@shipstatic/ship 2.2.0-beta.5 → 2.2.0-beta.6

package/dist/index.d.cts

@@ -2436,6 +2436,56 @@ interface MD5Result {
 }
 declare function calculateMD5(input: Blob | Buffer | string): Promise<MD5Result>;
 
+/**
+ * @file One ordered table of deploy-file rules, and the single evaluation two
+ * renderers share.
+ *
+ * **The defect this closes:** one rule was rendering as three sentences. A
+ * file over the size cap said `File x is too large. Maximum allowed size is
+ * 20MB.` from the deploy pipelines, `File size (21 MB) exceeds limit of 20 MB`
+ * from `validateFiles`, and `File too large. Maximum 20971520 bytes allowed`
+ * from the API — against the dual-validation doctrine that an error reads the
+ * same wherever it was caught (root `CLAUDE.md`). Both pipelines also restated
+ * the whole ordered check, so node/browser parity was a comment.
+ *
+ * **A rule states a predicate and a sentence; a renderer chooses only how to
+ * DELIVER it.** That is the `SHAPES`-table move (`cli/formatters.ts`) applied
+ * to validation: the throwing renderer raises the first broken rule, the
+ * collecting renderer records it, and neither authors prose. Adding a rule is
+ * a row, and both surfaces get it in the same position by construction.
+ *
+ * **Wording follows the API where a choice existed**, so the deferred Phase B
+ * — promoting this table to `@shipstatic/types` with the API consuming it —
+ * has less to move. Two deliberate deviations, recorded rather than silent:
+ *
+ * - **Sizes are formatted, not raw bytes.** The API says `20971520 bytes`;
+ *   a browser upload UI showing that is worse for the person reading it, and
+ *   the unit is the smaller half of the sentence to reconcile later.
+ * - **The path is named.** The API has no path to name; the throwing renderer
+ *   has nothing BUT the message, so dropping it would leave a CLI user asking
+ *   which file.
+ *
+ * Out of scope, and left where they are: `validateDeployPath` (a rule about
+ * the deploy PATH rather than the file, and pipelines-only), and
+ * `validateFiles`' UI-tier pre-checks — empty, negative, count, unbuilt
+ * marker, processing error — which have one holder each and no drift.
+ */
+
+/** What a rule is asked about: one file, and the deploy so far. */
+interface FileRuleInput {
+    /** The path this file will be served at. */
+    readonly path: string;
+    /** This file's size in bytes. */
+    readonly size: number;
+    /** Bytes accumulated INCLUDING this file — the total rule's subject. */
+    readonly totalSize: number;
+}
+
+/**
+ * @file Shared security validation for the deploy pipeline.
+ * Used by both Node.js and browser file processing pipelines.
+ */
+
 /**
  * Validate a deploy path for security concerns.
  * Rejects paths containing path traversal patterns or null bytes.
@@ -2454,24 +2504,22 @@ declare function calculateMD5(input: Blob | Buffer | string): Promise<MD5Result>
  */
 declare function validateDeployPath(deployPath: string, sourceIdentifier: string): void;
 /**
- * Validate a deploy file's name and extension.
- * Rejects unsafe filenames (shell/URL-dangerous chars, reserved names)
- * and file extensions the platform refuses to host.
+ * The THROWING renderer of `FILE_RULES` — the deploy pipelines' shape.
  *
- * **The blocklist is the platform's, delivered — not this package's.** It
- * arrives as `PlatformLimits.blockedExtensions` from `GET /limits`, which the
- * client has already fetched by the time any file is processed. That is what
- * keeps a pinned CLI from enforcing a policy the platform has moved on from,
- * in either direction. Callers pass `[]` when the API sent no list (one that
- * predates the field): the check then does nothing and the API refuses the
- * file at the boundary, which is the correct place for it to be refused.
+ * It raises the first rule the file breaks and nothing else: the rules, their
+ * order and their sentences all live in `file-rules.ts`, so this function
+ * cannot re-order, skip or reword one. That is what makes node/browser parity
+ * structural — both pipelines call this, and this calls the one table.
  *
- * @param deployPath - The deployment path to validate
- * @param sourceIdentifier - Human-readable identifier for error messages
- * @param blockedExtensions - The platform's blocklist, from `/limits`
- * @throws {ShipError} If the filename is unsafe or the extension is blocked
+ * Its counterpart is the collecting renderer in `file-validation.ts`
+ * (`validateFiles`), which reaches the same verdict and reports it as a list
+ * instead of a throw.
+ *
+ * @param input - The file and the deploy so far (`totalSize` INCLUDES it)
+ * @param limits - The platform's limits, from `/limits`
+ * @throws {ShipError} The first broken rule's sentence
  */
-declare function validateDeployFile(deployPath: string, sourceIdentifier: string, blockedExtensions: readonly string[]): void;
+declare function validateDeployFile(input: FileRuleInput, limits: PlatformLimits): void;
 
 /**
  * Utility functions for string manipulation.

package/dist/index.d.ts

@@ -2436,6 +2436,56 @@ interface MD5Result {
 }
 declare function calculateMD5(input: Blob | Buffer | string): Promise<MD5Result>;
 
+/**
+ * @file One ordered table of deploy-file rules, and the single evaluation two
+ * renderers share.
+ *
+ * **The defect this closes:** one rule was rendering as three sentences. A
+ * file over the size cap said `File x is too large. Maximum allowed size is
+ * 20MB.` from the deploy pipelines, `File size (21 MB) exceeds limit of 20 MB`
+ * from `validateFiles`, and `File too large. Maximum 20971520 bytes allowed`
+ * from the API — against the dual-validation doctrine that an error reads the
+ * same wherever it was caught (root `CLAUDE.md`). Both pipelines also restated
+ * the whole ordered check, so node/browser parity was a comment.
+ *
+ * **A rule states a predicate and a sentence; a renderer chooses only how to
+ * DELIVER it.** That is the `SHAPES`-table move (`cli/formatters.ts`) applied
+ * to validation: the throwing renderer raises the first broken rule, the
+ * collecting renderer records it, and neither authors prose. Adding a rule is
+ * a row, and both surfaces get it in the same position by construction.
+ *
+ * **Wording follows the API where a choice existed**, so the deferred Phase B
+ * — promoting this table to `@shipstatic/types` with the API consuming it —
+ * has less to move. Two deliberate deviations, recorded rather than silent:
+ *
+ * - **Sizes are formatted, not raw bytes.** The API says `20971520 bytes`;
+ *   a browser upload UI showing that is worse for the person reading it, and
+ *   the unit is the smaller half of the sentence to reconcile later.
+ * - **The path is named.** The API has no path to name; the throwing renderer
+ *   has nothing BUT the message, so dropping it would leave a CLI user asking
+ *   which file.
+ *
+ * Out of scope, and left where they are: `validateDeployPath` (a rule about
+ * the deploy PATH rather than the file, and pipelines-only), and
+ * `validateFiles`' UI-tier pre-checks — empty, negative, count, unbuilt
+ * marker, processing error — which have one holder each and no drift.
+ */
+
+/** What a rule is asked about: one file, and the deploy so far. */
+interface FileRuleInput {
+    /** The path this file will be served at. */
+    readonly path: string;
+    /** This file's size in bytes. */
+    readonly size: number;
+    /** Bytes accumulated INCLUDING this file — the total rule's subject. */
+    readonly totalSize: number;
+}
+
+/**
+ * @file Shared security validation for the deploy pipeline.
+ * Used by both Node.js and browser file processing pipelines.
+ */
+
 /**
  * Validate a deploy path for security concerns.
  * Rejects paths containing path traversal patterns or null bytes.
@@ -2454,24 +2504,22 @@ declare function calculateMD5(input: Blob | Buffer | string): Promise<MD5Result>
  */
 declare function validateDeployPath(deployPath: string, sourceIdentifier: string): void;
 /**
- * Validate a deploy file's name and extension.
- * Rejects unsafe filenames (shell/URL-dangerous chars, reserved names)
- * and file extensions the platform refuses to host.
+ * The THROWING renderer of `FILE_RULES` — the deploy pipelines' shape.
  *
- * **The blocklist is the platform's, delivered — not this package's.** It
- * arrives as `PlatformLimits.blockedExtensions` from `GET /limits`, which the
- * client has already fetched by the time any file is processed. That is what
- * keeps a pinned CLI from enforcing a policy the platform has moved on from,
- * in either direction. Callers pass `[]` when the API sent no list (one that
- * predates the field): the check then does nothing and the API refuses the
- * file at the boundary, which is the correct place for it to be refused.
+ * It raises the first rule the file breaks and nothing else: the rules, their
+ * order and their sentences all live in `file-rules.ts`, so this function
+ * cannot re-order, skip or reword one. That is what makes node/browser parity
+ * structural — both pipelines call this, and this calls the one table.
  *
- * @param deployPath - The deployment path to validate
- * @param sourceIdentifier - Human-readable identifier for error messages
- * @param blockedExtensions - The platform's blocklist, from `/limits`
- * @throws {ShipError} If the filename is unsafe or the extension is blocked
+ * Its counterpart is the collecting renderer in `file-validation.ts`
+ * (`validateFiles`), which reaches the same verdict and reports it as a list
+ * instead of a throw.
+ *
+ * @param input - The file and the deploy so far (`totalSize` INCLUDES it)
+ * @param limits - The platform's limits, from `/limits`
+ * @throws {ShipError} The first broken rule's sentence
  */
-declare function validateDeployFile(deployPath: string, sourceIdentifier: string, blockedExtensions: readonly string[]): void;
+declare function validateDeployFile(input: FileRuleInput, limits: PlatformLimits): void;
 
 /**
  * Utility functions for string manipulation.

