@stacksjs/ts-cloud 0.11.4 → 0.11.5

package/dist/deploy/index.js

@@ -1 +1 @@
-import{Ac as Z,Bc as aa,Cc as ba,Dc as ca,Ec as da,Fc as ea,Gc as fa,Hc as ga,Ic as ha,Jc as ia,Kc as ja,Lc as ka,Mc as la,Nc as ma,Oc as na,ic as y,jc as z,kc as A,lc as B,mc as C,nc as D,oc as E,od as oa,pc as O,pd as pa,qc as P,qd as qa,rc as Q,rd as ra,sc as R,tc as S,uc as T,vc as U,wc as V,xc as W,yc as X,zc as Y}from"../chunk-7pff0rv9.js";import{Ad as N,sd as F,td as G,ud as H,vd as I,wd as J,xd as K,yd as L,zd as M}from"../chunk-6v4k9ekm.js";import{Id as _}from"../chunk-1ypkh8g6.js";import"../chunk-h1rc94df.js";import"../chunk-nnqxmh7f.js";import"../chunk-q2njk4hx.js";import"../chunk-ky5c6t5y.js";import"../chunk-t0kh8haz.js";import"../chunk-hwan3cev.js";import"../chunk-qjk1v1gs.js";import{Dh as s,Eh as t,Fh as u,Gh as v,Hh as w,Ih as x,Uf as a,Vf as b,Wf as c,Xf as d,Yf as e,Zf as f,_f as g,gg as h,hg as i,ig as j,jg as k,kg as l,lg as m,mg as n,ng as o,og as p,pg as q,qg as r}from"../chunk-7xpxzbkr.js";import"../chunk-hbhxk5a0.js";import"../chunk-8e0az001.js";import"../chunk-p6vszgc2.js";import"../chunk-gk58959n.js";import"../chunk-s3rpd72x.js";import"../chunk-r5natbed.js";import"../chunk-b10cbk8z.js";import"../chunk-0hj552t7.js";import"../chunk-spx89gaw.js";export{d as IPV6_EXCLUDED_HOST_LABELS,s as MANAGEMENT_DASHBOARD_SITE,Z as buildAndPushContainerImage,_ as buildAndPushServerlessImage,ba as buildFunctionEnv,x as buildManagementDashboardArtifact,ha as buildServerTopology,ia as buildServerlessTopology,ja as buildTopology,na as collectEgressMetrics,a as collectServerDnsDomains,Y as createContainerImageDependencies,T as createExistingStaticFullStackDependencies,P as createStaticApiOriginDependencies,pa as dashboardActions,t as dashboardCredentialsFile,C as dashboardPageRoutes,M as deleteStaticSite,V as deployExistingStaticFullStack,ca as deployServerlessApp,r as deployShipsFiles,O as deploySite,Q as deployStaticApiOrigin,J as deployStaticSite,N as deployStaticSiteFull,G as deployStaticSiteWithExternalDns,H as deployStaticSiteWithExternalDnsFull,la as egressReportMetrics,y as ensureDashboardActor,w as ensureManagementDashboard,W as estimateExistingStaticFullStackMonthlyCost,S as estimateStaticApiOriginMonthlyCost,ma as fetchEgressReport,U as generateExistingStaticFullStackTemplate,F as generateExternalDnsStaticSiteTemplate,I as generateStaticSiteTemplate,n as hasComputeConfigured,k as hasProxyUpstream,X as hashContainerContext,e as hostAcceptsIpv6,aa as infraEnvFromOutputs,z as initializeDashboardControlPlane,L as invalidateCache,i as isPhpSite,c as normalizePublicIpv6,f as reconcileAddressRecords,da as redeployServerlessApp,b as removeStaleServerAddressRecords,qa as resolveDashboardAction,u as resolveDashboardAuth,ka as resolveDashboardData,D as resolveLegacyDashboardRoute,j as resolveProxyUpstreams,l as resolveSiteDeployTarget,m as resolveSiteKind,v as resolveUiSource,ea as rollbackServerlessApp,E as routesForDashboard,ga as runRemoteCommand,oa as sanitizeCloudConfig,fa as setMaintenance,p as shipsARelease,q as shipsToBucket,h as siteInstallBase,ra as startLocalDashboardServer,A as synchronizeDashboardUsers,B as trackDashboardOperation,K as uploadStaticFiles,o as validateDeploymentConfig,g as verifyAddressRecord,R as verifyStaticApiOrigin};
+import{Ac as Z,Bc as aa,Cc as ba,Dc as ca,Ec as da,Fc as ea,Gc as fa,Hc as ga,Ic as ha,Jc as ia,Kc as ja,Lc as ka,Mc as la,Nc as ma,Oc as na,ic as y,jc as z,kc as A,lc as B,mc as C,nc as D,oc as E,od as oa,pc as O,pd as pa,qc as P,qd as qa,rc as Q,rd as ra,sc as R,tc as S,uc as T,vc as U,wc as V,xc as W,yc as X,zc as Y}from"../chunk-9pa96r7f.js";import{Ad as N,sd as F,td as G,ud as H,vd as I,wd as J,xd as K,yd as L,zd as M}from"../chunk-zam6ecam.js";import{Id as _}from"../chunk-dr4pj8hp.js";import"../chunk-q0rc1ax9.js";import"../chunk-kasdm9tx.js";import"../chunk-by2bwzk6.js";import"../chunk-73ztr55z.js";import"../chunk-xcj8zfmg.js";import"../chunk-tz9myq9a.js";import"../chunk-y4xkj2f1.js";import{Gh as s,Hh as t,Ih as u,Jh as v,Kh as w,Lh as x,Uf as a,Vf as b,Wf as c,Xf as d,Yf as e,Zf as f,_f as g,jg as h,kg as i,lg as j,mg as k,ng as l,og as m,pg as n,qg as o,rg as p,sg as q,tg as r}from"../chunk-t2a6r38z.js";import"../chunk-aj025v2s.js";import"../chunk-wavjkdb8.js";import"../chunk-nk7sav4r.js";import"../chunk-mz0dk78z.js";import"../chunk-aw0cgv5w.js";import"../chunk-hn40z11p.js";import"../chunk-x3hay61c.js";import"../chunk-zz52xje8.js";import"../chunk-z2qqwy7e.js";export{d as IPV6_EXCLUDED_HOST_LABELS,s as MANAGEMENT_DASHBOARD_SITE,Z as buildAndPushContainerImage,_ as buildAndPushServerlessImage,ba as buildFunctionEnv,x as buildManagementDashboardArtifact,ha as buildServerTopology,ia as buildServerlessTopology,ja as buildTopology,na as collectEgressMetrics,a as collectServerDnsDomains,Y as createContainerImageDependencies,T as createExistingStaticFullStackDependencies,P as createStaticApiOriginDependencies,pa as dashboardActions,t as dashboardCredentialsFile,C as dashboardPageRoutes,M as deleteStaticSite,V as deployExistingStaticFullStack,ca as deployServerlessApp,r as deployShipsFiles,O as deploySite,Q as deployStaticApiOrigin,J as deployStaticSite,N as deployStaticSiteFull,G as deployStaticSiteWithExternalDns,H as deployStaticSiteWithExternalDnsFull,la as egressReportMetrics,y as ensureDashboardActor,w as ensureManagementDashboard,W as estimateExistingStaticFullStackMonthlyCost,S as estimateStaticApiOriginMonthlyCost,ma as fetchEgressReport,U as generateExistingStaticFullStackTemplate,F as generateExternalDnsStaticSiteTemplate,I as generateStaticSiteTemplate,n as hasComputeConfigured,k as hasProxyUpstream,X as hashContainerContext,e as hostAcceptsIpv6,aa as infraEnvFromOutputs,z as initializeDashboardControlPlane,L as invalidateCache,i as isPhpSite,c as normalizePublicIpv6,f as reconcileAddressRecords,da as redeployServerlessApp,b as removeStaleServerAddressRecords,qa as resolveDashboardAction,u as resolveDashboardAuth,ka as resolveDashboardData,D as resolveLegacyDashboardRoute,j as resolveProxyUpstreams,l as resolveSiteDeployTarget,m as resolveSiteKind,v as resolveUiSource,ea as rollbackServerlessApp,E as routesForDashboard,ga as runRemoteCommand,oa as sanitizeCloudConfig,fa as setMaintenance,p as shipsARelease,q as shipsToBucket,h as siteInstallBase,ra as startLocalDashboardServer,A as synchronizeDashboardUsers,B as trackDashboardOperation,K as uploadStaticFiles,o as validateDeploymentConfig,g as verifyAddressRecord,R as verifyStaticApiOrigin};

package/dist/dns/index.js

@@ -1 +1 @@
-import{Af as e,Bf as f,Cf as g,Df as h,Ef as i,Ff as j,Gf as k,Hf as l,If as m,Jf as n,Kf as o,Lf as p,Mf as q,Nf as r,Of as s,Pf as t,Qf as u,vf as a,wf as b,xf as c,zf as d}from"../chunk-hwan3cev.js";import"../chunk-qjk1v1gs.js";import"../chunk-gk58959n.js";import"../chunk-spx89gaw.js";export{d as CloudflareProvider,t as DnsProviderFactory,c as GoDaddyProvider,a as PROXIABLE_RECORD_TYPES,b as PorkbunProvider,i as Route53Provider,n as UnifiedDnsValidator,l as applyZoneMigration,r as createDnsProvider,p as createGoDaddyValidator,o as createPorkbunValidator,q as createRoute53Validator,s as detectDnsProvider,u as dnsProviders,j as exportRoute53Zone,k as planZoneMigration,e as policyTag,f as qualifyName,h as reconcileDeclaredRecords,g as resolveDeclaredRecords,m as verifyZoneParity};
+import{Af as e,Bf as f,Cf as g,Df as h,Ef as i,Ff as j,Gf as k,Hf as l,If as m,Jf as n,Kf as o,Lf as p,Mf as q,Nf as r,Of as s,Pf as t,Qf as u,vf as a,wf as b,xf as c,zf as d}from"../chunk-tz9myq9a.js";import"../chunk-y4xkj2f1.js";import"../chunk-mz0dk78z.js";import"../chunk-z2qqwy7e.js";export{d as CloudflareProvider,t as DnsProviderFactory,c as GoDaddyProvider,a as PROXIABLE_RECORD_TYPES,b as PorkbunProvider,i as Route53Provider,n as UnifiedDnsValidator,l as applyZoneMigration,r as createDnsProvider,p as createGoDaddyValidator,o as createPorkbunValidator,q as createRoute53Validator,s as detectDnsProvider,u as dnsProviders,j as exportRoute53Zone,k as planZoneMigration,e as policyTag,f as qualifyName,h as reconcileDeclaredRecords,g as resolveDeclaredRecords,m as verifyZoneParity};

package/dist/drivers/index.js

@@ -1 +1 @@
-import{$g as J,Ag as j,Ah as ha,Bg as k,Bh as ia,Cg as l,Ch as ja,Dg as m,Eg as n,Fg as o,Hg as p,Ig as q,Jg as r,Kg as s,Kh as ka,Lg as t,Lh as la,Mg as u,Mh as ma,Ng as v,Nh as na,Og as w,Oh as oa,Pg as x,Ph as pa,Qg as y,Qh as qa,Rg as z,Rh as ra,Sg as A,Tg as B,Ug as C,Vg as D,Wg as E,Xg as F,Yg as G,Zg as H,_g as I,ah as K,bh as L,ch as M,dh as N,eh as O,fh as P,gh as Q,hh as R,ih as S,jh as T,kh as U,lh as V,mh as W,nh as X,oh as Y,ph as Z,qh as _,rg as a,rh as aa,sg as b,sh as ba,tg as c,th as ca,ug as d,vg as e,wg as f,wh as da,xg as g,xh as ea,yg as h,yh as fa,zg as i,zh as ga}from"../chunk-7xpxzbkr.js";import"../chunk-hbhxk5a0.js";import"../chunk-8e0az001.js";import"../chunk-p6vszgc2.js";import"../chunk-gk58959n.js";import"../chunk-r5natbed.js";import"../chunk-b10cbk8z.js";import"../chunk-0hj552t7.js";import"../chunk-spx89gaw.js";export{ba as AwsBoxProvisioner,o as AwsDriver,x as CloudDriverFactory,a as DEFAULT_RPX_CERTS_DIR,aa as HetznerBoxProvisioner,p as HetznerClient,t as HetznerDriver,u as LocalBoxDriver,pa as MANAGED_CACHE_POLICY_DISABLED,oa as MANAGED_CACHE_POLICY_OPTIMIZED,qa as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,i as RPX_DIR,j as RPX_LAUNCHER_PATH,k as RPX_SERVICE_NAME,Z as UBUNTU_2404_AMI_PARAM,U as acquireResizeLock,N as applyHetznerHostOptimization,ha as buildAwsArtifactFetch,_ as buildBoxUserData,ra as buildCloudFrontOriginConfig,M as buildHetznerHostOptimizationScript,ja as buildHostCleanupScript,ia as buildLocalArtifactFetch,f as buildRpxConfig,m as buildRpxFragmentRefreshScript,g as buildRpxLbConfig,l as buildRpxProvisionScript,ea as buildSiteDeployScript,C as buildSshArgs,fa as buildStaticSiteDeployScript,y as cloudDrivers,O as collectHetznerHostOptimizationReport,I as collectHetznerResizeManifest,ca as createBoxProvisioner,w as createCloudDriver,la as deployAllComputeSites,ka as deploySiteRelease,e as deriveRouteId,W as ensureFirewall,X as ensureServer,V as ensureSshKey,B as executeHetznerServerResize,c as gatewayHostnames,n as generateUbuntuAppCloudInit,b as hasAutoWwwVariant,v as isBoxMode,A as isHetznerCapacityError,d as normalizeRoutePath,r as normalizeSshPublicKey,z as planHetznerServerResize,J as prepareHetznerResize,S as readResizeCheckpoint,ga as releaseTarballTmpPath,ma as reloadRpxGateway,h as renderRpxLauncher,na as renewRpxCertificates,Q as resizeCheckpointPath,R as resizeLockPath,da as resolveExecStart,q as resolveHetznerApiToken,L as resolveHetznerHostOptimizationPlan,F as scpUpload,Y as serverPublicIpv4,D as sshExec,E as sshExecOrThrow,P as verifyHetznerHostOptimization,K as verifyHetznerResize,H as waitForCloudInit,G as waitForSsh,s as wrapCloudInitUserData,T as writeResizeCheckpoint};
+import{$g as G,Ag as g,Ah as ea,Bg as h,Bh as fa,Cg as i,Ch as ga,Dg as j,Dh as ha,Eg as k,Eh as ia,Fg as l,Fh as ja,Gg as m,Hg as n,Ig as o,Kg as p,Lg as q,Mg as r,Ng as s,Nh as ka,Og as t,Oh as la,Pg as u,Ph as ma,Qg as v,Qh as na,Rg as w,Rh as oa,Sg as x,Sh as pa,Tg as y,Th as qa,Ug as z,Uh as ra,Vg as A,Wg as B,Xg as C,Yg as D,Zg as E,_g as F,ah as H,bh as I,ch as J,dh as K,eh as L,fh as M,gh as N,hh as O,ih as P,jh as Q,kh as R,lh as S,mh as T,nh as U,oh as V,ph as W,qh as X,rh as Y,sh as Z,th as _,ug as a,uh as aa,vg as b,vh as ba,wg as c,wh as ca,xg as d,yg as e,zg as f,zh as da}from"../chunk-t2a6r38z.js";import"../chunk-aj025v2s.js";import"../chunk-wavjkdb8.js";import"../chunk-nk7sav4r.js";import"../chunk-mz0dk78z.js";import"../chunk-hn40z11p.js";import"../chunk-x3hay61c.js";import"../chunk-zz52xje8.js";import"../chunk-z2qqwy7e.js";export{ba as AwsBoxProvisioner,o as AwsDriver,x as CloudDriverFactory,a as DEFAULT_RPX_CERTS_DIR,aa as HetznerBoxProvisioner,p as HetznerClient,t as HetznerDriver,u as LocalBoxDriver,pa as MANAGED_CACHE_POLICY_DISABLED,oa as MANAGED_CACHE_POLICY_OPTIMIZED,qa as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,i as RPX_DIR,j as RPX_LAUNCHER_PATH,k as RPX_SERVICE_NAME,Z as UBUNTU_2404_AMI_PARAM,U as acquireResizeLock,N as applyHetznerHostOptimization,ha as buildAwsArtifactFetch,_ as buildBoxUserData,ra as buildCloudFrontOriginConfig,M as buildHetznerHostOptimizationScript,ja as buildHostCleanupScript,ia as buildLocalArtifactFetch,f as buildRpxConfig,m as buildRpxFragmentRefreshScript,g as buildRpxLbConfig,l as buildRpxProvisionScript,ea as buildSiteDeployScript,C as buildSshArgs,fa as buildStaticSiteDeployScript,y as cloudDrivers,O as collectHetznerHostOptimizationReport,I as collectHetznerResizeManifest,ca as createBoxProvisioner,w as createCloudDriver,la as deployAllComputeSites,ka as deploySiteRelease,e as deriveRouteId,W as ensureFirewall,X as ensureServer,V as ensureSshKey,B as executeHetznerServerResize,c as gatewayHostnames,n as generateUbuntuAppCloudInit,b as hasAutoWwwVariant,v as isBoxMode,A as isHetznerCapacityError,d as normalizeRoutePath,r as normalizeSshPublicKey,z as planHetznerServerResize,J as prepareHetznerResize,S as readResizeCheckpoint,ga as releaseTarballTmpPath,ma as reloadRpxGateway,h as renderRpxLauncher,na as renewRpxCertificates,Q as resizeCheckpointPath,R as resizeLockPath,da as resolveExecStart,q as resolveHetznerApiToken,L as resolveHetznerHostOptimizationPlan,F as scpUpload,Y as serverPublicIpv4,D as sshExec,E as sshExecOrThrow,P as verifyHetznerHostOptimization,K as verifyHetznerResize,H as waitForCloudInit,G as waitForSsh,s as wrapCloudInitUserData,T as writeResizeCheckpoint};

package/dist/drivers/shared/mail-provision.d.ts

@@ -61,7 +61,7 @@ export declare function buildMailEnvFile(mail: ResolvedMailService): string;
 export declare function buildMailUnit(mail: ResolvedMailService): string;
 /** A DNS record an operator has to publish for mail to work. */
 export interface MailDnsRecord {
-    type: 'MX' | 'TXT' | 'CNAME';
+    type: 'MX' | 'TXT' | 'CNAME' | 'A';
     /** Record name, e.g. `example.com` or `default._domainkey.example.com`. */
     name: string;
     /**

package/dist/drivers/shared/mta-sts.d.ts

@@ -0,0 +1,89 @@
+/**
+ * MTA-STS — the policy that tells other mail servers TLS is not optional.
+ *
+ * SMTP's STARTTLS is opportunistic: a sender that cannot negotiate TLS delivers
+ * in plaintext instead, and an attacker who can strip the STARTTLS banner gets
+ * exactly that. MTA-STS (RFC 8461) is how a domain says "do not do that for
+ * me" — senders that honour it refuse to deliver unless the connection is
+ * authenticated TLS to a listed MX.
+ *
+ * It has two halves, and this module exists because half of it is worse than
+ * none:
+ *
+ *   1. a `_mta-sts.<domain>` TXT record advertising a policy id;
+ *   2. the policy itself, served at
+ *      `https://mta-sts.<domain>/.well-known/mta-sts.txt`.
+ *
+ * A domain that publishes the record and does not serve the policy has told
+ * every sender to go looking for a file that 404s. They fall back to
+ * opportunistic TLS — so mail keeps flowing and nothing breaks, which is
+ * precisely why this stays broken for years once it happens. stacksjs.com had
+ * exactly that state.
+ *
+ * ## Why the policy is served by a listener rather than redirected
+ *
+ * RFC 8461 §3.3 requires the policy to be fetched over HTTPS with a certificate
+ * valid for `mta-sts.<domain>`, and forbids following redirects. So the policy
+ * cannot be pointed at a file living somewhere more convenient: the host needs
+ * its own vhost, its own certificate, and something answering on it.
+ */
+import type { ResolvedMailService } from '@ts-cloud/core';
+/**
+ * How strictly senders should apply the policy.
+ *
+ * - `testing` — report failures, deliver anyway. Where a new policy starts.
+ * - `enforce` — refuse to deliver when TLS to a listed MX cannot be
+ *   authenticated. This is the mode that can bounce real mail, and it is only
+ *   safe once the MX set is right and its certificate is valid for the MX name.
+ * - `none` — the documented way to retire a policy. Publish it, let the old
+ *   `max_age` lapse, and only then remove the record; deleting the record while
+ *   senders still cache an `enforce` policy leaves them enforcing a policy the
+ *   domain no longer has.
+ */
+export type MtaStsMode = 'testing' | 'enforce' | 'none';
+export interface MtaStsPolicy {
+    /** Host the policy is served from — `mta-sts.<domain>`. */
+    host: string;
+    /** The file's contents, served at `/.well-known/mta-sts.txt`. */
+    body: string;
+    /**
+     * Policy id for the TXT record.
+     *
+     * Derived from the policy body, not from a timestamp. Senders cache by id and
+     * only refetch when it changes, so an id that moves on every deploy causes
+     * pointless refetches, and one that never moves means a corrected MX list is
+     * ignored until `max_age` lapses. Content-derived, both problems go away.
+     */
+    id: string;
+    /** `_mta-sts.<domain>` TXT value. */
+    txt: string;
+}
+/**
+ * Build the policy for one domain.
+ *
+ * `mx` lists the hostnames senders may deliver to. It defaults to the mail
+ * server's own hostname because that is what ts-cloud's MX record points at;
+ * a domain whose mail also lands somewhere else must list that host too, or
+ * `enforce` will reject the mail it delivers there.
+ */
+export declare function buildMtaStsPolicy(mail: Pick<ResolvedMailService, 'hostname'>, domain: string, options?: {
+    mode?: MtaStsMode;
+    maxAge?: number;
+    mx?: string[];
+}): MtaStsPolicy;
+/**
+ * The port the policy listener binds on the box.
+ *
+ * 8461 is the RFC number, which makes it recognisable in an `ss -lntp` beside a
+ * dozen application ports that all look alike.
+ */
+export declare const MTA_STS_PORT = 8461;
+/**
+ * A listener that serves exactly one file and nothing else.
+ *
+ * Deliberately not a static-file server pointed at a directory: this vhost is
+ * reachable from the whole internet and has one legitimate URL, so anything it
+ * can be persuaded to serve beyond that is surface for no benefit. Every other
+ * path is a 404, including `/`.
+ */
+export declare function buildMtaStsServer(policy: MtaStsPolicy, port?: number): string;

package/dist/drivers/shared/mta-sts.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/index.d.ts

