***************************************************************************\n     *\n     * PRIVATE BUCKET\n     *\n     * A bucket to store the files within.\n     * Save ARN for later deploys.\n     *\n     **************************************************************************/\n\n    const bucket = new PrivateBucket(\n      this,\n      \"static-hosting-bucket\",\n      privateBucketProps,\n    );\n\n    /***************************************************************************\n     *\n     * DNS & Wildcard Certificate\n     *\n     * If a zone Id as passed in, find the hosted zone and create a wildcard\n     * certificate for the domain.\n     *\n     **************************************************************************/\n\n    let zone: IHostedZone | undefined;\n    let certificate: Certificate | undefined;\n\n    if (hostedZoneAttributes && baseDomain) {\n      zone = HostedZone.fromHostedZoneAttributes(\n        this,\n        \"zone\",\n        hostedZoneAttributes,\n      );\n      certificate = new Certificate(this, \"wildcard-certificate\", {\n        domainName: `*.${baseDomain}`,\n        subjectAlternativeNames: [baseDomain],\n        validation: CertificateValidation.fromDnsMultiZone({\n          [`*.${baseDomain}`]: zone,\n          [baseDomain]: zone,\n        }),\n      });\n    }\n\n    /******************************************************************************\n     *\n     * `LAMBDA@EDGE` FUNCTION\n     *\n     * This handles rewriting the path from domain name.\n     *\n     *****************************************************************************/\n\n    // Explicit entry required: when omitted, NodejsFunction infers the path from the\n    // call site (the built lib/index.js), so it looks for index.viewer-request-handler.js\n    // in the package. That file is only emitted if we add it as a separate tsup entry.\n    // Use .js when present (built package); fall back to .ts for tests running from source.\n    const handlerJs = path.join(\n      __dirname,\n      \"static-hosting.viewer-request-handler.js\",\n    );\n    const handlerTs = path.join(\n      __dirname,\n      \"static-hosting.viewer-request-handler.ts\",\n    );\n    const handlerEntry = fs.existsSync(handlerJs) ? handlerJs : handlerTs;\n\n    const handler = new NodejsFunction(this, \"viewer-request-handler\", {\n      entry: handlerEntry,\n      handler: hostingMode === \"static\" ? \"staticHandler\" : \"spaHandler\",\n      memorySize: 128,\n      runtime: Runtime.NODEJS_24_X,\n      logGroup: new LogGroup(this, \"viewer-request-handler-log-group\", {\n        retention: RetentionDays.ONE_MONTH,\n      }),\n    });\n\n    /******************************************************************************\n     *\n     *  CLOUDFRONT CONFIG\n     *\n     *  Setup a CloudFront Distribution for the bucket.\n     *\n     *****************************************************************************/\n\n    const cachePolicy = new CachePolicy(this, \"cloudfront-policy\", {\n      comment: \"Relatively conservative TTL policy.\",\n      maxTtl: Duration.seconds(300),\n      minTtl: Duration.seconds(0),\n      defaultTtl: Duration.seconds(60),\n      headerBehavior: CacheHeaderBehavior.none(),\n      queryStringBehavior: CacheQueryStringBehavior.none(),\n      cookieBehavior: CacheCookieBehavior.none(),\n      enableAcceptEncodingGzip: true,\n      enableAcceptEncodingBrotli: true,\n    });\n\n    const oac = new S3OriginAccessControl(this, \"MyOAC\", {\n      signing: Signing.SIGV4_NO_OVERRIDE,\n    });\n    const origin = S3BucketOrigin.withOriginAccessControl(bucket, {\n      originAccessControl: oac,\n      originAccessLevels: [AccessLevel.READ],\n    });\n\n    const distribution = new Distribution(this, \"cloudfront-distribution\", {\n      comment: `Distribution for ${props.description ?? id}`,\n\n      /**\n       * Only if domain was supplied\n       */\n      ...(certificate && baseDomain\n        ? {\n            certificate,\n            domainNames: [baseDomain, `*.${baseDomain}`],\n          }\n        : {}),\n\n      defaultBehavior: {\n        origin,\n        viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,\n        cachePolicy,\n        allowedMethods: AllowedMethods.ALLOW_GET_HEAD_OPTIONS,\n        edgeLambdas: [\n          {\n            functionVersion: handler.currentVersion,\n            eventType: LambdaEdgeEventType.VIEWER_REQUEST,\n          },\n        ],\n      },\n      defaultRootObject: \"index.html\",\n    });\n\n    /**\n     * We finally have enough information to set the full domain.\n     */\n    this.fullDomain =\n      certificate && baseDomain ? baseDomain : distribution.domainName;\n\n    /***************************************************************************\n     *\n     *  DNS ENTRY\n     *\n     * Link cloudfront to both the root fulldomain and all possible subdomains.