package/dist/index.js

@@ -1,2 +1,2 @@
-var Ke=Object.defineProperty;var P=(n,t)=>()=>(n&&(t=n(n=0)),t);var je=(n,t)=>{for(var e in t)Ke(n,e,{get:t[e],enumerable:!0})};function Nt(n){if(!n||typeof n!="string")return;let t=n.trim().toLowerCase();return Object.values(Ye).includes(t)?t:void 0}function fe(n){if(n==null)return;if(typeof n!="string")throw l.validation("Idempotency key must be a string.");let t=n.trim();if(!t)throw l.validation("Idempotency key must not be empty.");if(t.length>F.MAX_LENGTH)throw l.validation(`Idempotency key must be at most ${F.MAX_LENGTH} characters.`);return t}function Je(n){let t=n.code;return t==="ERR_INVALID_URL"?!1:typeof t=="string"?!0:n instanceof TypeError?!/\burl\b/i.test(n.message):!1}function k(n){return n!==null&&typeof n=="object"&&"name"in n&&n.name==="ShipError"&&"status"in n}function Qe(n){let t=n.replace(/\\/g,"/").split("/").pop()??"",e=t.lastIndexOf(".");return e<=0||e===t.length-1?null:t.slice(e+1).toLowerCase()}function H(n,t){let e=Qe(n);return e===null?!1:Array.isArray(t)?t.includes(e):t.has(e)}function he(n){return et.test(n)}function G(n){return n.replace(/\\/g,"/").split("/").filter(Boolean).some(e=>J.has(e))}function tt(n){return n.startsWith(ye.PREFIX)?x.API_KEY:n.startsWith(ge.PREFIX)?x.DEPLOY_TOKEN:x.OPAQUE}function De(n){let t=n.charCodeAt(0)===65279?n.slice(1):n,e;try{e=JSON.parse(t)}catch(r){throw l.config(`invalid JSON format in config: ${r.message}`,{filePath:L})}if(e===null||typeof e!="object"||Array.isArray(e))throw l.config(`${L} must contain a JSON object`,{filePath:L})}function Te(n,t,e){if(!n.startsWith(t.PREFIX))throw l.validation(`${e} must start with "${t.PREFIX}"`);if(n.length!==t.TOTAL_LENGTH)throw l.validation(`${e} must be ${t.TOTAL_LENGTH} characters total (${t.PREFIX} + ${t.HEX_LENGTH} hex chars)`);let r=n.slice(t.PREFIX.length);if(!new RegExp(`^[a-f0-9]{${t.HEX_LENGTH}}$`,"i").test(r))throw l.validation(`${e} must contain ${t.HEX_LENGTH} hexadecimal characters after "${t.PREFIX}" prefix`)}function nt(n){Te(n,ye,"API key")}function rt(n){Te(n,ge,"Deploy token")}function Q(n){switch(tt(n)){case x.API_KEY:nt(n);return;case x.DEPLOY_TOKEN:rt(n);return;case x.OPAQUE:if(!n)throw l.validation("Token must be a non-empty string")}}function Ae(n){if(!n||n.length>_.MAX_LENGTH||!_.PATTERN.test(n))throw l.validation(`Caller must be 1-${_.MAX_LENGTH} characters: letters, digits, dots, underscores, or hyphens`)}function Ct(n){try{let t=new URL(n);if(!["http:","https:"].includes(t.protocol))throw l.validation("API URL must use http:// or https:// protocol");if(t.pathname!=="/"&&t.pathname!=="")throw l.validation("API URL must not contain a path");if(t.search||t.hash)throw l.validation("API URL must not contain query parameters or fragments")}catch(t){throw k(t)?t:l.validation("API URL must be a valid URL")}}function _t(n){return/^[a-z]+-[a-z]+-[a-z0-9]{7}(\.[a-z0-9.-]+)?$/i.test(n)}function Se(n,t){return n.endsWith(`.${t}`)}function $t(n,t){return!Se(n,t)}function Ut(n,t){return Se(n,t)?n.slice(0,-(t.length+1)):null}function Mt(n){return`https://${n}`}function Bt(n){return`https://${n}`}function Ht(n){return!n||n.length===0?null:JSON.stringify(n)}function Gt(n){if(!n)return[];try{let t=JSON.parse(n);return Array.isArray(t)?t:[]}catch{return[]}}function ee(n){if(n==null)return;if(typeof n!="string")throw l.validation("Password must be a string");let t=n.trim();if(t.length<B.MIN_LENGTH||t.length>B.MAX_LENGTH)throw l.validation(`Password must be between ${B.MIN_LENGTH} and ${B.MAX_LENGTH} characters`);return t}var Lt,Ye,wt,F,bt,f,I,d,qe,W,Xe,We,l,Ze,xt,et,J,vt,me,ye,ge,_,x,Ot,L,Ee,z,Z,$,Ft,kt,y,N,Re,B,g=P(()=>{"use strict";Lt={PENDING:"pending",SUCCESS:"success",FAILED:"failed",DELETING:"deleting"},Ye={WEB:"web",SDK:"sdk",CLI:"cli",MCP:"mcp",GIT:"git",N8N:"n8n",GPT:"gpt",VSC:"vsc"},wt={PENDING:"pending",PARTIAL:"partial",SUCCESS:"success",PAUSED:"paused"},F={HEADER:"Idempotency-Key",MAX_LENGTH:256,WINDOW_SECONDS:1440*60};bt={FREE:"free",STANDARD:"standard",SPONSORED:"sponsored",ENTERPRISE:"enterprise",SUSPENDED:"suspended",TERMINATING:"terminating",TERMINATED:"terminated"},f={DEPLOYMENTS:"/deployments",DEPLOYMENT:n=>`/deployments/${n}`,DEPLOYMENT_CONFIG:n=>`/deployments/${n}/config`,DOMAINS:"/domains",DOMAIN:n=>`/domains/${n}`,DOMAIN_VERIFY:n=>`/domains/${n}/verify`,DOMAIN_DNS:n=>`/domains/${n}/dns`,DOMAIN_RECORDS:n=>`/domains/${n}/records`,DOMAIN_SHARE:n=>`/domains/${n}/share`,DOMAIN_PROPAGATION:n=>`/domains/${n}/propagation`,DOMAINS_VALIDATE:"/domains/validate",TOKENS:"/tokens",TOKEN:n=>`/tokens/${n}`,ACCOUNT:"/account",ACCOUNT_KEY:"/account/key",ACCOUNT_CLAIM:"/account/claim",ACTIVITIES:"/activities",LABELS:"/labels",LIMITS:"/limits",PING:"/ping",SETUP:"/setup",SPA_CHECK:"/spa-check",UPLOAD:"/upload"},I={FILES:"files[]",CHECKSUMS:"checksums",LABELS:"labels",VIA:"via",PASSWORD:"password",BUILD:"build",PRERENDER:"prerender",SPA:"spa",CAPTCHA:"captcha"},d={Validation:"validation_failed",NotFound:"not_found",Forbidden:"forbidden",RateLimit:"rate_limit_exceeded",Authentication:"authentication_failed",Business:"business_logic_error",Api:"internal_server_error",Maintenance:"maintenance",Network:"network_error",Cancelled:"operation_cancelled",File:"file_error",Config:"config_error"},qe=new Set([d.Network,d.Cancelled,d.File,d.Config]),W={client:new Set([d.Business,d.Cancelled,d.Config,d.File,d.Forbidden,d.NotFound,d.RateLimit,d.Validation]),network:new Set([d.Network]),auth:new Set([d.Authentication])},Xe=new Set(Object.values(d).filter(n=>!qe.has(n))),We=200;l=class n extends Error{type;status;details;constructor(t,e,r,i){super(e),this.type=t,this.status=r,this.details=i,this.name="ShipError"}toResponse(){let t=this.details,e=this.type===d.Authentication&&t?.internal?void 0:this.details;return{error:this.type,message:this.message,status:this.status,details:e}}static async fromHttpResponse(t,e){let r,i,s;try{if(t.headers.get("content-type")?.includes("application/json")){let p=await t.json();if(p&&typeof p=="object"){let c=p;typeof c.message=="string"?r=c.message:typeof c.error=="string"&&(r=c.error),i=c.details,typeof c.error=="string"&&Xe.has(c.error)&&(s=c.error)}}else{let p=(await t.text()).trim();p&&!p.startsWith("<")&&p.length<=We&&(r=p)}}catch{}let a=t.headers.get("retry-after");if(a!==null){let o=a.trim(),p=/^\d+$/.test(o)?Number(o):Math.ceil((Date.parse(o)-Date.now())/1e3);if(Number.isFinite(p)&&p>=0){let c=i&&typeof i=="object"?i:{};c.retryAfter===void 0&&(i={...c,retryAfter:p})}}r=r||`${e||"Request"} failed with status ${t.status}`;let u=s??(t.status===401?d.Authentication:t.status===403?d.Forbidden:t.status===429?d.RateLimit:d.Api);return new n(u,r,t.status,i)}static fromFetchError(t,e){if(k(t))return t;let r=e||"Request",i=t?.name;return i==="AbortError"?n.cancelled(`${r} was cancelled`):i==="TimeoutError"?n.network(`${r} timed out`,{cause:t}):t instanceof Error?Je(t)?n.network(`${r} failed: ${t.message}`,{cause:t}):new n(d.Api,`${r} failed: ${t.message}`):new n(d.Api,`${r} failed: Unknown error`)}static validation(t,e){return new n(d.Validation,t,400,e)}static notFound(t,e){let r=e?`${t} ${e} not found`:`${t} not found`;return new n(d.NotFound,r,404)}static forbidden(t,e){return new n(d.Forbidden,t,403,e)}static rateLimit(t="Too many requests",e){return new n(d.RateLimit,t,429,e)}static authentication(t="Authentication required",e){return new n(d.Authentication,t,401,e)}static business(t,e=400,r){return new n(d.Business,t,e,r)}static network(t,e){return new n(d.Network,t,void 0,e)}static cancelled(t,e){return new n(d.Cancelled,t,void 0,e)}static file(t,e){return new n(d.File,t,void 0,e)}static config(t,e){return new n(d.Config,t,void 0,e)}static api(t,e=500,r){return new n(d.Api,t,e,r)}static maintenance(t,e){return new n(d.Maintenance,t,503,e)}isClientError(){return W.client.has(this.type)?!0:this.status!==void 0&&this.status>=400&&this.status<500}isNetworkError(){return W.network.has(this.type)}isAuthError(){return W.auth.has(this.type)}isType(t){return this.type===t}};Ze=["html","htm","xhtml","xml","txt","md","markdown","pdf","csv","json","jsonc","webmanifest","map","toml","yaml","yml","rss","atom","css","scss","sass","less","js","mjs","cjs","jsx","ts","tsx","wasm","vue","svelte","png","jpg","jpeg","gif","webp","avif","svg","ico","bmp","tif","tiff","heic","heif","woff","woff2","ttf","otf","eot","mp3","wav","ogg","oga","opus","m4a","aac","flac","weba","mp4","webm","ogv","mov","m4v","avi","glb","gltf","usdz","vtt","srt","zip"],xt=Ze.map(n=>`.${n}`).join(","),et=/[\x00-\x1f\x7f#?%\\<>"]/;J=new Set(["node_modules","package.json"]);vt="/auth",me={SESSION:"session",API_KEY:"apiKey",TOKEN:"token",AGENT:"agent",OAUTH:"oauth",WEBHOOK:"webhook",SYSTEM:"system"},ye={PREFIX:"ship-",HEX_LENGTH:32,TOTAL_LENGTH:37,HINT_LENGTH:4},ge={PREFIX:"deploy-",HEX_LENGTH:32,TOTAL_LENGTH:39},_={HEADER:"X-Caller",MAX_LENGTH:128,PATTERN:/^[a-zA-Z0-9._-]+$/},x={API_KEY:me.API_KEY,DEPLOY_TOKEN:me.TOKEN,OPAQUE:"opaque"};Ot={ACCOUNT_READ:"account:read",DEPLOYMENTS_READ:"deployments:read",DEPLOYMENTS_WRITE:"deployments:write",DOMAINS_READ:"domains:read",DOMAINS_WRITE:"domains:write"},L="ship.json",Ee={rewrites:[{source:"/(.