@@ -50,6 +50,8 @@ export * from './backups';
 export * from './configuration';
 export type { DnsProvider, DnsProviderConfig, DnsRecord, DnsRecordType, DnsRecordResult, CreateRecordResult, DeleteRecordResult, ListRecordsResult, } from './dns';
 export { PROXIABLE_RECORD_TYPES } from './dns';
+export type { MtaStsMode, MtaStsPolicy } from './drivers/shared/mta-sts';
+export { buildMtaStsPolicy, buildMtaStsServer, MTA_STS_PORT } from './drivers/shared/mta-sts';
 export type { MigratedRecord, SkippedRecord, ZoneMigrationPlan, ZoneMigrationReport, ZoneParityReport, } from './dns';
 export { applyZoneMigration, exportRoute53Zone, planZoneMigration, verifyZoneParity, } from './dns';
 export type { DeclaredRecord, DeclaredRecordInput, DeclaredRecordOutcome, DeclaredRecordsReport, } from './dns';

package/dist/index.js

@@ -1,4 +1,4 @@
-import{$ as Vg,$a as wC,$b as wS,$c as JS,A as Ef,Aa as rC,Ab as rS,B as wf,Ba as nC,Bb as nS,Bc as yi,C as vf,Ca as iC,Cb as iS,Cc as Ci,D as Of,Da as oC,Db as oS,Dc as Si,E as gg,Ea as aC,Eb as aS,Ec as Ai,F as hg,Fa as sC,Fb as sS,Fc as bi,G as yg,Ga as cC,Gb as cS,Gc as Ri,H as Cg,Ha as lC,Hb as lS,Hc as Ti,I as Sg,Ia as dC,Ib as dS,J as Ag,Ja as uC,Jb as uS,K as bg,Ka as pC,Kb as pS,L as Rg,La as mC,Lb as mS,M as Tg,Ma as fC,Mb as fS,N as $g,Na as gC,Nb as gS,O as Pg,Oa as hC,Ob as hS,P as Ig,Pa as yC,Pb as yS,Pc as VS,Q as Dg,Qa as CC,Qb as CS,Qc as _S,R as Eg,Ra as SC,Rb as SS,Rc as BS,S as wg,Sa as AC,Sb as AS,Sc as WS,T as vg,Ta as bC,Tb as bS,Tc as zS,U as Og,Ua as RC,Ub as RS,Uc as HS,V as Ng,Va as TC,Vb as TS,Vc as GS,W as kg,Wa as $C,Wb as $S,Wc as KS,X as xg,Xa as PC,Xb as PS,Xc as US,Y as Lg,Ya as IC,Yb as IS,Yc as ZS,Z as Mg,Za as DC,Zb as DS,Zc as jS,_ as Fg,_a as EC,_b as ES,_c as qS,a as _m,aa as _g,ab as vC,ac as vS,ad as YS,b as Bm,ba as Bg,bb as OC,bc as OS,bd as QS,c as Wm,ca as Ny,cb as NC,cc as NS,cd as XS,d as zm,da as ky,db as kC,dc as kS,dd as eA,e as Hm,ea as xy,eb as xC,ec as xS,ed as tA,f as Gm,fa as Ly,fb as LC,fc as LS,fd as rA,g as Km,ga as My,gb as MC,gc as MS,gd as nA,h as Um,ha as Fy,hb as FC,hc as FS,hd as iA,i as Zm,ia as Vy,ib as VC,id as oA,j as jm,ja as _y,jb as _C,jd as aA,k as qm,ka as By,kb as BC,kd as sA,l as Jm,la as Wy,lb as WC,ld as cA,m as Ym,ma as zy,mb as zC,md as lA,n as Qm,na as Hy,nb as HC,nd as dA,o as Xm,oa as Gy,ob as GC,od as $i,p as ef,pa as Ky,pb as KC,pc as gi,pd as Pi,q as tf,qa as Uy,qb as UC,qd as Ii,r as rf,ra as Zy,rb as ZC,rd as Di,s as nf,sa as jy,sb as jC,t as of,ta as qy,tb as qC,u as af,ua as Jy,ub as JC,v as sf,va as Yy,vb as YC,w as cf,wa as Qy,wb as QC,x as lf,xa as Xy,xb as XC,y as If,ya as eC,yb as eS,z as Df,za as tC,zb as tS}from"./chunk-7pff0rv9.js";import{Ad as fi,sd as ai,td as si,ud as ci,vd as li,wd as di,xd as ui,yd as pi,zd as mi}from"./chunk-6v4k9ekm.js";import{Id as hi}from"./chunk-1ypkh8g6.js";import{$d as Dr,Be as Mr,Fe as Fr,Jd as Vt,Ld as _t,Le as Vr,Md as Bt,Nd as Wt,Od as zt,Oe as _r,Pd as Ht,Pe as Br,Qd as Gt,Qe as Wr,Re as zr,Sd as Ut,Td as yr,Ud as Sr,Vd as Ar,Wd as br,We as Hr,Xd as Rr,Yd as Tr,Zd as $r,_d as Pr,ae as Er,be as wr,ce as vr,de as Or,ef as Gr,if as Kr,ke as Nr,nf as Ur,pe as kr,te as xr,xe as Lr}from"./chunk-h1rc94df.js";import{of as At,pf as Rt,qf as Tt}from"./chunk-nnqxmh7f.js";import{sf as Me}from"./chunk-q2njk4hx.js";import{tf as hr}from"./chunk-ky5c6t5y.js";import{uf as Ir}from"./chunk-t0kh8haz.js";import{Af as Qt,Bf as Xt,Cf as er,Df as tr,Ef as rr,Ff as nr,Gf as ir,Hf as or,If as ar,Jf as sr,Kf as cr,Lf as lr,Mf as dr,Nf as q,Of as ur,Pf as pr,Qf as mr,Rf as fr,Sf as gr,vf as Zt,wf as jt,xf as qt,yf as Jt,zf as Yt}from"./chunk-hwan3cev.js";import{Tf as j}from"./chunk-qjk1v1gs.js";import{Ch as Mn,Dh as Fn,Eg as mn,Eh as Vn,Fg as fn,Fh as _n,Gh as Bn,Hg as gn,Hh as Wn,Ig as hn,Ih as zn,Jg as yn,Kg as Cn,Kh as Hn,Lg as Sn,Lh as Gn,Mh as Kn,Nh as Un,Og as An,Pg as bn,Qg as Rn,Uf as Zr,Ug as Tn,Vf as jr,Vg as $n,Wf as qr,Wg as Pn,Xf as Jr,Xg as In,Yf as ue,Yg as Dn,Zf as Yr,Zg as En,_f as Qr,fg as Ee,ig as Xr,jg as en,kg as tn,lg as rn,lh as wn,mh as vn,ng as nn,nh as On,og as on,oh as Nn,sg as an,tg as pe,wh as kn,xh as xn,yh as Ln}from"./chunk-7xpxzbkr.js";import{Sh as Kt,Th as Cr}from"./chunk-hbhxk5a0.js";import{Uh as Le}from"./chunk-8e0az001.js";import{Wh as bt}from"./chunk-p6vszgc2.js";import{Yh as St}from"./chunk-gk58959n.js";import{$h as df,$i as zg,$j as zh,Ai as Hf,Aj as gh,Ak as dy,Bi as Gf,Bj as hh,Bk as uy,Ci as Kf,Cj as yh,Ck as py,Di as Uf,Dj as Ch,Dk as my,Ei as Zf,Ej as Sh,Ek as fy,Fi as jf,Fj as Ah,Fk as wt,Gi as qf,Gj as bh,Gk as gy,Hi as Jf,Hj as Rh,Hk as hy,Ii as Yf,Ij as Th,Ik as yy,Ji as Qf,Jj as $h,Jk as Cy,Ki as Xf,Kj as Ph,Kk as Sy,Li as eg,Lj as Ih,Lk as Ay,Mi as tg,Mj as Dh,Mk as by,Ni as rg,Nj as Eh,Nk as Ry,Oi as ng,Oj as wh,Ok as Ty,Pi as ig,Pj as vh,Pk as $y,Qi as og,Qj as Oh,Qk as Py,Ri as ag,Rj as Nh,Rk as Iy,Si as sg,Sj as kh,Sk as Dy,Ti as cg,Tj as xh,Tk as Ey,Ui as lg,Uj as Lh,Uk as wy,Vi as dg,Vj as Mh,Vk as vy,Wi as ug,Wj as Fh,Wk as Oy,Xi as pg,Xj as Vh,Yi as mg,Yj as _h,Zi as fg,Zj as Bh,_i as Wg,_j as Wh,ai as uf,aj as Hg,ak as Hh,bi as pf,bj as Gg,bk as Gh,ci as mf,cj as Kg,ck as Kh,di as ff,dj as Ug,dk as Uh,ei as gf,ej as Zg,ek as Zh,fi as hf,fj as jg,fk as jh,gi as yf,gj as qg,gk as qh,hi as Cf,hj as Jg,hk as Jh,ii as Sf,ij as Yg,ik as Yh,ji as Af,jj as Qg,jk as Qh,ki as bf,kj as Xg,kk as Xh,li as Rf,lj as eh,lk as ey,mi as Tf,mj as th,mk as ty,ni as $f,nj as rh,nk as $t,oi as Pf,oj as nh,ok as Pt,pi as Nf,pj as ih,pk as It,qi as kf,qj as oh,qk as Dt,ri as xf,rj as ah,rk as Et,si as Lf,sj as sh,sk as ry,ti as Mf,tj as ch,tk as ny,ui as Ff,uj as lh,uk as iy,vi as Vf,vj as dh,vk as oy,wi as _f,wj as uh,wk as ay,xi as Bf,xj as ph,xk as sy,yi as Wf,yj as mh,yk as cy,zi as zf,zj as fh,zk as ly}from"./chunk-s3rpd72x.js";import{$k as Yn,Xk as Zn,Yk as jn,Zk as qn,_k as Jn,al as Qn,bl as Xn,dl as ei,el as ti,fl as ri,gl as ni,hl as ii,il as oi}from"./chunk-vz95qy3n.js";import{kl as sn,ll as cn,ml as ln,nl as dn,ol as un,pl as pn}from"./chunk-r5natbed.js";import{ql as vt,rl as Ot,sl as Nt,tl as kt,ul as xt,vl as Lt,wl as Mt,xl as Ft}from"./chunk-b10cbk8z.js";import{$l as za,$m as Ts,$n as Tc,$o as Tl,$p as Td,$q as Tu,$r as Tp,$s as mm,Al as ga,Am as Re,An as Js,Ao as Jc,Ap as Jl,Aq as Jd,Ar as Ju,As as Jp,Bl as ha,Bm as K,Bn as Ys,Bo as Yc,Bp as Yl,Bq as Yd,Br as Yu,Bs as Yp,Cl as ya,Cm as L,Cn as Qs,Co as Qc,Cp as Ql,Cq as Qd,Cr as Qu,Cs as Qp,Dl as Ca,Dm as ls,Dn as Xs,Do as Xc,Dp as Xl,Dq as Xd,Dr as Xu,Ds as Xp,El as Sa,Em as ds,En as ec,Eo as el,Ep as ed,Eq as eu,Er as ep,Es as em,Fl as Aa,Fm as te,Fn as tc,Fo as tl,Fp as td,Fq as tu,Fr as tp,Fs as tm,Gl as ba,Gm as us,Gn as rc,Go as rl,Gp as rd,Gq as ru,Gr as rp,Gs as rm,Hl as Ra,Hm as ps,Hn as nc,Ho as nl,Hp as nd,Hq as nu,Hr as np,Hs as nm,Il as Ta,Im as ms,In as ic,Io as il,Ip as id,Iq as iu,Ir as ip,Is as im,Jl as $a,Jm as fs,Jn as oc,Jo as ol,Jp as od,Jq as ou,Jr as op,Js as om,Kl as Pa,Km as Te,Kn as ac,Ko as al,Kp as ad,Kq as au,Kr as ap,Ks as lt,Ll as Ia,Lm as M,Ln as sc,Lo as sl,Lp as sd,Lq as su,Lr as sp,Ls as dt,Ml as Da,Mm as U,Mn as cc,Mo as cl,Mp as cd,Mq as cu,Mr as cp,Ms as ut,Nl as Ea,Nm as re,Nn as lc,No as ll,Np as ld,Nq as lu,Nr as lp,Ns as pt,Ol as wa,Om as $e,On as dc,Oo as dl,Op as dd,Oq as du,Or as dp,Os as mt,Pl as va,Pm as Pe,Pn as uc,Po as ul,Pp as ud,Pq as uu,Pr as up,Ps as ft,Ql as Oa,Qm as gs,Qn as pc,Qo as pl,Qp as pd,Qq as pu,Qr as pp,Qs as gt,Rl as Na,Rm as hs,Rn as mc,Ro as ml,Rp as md,Rq as mu,Rr as mp,Rs as ht,Sl as ka,Sm as Ie,Sn as fc,So as fl,Sp as fd,Sq as fu,Sr as fp,Ss as yt,Tl as xa,Tm as ys,Tn as gc,To as gl,Tp as gd,Tq as gu,Tr as gp,Ts as Ct,Ul as La,Um as Cs,Un as hc,Uo as hl,Up as hd,Uq as hu,Ur as hp,Us as am,Vl as Ma,Vm as Ss,Vn as yc,Vo as yl,Vp as yd,Vq as yu,Vr as yp,Vs as sm,Wl as Fa,Wm as As,Wn as Cc,Wo as Cl,Wp as Cd,Wq as Cu,Wr as Cp,Ws as cm,Xl as Va,Xm as bs,Xn as Sc,Xo as Sl,Xp as Sd,Xq as Su,Xr as Sp,Xs as lm,Yl as _a,Ym as De,Yn as Ac,Yo as Al,Yp as Ad,Yq as Au,Yr as Ap,Ys as dm,Zl as Ba,Zm as Z,Zn as bc,Zo as bl,Zp as bd,Zq as bu,Zr as bp,Zs as um,_l as Wa,_m as Rs,_n as Rc,_o as Rl,_p as Rd,_q as Ru,_r as Rp,_s as pm,am as Ha,an as $s,ao as $c,ap as $l,aq as $d,ar as $u,as as $p,at as fm,bm as Ga,bn as Ps,bo as Pc,bp as Pl,bq as Pd,br as Pu,bs as Pp,bt as gm,cm as Se,cn as Is,co as Ic,cp as Il,cq as Id,cr as Iu,cs as Ip,ct as hm,dm as Ka,dn as Ds,do as Dc,dp as Dl,dq as Dd,dr as Du,ds as Dp,dt as ym,em as Ae,en as Es,eo as Ec,ep as El,eq as Ed,er as Eu,es as Ep,et as Cm,fm as be,fn as ws,fo as wc,fp as wl,fq as wd,fr as wu,fs as wp,ft as Sm,gm as Ua,gn as vs,go as vc,gp as vl,gq as vd,gr as vu,gs as vp,gt as Am,hm as Za,hn as Os,ho as Oc,hp as Ol,hq as Od,hr as Ou,hs as Op,ht as bm,im as ja,in as Ns,io as Nc,ip as Nl,iq as Nd,ir as Nu,is as Np,it as Rm,jm as qa,jn as ks,jo as kc,jp as kl,jq as kd,jr as ku,js as kp,jt as Tm,km as Ja,kn as xs,ko as xc,kp as xl,kq as xd,kr as xu,ks as xp,kt as $m,lm as Ya,ln as Ls,lo as Lc,lp as Ll,lq as Ld,lr as Lu,ls as Lp,lt as Pm,mm as Qa,mn as Ms,mo as Mc,mp as Ml,mq as Md,mr as Mu,ms as Mp,mt as Im,nm as Xa,nn as Fs,no as Fc,np as Fl,nq as Fd,nr as Fu,ns as Fp,nt as Dm,om as es,on as Vs,oo as Vc,op as Vl,oq as Vd,or as Vu,os as Vp,ot as Em,pm as ts,pn as _s,po as _c,pp as _l,pq as _d,pr as _u,ps as _p,pt as wm,qm as rs,qn as Bs,qo as Bc,qp as Bl,qq as Bd,qr as Bu,qs as Bp,qt as vm,rm as ns,rn as Ws,ro as Wc,rp as Wl,rq as Wd,rr as Wu,rs as Wp,rt as Om,sm as is,sn as zs,so as zc,sp as zl,sq as zd,sr as zu,ss as zp,st as Nm,tm as os,tn as Hs,to as Hc,tp as Hl,tq as Hd,tr as Hu,ts as Hp,tt as km,um as X,un as Gs,uo as Gc,up as Gl,uq as Gd,ur as Gu,us as Gp,ut as xm,vm as as,vn as Ks,vo as Kc,vp as Kl,vq as Kd,vr as Ku,vs as Kp,vt as Lm,wm as ss,wn as Us,wo as Uc,wp as Ul,wq as Ud,wr as Uu,ws as Up,wt as Mm,xm as cs,xn as Zs,xo as Zc,xp as Zl,xq as Zd,xr as Zu,xs as Zp,xt as Fm,yl as ma,ym as ee,yn as js,yo as jc,yp as jl,yq as jd,yr as ju,ys as jp,yt as Vm,zl as fa,zm as w,zn as qs,zo as qc,zp as ql,zq as qd,zr as qu,zs as qp}from"./chunk-0hj552t7.js";import{zt as Je}from"./chunk-spx89gaw.js";import{createHmac as fe,createSign as _e,timingSafeEqual as Be}from"node:crypto";function B(e){let t=e instanceof Date?e.getTime():e;if(!Number.isFinite(t))throw TypeError("Media access timestamp must be finite");return Math.floor(t/1000)}function ge(e){return Buffer.from(e).toString("base64").replaceAll("+","-").replaceAll("=","_").replaceAll("/","~")}function We(e){return Buffer.from(e).toString("base64url")}function he(e,t=!1){if(!e||/[\r\n]/.test(e))throw TypeError("Media resource is invalid");let r=t?e.replaceAll("*","wildcard"):e,n=new URL(r);if(!["http:","https:"].includes(n.protocol))throw TypeError("Media resource must use HTTP or HTTPS");if(!t&&e.includes("*"))throw TypeError("Canned policies cannot contain wildcards")}function ye(e,t){let r=_e("RSA-SHA1");return r.update(e),r.end(),ge(r.sign(t))}function Ce(e){he(e.resource,!0);let r={DateLessThan:{"AWS:EpochTime":B(e.expiresAt)}};if(e.activeAt!==void 0)r.DateGreaterThan={"AWS:EpochTime":B(e.activeAt)};if(e.ipAddress)r.IpAddress={"AWS:SourceIp":e.ipAddress};return JSON.stringify({Statement:[{Resource:e.resource,Condition:r}]})}function wi(e,t,r){he(e);let n=B(t),o=e.includes("?")?"&":"?",l=Ce({resource:e,expiresAt:t}),c=ye(l,r.privateKey);return`${e}${o}Expires=${n}&Signature=${encodeURIComponent(c)}&Key-Pair-Id=${encodeURIComponent(r.keyPairId)}`}function vi(e,t){let r=Ce(e);return{"CloudFront-Key-Pair-Id":t.keyPairId,"CloudFront-Policy":ge(Buffer.from(r)),"CloudFront-Signature":ye(r,t.privateKey)}}function Oi(e){if(!e.resource||/[\r\n]/.test(e.resource))throw TypeError("Media resource is invalid");let t=We(Buffer.from(JSON.stringify({resource:e.resource,expiresAt:B(e.expiresAt),...e.keyId?{keyId:e.keyId}:{},...e.audience?{audience:e.audience}:{}}))),r=fe("sha256",e.secret).update(t).digest("base64url");return`${t}.${r}`}function Ni(e,t){let[r,n,o]=e.split(".");if(!r||!n||o)return null;let l=fe("sha256",t.secret).update(r).digest(),c;try{c=Buffer.from(n,"base64url")}catch{return null}if(l.length!==c.length||!Be(l,c))return null;try{let s=JSON.parse(Buffer.from(r,"base64url").toString("utf8")),d=B(t.now??Date.now());if(!s.resource||!Number.isSafeInteger(s.expiresAt)||s.expiresAt<=d)return null;if(t.resource&&s.resource!==t.resource)return null;if(t.audience&&s.audience!==t.audience)return null;return s}catch{return null}}function ki(e,t=!1){let r=new URL(e,"https://media.invalid").pathname.toLowerCase(),n=/\.(?:m3u8|mpd|vtt|json)$/.test(r),o=/\.(?:key|license)$/.test(r)||r.includes("/keys/")||r.includes("/licenses/");return{"Accept-Ranges":"bytes","Cache-Control":t&&(n||o)?"private, no-store":n?"public, max-age=5, s-maxage=30, stale-while-revalidate=30":"public, max-age=31536000, immutable","Cross-Origin-Resource-Policy":"cross-origin","X-Content-Type-Options":"nosniff"}}function xi(e){if(!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(e.bucket))throw TypeError("Media bucket is invalid");if(!/^[a-z0-9-]+$/.test(e.region))throw TypeError("Media bucket region is invalid");let t=e.prefix?`/${e.prefix.replace(/^\/+|\/+$/g,"")}`:"",r=e.protected??!1,n="public, max-age=31536000, immutable",o=r?"private, no-store":"public, max-age=5, s-maxage=30, stale-while-revalidate=30";return{originDomain:`${e.bucket}.s3.${e.region}.amazonaws.com`,originPath:t,domain:e.domain,trustedKeyGroupIds:[...new Set(e.trustedKeyGroupIds??[])],behaviors:[{pathPattern:"*.m3u8",cacheControl:o,compress:!0,signed:r},{pathPattern:"*.mpd",cacheControl:o,compress:!0,signed:r},{pathPattern:"*.vtt",cacheControl:o,compress:!0,signed:r},{pathPattern:"*",cacheControl:n,compress:!1,signed:r}],responseHeaders:{"Access-Control-Allow-Headers":"Range, If-Range","Access-Control-Allow-Methods":"GET, HEAD, OPTIONS","Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":"Accept-Ranges, Content-Length, Content-Range, ETag","X-Content-Type-Options":"nosniff"}}}class ze{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;constructor(e){this.config=e.config,this.environment=e.environment,this.builder=new Se(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let t=this.config.environments[this.environment]?.infrastructure;if(!t)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...t,compute:{...this.config.infrastructure?.compute,...t.compute},storage:{...this.config.infrastructure?.storage,...t.storage},functions:{...this.config.infrastructure?.functions,...t.functions},servers:{...this.config.infrastructure?.servers,...t.servers},databases:{...this.config.infrastructure?.databases,...t.databases},cdn:{...this.config.infrastructure?.cdn,...t.cdn},sftp:t.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...t.queues},redirects:{...this.config.infrastructure?.redirects,...t.redirects},realtime:{...this.config.infrastructure?.realtime,...t.realtime},cache:{...this.config.infrastructure?.cache,...t.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...t.fileSystem},email:{...this.config.infrastructure?.email,...t.email},search:{...this.config.infrastructure?.search,...t.search},ai:{...this.config.infrastructure?.ai,...t.ai}}}}shouldDeploy(e){if(e.environments&&!e.environments.includes(this.environment))return!1;if(e.requiresFeatures){let t=this.config.features||{};if(!e.requiresFeatures.every((n)=>t[n]===!0))return!1}if(e.regions){let t=this.config.environments[this.environment]?.region||this.config.project.region;if(!e.regions.includes(t))return!1}if(e.condition&&typeof e.condition==="function")return e.