@shipstatic/ship 2.2.0 → 2.3.0-beta.2

package/dist/index.d.cts

@@ -1118,6 +1118,39 @@ declare const DEPLOY_TOKEN: {
     /** Total length of a deploy token including prefix (`PREFIX.length + HEX_LENGTH = 39`). */
     readonly TOTAL_LENGTH: 39;
 };
+/**
+ * Shape constants for OAuth access tokens (`oauth-{32 hex chars}`) — the
+ * delegated population, minted by the platform's own authorization server
+ * for a connected app acting on a user's behalf.
+ *
+ * Same width as the other two, and for the same reason: one entropy standard
+ * across the platform, so "how long is a credential" has one answer.
+ *
+ * **This population is the access token alone.** Refresh tokens, authorization
+ * codes and client secrets are deliberately NOT here and are deliberately not
+ * prefixed by this constant: none of them ever enters the `Authorization:
+ * Bearer` slot — a refresh token is posted as a form field to the token
+ * endpoint, which knows what it is receiving — so `classifyToken` never sees
+ * one and a prefix would name a population no dispatcher dispatches. The same
+ * reasoning that keeps the deployment claim code bare.
+ *
+ * **The prefix must be applied at the MINT, never as a display wrapper.** The
+ * authorization server hashes what it stores and the API hashes what it is
+ * presented, so the prefix has to be inside the hashed string on both sides.
+ * `@better-auth/oauth-provider` offers a `prefix.opaqueAccessToken` option
+ * that prepends AFTER hashing and strips on its own read paths; using it would
+ * store a hash of the UNPREFIXED token and silently break the platform's read
+ * arm. The API therefore mints through `generateOpaqueAccessToken` — recorded
+ * beside the config in `cloudflare/api/src/lib/auth/instance.ts`.
+ */
+declare const OAUTH_TOKEN: {
+    /** Prefix that identifies an OAuth access token. */
+    readonly PREFIX: "oauth-";
+    /** Number of hex characters following the prefix. */
+    readonly HEX_LENGTH: 32;
+    /** Total length including prefix (`PREFIX.length + HEX_LENGTH = 38`). */
+    readonly TOTAL_LENGTH: 38;
+};
 /**
  * Shape constants for caller identifiers (the `X-Caller` instance-identity
  * header — rate-limit bucketing for multi-tenant orchestrators). The API
@@ -1138,16 +1171,23 @@ declare const CALLER: {
  * client token in one wire slot (`Authorization: Bearer <value>`) and
  * classifies by value, never by a side channel — this is the classifier.
  *
- * `API_KEY` and `DEPLOY_TOKEN` *are* `AuthMethod.API_KEY` and
- * `AuthMethod.TOKEN` — the equality is structural, so a classification flows
- * straight into an auth method and the pair can never drift. `OPAQUE` is any
- * other value — shape says nothing about it, so only a lookup can. Today the
- * server refuses every opaque bearer; the OAuth access-token population
- * resolves there when the authorization server ships.
+ * `API_KEY`, `DEPLOY_TOKEN` and `OAUTH` *are* `AuthMethod.API_KEY`,
+ * `AuthMethod.TOKEN` and `AuthMethod.OAUTH` — the equality is structural, so
+ * a classification flows straight into an auth method and the trio can never
+ * drift.
+ *
+ * `OPAQUE` is any other value, and since 2026-08-14 it names NO population:
+ * every credential this platform mints for the Bearer slot carries a prefix,
+ * so an opaque bearer is a bearer we did not mint. It stays a member rather
+ * than becoming a `null` return because a dispatcher with a total codomain
+ * reads better than one with an absence in it — and because it is where a
+ * future population would land before anyone gave it a shape, which is
+ * exactly what the OAuth token itself did until its prefix existed.
  */
 declare const TokenKind: {
     readonly API_KEY: "apiKey";
     readonly DEPLOY_TOKEN: "token";
+    readonly OAUTH: "oauth";
     readonly OPAQUE: "opaque";
 };
 type TokenKindType = (typeof TokenKind)[keyof typeof TokenKind];
@@ -1158,6 +1198,43 @@ type TokenKindType = (typeof TokenKind)[keyof typeof TokenKind];
  * is what guarantees client and server can never disagree on dispatch.
  */
 declare function classifyToken(token: string): TokenKindType;
+/**
+ * Read the credential out of an `Authorization` header value — the step
+ * BEFORE `classifyToken`, and the other half of the one wire slot this
+ * section owns.
+ *
+ * Returns the credential's own bytes, or `null` when the header carries a
+ * foreign scheme or nothing after the scheme.
+ *
+ * **The scheme is folded; the credential is not.** RFC 7235 §2.1 makes the
+ * auth-scheme case-insensitive, so `bearer`, `Bearer` and `BEARER` are the
+ * same header. The value after it is opaque and is compared literally
+ * everywhere it is used — `ship-`/`deploy-`/`oauth-` are lowercase hex, and
+ * folding them would make a credential match values it is not.
+ *
+ * **This platform has paid for the rule twice, which is why it has an owner
+ * rather than a convention.** A spec-conformant `bearer ship-…` client was
+ * refused for as long as the API's scheme test was spelled case-sensitively;
+ * and `@better-auth/oauth-provider` carries the same defect in four places
+ * today (`startsWith("Bearer ")`), which is precisely why the platform folds
+ * the scheme itself and hands the provider a bare token.
+ *
+ * **ABSENCE is deliberately not this function's business.** A missing header
+ * and an unreadable one are different facts, and the callers that care split
+ * on them: the API worker's middleware distinguishes `absent` (the only
+ * anonymous path) from `unreadable` (a presented credential that is refused),
+ * and collapsing the two here would take that distinction away from the layer
+ * that needs it. Callers check for the header themselves and pass its value.
+ *
+ * **Why this lives in the constitution rather than in a worker's `shared/`.**
+ * It is the same wire boundary `classifyToken` already owns — one reads the
+ * slot, the other dispatches on what came out — and a rule with two holders
+ * whose drift is silent earns exactly one owner regardless of what the
+ * convoy costs. The estate's recorded refusal to own a `Bearer` CONSTANT
+ * stands and is a different thing: that is RFC vocabulary, the same reason
+ * this package owns no `"POST"`. A parser is not a spelling.
+ */
+declare function readBearerValue(header: string): string | null;
 /**
  * OAuth scope vocabulary for delegated third-party access tokens.
  * Single source of truth used by the authorization server (advertised in
@@ -1243,11 +1320,22 @@ declare function validateApiKey(apiKey: string): void;
  * Validate deploy token format
  */
 declare function validateDeployToken(deployToken: string): void;
+/**
+ * Validate OAuth access token format
+ */
+declare function validateOAuthToken(oauthToken: string): void;
 /**
  * Validate a client token of any population. Classifies by shape and applies
- * the matching format rules: `ship-` keys and `deploy-` deploy tokens are
- * validated strictly; opaque tokens (OAuth access tokens, future populations)
- * only need to be non-empty — their validity is the server's to decide.
+ * the matching format rules: all three prefixed populations are validated
+ * strictly; an OPAQUE token only needs to be non-empty.
+ *
+ * **The OPAQUE arm stays permissive on purpose**, even though the platform no
+ * longer mints an unprefixed credential. It is the fallback for a population
+ * that does not exist yet, and a client refusing a shape the server would
+ * accept is the one failure mode this boundary must never have — the server
+ * decides, and it refuses an unrecognised bearer anyway. Unprefixed OAuth
+ * tokens from before 2026-08-14 land here and are refused server-side, which
+ * is correct: they were revoked by the change, not grandfathered.
  */
 declare function validateToken(token: string): void;
 /**
@@ -2789,6 +2877,6 @@ declare class Ship extends Ship$1 {
 }
 
 declare namespace Ship {
-  export { API_KEY, API_PATHS, AUTH_BASE_PATH, Account, AccountDeleteResponse, AccountGetResponse, AccountKeyResponse, AccountOverrides, AccountPlan, AccountPlanType, AccountResource, AccountUsage, Activity, ActivityEvent, ActivityListResponse, ActivityMeta, ApiDeployOptions, ApiHttp, ApiHttpOptions, AuthMethod, AuthMethodType, BillingCancelResponse, BillingStatus, CALLER, CheckoutSession, DEFAULT_API, DEPLOYMENT_CONFIG_FILENAME, DEPLOY_FIELDS, DEPLOY_TOKEN, DeployBodyContext, DeployFile, DeployInput, DeployTransport, Deployment, DeploymentCreateResponse, DeploymentDeleteResponse, DeploymentListResponse, DeploymentOptions, DeploymentResource, DeploymentResourceContext, DeploymentSetOptions, DeploymentStatus, DeploymentStatusType, DeploymentUploadOptions, DeploymentVia, DeploymentViaType, DnsLookup, DnsProvider, DnsRecord, DnsRecordType, Domain, DomainDeleteResponse, DomainDnsResponse, DomainListResponse, DomainRecordsResponse, DomainResource, DomainSetOptions, DomainSetResult, DomainShareResponse, DomainStatus, DomainStatusType, DomainValidateResponse, DomainVerifyResponse, ErrorResponse, ErrorType, ExecutionEnvironment, FileValidationStatus as FILE_VALIDATION_STATUS, Fetch, FileValidationResult, FileValidationStatus, FileValidationStatusType, IDEMPOTENCY_KEY_CONSTRAINTS, JUNK_DIRECTORIES, LABEL_CONSTRAINTS, LABEL_PATTERN, LabelsResponse, ListOptions, ListResponse, MD5Result, MY_API_KEY_URL, OAuthScope, OAuthScopeType, PASSWORD_CONSTRAINTS, PUBLIC_DEPLOYMENT_TTL_SECONDS, PingResponse, PlatformLimits, RequestResult, ResourceContext, SHIP_ENV, SPACheckDebug, SPACheckRequest, SPACheckResponse, SPA_CHECK_CONSTRAINTS, SPA_DEFAULT_CONFIG, SetupInstructionsResponse, ShipClientOptions, ShipError, ShipEvents, ShipRequestInit, StaticFile, TTL_CONSTRAINTS, Token, TokenCreateOptions, TokenCreateResponse, TokenDeleteResponse, TokenKind, TokenKindType, TokenListResponse, TokenProvider, TokenResource, Transport, UNBUILT_PROJECT_MARKERS, UNSAFE_FILENAME_CHARS, UploadedFile, UserVisibleActivityEvent, ValidatableFile, ValidationIssue, WEB_FILE_ACCEPT, __setTestEnvironment, allValidFilesReady, assertShipJsonSyntax, calculateMD5, classifyToken, createAccountResource, createDeploymentResource, createDomainResource, createTokenResource, deserializeLabels, extractSubdomain, filterJunk, formatFileSize, generateDeploymentUrl, generateDomainUrl, getENV, getValidFiles, hasUnbuiltMarker, hasUnsafeChars, isBlockedExtension, isCustomDomain, isDeployment, isPlatformDomain, isShipError, normalizeVia, optimizeDeployPaths, pluralize, processFilesForNode, serializeLabels, validateApiKey, validateApiUrl, validateCaller, validateDeployFile, validateDeployPath, validateDeployToken, validateFileName, validateFiles, validateIdempotencyKey, validatePassword, validateToken, validateTtl };
+  export { API_KEY, API_PATHS, AUTH_BASE_PATH, Account, AccountDeleteResponse, AccountGetResponse, AccountKeyResponse, AccountOverrides, AccountPlan, AccountPlanType, AccountResource, AccountUsage, Activity, ActivityEvent, ActivityListResponse, ActivityMeta, ApiDeployOptions, ApiHttp, ApiHttpOptions, AuthMethod, AuthMethodType, BillingCancelResponse, BillingStatus, CALLER, CheckoutSession, DEFAULT_API, DEPLOYMENT_CONFIG_FILENAME, DEPLOY_FIELDS, DEPLOY_TOKEN, DeployBodyContext, DeployFile, DeployInput, DeployTransport, Deployment, DeploymentCreateResponse, DeploymentDeleteResponse, DeploymentListResponse, DeploymentOptions, DeploymentResource, DeploymentResourceContext, DeploymentSetOptions, DeploymentStatus, DeploymentStatusType, DeploymentUploadOptions, DeploymentVia, DeploymentViaType, DnsLookup, DnsProvider, DnsRecord, DnsRecordType, Domain, DomainDeleteResponse, DomainDnsResponse, DomainListResponse, DomainRecordsResponse, DomainResource, DomainSetOptions, DomainSetResult, DomainShareResponse, DomainStatus, DomainStatusType, DomainValidateResponse, DomainVerifyResponse, ErrorResponse, ErrorType, ExecutionEnvironment, FileValidationStatus as FILE_VALIDATION_STATUS, Fetch, FileValidationResult, FileValidationStatus, FileValidationStatusType, IDEMPOTENCY_KEY_CONSTRAINTS, JUNK_DIRECTORIES, LABEL_CONSTRAINTS, LABEL_PATTERN, LabelsResponse, ListOptions, ListResponse, MD5Result, MY_API_KEY_URL, OAUTH_TOKEN, OAuthScope, OAuthScopeType, PASSWORD_CONSTRAINTS, PUBLIC_DEPLOYMENT_TTL_SECONDS, PingResponse, PlatformLimits, RequestResult, ResourceContext, SHIP_ENV, SPACheckDebug, SPACheckRequest, SPACheckResponse, SPA_CHECK_CONSTRAINTS, SPA_DEFAULT_CONFIG, SetupInstructionsResponse, ShipClientOptions, ShipError, ShipEvents, ShipRequestInit, StaticFile, TTL_CONSTRAINTS, Token, TokenCreateOptions, TokenCreateResponse, TokenDeleteResponse, TokenKind, TokenKindType, TokenListResponse, TokenProvider, TokenResource, Transport, UNBUILT_PROJECT_MARKERS, UNSAFE_FILENAME_CHARS, UploadedFile, UserVisibleActivityEvent, ValidatableFile, ValidationIssue, WEB_FILE_ACCEPT, __setTestEnvironment, allValidFilesReady, assertShipJsonSyntax, calculateMD5, classifyToken, createAccountResource, createDeploymentResource, createDomainResource, createTokenResource, deserializeLabels, extractSubdomain, filterJunk, formatFileSize, generateDeploymentUrl, generateDomainUrl, getENV, getValidFiles, hasUnbuiltMarker, hasUnsafeChars, isBlockedExtension, isCustomDomain, isDeployment, isPlatformDomain, isShipError, normalizeVia, optimizeDeployPaths, pluralize, processFilesForNode, readBearerValue, serializeLabels, validateApiKey, validateApiUrl, validateCaller, validateDeployFile, validateDeployPath, validateDeployToken, validateFileName, validateFiles, validateIdempotencyKey, validateOAuthToken, validatePassword, validateToken, validateTtl };
 }
 export = Ship;

package/dist/index.d.ts

@@ -1118,6 +1118,39 @@ declare const DEPLOY_TOKEN: {
     /** Total length of a deploy token including prefix (`PREFIX.length + HEX_LENGTH = 39`). */
     readonly TOTAL_LENGTH: 39;
 };
+/**
+ * Shape constants for OAuth access tokens (`oauth-{32 hex chars}`) — the
+ * delegated population, minted by the platform's own authorization server
+ * for a connected app acting on a user's behalf.