*)",destination:"/index.html"}]},z={INDEX_FILE:"index.html",MAX_INDEX_BYTES:100*1024};Z="https://api.shipstatic.com",$={TOKEN:"SHIP_TOKEN",API_URL:"SHIP_API_URL"},Ft="https://my.shipstatic.com/api-key",kt=4320*60,y={PENDING:"pending",PROCESSING_ERROR:"processing_error",EXCLUDED:"excluded",VALIDATION_FAILED:"validation_failed",READY:"ready"};N={MIN_LENGTH:3,MAX_LENGTH:25,MAX_COUNT:10,SEPARATORS:"._-"},Re=/^[a-z0-9]+(?:[._-][a-z0-9]+)*$/;B={MIN_LENGTH:6,MAX_LENGTH:128}});async function mt(n){let t=(await import("spark-md5")).default,e=new t.ArrayBuffer,r=2097152;for(let i=0;i<n.size;i+=r){let s=Math.min(i+r,n.size);e.append(await n.slice(i,s).arrayBuffer())}return{md5:e.end()}}async function ft(n){let{createHash:t}=await import("crypto"),e=t("md5");return e.update(n),{md5:e.digest("hex")}}async function ht(n){let{createHash:t}=await import("crypto"),{createReadStream:e}=await import("fs");return new Promise((r,i)=>{let s=t("md5"),a=e(n);a.on("error",u=>i(l.file(`Failed to read file for MD5: ${u.message}`,{filePath:n}))),a.on("data",u=>s.update(u)),a.on("end",()=>r({md5:s.digest("hex")}))})}async function j(n){if(n instanceof Blob)return mt(n);if(typeof Buffer<"u"&&Buffer.isBuffer(n))return ft(n);if(typeof n=="string")return ht(n);throw l.business("Invalid input for MD5 calculation")}var Y=P(()=>{"use strict";g()});function un(n){ne=n}function gt(){return typeof process<"u"&&process.versions&&process.versions.node?"node":typeof window<"u"||typeof self<"u"?"browser":"unknown"}function v(){return ne||gt()}var ne,M=P(()=>{"use strict";ne=null});function ke(n){if(!n||n.length===0)return"";let t=n.filter(s=>s&&typeof s=="string").map(s=>s.replace(/\\/g,"/"));if(t.length===0)return"";if(t.length===1)return t[0];let e=t.map(s=>s.split("/").filter(Boolean)),r=[],i=Math.min(...e.map(s=>s.length));for(let s=0;s<i;s++){let a=e[0][s];if(e.every(u=>u[s]===a))r.push(a);else break}return r.join("/")}function X(n){return n.replace(/\\/g,"/").replace(/\/+/g,"/").replace(/^\/+/,"")}var re=P(()=>{"use strict"});function $e(n,t={}){if(t.flatten===!1)return n.map(r=>({path:X(r),name:ie(r)}));let e=Tt(n);return n.map(r=>{let i=X(r);if(e){let s=e.endsWith("/")?e:`${e}/`;i.startsWith(s)&&(i=i.substring(s.length))}return i||(i=ie(r)),{path:i,name:ie(r)}})}function Tt(n){if(!n.length)return"";let e=n.map(s=>X(s)).map(s=>s.split("/")),r=[],i=Math.min(...e.map(s=>s.length));for(let s=0;s<i-1;s++){let a=e[0][s];if(e.every(u=>u[s]===a))r.push(a);else break}return r.join("/")}function ie(n){return n.split(/[/\\]/).pop()||n}var se=P(()=>{"use strict";re()});function oe(n,t=1){if(n===0)return"0 Bytes";let e=1024,r=["Bytes","KB","MB","GB"],i=Math.floor(Math.log(n)/Math.log(e));return`${parseFloat((n/e**i).toFixed(t))} ${r[i]}`}function ae(n){if(he(n))return{valid:!1,reason:"File name contains unsafe characters"};if(n.startsWith(" ")||n.endsWith(" "))return{valid:!1,reason:"File name cannot start/end with spaces"};if(n.endsWith("."))return{valid:!1,reason:"File name cannot end with dots"};let t=/^(CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(\.|$)/i,e=n.split("/").pop()||n;return t.test(e)?{valid:!1,reason:"File name uses a reserved system name"}:n.includes("..")?{valid:!1,reason:"File name contains path traversal pattern"}:{valid:!0}}function Nn(n,t){let e=[],r=[],i=[];if(n.length===0){let o={file:"(no files)",message:"At least one file must be provided"};return e.push(o),{files:[],validFiles:[],errors:e,warnings:[],canDeploy:!1}}for(let o of n)if(G(o.name))return e.push({file:o.name,message:"Unbuilt project detected \u2014 deploy your build output (dist/, build/, out/), not the project folder"}),{files:n.map(p=>({...p,status:y.VALIDATION_FAILED,statusMessage:"Unbuilt project detected"})),validFiles:[],errors:e,warnings:[],canDeploy:!1};if(n.length>t.maxFilesCount){let o={file:`(${n.length} files)`,message:`File count (${n.length}) exceeds limit of ${t.maxFilesCount}`};return e.push(o),{files:n.map(p=>({...p,status:y.VALIDATION_FAILED,statusMessage:o.message})),validFiles:[],errors:e,warnings:[],canDeploy:!1}}let s=0;for(let o of n){let p=y.READY,c="Ready for upload",D=o.name?ae(o.name):{valid:!1,reason:"File name cannot be empty"};if(o.status===y.PROCESSING_ERROR)p=y.VALIDATION_FAILED,c=o.statusMessage||"File failed during processing",e.push({file:o.name,message:c});else if(o.size===0){p=y.EXCLUDED,c="File is empty (0 bytes) and cannot be deployed due to storage limitations",r.push({file:o.name,message:c}),i.push({...o,status:p,statusMessage:c});continue}else o.size<0?(p=y.VALIDATION_FAILED,c="File size must be positive",e.push({file:o.name,message:c})):!o.name||o.name.trim().length===0?(p=y.VALIDATION_FAILED,c="File name cannot be empty",e.push({file:o.name||"(empty)",message:c})):o.name.includes("\0")?(p=y.VALIDATION_FAILED,c="File name contains invalid characters (null byte)",e.push({file:o.name,message:c})):D.valid?H(o.name,t.blockedExtensions??[])?(p=y.VALIDATION_FAILED,c=`File extension not allowed: "${o.name}"`,e.push({file:o.name,message:c})):o.size>t.maxFileSize?(p=y.VALIDATION_FAILED,c=`File size (${oe(o.size)}) exceeds limit of ${oe(t.maxFileSize)}`,e.push({file:o.name,message:c})):(s+=o.size,s>t.maxTotalSize&&(p=y.VALIDATION_FAILED,c=`Total size would exceed limit of ${oe(t.maxTotalSize)}`,e.push({file:o.name,message:c}))):(p=y.VALIDATION_FAILED,c=D.reason||"Invalid file name",e.push({file:o.name,message:c}));i.push({...o,status:p,statusMessage:c})}e.length>0&&(i=i.map(o=>o.status===y.EXCLUDED?o:{...o,status:y.VALIDATION_FAILED,statusMessage:o.status===y.VALIDATION_FAILED?o.statusMessage:"Deployment failed due to validation errors in bundle"}));let a=e.length===0?i.filter(o=>o.status===y.READY):[],u=e.length===0;return{files:i,validFiles:a,errors:e,warnings:r,canDeploy:u}}function At(n){return n.filter(t=>t.status===y.READY)}function bn(n){return At(n).length>0}var le=P(()=>{"use strict";g()});import{isJunk as St}from"junk";function Ue(n,t){if(!n||n.length===0)return[];if(!t?.allowUnbuilt&&n.find(r=>r&&G(r)))throw l.business("Unbuilt project detected \u2014 deploy your build output (dist/, build/, out/), not the project folder");return n.filter(e=>{if(!e)return!1;let r=e.replace(/\\/g,"/").split("/").filter(Boolean);if(r.length===0)return!0;let i=r[r.length-1];if(St(i))return!1;for(let a of r)if(a!==".well-known"&&(a.startsWith(".")||a.length>255))return!1;let s=r.slice(0,-1);for(let a of s)if(Rt.some(u=>a.toLowerCase()===u.toLowerCase()))return!1;return!0})}var Rt,ce=P(()=>{"use strict";g();Rt=["__MACOSX",".Trashes",".fseventsd",".Spotlight-V100"]});function Me(n,t){if(n.includes("\0")||n.includes("/../")||n.startsWith("../")||n.endsWith("/.."))throw l.business(`Security error: Unsafe file path "${n}" for file: ${t}`)}function Be(n,t,e){let r=ae(n);if(!r.valid)throw l.business(r.reason||"Invalid file name");if(H(n,e))throw l.business(`File extension not allowed: "${t}"`)}var pe=P(()=>{"use strict";g();le()});var ze={};je(ze,{processFilesForNode:()=>Ge});import*as T from"fs";import*as A from"path";function He(n,t=new Set){let e=[],r=T.realpathSync(n);if(t.has(r))return e;t.add(r);let i=T.readdirSync(n);for(let s of i){let a=A.join(n,s),u=T.statSync(a);if(u.isDirectory()){let o=He(a,t);e.push(...o)}else u.isFile()&&e.push(a)}return e}async function Ge(n,t={},e){if(v()!=="node")throw l.business("processFilesForNode can only be called in Node.js environment.");for(let m of n){let h=A.resolve(m);try{if(T.statSync(h).isDirectory()){let S=T.readdirSync(h).find(R=>J.has(R));if(S)throw l.business(`"${S}" detected \u2014 deploy your build output (dist/, build/, out/), not the project folder`)}}catch(S){if(k(S))throw S}}let r=n.flatMap(m=>{let h=A.resolve(m);try{return T.statSync(h).isDirectory()?He(h):[h]}catch{throw l.file(`Path does not exist: ${m}`,{filePath:m})}}),i=[...new Set(r)],s=n.map(m=>A.resolve(m)),a=ke(s.map(m=>{try{return T.statSync(m).isDirectory()?m:A.dirname(m)}catch{return A.dirname(m)}})),u=i.map(m=>{if(a&&a.length>0){let h=A.relative(a,m);if(h&&typeof h=="string"&&!h.startsWith(".."))return h.replace(/\\/g,"/")}return A.basename(m)}),p=$e(u,{flatten:t.pathDetect!==!1}).map(m=>m.path),c=new Set(Ue(p));if(c.size===0)return[];let D=[],O=[];for(let m=0;m<i.length;m++)c.has(p[m])&&(D.push(i[m]),O.push(p[m]));let b=[],w=0;if(!e)throw l.config("Platform limits not provided. processFilesForNode requires the limits argument \u2014 pass `ship.getLimits()` result.");let E=e.blockedExtensions??[];for(let m=0;m<D.length;m++){let h=D[m],S=O[m];try{Me(S,h);let R=T.statSync(h);if(R.size===0)continue;if(Be(S,h,E),R.size>e.maxFileSize)throw l.business(`File ${h} is too large. Maximum allowed size is ${e.maxFileSize/(1024*1024)}MB.`);if(w+=R.size,w>e.maxTotalSize)throw l.business(`Total deploy size is too large. Maximum allowed is ${e.maxTotalSize/(1024*1024)}MB.`);let C=T.readFileSync(h),{md5:Ve}=await j(C);b.push({path:S,content:C,size:C.length,md5:Ve})}catch(R){if(k(R))throw R;let C=R instanceof Error?R.message:String(R);throw l.file(`Failed to read file "${h}": ${C}`,{filePath:h})}}if(b.length>e.maxFilesCount)throw l.business(`Too many files to deploy. Maximum allowed is ${e.maxFilesCount} files.`);return b}var ue=P(()=>{"use strict";g();se();M();ce();Y();re();pe()});g();g();g();var V=class{constructor(){this.handlers=new Map}on(t,e){this.handlers.has(t)||this.handlers.set(t,new Set),this.handlers.get(t)?.add(e)}off(t,e){let r=this.handlers.get(t);r&&(r.delete(e),r.size===0&&this.handlers.delete(t))}emit(t,...e){let r=this.handlers.get(t);if(!r)return;let i=Array.from(r);for(let s of i)try{s(...e)}catch(a){r.delete(s),t!=="error"&&setTimeout(()=>{let u=a instanceof Error?a:new Error(String(a));this.emit("error",u,String(t))},0)}}};g();g();function U(n){if(n==null)return;if(n.length===0)return n;if(n.length>N.MAX_COUNT)throw l.validation(`Maximum ${N.MAX_COUNT} labels allowed`);let t=n.map((r,i)=>{if(typeof r!="string")throw l.validation(`Label at index ${i} must be a string`);let s=r.trim().toLowerCase();if(s.length<N.MIN_LENGTH)throw l.validation(`Labels must be at least ${N.MIN_LENGTH} characters long`);if(s.length>N.MAX_LENGTH)throw l.validation(`Labels must be no more than ${N.MAX_LENGTH} characters long`);if(!Re.test(s))throw l.validation(`Labels must start and end with alphanumeric characters, with optional separators (${N.SEPARATORS}) between segments`);return s}),e=[...new Set(t)];if(e.length!==t.length)throw l.validation("Duplicate labels are not allowed");return e}async function Ie(n){let t=n.find(i=>i.path===L||i.path===`/${L}`);if(!t)return;let e=t.content,r=typeof e.text=="function"?await e.text():t.content.toString("utf8");De(r)}var it=3e4,st=2,ot=300,at=2e3,lt=new Set([500,502,503,504]);function ct(n,t){return new Promise((e,r)=>{if(t?.aborted){r(t.reason);return}let i=()=>{clearTimeout(a),t?.removeEventListener("abort",s)},s=()=>{i(),r(t?.reason)},a=setTimeout(()=>{i(),e()},n);t?.addEventListener("abort",s)})}var Pe=3e5,pt=3e5,ut=Pe+pt,dt="sdk";function te(n){let t=new URLSearchParams;n?.limit!