\n     *\n     **************************************************************************/\n\n    if (zone) {\n      new ARecord(this, \"root-dns-entry\", {\n        zone,\n        recordName: baseDomain ? baseDomain : \"\",\n        target: RecordTarget.fromAlias(new CloudFrontTarget(distribution)),\n      });\n\n      new ARecord(this, \"wc-dns-entry\", {\n        zone,\n        recordName: baseDomain ? `*.${baseDomain}` : \"*\",\n        target: RecordTarget.fromAlias(new CloudFrontTarget(distribution)),\n      });\n    }\n\n    /***************************************************************************\n     *\n     * EXPORTS\n     *\n     * Used by content uploader later.\n     *\n     **************************************************************************/\n\n    new StringParameter(this, \"dist-domain\", {\n      description: `GENERATED DO NOT CHANGE - CloudFront Distribution Details (${props.description ?? id}).`,\n      parameterName: distributionDomainParamName,\n      stringValue: distribution.domainName,\n    });\n\n    new StringParameter(this, \"dist-id\", {\n      description: `GENERATED DO NOT CHANGE - CloudFront Distribution Details (${props.description ?? id}).`,\n      parameterName: distributionIDParamName,\n      stringValue: distribution.distributionId,\n    });\n\n    new StringParameter(this, \"bucket-arn\", {\n      description: `GENERATED DO NOT CHANGE - S3 Bucket ARN for (${props.description ?? id}).`,\n      parameterName: bucketArnParamName,\n      stringValue: bucket.bucketArn,\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAKa,YAAA,iBAAiB;;;;MAI5B,KAAK;;;;MAKL,OAAO;;;;MAKP,MAAM;;AAYK,YAAA,yBAAyB;;;;;MAKpC,SAAS;;;;;MAKT,WAAW;;AAcA,YAAA,uBAAuB,QAAA;;;;;;;;;;ACvDpC,QAAA,uBAAA,UAAA,eAAA;AAQO,QAAMA,iBAAgB,MAAa;AACxC,cAAO,GAAA,qBAAA,UAAS,iCAAiC,EAC9C,SAAS,MAAM,EACf,QAAQ,cAAc,EAAE;IAC7B;AAJa,YAAA,gBAAaA;AAMnB,QAAM,kBAAkB,MAAa;AAI1C,UAAI,QAAQ,IAAI,mBAAmB;AACjC,eAAO,QAAQ,IAAI;MACrB;AAKA,YAAM,UAAS,GAAA,qBAAA,UAAS,oCAAoC,EACzD,SAAS,MAAM,EACf,QAAQ,cAAc,EAAE,EACxB,KAAI;AAEP,YAAM,QAAQ,OAAO,MAAM,iCAAiC;AAC5D,YAAM,WAAW,QAAQ,MAAM,CAAC,IAAI;AAEpC,aAAO;IACT;AApBa,YAAA,kBAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACd5B,QAAA,SAAA,aAAA,UAAA,QAAA,CAAA;AAQO,QAAM,aAAa,CAAC,UAAkB,aAAqB,QAAO;AACvE,aAAO,OACJ,WAAW,QAAQ,EACnB,OAAO,QAAQ,EACf,OAAO,KAAK,EACZ,UAAU,GAAG,UAAU;IAC5B;AANa,YAAA,aAAU;AAchB,QAAM,mBAAmB,CAAC,aAAqB,cAAqB;AACzE,aAAO,YAAY,SAAS,YACxB,cACA,YAAY,UAAU,GAAG,SAAS;IACxC;AAJa,YAAA,mBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;ACtB7B,iBAAA,qBAAA,OAAA;AACA,iBAAA,qBAAA,OAAA;AACA,iBAAA,wBAAA,OAAA;;;;;ACFA,YAAYC,SAAQ;AACpB,YAAYC,WAAU;AACtB;AAAA,EAEE;AAAA,OAEK;;;ACNP,YAAY,QAAQ;AACpB,YAAY,UAAU;AACtB,YAAY,UAAU;AAqBf,IAAM,wBAAwB,CAAC,aAAyC;AAC7E,MAAI,UAAe,aAAQ,QAAQ;AACnC,SAAO,MAAM;AACX,UAAM,YAAiB,UAAK,SAAS,qBAAqB;AAC1D,QAAO,cAAW,SAAS,GAAG;AAC5B,aAAO;AAAA,IACT;AACA,UAAM,SAAc,aAAQ,OAAO;AACnC,QAAI,WAAW,SAAS;AACtB,aAAO;AAAA,IACT;AACA,cAAU;AAAA,EACZ;AACF;AAUO,IAAM,0BAA0B,CACrC,kBACwB;AACxB,MAAI,CAAI,cAAW,aAAa,GAAG;AACjC,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,MAAS,gBAAa,eAAe,MAAM;AACjD,QAAM,SAAc,UAAK,GAAG;AAE5B,MAAI,CAAC,UAAU,OAAO,WAAW,UAAU;AACzC,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,MAAM;AACZ,QAAM,SAEF,CAAC;AAEL,QAAM,MAAM,IAAI;AAChB,MAAI,OAAO,QAAQ,YAAY,OAAO,SAAS,GAAG,GAAG;AACnD,WAAO,oBAAoB;AAAA,EAC7B;AAEA,QAAM,UAAU,IAAI;AACpB,MAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,UAAM,UAAU,QAAQ;AAAA,MACtB,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS;AAAA,IAC1E;AACA,QAAI,QAAQ,SAAS,GAAG;AACtB,aAAO,2BAA2B;AAAA,IACpC;AAAA,EACF;AAEA,SAAO;AACT;AAYO,IAAM,mBAAmB,CAC9B,WAC0B;AAC1B,QAAM,QAAuB,CAAC;AAE9B,MAAI,OAAO,OAAO,sBAAsB,UAAU;AAChD,UAAM,KAAK,uBAAuB,OAAO,iBAAiB,EAAE;AAAA,EAC9D;AAEA,QAAM,UAAU,OAAO,4BAA4B,CAAC;AACpD,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,KAAK,+BAA+B,QAAQ,KAAK,GAAG,CAAC,EAAE;AAAA,EAC/D;AAEA,SAAO;AACT;AAOO,IAAM,aAAa,CAAC,SAAsC;AAC/D,QAAM,MAAM,oBAAI,IAAoB;AACpC,aAAW,WAAW,KAAK,MAAM,OAAO,GAAG;AACzC,UAAM,OAAO,QAAQ,KAAK;AAC1B,QAAI,KAAK,WAAW,KAAK,KAAK,WAAW,GAAG,GAAG;AAC7C;AAAA,IACF;AACA,UAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,QAAI,KAAK,GAAG;AACV;AAAA,IACF;AACA,UAAM,MAAM,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK;AACnC,UAAM,QAAQ,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AACtC,QAAI,IAAI,SAAS,GAAG;AAClB,UAAI,IAAI,KAAK,KAAK;AAAA,IACpB;AAAA,EACF;AACA,SAAO;AACT;AAQO,IAAM,aAAa,CACxB,UACA,aACW;AACX,MAAI,SAAS,WAAW,GAAG;AACzB,WAAO,YAAY;AAAA,EACrB;AAEA,QAAM,SAAS,oBAAI,IAAoB;AACvC,aAAW,QAAQ,UAAU;AAC3B,UAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,QAAI,KAAK,GAAG;AACV;AAAA,IACF;AACA,WAAO,IAAI,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK,CAAC;AAAA,EAChE;AAEA,QAAM,cAAc,WAAW,YAAY,EAAE;AAC7C,aAAW,CAAC,KAAK,KAAK,KAAK,QAAQ;AACjC,gBAAY,IAAI,KAAK,KAAK;AAAA,EAC5B;AAEA,QAAM,cAA6B,CAAC;AACpC,QAAM,OAAO,oBAAI,IAAY;AAG7B,aAAW,YAAY,YAAY,IAAI,MAAM,OAAO,GAAG;AACrD,UAAM,OAAO,QAAQ,KAAK;AAC1B,QAAI,KAAK,WAAW,KAAK,KAAK,WAAW,GAAG,GAAG;AAC7C;AAAA,IACF;AACA,UAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,QAAI,KAAK,GAAG;AACV;AAAA,IACF;AACA,UAAM,MAAM,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK;AACnC,QAAI,IAAI,SAAS,KAAK,YAAY,IAAI,GAAG,KAAK,CAAC,KAAK,IAAI,GAAG,GAAG;AAC5D,kBAAY,KAAK,GAAG;AACpB,WAAK,IAAI,GAAG;AAAA,IACd;AAAA,EACF;AAGA,aAAW,OAAO,OAAO,KAAK,GAAG;AAC/B,QAAI,CAAC,KAAK,IAAI,GAAG,GAAG;AAClB,kBAAY,KAAK,GAAG;AACpB,WAAK,IAAI,GAAG;AAAA,IACd;AAAA,EACF;AAEA,QAAM,OAAO,YACV,IAAI,CAAC,QAAQ,GAAG,GAAG,IAAI,YAAY,IAAI,GAAG,CAAC,EAAE,EAC7C,KAAK,IAAI;AAEZ,SAAO,KAAK,WAAW,IAAI,KAAK,GAAG,IAAI;AAAA;AACzC;;;AD3IO,IAAM,4BAA4B,CAAC,WAGH;AACrC,QAAM,EAAE,OAAO,oBAAoB,IAAI;AACvC,MAAI,CAAI,eAAW,KAAK,GAAG;AACzB,WAAO,EAAE,eAAe,gBAAgB;AAAA,EAC1C;AAEA,QAAM,WAAgB,cAAa,cAAQ,KAAK,CAAC;AACjD,QAAM,aAAa,sBACV,cAAQ,mBAAmB,IAChC;AAEJ,QAAM,gBAAgB,sBAAsB,UAAU;AACtD,MAAI,CAAC,eAAe;AAClB,WAAO,EAAE,eAAe,yBAAyB;AAAA,EACnD;AAEA,QAAM,SAAS,wBAAwB,aAAa;AACpD,QAAM,QAAQ,iBAAiB,MAAM;AACrC,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO,EAAE,eAAe,eAAe;AAAA,EACzC;AAEA,QAAM,YAAiB,WAAK,UAAU,QAAQ;AAC9C,QAAM,WAAc,eAAW,SAAS,IACjC,iBAAa,WAAW,MAAM,IACjC;AACJ,QAAM,SAAS,WAAW,UAAU,KAAK;AAEzC,MAAI,WAAW,UAAU;AACvB,WAAO,EAAE,WAAW,eAAe,YAAY;AAAA,EACjD;AAEA,EAAG,kBAAc,WAAW,MAAM;AAClC,SAAO,EAAE,UAAU;AACrB;AAWO,IAAM,6BAA6B,CAAC,WAGtB;AACnB,QAAM,EAAE,WAAW,cAAc,IAAI;AACrC,SAAO;AAAA,IACL,eAAe,UAAkB,WAA6B;AAC5D,aAAO,eAAe,eAAe,UAAU,SAAS,KAAK,CAAC;AAAA,IAChE;AAAA,IACA,cAAc,UAAkB,WAA6B;AAC3D,YAAM,iBACJ,eAAe,cAAc,UAAU,SAAS,KAAK,CAAC;AACxD,YAAM,cAAc,MAAM,SAAS,IAAI,QAAQ;AAC/C,aAAO,CAAC,GAAG,gBAAgB,WAAW;AAAA,IACxC;AAAA,IACA,cAAc,UAAkB,WAA6B;AAC3D,aAAO,eAAe,cAAc,UAAU,SAAS,KAAK,CAAC;AAAA,IAC/D;AAAA,EACF;AACF;AAqBO,IAAM,8BAAN,cAA0C,eAAe;AAAA,EAC9D,YACE,OACA,IACA,OACA;AACA,QAAI;AACJ,QAAI,CAAC,MAAM,2BAA2B,MAAM,OAAO;AACjD,qBAAe,0BAA0B;AAAA,QACvC,OAAO,MAAM;AAAA,QACb,qBAAqB,MAAM;AAAA,MAC7B,CAAC;AAAA,IACH;AAEA,UAAM,EAAE,yBAAyB,qBAAqB,GAAG,KAAK,IAAI;AAClE,SAAK;AACL,SAAK;AAOL,UAAM,YAAY,cAAc;AAChC,UAAM,iBAAiB,cAAc,UAAgB,eAAW,SAAS;AAEzE,UAAM,gBAAqC,iBACvC;AAAA,MACE,GAAG;AAAA,MACH,UAAU;AAAA,QACR,GAAG,KAAK;AAAA,QACR,cAAc,2BAA2B;AAAA,UACvC;AAAA,UACA,eAAe,KAAK,UAAU;AAAA,QAChC,CAAC;AAAA,MACH;AAAA,IACF,IACA;AAEJ,UAAM,OAAO,IAAI,aAAa;AAAA,EAChC;AACF;;;AE1LA,SAAS,qBAAqB;AAC9B;AAAA,EACE;AAAA,EACA;AAAA,EAEA;AAAA,OACK;AAKA,IAAM,gBAAN,cAA4B,OAAO;AAAA,EACxC,YAAY,OAAkB,IAAY,QAA4B,CAAC,GAAG;AACxE,UAAM