+ *
+ * Same width as the other two, and for the same reason: one entropy standard
+ * across the platform, so "how long is a credential" has one answer.
+ *
+ * **This population is the access token alone.** Refresh tokens, authorization
+ * codes and client secrets are deliberately NOT here and are deliberately not
+ * prefixed by this constant: none of them ever enters the `Authorization:
+ * Bearer` slot — a refresh token is posted as a form field to the token
+ * endpoint, which knows what it is receiving — so `classifyToken` never sees
+ * one and a prefix would name a population no dispatcher dispatches. The same
+ * reasoning that keeps the deployment claim code bare.
+ *
+ * **The prefix must be applied at the MINT, never as a display wrapper.** The
+ * authorization server hashes what it stores and the API hashes what it is
+ * presented, so the prefix has to be inside the hashed string on both sides.
+ * `@better-auth/oauth-provider` offers a `prefix.opaqueAccessToken` option
+ * that prepends AFTER hashing and strips on its own read paths; using it would
+ * store a hash of the UNPREFIXED token and silently break the platform's read
+ * arm. The API therefore mints through `generateOpaqueAccessToken` — recorded
+ * beside the config in `cloudflare/api/src/lib/auth/instance.ts`.
+ */
+declare const OAUTH_TOKEN: {
+    /** Prefix that identifies an OAuth access token. */
+    readonly PREFIX: "oauth-";
+    /** Number of hex characters following the prefix. */
+    readonly HEX_LENGTH: 32;
+    /** Total length including prefix (`PREFIX.length + HEX_LENGTH = 38`). */
+    readonly TOTAL_LENGTH: 38;
+};
 /**
  * Shape constants for caller identifiers (the `X-Caller` instance-identity
  * header — rate-limit bucketing for multi-tenant orchestrators). The API
@@ -1138,16 +1171,23 @@ declare const CALLER: {
  * client token in one wire slot (`Authorization: Bearer <value>`) and
  * classifies by value, never by a side channel — this is the classifier.
  *
- * `API_KEY` and `DEPLOY_TOKEN` *are* `AuthMethod.API_KEY` and
- * `AuthMethod.TOKEN` — the equality is structural, so a classification flows
- * straight into an auth method and the pair can never drift. `OPAQUE` is any
- * other value — shape says nothing about it, so only a lookup can. Today the
- * server refuses every opaque bearer; the OAuth access-token population
- * resolves there when the authorization server ships.
+ * `API_KEY`, `DEPLOY_TOKEN` and `OAUTH` *are* `AuthMethod.API_KEY`,
+ * `AuthMethod.TOKEN` and `AuthMethod.OAUTH` — the equality is structural, so
+ * a classification flows straight into an auth method and the trio can never
+ * drift.
+ *
+ * `OPAQUE` is any other value, and since 2026-08-14 it names NO population:
+ * every credential this platform mints for the Bearer slot carries a prefix,
+ * so an opaque bearer is a bearer we did not mint. It stays a member rather
+ * than becoming a `null` return because a dispatcher with a total codomain
+ * reads better than one with an absence in it — and because it is where a
+ * future population would land before anyone gave it a shape, which is
+ * exactly what the OAuth token itself did until its prefix existed.
  */
 declare const TokenKind: {
     readonly API_KEY: "apiKey";
     readonly DEPLOY_TOKEN: "token";
+    readonly OAUTH: "oauth";
     readonly OPAQUE: "opaque";
 };
 type TokenKindType = (typeof TokenKind)[keyof typeof TokenKind];
@@ -1158,6 +1198,43 @@ type TokenKindType = (typeof TokenKind)[keyof typeof TokenKind];
  * is what guarantees client and server can never disagree on dispatch.
  */
 declare function classifyToken(token: string): TokenKindType;
+/**
+ * Read the credential out of an `Authorization` header value — the step
+ * BEFORE `classifyToken`, and the other half of the one wire slot this
+ * section owns.
+ *
+ * Returns the credential's own bytes, or `null` when the header carries a
+ * foreign scheme or nothing after the scheme.
+ *
+ * **The scheme is folded; the credential is not.** RFC 7235 §2.1 makes the
+ * auth-scheme case-insensitive, so `bearer`, `Bearer` and `BEARER` are the
+ * same header. The value after it is opaque and is compared literally
+ * everywhere it is used — `ship-`/`deploy-`/`oauth-` are lowercase hex, and
+ * folding them would make a credential match values it is not.
+ *
+ * **This platform has paid for the rule twice, which is why it has an owner
+ * rather than a convention.** A spec-conformant `bearer ship-…` client was
+ * refused for as long as the API's scheme test was spelled case-sensitively;
+ * and `@better-auth/oauth-provider` carries the same defect in four places
+ * today (`startsWith("Bearer ")`), which is precisely why the platform folds
+ * the scheme itself and hands the provider a bare token.
+ *
+ * **ABSENCE is deliberately not this function's business.** A missing header
+ * and an unreadable one are different facts, and the callers that care split
+ * on them: the API worker's middleware distinguishes `absent` (the only
+ * anonymous path) from `unreadable` (a presented credential that is refused),
+ * and collapsing the two here would take that distinction away from the layer
+ * that needs it. Callers check for the header themselves and pass its value.
+ *
+ * **Why this lives in the constitution rather than in a worker's `shared/`.**
+ * It is the same wire boundary `classifyToken` already owns — one reads the
+ * slot, the other dispatches on what came out — and a rule with two holders
+ * whose drift is silent earns exactly one owner regardless of what the
+ * convoy costs. The estate's recorded refusal to own a `Bearer` CONSTANT
+ * stands and is a different thing: that is RFC vocabulary, the same reason
+ * this package owns no `"POST"`. A parser is not a spelling.
+ */
+declare function readBearerValue(header: string): string | null;
 /**
  * OAuth scope vocabulary for delegated third-party access tokens.
  * Single source of truth used by the authorization server (advertised in
@@ -1243,11 +1320,22 @@ declare function validateApiKey(apiKey: string): void;
  * Validate deploy token format
  */
 declare function validateDeployToken(deployToken: string): void;
+/**
+ * Validate OAuth access token format
+ */
+declare function validateOAuthToken(oauthToken: string): void;
 /**
  * Validate a client token of any population. Classifies by shape and applies
- * the matching format rules: `ship-` keys and `deploy-` deploy tokens are
- * validated strictly; opaque tokens (OAuth access tokens, future populations)
- * only need to be non-empty — their validity is the server's to decide.
+ * the matching format rules: all three prefixed populations are validated
+ * strictly; an OPAQUE token only needs to be non-empty.
+ *
+ * **The OPAQUE arm stays permissive on purpose**, even though the platform no
+ * longer mints an unprefixed credential. It is the fallback for a population
+ * that does not exist yet, and a client refusing a shape the server would
+ * accept is the one failure mode this boundary must never have — the server
+ * decides, and it refuses an unrecognised bearer anyway. Unprefixed OAuth
+ * tokens from before 2026-08-14 land here and are refused server-side, which
+ * is correct: they were revoked by the change, not grandfathered.
  */
 declare function validateToken(token: string): void;
 /**
@@ -2788,4 +2876,4 @@ declare class Ship extends Ship$1 {
     protected processInput(input: DeployInput, options: DeploymentOptions): Promise<StaticFile[]>;
 }
 
-export { API_KEY, API_PATHS, AUTH_BASE_PATH, type Account, type AccountDeleteResponse, type AccountGetResponse, type AccountKeyResponse, type AccountOverrides, AccountPlan, type AccountPlanType, type AccountResource, type AccountUsage, type Activity, type ActivityEvent, type ActivityListResponse, type ActivityMeta, type ApiDeployOptions, ApiHttp, type ApiHttpOptions, AuthMethod, type AuthMethodType, type BillingCancelResponse, type BillingStatus, CALLER, type CheckoutSession, DEFAULT_API, DEPLOYMENT_CONFIG_FILENAME, DEPLOY_FIELDS, DEPLOY_TOKEN, type DeployBodyContext, type DeployFile, type DeployInput, type DeployTransport, type Deployment, type DeploymentCreateResponse, type DeploymentDeleteResponse, type DeploymentListResponse, type DeploymentOptions, type DeploymentResource, type DeploymentResourceContext, type DeploymentSetOptions, DeploymentStatus, type DeploymentStatusType, type DeploymentUploadOptions, DeploymentVia, type DeploymentViaType, type DnsLookup, type DnsProvider, type DnsRecord, type DnsRecordType, type Domain, type DomainDeleteResponse, type DomainDnsResponse, type DomainListResponse, type DomainRecordsResponse, type DomainResource, type DomainSetOptions, type DomainSetResult, type DomainShareResponse, DomainStatus, type DomainStatusType, type DomainValidateResponse, type DomainVerifyResponse, type ErrorResponse, ErrorType, type ExecutionEnvironment, FileValidationStatus as FILE_VALIDATION_STATUS, type Fetch, type FileValidationResult, FileValidationStatus, type FileValidationStatusType, IDEMPOTENCY_KEY_CONSTRAINTS, JUNK_DIRECTORIES, LABEL_CONSTRAINTS, LABEL_PATTERN, type LabelsResponse, type ListOptions, type ListResponse, type MD5Result, MY_API_KEY_URL, OAuthScope, type OAuthScopeType, PASSWORD_CONSTRAINTS, PUBLIC_DEPLOYMENT_TTL_SECONDS, type PingResponse, type PlatformLimits, type RequestResult, type ResourceContext, SHIP_ENV, type SPACheckDebug, type SPACheckRequest, type SPACheckResponse, SPA_CHECK_CONSTRAINTS, SPA_DEFAULT_CONFIG, type SetupInstructionsResponse, Ship, type ShipClientOptions, ShipError, type ShipEvents, type ShipRequestInit, type StaticFile, TTL_CONSTRAINTS, type Token, type TokenCreateOptions, type TokenCreateResponse, type TokenDeleteResponse, TokenKind, type TokenKindType, type TokenListResponse, type TokenProvider, type TokenResource, type Transport, UNBUILT_PROJECT_MARKERS, UNSAFE_FILENAME_CHARS, type UploadedFile, type UserVisibleActivityEvent, type ValidatableFile, type ValidationIssue, WEB_FILE_ACCEPT, __setTestEnvironment, allValidFilesReady, assertShipJsonSyntax, calculateMD5, classifyToken, createAccountResource, createDeploymentResource, createDomainResource, createTokenResource, Ship as default, deserializeLabels, extractSubdomain, filterJunk, formatFileSize, generateDeploymentUrl, generateDomainUrl, getENV, getValidFiles, hasUnbuiltMarker, hasUnsafeChars, isBlockedExtension, isCustomDomain, isDeployment, isPlatformDomain, isShipError, normalizeVia, optimizeDeployPaths, pluralize, processFilesForNode, serializeLabels, validateApiKey, validateApiUrl, validateCaller, validateDeployFile, validateDeployPath, validateDeployToken, validateFileName, validateFiles, validateIdempotencyKey, validatePassword, validateToken, validateTtl };