==void 0&&t.set("limit",String(n.limit)),n?.cursor!==void 0&&t.set("cursor",n.cursor);let e=t.toString();return e?`?${e}`:""}var K=class extends V{constructor(e){super();this.globalHeaders={};this.apiUrl=e.apiUrl||Z,this.getAuthHeadersCallback=e.getAuthHeaders,this.session=e.session??!1,this.caller=e.caller,this.timeout=e.timeout??it,this.maxRetries=Math.max(0,e.maxRetries??st),this.deployTimeout=e.timeout??Pe,this.deployBuildTimeout=e.timeout??ut,this.fetch=e.fetch??globalThis.fetch.bind(globalThis),this.createDeployBody=e.createDeployBody,this.deployEndpoint=e.deployEndpoint||f.DEPLOYMENTS}setGlobalHeaders(e){this.globalHeaders=e}async executeRequest(e,r,i,s=this.timeout){for(let a=0;;a++)try{return await this.attemptOnce(e,r,i,s)}catch(u){let o=l.fromFetchError(u,i);if(a>=this.maxRetries||!this.isRetryable(o,r))throw o;let p=Math.min(at,ot*2**a);try{await ct(Math.random()*p,r.signal)}catch(c){let D=l.fromFetchError(c,i);throw this.emit("error",D,e),D}}}isRetryable(e,r){if(r.signal?.aborted||e.isType(d.Maintenance)||e.isType(d.Cancelled)||!(e.isNetworkError()||e.status!==void 0&&lt.has(e.status)))return!1;let s=(r.method??"GET").toUpperCase();return s==="GET"||s==="HEAD"?!0:s==="PUT"||s==="DELETE"?!1:this.hasIdempotencyKey(r.headers)}hasIdempotencyKey(e){if(!e)return!1;let r=F.HEADER.toLowerCase(),i=!1,s=a=>{a.toLowerCase()===r&&(i=!0)};if(e instanceof Headers)e.forEach((a,u)=>{s(u)});else if(Array.isArray(e))for(let[a]of e)s(a);else for(let a of Object.keys(e))s(a);return i}async attemptOnce(e,r,i,s=this.timeout){let a=()=>{};try{let u=await this.mergeHeaders(r.headers),o=this.createTimeoutSignal(r.signal,s);a=o.cleanup;let p={...r,headers:u,credentials:this.session&&!u.Authorization?"include":void 0,signal:o.signal};this.emit("request",e,p);let c=await this.fetch(e,p);if(a(),!c.ok)throw await l.fromHttpResponse(c,i);return this.emit("response",this.safeClone(c),e),{data:await this.parseResponse(this.safeClone(c)),status:c.status}}catch(u){a();let o=l.fromFetchError(u,i);throw this.emit("error",o,e),o}}async request(e,r,i,s){let{data:a}=await this.executeRequest(e,r,i,s);return a}async requestWithStatus(e,r,i){return this.executeRequest(e,r,i)}async mergeHeaders(e={}){return{...this.globalHeaders,...this.caller?{[_.HEADER]:this.caller}:{},...await this.getAuthHeadersCallback(),...e}}createTimeoutSignal(e,r=this.timeout){let i=new AbortController,s=setTimeout(()=>i.abort(new DOMException(`Timed out after ${r}ms`,"TimeoutError")),r),a=e?()=>i.abort(e.reason):void 0;return e&&a&&(e.addEventListener("abort",a),e.aborted&&i.abort(e.reason)),{signal:i.signal,cleanup:()=>{clearTimeout(s),e&&a&&e.removeEventListener("abort",a)}}}safeClone(e){try{return e.clone()}catch{return e}}async parseResponse(e){if(!(e.headers.get("Content-Length")==="0"||e.status===204))return e.json()}async deploy(e,r={}){if(!e.length)throw l.business("No files to deploy");for(let p of e)if(!p.md5)throw l.file(`MD5 checksum missing for file: ${p.path}`,{filePath:p.path});ee(r.password);let i=fe(r.idempotencyKey),s=U(r.labels);await Ie(e);let a=r.build||r.prerender||r.spa?{build:r.build,prerender:r.prerender,spa:r.spa}:void 0,{body:u,headers:o}=await this.createDeployBody(e,{labels:s,via:r.via??dt,password:r.password,flags:a,captcha:r.captcha});return this.request(`${this.apiUrl}${this.deployEndpoint}`,{method:"POST",body:u,headers:i?{...o,[F.HEADER]:i}:o,signal:r.signal||null},"Deploy",r.build||r.prerender?this.deployBuildTimeout:this.deployTimeout)}async listDeployments(e){return this.request(`${this.apiUrl}${f.DEPLOYMENTS}${te(e)}`,{method:"GET"},"List deployments")}async getDeployment(e){return this.request(`${this.apiUrl}${f.DEPLOYMENT(encodeURIComponent(e))}`,{method:"GET"},"Get deployment")}async updateDeploymentLabels(e,r){let i=U(r);return this.request(`${this.apiUrl}${f.DEPLOYMENT(encodeURIComponent(e))}`,{method:"PATCH",headers:{"Content-Type":"application/json"},body:JSON.stringify({labels:i})},"Update deployment labels")}async deleteDeployment(e){return this.request(`${this.apiUrl}${f.DEPLOYMENT(encodeURIComponent(e))}`,{method:"DELETE"},"Delete deployment")}async setDomain(e,r,i){let s=U(i),a={};r&&(a.deployment=r),s!==void 0&&(a.labels=s);let{data:u,status:o}=await this.requestWithStatus(`${this.apiUrl}${f.DOMAIN(encodeURIComponent(e))}`,{method:"PUT",headers:{"Content-Type":"application/json"},body:JSON.stringify(a)},"Set domain");return{...u,isCreate:o===201}}async listDomains(e){return this.request(`${this.apiUrl}${f.DOMAINS}${te(e)}`,{method:"GET"},"List domains")}async getDomain(e){return this.request(`${this.apiUrl}${f.DOMAIN(encodeURIComponent(e))}`,{method:"GET"},"Get domain")}async deleteDomain(e){return this.request(`${this.apiUrl}${f.DOMAIN(encodeURIComponent(e))}`,{method:"DELETE"},"Delete domain")}async verifyDomain(e){return this.request(`${this.apiUrl}${f.DOMAIN_VERIFY(encodeURIComponent(e))}`,{method:"POST"},"Verify domain")}async getDomainDns(e){return this.request(`${this.apiUrl}${f.DOMAIN_DNS(encodeURIComponent(e))}`,{method:"GET"},"Get domain DNS")}async getDomainRecords(e){return this.request(`${this.apiUrl}${f.DOMAIN_RECORDS(encodeURIComponent(e))}`,{method:"GET"},"Get domain records")}async getDomainShare(e){return this.request(`${this.apiUrl}${f.DOMAIN_SHARE(encodeURIComponent(e))}`,{method:"GET"},"Get domain share")}async validateDomain(e){return this.request(`${this.apiUrl}${f.DOMAINS_VALIDATE}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({domain:e})},"Validate domain")}async createToken(e,r){let i=U(r),s={};return e!==void 0&&(s.ttl=e),i!==void 0&&(s.labels=i),this.request(`${this.apiUrl}${f.TOKENS}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(s)},"Create token")}async listTokens(e){return this.request(`${this.apiUrl}${f.TOKENS}${te(e)}`,{method:"GET"},"List tokens")}async deleteToken(e){return this.request(`${this.apiUrl}${f.TOKEN(encodeURIComponent(e))}`,{method:"DELETE"},"Delete token")}async getToken(e){return this.request(`${this.apiUrl}${f.TOKEN(encodeURIComponent(e))}`,{method:"GET"},"Get token")}async getAccount(){return this.request(`${this.apiUrl}${f.ACCOUNT}`,{method:"GET"},"Get account")}async getLimits(){return this.request(`${this.apiUrl}${f.LIMITS}`,{method:"GET"},"Get limits")}async ping(){return this.request(`${this.apiUrl}${f.PING}`,{method:"GET"},"Ping")}async checkSPA(e,r={}){let i=e.find(o=>o.path===z.INDEX_FILE||o.path===`/${z.INDEX_FILE}`);if(!i||i.size>z.MAX_INDEX_BYTES)return!1;let s;if(typeof Buffer<"u"&&Buffer.isBuffer(i.content))s=i.content.toString("utf-8");else if(typeof Blob<"u"&&i.content instanceof Blob)s=await i.content.text();else if(typeof File<"u"&&i.content instanceof File)s=await i.content.text();else return!1;let a={files:e.map(o=>o.path),index:s};return(await this.request(`${this.apiUrl}${f.SPA_CHECK}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(a)},"SPA check")).isSPA}};g();g();Y();async function yt(){let n=JSON.stringify(Ee,null,2),t;typeof Buffer<"u"?t=Buffer.from(n,"utf-8"):t=new Blob([n],{type:"application/json"});let{md5:e}=await j(t);return{path:L,content:t,size:n.length,md5:e}}async function Le(n,t,e){if(e.spaDetect===!1||e.spa||e.build||e.prerender||n.some(r=>r.path===L))return n;try{if(await t.checkSPA(n,e)){let i=await yt();return[...n,i]}}catch{}return n}function we(n){let{getApi:t,ensureInit:e,processInput:r}=n;return{upload:async(i,s={})=>{if(await e(),!r)throw l.config("processInput function is not provided.");let a=t(),u=await r(i,s);return u=await Le(u,a,s),a.deploy(u,s)},list:async i=>(await e(),t().listDeployments(i)),get:async i=>(await e(),t().getDeployment(i)),set:async(i,s)=>(await e(),t().updateDeploymentLabels(i,s.labels)),delete:async i=>(await e(),t().deleteDeployment(i))}}function Ne(n){let{getApi:t,ensureInit:e}=n;return{set:async(r,i={})=>(await e(),t().setDomain(r,i.deployment,i.labels)),list:async r=>(await e(),t().listDomains(r)),get:async r=>(await e(),t().getDomain(r)),delete:async r=>(await e(),t().deleteDomain(r)),verify:async r=>(await e(),t().verifyDomain(r)),validate:async r=>(await e(),t().validateDomain(r)),dns:async r=>(await e(),t().getDomainDns(r)),records:async r=>(await e(),t().getDomainRecords(r)),share:async r=>(await e(),t().getDomainShare(r))}}function be(n){let{getApi:t,ensureInit:e}=n;return{get:async()=>(await e(),t().getAccount())}}function xe(n){let{getApi:t,ensureInit:e}=n;return{create:async(r={})=>(await e(),t().createToken(r.ttl,r.labels)),list:async r=>(await e(),t().listTokens(r)),get:async r=>(await e(),t().getToken(r)),delete:async r=>(await e(),t().deleteToken(r))}}var q=class{constructor(t={}){this.initPromise=null;this.platformLimits=null;this.credential=null;if(t={...t,apiUrl:t.apiUrl||void 0,token:t.token||void 0,caller:t.caller||void 0},this.clientOptions=t,t.caller!==void 0&&Ae(t.caller),t.token&&t.session)throw l.config("Provide either `token` or `session`, not both.");typeof t.token=="string"?(Q(t.token),this.credential=t.token):t.token&&(this.credential=t.token),this.http=new K({...t,getAuthHeaders:()=>this.getAuthHeaders(),createDeployBody:this.getDeployBodyCreator()});let e={getApi:()=>this.http,ensureInit:()=>this.ensureInitialized()};this.deployments=we({...e,processInput:(r,i)=>this.processInput(r,i)}),this.domains=Ne(e),this.account=be(e),this.tokens=xe(e)}async ensureInitialized(){return this.initPromise||(this.initPromise=this.fetchPlatformLimits()),this.initPromise}async fetchPlatformLimits(){try{this.platformLimits=await this.http.getLimits()}catch(t){throw this.initPromise=null,t}}async ping(){return await this.ensureInitialized(),this.http.ping()}async deploy(t,e){return this.deployments.upload(t,e)}async whoami(){return this.account.get()}async getLimits(){return this.platformLimits?this.platformLimits:(await this.ensureInitialized(),this.platformLimits)}on(t,e){this.http.on(t,e)}off(t,e){this.http.off(t,e)}setHeaders(t){this.http.setGlobalHeaders(t)}clearHeaders(){this.http.setGlobalHeaders({})}setToken(t){if(this.clientOptions.session)throw l.config("Provide either `token` or `session`, not both.");if(typeof t=="string"){if(!t)throw l.business("Invalid token provided. Token must be a non-empty string.");Q(t),this.credential=t;return}if(typeof t!