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let e=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,t=Number(e||3008);return Number.isFinite(t)&&t>0?t:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(e,t){return e==="public"||t.routeCompute===!0}storageBucketName(e,t,r){return this.mergedConfig.infrastructure?.storage?.[r]?.bucket??`${e}-${t}-${r}`}fileSystemLogicalId(e,t,r){return be(Ae({slug:`${e}-${r}`,environment:t,resourceType:"efs"}))}resolveSftpStorage(e,t,r){let n=e.storage;if(n?.type==="efs"&&n.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[n.fileSystem])throw Error(`sftp: storage.fileSystem "${n.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(t,r,n.fileSystem)},posixProfile:n.posixProfile}}if(n?.type==="s3"&&n.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[n.storageBucket])throw Error(`sftp: storage.storageBucket "${n.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(t,r,n.storageBucket)}}return}resolveComputeCachePathPatterns(e){if(e&&e.length>0)return e;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(e,t){return{PathPattern:e,TargetOriginId:t,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(e,t,r,n,o,l){let c=this.serverEipLogicalIds.get("app"),s=this.serverEipLogicalIds.get("appInstance");if(!c)return;let d=`EC2-${n}-${o}-api`,h=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",u=h==="us-east-1"?".compute-1.amazonaws.com":`.${h}.compute.amazonaws.com`,b={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:c}]}]},u]]},A=this.resolveApiOriginPort();if(e.push({Id:d,DomainName:b,CustomOriginConfig:{HTTPPort:A,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),r.push(c),s)r.push(s);for(let T of l)t.push(this.createComputeCacheBehavior(T,d))}buildCaddyfile(e){let t=e.filter(([,o])=>typeof o.domain==="string"&&o.domain&&typeof o.port==="number");if(t.length===0)return;let r=new Map;for(let[,o]of t){let l=r.get(o.domain)??[];l.push({port:o.port,path:o.path}),r.set(o.domain,l)}let n=[];for(let[o,l]of r){let s=[...l].sort((d,h)=>{let u=!d.path||d.path==="/",b=!h.path||h.path==="/";if(u&&!b)return 1;if(!u&&b)return-1;return(h.path?.length??0)-(d.path?.length??0)}).map((d)=>{let h=!d.path||d.path==="/",u=`reverse_proxy localhost:${d.port}`;return h?`  handle {
+import{$ as zg,$a as kC,$b as kS,$c as eA,A as Nf,Aa as aC,Ab as aS,B as kf,Ba as sC,Bb as sS,Bc as Ai,C as xf,Ca as cC,Cb as cS,Cc as bi,D as Lf,Da as lC,Db as lS,Dc as Ri,E as Sg,Ea as dC,Eb as dS,Ec as Ti,F as Ag,Fa as uC,Fb as uS,Fc as $i,G as bg,Ga as pC,Gb as pS,Gc as Pi,H as Rg,Ha as mC,Hb as mS,Hc as Ii,I as Tg,Ia as fC,Ib as fS,J as $g,Ja as gC,Jb as gS,K as Pg,Ka as hC,Kb as hS,L as Ig,La as yC,Lb as yS,M as Dg,Ma as CC,Mb as CS,N as Eg,Na as SC,Nb as SS,O as wg,Oa as AC,Ob as AS,P as vg,Pa as bC,Pb as bS,Pc as zS,Q as Og,Qa as RC,Qb as RS,Qc as HS,R as Ng,Ra as TC,Rb as TS,Rc as GS,S as kg,Sa as $C,Sb as $S,Sc as KS,T as xg,Ta as PC,Tb as PS,Tc as US,U as Lg,Ua as IC,Ub as IS,Uc as ZS,V as Mg,Va as DC,Vb as DS,Vc as jS,W as Fg,Wa as EC,Wb as ES,Wc as qS,X as Vg,Xa as wC,Xb as wS,Xc as JS,Y as _g,Ya as vC,Yb as vS,Yc as YS,Z as Bg,Za as OC,Zb as OS,Zc as QS,_ as Wg,_a as NC,_b as NS,_c as XS,a as Hm,aa as Hg,ab as xC,ac as xS,ad as tA,b as Gm,ba as Gg,bb as LC,bc as LS,bd as rA,c as Km,ca as My,cb as MC,cc as MS,cd as nA,d as Um,da as Fy,db as FC,dc as FS,dd as iA,e as Zm,ea as Vy,eb as VC,ec as VS,ed as oA,f as jm,fa as _y,fb as _C,fc as _S,fd as aA,g as qm,ga as By,gb as BC,gc as BS,gd as sA,h as Jm,ha as Wy,hb as WC,hc as WS,hd as cA,i as Ym,ia as zy,ib as zC,id as lA,j as Qm,ja as Hy,jb as HC,jd as dA,k as Xm,ka as Gy,kb as GC,kd as uA,l as ef,la as Ky,lb as KC,ld as pA,m as tf,ma as Uy,mb as UC,md as mA,n as rf,na as Zy,nb as ZC,nd as fA,o as nf,oa as jy,ob as jC,od as Di,p as of,pa as qy,pb as qC,pc as Ci,pd as Ei,q as af,qa as Jy,qb as JC,qd as wi,r as sf,ra as Yy,rb as YC,rd as vi,s as cf,sa as Qy,sb as QC,t as lf,ta as Xy,tb as XC,u as df,ua as eC,ub as eS,v as uf,va as tC,vb as tS,w as pf,wa as rC,wb as rS,x as mf,xa as nC,xb as nS,y as vf,ya as iC,yb as iS,z as Of,za as oC,zb as oS}from"./chunk-9pa96r7f.js";import{Ad as yi,sd as li,td as di,ud as ui,vd as pi,wd as mi,xd as fi,yd as gi,zd as hi}from"./chunk-zam6ecam.js";import{Id as Si}from"./chunk-dr4pj8hp.js";import{$d as Dr,Be as Mr,Fe as Fr,Jd as Vt,Ld as _t,Le as Vr,Md as Bt,Nd as Wt,Od as zt,Oe as _r,Pd as Ht,Pe as Br,Qd as Gt,Qe as Wr,Re as zr,Sd as Ut,Td as yr,Ud as Sr,Vd as Ar,Wd as br,We as Hr,Xd as Rr,Yd as Tr,Zd as $r,_d as Pr,ae as Er,be as wr,ce as vr,de as Or,ef as Gr,if as Kr,ke as Nr,nf as Ur,pe as kr,te as xr,xe as Lr}from"./chunk-q0rc1ax9.js";import{of as At,pf as Rt,qf as Tt}from"./chunk-kasdm9tx.js";import{sf as Me}from"./chunk-by2bwzk6.js";import{tf as hr}from"./chunk-73ztr55z.js";import{uf as Ir}from"./chunk-xcj8zfmg.js";import{Af as Qt,Bf as Xt,Cf as er,Df as tr,Ef as rr,Ff as nr,Gf as ir,Hf as or,If as ar,Jf as sr,Kf as cr,Lf as lr,Mf as dr,Nf as q,Of as ur,Pf as pr,Qf as mr,Rf as fr,Sf as gr,vf as Zt,wf as jt,xf as qt,yf as Jt,zf as Yt}from"./chunk-tz9myq9a.js";import{Tf as j}from"./chunk-y4xkj2f1.js";import{$f as Xr,$g as vn,Ah as Fn,Bh as Vn,Fh as _n,Gh as Bn,Hg as hn,Hh as Wn,Ig as yn,Ih as zn,Jh as Hn,Kg as Cn,Kh as Gn,Lg as Sn,Lh as Kn,Mg as An,Ng as bn,Nh as Un,Og as Rn,Oh as Zn,Ph as jn,Qh as qn,Rg as Tn,Sg as $n,Tg as Pn,Uf as Zr,Vf as jr,Wf as qr,Xf as Jr,Xg as In,Yf as ue,Yg as Dn,Zf as Yr,Zg as En,_f as Qr,_g as wn,ag as en,ah as On,bg as tn,ig as Ee,lg as rn,mg as nn,ng as on,og as an,oh as Nn,ph as kn,qg as sn,qh as xn,rg as cn,rh as Ln,vg as ln,wg as pe,zh as Mn}from"./chunk-t2a6r38z.js";import{Vh as Kt,Wh as Cr}from"./chunk-aj025v2s.js";import{Xh as Le}from"./chunk-wavjkdb8.js";import{Zh as bt}from"./chunk-nk7sav4r.js";import{$h as St}from"./chunk-mz0dk78z.js";import{$i as yg,$j as Hh,Ai as Gf,Aj as hh,Ak as uy,Bi as Kf,Bj as yh,Bk as py,Ci as Uf,Cj as Ch,Ck as my,Di as Zf,Dj as Sh,Dk as fy,Ei as jf,Ej as Ah,Ek as gy,Fi as qf,Fj as bh,Fk as hy,Gi as Jf,Gj as Rh,Gk as yy,Hi as Yf,Hj as Th,Hk as Cy,Ii as Qf,Ij as $h,Ik as wt,Ji as Xf,Jj as Ph,Jk as Sy,Ki as eg,Kj as Ih,Kk as Ay,Li as tg,Lj as Dh,Lk as by,Mi as rg,Mj as Eh,Mk as Ry,Ni as ng,Nj as wh,Nk as Ty,Oi as ig,Oj as vh,Ok as $y,Pi as og,Pj as Oh,Pk as Py,Qi as ag,Qj as Nh,Qk as Iy,Ri as sg,Rj as kh,Rk as Dy,Si as cg,Sj as xh,Sk as Ey,Ti as lg,Tj as Lh,Tk as wy,Ui as dg,Uj as Mh,Uk as vy,Vi as ug,Vj as Fh,Vk as Oy,Wi as pg,Wj as Vh,Wk as Ny,Xi as mg,Xj as _h,Xk as ky,Yi as fg,Yj as Bh,Yk as xy,Zi as gg,Zj as Wh,Zk as Ly,_i as hg,_j as zh,aj as Cg,ak as Gh,bj as Kg,bk as Kh,ci as ff,cj as Ug,ck as Uh,di as gf,dj as Zg,dk as Zh,ei as hf,ej as jg,ek as jh,fi as yf,fj as qg,fk as qh,gi as Cf,gj as Jg,gk as Jh,hi as Sf,hj as Yg,hk as Yh,ii as Af,ij as Qg,ik as Qh,ji as bf,jj as Xg,jk as Xh,ki as Rf,kj as eh,kk as ey,li as Tf,lj as th,lk as ty,mi as $f,mj as rh,mk as ry,ni as Pf,nj as nh,nk as ny,oi as If,oj as ih,ok as iy,pi as Df,pj as oh,pk as oy,qi as Ef,qj as ah,qk as $t,ri as wf,rj as sh,rk as Pt,si as Mf,sj as ch,sk as It,ti as Ff,tj as lh,tk as Dt,ui as Vf,uj as dh,uk as Et,vi as _f,vj as uh,vk as ay,wi as Bf,wj as ph,wk as sy,xi as Wf,xj as mh,xk as cy,yi as zf,yj as fh,yk as ly,zi as Hf,zj as gh,zk as dy}from"./chunk-aw0cgv5w.js";import{$k as Yn,_k as Jn,al as Qn,bl as Xn,cl as ei,dl as ti,el as ri,gl as ni,hl as ii,il as oi,jl as ai,kl as si,ll as ci}from"./chunk-1qdne0bf.js";import{nl as dn,ol as un,pl as pn,ql as mn,rl as fn,sl as gn}from"./chunk-hn40z11p.js";import{Al as Ft,tl as vt,ul as Ot,vl as Nt,wl as kt,xl as xt,yl as Lt,zl as Mt}from"./chunk-x3hay61c.js";import{$l as Ha,$m as De,$n as $c,$o as $l,$p as $d,$q as $u,$r as $p,$s as fm,Am as ps,An as Ys,Ao as Yc,Ap as Yl,Aq as Yd,Ar as Yu,As as Yp,At as Wm,Bl as ya,Bm as ee,Bn as Qs,Bo as Qc,Bp as Ql,Bq as Qd,Br as Qu,Bs as Qp,Bt as zm,Cl as Ca,Cm as w,Cn as Xs,Co as Xc,Cp as Xl,Cq as Xd,Cr as Xu,Cs as Xp,Dl as Sa,Dm as Re,Dn as ec,Do as el,Dp as ed,Dq as eu,Dr as ep,Ds as em,El as Aa,Em as K,En as tc,Eo as tl,Ep as td,Eq as tu,Er as tp,Es as tm,Fl as ba,Fm as L,Fn as rc,Fo as rl,Fp as rd,Fq as ru,Fr as rp,Fs as rm,Gl as Ra,Gm as ms,Gn as nc,Go as nl,Gp as nd,Gq as nu,Gr as np,Gs as nm,Hl as Ta,Hm as fs,Hn as ic,Ho as il,Hp as id,Hq as iu,Hr as ip,Hs as im,Il as $a,Im as te,In as oc,Io as ol,Ip as od,Iq as ou,Ir as op,Is as om,Jl as Pa,Jm as gs,Jn as ac,Jo as al,Jp as ad,Jq as au,Jr as ap,Js as am,Kl as Ia,Km as hs,Kn as sc,Ko as sl,Kp as sd,Kq as su,Kr as sp,Ks as sm,Ll as Da,Lm as ys,Ln as cc,Lo as cl,Lp as cd,Lq as cu,Lr as cp,Ls as cm,Ml as Ea,Mm as Cs,Mn as lc,Mo as ll,Mp as ld,Mq as lu,Mr as lp,Ms as lm,Nl as wa,Nm as Te,Nn as dc,No as dl,Np as dd,Nq as du,Nr as dp,Ns as lt,Ol as va,Om as M,On as uc,Oo as ul,Op as ud,Oq as uu,Or as up,Os as dt,Pl as Oa,Pm as U,Pn as pc,Po as pl,Pp as pd,Pq as pu,Pr as pp,Ps as ut,Ql as Na,Qm as re,Qn as mc,Qo as ml,Qp as md,Qq as mu,Qr as mp,Qs as pt,Rl as ka,Rm as $e,Rn as fc,Ro as fl,Rp as fd,Rq as fu,Rr as fp,Rs as mt,Sl as xa,Sm as Pe,Sn as gc,So as gl,Sp as gd,Sq as gu,Sr as gp,Ss as ft,Tl as La,Tm as Ss,Tn as hc,To as hl,Tp as hd,Tq as hu,Tr as hp,Ts as gt,Ul as Ma,Um as As,Un as yc,Uo as yl,Up as yd,Uq as yu,Ur as yp,Us as ht,Vl as Fa,Vm as Ie,Vn as Cc,Vo as Cl,Vp as Cd,Vq as Cu,Vr as Cp,Vs as yt,Wl as Va,Wm as bs,Wn as Sc,Wo as Sl,Wp as Sd,Wq as Su,Wr as Sp,Ws as Ct,Xl as _a,Xm as Rs,Xn as Ac,Xo as Al,Xp as Ad,Xq as Au,Xr as Ap,Xs as dm,Yl as Ba,Ym as Ts,Yn as bc,Yo as bl,Yp as bd,Yq as bu,Yr as bp,Ys as um,Zl as Wa,Zm as $s,Zn as Rc,Zo as Rl,Zp as Rd,Zq as Ru,Zr as Rp,Zs as pm,_l as za,_m as Ps,_n as Tc,_o as Tl,_p as Td,_q as Tu,_r as Tp,_s as mm,am as Ga,an as Z,ao as Pc,ap as Pl,aq as Pd,ar as Pu,as as Pp,at as gm,bm as Ka,bn as Is,bo as Ic,bp as Il,bq as Id,br as Iu,bs as Ip,bt as hm,cm as Ua,cn as Ds,co as Dc,cp as Dl,cq as Dd,cr as Du,cs as Dp,ct as ym,dm as Za,dn as Es,do as Ec,dp as El,dq as Ed,dr as Eu,ds as Ep,dt as Cm,em as ja,en as ws,eo as wc,ep as wl,eq as wd,er as wu,es as wp,et as Sm,fm as Se,fn as vs,fo as vc,fp as vl,fq as vd,fr as vu,fs as vp,ft as Am,gm as qa,gn as Os,go as Oc,gp as Ol,gq as Od,gr as Ou,gs as Op,gt as bm,hm as Ae,hn as Ns,ho as Nc,hp as Nl,hq as Nd,hr as Nu,hs as Np,ht as Rm,im as be,in as ks,io as kc,ip as kl,iq as kd,ir as ku,is as kp,it as Tm,jm as Ja,jn as xs,jo as xc,jp as xl,jq as xd,jr as xu,js as xp,jt as $m,km as Ya,kn as Ls,ko as Lc,kp as Ll,kq as Ld,kr as Lu,ks as Lp,kt as Pm,lm as Qa,ln as Ms,lo as Mc,lp as Ml,lq as Md,lr as Mu,ls as Mp,lt as Im,mm as Xa,mn as Fs,mo as Fc,mp as Fl,mq as Fd,mr as Fu,ms as Fp,mt as Dm,nm as es,nn as Vs,no as Vc,np as Vl,nq as Vd,nr as Vu,ns as Vp,nt as Em,om as ts,on as _s,oo as _c,op as _l,oq as _d,or as _u,os as _p,ot as wm,pm as rs,pn as Bs,po as Bc,pp as Bl,pq as Bd,pr as Bu,ps as Bp,pt as vm,qm as ns,qn as Ws,qo as Wc,qp as Wl,qq as Wd,qr as Wu,qs as Wp,qt as Om,rm as is,rn as zs,ro as zc,rp as zl,rq as zd,rr as zu,rs as zp,rt as Nm,sm as os,sn as Hs,so as Hc,sp as Hl,sq as Hd,sr as Hu,ss as Hp,st as km,tm as as,tn as Gs,to as Gc,tp as Gl,tq as Gd,tr as Gu,ts as Gp,tt as xm,um as ss,un as Ks,uo as Kc,up as Kl,uq as Kd,ur as Ku,us as Kp,ut as Lm,vm as cs,vn as Us,vo as Uc,vp as Ul,vq as Ud,vr as Uu,vs as Up,vt as Mm,wm as ls,wn as Zs,wo as Zc,wp as Zl,wq as Zd,wr as Zu,ws as Zp,wt as Fm,xm as X,xn as js,xo as jc,xp as jl,xq as jd,xr as ju,xs as jp,xt as Vm,ym as ds,yn as qs,yo as qc,yp as ql,yq as qd,yr as qu,ys as qp,yt as _m,zm as us,zn as Js,zo as Jc,zp as Jl,zq as Jd,zr as Ju,zs as Jp,zt as Bm}from"./chunk-zz52xje8.js";import{Ct as Je}from"./chunk-z2qqwy7e.js";import{createHmac as fe,createSign as _e,timingSafeEqual as Be}from"node:crypto";function B(e){let t=e instanceof Date?e.getTime():e;if(!Number.isFinite(t))throw TypeError("Media access timestamp must be finite");return Math.floor(t/1000)}function ge(e){return Buffer.from(e).toString("base64").replaceAll("+","-").replaceAll("=","_").replaceAll("/","~")}function We(e){return Buffer.from(e).toString("base64url")}function he(e,t=!1){if(!e||/[\r\n]/.test(e))throw TypeError("Media resource is invalid");let r=t?e.replaceAll("*","wildcard"):e,n=new URL(r);if(!["http:","https:"].includes(n.protocol))throw TypeError("Media resource must use HTTP or HTTPS");if(!t&&e.includes("*"))throw TypeError("Canned policies cannot contain wildcards")}function ye(e,t){let r=_e("RSA-SHA1");return r.update(e),r.end(),ge(r.sign(t))}function Ce(e){he(e.resource,!0);let r={DateLessThan:{"AWS:EpochTime":B(e.expiresAt)}};if(e.activeAt!==void 0)r.DateGreaterThan={"AWS:EpochTime":B(e.activeAt)};if(e.ipAddress)r.IpAddress={"AWS:SourceIp":e.ipAddress};return JSON.stringify({Statement:[{Resource:e.resource,Condition:r}]})}function Ni(e,t,r){he(e);let n=B(t),o=e.includes("?")?"&":"?",l=Ce({resource:e,expiresAt:t}),c=ye(l,r.privateKey);return`${e}${o}Expires=${n}&Signature=${encodeURIComponent(c)}&Key-Pair-Id=${encodeURIComponent(r.keyPairId)}`}function ki(e,t){let r=Ce(e);return{"CloudFront-Key-Pair-Id":t.keyPairId,"CloudFront-Policy":ge(Buffer.from(r)),"CloudFront-Signature":ye(r,t.privateKey)}}function xi(e){if(!e.resource||/[\r\n]/.test(e.resource))throw TypeError("Media resource is invalid");let t=We(Buffer.from(JSON.stringify({resource:e.resource,expiresAt:B(e.expiresAt),...e.keyId?{keyId:e.keyId}:{},...e.audience?{audience:e.audience}:{}}))),r=fe("sha256",e.secret).update(t).digest("base64url");return`${t}.${r}`}function Li(e,t){let[r,n,o]=e.split(".");if(!r||!n||o)return null;let l=fe("sha256",t.secret).update(r).digest(),c;try{c=Buffer.from(n,"base64url")}catch{return null}if(l.length!==c.length||!Be(l,c))return null;try{let s=JSON.parse(Buffer.from(r,"base64url").toString("utf8")),d=B(t.now??Date.now());if(!s.resource||!Number.isSafeInteger(s.expiresAt)||s.expiresAt<=d)return null;if(t.resource&&s.resource!==t.resource)return null;if(t.audience&&s.audience!==t.audience)return null;return s}catch{return null}}function Mi(e,t=!1){let r=new URL(e,"https://media.invalid").pathname.toLowerCase(),n=/\.(?:m3u8|mpd|vtt|json)$/.test(r),o=/\.(?:key|license)$/.test(r)||r.includes("/keys/")||r.includes("/licenses/");return{"Accept-Ranges":"bytes","Cache-Control":t&&(n||o)?"private, no-store":n?"public, max-age=5, s-maxage=30, stale-while-revalidate=30":"public, max-age=31536000, immutable","Cross-Origin-Resource-Policy":"cross-origin","X-Content-Type-Options":"nosniff"}}function Fi(e){if(!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(e.bucket))throw TypeError("Media bucket is invalid");if(!/^[a-z0-9-]+$/.test(e.region))throw TypeError("Media bucket region is invalid");let t=e.prefix?`/${e.prefix.replace(/^\/+|\/+$/g,"")}`:"",r=e.protected??!1,n="public, max-age=31536000, immutable",o=r?"private, no-store":"public, max-age=5, s-maxage=30, stale-while-revalidate=30";return{originDomain:`${e.bucket}.s3.${e.region}.amazonaws.com`,originPath:t,domain:e.domain,trustedKeyGroupIds:[...new Set(e.trustedKeyGroupIds??