+export { API_KEY, API_PATHS, AUTH_BASE_PATH, type Account, type AccountDeleteResponse, type AccountGetResponse, type AccountKeyResponse, type AccountOverrides, AccountPlan, type AccountPlanType, type AccountResource, type AccountUsage, type Activity, type ActivityEvent, type ActivityListResponse, type ActivityMeta, type ApiDeployOptions, ApiHttp, type ApiHttpOptions, AuthMethod, type AuthMethodType, type BillingCancelResponse, type BillingStatus, CALLER, type CheckoutSession, DEFAULT_API, DEPLOYMENT_CONFIG_FILENAME, DEPLOY_FIELDS, DEPLOY_TOKEN, type DeployBodyContext, type DeployFile, type DeployInput, type DeployTransport, type Deployment, type DeploymentCreateResponse, type DeploymentDeleteResponse, type DeploymentListResponse, type DeploymentOptions, type DeploymentResource, type DeploymentResourceContext, type DeploymentSetOptions, DeploymentStatus, type DeploymentStatusType, type DeploymentUploadOptions, DeploymentVia, type DeploymentViaType, type DnsLookup, type DnsProvider, type DnsRecord, type DnsRecordType, type Domain, type DomainDeleteResponse, type DomainDnsResponse, type DomainListResponse, type DomainRecordsResponse, type DomainResource, type DomainSetOptions, type DomainSetResult, type DomainShareResponse, DomainStatus, type DomainStatusType, type DomainValidateResponse, type DomainVerifyResponse, type ErrorResponse, ErrorType, type ExecutionEnvironment, FileValidationStatus as FILE_VALIDATION_STATUS, type Fetch, type FileValidationResult, FileValidationStatus, type FileValidationStatusType, IDEMPOTENCY_KEY_CONSTRAINTS, JUNK_DIRECTORIES, LABEL_CONSTRAINTS, LABEL_PATTERN, type LabelsResponse, type ListOptions, type ListResponse, type MD5Result, MY_API_KEY_URL, OAUTH_TOKEN, OAuthScope, type OAuthScopeType, PASSWORD_CONSTRAINTS, PUBLIC_DEPLOYMENT_TTL_SECONDS, type PingResponse, type PlatformLimits, type RequestResult, type ResourceContext, SHIP_ENV, type SPACheckDebug, type SPACheckRequest, type SPACheckResponse, SPA_CHECK_CONSTRAINTS, SPA_DEFAULT_CONFIG, type SetupInstructionsResponse, Ship, type ShipClientOptions, ShipError, type ShipEvents, type ShipRequestInit, type StaticFile, TTL_CONSTRAINTS, type Token, type TokenCreateOptions, type TokenCreateResponse, type TokenDeleteResponse, TokenKind, type TokenKindType, type TokenListResponse, type TokenProvider, type TokenResource, type Transport, UNBUILT_PROJECT_MARKERS, UNSAFE_FILENAME_CHARS, type UploadedFile, type UserVisibleActivityEvent, type ValidatableFile, type ValidationIssue, WEB_FILE_ACCEPT, __setTestEnvironment, allValidFilesReady, assertShipJsonSyntax, calculateMD5, classifyToken, createAccountResource, createDeploymentResource, createDomainResource, createTokenResource, Ship as default, deserializeLabels, extractSubdomain, filterJunk, formatFileSize, generateDeploymentUrl, generateDomainUrl, getENV, getValidFiles, hasUnbuiltMarker, hasUnsafeChars, isBlockedExtension, isCustomDomain, isDeployment, isPlatformDomain, isShipError, normalizeVia, optimizeDeployPaths, pluralize, processFilesForNode, readBearerValue, serializeLabels, validateApiKey, validateApiUrl, validateCaller, validateDeployFile, validateDeployPath, validateDeployToken, validateFileName, validateFiles, validateIdempotencyKey, validateOAuthToken, validatePassword, validateToken, validateTtl };

package/dist/index.js

@@ -1,2 +1,2 @@
-var Ke=Object.defineProperty;var T=(e,t)=>()=>(e&&(t=e(e=0)),t);var Ve=(e,t)=>{for(var n in t)Ke(e,n,{get:t[n],enumerable:!0})};function _t(e){if(!e||typeof e!="string")return;let t=e.trim().toLowerCase();return Object.values(qe).includes(t)?t:void 0}function ue(e){if(e==null)return;if(typeof e!="string")throw a.validation("Idempotency key must be a string.");let t=e.trim();if(!t)throw a.validation("Idempotency key must not be empty.");if(t.length>L.MAX_LENGTH)throw a.validation(`Idempotency key must be at most ${L.MAX_LENGTH} characters.`);return t}function We(e){let t=e.code;return t==="ERR_INVALID_URL"?!1:typeof t=="string"?!0:e instanceof TypeError?!/\burl\b/i.test(e.message):!1}function C(e){return e!==null&&typeof e=="object"&&"name"in e&&e.name==="ShipError"&&"status"in e}function Je(e){let t=e.replace(/\\/g,"/").split("/").pop()??"",n=t.lastIndexOf(".");return n<=0||n===t.length-1?null:t.slice(n+1).toLowerCase()}function de(e,t){let n=Je(e);return n===null?!1:Array.isArray(t)?t.includes(n):t.has(n)}function me(e){return Ze.test(e)}function F(e){return e.replace(/\\/g,"/").split("/").filter(Boolean).some(n=>Y.has(n))}function et(e){return e.startsWith(fe.PREFIX)?I.API_KEY:e.startsWith(he.PREFIX)?I.DEPLOY_TOKEN:I.OPAQUE}function Ee(e){let t=e.charCodeAt(0)===65279?e.slice(1):e,n;try{n=JSON.parse(t)}catch(r){throw a.config(`invalid JSON format in config: ${r.message}`,{filePath:A})}if(n===null||typeof n!="object"||Array.isArray(n))throw a.config(`${A} must contain a JSON object`,{filePath:A})}function ge(e,t,n){if(!e.startsWith(t.PREFIX))throw a.validation(`${n} must start with "${t.PREFIX}"`);if(e.length!==t.TOTAL_LENGTH)throw a.validation(`${n} must be ${t.TOTAL_LENGTH} characters total (${t.PREFIX} + ${t.HEX_LENGTH} hex chars)`);let r=e.slice(t.PREFIX.length);if(!new RegExp(`^[a-f0-9]{${t.HEX_LENGTH}}$`,"i").test(r))throw a.validation(`${n} must contain ${t.HEX_LENGTH} hexadecimal characters after "${t.PREFIX}" prefix`)}function tt(e){ge(e,fe,"API key")}function nt(e){ge(e,he,"Deploy token")}function j(e){switch(et(e)){case I.API_KEY:tt(e);return;case I.DEPLOY_TOKEN:nt(e);return;case I.OPAQUE:if(!e)throw a.validation("Token must be a non-empty string")}}function Te(e){if(!e||e.length>b.MAX_LENGTH||!b.PATTERN.test(e))throw a.validation(`Caller must be 1-${b.MAX_LENGTH} characters: letters, digits, dots, underscores, or hyphens`)}function Ut(e){try{let t=new URL(e);if(!["http:","https:"].includes(t.protocol))throw a.validation("API URL must use http:// or https:// protocol");if(t.pathname!=="/"&&t.pathname!=="")throw a.validation("API URL must not contain a path");if(t.search||t.hash)throw a.validation("API URL must not contain query parameters or fragments")}catch(t){throw C(t)?t:a.validation("API URL must be a valid URL")}}function Ht(e){return/^[a-z]+-[a-z]+-[a-z0-9]{7}(\.[a-z0-9.-]+)?$/i.test(e)}function X(e){if(e!=null){if(typeof e!="number"||!Number.isFinite(e))throw a.validation("TTL must be a number of seconds");if(!Number.isInteger(e))throw a.validation("TTL must be a whole number of seconds");if(e<v.MIN_SECONDS||e>v.MAX_SECONDS)throw a.validation(`TTL must be between ${v.MIN_SECONDS} and ${v.MAX_SECONDS} seconds`);return e}}function Se(e,t){return e.endsWith(`.${t}`)}function Bt(e,t){return!Se(e,t)}function zt(e,t){return Se(e,t)?e.slice(0,-(t.length+1)):null}function Kt(e){return`https://${e}`}function Vt(e){return`https://${e}`}function qt(e){return!e||e.length===0?null:JSON.stringify(e)}function Yt(e){if(!e)return[];try{let t=JSON.parse(e);return Array.isArray(t)?t:[]}catch{return[]}}function J(e){if(e==null)return;if(typeof e!="string")throw a.validation("Password must be a string");let t=e.trim();if(t.length<_.MIN_LENGTH||t.length>_.MAX_LENGTH)throw a.validation(`Password must be between ${_.MIN_LENGTH} and ${_.MAX_LENGTH} characters`);return t}var Ot,qe,vt,L,Ct,m,S,d,Ye,q,je,Xe,a,Qe,Ft,Ze,Y,Mt,ce,fe,he,b,I,kt,A,ye,M,v,W,x,$t,Gt,h,R,Ae,_,f=T(()=>{"use strict";Ot={PENDING:"pending",SUCCESS:"success",FAILED:"failed",DELETING:"deleting"},qe={WEB:"web",SDK:"sdk",CLI:"cli",MCP:"mcp",GIT:"git",N8N:"n8n",GPT:"gpt",VSC:"vsc"},vt={PENDING:"pending",PARTIAL:"partial",SUCCESS:"success",PAUSED:"paused"},L={HEADER:"Idempotency-Key",MAX_LENGTH:256,WINDOW_SECONDS:1440*60};Ct={FREE:"free",STANDARD:"standard",SPONSORED:"sponsored",ENTERPRISE:"enterprise",SUSPENDED:"suspended",TERMINATING:"terminating",TERMINATED:"terminated"},m={DEPLOYMENTS:"/deployments",DEPLOYMENT:e=>`/deployments/${e}`,DEPLOYMENT_CONFIG:e=>`/deployments/${e}/config`,DOMAINS:"/domains",DOMAIN:e=>`/domains/${e}`,DOMAIN_VERIFY:e=>`/domains/${e}/verify`,DOMAIN_DNS:e=>`/domains/${e}/dns`,DOMAIN_RECORDS:e=>`/domains/${e}/records`,DOMAIN_SHARE:e=>`/domains/${e}/share`,DOMAIN_PROPAGATION:e=>`/domains/${e}/propagation`,DOMAINS_VALIDATE:"/domains/validate",TOKENS:"/tokens",TOKEN:e=>`/tokens/${e}`,ACCOUNT:"/account",ACCOUNT_KEY:"/account/key",ACCOUNT_CLAIM:"/account/claim",ACTIVITIES:"/activities",LABELS:"/labels",LIMITS:"/limits",PING:"/ping",SETUP:"/setup",SPA_CHECK:"/spa-check",UPLOAD:"/upload"},S={FILES:"files[]",CHECKSUMS:"checksums",LABELS:"labels",VIA:"via",PASSWORD:"password",TTL:"ttl",BUILD:"build",PRERENDER:"prerender",SPA:"spa",CAPTCHA:"captcha"},d={Validation:"validation_failed",NotFound:"not_found",Forbidden:"forbidden",RateLimit:"rate_limit_exceeded",Authentication:"authentication_failed",Business:"business_logic_error",Api:"internal_server_error",Maintenance:"maintenance",Network:"network_error",Timeout:"timeout_error",Cancelled:"operation_cancelled",File:"file_error",Config:"config_error"},Ye=new Set([d.Network,d.Timeout,d.Cancelled,d.File,d.Config]),q={client:new Set([d.Business,d.Cancelled,d.Config,d.File,d.Forbidden,d.NotFound,d.RateLimit,d.Validation]),network:new Set([d.Network,d.Timeout]),auth:new Set([d.Authentication])},je=new Set(Object.values(d).filter(e=>!Ye.has(e))),Xe=200;a=class e extends Error{type;status;details;constructor(t,n,r,i){super(n),this.type=t,this.status=r,this.details=i,this.name="ShipError"}toResponse(){let t=this.details,n=this.type===d.Authentication&&t?.internal?void 0:this.details;return{error:this.type,message:this.message,status:this.status,details:n}}static async fromHttpResponse(t,n){let r,i,o;try{if(t.headers.get("content-type")?.includes("application/json")){let u=await t.json();if(u&&typeof u=="object"){let p=u;typeof p.message=="string"?r=p.message:typeof p.error=="string"&&(r=p.error),i=p.details,typeof p.error=="string"&&je.has(p.error)&&(o=p.error)}}else{let u=(await t.text()).trim();u&&!u.startsWith("<")&&u.length<=Xe&&(r=u)}}catch{}let l=t.headers.get("retry-after");if(l!==null){let s=l.trim(),u=/^\d+$/.test(s)?Number(s):Math.ceil((Date.parse(s)-Date.now())/1e3);if(Number.isFinite(u)&&u>=0){let p=i&&typeof i=="object"?i:{};p.retryAfter===void 0&&(i={...p,retryAfter:u})}}r=r||`${n||"Request"} failed with status ${t.status}`;let c=o??(t.status===401?d.Authentication:t.status===403?d.Forbidden:t.status===429?d.RateLimit:d.Api);return new e(c,r,t.status,i)}static fromFetchError(t,n){if(C(t))return t;let r=n||"Request",i=t?.name;return i==="AbortError"?e.cancelled(`${r} was cancelled`):i==="TimeoutError"?e.timeout(`${r} timed out`,{cause:t}):t instanceof Error?We(t)?e.network(`${r} failed: ${t.message}`,{cause:t}):new e(d.Api,`${r} failed: ${t.message}`):new e(d.Api,`${r} failed: Unknown error`)}static validation(t,n){return new e(d.Validation,t,400,n)}static notFound(t,n){let r=n?`${t} ${n} not found`:`${t} not found`;return new e(d.NotFound,r,404)}static forbidden(t,n){return new e(d.Forbidden,t,403,n)}static rateLimit(t="Too many requests",n){return new e(d.RateLimit,t,429,n)}static authentication(t="Authentication required",n){return new e(d.Authentication,t,401,n)}static business(t,n=400,r){return new e(d.Business,t,n,r)}static network(t,n){return new e(d.Network,t,void 0,n)}static timeout(t,n){return new e(d.Timeout,t,void 0,n)}static cancelled(t,n){return new e(d.Cancelled,t,void 0,n)}static file(t,n){return new e(d.File,t,void 0,n)}static config(t,n){return new e(d.Config,t,void 0,n)}static api(t,n=500,r){return new e(d.Api,t,n,r)}static maintenance(t,n){return new e(d.Maintenance,t,503,n)}isClientError(){return q.client.has(this.type)?!0:this.status!==void 0&&this.status>=400&&this.status<500}isNetworkError(){return q.network.has(this.type)}isAuthError(){return q.auth.has(this.type)}isType(t){return this.type===t}};Qe=["html","htm","xhtml","xml","txt","md","markdown","pdf","csv","json","jsonc","webmanifest","map","toml","yaml","yml","rss","atom","css","scss","sass","less","js","mjs","cjs","jsx","ts","tsx","wasm","vue","svelte","png","jpg","jpeg","gif","webp","avif","svg","ico","bmp","tif","tiff","heic","heif","woff","woff2","ttf","otf","eot","mp3","wav","ogg","oga","opus","m4a","aac","flac","weba","mp4","webm","ogv","mov","m4v","avi","glb","gltf","usdz","vtt","srt","zip"],Ft=Qe.map(e=>`.${e}`).join(","),Ze=/[\x00-\x1f\x7f#?