="function")throw l.business("Invalid token provided. Token must be a non-empty string or a provider function.");this.credential=t}async getAuthHeaders(){if(this.credential===null)return{};let t=typeof this.credential=="function"?await this.credential():this.credential;if(!t)throw l.authentication("Token provider returned no token.");if(typeof t!="string")throw l.authentication("Token provider returned a non-string value.");return{Authorization:`Bearer ${t}`}}};M();g();import{z as Ce}from"zod";import{z as ve}from"zod";var Oe={apiUrl:ve.string().url().optional(),token:ve.string().min(1).optional()};M();var Et=Ce.object(Oe).strict(),Dt={apiUrl:$.API_URL,token:$.TOKEN};function _e(){if(v()!=="node")return{};let n={apiUrl:process.env[$.API_URL]||void 0,token:process.env[$.TOKEN]||void 0};try{return Et.parse(n)}catch(t){if(t instanceof Ce.ZodError){let e=t.issues[0],r=e.path[0],i=(r&&Dt[r])??"SHIP environment configuration";throw l.config(`Invalid ${i}: ${e.message}`)}throw l.config("Invalid environment configuration")}}g();async function Fe(n,t={}){let{FormData:e,File:r}=await import("formdata-node"),{FormDataEncoder:i}=await import("form-data-encoder"),{labels:s,via:a,password:u,flags:o,captcha:p}=t,c=new e,D=[];for(let E of n){if(!Buffer.isBuffer(E.content)&&!(typeof Blob<"u"&&E.content instanceof Blob))throw l.file(`Unsupported file.content type for Node.js: ${E.path}`,{filePath:E.path});if(!E.md5)throw l.file(`File missing md5 checksum: ${E.path}`,{filePath:E.path});let m=new r([E.content],E.path,{type:"application/octet-stream"});c.append(I.FILES,m),D.push(E.md5)}c.append(I.CHECKSUMS,JSON.stringify(D)),s&&s.length>0&&c.append(I.LABELS,JSON.stringify(s)),a&&c.append(I.VIA,a),u&&c.append(I.PASSWORD,u),o?.build&&c.append(I.BUILD,"true"),o?.prerender&&c.append(I.PRERENDER,"true"),o?.spa&&c.append(I.SPA,"true"),p&&c.append(I.CAPTCHA,p);let O=new i(c),b=[];for await(let E of O.encode())b.push(Buffer.from(E));let w=Buffer.concat(b);return{body:w.buffer.slice(w.byteOffset,w.byteOffset+w.byteLength),headers:{"Content-Type":O.contentType,"Content-Length":Buffer.byteLength(w).toString()}}}g();g();se();M();le();ce();Y();pe();function $n(n,t,e,r=!0){let i=n===1?t:e;return r?`${n} ${i}`:i}ue();var de=class extends q{constructor(t={}){if(v()!=="node")throw l.business("Node.js Ship class can only be used in Node.js environment.");let e=_e();super({...t,apiUrl:t.apiUrl||e.apiUrl,token:t.token||(t.session?void 0:e.token)})}async deploy(t,e){return super.deploy(t,e)}async processInput(t,e){let r=typeof t=="string"?[t]:t;if(!Array.isArray(r)||!r.every(s=>typeof s=="string"))throw l.business("Invalid input type for Node.js environment. Expected string or string[].");if(r.length===0)throw l.business("No files to deploy.");let{processFilesForNode:i}=await Promise.resolve().then(()=>(ue(),ze));return i(r,e,this.platformLimits??void 0)}getDeployBodyCreator(){return Fe}},It=de;export{ye as API_KEY,f as API_PATHS,vt as AUTH_BASE_PATH,bt as AccountPlan,K as ApiHttp,me as AuthMethod,_ as CALLER,Z as DEFAULT_API,L as DEPLOYMENT_CONFIG_FILENAME,I as DEPLOY_FIELDS,ge as DEPLOY_TOKEN,Lt as DeploymentStatus,Ye as DeploymentVia,wt as DomainStatus,d as ErrorType,y as FILE_VALIDATION_STATUS,y as FileValidationStatus,F as IDEMPOTENCY_KEY_CONSTRAINTS,Rt as JUNK_DIRECTORIES,N as LABEL_CONSTRAINTS,Re as LABEL_PATTERN,Ft as MY_API_KEY_URL,Ot as OAuthScope,B as PASSWORD_CONSTRAINTS,kt as PUBLIC_DEPLOYMENT_TTL_SECONDS,$ as SHIP_ENV,z as SPA_CHECK_CONSTRAINTS,Ee as SPA_DEFAULT_CONFIG,de as Ship,l as ShipError,x as TokenKind,J as UNBUILT_PROJECT_MARKERS,et as UNSAFE_FILENAME_CHARS,xt as WEB_FILE_ACCEPT,un as __setTestEnvironment,bn as allValidFilesReady,De as assertShipJsonSyntax,j as calculateMD5,tt as classifyToken,be as createAccountResource,we as createDeploymentResource,Ne as createDomainResource,xe as createTokenResource,It as default,Gt as deserializeLabels,Ut as extractSubdomain,Ue as filterJunk,oe as formatFileSize,Mt as generateDeploymentUrl,Bt as generateDomainUrl,v as getENV,At as getValidFiles,G as hasUnbuiltMarker,he as hasUnsafeChars,H as isBlockedExtension,$t as isCustomDomain,_t as isDeployment,Se as isPlatformDomain,k as isShipError,Nt as normalizeVia,$e as optimizeDeployPaths,$n as pluralize,Ge as processFilesForNode,Ht as serializeLabels,nt as validateApiKey,Ct as validateApiUrl,Ae as validateCaller,Be as validateDeployFile,Me as validateDeployPath,rt as validateDeployToken,ae as validateFileName,Nn as validateFiles,fe as validateIdempotencyKey,ee as validatePassword,Q as validateToken};
+var je=Object.defineProperty;var R=(n,t)=>()=>(n&&(t=n(n=0)),t);var Ye=(n,t)=>{for(var e in t)je(n,e,{get:t[e],enumerable:!0})};function xt(n){if(!n||typeof n!="string")return;let t=n.trim().toLowerCase();return Object.values(qe).includes(t)?t:void 0}function fe(n){if(n==null)return;if(typeof n!="string")throw a.validation("Idempotency key must be a string.");let t=n.trim();if(!t)throw a.validation("Idempotency key must not be empty.");if(t.length>_.MAX_LENGTH)throw a.validation(`Idempotency key must be at most ${_.MAX_LENGTH} characters.`);return t}function Qe(n){let t=n.code;return t==="ERR_INVALID_URL"?!1:typeof t=="string"?!0:n instanceof TypeError?!/\burl\b/i.test(n.message):!1}function F(n){return n!==null&&typeof n=="object"&&"name"in n&&n.name==="ShipError"&&"status"in n}function Ze(n){let t=n.replace(/\\/g,"/").split("/").pop()??"",e=t.lastIndexOf(".");return e<=0||e===t.length-1?null:t.slice(e+1).toLowerCase()}function he(n,t){let e=Ze(n);return e===null?!1:Array.isArray(t)?t.includes(e):t.has(e)}function ye(n){return tt.test(n)}function B(n){return n.replace(/\\/g,"/").split("/").filter(Boolean).some(e=>J.has(e))}function nt(n){return n.startsWith(ge.PREFIX)?x.API_KEY:n.startsWith(Ee.PREFIX)?x.DEPLOY_TOKEN:x.OPAQUE}function Te(n){let t=n.charCodeAt(0)===65279?n.slice(1):n,e;try{e=JSON.parse(t)}catch(r){throw a.config(`invalid JSON format in config: ${r.message}`,{filePath:L})}if(e===null||typeof e!="object"||Array.isArray(e))throw a.config(`${L} must contain a JSON object`,{filePath:L})}function Ae(n,t,e){if(!n.startsWith(t.PREFIX))throw a.validation(`${e} must start with "${t.PREFIX}"`);if(n.length!==t.TOTAL_LENGTH)throw a.validation(`${e} must be ${t.TOTAL_LENGTH} characters total (${t.PREFIX} + ${t.HEX_LENGTH} hex chars)`);let r=n.slice(t.PREFIX.length);if(!new RegExp(`^[a-f0-9]{${t.HEX_LENGTH}}$`,"i").test(r))throw a.validation(`${e} must contain ${t.HEX_LENGTH} hexadecimal characters after "${t.PREFIX}" prefix`)}function rt(n){Ae(n,ge,"API key")}function it(n){Ae(n,Ee,"Deploy token")}function Q(n){switch(nt(n)){case x.API_KEY:rt(n);return;case x.DEPLOY_TOKEN:it(n);return;case x.OPAQUE:if(!n)throw a.validation("Token must be a non-empty string")}}function Se(n){if(!n||n.length>C.MAX_LENGTH||!C.PATTERN.test(n))throw a.validation(`Caller must be 1-${C.MAX_LENGTH} characters: letters, digits, dots, underscores, or hyphens`)}function Ft(n){try{let t=new URL(n);if(!["http:","https:"].includes(t.protocol))throw a.validation("API URL must use http:// or https:// protocol");if(t.pathname!=="/"&&t.pathname!=="")throw a.validation("API URL must not contain a path");if(t.search||t.hash)throw a.validation("API URL must not contain query parameters or fragments")}catch(t){throw F(t)?t:a.validation("API URL must be a valid URL")}}function kt(n){return/^[a-z]+-[a-z]+-[a-z0-9]{7}(\.[a-z0-9.-]+)?$/i.test(n)}function Re(n,t){return n.endsWith(`.${t}`)}function Mt(n,t){return!Re(n,t)}function Bt(n,t){return Re(n,t)?n.slice(0,-(t.length+1)):null}function Ht(n){return`https://${n}`}function Gt(n){return`https://${n}`}function zt(n){return!n||n.length===0?null:JSON.stringify(n)}function Kt(n){if(!n)return[];try{let t=JSON.parse(n);return Array.isArray(t)?t:[]}catch{return[]}}function ee(n){if(n==null)return;if(typeof n!="string")throw a.validation("Password must be a string");let t=n.trim();if(t.length<M.MIN_LENGTH||t.length>M.MAX_LENGTH)throw a.validation(`Password must be between ${M.MIN_LENGTH} and ${M.MAX_LENGTH} characters`);return t}var bt,qe,Nt,_,vt,f,I,m,Xe,W,We,Je,a,et,Ot,tt,J,Ct,me,ge,Ee,C,x,_t,L,De,H,Z,k,Ut,$t,g,b,Ie,M,y=R(()=>{"use strict";bt={PENDING:"pending",SUCCESS:"success",FAILED:"failed",DELETING:"deleting"},qe={WEB:"web",SDK:"sdk",CLI:"cli",MCP:"mcp",GIT:"git",N8N:"n8n",GPT:"gpt",VSC:"vsc"},Nt={PENDING:"pending",PARTIAL:"partial",SUCCESS:"success",PAUSED:"paused"},_={HEADER:"Idempotency-Key",MAX_LENGTH:256,WINDOW_SECONDS:1440*60};vt={FREE:"free",STANDARD:"standard",SPONSORED:"sponsored",ENTERPRISE:"enterprise",SUSPENDED:"suspended",TERMINATING:"terminating",TERMINATED:"terminated"},f={DEPLOYMENTS:"/deployments",DEPLOYMENT:n=>`/deployments/${n}`,DEPLOYMENT_CONFIG:n=>`/deployments/${n}/config`,DOMAINS:"/domains",DOMAIN:n=>`/domains/${n}`,DOMAIN_VERIFY:n=>`/domains/${n}/verify`,DOMAIN_DNS:n=>`/domains/${n}/dns`,DOMAIN_RECORDS:n=>`/domains/${n}/records`,DOMAIN_SHARE:n=>`/domains/${n}/share`,DOMAIN_PROPAGATION:n=>`/domains/${n}/propagation`,DOMAINS_VALIDATE:"/domains/validate",TOKENS:"/tokens",TOKEN:n=>`/tokens/${n}`,ACCOUNT:"/account",ACCOUNT_KEY:"/account/key",ACCOUNT_CLAIM:"/account/claim",ACTIVITIES:"/activities",LABELS:"/labels",LIMITS:"/limits",PING:"/ping",SETUP:"/setup",SPA_CHECK:"/spa-check",UPLOAD:"/upload"},I={FILES:"files[]",CHECKSUMS:"checksums",LABELS:"labels",VIA:"via",PASSWORD:"password",BUILD:"build",PRERENDER:"prerender",SPA:"spa",CAPTCHA:"captcha"},m={Validation:"validation_failed",NotFound:"not_found",Forbidden:"forbidden",RateLimit:"rate_limit_exceeded",Authentication:"authentication_failed",Business:"business_logic_error",Api:"internal_server_error",Maintenance:"maintenance",Network:"network_error",Cancelled:"operation_cancelled",File:"file_error",Config:"config_error"},Xe=new Set([m.Network,m.Cancelled,m.File,m.Config]),W={client:new Set([m.Business,m.Cancelled,m.Config,m.File,m.Forbidden,m.NotFound,m.RateLimit,m.Validation]),network:new Set([m.Network]),auth:new Set([m.Authentication])},We=new Set(Object.values(m).filter(n=>!Xe.has(n))),Je=200;a=class n extends Error{type;status;details;constructor(t,e,r,i){super(e),this.type=t,this.status=r,this.details=i,this.name="ShipError"}toResponse(){let t=this.details,e=this.type===m.Authentication&&t?.internal?void 0:this.details;return{error:this.type,message:this.message,status:this.status,details:e}}static async fromHttpResponse(t,e){let r,i,s;try{if(t.headers.get("content-type")?.includes("application/json")){let u=await t.json();if(u&&typeof u=="object"){let c=u;typeof c.message=="string"?r=c.message:typeof c.error=="string"&&(r=c.error),i=c.details,typeof c.error=="string"&&We.has(c.error)&&(s=c.error)}}else{let u=(await t.text()).trim();u&&!u.startsWith("<")&&u.length<=Je&&(r=u)}}catch{}let o=t.headers.get("retry-after");if(o!