[])],behaviors:[{pathPattern:"*.m3u8",cacheControl:o,compress:!0,signed:r},{pathPattern:"*.mpd",cacheControl:o,compress:!0,signed:r},{pathPattern:"*.vtt",cacheControl:o,compress:!0,signed:r},{pathPattern:"*",cacheControl:n,compress:!1,signed:r}],responseHeaders:{"Access-Control-Allow-Headers":"Range, If-Range","Access-Control-Allow-Methods":"GET, HEAD, OPTIONS","Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":"Accept-Ranges, Content-Length, Content-Range, ETag","X-Content-Type-Options":"nosniff"}}}class ze{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;constructor(e){this.config=e.config,this.environment=e.environment,this.builder=new Se(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let t=this.config.environments[this.environment]?.infrastructure;if(!t)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...t,compute:{...this.config.infrastructure?.compute,...t.compute},storage:{...this.config.infrastructure?.storage,...t.storage},functions:{...this.config.infrastructure?.functions,...t.functions},servers:{...this.config.infrastructure?.servers,...t.servers},databases:{...this.config.infrastructure?.databases,...t.databases},cdn:{...this.config.infrastructure?.cdn,...t.cdn},sftp:t.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...t.queues},redirects:{...this.config.infrastructure?.redirects,...t.redirects},realtime:{...this.config.infrastructure?.realtime,...t.realtime},cache:{...this.config.infrastructure?.cache,...t.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...t.fileSystem},email:{...this.config.infrastructure?.email,...t.email},search:{...this.config.infrastructure?.search,...t.search},ai:{...this.config.infrastructure?.ai,...t.ai}}}}shouldDeploy(e){if(e.environments&&!e.environments.includes(this.environment))return!1;if(e.requiresFeatures){let t=this.config.features||{};if(!e.requiresFeatures.every((n)=>t[n]===!0))return!1}if(e.regions){let t=this.config.environments[this.environment]?.region||this.config.project.region;if(!e.regions.includes(t))return!1}if(e.condition&&typeof e.condition==="function")return e.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let e=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,t=Number(e||3008);return Number.isFinite(t)&&t>0?t:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(e,t){return e==="public"||t.routeCompute===!0}storageBucketName(e,t,r){return this.mergedConfig.infrastructure?.storage?.[r]?.bucket??`${e}-${t}-${r}`}fileSystemLogicalId(e,t,r){return be(Ae({slug:`${e}-${r}`,environment:t,resourceType:"efs"}))}resolveSftpStorage(e,t,r){let n=e.storage;if(n?.type==="efs"&&n.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[n.fileSystem])throw Error(`sftp: storage.fileSystem "${n.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(t,r,n.fileSystem)},posixProfile:n.posixProfile}}if(n?.type==="s3"&&n.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[n.storageBucket])throw Error(`sftp: storage.storageBucket "${n.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(t,r,n.storageBucket)}}return}resolveComputeCachePathPatterns(e){if(e&&e.length>0)return e;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(e,t){return{PathPattern:e,TargetOriginId:t,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(e,t,r,n,o,l){let c=this.serverEipLogicalIds.get("app"),s=this.serverEipLogicalIds.get("appInstance");if(!c)return;let d=`EC2-${n}-${o}-api`,h=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",u=h==="us-east-1"?".compute-1.amazonaws.com":`.${h}.compute.amazonaws.com`,b={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:c}]}]},u]]},A=this.resolveApiOriginPort();if(e.push({Id:d,DomainName:b,CustomOriginConfig:{HTTPPort:A,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),r.push(c),s)r.push(s);for(let T of l)t.push(this.createComputeCacheBehavior(T,d))}buildCaddyfile(e){let t=e.filter(([,o])=>typeof o.domain==="string"&&o.domain&&typeof o.port==="number");if(t.length===0)return;let r=new Map;for(let[,o]of t){let l=r.get(o.domain)??[];l.push({port:o.port,path:o.path}),r.set(o.domain,l)}let n=[];for(let[o,l]of r){let s=[...l].sort((d,h)=>{let u=!d.path||d.path==="/",b=!h.path||h.path==="/";if(u&&!b)return 1;if(!u&&b)return-1;return(h.path?.length??0)-(d.path?.length??0)}).map((d)=>{let h=!d.path||d.path==="/",u=`reverse_proxy localhost:${d.port}`;return h?`  handle {
     ${u}
   }`:`  handle ${d.path} {
     ${u}
@@ -219,7 +219,7 @@ ${t.loadManagement?.enabled?`
   },
 `:""}
 } satisfies BroadcastConfig
-`}toYAML(){return this.builder.toYAML()}toJSON(){return this.builder.toJSON()}getBuilder(){return this.builder}}function He(e){let t=[],r=[];if(!e.AWSTemplateFormatVersion)t.push({path:"AWSTemplateFormatVersion",message:"AWSTemplateFormatVersion is required",severity:"error"});else if(e.AWSTemplateFormatVersion!=="2010-09-09")r.push({path:"AWSTemplateFormatVersion",message:'AWSTemplateFormatVersion should be "2010-09-09"',severity:"warning"});if(!e.Resources||Object.keys(e.Resources).length===0)t.push({path:"Resources",message:"At least one resource is required",severity:"error"});else for(let[n,o]of Object.entries(e.Resources))Ge(n,o,t,r);if(e.Resources){let n=Ze(e.Resources);if(n.length>0)t.push({path:"Resources",message:`Circular dependencies detected: ${n.join(" -> ")}`,severity:"error"})}if(e.Parameters)for(let[n,o]of Object.entries(e.Parameters))Ke(n,o,t,r);if(e.Outputs)for(let[n,o]of Object.entries(e.Outputs))Ue(n,o,t,r);return{valid:t.length===0,errors:t,warnings:r}}function Ge(e,t,r,n){if(!t.Type)r.push({path:`Resources.${e}.Type`,message:"Resource Type is required",severity:"error"});if(!/^[a-zA-Z0-9]+$/.test(e))n.push({path:`Resources.${e}`,message:"Logical ID should only contain alphanumeric characters",severity:"warning"});if(t.Type&&!t.Type.startsWith("AWS::")&&!t.Type.startsWith("Custom::"))r.push({path:`Resources.${e}.Type`,message:'Resource Type must start with "AWS::" or "Custom::"',severity:"error"});if(t.Properties){for(let[o,l]of Object.entries(t.Properties))if(l===void 0||l===null)n.push({path:`Resources.${e}.Properties.${o}`,message:"Property has undefined or null value",severity:"warning"})}if(t.DependsOn){if(typeof t.DependsOn==="string"){if(t.DependsOn===e)r.push({path:`Resources.${e}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}else if(Array.isArray(t.DependsOn)){if(t.DependsOn.includes(e))r.push({path:`Resources.${e}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}}}function Ke(e,t,r,n){if(!t.Type)r.push({path:`Parameters.${e}.Type`,message:"Parameter Type is required",severity:"error"});let o=["String","Number","List<Number>","CommaDelimitedList","AWS::SSM::Parameter::Value<String>"];if(t.Type&&!o.includes(t.Type)&&!t.Type.startsWith("AWS::"))n.push({path:`Parameters.${e}.Type`,message:`Uncommon parameter type: ${t.Type}`,severity:"warning"});if(t.NoEcho&&t.Default)n.push({path:`Parameters.${e}`,message:"NoEcho parameters should not have default values",severity:"warning"})}function Ue(e,t,r,n){if(!t.Value)r.push({path:`Outputs.${e}.Value`,message:"Output Value is required",severity:"error"})}function Ze(e){let t={};for(let[c,s]of Object.entries(e)){if(t[c]=[],s.DependsOn){if(typeof s.DependsOn==="string")t[c].push(s.DependsOn);else if(Array.isArray(s.DependsOn))t[c].push(...s.DependsOn)}let d=ne(s);t[c].push(...d)}let r=new Set,n=new Set,o=[];function l(c,s){r.add(c),n.add(c),s.push(c);let d=t[c]||[];for(let h of d)if(!r.has(h)){if(l(h,s))return!0}else if(n.has(h)){let u=s.indexOf(h);return o.push(...s.slice(u),h),!0}return s.pop(),n.delete(c),!1}for(let c of Object.keys(t))if(!r.has(c)){if(l(c,[]))return o}return[]}function ne(e,t=[]){if(typeof e!=="object"||e===null)return t;if(Array.isArray(e)){for(let r of e)ne(r,t);return t}if(e.Ref&&typeof e.Ref==="string"&&!e.Ref.startsWith("AWS::"))t.push(e.Ref);if(e["Fn::GetAtt"]){let r=e["Fn::GetAtt"];if(Array.isArray(r)&&r.length>0)t.push(r[0])}for(let r of Object.values(e))ne(r,t);return t}function je(e){let t=[],r=[],n=new TextEncoder().encode(e).length,o=51200,l=460800;if(n>51200)if(n>460800)t.push({path:"template",message:`Template size (${n} bytes) exceeds maximum allowed size of 460800 bytes`,severity:"error"});else r.push({path:"template",message:`Template size (${n} bytes) exceeds direct upload limit (51200 bytes). You must upload to S3 first.`,severity:"warning"});return{valid:t.length===0,errors:t,warnings:r}}function qe(e){let t=[],r=[],n=e.Resources?Object.keys(e.Resources).length:0,o=e.Parameters?Object.keys(e.Parameters).length:0,l=e.Outputs?Object.keys(e.Outputs).length:0;if(n>500)t.push({path:"Resources",message:`Template has ${n} resources, exceeding the limit of 500`,severity:"error"});else if(n>200)r.push({path:"Resources",message:`Template has ${n} resources. Consider using nested stacks for better organization.`,severity:"warning"});if(o>200)t.push({path:"Parameters",message:`Template has ${o} parameters, exceeding the limit of 200`,severity:"error"});if(l>200)t.push({path:"Outputs",message:`Template has ${l} outputs, exceeding the limit of 200`,severity:"error"});return{valid:t.length===0,errors:t,warnings:r}}function ji(e){let{domains:t,email:r,staging:n=!1,challengeType:o="http-01",certPath:l="/etc/letsencrypt/live",autoRenew:c=!0}=e,s=t[0],d=t.map((u)=>`-d ${u}`).join(" "),h=n?"--staging":"";if(o==="http-01")return Ye({domains:t,email:r,staging:n,certPath:l,autoRenew:c,domainFlags:d,stagingFlag:h,primaryDomain:s});else{let u=e.dnsProvider?.provider||(e.hostedZoneId?"route53":void 0);return Qe({domains:t,email:r,staging:n,certPath:l,autoRenew:c,domainFlags:d,stagingFlag:h,primaryDomain:s,hostedZoneId:e.hostedZoneId,dnsProvider:e.dnsProvider,dnsProviderType:u})}}function Ye(e){let{email:t,certPath:r,autoRenew:n,domainFlags:o,stagingFlag:l,primaryDomain:c}=e;return`
+`}toYAML(){return this.builder.toYAML()}toJSON(){return this.builder.toJSON()}getBuilder(){return this.builder}}function He(e){let t=[],r=[];if(!e.AWSTemplateFormatVersion)t.push({path:"AWSTemplateFormatVersion",message:"AWSTemplateFormatVersion is required",severity:"error"});else if(e.AWSTemplateFormatVersion!=="2010-09-09")r.push({path:"AWSTemplateFormatVersion",message:'AWSTemplateFormatVersion should be "2010-09-09"',severity:"warning"});if(!e.Resources||Object.keys(e.Resources).length===0)t.push({path:"Resources",message:"At least one resource is required",severity:"error"});else for(let[n,o]of Object.entries(e.Resources))Ge(n,o,t,r);if(e.Resources){let n=Ze(e.Resources);if(n.length>0)t.push({path:"Resources",message:`Circular dependencies detected: ${n.join(" -> ")}`,severity:"error"})}if(e.Parameters)for(let[n,o]of Object.entries(e.Parameters))Ke(n,o,t,r);if(e.Outputs)for(let[n,o]of Object.entries(e.Outputs))Ue(n,o,t,r);return{valid:t.length===0,errors:t,warnings:r}}function Ge(e,t,r,n){if(!t.Type)r.push({path:`Resources.${e}.Type`,message:"Resource Type is required",severity:"error"});if(!/^[a-zA-Z0-9]+$/.test(e))n.push({path:`Resources.${e}`,message:"Logical ID should only contain alphanumeric characters",severity:"warning"});if(t.Type&&!t.Type.startsWith("AWS::")&&!t.Type.startsWith("Custom::"))r.push({path:`Resources.${e}.Type`,message:'Resource Type must start with "AWS::" or "Custom::"',severity:"error"});if(t.Properties){for(let[o,l]of Object.entries(t.Properties))if(l===void 0||l===null)n.push({path:`Resources.${e}.Properties.${o}`,message:"Property has undefined or null value",severity:"warning"})}if(t.DependsOn){if(typeof t.DependsOn==="string"){if(t.DependsOn===e)r.push({path:`Resources.${e}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}else if(Array.isArray(t.DependsOn)){if(t.DependsOn.includes(e))r.push({path:`Resources.${e}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}}}function Ke(e,t,r,n){if(!t.Type)r.push({path:`Parameters.${e}.Type`,message:"Parameter Type is required",severity:"error"});let o=["String","Number","List<Number>","CommaDelimitedList","AWS::SSM::Parameter::Value<String>"];if(t.Type&&!o.includes(t.Type)&&!t.Type.startsWith("AWS::"))n.push({path:`Parameters.${e}.Type`,message:`Uncommon parameter type: ${t.Type}`,severity:"warning"});if(t.NoEcho&&t.Default)n.push({path:`Parameters.${e}`,message:"NoEcho parameters should not have default values",severity:"warning"})}function Ue(e,t,r,n){if(!t.Value)r.push({path:`Outputs.${e}.Value`,message:"Output Value is required",severity:"error"})}function Ze(e){let t={};for(let[c,s]of Object.entries(e)){if(t[c]=[],s.DependsOn){if(typeof s.DependsOn==="string")t[c].push(s.DependsOn);else if(Array.isArray(s.DependsOn))t[c].push(...s.DependsOn)}let d=ne(s);t[c].push(...d)}let r=new Set,n=new Set,o=[];function l(c,s){r.add(c),n.add(c),s.push(c);let d=t[c]||[];for(let h of d)if(!r.has(h)){if(l(h,s))return!0}else if(n.has(h)){let u=s.indexOf(h);return o.push(...s.slice(u),h),!0}return s.pop(),n.delete(c),!1}for(let c of Object.keys(t))if(!r.has(c)){if(l(c,[]))return o}return[]}function ne(e,t=[]){if(typeof e!=="object"||e===null)return t;if(Array.isArray(e)){for(let r of e)ne(r,t);return t}if(e.Ref&&typeof e.Ref==="string"&&!e.Ref.startsWith("AWS::"))t.push(e.Ref);if(e["Fn::GetAtt"]){let r=e["Fn::GetAtt"];if(Array.isArray(r)&&r.length>0)t.push(r[0])}for(let r of Object.values(e))ne(r,t);return t}function je(e){let t=[],r=[],n=new TextEncoder().encode(e).length,o=51200,l=460800;if(n>51200)if(n>460800)t.push({path:"template",message:`Template size (${n} bytes) exceeds maximum allowed size of 460800 bytes`,severity:"error"});else r.push({path:"template",message:`Template size (${n} bytes) exceeds direct upload limit (51200 bytes). You must upload to S3 first.`,severity:"warning"});return{valid:t.length===0,errors:t,warnings:r}}function qe(e){let t=[],r=[],n=e.Resources?Object.keys(e.Resources).length:0,o=e.Parameters?Object.keys(e.Parameters).length:0,l=e.Outputs?Object.keys(e.Outputs).length:0;if(n>500)t.push({path:"Resources",message:`Template has ${n} resources, exceeding the limit of 500`,severity:"error"});else if(n>200)r.push({path:"Resources",message:`Template has ${n} resources. Consider using nested stacks for better organization.`,severity:"warning"});if(o>200)t.push({path:"Parameters",message:`Template has ${o} parameters, exceeding the limit of 200`,severity:"error"});if(l>200)t.push({path:"Outputs",message:`Template has ${l} outputs, exceeding the limit of 200`,severity:"error"});return{valid:t.length===0,errors:t,warnings:r}}function Yi(e){let{domains:t,email:r,staging:n=!1,challengeType:o="http-01",certPath:l="/etc/letsencrypt/live",autoRenew:c=!0}=e,s=t[0],d=t.map((u)=>`-d ${u}`).join(" "),h=n?"--staging":"";if(o==="http-01")return Ye({domains:t,email:r,staging:n,certPath:l,autoRenew:c,domainFlags:d,stagingFlag:h,primaryDomain:s});else{let u=e.dnsProvider?.provider||(e.hostedZoneId?"route53":void 0);return Qe({domains:t,email:r,staging:n,certPath:l,autoRenew:c,domainFlags:d,stagingFlag:h,primaryDomain:s,hostedZoneId:e.hostedZoneId,dnsProvider:e.dnsProvider,dnsProviderType:u})}}function Ye(e){let{email:t,certPath:r,autoRenew:n,domainFlags:o,stagingFlag:l,primaryDomain:c}=e;return`
 # ==========================================
 # Let's Encrypt Certificate Setup (HTTP-01)
 # ==========================================
@@ -506,7 +506,7 @@ systemctl enable certbot-renewal.timer
 systemctl start certbot-renewal.timer
 