,eAAe;AAAA,MACnB,eAAe,MAAM,iBAAiB,cAAc;AAAA,MACpD,mBAAmB,MAAM,kBAAkB,cAAc;AAAA,IAC3D;AAEA,UAAM,gBAAgB;AAAA,MACpB,kBAAkB;AAAA,MAClB,mBAAmB,kBAAkB;AAAA,MACrC,YAAY;AAAA,MACZ,iBAAiB,gBAAgB;AAAA,IACnC;AAEA,UAAM,OAAO,IAAI,EAAE,GAAG,cAAc,GAAG,OAAO,GAAG,cAAc,CAAC;AAAA,EAClE;AACF;;;AC1BA,mBAA8B;AAC9B,SAAS,UAAAC,eAAc;AACvB,SAAS,kBAAkB,cAAc;AACzC,SAAS,uBAAuB;AAChC,SAAS,iBAAiB;AAC1B,SAAS,iBAAiB;AAqDnB,IAAM,gBAAN,cAA4B,UAAU;AAAA,EAC3C,YAAY,OAAkB,IAAY,OAA2B;AACnE,UAAM,OAAO,EAAE;AAUf,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IAAI;AAAA,MACF,oBAAoB;AAAA,MACpB,eAAW,4BAAc;AAAA,MACzB,GAAG;AAAA,IACL;AAQA,UAAM,YAAY,CAAC,UAAU,SAAS,GAAG,UAAU,EAAE,KAAK,GAAG;AAE7D,UAAM,YAAY,gBAAgB;AAAA,MAChC;AAAA,MACA;AAAA,IACF;AACA,UAAM,SAASA,QAAO,cAAc,MAAM,UAAU,SAAS;AAU7D,UAAM,YAAY,QAAQ,IAAI,WAAW;AACzC,UAAM,UAAU,YAAY,CAAC,IAAI,CAAC,OAAO,MAAM,sBAAsB,CAAC;AAEtE,QAAI,iBAAiB,MAAM,UAAU;AAAA,MACnC;AAAA,MACA,mBAAmB;AAAA,MACnB,gBAAgB;AAAA,MAChB,sBAAsB,GAAG,SAAS,GAAG,2BAA2B;AAAA,IAClE,CAAC;AAAA,EACH;AACF;;;ACnHA,YAAYC,SAAQ;AACpB,YAAYC,WAAU;AACtB,SAAS,gBAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB;AAC/B,SAAS,eAAe;AACxB,SAAS,kBAAAC,uBAAsB;AAC/B,SAAS,UAAU,qBAAqB;AACxC;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,OACK;AACP,SAAS,wBAAwB;AACjC,SAAS,mBAAAC,wBAAuB;AAChC,SAAS,aAAAC,kBAAiB;AAoEnB,IAAM,gBAAN,cAA4BC,WAAU;AAAA,EAM3C,YAAY,OAAkB,IAAY,QAA4B,CAAC,GAAG;AACxE,UAAM,OAAO,EAAE;AAUf,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IAAI;AAAA,MACF,oBAAoB;AAAA,MACpB,6BAA6B;AAAA,MAC7B,yBAAyB;AAAA,MACzB,aAAa;AAAA,MACb,GAAG;AAAA,IACL;AAEA,UAAM,EAAE,YAAY,qBAAqB,IAAI,qBAAqB,CAAC;AAWnE,UAAM,SAAS,IAAI;AAAA,MACjB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAWA,QAAI;AACJ,QAAI;AAEJ,QAAI,wBAAwB,YAAY;AACtC,aAAO,WAAW;AAAA,QAChB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,oBAAc,IAAI,YAAY,MAAM,wBAAwB;AAAA,QAC1D,YAAY,KAAK,UAAU;AAAA,QAC3B,yBAAyB,CAAC,UAAU;AAAA,QACpC,YAAY,sBAAsB,iBAAiB;AAAA,UACjD,CAAC,KAAK,UAAU,EAAE,GAAG;AAAA,UACrB,CAAC,UAAU,GAAG;AAAA,QAChB,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AAcA,UAAM,YAAiB;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AACA,UAAM,YAAiB;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AACA,UAAM,eAAkB,eAAW,SAAS,IAAI,YAAY;AAE5D,UAAM,UAAU,IAAIC,gBAAe,MAAM,0BAA0B;AAAA,MACjE,OAAO;AAAA,MACP,SAAS,gBAAgB,WAAW,kBAAkB;AAAA,MACtD,YAAY;AAAA,MACZ,SAAS,QAAQ;AAAA,MACjB,UAAU,IAAI,SAAS,MAAM,oCAAoC;AAAA,QAC/D,WAAW,cAAc;AAAA,MAC3B,CAAC;AAAA,IACH,CAAC;AAUD,UAAM,cAAc,IAAI,YAAY,MAAM,qBAAqB;AAAA,MAC7D,SAAS;AAAA,MACT,QAAQ,SAAS,QAAQ,GAAG;AAAA,MAC5B,QAAQ,SAAS,QAAQ,CAAC;AAAA,MAC1B,YAAY,SAAS,QAAQ,EAAE;AAAA,MAC/B,gBAAgB,oBAAoB,KAAK;AAAA,MACzC,qBAAqB,yBAAyB,KAAK;AAAA,MACnD,gBAAgB,oBAAoB,KAAK;AAAA,MACzC,0BAA0B;AAAA,MAC1B,4BAA4B;AAAA,IAC9B,CAAC;AAED,UAAM,MAAM,IAAI,sBAAsB,MAAM,SAAS;AAAA,MACnD,SAAS,QAAQ;AAAA,IACnB,CAAC;AACD,UAAM,SAAS,eAAe,wBAAwB,QAAQ;AAAA,MAC5D,qBAAqB;AAAA,MACrB,oBAAoB,CAAC,YAAY,IAAI;AAAA,IACvC,CAAC;AAED,UAAM,eAAe,IAAI,aAAa,MAAM,2BAA2B;AAAA,MACrE,SAAS,oBAAoB,MAAM,eAAe,EAAE;AAAA;AAAA;AAAA;AAAA,MAKpD,GAAI,eAAe,aACf;AAAA,QACE;AAAA,QACA,aAAa,CAAC,YAAY,KAAK,UAAU,EAAE;AAAA,MAC7C,IACA,CAAC;AAAA,MAEL,iBAAiB;AAAA,QACf;AAAA,QACA,sBAAsB,qBAAqB;AAAA,QAC3C;AAAA,QACA,gBAAgB,eAAe;AAAA,QAC/B,aAAa;AAAA,UACX;AAAA,YACE,iBAAiB,QAAQ;AAAA,YACzB,WAAW,oBAAoB;AAAA,UACjC;AAAA,QACF;AAAA,MACF;AAAA,MACA,mBAAmB;AAAA,IACrB,CAAC;AAKD,SAAK,aACH,eAAe,aAAa,aAAa,aAAa;AAUxD,QAAI,MAAM;AACR,UAAI,QAAQ,MAAM,kBAAkB;AAAA,QAClC;AAAA,QACA,YAAY,aAAa,aAAa;AAAA,QACtC,QAAQ,aAAa,UAAU,IAAI,iBAAiB,YAAY,CAAC;AAAA,MACnE,CAAC;AAED,UAAI,QAAQ,MAAM,gBAAgB;AAAA,QAChC;AAAA,QACA,YAAY,aAAa,KAAK,UAAU,KAAK;AAAA,QAC7C,QAAQ,aAAa,UAAU,IAAI,iBAAiB,YAAY,CAAC;AAAA,MACnE,CAAC;AAAA,IACH;AAUA,QAAIC,iBAAgB,MAAM,eAAe;AAAA,MACvC,aAAa,8DAA8D,MAAM,eAAe,EAAE;AAAA,MAClG,eAAe;AAAA,MACf,aAAa,aAAa;AAAA,IAC5B,CAAC;AAED,QAAIA,iBAAgB,MAAM,WAAW;AAAA,MACnC,aAAa,8DAA8D,MAAM,eAAe,EAAE;AAAA,MAClG,eAAe;AAAA,MACf,aAAa,aAAa;AAAA,IAC5B,CAAC;AAED,QAAIA,iBAAgB,MAAM,cAAc;AAAA,MACtC,aAAa,gDAAgD,MAAM,eAAe,EAAE;AAAA,MACpF,eAAe;AAAA,MACf,aAAa,OAAO;AAAA,IACtB,CAAC;AAAA,EACH;AACF;","names":["findGitBranch","fs","path","Bucket","fs","path","NodejsFunction","StringParameter","Construct","Construct","NodejsFunction","StringParameter"]}

package/package.json

@@ -11,6 +11,7 @@
   },
   "devDependencies": {
     "@microsoft/api-extractor": "7.58.7",
+    "@types/js-yaml": "^4.0.9",
     "@types/node": "25.8.0",
     "@typescript-eslint/eslint-plugin": "^8",
     "@typescript-eslint/parser": "^8",
@@ -40,7 +41,8 @@
   "dependencies": {
     "@types/aws-lambda": "^8.10.161",
     "change-case": "^4.0",
-    "esbuild": "^0.28.0"
+    "esbuild": "^0.28.0",
+    "js-yaml": "^4.1.0"
   },
   "devEngines": {
     "packageManager": {
@@ -51,7 +53,7 @@
   },
   "main": "lib/index.js",
   "license": "MIT",
-  "version": "0.0.72",
+  "version": "0.0.74",
   "types": "lib/index.d.ts",
   "//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"pnpm exec projen\".",
   "scripts": {