==null){let l=o.trim(),u=/^\d+$/.test(l)?Number(l):Math.ceil((Date.parse(l)-Date.now())/1e3);if(Number.isFinite(u)&&u>=0){let c=i&&typeof i=="object"?i:{};c.retryAfter===void 0&&(i={...c,retryAfter:u})}}r=r||`${e||"Request"} failed with status ${t.status}`;let p=s??(t.status===401?m.Authentication:t.status===403?m.Forbidden:t.status===429?m.RateLimit:m.Api);return new n(p,r,t.status,i)}static fromFetchError(t,e){if(F(t))return t;let r=e||"Request",i=t?.name;return i==="AbortError"?n.cancelled(`${r} was cancelled`):i==="TimeoutError"?n.network(`${r} timed out`,{cause:t}):t instanceof Error?Qe(t)?n.network(`${r} failed: ${t.message}`,{cause:t}):new n(m.Api,`${r} failed: ${t.message}`):new n(m.Api,`${r} failed: Unknown error`)}static validation(t,e){return new n(m.Validation,t,400,e)}static notFound(t,e){let r=e?`${t} ${e} not found`:`${t} not found`;return new n(m.NotFound,r,404)}static forbidden(t,e){return new n(m.Forbidden,t,403,e)}static rateLimit(t="Too many requests",e){return new n(m.RateLimit,t,429,e)}static authentication(t="Authentication required",e){return new n(m.Authentication,t,401,e)}static business(t,e=400,r){return new n(m.Business,t,e,r)}static network(t,e){return new n(m.Network,t,void 0,e)}static cancelled(t,e){return new n(m.Cancelled,t,void 0,e)}static file(t,e){return new n(m.File,t,void 0,e)}static config(t,e){return new n(m.Config,t,void 0,e)}static api(t,e=500,r){return new n(m.Api,t,e,r)}static maintenance(t,e){return new n(m.Maintenance,t,503,e)}isClientError(){return W.client.has(this.type)?!0:this.status!==void 0&&this.status>=400&&this.status<500}isNetworkError(){return W.network.has(this.type)}isAuthError(){return W.auth.has(this.type)}isType(t){return this.type===t}};et=["html","htm","xhtml","xml","txt","md","markdown","pdf","csv","json","jsonc","webmanifest","map","toml","yaml","yml","rss","atom","css","scss","sass","less","js","mjs","cjs","jsx","ts","tsx","wasm","vue","svelte","png","jpg","jpeg","gif","webp","avif","svg","ico","bmp","tif","tiff","heic","heif","woff","woff2","ttf","otf","eot","mp3","wav","ogg","oga","opus","m4a","aac","flac","weba","mp4","webm","ogv","mov","m4v","avi","glb","gltf","usdz","vtt","srt","zip"],Ot=et.map(n=>`.${n}`).join(","),tt=/[\x00-\x1f\x7f#?%\\<>"]/;J=new Set(["node_modules","package.json"]);Ct="/auth",me={SESSION:"session",API_KEY:"apiKey",TOKEN:"token",AGENT:"agent",OAUTH:"oauth",WEBHOOK:"webhook",SYSTEM:"system"},ge={PREFIX:"ship-",HEX_LENGTH:32,TOTAL_LENGTH:37,HINT_LENGTH:4},Ee={PREFIX:"deploy-",HEX_LENGTH:32,TOTAL_LENGTH:39},C={HEADER:"X-Caller",MAX_LENGTH:128,PATTERN:/^[a-zA-Z0-9._-]+$/},x={API_KEY:me.API_KEY,DEPLOY_TOKEN:me.TOKEN,OPAQUE:"opaque"};_t={ACCOUNT_READ:"account:read",DEPLOYMENTS_READ:"deployments:read",DEPLOYMENTS_WRITE:"deployments:write",DOMAINS_READ:"domains:read",DOMAINS_WRITE:"domains:write"},L="ship.json",De={rewrites:[{source:"/(.*)",destination:"/index.html"}]},H={INDEX_FILE:"index.html",MAX_INDEX_BYTES:100*1024};Z="https://api.shipstatic.com",k={TOKEN:"SHIP_TOKEN",API_URL:"SHIP_API_URL"},Ut="https://my.shipstatic.com/api-key",$t=4320*60,g={PENDING:"pending",PROCESSING_ERROR:"processing_error",EXCLUDED:"excluded",VALIDATION_FAILED:"validation_failed",READY:"ready"};b={MIN_LENGTH:3,MAX_LENGTH:25,MAX_COUNT:10,SEPARATORS:"._-"},Ie=/^[a-z0-9]+(?:[._-][a-z0-9]+)*$/;M={MIN_LENGTH:6,MAX_LENGTH:128}});async function ft(n){let t=(await import("spark-md5")).default,e=new t.ArrayBuffer,r=2097152;for(let i=0;i<n.size;i+=r){let s=Math.min(i+r,n.size);e.append(await n.slice(i,s).arrayBuffer())}return{md5:e.end()}}async function ht(n){let{createHash:t}=await import("crypto"),e=t("md5");return e.update(n),{md5:e.digest("hex")}}async function yt(n){let{createHash:t}=await import("crypto"),{createReadStream:e}=await import("fs");return new Promise((r,i)=>{let s=t("md5"),o=e(n);o.on("error",p=>i(a.file(`Failed to read file for MD5: ${p.message}`,{filePath:n}))),o.on("data",p=>s.update(p)),o.on("end",()=>r({md5:s.digest("hex")}))})}async function K(n){if(n instanceof Blob)return ft(n);if(typeof Buffer<"u"&&Buffer.isBuffer(n))return ht(n);if(typeof n=="string")return yt(n);throw a.business("Invalid input for MD5 calculation")}var V=R(()=>{"use strict";y()});function mn(n){ne=n}function Et(){return typeof process<"u"&&process.versions&&process.versions.node?"node":typeof window<"u"||typeof self<"u"?"browser":"unknown"}function v(){return ne||Et()}var ne,$=R(()=>{"use strict";ne=null});function Ue(n){if(!n||n.length===0)return"";let t=n.filter(s=>s&&typeof s=="string").map(s=>s.replace(/\\/g,"/"));if(t.length===0)return"";if(t.length===1)return t[0];let e=t.map(s=>s.split("/").filter(Boolean)),r=[],i=Math.min(...e.map(s=>s.length));for(let s=0;s<i;s++){let o=e[0][s];if(e.every(p=>p[s]===o))r.push(o);else break}return r.join("/")}function Y(n){return n.replace(/\\/g,"/").replace(/\/+/g,"/").replace(/^\/+/,"")}var re=R(()=>{"use strict"});function $e(n,t={}){if(t.flatten===!1)return n.map(r=>({path:Y(r),name:ie(r)}));let e=At(n);return n.map(r=>{let i=Y(r);if(e){let s=e.endsWith("/")?e:`${e}/`;i.startsWith(s)&&(i=i.substring(s.length))}return i||(i=ie(r)),{path:i,name:ie(r)}})}function At(n){if(!n.length)return"";let e=n.map(s=>Y(s)).map(s=>s.split("/")),r=[],i=Math.min(...e.map(s=>s.length));for(let s=0;s<i-1;s++){let o=e[0][s];if(e.every(p=>p[s]===o))r.push(o);else break}return r.join("/")}function ie(n){return n.split(/[/\\]/).pop()||n}var se=R(()=>{"use strict";re()});function X(n,t){return St.find(e=>e.broken(n,t))}var St,ae=R(()=>{"use strict";y();le();St=[{name:"name",broken:({path:n})=>!oe(n).valid,sentence:({path:n})=>oe(n).reason??"Invalid file name"},{name:"extension",broken:({path:n},t)=>he(n,t.blockedExtensions??[]),sentence:({path:n})=>`File extension not allowed: "${n}"`},{name:"fileSize",broken:({size:n},t)=>n>t.maxFileSize,sentence:({path:n},t)=>`File "${n}" too large. Maximum ${q(t.maxFileSize)} allowed`},{name:"totalSize",broken:({totalSize:n},t)=>n>t.maxTotalSize,sentence:({totalSize:n},t)=>`Total upload size too large. ${q(n)} exceeds maximum of ${q(t.maxTotalSize)}`}]});function q(n,t=1){if(n===0)return"0 Bytes";let e=1024,r=["Bytes","KB","MB","GB"],i=Math.floor(Math.log(n)/Math.log(e));return`${parseFloat((n/e**i).toFixed(t))} ${r[i]}`}function oe(n){if(ye(n))return{valid:!1,reason:"File name contains unsafe characters"};if(n.startsWith(" ")||n.endsWith(" "))return{valid:!1,reason:"File name cannot start/end with spaces"};if(n.endsWith("."))return{valid:!1,reason:"File name cannot end with dots"};let t=/^(CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(\.|$)/i,e=n.split("/").pop()||n;return t.test(e)?{valid:!1,reason:"File name uses a reserved system name"}:n.includes("..")?{valid:!1,reason:"File name contains path traversal pattern"}:{valid:!0}}function _n(n,t){let e=[],r=[],i=[];if(n.length===0){let l={file:"(no files)",message:"At least one file must be provided"};return e.push(l),{files:[],validFiles:[],errors:e,warnings:[],canDeploy:!1}}for(let l of n)if(B(l.name))return e.push({file:l.name,message:"Unbuilt project detected \u2014 deploy your build output (dist/, build/, out/), not the project folder"}),{files:n.map(u=>({...u,status:g.VALIDATION_FAILED,statusMessage:"Unbuilt project detected"})),validFiles:[],errors:e,warnings:[],canDeploy:!1};if(n.length>t.maxFilesCount){let l={file:`(${n.length} files)`,message:`File count (${n.length}) exceeds limit of ${t.maxFilesCount}`};return e.push(l),{files:n.map(u=>({...u,status:g.VALIDATION_FAILED,statusMessage:l.message})),validFiles:[],errors:e,warnings:[],canDeploy:!1}}let s=0;for(let l of n){let u=g.READY,c="Ready for upload";if(l.status===g.PROCESSING_ERROR)u=g.VALIDATION_FAILED,c=l.statusMessage||"File failed during processing",e.push({file:l.name,message:c});else if(l.size===0){u=g.EXCLUDED,c="File is empty (0 bytes) and cannot be deployed due to storage limitations",r.push({file:l.name,message:c}),i.push({...l,status:u,statusMessage:c});continue}else if(l.size<0)u=g.VALIDATION_FAILED,c="File size must be positive",e.push({file:l.name,message:c});else if(!l.name||l.name.trim().length===0)u=g.VALIDATION_FAILED,c="File name cannot be empty",e.push({file:l.name||"(empty)",message:c});else if(l.name.includes("\0"))u=g.VALIDATION_FAILED,c="File name contains invalid characters (null byte)",e.push({file:l.name,message:c});else{let E={path:l.name,size:l.size,totalSize:s+l.size},P=X(E,t);P?(u=g.VALIDATION_FAILED,c=P.sentence(E,t),e.push({file:P.name==="totalSize"?