 echo "Certificate auto-renewal configured"
-`}function qi(e){let{httpPort:t=80,httpsPort:r=443,certPath:n="/etc/ssl/stacks",redirectHttp:o=!0}=e;return`
+`}function Qi(e){let{httpPort:t=80,httpsPort:r=443,certPath:n="/etc/ssl/stacks",redirectHttp:o=!0}=e;return`
 // HTTPS Server with Let's Encrypt certificates
 import { readFileSync, existsSync } from 'node:fs'
 
@@ -592,5 +592,5 @@ async function handleRequest(request: Request): Promise<Response> {
   // Implement your request handling here
   return new Response('Hello from Stacks!')
 }
-`}async function Ji(e){let{domain:t,challengeValue:r,hostedZoneId:n,dnsProvider:o,region:l="us-east-1"}=e;if(o){let s=await q(o).upsertRecord(t,{name:`_acme-challenge.${t}`,type:"TXT",content:r,ttl:60});if(!s.success)throw Error(`Failed to create DNS challenge record: ${s.message}`);return}if(n){await new j(l).changeResourceRecordSets({HostedZoneId:n,ChangeBatch:{Comment:"ACME DNS-01 challenge",Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:`_acme-challenge.${t}`,Type:"TXT",TTL:60,ResourceRecords:[{Value:`"${r}"`}]}}]}});return}throw Error("Either dnsProvider or hostedZoneId must be provided")}async function Yi(e){let{domain:t,challengeValue:r,hostedZoneId:n,dnsProvider:o,region:l="us-east-1"}=e;if(o){let s=await q(o).deleteRecord(t,{name:`_acme-challenge.${t}`,type:"TXT",content:r});if(!s.success)console.warn(`Failed to delete DNS challenge record: ${s.message}`);return}if(n){await new j(l).changeResourceRecordSets({HostedZoneId:n,ChangeBatch:{Comment:"Remove ACME DNS-01 challenge",Changes:[{Action:"DELETE",ResourceRecordSet:{Name:`_acme-challenge.${t}`,Type:"TXT",TTL:60,ResourceRecords:[{Value:`"${r}"`}]}}]}});return}throw Error("Either dnsProvider or hostedZoneId must be provided")}function Qi(e){try{let{execSync:t}=Je("node:child_process"),r=t(`openssl x509 -checkend 2592000 -noout -in ${e}/cert.pem`,{encoding:"utf-8",stdio:["pipe","pipe","pipe"]});return!1}catch{return!0}}import{createHash as we,createSign as rt,generateKeyPairSync as ve}from"node:crypto";var Oe={production:"https://acme-v02.api.letsencrypt.org/directory",staging:"https://acme-staging-v02.api.letsencrypt.org/directory"};class nt{directoryUrl;email;accountKey;accountUrl=null;directory=null;nonce=null;constructor(e){this.directoryUrl=e.staging?Oe.staging:Oe.production,this.email=e.email,this.accountKey=e.accountKey||this.generateAccountKey()}generateAccountKey(){let{privateKey:e}=ve("ec",{namedCurve:"P-256"});return e.export({type:"pkcs8",format:"pem"})}async getDirectory(){if(this.directory)return this.directory;let e=await fetch(this.directoryUrl);if(!e.ok)throw Error(`Failed to fetch ACME directory: ${e.status}`);return this.directory=await e.json(),this.directory}async getNonce(){if(this.nonce){let n=this.nonce;return this.nonce=null,n}let e=await this.getDirectory(),r=(await fetch(e.newNonce,{method:"HEAD"})).headers.get("replay-nonce");if(!r)throw Error("Failed to get nonce from ACME server");return r}getJwk(){let e=this.accountKey.split(`
-`).filter((l)=>!l.startsWith("-----")).join(""),t=Buffer.from(e,"base64"),r=t.length-65,n=t.subarray(r+1,r+33),o=t.subarray(r+33,r+65);return{kty:"EC",crv:"P-256",x:this.base64UrlEncode(n),y:this.base64UrlEncode(o)}}getJwkThumbprint(){let e=this.getJwk(),t=JSON.stringify({crv:e.crv,kty:e.kty,x:e.x,y:e.y}),r=we("sha256").update(t).digest();return this.base64UrlEncode(r)}base64UrlEncode(e){return(typeof e==="string"?Buffer.from(e):e).toString("base64").replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async signPayload(e,t){let r=await this.getNonce(),n=this.getJwk(),o={alg:"ES256",nonce:r,url:e};if(this.accountUrl)o.kid=this.accountUrl;else o.jwk=n;let l=this.base64UrlEncode(JSON.stringify(o)),c=t===""?"":this.base64UrlEncode(JSON.stringify(t)),s=`${l}.${c}`,d=rt("SHA256");d.update(s);let h=d.sign(this.accountKey),u=h.subarray(4,4+h[3]),b=4+h[3]+2,A=h.subarray(b,b+h[b-1]),T=Buffer.alloc(32),g=Buffer.alloc(32);u.copy(T,32-u.length),A.copy(g,32-A.length);let m=Buffer.concat([T,g]);return JSON.stringify({protected:l,payload:c,signature:this.base64UrlEncode(m)})}async acmeRequest(e,t){let r=await this.signPayload(e,t),n=await fetch(e,{method:"POST",headers:{"Content-Type":"application/jose+json"},body:r}),o=n.headers.get("replay-nonce");if(o)this.nonce=o;let l,c=n.headers.get("content-type");if(c?.includes("application/json")||c?.includes("application/problem+json"))l=await n.json();else l=await n.text();if(!n.ok)throw Error(`ACME request failed: ${JSON.stringify(l)}`);return{body:l,headers:n.headers}}async registerAccount(){let e=await this.getDirectory(),{body:t,headers:r}=await this.acmeRequest(e.newAccount,{termsOfServiceAgreed:!0,contact:[`mailto:${this.email}`]}),n=r.get("location");if(!n)throw Error("No account URL returned");return this.accountUrl=n,n}async createOrder(e){if(!this.accountUrl)await this.registerAccount();let t=await this.getDirectory(),{body:r,headers:n}=await this.acmeRequest(t.newOrder,{identifiers:e.map((l)=>({type:"dns",value:l}))}),o=n.get("location");if(!o)throw Error("No order URL returned");return{orderUrl:o,authorizations:r.authorizations,finalize:r.finalize}}async getAuthorization(e){let{body:t}=await this.acmeRequest(e,""),r=t.identifier.value,n=this.getJwkThumbprint(),o=t.challenges.filter((l)=>l.type==="http-01"||l.type==="dns-01").map((l)=>{let c=`${l.token}.${n}`;if(l.type==="http-01")return{type:"http-01",token:l.token,keyAuthorization:c,identifier:`/.well-known/acme-challenge/${l.token}`};else{let s=this.base64UrlEncode(we("sha256").update(c).digest());return{type:"dns-01",token:l.token,keyAuthorization:c,identifier:`_acme-challenge.${r}`,dnsValue:s}}});return{domain:r,challenges:o}}async respondToChallenge(e){await this.acmeRequest(e,{})}async waitForAuthorization(e,t=30){for(let r=0;r<t;r++){let{body:n}=await this.acmeRequest(e,"");if(n.status==="valid")return;if(n.status==="invalid")throw Error(`Authorization failed: ${JSON.stringify(n)}`);await new Promise((o)=>setTimeout(o,2000))}throw Error("Authorization timed out")}generateCsr(e){let{privateKey:t}=ve("rsa",{modulusLength:2048}),r=t.export({type:"pkcs8",format:"pem"});return{csr:this.createSimpleCsr(e,t),privateKey:r}}createSimpleCsr(e,t){throw Error("CSR generation requires additional implementation. Consider using the shell-based certbot approach instead.")}async finalizeOrder(e,t){let{csr:r,privateKey:n}=this.generateCsr(t),{body:o}=await this.acmeRequest(e,{csr:this.base64UrlEncode(Buffer.from(r,"base64"))}),l=o.certificate;if(!l)throw Error("Certificate not immediately available - polling not implemented");let s=await(await fetch(l)).text(),d=s.split(/(?=-----BEGIN CERTIFICATE-----)/g),h=d[0],u=d.slice(1).join("");return{certificate:h,privateKey:n,chain:u,fullchain:s,expiresAt:new Date(Date.now()+7776000000)}}getAccountKey(){return this.accountKey}}var Ne=["js","mjs","cjs","css","map","woff","woff2","ttf","otf","eot","png","jpg","jpeg","gif","webp","avif","svg","ico","mp4","webm","ogg","mp3","wav","pdf","wasm"];function oe(e){return`"${e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`}function ke(e){return`{${e.map(oe).join(" ")}}`}function ae(e){if(e.length===1)return`http.host eq ${oe(e[0])}`;return`http.host in ${ke(e)}`}function se(e,t={}){if(t.enabled===!1||e.length===0)return[];let r=ae(e),n=[],o=t.bypassPaths??[],l=o.length>0?`(${o.map((h)=>`starts_with(http.request.uri.path, ${oe(h)})`).join(" or ")})`:void 0;if(l)n.push({action:"set_cache_settings",description:"bypass cache",expression:`(${r} and ${l})`,enabled:!0,action_parameters:{cache:!1}});let c=l?`${r} and not ${l}`:r,s=t.assetExtensions??Ne,d=s.length>0?`lower(http.request.uri.path.extension) in ${ke([...s])}`:void 0;if(d)n.push({action:"set_cache_settings",description:"cache fingerprinted assets",expression:`(${c} and ${d})`,enabled:!0,action_parameters:{cache:!0,edge_ttl:{mode:"override_origin",default:t.assetEdgeTtl??2592000},browser_ttl:{mode:"override_origin",default:t.assetBrowserTtl??31536000}}});return n.push({action:"set_cache_settings",description:"cache documents",expression:d?`(${c} and not ${d})`:`(${c})`,enabled:!0,action_parameters:{cache:!0,edge_ttl:{mode:"override_origin",default:t.documentEdgeTtl??3600},browser_ttl:{mode:"override_origin",default:t.documentBrowserTtl??0}}}),n}function ce(e,t,r){if(e.length===0||!t||!r)return[];return[{action:"rewrite",description:"origin guard header",expression:`(${ae(e)})`,enabled:!0,action_parameters:{headers:{[t]:{operation:"set",value:r}}}}]}var N=(e)=>e===void 0?void 0:e?"on":"off";function le(e){let t={ssl:e.ssl,always_use_https:N(e.alwaysUseHttps),automatic_https_rewrites:N(e.automaticHttpsRewrites),min_tls_version:e.minTlsVersion,tls_1_3:N(e.tls13),brotli:N(e.brotli),http3:N(e.http3),"0rtt":N(e.zeroRtt),early_hints:N(e.earlyHints),browser_cache_ttl:e.browserCacheTtl,always_online:N(e.alwaysOnline),websockets:N(e.websockets),email_obfuscation:N(e.emailObfuscation)};if(e.hsts)t.security_header={strict_transport_security:{enabled:e.hsts.enabled,max_age:e.hsts.maxAge??31536000,include_subdomains:e.hsts.includeSubdomains??!1,preload:e.hsts.preload??!1,nosniff:e.hsts.noSniff??!0}};for(let r of Object.keys(t))if(t[r]===void 0)delete t[r];return{...t,...e.raw??{}}}var W={ssl:"strict",alwaysUseHttps:!0,automaticHttpsRewrites:!0,minTlsVersion:"1.2",tls13:!0,brotli:!0,http3:!0,earlyHints:!0,alwaysOnline:!0,emailObfuscation:!1,browserCacheTtl:0};import{connect as it}from"node:tls";async function de(e){let{address:t,serverName:r,port:n=443,timeoutMs:o=5000}=e;return new Promise((l)=>{let c=!1,s=(h)=>{if(c)return;c=!0;try{d.destroy()}catch{}l(h)},d=it({host:t,port:n,servername:r,rejectUnauthorized:!1,timeout:o});d.once("secureConnect",()=>{if(d.authorized){s({reachable:!0,trusted:!0});return}s({reachable:!0,trusted:!1,reason:d.authorizationError?String(d.authorizationError):"origin certificate is not trusted for this hostname"})}),d.once("timeout",()=>{s({reachable:!1,trusted:!1,reason:`no TLS handshake within ${o}ms`})}),d.once("error",(h)=>{s({reachable:!1,trusted:!1,reason:h.message})})})}function ot(e,t){let r=t.replace(/\.$/,"").toLowerCase();return e.some((n)=>{let o=n.replace(/\.$/,"").toLowerCase();if(o===r)return!0;if(!o.startsWith("*."))return!1;let l=o.slice(2);if(!r.endsWith(`.${l}`))return!1;return!r.slice(0,r.length-l.length-1).includes(".")})}async function at(e){let{provider:t,zone:r,hosts:n,ipv4:o,ipv6:l,proxied:c=!0,settings:s=W,cache:d,originGuard:h,purge:u=!0,ttl:b=300,skipOriginProbe:A=!1,skipEdgeCertificateCheck:T=!1}=e,g={records:[],settingsChanged:[],cacheRules:0,originGuard:!1,purged:!1,deferredProxy:[],warnings:[]};if(n.length===0)return g;let m=[],a=c&&!T?await t.listEdgeCertificateHosts(r):null;for(let i of n){let p=c;if(p&&a&&!ot(a,i)){p=!1;let C=a.length===0?"the zone has no active edge certificate yet":`no active edge certificate covers it (${a.join(", ")})`;g.deferredProxy.push({host:i,reason:C}),g.warnings.push(`${i}: publishing DNS-only — ${C}. Proxying it would make Cloudflare terminate TLS with no certificate for the name, which fails the handshake outright rather than degrading. Universal SSL covers the apex and ONE level of subdomain, so a deeper name needs its own certificate; otherwise re-run the deploy once the certificate is active.`)}if(p&&!A){let C=await de({address:o,serverName:i});if(!C.trusted){p=!1;let S=C.reason||"origin is not serving a trusted certificate";g.deferredProxy.push({host:i,reason:S}),g.warnings.push(`${i}: publishing DNS-only for now — the origin does not yet serve a certificate this proxy can verify (${S}). The origin issues certificates over HTTP-01, which needs the name to reach it directly; re-run the deploy once it has one and the record will be proxied.`)}}if(p)m.push(i);let f=[{type:"A",content:o}];if(l&&ue(i))f.push({type:"AAAA",content:l});for(let{type:C,content:S}of f){let R=await t.upsertRecord(r,{name:i,type:C,content:S,ttl:b,proxied:p});if(R.success)g.records.push({host:i,type:C,content:S,proxied:p});else g.warnings.push(`${i} ${C} → ${S} failed: ${R.message||"unknown provider error"}`)}}if(m.length===0){if(c)g.warnings.push("No host is proxied yet, so zone settings, cache rules and purge were skipped — they only take effect through the proxy.");return g}try{let i=le(s),p=await t.applyZoneSettings(r,i);g.settingsChanged=p.changed;for(let f of p.failed)g.warnings.push(`zone setting '${f.id}' could not be applied: ${f.error}`)}catch(i){g.warnings.push(`zone settings could not be read: ${i instanceof Error?i.message:String(i)}`)}let y=se(m,d);if(y.length>0){let i=await t.putManagedPhaseRules(r,"http_request_cache_settings",y);if(i.success)g.cacheRules=y.length;else g.warnings.push(`cache rules could not be written: ${i.message}`)}if(h){let i=ce(m,h.header,h.value);if(i.length>0){let p=await t.putManagedPhaseRules(r,"http_request_late_transform",i);if(p.success)g.originGuard=!0;else g.warnings.push(`origin guard header could not be written: ${p.message}. `+"The gateway will reject requests that lack it — disable the guard or grant the token Transform Rules: Edit.")}}if(u){if(g.purged=await t.purgeCache(r,{hosts:m}),!g.purged)g.warnings.push("edge cache purge failed — new content may take until TTL expiry to appear.")}return g}var st=(e)=>process.env[e];function xe(e,t){let r=e.replace(/\.$/,"").toLowerCase();if(t){let n=t.replace(/\.$/,"").toLowerCase();if(r===n||r.endsWith(`.${n}`))return n}return r.split(".").slice(-2).join(".")}function ct(e,t={}){let r=t.env??st,n=e.infrastructure?.compute?.proxy?.cdn,o=[];if(!n||n.provider!=="cloudflare")return{plan:null,errors:o};if(n.originDomain)o.push(`compute.proxy.cdn.originDomain (${n.originDomain}) is ignored for Cloudflare: the proxy forwards to the address in the record it fronts, `+"so no separate origin hostname is needed — and publishing one gives clients a documented way around the edge.");let l=r("CLOUDFLARE_API_TOKEN");if(!l)return o.push("CLOUDFLARE_API_TOKEN is not set — the Cloudflare CDN cannot be reconciled."),{plan:null,errors:o};let c=e.sites??{},s=n.frontedHosts?.length?[...new Set(n.frontedHosts.map((A)=>A.toLowerCase()))]:pe(c,{autoWww:e.infrastructure?.compute?.proxy?.autoWww!==!1});if(s.length===0)return o.push("No hostnames to front — set compute.proxy.cdn.frontedHosts, or give a site a domain."),{plan:null,errors:o};let d=e.infrastructure?.dns?.domain,h=new Set(s.map((A)=>xe(A,d)));if(h.size>1)return o.push(`Fronted hosts span more than one zone (${[...h].join(", ")}). A Cloudflare zone is configured as a unit, so run one CDN config per zone.`),{plan:null,errors:o};let u=n.cloudflare??{},b=n.secret?{header:n.secretHeader??"X-Origin-Verify",value:n.secret}:void 0;return{plan:{zone:[...h][0],hosts:s,apiToken:l,zoneId:u.zoneId??r("CLOUDFLARE_ZONE_ID"),accountId:u.accountId??r("CLOUDFLARE_ACCOUNT_ID"),proxied:u.proxied!==!1,settings:u.settings??W,cache:u.cache,originGuard:b,purge:u.purgeOnDeploy!==!1,skipOriginProbe:u.skipOriginProbe===!0},errors:o}}export{bu as ABTestManager,fr as ACMClient,gr as ACMDnsValidator,Oe as ACME_DIRECTORIES,M as AI,Ef as API_IDEMPOTENCY_TTL_MS,If as API_TOKEN_DEFAULT_TTL_MS,Df as API_TOKEN_MAX_TTL_MS,Ny as API_VERSION,pf as AUTHORIZATION_CAPABILITIES,Qm as AUTH_ACTION_TOKEN_TTL_MS,Xm as AUTH_MFA_CHALLENGE_TTL_MS,ef as AUTH_OIDC_TRANSACTION_TTL_MS,Ym as AUTH_SESSION_ABSOLUTE_TTL_MS,Jm as AUTH_SESSION_IDLE_TTL_MS,Oc as AWSAPIError,St as AWSClient,Le as AWSCloudFormationClient,Me as AWSCloudFrontClient,lu as AWSConfigManager,Ps as AWS_PSEUDO_PARAMETERS,Ad as AWS_REGIONS,nt as AcmeClient,Pt as AlertEvaluator,$t as AlertStore,Vh as AnomalyConfigStore,Pe as ApiGateway,Dy as ApiServiceError,zr as ApplicationAutoScalingClient,$s as Arn,Ss as AssetHasher,ys as Auth,tf as AuthenticationStore,wy as AutomationApiService,wf as AutomationIdentityStore,qC as AwsAuroraDataAdapter,eS as AwsAuroraTransport,US as AwsDatabaseBackupSource,fn as AwsDriver,JC as AwsElastiCacheDataAdapter,tS as AwsElastiCacheTransport,Hy as AwsIamCapabilityScanner,tA as AwsInfrastructureBackupSource,jC as AwsRdsDataAdapter,XC as AwsRdsTransport,TS as AwsRegionalDriver,aA as AwsSecretsManagerConfigurationBackend,$y as AwsSpendTransport,sA as AwsSsmConfigurationBackend,GS as BackupCoordinator,ou as BackupManager,_S as BackupStore,Fp as BatchProcessingManager,Or as BedrockClient,vr as BedrockRuntimeClient,Eg as BitbucketSourceAdapter,yu as BlueGreenManager,bp as BounceComplaintHandler,Yu as BuildOptimizationManager,rS as BunDockerRuntime,QS as BunDockerVolumeRuntime,qS as BunFilesystemArchiveRuntime,ss as CDN,dt as CHAIN_HEADER,Jt as CLOUDFLARE_MANAGED_RULE_PREFIX,_d as COMMON_CROSS_ACCOUNT_ROLES,df as CONTROL_PLANE_SCHEMA_VERSION,re as Cache,Su as CanaryManager,Ku as CertificateManager,dg as CloudBlockVolumeDriver,bn as CloudDriverFactory,Ic as CloudError,Is as CloudFormationBuilder,Le as CloudFormationClient,Me as CloudFrontClient,uu as CloudTrailManager,Tr as CloudWatchLogsClient,Yt as CloudflareProvider,sd as CommandHistory,Rs as Communication,fg as ComposeApplicationService,mg as ComposeApplicationStore,Nr as ComprehendClient,w as Compute,Py as ComputeSpendTransport,Dc as ConfigurationError,lA as ConfigurationService,rA as ConfigurationStore,$r as ConnectClient,QC as ContainerDataAdapter,Xu as ContainerRegistryManager,eA as ControlPlaneBackupSource,MS as ControlPlaneCleanupDriver,$f as ControlPlaneStore,dh as CounterTracker,Ec as CredentialError,pd as CrossRegionReferenceManager,Us as DASHBOARD_ENTRY,Zs as DASHBOARD_PORT_BASE,js as DASHBOARD_PORT_SPAN,Ks as DASHBOARD_STATE_DIR,ti as DEFAULT_ATTACK_MODE_HOURS,vt as DEFAULT_DDOS_THRESHOLDS,sh as DEFAULT_METER_MAPPINGS,Qg as DEFAULT_PRICE_BOOK,mt as DEFAULT_RECURSION_LIMITS,zc as DEFAULT_SERVICE_LIMITS,wa as DEFAULT_STATE_DIR,Ne as DEFAULT_STATIC_ASSET_EXTENSIONS,ry as DEFAULT_TELEMETRY_POLICY,fh as DEFAULT_THRESHOLDS,Qf as DEPLOYMENT_QUEUE_KINDS,lt as DEPTH_HEADER,_h as DETECTABLE_SIGNALS,PC as DIAGNOSTIC_PRESETS,Lp as DLQMonitoringManager,cs as DNS,yp as DNSSECManager,UC as DataServiceLifecycle,GC as DataServiceStore,U as Database,_u as DatabaseUserManager,Lc as DebugLogger,ns as DependencyGraph,Cs as Deployment,wc as DeploymentError,su