%\\<>"]/;Y=new Set(["node_modules","package.json"]);Mt="/auth",ce={SESSION:"session",API_KEY:"apiKey",TOKEN:"token",AGENT:"agent",OAUTH:"oauth",WEBHOOK:"webhook",SYSTEM:"system"},fe={PREFIX:"ship-",HEX_LENGTH:32,TOTAL_LENGTH:37,HINT_LENGTH:4},he={PREFIX:"deploy-",HEX_LENGTH:32,TOTAL_LENGTH:39},b={HEADER:"X-Caller",MAX_LENGTH:128,PATTERN:/^[a-zA-Z0-9._-]+$/},I={API_KEY:ce.API_KEY,DEPLOY_TOKEN:ce.TOKEN,OPAQUE:"opaque"};kt={ACCOUNT_READ:"account:read",DEPLOYMENTS_READ:"deployments:read",DEPLOYMENTS_WRITE:"deployments:write",DOMAINS_READ:"domains:read",DOMAINS_WRITE:"domains:write"},A="ship.json",ye={rewrites:[{source:"/(.*)",destination:"/index.html"}]},M={INDEX_FILE:"index.html",MAX_INDEX_BYTES:100*1024};v={MIN_SECONDS:1,MAX_SECONDS:365*24*60*60};W="https://api.shipstatic.com",x={TOKEN:"SHIP_TOKEN",API_URL:"SHIP_API_URL"},$t="https://my.shipstatic.com/api-key",Gt=4320*60,h={PENDING:"pending",PROCESSING_ERROR:"processing_error",EXCLUDED:"excluded",VALIDATION_FAILED:"validation_failed",READY:"ready"};R={MIN_LENGTH:3,MAX_LENGTH:25,MAX_COUNT:10,SEPARATORS:"._-"},Ae=/^[a-z0-9]+(?:[._-][a-z0-9]+)*$/;_={MIN_LENGTH:6,MAX_LENGTH:128}});async function ut(e){let t=(await import("spark-md5")).default,n=new t.ArrayBuffer,r=2097152;for(let i=0;i<e.size;i+=r){let o=Math.min(i+r,e.size);n.append(await e.slice(i,o).arrayBuffer())}return{md5:n.end()}}async function dt(e){let{createHash:t}=await import("crypto"),n=t("md5");return n.update(e),{md5:n.digest("hex")}}async function mt(e){let{createHash:t}=await import("crypto"),{createReadStream:n}=await import("fs");return new Promise((r,i)=>{let o=t("md5"),l=n(e);l.on("error",c=>i(a.file(`Failed to read file for MD5: ${c.message}`,{filePath:e}))),l.on("data",c=>o.update(c)),l.on("end",()=>r({md5:o.digest("hex")}))})}async function H(e){if(e instanceof Blob)return ut(e);if(typeof Buffer<"u"&&Buffer.isBuffer(e))return dt(e);if(typeof e=="string")return mt(e);throw a.business("Invalid input for MD5 calculation")}var $=T(()=>{"use strict";f()});function Tn(e){Z=e}function Et(){return typeof process<"u"&&process.versions&&process.versions.node?"node":typeof window<"u"||typeof self<"u"?"browser":"unknown"}function N(){return Z||Et()}var Z,O=T(()=>{"use strict";Z=null});function Ce(e){if(!e||e.length===0)return"";let t=e.filter(o=>o&&typeof o=="string").map(o=>o.replace(/\\/g,"/"));if(t.length===0)return"";if(t.length===1)return t[0];let n=t.map(o=>o.split("/").filter(Boolean)),r=[],i=Math.min(...n.map(o=>o.length));for(let o=0;o<i;o++){let l=n[0][o];if(n.every(c=>c[o]===l))r.push(l);else break}return r.join("/")}function z(e){return e.replace(/\\/g,"/").replace(/\/+/g,"/").replace(/^\/+/,"")}var ee=T(()=>{"use strict"});function Fe(e,t={}){if(t.flatten===!1)return e.map(r=>({path:z(r),name:te(r)}));let n=St(e);return e.map(r=>{let i=z(r);if(n){let o=n.endsWith("/")?n:`${n}/`;i.startsWith(o)&&(i=i.substring(o.length))}return i||(i=te(r)),{path:i,name:te(r)}})}function St(e){if(!e.length)return"";let n=e.map(o=>z(o)).map(o=>o.split("/")),r=[],i=Math.min(...n.map(o=>o.length));for(let o=0;o<i-1;o++){let l=n[0][o];if(n.every(c=>c[o]===l))r.push(l);else break}return r.join("/")}function te(e){return e.split(/[/\\]/).pop()||e}var ne=T(()=>{"use strict";ee()});function V(e,t){return At.find(n=>n.broken(e,t))}var At,ie=T(()=>{"use strict";f();oe();At=[{name:"name",broken:({path:e})=>!re(e).valid,sentence:({path:e})=>re(e).reason??"Invalid file name"},{name:"extension",broken:({path:e},t)=>de(e,t.blockedExtensions??[]),sentence:({path:e})=>`File extension not allowed: "${e}"`},{name:"fileSize",broken:({size:e},t)=>e>t.maxFileSize,sentence:({path:e},t)=>`File "${e}" too large. Maximum ${K(t.maxFileSize)} allowed`},{name:"totalSize",broken:({totalSize:e},t)=>e>t.maxTotalSize,sentence:({totalSize:e},t)=>`Total upload size too large. ${K(e)} exceeds maximum of ${K(t.maxTotalSize)}`}]});function K(e,t=1){if(e===0)return"0 Bytes";let n=1024,r=["Bytes","KB","MB","GB"],i=Math.floor(Math.log(e)/Math.log(n));return`${parseFloat((e/n**i).toFixed(t))} ${r[i]}`}function re(e){if(me(e))return{valid:!1,reason:"File name contains unsafe characters"};if(e.startsWith(" ")||e.endsWith(" "))return{valid:!1,reason:"File name cannot start/end with spaces"};if(e.endsWith("."))return{valid:!1,reason:"File name cannot end with dots"};let t=/^(CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(\.|$)/i,n=e.split("/").pop()||e;return t.test(n)?{valid:!1,reason:"File name uses a reserved system name"}:e.includes("..")?{valid:!1,reason:"File name contains path traversal pattern"}:{valid:!0}}function Un(e,t){let n=[],r=[],i=[];if(e.length===0){let s={file:"(no files)",message:"At least one file must be provided"};return n.push(s),{files:[],validFiles:[],errors:n,warnings:[],canDeploy:!1}}for(let s of e)if(F(s.name))return n.push({file:s.name,message:"Unbuilt project detected \u2014 deploy your build output (dist/, build/, out/), not the project folder"}),{files:e.map(u=>({...u,status:h.VALIDATION_FAILED,statusMessage:"Unbuilt project detected"})),validFiles:[],errors:n,warnings:[],canDeploy:!1};if(e.length>t.maxFilesCount){let s={file:`(${e.length} files)`,message:`File count (${e.length}) exceeds limit of ${t.maxFilesCount}`};return n.push(s),{files:e.map(u=>({...u,status:h.VALIDATION_FAILED,statusMessage:s.message})),validFiles:[],errors:n,warnings:[],canDeploy:!1}}let o=0;for(let s of e){let u=h.READY,p="Ready for upload";if(s.status===h.PROCESSING_ERROR)u=h.VALIDATION_FAILED,p=s.statusMessage||"File failed during processing",n.push({file:s.name,message:p});else if(s.size===0){u=h.EXCLUDED,p="File is empty (0 bytes) and cannot be deployed due to storage limitations",r.push({file:s.name,message:p}),i.push({...s,status:u,statusMessage:p});continue}else if(s.size<0)u=h.VALIDATION_FAILED,p="File size must be positive",n.push({file:s.name,message:p});else if(!s.name||s.name.trim().length===0)u=h.VALIDATION_FAILED,p="File name cannot be empty",n.push({file:s.name||"(empty)",message:p});else if(s.name.includes("\0"))u=h.VALIDATION_FAILED,p="File name contains invalid characters (null byte)",n.push({file:s.name,message:p});else{let y={path:s.name,size:s.size,totalSize:o+s.size},D=V(y,t);D?(u=h.VALIDATION_FAILED,p=D.sentence(y,t),n.push({file:D.name==="totalSize"?`(${e.length} files)`:s.name,message:p})):o=y.totalSize}i.push({...s,status:u,statusMessage:p})}n.length>0&&(i=i.map(s=>s.status===h.EXCLUDED?s:{...s,status:h.VALIDATION_FAILED,statusMessage:s.status===h.VALIDATION_FAILED?s.statusMessage:"Deployment failed due to validation errors in bundle"}));let l=n.length===0?i.filter(s=>s.status===h.READY):[],c=n.length===0;return{files:i,validFiles:l,errors:n,warnings:r,canDeploy:c}}function Dt(e){return e.filter(t=>t.status===h.READY)}function Hn(e){return Dt(e).length>0}var oe=T(()=>{"use strict";f();ie()});import{isJunk as Rt}from"junk";function Me(e,t){if(!e||e.length===0)return[];if(!t?.allowUnbuilt&&e.find(r=>r&&F(r)))throw a.business("Unbuilt project detected \u2014 deploy your build output (dist/, build/, out/), not the project folder");return e.filter(n=>{if(!n)return!1;let r=n.replace(/\\/g,"/").split("/").filter(Boolean);if(r.length===0)return!0;let i=r[r.length-1];if(Rt(i))return!1;for(let l of r)if(l!==".well-known"&&(l.startsWith(".")||l.length>255))return!1;let o=r.slice(0,-1);for(let l of o)if(It.some(c=>l.toLowerCase()===c.toLowerCase()))return!1;return!0})}var It,se=T(()=>{"use strict";f();It=["__MACOSX",".Trashes",".fseventsd",".Spotlight-V100"]});function ke(e,t){if(e.includes("\0")||e.includes("/../")||e.startsWith("../")||e.endsWith("/.."))throw a.business(`Security error: Unsafe file path "${e}" for file: ${t}`)}function Ue(e,t){let n=V(e,t);if(n)throw a.business(n.sentence(e,t))}var ae=T(()=>{"use strict";f();ie()});async function He(e,t={},n){let r=!!(t.build||t.prerender),i=Fe(e.map(p=>p.path),{flatten:t.pathDetect!==!1}).map(p=>p.path),o=new Set(Me(i,{allowUnbuilt:r})),l=e.map((p,y)=>({source:p,deployPath:i[y]})).filter(({deployPath:p})=>o.has(p));if(l.length===0)return[];let c=r?null:Lt(n),s=[],u=0;for(let{source:p,deployPath:y}of l){if(c&&ke(y,p.origin),p.size===0)continue;c&&(u+=p.size,Ue({path:y,size:p.size,totalSize:u},c));let D=await p.read(),{md5:P}=await H(D);s.push({path:y,content:D,size:p.size,md5:P})}if(c&&s.length>c.maxFilesCount)throw a.business(`Too many files to deploy. Maximum allowed is ${c.maxFilesCount} files.`);return s}function Lt(e){if(!e)throw a.config("Platform limits not provided. Deploy-mode validation requires the limits argument \u2014 pass `ship.getLimits()` result.");return e}var $e=T(()=>{"use strict";f();ne();se();$();ae()});var ze={};Ve(ze,{processFilesForNode:()=>Be});import*as g from"fs";import*as E from"path";function Ge(e,t=new Set){let n=[],r=g.realpathSync(e);if(t.has(r))return n;t.add(r);for(let i of g.readdirSync(e)){let o=E.join(e,i),l=g.statSync(o);l.isDirectory()?n.push(...Ge(o,t)):l.isFile()&&n.push({absPath:o,size:l.size})}return n}async function Nt(e){try{return g.readFileSync(e)}catch(t){let n=t instanceof Error?t.message:String(t);throw a.file(`Failed to read file "${e}": ${n}`,{filePath:e})}}function Pt(e){for(let t of e){let n=E.resolve(t);try{if(g.statSync(n).isDirectory()){let r=g.readdirSync(n).find(i=>Y.has(i));if(r)throw a.business(`"${r}" detected \u2014 deploy your build output (dist/, build/, out/), not the project folder`)}}catch(r){if(C(r))throw r}}}async function Be(e,t={},n){if(N()!=="node")throw a.business("processFilesForNode can only be called in Node.js environment.");Pt(e);let r=e.flatMap(c=>{let s=E.resolve(c);try{let u=g.statSync(s);return u.isDirectory()?Ge(s):[{absPath:s,size:u.size}]}catch{throw a.file(`Path does not exist: ${c}`,{filePath:c})}}),i=new Map(r.map(c=>[c.absPath,c.size])),o=Ce(e.map(c=>E.resolve(c)).map(c=>{try{return g.statSync(c).isDirectory()?c:E.dirname(c)}catch{return E.dirname(c)}})),l=[...i].map(([c,s])=>({path:bt(c,o),origin:c,size:s,read:()=>Nt(c)}));return He(l,t,n)}function bt(e,t){if(t&&t.length>0){let n=E.relative(t,e);if(n&&typeof n=="string"&&!n.startsWith(".."))return n.replace(/\\/g,"/")}return E.basename(e)}var le=T(()=>{"use strict";f();$e();O();ee()});f();f();f();var k=class{constructor(){this.handlers=new Map}on(t,n){this.handlers.has(t)||this.handlers.set(t,new Set),this.handlers.get(t)?.add(n)}off(t,n){let r=this.handlers.get(t);r&&(r.delete(n),r.size===0&&this.handlers.delete(t))}emit(t,...n){let r=this.handlers.get(t);if(!r)return;let i=Array.from(r);for(let o of i)try{o(...n)}catch(l){r.delete(o),t!=="error"&&setTimeout(()=>{let c=l instanceof Error?l:new Error(String(l));this.emit("error",c,String(t))},0)}}};var rt=3e4,it=2,ot=300,st=2e3,at=new Set([500,502,503,504]);function lt(e,t){return new Promise((n,r)=>{if(t?.aborted){r(t.reason);return}let i=()=>{clearTimeout(l),t?.removeEventListener("abort",o)},o=()=>{i(),r(t?.reason)},l=setTimeout(()=>{i(),n()},e);t?.addEventListener("abort",o)})}var De=3e5,pt=3e5,ct=De+pt,U=class extends k{constructor(n){super();this.globalHeaders={};this.apiUrl=n.apiUrl||W,this.getAuthHeadersCallback=n.getAuthHeaders,this.session=n.session??!1,this.caller=n.caller,this.timeout=n.timeout??rt,this.maxRetries=Math.max(0,n.maxRetries??it),this.fetch=n.fetch??globalThis.fetch.bind(globalThis),this.deploy={endpoint:n.deployEndpoint||m.DEPLOYMENTS,timeout:n.timeout??De,buildTimeout:n.timeout??ct}}setGlobalHeaders(n){this.globalHeaders=n}async executeRequest(n,r,i,o=this.timeout){for(let l=0;;l++)try{return await this.attemptOnce(n,r,i,o)}catch(c){let s=a.fromFetchError(c,i);if(l>=this.maxRetries||!this.isRetryable(s,r))throw this.emit("error",s,n),s;this.emit("retry",s,n,l+1);let u=Math.min(st,ot*2**l);try{await lt(Math.random()*u,r.signal)}catch(p){let y=a.fromFetchError(p,i);throw this.emit("error",y,n),y}}}isRetryable(n,r){if(r.signal?.aborted||n.isType(d.Maintenance)||n.isType(d.Cancelled)||!