`(${n.length} files)`:l.name,message:c})):s=E.totalSize}i.push({...l,status:u,statusMessage:c})}e.length>0&&(i=i.map(l=>l.status===g.EXCLUDED?l:{...l,status:g.VALIDATION_FAILED,statusMessage:l.status===g.VALIDATION_FAILED?l.statusMessage:"Deployment failed due to validation errors in bundle"}));let o=e.length===0?i.filter(l=>l.status===g.READY):[],p=e.length===0;return{files:i,validFiles:o,errors:e,warnings:r,canDeploy:p}}function Rt(n){return n.filter(t=>t.status===g.READY)}function Fn(n){return Rt(n).length>0}var le=R(()=>{"use strict";y();ae()});import{isJunk as It}from"junk";function Me(n,t){if(!n||n.length===0)return[];if(!t?.allowUnbuilt&&n.find(r=>r&&B(r)))throw a.business("Unbuilt project detected \u2014 deploy your build output (dist/, build/, out/), not the project folder");return n.filter(e=>{if(!e)return!1;let r=e.replace(/\\/g,"/").split("/").filter(Boolean);if(r.length===0)return!0;let i=r[r.length-1];if(It(i))return!1;for(let o of r)if(o!==".well-known"&&(o.startsWith(".")||o.length>255))return!1;let s=r.slice(0,-1);for(let o of s)if(Pt.some(p=>o.toLowerCase()===p.toLowerCase()))return!1;return!0})}var Pt,ce=R(()=>{"use strict";y();Pt=["__MACOSX",".Trashes",".fseventsd",".Spotlight-V100"]});function Be(n,t){if(n.includes("\0")||n.includes("/../")||n.startsWith("../")||n.endsWith("/.."))throw a.business(`Security error: Unsafe file path "${n}" for file: ${t}`)}function He(n,t){let e=X(n,t);if(e)throw a.business(e.sentence(n,t))}var pe=R(()=>{"use strict";y();ae()});var Ke={};Ye(Ke,{processFilesForNode:()=>ze});import*as D from"fs";import*as T from"path";function Ge(n,t=new Set){let e=[],r=D.realpathSync(n);if(t.has(r))return e;t.add(r);let i=D.readdirSync(n);for(let s of i){let o=T.join(n,s),p=D.statSync(o);if(p.isDirectory()){let l=Ge(o,t);e.push(...l)}else p.isFile()&&e.push(o)}return e}async function ze(n,t={},e){if(v()!=="node")throw a.business("processFilesForNode can only be called in Node.js environment.");for(let d of n){let h=T.resolve(d);try{if(D.statSync(h).isDirectory()){let A=D.readdirSync(h).find(S=>J.has(S));if(A)throw a.business(`"${A}" detected \u2014 deploy your build output (dist/, build/, out/), not the project folder`)}}catch(A){if(F(A))throw A}}let r=n.flatMap(d=>{let h=T.resolve(d);try{return D.statSync(h).isDirectory()?Ge(h):[h]}catch{throw a.file(`Path does not exist: ${d}`,{filePath:d})}}),i=[...new Set(r)],s=n.map(d=>T.resolve(d)),o=Ue(s.map(d=>{try{return D.statSync(d).isDirectory()?d:T.dirname(d)}catch{return T.dirname(d)}})),p=i.map(d=>{if(o&&o.length>0){let h=T.relative(o,d);if(h&&typeof h=="string"&&!h.startsWith(".."))return h.replace(/\\/g,"/")}return T.basename(d)}),u=$e(p,{flatten:t.pathDetect!==!1}).map(d=>d.path),c=new Set(Me(u));if(c.size===0)return[];let E=[],P=[];for(let d=0;d<i.length;d++)c.has(u[d])&&(E.push(i[d]),P.push(u[d]));let N=[],w=0;if(!e)throw a.config("Platform limits not provided. processFilesForNode requires the limits argument \u2014 pass `ship.getLimits()` result.");for(let d=0;d<E.length;d++){let h=E[d],A=P[d];try{Be(A,h);let S=D.statSync(h);if(S.size===0)continue;w+=S.size,He({path:A,size:S.size,totalSize:w},e);let O=D.readFileSync(h),{md5:Ve}=await K(O);N.push({path:A,content:O,size:O.length,md5:Ve})}catch(S){if(F(S))throw S;let O=S instanceof Error?S.message:String(S);throw a.file(`Failed to read file "${h}": ${O}`,{filePath:h})}}if(N.length>e.maxFilesCount)throw a.business(`Too many files to deploy. Maximum allowed is ${e.maxFilesCount} files.`);return N}var ue=R(()=>{"use strict";y();se();$();ce();V();re();pe()});y();y();y();var G=class{constructor(){this.handlers=new Map}on(t,e){this.handlers.has(t)||this.handlers.set(t,new Set),this.handlers.get(t)?.add(e)}off(t,e){let r=this.handlers.get(t);r&&(r.delete(e),r.size===0&&this.handlers.delete(t))}emit(t,...e){let r=this.handlers.get(t);if(!r)return;let i=Array.from(r);for(let s of i)try{s(...e)}catch(o){r.delete(s),t!=="error"&&setTimeout(()=>{let p=o instanceof Error?o:new Error(String(o));this.emit("error",p,String(t))},0)}}};y();y();function U(n){if(n==null)return;if(n.length===0)return n;if(n.length>b.MAX_COUNT)throw a.validation(`Maximum ${b.MAX_COUNT} labels allowed`);let t=n.map((r,i)=>{if(typeof r!="string")throw a.validation(`Label at index ${i} must be a string`);let s=r.trim().toLowerCase();if(s.length<b.MIN_LENGTH)throw a.validation(`Labels must be at least ${b.MIN_LENGTH} characters long`);if(s.length>b.MAX_LENGTH)throw a.validation(`Labels must be no more than ${b.MAX_LENGTH} characters long`);if(!Ie.test(s))throw a.validation(`Labels must start and end with alphanumeric characters, with optional separators (${b.SEPARATORS}) between segments`);return s}),e=[...new Set(t)];if(e.length!==t.length)throw a.validation("Duplicate labels are not allowed");return e}async function Pe(n){let t=n.find(i=>i.path===L||i.path===`/${L}`);if(!t)return;let e=t.content,r=typeof e.text=="function"?await e.text():t.content.toString("utf8");Te(r)}var st=3e4,ot=2,at=300,lt=2e3,ct=new Set([500,502,503,504]);function pt(n,t){return new Promise((e,r)=>{if(t?.aborted){r(t.reason);return}let i=()=>{clearTimeout(o),t?.removeEventListener("abort",s)},s=()=>{i(),r(t?.reason)},o=setTimeout(()=>{i(),e()},n);t?.addEventListener("abort",s)})}var Le=3e5,ut=3e5,dt=Le+ut,mt="sdk";function te(n){let t=new URLSearchParams;n?.limit!==void 0&&t.set("limit",String(n.limit)),n?.cursor!==void 0&&t.set("cursor",n.cursor);let e=t.toString();return e?`?${e}`:""}var z=class extends G{constructor(e){super();this.globalHeaders={};this.apiUrl=e.apiUrl||Z,this.getAuthHeadersCallback=e.getAuthHeaders,this.session=e.session??!1,this.caller=e.caller,this.timeout=e.timeout??st,this.maxRetries=Math.max(0,e.maxRetries??ot),this.deployTimeout=e.timeout??Le,this.deployBuildTimeout=e.timeout??dt,this.fetch=e.fetch??globalThis.fetch.bind(globalThis),this.createDeployBody=e.createDeployBody,this.deployEndpoint=e.deployEndpoint||f.DEPLOYMENTS}setGlobalHeaders(e){this.globalHeaders=e}async executeRequest(e,r,i,s=this.timeout){for(let o=0;;o++)try{return await this.attemptOnce(e,r,i,s)}catch(p){let l=a.fromFetchError(p,i);if(o>=this.maxRetries||!this.isRetryable(l,r))throw l;let u=Math.min(lt,at*2**o);try{await pt(Math.random()*u,r.signal)}catch(c){let E=a.fromFetchError(c,i);throw this.emit("error",E,e),E}}}isRetryable(e,r){if(r.signal?.aborted||e.isType(m.Maintenance)||e.isType(m.Cancelled)||!(e.isNetworkError()||e.status!==void 0&&ct.has(e.status)))return!1;let s=(r.method??"GET").toUpperCase();return s==="GET"||s==="HEAD"?!0:s==="PUT"||s==="DELETE"?!1:this.hasIdempotencyKey(r.headers)}hasIdempotencyKey(e){if(!e)return!1;let r=_.HEADER.toLowerCase(),i=!1,s=o=>{o.toLowerCase()===r&&(i=!0)};if(e instanceof Headers)e.forEach((o,p)=>{s(p)});else if(Array.isArray(e))for(let[o]of e)s(o);else for(let o of Object.keys(e))s(o);return i}async attemptOnce(e,r,i,s=this.timeout){let o=()=>{};try{let p=await this.mergeHeaders(r.headers),l=this.createTimeoutSignal(r.signal,s);o=l.cleanup;let u={...r,headers:p,credentials:this.session&&!p.Authorization?"include":void 0,signal:l.signal};this.emit("request",e,u);let c=await this.fetch(e,u);if(o(),!c.ok)throw await a.fromHttpResponse(c,i);return this.emit("response",this.safeClone(c),e),{data:await this.parseResponse(this.safeClone(c)),status:c.status}}catch(p){o();let l=a.fromFetchError(p,i);throw this.emit("error",l,e),l}}async request(e,r,i,s){let{data:o}=await this.executeRequest(e,r,i,s);return o}async requestWithStatus(e,r,i){return this.executeRequest(e,r,i)}async mergeHeaders(e={}){return{...this.globalHeaders,...this.caller?{[C.HEADER]:this.caller}:{},...await this.getAuthHeadersCallback(),...e}}createTimeoutSignal(e,r=this.timeout){let i=new AbortController,s=setTimeout(()=>i.abort(new DOMException(`Timed out after ${r}ms`,"TimeoutError")),r),o=e?()=>i.abort(e.reason):void 0;return e&&o&&(e.addEventListener("abort",o),e.aborted&&i.abort(e.reason)),{signal:i.signal,cleanup:()=>{clearTimeout(s),e&&o&&e.removeEventListener("abort",o)}}}safeClone(e){try{return e.clone()}catch{return e}}async parseResponse(e){if(!(e.headers.get("Content-Length")==="0"||e.status===204))return e.json()}async deploy(e,r={}){if(!e.length)throw a.business("No files to deploy");for(let u of e)if(!u.md5)throw a.file(`MD5 checksum missing for file: ${u.path}`,{filePath:u.path});ee(r.password);let i=fe(r.idempotencyKey),s=U(r.labels);await Pe(e);let o=r.build||r.prerender||r.spa?{build:r.build,prerender:r.prerender,spa:r.spa}:void 0,{body:p,headers:l}=await this.createDeployBody(e,{labels:s,via:r.via??mt,password:r.password,flags:o,captcha:r.captcha});return this.request(`${this.apiUrl}${this.deployEndpoint}`,{method:"POST",body:p,headers:i?{...l,[_.HEADER]:i}:l,signal:r.signal||null},"Deploy",r.build||r.prerender?this.deployBuildTimeout:this.deployTimeout)}async listDeployments(e){return this.request(`${this.apiUrl}${f.DEPLOYMENTS}${te(e)}`,{method:"GET"},"List deployments")}async getDeployment(e){return this.request(`${this.apiUrl}${f.DEPLOYMENT(encodeURIComponent(e))}`,{method:"GET"},"Get deployment")}async updateDeploymentLabels(e,r){let i=U(r);return this.request(`${this.apiUrl}${f.DEPLOYMENT(encodeURIComponent(e))}`,{method:"PATCH",headers:{"Content-Type":"application/json"},body:JSON.stringify({labels:i})},"Update deployment labels")}async deleteDeployment(e){return this.request(`${this.apiUrl}${f.DEPLOYMENT(encodeURIComponent(e))}`,{method:"DELETE"},"Delete deployment")}async setDomain(e,r,i){let s=U(i),o={};r&&(o.deployment=r),s!