as DisasterRecoveryManager,pr as DnsProviderFactory,nS as DockerDataTransport,hC as DockerDiscoveryAdapter,cg as DockerNamedVolumeDriver,XS as DockerVolumeBackupSource,jf as DurableOperationQueue,qf as DurableQueueWorker,Dr as DynamoDBClient,Kt as EC2Client,hr as ECRClient,yr as ECSClient,Ur as EFSClient,Pr as ELBv2Client,Hg as ENFORCEMENT_ACTIONS,Th as ENFORCEMENT_DESCRIPTIONS,Gg as ENFORCEMENT_SEVERITY,AC as EcsRuntimeAdapter,Yn as EdgeRateLimiter,Br as ElastiCacheClient,L as Email,wp as EmailAdvanced,Tp as EmailAnalyticsManager,Tt as EmailClient,vp as EmailHandlers,Dp as EmailTemplateManager,iS as EncryptedDataSecretStore,Nc as ErrorCodes,_r as EventBridgeClient,VC as EventBridgeJobAdapter,cA as ExternalConfigurationBackend,kp as FIFOQueueManager,Gh as FOCUS_VERSION,Uc as FileCache,K as FileSystem,JS as FilesystemBackupSource,lS as FleetService,cS as FleetStore,Ts as Fn,wg as GiteaSourceAdapter,Ig as GithubSourceAdapter,Dg as GitlabSourceAdapter,md as GlobalResourceManager,qt as GoDaddyProvider,mu as GuardDutyManager,rl as HashCache,km as HealthCheckManager,Et as HealthCheckRunner,gn as HetznerClient,Sn as HetznerDriver,At as IAMClient,Jr as IPV6_EXCLUDED_HOST_LABELS,qu as ImageScanningManager,ze as InfrastructureGenerator,Cf as InvalidOperationTransitionError,us as JobLoader,_C as JobProviderReconciler,WC as JobService,LC as JobStore,Vr as KendraClient,Tm as LARAVEL_SERVERLESS_BUILD_STEPS,Rr as LambdaClient,sp as LambdaConcurrencyManager,mp as LambdaDLQManager,lp as LambdaDestinationsManager,np as LambdaLayersManager,bC as LambdaRuntimeAdapter,up as LambdaVPCManager,op as LambdaVersionsManager,oA as LocalEncryptedConfigurationBackend,YS as LogicalDatabaseBackupSource,wu as LogsManager,Zp as MANAGED_NODE_VERSIONS,Fn as MANAGEMENT_DASHBOARD_SITE,Xs as MANAGEMENT_DASHBOARD_SITE_PREFIX,ei as MAX_CONTROL_HOURS,Rf as MAX_CONTROL_PLANE_ERROR_BYTES,bf as MAX_CONTROL_PLANE_JSON_BYTES,zg as METERS,Wg as METER_KEYS,Kg as MICRO_CENTS,Sh as MIN_PROJECTION_CONFIDENCE,kS as MaintenanceService,OS as MaintenanceStore,gs as Messaging,Du as MetricsManager,ku as MigrationManager,Il as MockCloudFormation,El as MockDynamoDB,Dl as MockS3,Ie as Monitoring,kd as MultiAccountManager,dd as MultiRegionManager,Kl as MultiStepProgress,Re as Network,Lm as NetworkSecurityManager,Dt as NotificationRouter,Er as OpenSearchClient,yf as OptimisticConcurrencyError,xd as OrganizationManager,Pm as PHP_DEFAULT_EXCLUDES,Qp as PHP_LAYER_EXTENSIONS,Zt as PROXIABLE_RECORD_TYPES,bs as ParameterStore,Fu as PerformanceManager,$e as Permissions,Fr as PersonalizeClient,ds as Phone,Op as PhoneAdvanced,ls as PhoneHandlers,mS as PlacementService,pS as PlacementStore,Lr as PollyClient,jt as PorkbunProvider,Fy as PreDeployScanner,vl as PreviewEnvironmentManager,Yf as PreviewEnvironmentService,Jf as PreviewEnvironmentStore,Ll as PreviewNotificationService,Gl as ProgressBar,Tu as ProgressiveDeploymentManager,ri as ProtectionControlStore,Ka as Pseudo,te as Queue,Kf as QueueCancellationError,_p as QueueManagementManager,Da as QueuePresets,Uf as QueueTimeoutError,Zn as RATE_LIMIT_KEY_SEPARATOR,Ir as RDSClient,Fd as RECOMMENDED_ACCOUNT_STRUCTURES,Vd as RECOMMENDED_SCPS,Rg as RELEASE_QUEUE_KINDS,id as REPL,ad as REPLCommandBuilder,od as REPLContext,ll as RateLimiter,Ea as RealtimePresets,ty as RecordingSpendTransport,ht as RecursionGuard,Z as Redirects,fd as RegionPairManager,bS as RegionService,AS as RegionStore,as as Registry,kr as RekognitionClient,Cg as ReleaseService,yg as ReleaseStore,fS as RemoteBuildService,Lu as ReplicaManager,Fm as ResourceManagementManager,Zf as RetryableOperationError,j as Route53Client,Ut as Route53DomainsClient,rr as Route53Provider,Sp as Route53ResolverManager,gp as Route53RoutingManager,IC as RuntimeOperationService,DC as RuntimeStreamRegistry,HS as S3BackupDestinationAdapter,bt as S3Client,$c as S3Error,My as SECRET_PATTERNS,Mh as SENSITIVITY_THRESHOLDS,Rt as SESClient,fs as SMS,Ar as SNSClient,Ry as SPEND_CYCLE_SECONDS,Jh as SPEND_GATE_SETTING,Sy as SPEND_LEASE_SETTING,br as SQSClient,Cr as SSMClient,va as STATE_DIR_ENV_VAR,W as STATIC_SITE_ZONE_SETTINGS,Vt as STSClient,Wr as SchedulerClient,De as Search,Wy as SecretFindingScanner,As as Secrets,Hu as SecretsManager,Sr as SecretsManagerClient,Wu as SecretsRotationManager,ee as Security,gu as SecurityHubManager,Ly as SecurityPostureStore,By as SecurityScannerRunner,Zu as SecurityScanningManager,Pp as SenderReputationManager,FC as ServerCronJobAdapter,YC as ServerDataAdapter,lg as ServerPathVolumeDriver,tp as ServiceMeshManager,Te as Sftp,Wh as SignalSource,Np as SmsAdvanced,Hr as SmsClient,ms as SmsHandlers,$g as SourceConnectionStore,Pg as SourceProviderError,Qh as SpendCapError,Yh as SpendGate,Ay as SpendLoopLease,Cy as SpendNotificationRouter,by as SpendRunner,jh as SpendService,gh as SpendStore,Ul as Spinner,aS as SshFleetDriver,gd as StackDependencyManager,ps as StacksIntegration,wm as StaticSiteManager,X as Storage,Om as StorageAdvancedManager,Kr as SupportClient,Ou as SyntheticsManager,oS as SystemFleetSshTransport,SC as SystemdDiscoveryAdapter,ut as TRACE_HEADER,Zl as TaskList,fy as TelemetryStore,Se as TemplateBuilder,Zc as TemplateCache,xr as TextractClient,wr as TranscribeClient,Mr as TranslateClient,FS as TransportDisasterRecoveryDriver,LS as TransportPlatformMaintenanceDriver,hS as TransportRemoteBuildDriver,zy as TrivyImageScanner,vf as TsCloudApiError,Of as TsCloudClient,gy as URGENT_SPEND_EVENTS,$h as USER_VISIBLE_ACTIONS,$S as UnavailableRegionalDriver,sr as UnifiedDnsValidator,Sf as UnsupportedSchemaVersionError,vc as ValidationError,Gr as VoiceClient,ag as VolumeService,tg as VolumeStore,hs as Workflow,Pu as XRayManager,Ru as abTestManager,Ag as activateImmutableRelease,lC as ageSeconds,ph as aggregateDeltas,is as analyzeStackDiff,Lh as anomalyOptionsForSignal,oi as applyControlsToDdos,ii as applyControlsToRateLimits,Ft as applyMitigationFactor,or as applyZoneMigration,Kp as artifactKey,hg as assertReleaseStrategy,Xh as assertSpendAllows,qy as attachProvenanceToRelease,Uy as attachSbomToRelease,Zy as attachVulnerabilitySummary,nf as authEncryptionKeyFile,gf as authorizeOrganization,$C as authorizeRuntimePath,Xl as autocomplete,du as awsConfigManager,zS as backupCredentialStatus,au as backupManager,il as batch,Vp as batchProcessingManager,cf as beginOidcAuthorization,Cu as blueGreenManager,Rp as bounceComplaintHandler,nh as budgetWindow,hi as buildAndPushServerlessImage,om as buildBunRuntimeLayerZip,Ds as buildCloudFormationTemplate,Hf as buildComposeLogsCommand,Wf as buildComposeRuntimeCommand,zf as buildComposeScaleCommand,Gf as buildComposeShellCommand,Ci as buildFunctionEnv,Mn as buildHostCleanupScript,Ha as buildMailEnv,zn as buildManagementDashboardArtifact,xi as buildMediaCdnPlan,im as buildNodeRuntimeLayerZip,Qu as buildOptimizationManager,ce as buildOriginGuardRule,$m as buildPhpRuntimeLayerZip,xn as buildSiteDeployScript,Tn as buildSshArgs,se as buildStaticSiteCacheRules,Ln as buildStaticSiteDeployScript,dC as bytes,Au as canaryManager,PS as canonicalJson,aC as capabilities,uS as capacity,gl as categorizeChanges,Uu as certificateManager,_c as checkIAMPermissions,um as checkInvocation,Hc as checkServiceQuotas,dl as chunk,Yi as cleanupDns01Challenge,Ta as clearSigningKeyCache,Lg as cloneSourceBinding,Cl as cloudConfigSchema,Rn as cloudDrivers,pu as cloudTrailManager,Dm as collectPhpAppEntries,Zr as collectServerDnsDomains,pg as completeComposeVolumeDeletion,lf as completeOidcAuthorization,oc as composePresets,Bf as composeProjectName,Yp as composeServerlessAppTemplate,Iy as compositeSpendTransport,ZS as compressBackup,zm as config,KC as connectionGuidance,ep as containerRegistryManager,Af as controlPlaneDatabaseFile,uf as controlPlaneMigrations,xs as createApiBackendPreset,xy as createApiV1Handler,SS as createAsgBuildDriver,KS as createBackupQueueHandlers,Cm as createCliHandler,An as createCloudDriver,Ce as createCloudFrontPolicy,Ac as createCredentialProvider,Gs as createDashboardSite,_s as createDataPipelinePreset,ZC as createDataServiceQueueHandlers,eg as createDeploymentQueueHandlers,q as createDnsProvider,CS as createEcsBuildDriver,ey as createEnforcementHandlers,xc as createError,Ns as createExistingStaticFullStackPreset,sS as createFleetQueueHandlers,ks as createFullStackAppPreset,lr as createGoDaddyValidator,Sm as createHandlers,hm as createHttpHandler,Ms as createJamstackPreset,zC as createJobQueueHandlers,zs as createLaravelPreset,Bs as createMLApiPreset,xS as createMaintenanceQueueHandlers,Oi as createMediaAccessToken,Fs as createMicroservicesPreset,wl as createMockAWS,ws as createNodeJsServerPreset,vs as createNodeJsServerlessPreset,Gt as createObjectStorageClient,cr as createPorkbunValidator,ac as createPreset,ha as createPresignedUrl,ya as createPresignedUrlAsync,ym as createQueueHandler,Vs as createRealtimeAppPreset,RS as createRegionQueueHandlers,jy as createReleaseProvenance,Tg as createReleaseQueueHandlers,gS as createRemoteBuildQueueHandlers,dr as createRoute53Validator,RC as createRuntimeAdapters,Pc as createS3Client,yS as createServerBuildDriver,Hs as createServerlessLaravelPreset,Os as createServerlessNodePreset,vg as createSourceAdapter,Es as createStaticSitePreset,Ws as createTraditionalWebAppPreset,sg as createVolumeQueueHandlers,Ls as createWordPressPreset,Wp as createZip,hd as crossRegionReferenceManager,Pi as dashboardActions,Vn as dashboardCredentialsFile,HC as dataServiceCapabilities,Bu as databaseUserManager,Gm as decodeBase32,jS as decompressBackup,WS as decryptBackup,_m as defaultConfig,Al as defaultLocalConfig,Xn as defaultRateLimitRules,mi as deleteStaticSite,Gn as deployAllComputeSites,Si as deployServerlessApp,gi as deploySite,Hn as deploySiteRelease,di as deployStaticSite,fi as deployStaticSiteFull,si as deployStaticSiteWithExternalDns,ci as deployStaticSiteWithExternalDnsFull,Va as deploymentCoexistenceError,qs as deriveManagementDashboardPort,ni as describePosture,MC as desiredJobProviderState,kh as detectAnomalies,Ma as detectDeploymentTargets,ur as detectDnsProvider,xh as detectLatestAnomaly,Fc as detectMisconfigurations,ma as detectServiceRegion,xf as diffCompose,pl as diffTemplates,xg as discoverGitRefs,sf as discoverOidcProvider,uC as discoverRuntimeInventory,Mp as dlqMonitoringManager,mr as dnsProviders,Cp as dnssecManager,gC as dockerWorkloads,DS as documentDigest,cu as drManager,pC as ecsWorkloads,hf as effectiveCapabilities,$p as emailAnalyticsManager,Ep as emailTemplateManager,Hm as encodeBase32,BS as encryptBackup,Qy as ensureDefaultSecurityPolicies,vn as ensureFirewall,Wn as ensureManagementDashboard,On as ensureServer,wn as ensureSshKey,sn as escapeSecLang,bh as evaluateBudget,wt as evaluateTelemetryAlertRules,kC as eventBridgeScheduleInput,fm as eventToRequest,Nh as ewma,kf as exportCompose,nr as exportRoute53Zone,ic as extendPreset,xp as fifoQueueManager,tl as findChangedFiles,ch as findMapping,Zg as findPriceEntry,Hd as formatAccountStructure,Bl as formatBytes,hy as formatCents,os as formatDiff,Wl as formatDuration,td as formatFlagSuggestions,cd as formatHistory,ld as formatHistoryStats,Hl as formatKeyValue,zl as formatList,_l as formatProgressBar,vd as formatRegion,Od as formatRegionList,_y as formatScanResults,ql as formatSuggestion,Fl as formatTable,Ch as formatTimeToExhaustion,Vl as formatTree,hc as fromEC2Metadata,yc as fromECSMetadata,fc as fromEnvironment,gc as fromSharedCredentials,Cc as fromWebIdentity,pt as functionFingerprint,pe as gatewayHostnames,rm as generateAppImageDockerfile,nu as generateApprovalConfig,zp as generateBootstrap,kl as generateCleanupWorkflow,xl as generateCostReportWorkflow,Wd as generateCrossAccountRoleCF,Gy as generateCycloneDxSbom,eu as generateDeploymentConfig,qd as generateDeploymentPipeline,Gd as generateDeploymentWorkflow,ai as generateExternalDnsStaticSiteTemplate,qi as generateHttpsServerCode,Ky as generateImageSbom,ji as generateLetsEncryptUserData,be as generateLogicalId,Xd as generateManualPipeline,jd as generateMatrixWorkflow,tu as generateMultiEnvConfig,Jd as generateMultiEnvPipeline,Kd as generateMultiEnvWorkflow,Ud as generatePRPreviewWorkflow,iu as generateParallelConfig,Am as generatePhpFpmConfig,tm as generatePhpLayerDockerfile,Yd as generatePreviewPipeline,Nl as generatePreviewWorkflow,Ae as generateResourceName,ru as generateScheduledConfig,Qd as generateScheduledPipeline,Zd as generateScheduledWorkflow,li as generateStaticSiteTemplate,mn as generateUbuntuAppCloudInit,Tc as getAccountId,Rd as getAllRegions,Dd as getClosestRegion,rd as getCommandUsage,Mf as getComposeTemplate,Bm as getConfig,Yl as getContextualHelp,Sc as getCredentials,hl as getDeploymentStrategy,yl as getDiffStats,ml as getDiffSummary,kc as getErrorDetails,bl as getLocalConfig,$l as getLocalCredentials,Tl as getLocalEndpoint,Pl as getLocalEnvVars,Gc as getQuotaUsageSummary,Bd as getRecommendedStructure,bd as getRegion,Nd as getRegionStats,$d as getRegionsByCompliance,Td as getRegionsByLocation,Pd as getRegionsByPricingTier,Bc as getRequiredPermissions,$a as getSigningKeyCacheSize,Ua as getTimestamp,jn as globMatches,ln as globToRegex,yd as globalResourceManager,Ah as governingLimitCents,fu as guardDutyManager,vy as handleSpendRequest,an as hasAutoWwwVariant,Qs as hasManagementDashboardSite,en as hasProxyUpstream,Yc as hashBuffer,Qc as hashDirectory,qc as hashFile,Xc as hashManifest,Jc as hashString,xm as healthCheckManager,ue as hostAcceptsIpv6,ae as hostCondition,Km as hotp,oh as hourBucket,ah as hourBucketsBetween,Ju as imageScanningManager,yi as infraEnvFromOutputs,gt as inspectInvocation,cm as installRecursionFetch,pi as invalidateCache,am as invocationContext,Jl as isLikelyTypo,Rl as isLocalDevelopment,tc as isManagementDashboardSiteName,Pa as isNodeCryptoAvailable,Eh as isOperationAllowed,It as isQuietHours,cn as isSafePattern,La as isStatePath,Ot as isValidCidr,Id as isValidRegion,Xg as isValidTimeZone,Ia as isWebCryptoAvailable,OC as jobProviderCapability,Bt as keyMatchesFilters,cp as lambdaConcurrencyManager,fp as lambdaDLQManager,dp as lambdaDestinationsManager,ip as lambdaLayersManager,pp as lambdaVPCManager,ap as lambdaVersionsManager,mC as lambdaWorkloads,Rm as laravelServerlessEnvDefaults,Lf as listComposeTemplates,Vg as listSourceReferences,Wm as loadCloudConfig,oy as loadTelemetryPolicy,vu as logsManager,Hh as lookbackHoursForSignal,Ba as mailEnabled,za as mailFirewallPorts,NS as maintenanceWindowOpen,Ca as makeAWSRequest,Aa as makeAWSRequestAsync,Sa as makeAWSRequestOnce,ec as managementDashboardSiteName,IS as manifestDigest,jm as matchTotpCounter,ki as mediaObjectHeaders,wh as median,vh as medianAbsoluteDeviation,Rh as mergeDecisions,sc as mergeInfrastructure,Yg as mergePriceBooks,uh as meterTelemetry,Eu as metricsManager,Wt as migrateObjectStorage,xu as migrationManager,Ld as multiAccountManager,ud as multiRegionManager,Qi as needsRenewal,Mm as networkSecurityManager,wC as nextScheduleRuns,qr as normalizePublicIpv6,sC as normalizeRuntimeStatus,EC as normalizeScheduleExpression,Og as normalizeSourceEvent,yn as normalizeSshPublicKey,ny as normalizeTelemetryPolicy,ky as openApiDocument,zh as optionsForSignal,Md as organizationManager,Em as packagePhpApp,Up as packageServerlessApp,nl as parallel,ol as parallelMap,al as parallelWithRetry,ft as parseChain,Nf as parseCompose,Vf as parseComposeCatalog,fC as parseDockerInspect,nA as parseDotenv,Ra as parseJSONResponse,yC as parseSystemdRecords,ba as parseXMLResponse,dy as pathTemplate,yh as percentOfLimit,Vu as performanceManager,em as phpLayerBuildStage,Xp as phpLayerPackages,bm as phpRuntimeLayerAssets,_f as planComposeTemplateUpgrade,Ph as planEnforcement,Mt as planMitigation,ir as planZoneMigration,Qt as policyTag,Ol as previewManager,Ml as previewNotifications,vC as previewSchedule,ih as previousBudgetWindow,jg as priceUsage,qg as priceUsageLines,de as probeOriginTls,ul as processInChunks,Ng as processSourceWebhook,rC as productionChangeReview,$u as progressiveDeploymentManager,hh as projectSpend,yt as propagationHeaders,zt as providerEndpoint,ES as publicKeyFingerprint,Xt as qualifyName,Bp as queueManagementManager,el as quickHash,Qn as rateLimitHeaders,Jn as rateLimitKey,Yr as reconcileAddressRecords,at as reconcileCloudflareCdn,tr as reconcileDeclaredRecords,xC as reconcileJobObservation,_g as reconcileSourceWebhook,tC as recordDashboardHostPosture,Xy as recordPreDeploySecretScan,eC as recordSkippedSecretScan,Ct as recursionBlockedResponse,cC as redactRuntimeConfig,cy as redactTelemetryText,ly as redactTelemetryValue,Ai as redeployServerlessApp,Cd as regionPairManager,gg as releaseStrategyCapabilities,Sg as releaseTrafficPlan,Kn as reloadRpxGateway,_t as remapKey,Bg as removeSourceWebhook,jr as removeStaleServerAddressRecords,Ff as renderComposeTemplate,Lt as renderDdosInstallScript,xt as renderNftablesRuleset,NC as renderServerCron,kt as renderSysctlFile,dn as renderWafConfig,un as renderWafInstallScript,Un as renewRpxCertificates,Mu as replicaManager,Ey as requestHash,fl as requiresReplacement,dm as resetRecursionRuntime,mm as resolveApp,_a as resolveAppDatabase,of as resolveAuthEncryptionKey,Ga as resolveCloudProvider,ct as resolveCloudflareCdnPlan,bc as resolveCredentials,Ii as resolveDashboardAction,_n as resolveDashboardAuth,Js as resolveDashboardDomain,Ys as resolveDashboardDomains,er as resolveDeclaredRecords,Xa as resolveDeployBucketName,Fa as resolveDeploymentMode,kn as resolveExecStart,hn as resolveHetznerApiToken,Wa as resolveMailService,nc as resolveManagementDashboardSite,rc as resolveManagementDashboardSites,Ht as resolveObjectStorage,ja as resolveProjectStackName,Xr as resolveProxyUpstreams,Jp as resolveQueueNames,Xf as resolveQueuedDeploymentCommand,qp as resolveQueues,sm as resolveRecursionConfig,Rc as resolveRegion,TC as resolveRuntimeInventory,es as resolveServerlessAppStackName,ts as resolveServerlessArtifactBucketName,rs as resolveServerlessAssetBucketName,jp as resolveServerlessRuntime,Ya as resolveSiteBucketName,tn as resolveSiteDeployTarget,rn as resolveSiteKind,Ja as resolveSiteResourceName,qa as resolveSiteStackName,xa as resolveStatePath,Qa as