(n.isNetworkError()||n.status!==void 0&&at.has(n.status)))return!1;let o=(r.method??"GET").toUpperCase();return o==="GET"||o==="HEAD"?!0:o==="PUT"||o==="DELETE"?!1:this.hasIdempotencyKey(r.headers)}hasIdempotencyKey(n){if(!n)return!1;let r=L.HEADER.toLowerCase();return Object.keys(n).some(i=>i.toLowerCase()===r)}async attemptOnce(n,r,i,o=this.timeout){let l=()=>{};try{let c=await this.mergeHeaders(r.headers),s=this.createTimeoutSignal(r.signal,o);l=s.cleanup;let u={...r,headers:c,credentials:this.session&&!c.Authorization?"include":void 0,signal:s.signal};this.emit("request",n,u);let p=await this.fetch(n,u);if(l(),!p.ok)throw await a.fromHttpResponse(p,i);return this.emit("response",this.safeClone(p),n),{data:await this.parseResponse(this.safeClone(p)),status:p.status}}catch(c){throw l(),a.fromFetchError(c,i)}}async request(n,r,i,o){let{data:l}=await this.executeRequest(`${this.apiUrl}${n}`,r,i,o);return l}async requestWithStatus(n,r,i){return this.executeRequest(`${this.apiUrl}${n}`,r,i)}async mergeHeaders(n={}){return{...this.globalHeaders,...this.caller?{[b.HEADER]:this.caller}:{},...await this.getAuthHeadersCallback(),...n}}createTimeoutSignal(n,r=this.timeout){let i=new AbortController,o=setTimeout(()=>i.abort(new DOMException(`Timed out after ${r}ms`,"TimeoutError")),r),l=n?()=>i.abort(n.reason):void 0;return n&&l&&(n.addEventListener("abort",l),n.aborted&&i.abort(n.reason)),{signal:i.signal,cleanup:()=>{clearTimeout(o),n&&l&&n.removeEventListener("abort",l)}}}safeClone(n){try{return n.clone()}catch{return n}}async parseResponse(n){if(!(n.headers.get("Content-Length")==="0"||n.status===204))return n.json()}};f();f();async function Re(e,t={}){let{labels:n,via:r,password:i,ttl:o,flags:l,captcha:c}=t,s=new FormData,u=[];for(let p of e){if(typeof p.content=="string"||p.content===null||p.content===void 0)throw a.file(`Unsupported file.content type: ${p.path}`,{filePath:p.path});if(!p.md5)throw a.file(`File missing md5 checksum: ${p.path}`,{filePath:p.path});s.append(S.FILES,new File([p.content],p.path,{type:"application/octet-stream"})),u.push(p.md5)}return s.append(S.CHECKSUMS,JSON.stringify(u)),n&&n.length>0&&s.append(S.LABELS,JSON.stringify(n)),r&&s.append(S.VIA,r),i&&s.append(S.PASSWORD,i),o!==void 0&&s.append(S.TTL,String(o)),l?.build&&s.append(S.BUILD,"true"),l?.prerender&&s.append(S.PRERENDER,"true"),l?.spa&&s.append(S.SPA,"true"),c&&s.append(S.CAPTCHA,c),s}f();$();async function ft(){let e=JSON.stringify(ye,null,2),t;typeof Buffer<"u"?t=Buffer.from(e,"utf-8"):t=new Blob([e],{type:"application/json"});let{md5:n}=await H(t);return{path:A,content:t,size:e.length,md5:n}}async function ht(e,t){let n=e.find(l=>l.path===M.INDEX_FILE||l.path===`/${M.INDEX_FILE}`);if(!n||n.size>M.MAX_INDEX_BYTES)return!1;let r;if(typeof Buffer<"u"&&Buffer.isBuffer(n.content))r=n.content.toString("utf-8");else if(typeof Blob<"u"&&n.content instanceof Blob)r=await n.content.text();else if(typeof File<"u"&&n.content instanceof File)r=await n.content.text();else return!1;let i={files:e.map(l=>l.path),index:r};return(await t.request(m.SPA_CHECK,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(i)},"SPA check")).isSPA}async function Ie(e,t,n){if(n.spaDetect===!1||n.spa||n.build||n.prerender||e.some(r=>r.path===A))return e;try{if(await ht(e,t)){let i=await ft();return[...e,i]}}catch{}return e}f();f();function w(e){if(e==null)return;if(e.length===0)return e;if(e.length>R.MAX_COUNT)throw a.validation(`Maximum ${R.MAX_COUNT} labels allowed`);let t=e.map((r,i)=>{if(typeof r!="string")throw a.validation(`Label at index ${i} must be a string`);let o=r.trim().toLowerCase();if(o.length<R.MIN_LENGTH)throw a.validation(`Labels must be at least ${R.MIN_LENGTH} characters long`);if(o.length>R.MAX_LENGTH)throw a.validation(`Labels must be no more than ${R.MAX_LENGTH} characters long`);if(!Ae.test(o))throw a.validation(`Labels must start and end with alphanumeric characters, with optional separators (${R.SEPARATORS}) between segments`);return o}),n=[...new Set(t)];if(n.length!==t.length)throw a.validation("Duplicate labels are not allowed");return n}async function Le(e){let t=e.find(i=>i.path===A||i.path===`/${A}`);if(!t)return;let n=t.content,r=typeof n.text=="function"?await n.text():t.content.toString("utf8");Ee(r)}var G={"Content-Type":"application/json"},yt="sdk";function Q(e){let t=new URLSearchParams;e?.limit!==void 0&&t.set("limit",String(e.limit)),e?.cursor!==void 0&&t.set("cursor",e.cursor);let n=t.toString();return n?`?${n}`:""}function Ne(e){let{getApi:t,processInput:n}=e;return{upload:async(r,i={})=>{if(!n)throw a.config("processInput function is not provided.");let o=t(),l=await n(r,i),c=await Ie(l,o,i);if(!c.length)throw a.business("No files to deploy");for(let P of c)if(!P.md5)throw a.file(`MD5 checksum missing for file: ${P.path}`,{filePath:P.path});J(i.password);let s=X(i.ttl),u=ue(i.idempotencyKey),p=w(i.labels);await Le(c);let y=i.build||i.prerender||i.spa?{build:i.build,prerender:i.prerender,spa:i.spa}:void 0,D=await Re(c,{labels:p,via:i.via??yt,password:i.password,ttl:s,flags:y,captcha:i.captcha});return o.request(o.deploy.endpoint,{method:"POST",body:D,...u?{headers:{[L.HEADER]:u}}:{},signal:i.signal||null},"Deploy",i.build||i.prerender?o.deploy.buildTimeout:o.deploy.timeout)},list:async r=>t().request(`${m.DEPLOYMENTS}${Q(r)}`,{method:"GET"},"List deployments"),get:async r=>t().request(m.DEPLOYMENT(encodeURIComponent(r)),{method:"GET"},"Get deployment"),set:async(r,i)=>t().request(m.DEPLOYMENT(encodeURIComponent(r)),{method:"PATCH",headers:G,body:JSON.stringify({labels:w(i.labels)})},"Update deployment labels"),delete:async r=>t().request(m.DEPLOYMENT(encodeURIComponent(r)),{method:"DELETE"},"Delete deployment")}}function Pe(e){let{getApi:t}=e;return{set:async(n,r={})=>{let i=w(r.labels),o={};r.deployment&&(o.deployment=r.deployment),i!==void 0&&(o.labels=i);let{data:l,status:c}=await t().requestWithStatus(m.DOMAIN(encodeURIComponent(n)),{method:"PUT",headers:G,body:JSON.stringify(o)},"Set domain");return{...l,isCreate:c===201}},list:async n=>t().request(`${m.DOMAINS}${Q(n)}`,{method:"GET"},"List domains"),get:async n=>t().request(m.DOMAIN(encodeURIComponent(n)),{method:"GET"},"Get domain"),delete:async n=>t().request(m.DOMAIN(encodeURIComponent(n)),{method:"DELETE"},"Delete domain"),verify:async n=>t().request(m.DOMAIN_VERIFY(encodeURIComponent(n)),{method:"POST"},"Verify domain"),validate:async n=>t().request(m.DOMAINS_VALIDATE,{method:"POST",headers:G,body:JSON.stringify({domain:n})},"Validate domain"),dns:async n=>t().request(m.DOMAIN_DNS(encodeURIComponent(n)),{method:"GET"},"Get domain DNS"),records:async n=>t().request(m.DOMAIN_RECORDS(encodeURIComponent(n)),{method:"GET"},"Get domain records"),share:async n=>t().request(m.DOMAIN_SHARE(encodeURIComponent(n)),{method:"GET"},"Get domain share")}}function be(e){let{getApi:t}=e;return{get:async()=>t().request(m.ACCOUNT,{method:"GET"},"Get account")}}function xe(e){let{getApi:t}=e;return{create:async(n={})=>{let r=X(n.ttl),i=w(n.labels),o={};return r!==void 0&&(o.ttl=r),i!==void 0&&(o.labels=i),t().request(m.TOKENS,{method:"POST",headers:G,body:JSON.stringify(o)},"Create token")},list:async n=>t().request(`${m.TOKENS}${Q(n)}`,{method:"GET"},"List tokens"),get:async n=>t().request(m.TOKEN(encodeURIComponent(n)),{method:"GET"},"Get token"),delete:async n=>t().request(m.TOKEN(encodeURIComponent(n)),{method:"DELETE"},"Delete token")}}var B=class{constructor(t={}){this.initPromise=null;this.platformLimits=null;this.credential=null;if(t={...t,apiUrl:t.apiUrl||void 0,token:t.token||void 0,caller:t.caller||void 0},this.clientOptions=t,t.caller!==void 0&&Te(t.caller),t.token&&t.session)throw a.config("Provide either `token` or `session`, not both.");typeof t.token=="string"?(j(t.token),this.credential=t.token):t.token&&(this.credential=t.token),this.http=new U({...t,getAuthHeaders:()=>this.getAuthHeaders()});let n={getApi:()=>this.http};this.deployments=Ne({...n,processInput:async(r,i)=>(await this.ensureInitialized(),this.processInput(r,i))}),this.domains=Pe(n),this.account=be(n),this.tokens=xe(n)}async ensureInitialized(){return this.initPromise||(this.initPromise=this.fetchPlatformLimits()),this.initPromise}async fetchPlatformLimits(){try{this.platformLimits=await this.http.request(m.LIMITS,{method:"GET"},"Get limits")}catch(t){throw this.initPromise=null,t}}async ping(){return this.http.request(m.PING,{method:"GET"},"Ping")}async deploy(t,n){return this.deployments.upload(t,n)}async whoami(){return this.account.get()}async getLimits(){return this.platformLimits?this.platformLimits:(await this.ensureInitialized(),this.platformLimits)}on(t,n){this.http.on(t,n)}off(t,n){this.http.off(t,n)}setHeaders(t){this.http.setGlobalHeaders(t)}clearHeaders(){this.http.setGlobalHeaders({})}setToken(t){if(this.clientOptions.session)throw a.config("Provide either `token` or `session`, not both.");if(typeof t=="string"){if(!t)throw a.business("Invalid token provided. Token must be a non-empty string.");j(t),this.credential=t;return}if(typeof t!="function")throw a.business("Invalid token provided. Token must be a non-empty string or a provider function.");this.credential=t}async getAuthHeaders(){if(this.credential===null)return{};let t=typeof this.credential=="function"?await this.credential():this.credential;if(!t)throw a.authentication("Token provider returned no token.");if(typeof t!="string")throw a.authentication("Token provider returned a non-string value.");return{Authorization:`Bearer ${t}`}}};O();f();import{z as ve}from"zod";import{z as we}from"zod";var Oe={apiUrl:we.string().url().optional(),token:we.string().min(1).optional()};O();var gt=ve.object(Oe).strict(),Tt={apiUrl:x.API_URL,token:x.TOKEN};function _e(){if(N()!=="node")return{};let e={apiUrl:process.env[x.API_URL]||void 0,token:process.env[x.TOKEN]||void 0};try{return gt.parse(e)}catch(t){if(t instanceof ve.ZodError){let n=t.issues[0],r=n.path[0],i=(r&&Tt[r])??"SHIP environment configuration";throw a.config(`Invalid ${i}: ${n.message}`)}throw a.config("Invalid environment configuration")}}f();f();ne();O();oe();se();$();ae();function Yn(e,t,n,r=!0){let i=e===1?t:n;return r?`${e} ${i}`:i}le();var pe=class extends B{constructor(t={}){if(N()!=="node")throw a.business("Node.js Ship class can only be used in Node.js environment.");let n=_e();super({...t,apiUrl:t.apiUrl||n.apiUrl,token:t.token||(t.session?void 0:n.token)})}async deploy(t,n){return super.deploy(t,n)}async processInput(t,n){let r=typeof t=="string"?[t]:t;if(!Array.isArray(r)||!r.every(o=>typeof o=="string"))throw a.business("Invalid input type for Node.js environment. Expected string or string[].");if(r.length===0)throw a.business("No files to deploy.");let{processFilesForNode:i}=await Promise.resolve().then(()=>(le(),ze));return i(r,n,this.platformLimits??void 0)}},xt=pe;export{fe as API_KEY,m as API_PATHS,Mt as AUTH_BASE_PATH,Ct as AccountPlan,U as ApiHttp,ce as AuthMethod,b as CALLER,W as DEFAULT_API,A as DEPLOYMENT_CONFIG_FILENAME,S as DEPLOY_FIELDS,he as DEPLOY_TOKEN,Ot as DeploymentStatus,qe as DeploymentVia,vt as DomainStatus,d as ErrorType,h as FILE_VALIDATION_STATUS,h as FileValidationStatus,L as IDEMPOTENCY_KEY_CONSTRAINTS,It as JUNK_DIRECTORIES,R as LABEL_CONSTRAINTS,Ae as LABEL_PATTERN,$t as MY_API_KEY_URL,kt as OAuthScope,_ as PASSWORD_CONSTRAINTS,Gt as PUBLIC_DEPLOYMENT_TTL_SECONDS,x as SHIP_ENV,M as SPA_CHECK_CONSTRAINTS,ye as SPA_DEFAULT_CONFIG,pe as Ship,a as ShipError,v as TTL_CONSTRAINTS,I as TokenKind,Y as UNBUILT_PROJECT_MARKERS,Ze as UNSAFE_FILENAME_CHARS,Ft as WEB_FILE_ACCEPT,Tn as __setTestEnvironment,Hn as allValidFilesReady,Ee as assertShipJsonSyntax,H as calculateMD5,et as classifyToken,be as createAccountResource,Ne as createDeploymentResource,Pe as createDomainResource,xe as createTokenResource,xt as default,Yt as deserializeLabels,zt as extractSubdomain,Me as filterJunk,K as formatFileSize,Kt as generateDeploymentUrl,Vt as generateDomainUrl,N as getENV,Dt as getValidFiles,F as hasUnbuiltMarker,me as hasUnsafeChars,de as isBlockedExtension,Bt as isCustomDomain,Ht as isDeployment,Se as isPlatformDomain,C as isShipError,_t as normalizeVia,Fe as optimizeDeployPaths,Yn as pluralize,Be as processFilesForNode,qt as serializeLabels,tt as validateApiKey,Ut as validateApiUrl,Te as validateCaller,Ue as validateDeployFile,ke as validateDeployPath,nt as validateDeployToken,re as validateFileName,Un as validateFiles,ue as validateIdempotencyKey,J as validatePassword,j as validateToken,X as validateTtl};