==void 0&&(o.labels=s);let{data:p,status:l}=await this.requestWithStatus(`${this.apiUrl}${f.DOMAIN(encodeURIComponent(e))}`,{method:"PUT",headers:{"Content-Type":"application/json"},body:JSON.stringify(o)},"Set domain");return{...p,isCreate:l===201}}async listDomains(e){return this.request(`${this.apiUrl}${f.DOMAINS}${te(e)}`,{method:"GET"},"List domains")}async getDomain(e){return this.request(`${this.apiUrl}${f.DOMAIN(encodeURIComponent(e))}`,{method:"GET"},"Get domain")}async deleteDomain(e){return this.request(`${this.apiUrl}${f.DOMAIN(encodeURIComponent(e))}`,{method:"DELETE"},"Delete domain")}async verifyDomain(e){return this.request(`${this.apiUrl}${f.DOMAIN_VERIFY(encodeURIComponent(e))}`,{method:"POST"},"Verify domain")}async getDomainDns(e){return this.request(`${this.apiUrl}${f.DOMAIN_DNS(encodeURIComponent(e))}`,{method:"GET"},"Get domain DNS")}async getDomainRecords(e){return this.request(`${this.apiUrl}${f.DOMAIN_RECORDS(encodeURIComponent(e))}`,{method:"GET"},"Get domain records")}async getDomainShare(e){return this.request(`${this.apiUrl}${f.DOMAIN_SHARE(encodeURIComponent(e))}`,{method:"GET"},"Get domain share")}async validateDomain(e){return this.request(`${this.apiUrl}${f.DOMAINS_VALIDATE}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({domain:e})},"Validate domain")}async createToken(e,r){let i=U(r),s={};return e!==void 0&&(s.ttl=e),i!==void 0&&(s.labels=i),this.request(`${this.apiUrl}${f.TOKENS}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(s)},"Create token")}async listTokens(e){return this.request(`${this.apiUrl}${f.TOKENS}${te(e)}`,{method:"GET"},"List tokens")}async deleteToken(e){return this.request(`${this.apiUrl}${f.TOKEN(encodeURIComponent(e))}`,{method:"DELETE"},"Delete token")}async getToken(e){return this.request(`${this.apiUrl}${f.TOKEN(encodeURIComponent(e))}`,{method:"GET"},"Get token")}async getAccount(){return this.request(`${this.apiUrl}${f.ACCOUNT}`,{method:"GET"},"Get account")}async getLimits(){return this.request(`${this.apiUrl}${f.LIMITS}`,{method:"GET"},"Get limits")}async ping(){return this.request(`${this.apiUrl}${f.PING}`,{method:"GET"},"Ping")}async checkSPA(e,r={}){let i=e.find(l=>l.path===H.INDEX_FILE||l.path===`/${H.INDEX_FILE}`);if(!i||i.size>H.MAX_INDEX_BYTES)return!1;let s;if(typeof Buffer<"u"&&Buffer.isBuffer(i.content))s=i.content.toString("utf-8");else if(typeof Blob<"u"&&i.content instanceof Blob)s=await i.content.text();else if(typeof File<"u"&&i.content instanceof File)s=await i.content.text();else return!1;let o={files:e.map(l=>l.path),index:s};return(await this.request(`${this.apiUrl}${f.SPA_CHECK}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(o)},"SPA check")).isSPA}};y();y();V();async function gt(){let n=JSON.stringify(De,null,2),t;typeof Buffer<"u"?t=Buffer.from(n,"utf-8"):t=new Blob([n],{type:"application/json"});let{md5:e}=await K(t);return{path:L,content:t,size:n.length,md5:e}}async function we(n,t,e){if(e.spaDetect===!1||e.spa||e.build||e.prerender||n.some(r=>r.path===L))return n;try{if(await t.checkSPA(n,e)){let i=await gt();return[...n,i]}}catch{}return n}function be(n){let{getApi:t,ensureInit:e,processInput:r}=n;return{upload:async(i,s={})=>{if(await e(),!r)throw a.config("processInput function is not provided.");let o=t(),p=await r(i,s);return p=await we(p,o,s),o.deploy(p,s)},list:async i=>(await e(),t().listDeployments(i)),get:async i=>(await e(),t().getDeployment(i)),set:async(i,s)=>(await e(),t().updateDeploymentLabels(i,s.labels)),delete:async i=>(await e(),t().deleteDeployment(i))}}function Ne(n){let{getApi:t,ensureInit:e}=n;return{set:async(r,i={})=>(await e(),t().setDomain(r,i.deployment,i.labels)),list:async r=>(await e(),t().listDomains(r)),get:async r=>(await e(),t().getDomain(r)),delete:async r=>(await e(),t().deleteDomain(r)),verify:async r=>(await e(),t().verifyDomain(r)),validate:async r=>(await e(),t().validateDomain(r)),dns:async r=>(await e(),t().getDomainDns(r)),records:async r=>(await e(),t().getDomainRecords(r)),share:async r=>(await e(),t().getDomainShare(r))}}function xe(n){let{getApi:t,ensureInit:e}=n;return{get:async()=>(await e(),t().getAccount())}}function ve(n){let{getApi:t,ensureInit:e}=n;return{create:async(r={})=>(await e(),t().createToken(r.ttl,r.labels)),list:async r=>(await e(),t().listTokens(r)),get:async r=>(await e(),t().getToken(r)),delete:async r=>(await e(),t().deleteToken(r))}}var j=class{constructor(t={}){this.initPromise=null;this.platformLimits=null;this.credential=null;if(t={...t,apiUrl:t.apiUrl||void 0,token:t.token||void 0,caller:t.caller||void 0},this.clientOptions=t,t.caller!==void 0&&Se(t.caller),t.token&&t.session)throw a.config("Provide either `token` or `session`, not both.");typeof t.token=="string"?(Q(t.token),this.credential=t.token):t.token&&(this.credential=t.token),this.http=new z({...t,getAuthHeaders:()=>this.getAuthHeaders(),createDeployBody:this.getDeployBodyCreator()});let e={getApi:()=>this.http,ensureInit:()=>this.ensureInitialized()};this.deployments=be({...e,processInput:(r,i)=>this.processInput(r,i)}),this.domains=Ne(e),this.account=xe(e),this.tokens=ve(e)}async ensureInitialized(){return this.initPromise||(this.initPromise=this.fetchPlatformLimits()),this.initPromise}async fetchPlatformLimits(){try{this.platformLimits=await this.http.getLimits()}catch(t){throw this.initPromise=null,t}}async ping(){return await this.ensureInitialized(),this.http.ping()}async deploy(t,e){return this.deployments.upload(t,e)}async whoami(){return this.account.get()}async getLimits(){return this.platformLimits?this.platformLimits:(await this.ensureInitialized(),this.platformLimits)}on(t,e){this.http.on(t,e)}off(t,e){this.http.off(t,e)}setHeaders(t){this.http.setGlobalHeaders(t)}clearHeaders(){this.http.setGlobalHeaders({})}setToken(t){if(this.clientOptions.session)throw a.config("Provide either `token` or `session`, not both.");if(typeof t=="string"){if(!t)throw a.business("Invalid token provided. Token must be a non-empty string.");Q(t),this.credential=t;return}if(typeof t!="function")throw a.business("Invalid token provided. Token must be a non-empty string or a provider function.");this.credential=t}async getAuthHeaders(){if(this.credential===null)return{};let t=typeof this.credential=="function"?await this.credential():this.credential;if(!t)throw a.authentication("Token provider returned no token.");if(typeof t!="string")throw a.authentication("Token provider returned a non-string value.");return{Authorization:`Bearer ${t}`}}};$();y();import{z as _e}from"zod";import{z as Oe}from"zod";var Ce={apiUrl:Oe.string().url().optional(),token:Oe.string().min(1).optional()};$();var Dt=_e.object(Ce).strict(),Tt={apiUrl:k.API_URL,token:k.TOKEN};function Fe(){if(v()!=="node")return{};let n={apiUrl:process.env[k.API_URL]||void 0,token:process.env[k.TOKEN]||void 0};try{return Dt.parse(n)}catch(t){if(t instanceof _e.ZodError){let e=t.issues[0],r=e.path[0],i=(r&&Tt[r])??"SHIP environment configuration";throw a.config(`Invalid ${i}: ${e.message}`)}throw a.config("Invalid environment configuration")}}y();async function ke(n,t={}){let{FormData:e,File:r}=await import("formdata-node"),{FormDataEncoder:i}=await import("form-data-encoder"),{labels:s,via:o,password:p,flags:l,captcha:u}=t,c=new e,E=[];for(let d of n){if(!Buffer.isBuffer(d.content)&&!(typeof Blob<"u"&&d.content instanceof Blob))throw a.file(`Unsupported file.content type for Node.js: ${d.path}`,{filePath:d.path});if(!d.md5)throw a.file(`File missing md5 checksum: ${d.path}`,{filePath:d.path});let h=new r([d.content],d.path,{type:"application/octet-stream"});c.append(I.FILES,h),E.push(d.md5)}c.append(I.CHECKSUMS,JSON.stringify(E)),s&&s.length>0&&c.append(I.LABELS,JSON.stringify(s)),o&&c.append(I.VIA,o),p&&c.append(I.PASSWORD,p),l?.build&&c.append(I.BUILD,"true"),l?.prerender&&c.append(I.PRERENDER,"true"),l?.spa&&c.append(I.SPA,"true"),u&&c.append(I.CAPTCHA,u);let P=new i(c),N=[];for await(let d of P.encode())N.push(Buffer.from(d));let w=Buffer.concat(N);return{body:w.buffer.slice(w.byteOffset,w.byteOffset+w.byteLength),headers:{"Content-Type":P.contentType,"Content-Length":Buffer.byteLength(w).toString()}}}y();y();se();$();le();ce();V();pe();function zn(n,t,e,r=!0){let i=n===1?t:e;return r?`${n} ${i}`:i}ue();var de=class extends j{constructor(t={}){if(v()!=="node")throw a.business("Node.js Ship class can only be used in Node.js environment.");let e=Fe();super({...t,apiUrl:t.apiUrl||e.apiUrl,token:t.token||(t.session?void 0:e.token)})}async deploy(t,e){return super.deploy(t,e)}async processInput(t,e){let r=typeof t=="string"?[t]:t;if(!Array.isArray(r)||!r.every(s=>typeof s=="string"))throw a.business("Invalid input type for Node.js environment. Expected string or string[].");if(r.length===0)throw a.business("No files to deploy.");let{processFilesForNode:i}=await Promise.resolve().then(()=>(ue(),Ke));return i(r,e,this.platformLimits??void 0)}getDeployBodyCreator(){return ke}},Lt=de;export{ge as API_KEY,f as API_PATHS,Ct as AUTH_BASE_PATH,vt as AccountPlan,z as ApiHttp,me as AuthMethod,C as CALLER,Z as DEFAULT_API,L as DEPLOYMENT_CONFIG_FILENAME,I as DEPLOY_FIELDS,Ee as DEPLOY_TOKEN,bt as DeploymentStatus,qe as DeploymentVia,Nt as DomainStatus,m as ErrorType,g as FILE_VALIDATION_STATUS,g as FileValidationStatus,_ as IDEMPOTENCY_KEY_CONSTRAINTS,Pt as JUNK_DIRECTORIES,b as LABEL_CONSTRAINTS,Ie as LABEL_PATTERN,Ut as MY_API_KEY_URL,_t as OAuthScope,M as PASSWORD_CONSTRAINTS,$t as PUBLIC_DEPLOYMENT_TTL_SECONDS,k as SHIP_ENV,H as SPA_CHECK_CONSTRAINTS,De as SPA_DEFAULT_CONFIG,de as Ship,a as ShipError,x as TokenKind,J as UNBUILT_PROJECT_MARKERS,tt as UNSAFE_FILENAME_CHARS,Ot as WEB_FILE_ACCEPT,mn as __setTestEnvironment,Fn as allValidFilesReady,Te as assertShipJsonSyntax,K as calculateMD5,nt as classifyToken,xe as createAccountResource,be as createDeploymentResource,Ne as createDomainResource,ve as createTokenResource,Lt as default,Kt as deserializeLabels,Bt as extractSubdomain,Me as filterJunk,q as formatFileSize,Ht as generateDeploymentUrl,Gt as generateDomainUrl,v as getENV,Rt as getValidFiles,B as hasUnbuiltMarker,ye as hasUnsafeChars,he as isBlockedExtension,Mt as isCustomDomain,kt as isDeployment,Re as isPlatformDomain,F as isShipError,xt as normalizeVia,$e as optimizeDeployPaths,zn as pluralize,ze as processFilesForNode,zt as serializeLabels,rt as validateApiKey,Ft as validateApiUrl,Se as validateCaller,He as validateDeployFile,Be as validateDeployPath,it as validateDeployToken,oe as validateFileName,_n as validateFiles,fe as validateIdempotencyKey,ee as validatePassword,Q as validateToken};
 //# sourceMappingURL=index.js.map