resolveStorageBucketName,Bn as resolveUiSource,xe as resolveZoneApex,Vm as resourceManagementManager,gm as responseToResult,Oh as robustZScore,mf as roleCapabilities,bg as rollbackImmutableRelease,bi as rollbackServerlessApp,Jg as roundCents,Ap as route53ResolverManager,hp as route53RoutingManager,Fh as routeMatches,qn as ruleMatches,Hp as runBuildHooks,Ih as runEnforcement,Im as runPhpBuildHooks,Ti as runRemoteCommand,iC as runtimeId,$i as sanitizeCloudConfig,Tf as sanitizeControlPlaneValue,Za as sanitizeName,af as sanitizeOidcReturnPath,ay as saveTelemetryPolicy,Vy as scanForSecrets,ff as scopeContains,mh as scopeKey,In as scpUpload,Ql as searchCommands,Pf as searchControlPlane,Gu as secretsManager,zu as secretsRotationManager,nC as secureContainerRelease,hu as securityHubManager,ju as securityScanningManager,Yy as securityScope,rf as sendAuthenticationEmail,Ip as senderReputationManager,sl as sequence,iA as serializeDotenv,Nn as serverPublicIpv4,rp as serviceMeshManager,Ri as setMaintenance,Oa as setStateDir,Ji as setupDns01Challenge,Gp as sha256,lm as sharedRecursionGuard,nm as sharedRuntimeLoop,on as shipsARelease,vi as signCloudFrontCookies,wi as signCloudFrontUrl,fa as signRequest,ga as signRequestAsync,Bh as signalDefinition,yy as spendNotificationText,Oy as spendOpenApiPaths,$n as sshExec,Pn as sshExecOrThrow,Sd as stackDependencyManager,Di as startLocalDashboardServer,Ty as startSpendLoop,Na as stateDir,ka as statePath,vm as staticSiteManager,Nm as storageAdvancedManager,Zh as streamFocusJsonl,Dh as strongestActiveAction,jl as suggestCommand,ed as suggestFlags,Wc as suggestIAMPolicy,Kc as suggestQuotaIncrease,wd as suggestRegionPairs,Ed as suggestRegions,Fg as syncSourceRepositories,ug as synchronizeComposeVolumes,dA as synchronizeConfiguredConfiguration,BC as synchronizeConfiguredJobs,Nu as syntheticsManager,Nt as sysctlHardening,CC as systemdWorkloads,my as telemetryBucketLabel,uy as telemetryCursor,sy as telemetryEstimatedMonthlyCost,py as telemetryPercentile,iy as telemetryPolicyKey,jc as templateCache,Mg as testSourceConnection,Ug as tieredMicroCents,le as toCloudflareZoneSettings,Uh as toFocusJsonl,Kh as toFocusRecords,Um as totp,qm as totpUri,oC as unsupportedCapabilities,rg as unsupportedVolumeCapabilities,vS as updateCompatibility,ui as uploadStaticFiles,lh as usageDeltaKey,rh as utcInstantOfLocal,zd as validateAccountStructure,Sl as validateAgainstSchema,og as validateAttachment,VS as validateBackupDestination,nd as validateCommand,Mc as validateConfiguration,Vc as validateCredentials,nn as validateDeploymentConfig,ig as validateMountPath,qe as validateResourceLimits,He as validateTemplate,je as validateTemplateSize,Qr as verifyAddressRecord,Jy as verifyArtifactSignature,Ni as verifyMediaAccessToken,Zm as verifyTotp,wS as verifyUpdateSignature,ar as verifyZoneParity,ng as volumeCapabilities,pn as wafEventTelemetry,En as waitForCloudInit,Dn as waitForSsh,kg as webhookEndpoint,pc as withCDN,uc as withCache,dc as withDatabase,pm as withInvocation,cc as withMonitoring,mc as withQueue,lc as withSecurity,cl as withTimeout,Cn as wrapCloudInitUserData,Iu as xrayManager,dS as zeroCapacity,qh as zeroFill,th as zoneOffsetMs,eh as zonedParts};
+`}async function Xi(e){let{domain:t,challengeValue:r,hostedZoneId:n,dnsProvider:o,region:l="us-east-1"}=e;if(o){let s=await q(o).upsertRecord(t,{name:`_acme-challenge.${t}`,type:"TXT",content:r,ttl:60});if(!s.success)throw Error(`Failed to create DNS challenge record: ${s.message}`);return}if(n){await new j(l).changeResourceRecordSets({HostedZoneId:n,ChangeBatch:{Comment:"ACME DNS-01 challenge",Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:`_acme-challenge.${t}`,Type:"TXT",TTL:60,ResourceRecords:[{Value:`"${r}"`}]}}]}});return}throw Error("Either dnsProvider or hostedZoneId must be provided")}async function eo(e){let{domain:t,challengeValue:r,hostedZoneId:n,dnsProvider:o,region:l="us-east-1"}=e;if(o){let s=await q(o).deleteRecord(t,{name:`_acme-challenge.${t}`,type:"TXT",content:r});if(!s.success)console.warn(`Failed to delete DNS challenge record: ${s.message}`);return}if(n){await new j(l).changeResourceRecordSets({HostedZoneId:n,ChangeBatch:{Comment:"Remove ACME DNS-01 challenge",Changes:[{Action:"DELETE",ResourceRecordSet:{Name:`_acme-challenge.${t}`,Type:"TXT",TTL:60,ResourceRecords:[{Value:`"${r}"`}]}}]}});return}throw Error("Either dnsProvider or hostedZoneId must be provided")}function to(e){try{let{execSync:t}=Je("node:child_process"),r=t(`openssl x509 -checkend 2592000 -noout -in ${e}/cert.pem`,{encoding:"utf-8",stdio:["pipe","pipe","pipe"]});return!1}catch{return!0}}import{createHash as we,createSign as rt,generateKeyPairSync as ve}from"node:crypto";var Oe={production:"https://acme-v02.api.letsencrypt.org/directory",staging:"https://acme-staging-v02.api.letsencrypt.org/directory"};class nt{directoryUrl;email;accountKey;accountUrl=null;directory=null;nonce=null;constructor(e){this.directoryUrl=e.staging?Oe.staging:Oe.production,this.email=e.email,this.accountKey=e.accountKey||this.generateAccountKey()}generateAccountKey(){let{privateKey:e}=ve("ec",{namedCurve:"P-256"});return e.export({type:"pkcs8",format:"pem"})}async getDirectory(){if(this.directory)return this.directory;let e=await fetch(this.directoryUrl);if(!e.ok)throw Error(`Failed to fetch ACME directory: ${e.status}`);return this.directory=await e.json(),this.directory}async getNonce(){if(this.nonce){let n=this.nonce;return this.nonce=null,n}let e=await this.getDirectory(),r=(await fetch(e.newNonce,{method:"HEAD"})).headers.get("replay-nonce");if(!r)throw Error("Failed to get nonce from ACME server");return r}getJwk(){let e=this.accountKey.split(`
+`).filter((l)=>!l.startsWith("-----")).join(""),t=Buffer.from(e,"base64"),r=t.length-65,n=t.subarray(r+1,r+33),o=t.subarray(r+33,r+65);return{kty:"EC",crv:"P-256",x:this.base64UrlEncode(n),y:this.base64UrlEncode(o)}}getJwkThumbprint(){let e=this.getJwk(),t=JSON.stringify({crv:e.crv,kty:e.kty,x:e.x,y:e.y}),r=we("sha256").update(t).digest();return this.base64UrlEncode(r)}base64UrlEncode(e){return(typeof e==="string"?Buffer.from(e):e).toString("base64").replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async signPayload(e,t){let r=await this.getNonce(),n=this.getJwk(),o={alg:"ES256",nonce:r,url:e};if(this.accountUrl)o.kid=this.accountUrl;else o.jwk=n;let l=this.base64UrlEncode(JSON.stringify(o)),c=t===""?"":this.base64UrlEncode(JSON.stringify(t)),s=`${l}.${c}`,d=rt("SHA256");d.update(s);let h=d.sign(this.accountKey),u=h.subarray(4,4+h[3]),b=4+h[3]+2,A=h.subarray(b,b+h[b-1]),T=Buffer.alloc(32),g=Buffer.alloc(32);u.copy(T,32-u.length),A.copy(g,32-A.length);let m=Buffer.concat([T,g]);return JSON.stringify({protected:l,payload:c,signature:this.base64UrlEncode(m)})}async acmeRequest(e,t){let r=await this.signPayload(e,t),n=await fetch(e,{method:"POST",headers:{"Content-Type":"application/jose+json"},body:r}),o=n.headers.get("replay-nonce");if(o)this.nonce=o;let l,c=n.headers.get("content-type");if(c?.includes("application/json")||c?.includes("application/problem+json"))l=await n.json();else l=await n.text();if(!n.ok)throw Error(`ACME request failed: ${JSON.stringify(l)}`);return{body:l,headers:n.headers}}async registerAccount(){let e=await this.getDirectory(),{body:t,headers:r}=await this.acmeRequest(e.newAccount,{termsOfServiceAgreed:!0,contact:[`mailto:${this.email}`]}),n=r.get("location");if(!n)throw Error("No account URL returned");return this.accountUrl=n,n}async createOrder(e){if(!this.accountUrl)await this.registerAccount();let t=await this.getDirectory(),{body:r,headers:n}=await this.acmeRequest(t.newOrder,{identifiers:e.map((l)=>({type:"dns",value:l}))}),o=n.get("location");if(!o)throw Error("No order URL returned");return{orderUrl:o,authorizations:r.authorizations,finalize:r.finalize}}async getAuthorization(e){let{body:t}=await this.acmeRequest(e,""),r=t.identifier.value,n=this.getJwkThumbprint(),o=t.challenges.filter((l)=>l.type==="http-01"||l.type==="dns-01").map((l)=>{let c=`${l.token}.${n}`;if(l.type==="http-01")return{type:"http-01",token:l.token,keyAuthorization:c,identifier:`/.well-known/acme-challenge/${l.token}`};else{let s=this.base64UrlEncode(we("sha256").update(c).digest());return{type:"dns-01",token:l.token,keyAuthorization:c,identifier:`_acme-challenge.${r}`,dnsValue:s}}});return{domain:r,challenges:o}}async respondToChallenge(e){await this.acmeRequest(e,{})}async waitForAuthorization(e,t=30){for(let r=0;r<t;r++){let{body:n}=await this.acmeRequest(e,"");if(n.status==="valid")return;if(n.status==="invalid")throw Error(`Authorization failed: ${JSON.stringify(n)}`);await new Promise((o)=>setTimeout(o,2000))}throw Error("Authorization timed out")}generateCsr(e){let{privateKey:t}=ve("rsa",{modulusLength:2048}),r=t.export({type:"pkcs8",format:"pem"});return{csr:this.createSimpleCsr(e,t),privateKey:r}}createSimpleCsr(e,t){throw Error("CSR generation requires additional implementation. Consider using the shell-based certbot approach instead.")}async finalizeOrder(e,t){let{csr:r,privateKey:n}=this.generateCsr(t),{body:o}=await this.acmeRequest(e,{csr:this.base64UrlEncode(Buffer.from(r,"base64"))}),l=o.certificate;if(!l)throw Error("Certificate not immediately available - polling not implemented");let s=await(await fetch(l)).text(),d=s.split(/(?=-----BEGIN CERTIFICATE-----)/g),h=d[0],u=d.slice(1).join("");return{certificate:h,privateKey:n,chain:u,fullchain:s,expiresAt:new Date(Date.now()+7776000000)}}getAccountKey(){return this.accountKey}}var Ne=["js","mjs","cjs","css","map","woff","woff2","ttf","otf","eot","png","jpg","jpeg","gif","webp","avif","svg","ico","mp4","webm","ogg","mp3","wav","pdf","wasm"];function oe(e){return`"${e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`}function ke(e){return`{${e.map(oe).join(" ")}}`}function ae(e){if(e.length===1)return`http.host eq ${oe(e[0])}`;return`http.host in ${ke(e)}`}function se(e,t={}){if(t.enabled===!1||e.length===0)return[];let r=ae(e),n=[],o=t.bypassPaths??[],l=o.length>0?`(${o.map((h)=>`starts_with(http.request.uri.path, ${oe(h)})`).join(" or ")})`:void 0;if(l)n.push({action:"set_cache_settings",description:"bypass cache",expression:`(${r} and ${l})`,enabled:!0,action_parameters:{cache:!1}});let c=l?`${r} and not ${l}`:r,s=t.assetExtensions??Ne,d=s.length>0?`lower(http.request.uri.path.extension) in ${ke([...s])}`:void 0;if(d)n.push({action:"set_cache_settings",description:"cache fingerprinted assets",expression:`(${c} and ${d})`,enabled:!0,action_parameters:{cache:!0,edge_ttl:{mode:"override_origin",default:t.assetEdgeTtl??2592000},browser_ttl:{mode:"override_origin",default:t.assetBrowserTtl??31536000}}});return n.push({action:"set_cache_settings",description:"cache documents",expression:d?`(${c} and not ${d})`:`(${c})`,enabled:!0,action_parameters:{cache:!0,edge_ttl:{mode:"override_origin",default:t.documentEdgeTtl??3600},browser_ttl:{mode:"override_origin",default:t.documentBrowserTtl??0}}}),n}function ce(e,t,r){if(e.length===0||!t||!r)return[];return[{action:"rewrite",description:"origin guard header",expression:`(${ae(e)})`,enabled:!0,action_parameters:{headers:{[t]:{operation:"set",value:r}}}}]}var N=(e)=>e===void 0?void 0:e?"on":"off";function le(e){let t={ssl:e.ssl,always_use_https:N(e.alwaysUseHttps),automatic_https_rewrites:N(e.automaticHttpsRewrites),min_tls_version:e.minTlsVersion,tls_1_3:N(e.tls13),brotli:N(e.brotli),http3:N(e.http3),"0rtt":N(e.zeroRtt),early_hints:N(e.earlyHints),browser_cache_ttl:e.browserCacheTtl,always_online:N(e.alwaysOnline),websockets:N(e.websockets),email_obfuscation:N(e.emailObfuscation)};if(e.hsts)t.security_header={strict_transport_security:{enabled:e.hsts.enabled,max_age:e.hsts.maxAge??31536000,include_subdomains:e.hsts.includeSubdomains??!1,preload:e.hsts.preload??!1,nosniff:e.hsts.noSniff??!0}};for(let r of Object.keys(t))if(t[r]===void 0)delete t[r];return{...t,...e.raw??{}}}var W={ssl:"strict",alwaysUseHttps:!0,automaticHttpsRewrites:!0,minTlsVersion:"1.2",tls13:!0,brotli:!0,http3:!0,earlyHints:!0,alwaysOnline:!0,emailObfuscation:!1,browserCacheTtl:0};import{connect as it}from"node:tls";async function de(e){let{address:t,serverName:r,port:n=443,timeoutMs:o=5000}=e;return new Promise((l)=>{let c=!1,s=(h)=>{if(c)return;c=!0;try{d.destroy()}catch{}l(h)},d=it({host:t,port:n,servername:r,rejectUnauthorized:!1,timeout:o});d.once("secureConnect",()=>{if(d.authorized){s({reachable:!0,trusted:!0});return}s({reachable:!0,trusted:!1,reason:d.authorizationError?String(d.authorizationError):"origin certificate is not trusted for this hostname"})}),d.once("timeout",()=>{s({reachable:!1,trusted:!1,reason:`no TLS handshake within ${o}ms`})}),d.once("error",(h)=>{s({reachable:!1,trusted:!1,reason:h.message})})})}function ot(e,t){let r=t.replace(/\.$/,"").toLowerCase();return e.some((n)=>{let o=n.replace(/\.$/,"").toLowerCase();if(o===r)return!0;if(!o.startsWith("*."))return!1;let l=o.slice(2);if(!r.endsWith(`.${l}`))return!1;return!r.slice(0,r.length-l.length-1).includes(".")})}async function at(e){let{provider:t,zone:r,hosts:n,ipv4:o,ipv6:l,proxied:c=!0,settings:s=W,cache:d,originGuard:h,purge:u=!0,ttl:b=300,skipOriginProbe:A=!1,skipEdgeCertificateCheck:T=!1}=e,g={records:[],settingsChanged:[],cacheRules:0,originGuard:!1,purged:!1,deferredProxy:[],warnings:[]};if(n.length===0)return g;let m=[],a=c&&!T?await t.listEdgeCertificateHosts(r):null;for(let i of n){let p=c;if(p&&a&&!ot(a,i)){p=!1;let C=a.length===0?"the zone has no active edge certificate yet":`no active edge certificate covers it (${a.join(", ")})`;g.deferredProxy.push({host:i,reason:C}),g.warnings.push(`${i}: publishing DNS-only — ${C}. Proxying it would make Cloudflare terminate TLS with no certificate for the name, which fails the handshake outright rather than degrading. Universal SSL covers the apex and ONE level of subdomain, so a deeper name needs its own certificate; otherwise re-run the deploy once the certificate is active.`)}if(p&&!A){let C=await de({address:o,serverName:i});if(!C.trusted){p=!1;let S=C.reason||"origin is not serving a trusted certificate";g.deferredProxy.push({host:i,reason:S}),g.warnings.push(`${i}: publishing DNS-only for now — the origin does not yet serve a certificate this proxy can verify (${S}). The origin issues certificates over HTTP-01, which needs the name to reach it directly; re-run the deploy once it has one and the record will be proxied.`)}}if(p)m.push(i);let f=[{type:"A",content:o}];if(l&&ue(i))f.push({type:"AAAA",content:l});for(let{type:C,content:S}of f){let R=await t.upsertRecord(r,{name:i,type:C,content:S,ttl:b,proxied:p});if(R.success)g.records.push({host:i,type:C,content:S,proxied:p});else g.warnings.push(`${i} ${C} → ${S} failed: ${R.message||"unknown provider error"}`)}}if(m.length===0){if(c)g.warnings.push("No host is proxied yet, so zone settings, cache rules and purge were skipped — they only take effect through the proxy.");return g}try{let i=le(s),p=await t.applyZoneSettings(r,i);g.settingsChanged=p.changed;for(let f of p.failed)g.warnings.push(`zone setting '${f.id}' could not be applied: ${f.error}`)}catch(i){g.warnings.push(`zone settings could not be read: ${i instanceof Error?i.message:String(i)}`)}let y=se(m,d);if(y.length>0){let i=await t.putManagedPhaseRules(r,"http_request_cache_settings",y);if(i.success)g.cacheRules=y.length;else g.warnings.push(`cache rules could not be written: ${i.message}`)}if(h){let i=ce(m,h.header,h.value);if(i.length>0){let p=await t.putManagedPhaseRules(r,"http_request_late_transform",i);if(p.success)g.originGuard=!0;else g.warnings.push(`origin guard header could not be written: ${p.message}. `+"The gateway will reject requests that lack it — disable the guard or grant the token Transform Rules: Edit.")}}if(u){if(g.purged=await t.purgeCache(r,{hosts:m}),!g.purged)g.warnings.push("edge cache purge failed — new content may take until TTL expiry to appear.")}return g}var st=(e)=>process.env[e];function xe(e,t){let r=e.replace(/\.$/,"").toLowerCase();if(t){let n=t.replace(/\.$/,"").toLowerCase();if(r===n||r.endsWith(`.${n}`))return n}return r.split(".").slice(-2).join(".")}function ct(e,t={}){let r=t.env??st,n=e.infrastructure?.compute?.proxy?.cdn,o=[];if(!n||n.provider!=="cloudflare")return{plan:null,errors:o};if(n.originDomain)o.push(`compute.proxy.cdn.originDomain (${n.originDomain}) is ignored for Cloudflare: the proxy forwards to the address in the record it fronts, `+"so no separate origin hostname is needed — and publishing one gives clients a documented way around the edge.");let l=r("CLOUDFLARE_API_TOKEN");if(!l)return o.push("CLOUDFLARE_API_TOKEN is not set — the Cloudflare CDN cannot be reconciled."),{plan:null,errors:o};let c=e.sites??{},s=n.frontedHosts?.length?[...new Set(n.frontedHosts.map((A)=>A.toLowerCase()))]:pe(c,{autoWww:e.infrastructure?.compute?.proxy?.autoWww!==!1});if(s.length===0)return o.push("No hostnames to front — set compute.proxy.cdn.frontedHosts, or give a site a domain."),{plan:null,errors:o};let d=e.infrastructure?.dns?.domain,h=new Set(s.map((A)=>xe(A,d)));if(h.size>1)return o.push(`Fronted hosts span more than one zone (${[...h].join(", ")}). A Cloudflare zone is configured as a unit, so run one CDN config per zone.`),{plan:null,errors:o};let u=n.cloudflare??{},b=n.secret?{header:n.secretHeader??"X-Origin-Verify",value:n.secret}:void 0;return{plan:{zone:[...h][0],hosts:s,apiToken:l,zoneId:u.zoneId??r("CLOUDFLARE_ZONE_ID"),accountId:u.accountId??r("CLOUDFLARE_ACCOUNT_ID"),proxied:u.proxied!==!1,settings:u.settings??W,cache:u.cache,originGuard:b,purge:u.purgeOnDeploy!