+var qe=Object.defineProperty;var T=(e,t)=>()=>(e&&(t=e(e=0)),t);var Ye=(e,t)=>{for(var n in t)qe(e,n,{get:t[n],enumerable:!0})};function Mt(e){if(!e||typeof e!="string")return;let t=e.trim().toLowerCase();return Object.values(je).includes(t)?t:void 0}function me(e){if(e==null)return;if(typeof e!="string")throw a.validation("Idempotency key must be a string.");let t=e.trim();if(!t)throw a.validation("Idempotency key must not be empty.");if(t.length>L.MAX_LENGTH)throw a.validation(`Idempotency key must be at most ${L.MAX_LENGTH} characters.`);return t}function Qe(e){let t=e.code;return t==="ERR_INVALID_URL"?!1:typeof t=="string"?!0:e instanceof TypeError?!/\burl\b/i.test(e.message):!1}function C(e){return e!==null&&typeof e=="object"&&"name"in e&&e.name==="ShipError"&&"status"in e}function Ze(e){let t=e.replace(/\\/g,"/").split("/").pop()??"",n=t.lastIndexOf(".");return n<=0||n===t.length-1?null:t.slice(n+1).toLowerCase()}function fe(e,t){let n=Ze(e);return n===null?!1:Array.isArray(t)?t.includes(n):t.has(n)}function he(e){return tt.test(e)}function F(e){return e.replace(/\\/g,"/").split("/").filter(Boolean).some(n=>X.has(n))}function nt(e){return e.startsWith(ye.PREFIX)?R.API_KEY:e.startsWith(Ee.PREFIX)?R.DEPLOY_TOKEN:e.startsWith(ge.PREFIX)?R.OAUTH:R.OPAQUE}function $t(e){return e.slice(0,j.length).toLowerCase()!==j?null:e.slice(j.length)||null}function Se(e){let t=e.charCodeAt(0)===65279?e.slice(1):e,n;try{n=JSON.parse(t)}catch(r){throw a.config(`invalid JSON format in config: ${r.message}`,{filePath:A})}if(n===null||typeof n!="object"||Array.isArray(n))throw a.config(`${A} must contain a JSON object`,{filePath:A})}function W(e,t,n){if(!e.startsWith(t.PREFIX))throw a.validation(`${n} must start with "${t.PREFIX}"`);if(e.length!==t.TOTAL_LENGTH)throw a.validation(`${n} must be ${t.TOTAL_LENGTH} characters total (${t.PREFIX} + ${t.HEX_LENGTH} hex chars)`);let r=e.slice(t.PREFIX.length);if(!new RegExp(`^[a-f0-9]{${t.HEX_LENGTH}}$`,"i").test(r))throw a.validation(`${n} must contain ${t.HEX_LENGTH} hexadecimal characters after "${t.PREFIX}" prefix`)}function rt(e){W(e,ye,"API key")}function it(e){W(e,Ee,"Deploy token")}function ot(e){W(e,ge,"OAuth access token")}function J(e){switch(nt(e)){case R.API_KEY:rt(e);return;case R.DEPLOY_TOKEN:it(e);return;case R.OAUTH:ot(e);return;case R.OPAQUE:if(!e)throw a.validation("Token must be a non-empty string")}}function Ae(e){if(!e||e.length>b.MAX_LENGTH||!b.PATTERN.test(e))throw a.validation(`Caller must be 1-${b.MAX_LENGTH} characters: letters, digits, dots, underscores, or hyphens`)}function Bt(e){try{let t=new URL(e);if(!["http:","https:"].includes(t.protocol))throw a.validation("API URL must use http:// or https:// protocol");if(t.pathname!=="/"&&t.pathname!=="")throw a.validation("API URL must not contain a path");if(t.search||t.hash)throw a.validation("API URL must not contain query parameters or fragments")}catch(t){throw C(t)?t:a.validation("API URL must be a valid URL")}}function zt(e){return/^[a-z]+-[a-z]+-[a-z0-9]{7}(\.[a-z0-9.-]+)?$/i.test(e)}function Q(e){if(e!=null){if(typeof e!="number"||!Number.isFinite(e))throw a.validation("TTL must be a number of seconds");if(!Number.isInteger(e))throw a.validation("TTL must be a whole number of seconds");if(e<_.MIN_SECONDS||e>_.MAX_SECONDS)throw a.validation(`TTL must be between ${_.MIN_SECONDS} and ${_.MAX_SECONDS} seconds`);return e}}function De(e,t){return e.endsWith(`.${t}`)}function qt(e,t){return!De(e,t)}function Yt(e,t){return De(e,t)?e.slice(0,-(t.length+1)):null}function jt(e){return`https://${e}`}function Xt(e){return`https://${e}`}function Wt(e){return!e||e.length===0?null:JSON.stringify(e)}function Jt(e){if(!e)return[];try{let t=JSON.parse(e);return Array.isArray(t)?t:[]}catch{return[]}}function ee(e){if(e==null)return;if(typeof e!="string")throw a.validation("Password must be a string");let t=e.trim();if(t.length<v.MIN_LENGTH||t.length>v.MAX_LENGTH)throw a.validation(`Password must be between ${v.MIN_LENGTH} and ${v.MAX_LENGTH} characters`);return t}var Ct,je,Ft,L,kt,m,S,d,Xe,q,We,Je,a,et,Ut,tt,X,Ht,Y,ye,Ee,ge,b,R,j,Gt,A,Te,M,_,Z,x,Kt,Vt,h,I,Re,v,f=T(()=>{"use strict";Ct={PENDING:"pending",SUCCESS:"success",FAILED:"failed",DELETING:"deleting"},je={WEB:"web",SDK:"sdk",CLI:"cli",MCP:"mcp",GIT:"git",N8N:"n8n",GPT:"gpt",VSC:"vsc"},Ft={PENDING:"pending",PARTIAL:"partial",SUCCESS:"success",PAUSED:"paused"},L={HEADER:"Idempotency-Key",MAX_LENGTH:256,WINDOW_SECONDS:1440*60};kt={FREE:"free",STANDARD:"standard",SPONSORED:"sponsored",ENTERPRISE:"enterprise",SUSPENDED:"suspended",TERMINATING:"terminating",TERMINATED:"terminated"},m={DEPLOYMENTS:"/deployments",DEPLOYMENT:e=>`/deployments/${e}`,DEPLOYMENT_CONFIG:e=>`/deployments/${e}/config`,DOMAINS:"/domains",DOMAIN:e=>`/domains/${e}`,DOMAIN_VERIFY:e=>`/domains/${e}/verify`,DOMAIN_DNS:e=>`/domains/${e}/dns`,DOMAIN_RECORDS:e=>`/domains/${e}/records`,DOMAIN_SHARE:e=>`/domains/${e}/share`,DOMAIN_PROPAGATION:e=>`/domains/${e}/propagation`,DOMAINS_VALIDATE:"/domains/validate",TOKENS:"/tokens",TOKEN:e=>`/tokens/${e}`,ACCOUNT:"/account",ACCOUNT_KEY:"/account/key",ACCOUNT_CLAIM:"/account/claim",ACTIVITIES:"/activities",LABELS:"/labels",LIMITS:"/limits",PING:"/ping",SETUP:"/setup",SPA_CHECK:"/spa-check",UPLOAD:"/upload"},S={FILES:"files[]",CHECKSUMS:"checksums",LABELS:"labels",VIA:"via",PASSWORD:"password",TTL:"ttl",BUILD:"build",PRERENDER:"prerender",SPA:"spa",CAPTCHA:"captcha"},d={Validation:"validation_failed",NotFound:"not_found",Forbidden:"forbidden",RateLimit:"rate_limit_exceeded",Authentication:"authentication_failed",Business:"business_logic_error",Api:"internal_server_error",Maintenance:"maintenance",Network:"network_error",Timeout:"timeout_error",Cancelled:"operation_cancelled",File:"file_error",Config:"config_error"},Xe=new Set([d.Network,d.Timeout,d.Cancelled,d.File,d.Config]),q={client:new Set([d.Business,d.Cancelled,d.Config,d.File,d.Forbidden,d.NotFound,d.RateLimit,d.Validation]),network:new Set([d.Network,d.Timeout]),auth:new Set([d.Authentication])},We=new Set(Object.values(d).filter(e=>!Xe.has(e))),Je=200;a=class e extends Error{type;status;details;constructor(t,n,r,i){super(n),this.type=t,this.status=r,this.details=i,this.name="ShipError"}toResponse(){let t=this.details,n=this.type===d.Authentication&&t?.internal?void 0:this.details;return{error:this.type,message:this.message,status:this.status,details:n}}static async fromHttpResponse(t,n){let r,i,o;try{if(t.headers.get("content-type")?.includes("application/json")){let u=await t.json();if(u&&typeof u=="object"){let p=u;typeof p.message=="string"?r=p.message:typeof p.error=="string"&&(r=p.error),i=p.details,typeof p.error=="string"&&We.has(p.error)&&(o=p.error)}}else{let u=(await t.text()).trim();u&&!u.startsWith("<")&&u.length<=Je&&(r=u)}}catch{}let l=t.headers.get("retry-after");if(l!==null){let s=l.trim(),u=/^\d+$/.test(s)?Number(s):Math.ceil((Date.parse(s)-Date.now())/1e3);if(Number.isFinite(u)&&u>=0){let p=i&&typeof i=="object"?i:{};p.retryAfter===void 0&&(i={...p,retryAfter:u})}}r=r||`${n||"Request"} failed with status ${t.status}`;let c=o??(t.status===401?d.Authentication:t.status===403?d.Forbidden:t.status===429?d.RateLimit:d.Api);return new e(c,r,t.status,i)}static fromFetchError(t,n){if(C(t))return t;let r=n||"Request",i=t?.name;return i==="AbortError"?e.cancelled(`${r} was cancelled`):i==="TimeoutError"?e.timeout(`${r} timed out`,{cause:t}):t instanceof Error?Qe(t)?e.network(`${r} failed: ${t.message}`,{cause:t}):new e(d.Api,`${r} failed: ${t.message}`):new e(d.Api,`${r} failed: Unknown error`)}static validation(t,n){return new e(d.Validation,t,400,n)}static notFound(t,n){let r=n?`${t} ${n} not found`:`${t} not found`;return new e(d.NotFound,r,404)}static forbidden(t,n){return new e(d.Forbidden,t,403,n)}static rateLimit(t="Too many requests",n){return new e(d.RateLimit,t,429,n)}static authentication(t="Authentication required",n){return new e(d.Authentication,t,401,n)}static business(t,n=400,r){return new e(d.Business,t,n,r)}static network(t,n){return new e(d.Network,t,void 0,n)}static timeout(t,n){return new e(d.Timeout,t,void 0,n)}static cancelled(t,n){return new e(d.Cancelled,t,void 0,n)}static file(t,n){return new e(d.File,t,void 0,n)}static config(t,n){return new e(d.Config,t,void 0,n)}static api(t,n=500,r){return new e(d.Api,t,n,r)}static maintenance(t,n){return new e(d.Maintenance,t,503,n)}isClientError(){return q.client.has(this.type)?!0:this.status!==void 0&&this.status>=400&&this.status<500}isNetworkError(){return q.network.has(this.type)}isAuthError(){return q.auth.has(this.type)}isType(t){return this.type===t}};et=["html","htm","xhtml","xml","txt","md","markdown","pdf","csv","json","jsonc","webmanifest","map","toml","yaml","yml","rss","atom","css","scss","sass","less","js","mjs","cjs","jsx","ts","tsx","wasm","vue","svelte","png","jpg","jpeg","gif","webp","avif","svg","ico","bmp","tif","tiff","heic","heif","woff","woff2","ttf","otf","eot","mp3","wav","ogg","oga","opus","m4a","aac","flac","weba","mp4","webm","ogv","mov","m4v","avi","glb","gltf","usdz","vtt","srt","zip"],Ut=et.map(e=>`.${e}`).join(","),tt=/[\x00-\x1f\x7f#?%\\<>"]/;X=new Set(["node_modules","package.json"]);Ht="/auth",Y={SESSION:"session",API_KEY:"apiKey",TOKEN:"token",AGENT:"agent",OAUTH:"oauth",WEBHOOK:"webhook",SYSTEM:"system"},ye={PREFIX:"ship-",HEX_LENGTH:32,TOTAL_LENGTH:37,HINT_LENGTH:4},Ee={PREFIX:"deploy-",HEX_LENGTH:32,TOTAL_LENGTH:39},ge={PREFIX:"oauth-",HEX_LENGTH:32,TOTAL_LENGTH:38},b={HEADER:"X-Caller",MAX_LENGTH:128,PATTERN:/^[a-zA-Z0-9._-]+$/},R={API_KEY:Y.API_KEY,DEPLOY_TOKEN:Y.TOKEN,OAUTH:Y.OAUTH,OPAQUE:"opaque"};j="bearer ";Gt={ACCOUNT_READ:"account:read",DEPLOYMENTS_READ:"deployments:read",DEPLOYMENTS_WRITE:"deployments:write",DOMAINS_READ:"domains:read",DOMAINS_WRITE:"domains:write"},A="ship.json",Te={rewrites:[{source:"/(.*)",destination:"/index.html"}]},M={INDEX_FILE:"index.html",MAX_INDEX_BYTES:100*1024};_={MIN_SECONDS:1,MAX_SECONDS:365*24*60*60};Z="https://api.shipstatic.com",x={TOKEN:"SHIP_TOKEN",API_URL:"SHIP_API_URL"},Kt="https://my.shipstatic.com/api-key",Vt=4320*60,h={PENDING:"pending",PROCESSING_ERROR:"processing_error",EXCLUDED:"excluded",VALIDATION_FAILED:"validation_failed",READY:"ready"};I={MIN_LENGTH:3,MAX_LENGTH:25,MAX_COUNT:10,SEPARATORS:"._-"},Re=/^[a-z0-9]+(?:[._-][a-z0-9]+)*$/;v={MIN_LENGTH:6,MAX_LENGTH:128}});async function ft(e){let t=(await import("spark-md5")).default,n=new t.ArrayBuffer,r=2097152;for(let i=0;i<e.size;i+=r){let o=Math.min(i+r,e.size);n.append(await e.slice(i,o).arrayBuffer())}return{md5:n.end()}}async function ht(e){let{createHash:t}=await import("crypto"),n=t("md5");return n.update(e),{md5:n.digest("hex")}}async function yt(e){let{createHash:t}=await import("crypto"),{createReadStream:n}=await import("fs");return new Promise((r,i)=>{let o=t("md5"),l=n(e);l.on("error",c=>i(a.file(`Failed to read file for MD5: ${c.message}`,{filePath:e}))),l.on("data",c=>o.update(c)),l.on("end",()=>r({md5:o.digest("hex")}))})}async function H(e){if(e instanceof Blob)return ft(e);if(typeof Buffer<"u"&&Buffer.isBuffer(e))return ht(e);if(typeof e=="string")return yt(e);throw a.business("Invalid input for MD5 calculation")}var $=T(()=>{"use strict";f()});function Rn(e){ne=e}function St(){return typeof process<"u"&&process.versions&&process.versions.node?"node":typeof window<"u"||typeof self<"u"?"browser":"unknown"}function N(){return ne||St()}var ne,w=T(()=>{"use strict";ne=null});function Me(e){if(!e||e.length===0)return"";let t=e.filter(o=>o&&typeof o=="string").map(o=>o.replace(/\\/g,"/"));if(t.length===0)return"";if(t.length===1)return t[0];let n=t.map(o=>o.split("/").filter(Boolean)),r=[],i=Math.min(...n.map(o=>o.length));for(let o=0;o<i;o++){let l=n[0][o];if(n.every(c=>c[o]===l))r.push(l);else break}return r.join("/")}function z(e){return e.replace(/\\/g,"/").replace(/\/+/g,"/").replace(/^\/+/,"")}var re=T(()=>{"use strict"});function ke(e,t={}){if(t.flatten===!1)return e.map(r=>({path:z(r),name:ie(r)}));let n=Rt(e);return e.map(r=>{let i=z(r);if(n){let o=n.endsWith("/")?n:`${n}/`;i.startsWith(o)&&(i=i.substring(o.length))}return i||(i=ie(r)),{path:i,name:ie(r)}})}function Rt(e){if(!e.length)return"";let n=e.map(o=>z(o)).map(o=>o.split("/")),r=[],i=Math.min(...n.map(o=>o.length));for(let o=0;o<i-1;o++){let l=n[0][o];if(n.every(c=>c[o]===l))r.push(l);else break}return r.join("/")}function ie(e){return e.split(/[/\\]/).pop()||e}var oe=T(()=>{"use strict";re()});function V(e,t){return It.find(n=>n.broken(e,t))}var It,ae=T(()=>{"use strict";f();le();It=[{name:"name",broken:({path:e})=>!se(e).valid,sentence:({path:e})=>se(e).reason??"Invalid file name"},{name:"extension",broken:({path:e},t)=>fe(e,t.blockedExtensions??[]),sentence:({path:e})=>`File extension not allowed: "${e}"`},{name:"fileSize",broken:({size:e},t)=>e>t.maxFileSize,sentence:({path:e},t)=>`File "${e}" too large. Maximum ${K(t.maxFileSize)} allowed`},{name:"totalSize",broken:({totalSize:e},t)=>e>t.maxTotalSize,sentence:({totalSize:e},t)=>`Total upload size too large. ${K(e)} exceeds maximum of ${K(t.maxTotalSize)}`}]});function K(e,t=1){if(e===0)return"0 Bytes";let n=1024,r=["Bytes","KB","MB","GB"],i=Math.floor(Math.log(e)/Math.log(n));return`${parseFloat((e/n**i).toFixed(t))} ${r[i]}`}function se(e){if(he(e))return{valid:!1,reason:"File name contains unsafe characters"};if(e.startsWith(" ")||e.endsWith(" "))return{valid:!1,reason:"File name cannot start/end with spaces"};if(e.endsWith("."))return{valid:!1,reason:"File name cannot end with dots"};let t=/^(CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(\.|$)/i,n=e.split("/").pop()||e;return t.test(n)?{valid:!1,reason:"File name uses a reserved system name"}:e.includes("..")?{valid:!1,reason:"File name contains path traversal pattern"}:{valid:!0}}function Bn(e,t){let n=[],r=[],i=[];if(e.length===0){let s={file:"(no files)",message:"At least one file must be provided"};return n.push(s),{files:[],validFiles:[],errors:n,warnings:[],canDeploy:!1}}for(let s of e)if(F(s.name))return n.push({file:s.name,message:"Unbuilt project detected \u2014 deploy your build output (dist/, build/, out/), not the project folder"}),{files:e.map(u=>({...u,status:h.VALIDATION_FAILED,statusMessage:"Unbuilt project detected"})),validFiles:[],errors:n,warnings:[],canDeploy:!1};if(e.length>t.maxFilesCount){let s={file:`(${e.length} files)`,message:`File count (${e.length}) exceeds limit of ${t.maxFilesCount}`};return n.push(s),{files:e.map(u=>({...u,status:h.VALIDATION_FAILED,statusMessage:s.message})),validFiles:[],errors:n,warnings:[],canDeploy:!1}}let o=0;for(let s of e){let u=h.READY,p="Ready for upload";if(s.status===h.PROCESSING_ERROR)u=h.VALIDATION_FAILED,p=s.statusMessage||"File failed during processing",n.push({file:s.name,message:p});else if(s.size===0){u=h.EXCLUDED,p="File is empty (0 bytes) and cannot be deployed due to storage limitations",r.push({file:s.name,message:p}),i.push({...s,status:u,statusMessage:p});continue}else if(s.size<0)u=h.VALIDATION_FAILED,p="File size must be positive",n.push({file:s.name,message:p});else if(!s.name||s.name.trim().length===0)u=h.VALIDATION_FAILED,p="File name cannot be empty",n.push({file:s.name||"(empty)",message:p});else if(s.name.includes("\0"))u=h.VALIDATION_FAILED,p="File name contains invalid characters (null byte)",n.push({file:s.name,message:p});else{let y={path:s.name,size:s.size,totalSize:o+s.size},D=V(y,t);D?(u=h.VALIDATION_FAILED,p=D.sentence(y,t),n.push({file:D.name==="totalSize"?`(${e.length} files)`:s.name,message:p})):o=y.totalSize}i.push({...s,status:u,statusMessage:p})}n.length>0&&(i=i.map(s=>s.status===h.EXCLUDED?s:{...s,status:h.VALIDATION_FAILED,statusMessage:s.status===h.VALIDATION_FAILED?s.statusMessage:"Deployment failed due to validation errors in bundle"}));let l=n.length===0?i.filter(s=>s.status===h.READY):[],c=n.length===0;return{files:i,validFiles:l,errors:n,warnings:r,canDeploy:c}}function Lt(e){return e.filter(t=>t.status===h.READY)}function zn(e){return Lt(e).length>0}var le=T(()=>{"use strict";f();ae()});import{isJunk as Nt}from"junk";function Ue(e,t){if(!e||e.length===0)return[];if(!t?.allowUnbuilt&&e.find(r=>r&&F(r)))throw a.business("Unbuilt project detected \u2014 deploy your build output (dist/, build/, out/), not the project folder");return e.filter(n=>{if(!n)return!1;let r=n.replace(/\\/g,"/").split("/").filter(Boolean);if(r.length===0)return!0;let i=r[r.length-1];if(Nt(i))return!1;for(let l of r)if(l!==".well-known"&&(l.startsWith(".")||l.length>255))return!1;let o=r.slice(0,-1);for(let l of o)if(Pt.some(c=>l.toLowerCase()===c.toLowerCase()))return!1;return!0})}var Pt,pe=T(()=>{"use strict";f();Pt=["__MACOSX",".Trashes",".fseventsd",".Spotlight-V100"]});function He(e,t){if(e.includes("\0")||e.includes("/../")||e.startsWith("../")||e.endsWith("/.."))throw a.business(`Security error: Unsafe file path "${e}" for file: ${t}`)}function $e(e,t){let n=V(e,t);if(n)throw a.business(n.sentence(e,t))}var ce=T(()=>{"use strict";f();ae()});async function Ge(e,t={},n){let r=!!(t.build||t.prerender),i=ke(e.map(p=>p.path),{flatten:t.pathDetect!==!1}).map(p=>p.path),o=new Set(Ue(i,{allowUnbuilt:r})),l=e.map((p,y)=>({source:p,deployPath:i[y]})).filter(({deployPath:p})=>o.has(p));if(l.length===0)return[];let c=r?null:bt(n),s=[],u=0;for(let{source:p,deployPath:y}of l){if(c&&He(y,p.origin),p.size===0)continue;c&&(u+=p.size,$e({path:y,size:p.size,totalSize:u},c));let D=await p.read(),{md5:P}=await H(D);s.push({path:y,content:D,size:p.size,md5:P})}if(c&&s.length>c.maxFilesCount)throw a.business(`Too many files to deploy. Maximum allowed is ${c.maxFilesCount} files.`);return s}function bt(e){if(!e)throw a.config("Platform limits not provided. Deploy-mode validation requires the limits argument \u2014 pass `ship.getLimits()` result.");return e}var Be=T(()=>{"use strict";f();oe();pe();$();ce()});var Ve={};Ye(Ve,{processFilesForNode:()=>Ke});import*as g from"fs";import*as E from"path";function ze(e,t=new Set){let n=[],r=g.realpathSync(e);if(t.has(r))return n;t.add(r);for(let i of g.readdirSync(e)){let o=E.join(e,i),l=g.statSync(o);l.isDirectory()?n.push(...ze(o,t)):l.isFile()&&n.push({absPath:o,size:l.size})}return n}async function xt(e){try{return g.readFileSync(e)}catch(t){let n=t instanceof Error?t.message:String(t);throw a.file(`Failed to read file "${e}": ${n}`,{filePath:e})}}function Ot(e){for(let t of e){let n=E.resolve(t);try{if(g.statSync(n).isDirectory()){let r=g.readdirSync(n).find(i=>X.has(i));if(r)throw a.business(`"${r}" detected \u2014 deploy your build output (dist/, build/, out/), not the project folder`)}}catch(r){if(C(r))throw r}}}async function Ke(e,t={},n){if(N()!=="node")throw a.business("processFilesForNode can only be called in Node.js environment.");Ot(e);let r=e.flatMap(c=>{let s=E.resolve(c);try{let u=g.statSync(s);return u.isDirectory()?ze(s):[{absPath:s,size:u.size}]}catch{throw a.file(`Path does not exist: ${c}`,{filePath:c})}}),i=new Map(r.map(c=>[c.absPath,c.size])),o=Me(e.map(c=>E.resolve(c)).map(c=>{try{return g.statSync(c).isDirectory()?c:E.dirname(c)}catch{return E.dirname(c)}})),l=[...i].map(([c,s])=>({path:wt(c,o),origin:c,size:s,read:()=>xt(c)}));return Ge(l,t,n)}function wt(e,t){if(t&&t.length>0){let n=E.relative(t,e);if(n&&typeof n=="string"&&!n.startsWith(".."))return n.replace(/\\/g,"/")}return E.basename(e)}var ue=T(()=>{"use strict";f();Be();w();re()});f();f();f();var k=class{constructor(){this.handlers=new Map}on(t,n){this.handlers.has(t)||this.handlers.set(t,new Set),this.handlers.get(t)?.add(n)}off(t,n){let r=this.handlers.get(t);r&&(r.delete(n),r.size===0&&this.handlers.delete(t))}emit(t,...n){let r=this.handlers.get(t);if(!r)return;let i=Array.from(r);for(let o of i)try{o(...n)}catch(l){r.delete(o),t!=="error"&&setTimeout(()=>{let c=l instanceof Error?l:new Error(String(l));this.emit("error",c,String(t))},0)}}};var st=3e4,at=2,lt=300,pt=2e3,ct=new Set([500,502,503,504]);function ut(e,t){return new Promise((n,r)=>{if(t?.aborted){r(t.reason);return}let i=()=>{clearTimeout(l),t?.removeEventListener("abort",o)},o=()=>{i(),r(t?.reason)},l=setTimeout(()=>{i(),n()},e);t?.addEventListener("abort",o)})}var Ie=3e5,dt=3e5,mt=Ie+dt,U=class extends k{constructor(n){super();this.globalHeaders={};this.apiUrl=n.apiUrl||Z,this.getAuthHeadersCallback=n.getAuthHeaders,this.session=n.session??!1,this.caller=n.caller,this.timeout=n.timeout??st,this.maxRetries=Math.max(0,n.maxRetries??at),this.fetch=n.fetch??globalThis.fetch.bind(globalThis),this.deploy={endpoint:n.deployEndpoint||m.DEPLOYMENTS,timeout:n.timeout??Ie,buildTimeout:n.timeout??mt}}setGlobalHeaders(n){this.globalHeaders=n}async executeRequest(n,r,i,o=this.timeout){for(let l=0;;l++)try{return await this.attemptOnce(n,r,i,o)}catch(c){let s=a.fromFetchError(c,i);if(l>=this.maxRetries||!this.isRetryable(s,r))throw this.emit("error",s,n),s;this.emit("retry",s,n,l+1);let u=Math.min(pt,lt*2**l);try{await ut(Math.random()*u,r.signal)}catch(p){let y=a.fromFetchError(p,i);throw this.emit("error",y,n),y}}}isRetryable(n,r){if(r.signal?.aborted||n.isType(d.Maintenance)||n.isType(d.Cancelled)||!(n.isNetworkError()||n.status!==void 0&&ct.has(n.status)))return!1;let o=(r.method??"GET").toUpperCase();return o==="GET"||o==="HEAD"?!0:o==="PUT"||o==="DELETE"?!1:this.hasIdempotencyKey(r.headers)}hasIdempotencyKey(n){if(!n)return!1;let r=L.HEADER.toLowerCase();return Object.keys(n).some(i=>i.toLowerCase()===r)}async attemptOnce(n,r,i,o=this.timeout){let l=()=>{};try{let c=await this.mergeHeaders(r.headers),s=this.createTimeoutSignal(r.signal,o);l=s.cleanup;let u={...r,headers:c,credentials:this.session&&!c.Authorization?"include":void 0,signal:s.signal};this.emit("request",n,u);let p=await this.fetch(n,u);if(l(),!p.ok)throw await a.fromHttpResponse(p,i);return this.emit("response",this.safeClone(p),n),{data:await this.parseResponse(this.safeClone(p)),status:p.status}}catch(c){throw l(),a.fromFetchError(c,i)}}async request(n,r,i,o){let{data:l}=await this.executeRequest(`${this.apiUrl}${n}`,r,i,o);return l}async requestWithStatus(n,r,i){return this.executeRequest(`${this.apiUrl}${n}`,r,i)}async mergeHeaders(n={}){return{...this.globalHeaders,...this.caller?{[b.HEADER]:this.caller}:{},...await this.getAuthHeadersCallback(),...n}}createTimeoutSignal(n,r=this.timeout){let i=new AbortController,o=setTimeout(()=>i.abort(new DOMException(`Timed out after ${r}ms`,"TimeoutError")),r),l=n?()=>i.abort(n.reason):void 0;return n&&l&&(n.addEventListener("abort",l),n.aborted&&i.abort(n.reason)),{signal:i.signal,cleanup:()=>{clearTimeout(o),n&&l&&n.removeEventListener("abort",l)}}}safeClone(n){try{return n.clone()}catch{return n}}async parseResponse(n){if(!(n.headers.get("Content-Length")==="0"||n.status===204))return n.json()}};f();f();async function Le(e,t={}){let{labels:n,via:r,password:i,ttl:o,flags:l,captcha:c}=t,s=new FormData,u=[];for(let p of e){if(typeof p.content=="string"||p.content===null||p.content===void 0)throw a.file(`Unsupported file.content type: ${p.path}`,{filePath:p.path});if(!p.md5)throw a.file(`File missing md5 checksum: ${p.path}`,{filePath:p.path});s.append(S.FILES,new File([p.content],p.path,{type:"application/octet-stream"})),u.push(p.md5)}return s.append(S.CHECKSUMS,JSON.stringify(u)),n&&n.length>0&&s.append(S.LABELS,JSON.stringify(n)),r&&s.append(S.VIA,r),i&&s.append(S.PASSWORD,i),o!==void 0&&s.append(S.TTL,String(o)),l?.build&&s.append(S.BUILD,"true"),l?.prerender&&s.append(S.PRERENDER,"true"),l?.spa&&s.append(S.SPA,"true"),c&&s.append(S.CAPTCHA,c),s}f();$();async function Et(){let e=JSON.stringify(Te,null,2),t;typeof Buffer<"u"?t=Buffer.from(e,"utf-8"):t=new Blob([e],{type:"application/json"});let{md5:n}=await H(t);return{path:A,content:t,size:e.length,md5:n}}async function gt(e,t){let n=e.find(l=>l.path===M.INDEX_FILE||l.path===`/${M.INDEX_FILE}`);if(!n||n.size>M.MAX_INDEX_BYTES)return!1;let r;if(typeof Buffer<"u"&&Buffer.isBuffer(n.content))r=n.content.toString("utf-8");else if(typeof Blob<"u"&&n.content instanceof Blob)r=await n.content.text();else if(typeof File<"u"&&n.content instanceof File)r=await n.content.text();else return!1;let i={files:e.map(l=>l.path),index:r};return(await t.request(m.SPA_CHECK,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(i)},"SPA check")).isSPA}async function Ne(e,t,n){if(n.spaDetect===!1||n.spa||n.build||n.prerender||e.some(r=>r.path===A))return e;try{if(await gt(e,t)){let i=await Et();return[...e,i]}}catch{}return e}f();f();function O(e){if(e==null)return;if(e.length===0)return e;if(e.length>I.MAX_COUNT)throw a.validation(`Maximum ${I.MAX_COUNT} labels allowed`);let t=e.map((r,i)=>{if(typeof r!="string")throw a.validation(`Label at index ${i} must be a string`);let o=r.trim().toLowerCase();if(o.length<I.MIN_LENGTH)throw a.validation(`Labels must be at least ${I.MIN_LENGTH} characters long`);if(o.length>I.MAX_LENGTH)throw a.validation(`Labels must be no more than ${I.MAX_LENGTH} characters long`);if(!Re.test(o))throw a.validation(`Labels must start and end with alphanumeric characters, with optional separators (${I.SEPARATORS}) between segments`);return o}),n=[...new Set(t)];if(n.length!==t.length)throw a.validation("Duplicate labels are not allowed");return n}async function Pe(e){let t=e.find(i=>i.path===A||i.path===`/${A}`);if(!t)return;let n=t.content,r=typeof n.text=="function"?await n.text():t.content.toString("utf8");Se(r)}var G={"Content-Type":"application/json"},Tt="sdk";function te(e){let t=new URLSearchParams;e?.limit!==void 0&&t.set("limit",String(e.limit)),e?.cursor!==void 0&&t.set("cursor",e.cursor);let n=t.toString();return n?`?${n}`:""}function be(e){let{getApi:t,processInput:n}=e;return{upload:async(r,i={})=>{if(!n)throw a.config("processInput function is not provided.");let o=t(),l=await n(r,i),c=await Ne(l,o,i);if(!c.length)throw a.business("No files to deploy");for(let P of c)if(!P.md5)throw a.file(`MD5 checksum missing for file: ${P.path}`,{filePath:P.path});ee(i.password);let s=Q(i.ttl),u=me(i.idempotencyKey),p=O(i.labels);await Pe(c);let y=i.build||i.prerender||i.spa?{build:i.build,prerender:i.prerender,spa:i.spa}:void 0,D=await Le(c,{labels:p,via:i.via??Tt,password:i.password,ttl:s,flags:y,captcha:i.captcha});return o.request(o.deploy.endpoint,{method:"POST",body:D,...u?{headers:{[L.HEADER]:u}}:{},signal:i.signal||null},"Deploy",i.build||i.prerender?o.deploy.buildTimeout:o.deploy.timeout)},list:async r=>t().request(`${m.DEPLOYMENTS}${te(r)}`,{method:"GET"},"List deployments"),get:async r=>t().request(m.DEPLOYMENT(encodeURIComponent(r)),{method:"GET"},"Get deployment"),set:async(r,i)=>t().request(m.DEPLOYMENT(encodeURIComponent(r)),{method:"PATCH",headers:G,body:JSON.stringify({labels:O(i.labels)})},"Update deployment labels"),delete:async r=>t().request(m.DEPLOYMENT(encodeURIComponent(r)),{method:"DELETE"},"Delete deployment")}}function xe(e){let{getApi:t}=e;return{set:async(n,r={})=>{let i=O(r.labels),o={};r.deployment&&(o.deployment=r.deployment),i!==void 0&&(o.labels=i);let{data:l,status:c}=await t().requestWithStatus(m.DOMAIN(encodeURIComponent(n)),{method:"PUT",headers:G,body:JSON.stringify(o)},"Set domain");return{...l,isCreate:c===201}},list:async n=>t().request(`${m.DOMAINS}${te(n)}`,{method:"GET"},"List domains"),get:async n=>t().request(m.DOMAIN(encodeURIComponent(n)),{method:"GET"},"Get domain"),delete:async n=>t().request(m.DOMAIN(encodeURIComponent(n)),{method:"DELETE"},"Delete domain"),verify:async n=>t().request(m.DOMAIN_VERIFY(encodeURIComponent(n)),{method:"POST"},"Verify domain"),validate:async n=>t().request(m.DOMAINS_VALIDATE,{method:"POST",headers:G,body:JSON.stringify({domain:n})},"Validate domain"),dns:async n=>t().request(m.DOMAIN_DNS(encodeURIComponent(n)),{method:"GET"},"Get domain DNS"),records:async n=>t().request(m.DOMAIN_RECORDS(encodeURIComponent(n)),{method:"GET"},"Get domain records"),share:async n=>t().request(m.DOMAIN_SHARE(encodeURIComponent(n)),{method:"GET"},"Get domain share")}}function Oe(e){let{getApi:t}=e;return{get:async()=>t().request(m.ACCOUNT,{method:"GET"},"Get account")}}function we(e){let{getApi:t}=e;return{create:async(n={})=>{let r=Q(n.ttl),i=O(n.labels),o={};return r!==void 0&&(o.ttl=r),i!==void 0&&(o.labels=i),t().request(m.TOKENS,{method:"POST",headers:G,body:JSON.stringify(o)},"Create token")},list:async n=>t().request(`${m.TOKENS}${te(n)}`,{method:"GET"},"List tokens"),get:async n=>t().request(m.TOKEN(encodeURIComponent(n)),{method:"GET"},"Get token"),delete:async n=>t().request(m.TOKEN(encodeURIComponent(n)),{method:"DELETE"},"Delete token")}}var B=class{constructor(t={}){this.initPromise=null;this.platformLimits=null;this.credential=null;if(t={...t,apiUrl:t.apiUrl||void 0,token:t.token||void 0,caller:t.caller||void 0},this.clientOptions=t,t.caller!==void 0&&Ae(t.caller),t.token&&t.session)throw a.config("Provide either `token` or `session`, not both.");typeof t.token=="string"?(J(t.token),this.credential=t.token):t.token&&(this.credential=t.token),this.http=new U({...t,getAuthHeaders:()=>this.getAuthHeaders()});let n={getApi:()=>this.http};this.deployments=be({...n,processInput:async(r,i)=>(await this.ensureInitialized(),this.processInput(r,i))}),this.domains=xe(n),this.account=Oe(n),this.tokens=we(n)}async ensureInitialized(){return this.initPromise||(this.initPromise=this.fetchPlatformLimits()),this.initPromise}async fetchPlatformLimits(){try{this.platformLimits=await this.http.request(m.LIMITS,{method:"GET"},"Get limits")}catch(t){throw this.initPromise=null,t}}async ping(){return this.http.request(m.PING,{method:"GET"},"Ping")}async deploy(t,n){return this.deployments.upload(t,n)}async whoami(){return this.account.get()}async getLimits(){return this.platformLimits?this.platformLimits:(await this.ensureInitialized(),this.platformLimits)}on(t,n){this.http.on(t,n)}off(t,n){this.http.off(t,n)}setHeaders(t){this.http.setGlobalHeaders(t)}clearHeaders(){this.http.setGlobalHeaders({})}setToken(t){if(this.clientOptions.session)throw a.config("Provide either `token` or `session`, not both.");if(typeof t=="string"){if(!t)throw a.business("Invalid token provided. Token must be a non-empty string.");J(t),this.credential=t;return}if(typeof t!="function")throw a.business("Invalid token provided. Token must be a non-empty string or a provider function.");this.credential=t}async getAuthHeaders(){if(this.credential===null)return{};let t=typeof this.credential=="function"?await this.credential():this.credential;if(!t)throw a.authentication("Token provider returned no token.");if(typeof t!="string")throw a.authentication("Token provider returned a non-string value.");return{Authorization:`Bearer ${t}`}}};w();f();import{z as Ce}from"zod";import{z as _e}from"zod";var ve={apiUrl:_e.string().url().optional(),token:_e.string().min(1).optional()};w();var At=Ce.object(ve).strict(),Dt={apiUrl:x.API_URL,token:x.TOKEN};function Fe(){if(N()!=="node")return{};let e={apiUrl:process.env[x.API_URL]||void 0,token:process.env[x.TOKEN]||void 0};try{return At.parse(e)}catch(t){if(t instanceof Ce.ZodError){let n=t.issues[0],r=n.path[0],i=(r&&Dt[r])??"SHIP environment configuration";throw a.config(`Invalid ${i}: ${n.message}`)}throw a.config("Invalid environment configuration")}}f();f();oe();w();le();pe();$();ce();function Jn(e,t,n,r=!0){let i=e===1?t:n;return r?`${e} ${i}`:i}ue();var de=class extends B{constructor(t={}){if(N()!=="node")throw a.business("Node.js Ship class can only be used in Node.js environment.");let n=Fe();super({...t,apiUrl:t.apiUrl||n.apiUrl,token:t.token||(t.session?void 0:n.token)})}async deploy(t,n){return super.deploy(t,n)}async processInput(t,n){let r=typeof t=="string"?[t]:t;if(!Array.isArray(r)||!r.every(o=>typeof o=="string"))throw a.business("Invalid input type for Node.js environment. Expected string or string[].");if(r.length===0)throw a.business("No files to deploy.");let{processFilesForNode:i}=await Promise.resolve().then(()=>(ue(),Ve));return i(r,n,this.platformLimits??void 0)}},_t=de;export{ye as API_KEY,m as API_PATHS,Ht as AUTH_BASE_PATH,kt as AccountPlan,U as ApiHttp,Y as AuthMethod,b as CALLER,Z as DEFAULT_API,A as DEPLOYMENT_CONFIG_FILENAME,S as DEPLOY_FIELDS,Ee as DEPLOY_TOKEN,Ct as DeploymentStatus,je as DeploymentVia,Ft as DomainStatus,d as ErrorType,h as FILE_VALIDATION_STATUS,h as FileValidationStatus,L as IDEMPOTENCY_KEY_CONSTRAINTS,Pt as JUNK_DIRECTORIES,I as LABEL_CONSTRAINTS,Re as LABEL_PATTERN,Kt as MY_API_KEY_URL,ge as OAUTH_TOKEN,Gt as OAuthScope,v as PASSWORD_CONSTRAINTS,Vt as PUBLIC_DEPLOYMENT_TTL_SECONDS,x as SHIP_ENV,M as SPA_CHECK_CONSTRAINTS,Te as SPA_DEFAULT_CONFIG,de as Ship,a as ShipError,_ as TTL_CONSTRAINTS,R as TokenKind,X as UNBUILT_PROJECT_MARKERS,tt as UNSAFE_FILENAME_CHARS,Ut as WEB_FILE_ACCEPT,Rn as __setTestEnvironment,zn as allValidFilesReady,Se as assertShipJsonSyntax,H as calculateMD5,nt as classifyToken,Oe as createAccountResource,be as createDeploymentResource,xe as createDomainResource,we as createTokenResource,_t as default,Jt as deserializeLabels,Yt as extractSubdomain,Ue as filterJunk,K as formatFileSize,jt as generateDeploymentUrl,Xt as generateDomainUrl,N as getENV,Lt as getValidFiles,F as hasUnbuiltMarker,he as hasUnsafeChars,fe as isBlockedExtension,qt as isCustomDomain,zt as isDeployment,De as isPlatformDomain,C as isShipError,Mt as normalizeVia,ke as optimizeDeployPaths,Jn as pluralize,Ke as processFilesForNode,$t as readBearerValue,Wt as serializeLabels,rt as validateApiKey,Bt as validateApiUrl,Ae as validateCaller,$e as validateDeployFile,He as validateDeployPath,it as validateDeployToken,se as validateFileName,Bn as validateFiles,me as validateIdempotencyKey,ot as validateOAuthToken,ee as validatePassword,J as validateToken,Q as validateTtl};
 //# sourceMappingURL=index.js.map