==!1,skipOriginProbe:u.skipOriginProbe===!0},errors:o}}export{Pu as ABTestManager,fr as ACMClient,gr as ACMDnsValidator,Oe as ACME_DIRECTORIES,M as AI,Nf as API_IDEMPOTENCY_TTL_MS,vf as API_TOKEN_DEFAULT_TTL_MS,Of as API_TOKEN_MAX_TTL_MS,My as API_VERSION,hf as AUTHORIZATION_CAPABILITIES,rf as AUTH_ACTION_TOKEN_TTL_MS,nf as AUTH_MFA_CHALLENGE_TTL_MS,of as AUTH_OIDC_TRANSACTION_TTL_MS,tf as AUTH_SESSION_ABSOLUTE_TTL_MS,ef as AUTH_SESSION_IDLE_TTL_MS,Lc as AWSAPIError,St as AWSClient,Le as AWSCloudFormationClient,Me as AWSCloudFrontClient,mu as AWSConfigManager,ws as AWS_PSEUDO_PARAMETERS,$d as AWS_REGIONS,nt as AcmeClient,Pt as AlertEvaluator,$t as AlertStore,zh as AnomalyConfigStore,Pe as ApiGateway,Oy as ApiServiceError,zr as ApplicationAutoScalingClient,Es as Arn,Ts as AssetHasher,bs as Auth,af as AuthenticationStore,ky as AutomationApiService,kf as AutomationIdentityStore,XC as AwsAuroraDataAdapter,iS as AwsAuroraTransport,JS as AwsDatabaseBackupSource,yn as AwsDriver,eS as AwsElastiCacheDataAdapter,oS as AwsElastiCacheTransport,Zy as AwsIamCapabilityScanner,oA as AwsInfrastructureBackupSource,QC as AwsRdsDataAdapter,nS as AwsRdsTransport,DS as AwsRegionalDriver,dA as AwsSecretsManagerConfigurationBackend,Ey as AwsSpendTransport,uA as AwsSsmConfigurationBackend,jS as BackupCoordinator,lu as BackupManager,HS as BackupStore,Wp as BatchProcessingManager,Or as BedrockClient,vr as BedrockRuntimeClient,Ng as BitbucketSourceAdapter,bu as BlueGreenManager,Pp as BounceComplaintHandler,tp as BuildOptimizationManager,aS as BunDockerRuntime,rA as BunDockerVolumeRuntime,XS as BunFilesystemArchiveRuntime,us as CDN,dt as CHAIN_HEADER,Jt as CLOUDFLARE_MANAGED_RULE_PREFIX,Hd as COMMON_CROSS_ACCOUNT_ROLES,ff as CONTROL_PLANE_SCHEMA_VERSION,re as Cache,Tu as CanaryManager,qu as CertificateManager,fg as CloudBlockVolumeDriver,$n as CloudDriverFactory,vc as CloudError,vs as CloudFormationBuilder,Le as CloudFormationClient,Me as CloudFrontClient,gu as CloudTrailManager,Tr as CloudWatchLogsClient,Yt as CloudflareProvider,ud as CommandHistory,Is as Communication,Cg as ComposeApplicationService,yg as ComposeApplicationStore,Nr as ComprehendClient,w as Compute,wy as ComputeSpendTransport,Oc as ConfigurationError,mA as ConfigurationService,aA as ConfigurationStore,$r as ConnectClient,rS as ContainerDataAdapter,np as ContainerRegistryManager,iA as ControlPlaneBackupSource,BS as ControlPlaneCleanupDriver,Ef as ControlPlaneStore,fh as CounterTracker,Nc as CredentialError,hd as CrossRegionReferenceManager,Js as DASHBOARD_ENTRY,Ys as DASHBOARD_PORT_BASE,Qs as DASHBOARD_PORT_SPAN,qs as DASHBOARD_STATE_DIR,ii as DEFAULT_ATTACK_MODE_HOURS,vt as DEFAULT_DDOS_THRESHOLDS,uh as DEFAULT_METER_MAPPINGS,rh as DEFAULT_PRICE_BOOK,mt as DEFAULT_RECURSION_LIMITS,Uc as DEFAULT_SERVICE_LIMITS,ka as DEFAULT_STATE_DIR,Ne as DEFAULT_STATIC_ASSET_EXTENSIONS,ay as DEFAULT_TELEMETRY_POLICY,Ch as DEFAULT_THRESHOLDS,rg as DEPLOYMENT_QUEUE_KINDS,lt as DEPTH_HEADER,Hh as DETECTABLE_SIGNALS,wC as DIAGNOSTIC_PRESETS,_p as DLQMonitoringManager,ps as DNS,bp as DNSSECManager,JC as DataServiceLifecycle,jC as DataServiceStore,U as Database,Hu as DatabaseUserManager,_c as DebugLogger,ss as DependencyGraph,Rs as Deployment,kc as DeploymentError,uu as DisasterRecoveryManager,pr as DnsProviderFactory,sS as DockerDataTransport,AC as DockerDiscoveryAdapter,pg as DockerNamedVolumeDriver,nA as DockerVolumeBackupSource,Qf as DurableOperationQueue,Xf as DurableQueueWorker,Dr as DynamoDBClient,Kt as EC2Client,hr as ECRClient,yr as ECSClient,Ur as EFSClient,Pr as ELBv2Client,Zg as ENFORCEMENT_ACTIONS,Dh as ENFORCEMENT_DESCRIPTIONS,jg as ENFORCEMENT_SEVERITY,$C as EcsRuntimeAdapter,ei as EdgeRateLimiter,Br as ElastiCacheClient,L as Email,kp as EmailAdvanced,Dp as EmailAnalyticsManager,Tt as EmailClient,xp as EmailHandlers,Op as EmailTemplateManager,cS as EncryptedDataSecretStore,Mc as ErrorCodes,_r as EventBridgeClient,zC as EventBridgeJobAdapter,pA as ExternalConfigurationBackend,Fp as FIFOQueueManager,jh as FOCUS_VERSION,Jc as FileCache,K as FileSystem,eA as FilesystemBackupSource,mS as FleetService,pS as FleetStore,Ds as Fn,kg as GiteaSourceAdapter,vg as GithubSourceAdapter,Og as GitlabSourceAdapter,yd as GlobalResourceManager,qt as GoDaddyProvider,yu as GuardDutyManager,al as HashCache,Fm as HealthCheckManager,Et as HealthCheckRunner,Cn as HetznerClient,Rn as HetznerDriver,At as IAMClient,Jr as IPV6_EXCLUDED_HOST_LABELS,Xu as ImageScanningManager,ze as InfrastructureGenerator,Rf as InvalidOperationTransitionError,gs as JobLoader,HC as JobProviderReconciler,KC as JobService,_C as JobStore,Vr as KendraClient,Dm as LARAVEL_SERVERLESS_BUILD_STEPS,Rr as LambdaClient,up as LambdaConcurrencyManager,yp as LambdaDLQManager,mp as LambdaDestinationsManager,sp as LambdaLayersManager,PC as LambdaRuntimeAdapter,gp as LambdaVPCManager,lp as LambdaVersionsManager,lA as LocalEncryptedConfigurationBackend,tA as LogicalDatabaseBackupSource,ku as LogsManager,Yp as MANAGED_NODE_VERSIONS,Bn as MANAGEMENT_DASHBOARD_SITE,nc as MANAGEMENT_DASHBOARD_SITE_PREFIX,ni as MAX_CONTROL_HOURS,If as MAX_CONTROL_PLANE_ERROR_BYTES,Pf as MAX_CONTROL_PLANE_JSON_BYTES,Ug as METERS,Kg as METER_KEYS,qg as MICRO_CENTS,Th as MIN_PROJECTION_CONFIDENCE,en as MTA_STS_PORT,FS as MaintenanceService,LS as MaintenanceStore,Ss as Messaging,Ou as MetricsManager,Fu as MigrationManager,vl as MockCloudFormation,Nl as MockDynamoDB,Ol as MockS3,Ie as Monitoring,Fd as MultiAccountManager,fd as MultiRegionManager,ql as MultiStepProgress,Re as Network,_m as NetworkSecurityManager,Dt as NotificationRouter,Er as OpenSearchClient,bf as OptimisticConcurrencyError,Vd as OrganizationManager,wm as PHP_DEFAULT_EXCLUDES,rm as PHP_LAYER_EXTENSIONS,Zt as PROXIABLE_RECORD_TYPES,Ps as ParameterStore,Wu as PerformanceManager,$e as Permissions,Fr as PersonalizeClient,fs as Phone,Lp as PhoneAdvanced,ms as PhoneHandlers,yS as PlacementService,hS as PlacementStore,Lr as PollyClient,jt as PorkbunProvider,Wy as PreDeployScanner,xl as PreviewEnvironmentManager,tg as PreviewEnvironmentService,eg as PreviewEnvironmentStore,_l as PreviewNotificationService,jl as ProgressBar,Du as ProgressiveDeploymentManager,oi as ProtectionControlStore,qa as Pseudo,te as Queue,qf as QueueCancellationError,Hp as QueueManagementManager,Oa as QueuePresets,Jf as QueueTimeoutError,Jn as RATE_LIMIT_KEY_SEPARATOR,Ir as RDSClient,Wd as RECOMMENDED_ACCOUNT_STRUCTURES,zd as RECOMMENDED_SCPS,Ig as RELEASE_QUEUE_KINDS,cd as REPL,dd as REPLCommandBuilder,ld as REPLContext,ml as RateLimiter,Na as RealtimePresets,oy as RecordingSpendTransport,ht as RecursionGuard,Z as Redirects,Cd as RegionPairManager,PS as RegionService,$S as RegionStore,ds as Registry,kr as RekognitionClient,Rg as ReleaseService,bg as ReleaseStore,CS as RemoteBuildService,_u as ReplicaManager,Wm as ResourceManagementManager,Yf as RetryableOperationError,j as Route53Client,Ut as Route53DomainsClient,rr as Route53Provider,Tp as Route53ResolverManager,Sp as Route53RoutingManager,vC as RuntimeOperationService,OC as RuntimeStreamRegistry,ZS as S3BackupDestinationAdapter,bt as S3Client,Ec as S3Error,By as SECRET_PATTERNS,Bh as SENSITIVITY_THRESHOLDS,Rt as SESClient,Cs as SMS,Ar as SNSClient,Iy as SPEND_CYCLE_SECONDS,ey as SPEND_GATE_SETTING,Ty as SPEND_LEASE_SETTING,br as SQSClient,Cr as SSMClient,xa as STATE_DIR_ENV_VAR,W as STATIC_SITE_ZONE_SETTINGS,Vt as STSClient,Wr as SchedulerClient,De as Search,Ky as SecretFindingScanner,$s as Secrets,Zu as SecretsManager,Sr as SecretsManagerClient,Ku as SecretsRotationManager,ee as Security,Su as SecurityHubManager,_y as SecurityPostureStore,Gy as SecurityScannerRunner,Yu as SecurityScanningManager,wp as SenderReputationManager,WC as ServerCronJobAdapter,tS as ServerDataAdapter,mg as ServerPathVolumeDriver,op as ServiceMeshManager,Te as Sftp,Kh as SignalSource,Mp as SmsAdvanced,Hr as SmsClient,ys as SmsHandlers,Eg as SourceConnectionStore,wg as SourceProviderError,ry as SpendCapError,ty as SpendGate,$y as SpendLoopLease,Ry as SpendNotificationRouter,Py as SpendRunner,Qh as SpendService,Sh as SpendStore,Jl as Spinner,dS as SshFleetDriver,Sd as StackDependencyManager,hs as StacksIntegration,km as StaticSiteManager,X as Storage,Lm as StorageAdvancedManager,Kr as SupportClient,Lu as SyntheticsManager,lS as SystemFleetSshTransport,TC as SystemdDiscoveryAdapter,ut as TRACE_HEADER,Yl as TaskList,Cy as TelemetryStore,Se as TemplateBuilder,Yc as TemplateCache,xr as TextractClient,wr as TranscribeClient,Mr as TranslateClient,WS as TransportDisasterRecoveryDriver,_S as TransportPlatformMaintenanceDriver,AS as TransportRemoteBuildDriver,Uy as TrivyImageScanner,xf as TsCloudApiError,Lf as TsCloudClient,Sy as URGENT_SPEND_EVENTS,Eh as USER_VISIBLE_ACTIONS,ES as UnavailableRegionalDriver,sr as UnifiedDnsValidator,Tf as UnsupportedSchemaVersionError,xc as ValidationError,Gr as VoiceClient,dg as VolumeService,og as VolumeStore,As as Workflow,wu as XRayManager,Iu as abTestManager,$g as activateImmutableRelease,mC as ageSeconds,hh as aggregateDeltas,cs as analyzeStackDiff,_h as anomalyOptionsForSignal,ci as applyControlsToDdos,si as applyControlsToRateLimits,Ft as applyMitigationFactor,or as applyZoneMigration,qp as artifactKey,Ag as assertReleaseStrategy,ny as assertSpendAllows,Xy as attachProvenanceToRelease,Jy as attachSbomToRelease,Yy as attachVulnerabilitySummary,cf as authEncryptionKeyFile,Sf as authorizeOrganization,EC as authorizeRuntimePath,nd as autocomplete,fu as awsConfigManager,US as backupCredentialStatus,du as backupManager,cl as batch,zp as batchProcessingManager,pf as beginOidcAuthorization,Ru as blueGreenManager,Ip as bounceComplaintHandler,sh as budgetWindow,Si as buildAndPushServerlessImage,lm as buildBunRuntimeLayerZip,Os as buildCloudFormationTemplate,Zf as buildComposeLogsCommand,Kf as buildComposeRuntimeCommand,Uf as buildComposeScaleCommand,jf as buildComposeShellCommand,bi as buildFunctionEnv,_n as buildHostCleanupScript,Za as buildMailEnv,Kn as buildManagementDashboardArtifact,Fi as buildMediaCdnPlan,Xr as buildMtaStsPolicy,tn as buildMtaStsServer,cm as buildNodeRuntimeLayerZip,rp as buildOptimizationManager,ce as buildOriginGuardRule,Em as buildPhpRuntimeLayerZip,Fn as buildSiteDeployScript,In as buildSshArgs,se as buildStaticSiteCacheRules,Vn as buildStaticSiteDeployScript,fC as bytes,$u as canaryManager,wS as canonicalJson,dC as capabilities,gS as capacity,Sl as categorizeChanges,Ju as certificateManager,Hc as checkIAMPermissions,gm as checkInvocation,Zc as checkServiceQuotas,fl as chunk,eo as cleanupDns01Challenge,Da as clearSigningKeyCache,_g as cloneSourceBinding,Rl as cloudConfigSchema,Pn as cloudDrivers,hu as cloudTrailManager,Om as collectPhpAppEntries,Zr as collectServerDnsDomains,hg as completeComposeVolumeDeletion,mf as completeOidcAuthorization,lc as composePresets,Gf as composeProjectName,tm as composeServerlessAppTemplate,vy as compositeSpendTransport,YS as compressBackup,Um as config,qC as connectionGuidance,ip as containerRegistryManager,$f as controlPlaneDatabaseFile,gf as controlPlaneMigrations,Vs as createApiBackendPreset,Vy as createApiV1Handler,TS as createAsgBuildDriver,qS as createBackupQueueHandlers,Rm as createCliHandler,Tn as createCloudDriver,Ce as createCloudFrontPolicy,$c as createCredentialProvider,js as createDashboardSite,Hs as createDataPipelinePreset,YC as createDataServiceQueueHandlers,ig as createDeploymentQueueHandlers,q as createDnsProvider,RS as createEcsBuildDriver,iy as createEnforcementHandlers,Vc as createError,Ms as createExistingStaticFullStackPreset,uS as createFleetQueueHandlers,Fs as createFullStackAppPreset,lr as createGoDaddyValidator,Tm as createHandlers,Am as createHttpHandler,Bs as createJamstackPreset,UC as createJobQueueHandlers,Us as createLaravelPreset,Gs as createMLApiPreset,VS as createMaintenanceQueueHandlers,xi as createMediaAccessToken,Ws as createMicroservicesPreset,kl as createMockAWS,ks as createNodeJsServerPreset,xs as createNodeJsServerlessPreset,Gt as createObjectStorageClient,cr as createPorkbunValidator,dc as createPreset,Aa as createPresignedUrl,ba as createPresignedUrlAsync,bm as createQueueHandler,zs as createRealtimeAppPreset,IS as createRegionQueueHandlers,Qy as createReleaseProvenance,Dg as createReleaseQueueHandlers,SS as createRemoteBuildQueueHandlers,dr as createRoute53Validator,IC as createRuntimeAdapters,wc as createS3Client,bS as createServerBuildDriver,Zs as createServerlessLaravelPreset,Ls as createServerlessNodePreset,xg as createSourceAdapter,Ns as createStaticSitePreset,Ks as createTraditionalWebAppPreset,ug as createVolumeQueueHandlers,_s as createWordPressPreset,Kp as createZip,Ad as crossRegionReferenceManager,Ei as dashboardActions,Wn as dashboardCredentialsFile,ZC as dataServiceCapabilities,Gu as databaseUserManager,jm as decodeBase32,QS as decompressBackup,KS as decryptBackup,Hm as defaultConfig,$l as defaultLocalConfig,ri as defaultRateLimitRules,hi as deleteStaticSite,Zn as deployAllComputeSites,Ri as deployServerlessApp,Ci as deploySite,Un as deploySiteRelease,mi as deployStaticSite,yi as deployStaticSiteFull,di as deployStaticSiteWithExternalDns,ui as deployStaticSiteWithExternalDnsFull,za as deploymentCoexistenceError,Xs as deriveManagementDashboardPort,ai as describePosture,BC as desiredJobProviderState,Fh as detectAnomalies,Ba as detectDeploymentTargets,ur as detectDnsProvider,Vh as detectLatestAnomaly,Wc as detectMisconfigurations,ya as detectServiceRegion,Vf as diffCompose,hl as diffTemplates,Vg as discoverGitRefs,uf as discoverOidcProvider,gC as discoverRuntimeInventory,Bp as dlqMonitoringManager,mr as dnsProviders,Rp as dnssecManager,SC as dockerWorkloads,OS as documentDigest,pu as drManager,hC as ecsWorkloads,Af as effectiveCapabilities,Ep as emailAnalyticsManager,Np as emailTemplateManager,Zm as encodeBase32,GS as encryptBackup,rC as ensureDefaultSecurityPolicies,kn as ensureFirewall,Gn as ensureManagementDashboard,xn as ensureServer,Nn as ensureSshKey,dn as escapeSecLang,Ph as evaluateBudget,wt as evaluateTelemetryAlertRules,FC as eventBridgeScheduleInput,Cm as eventToRequest,Mh as ewma,Ff as exportCompose,nr as exportRoute53Zone,cc as extendPreset,Vp as fifoQueueManager,ol as findChangedFiles,ph as findMapping,Yg as findPriceEntry,Zd as formatAccountStructure,Gl as formatBytes,Ay as formatCents,ls as formatDiff,Kl as formatDuration,od as formatFlagSuggestions,pd as formatHistory,md as formatHistoryStats,Zl as formatKeyValue,Ul as formatList,Hl as formatProgressBar,xd as formatRegion,Ld as formatRegionList,Hy as formatScanResults,Xl as formatSuggestion,Wl as formatTable,Rh as formatTimeToExhaustion,zl as formatTree,Ac as fromEC2Metadata,bc as fromECSMetadata,Cc as fromEnvironment,Sc as fromSharedCredentials,Rc as fromWebIdentity,pt as functionFingerprint,pe as gatewayHostnames,am as generateAppImageDockerfile,su as generateApprovalConfig,Up as generateBootstrap,Fl as generateCleanupWorkflow,Vl as generateCostReportWorkflow,Kd as generateCrossAccountRoleCF,jy as generateCycloneDxSbom,iu as generateDeploymentConfig,Xd as generateDeploymentPipeline,jd as generateDeploymentWorkflow,li as generateExternalDnsStaticSiteTemplate,Qi as generateHttpsServerCode,qy as generateImageSbom,Yi as generateLetsEncryptUserData,be as generateLogicalId,nu as generateManualPipeline,Qd as generateMatrixWorkflow,ou as generateMultiEnvConfig,eu as generateMultiEnvPipeline,qd as generateMultiEnvWorkflow,Jd as generatePRPreviewWorkflow,cu as generateParallelConfig,$m as generatePhpFpmConfig,om as generatePhpLayerDockerfile,tu as generatePreviewPipeline,Ml as generatePreviewWorkflow,Ae as generateResourceName,au as generateScheduledConfig,ru as generateScheduledPipeline,Yd as generateScheduledWorkflow,pi as generateStaticSiteTemplate,hn as generateUbuntuAppCloudInit,Dc as getAccountId,Id as getAllRegions,Od as getClosestRegion,ad as getCommandUsage,Bf as getComposeTemplate,Gm as getConfig,td as getContextualHelp,Tc as getCredentials,Al as getDeploymentStrategy,bl as getDiffStats,yl as getDiffSummary,Fc as getErrorDetails,Pl as getLocalConfig,El as getLocalCredentials,Dl as getLocalEndpoint,wl as getLocalEnvVars,jc as getQuotaUsageSummary,Gd as getRecommendedStructure,Pd as getRegion,Md as getRegionStats,Ed as getRegionsByCompliance,Dd as getRegionsByLocation,wd as getRegionsByPricingTier,Gc as getRequiredPermissions,Ea as getSigningKeyCacheSize,Ja as getTimestamp,Yn as globMatches,pn as globToRegex,bd as globalResourceManager,$h as governingLimitCents,Cu as guardDutyManager,xy as handleSpendRequest,ln as hasAutoWwwVariant,rc as hasManagementDashboardSite,nn as hasProxyUpstream,tl as hashBuffer,rl as hashDirectory,Xc as hashFile,nl as hashManifest,el as hashString,Vm as healthCheckManager,ue as hostAcceptsIpv6,ae as hostCondition,qm as hotp,lh as hourBucket,dh as hourBucketsBetween,ep as imageScanningManager,Ai as infraEnvFromOutputs,gt as inspectInvocation,pm as installRecursionFetch,gi as invalidateCache,dm as invocationContext,ed as isLikelyTypo,Il as isLocalDevelopment,oc as isManagementDashboardSiteName,wa as isNodeCryptoAvailable,Nh as isOperationAllowed,It as isQuietHours,un as isSafePattern,_a as isStatePath,Ot as isValidCidr,vd as isValidRegion,nh as isValidTimeZone,va as isWebCryptoAvailable,LC as jobProviderCapability,Bt as keyMatchesFilters,pp as lambdaConcurrencyManager,Cp as lambdaDLQManager,fp as lambdaDestinationsManager,cp as lambdaLayersManager,hp as lambdaVPCManager,dp as lambdaVersionsManager,yC as lambdaWorkloads,Im as laravelServerlessEnvDefaults,_f as listComposeTemplates,zg as listSourceReferences,Km as loadCloudConfig,ly as loadTelemetryPolicy,xu as logsManager,Zh as lookbackHoursForSignal,Ga as mailEnabled,Ua as mailFirewallPorts,MS as maintenanceWindowOpen,Ra as makeAWSRequest,$a as makeAWSRequestAsync,Ta as makeAWSRequestOnce,ic as managementDashboardSiteName,vS as manifestDigest,Qm as matchTotpCounter,Mi as mediaObjectHeaders,kh as median,xh as medianAbsoluteDeviation,Ih as mergeDecisions,uc as mergeInfrastructure,th as mergePriceBooks,gh as meterTelemetry,Nu as metricsManager,Wt as migrateObjectStorage,Vu as migrationManager,_d as multiAccountManager,gd as multiRegionManager,to as needsRenewal,Bm as networkSecurityManager,kC as nextScheduleRuns,qr as normalizePublicIpv6,uC as normalizeRuntimeStatus,NC as normalizeScheduleExpression,Lg as normalizeSourceEvent,An as normalizeSshPublicKey,sy as normalizeTelemetryPolicy,Fy as openApiDocument,Uh as optionsForSignal,Bd as organizationManager,Nm as packagePhpApp,Jp as packageServerlessApp,sl as parallel,ll as parallelMap,dl as parallelWithRetry,ft as parseChain,Mf as parseCompose,zf as parseComposeCatalog,CC as parseDockerInspect,sA as parseDotenv,Ia as parseJSONResponse,bC as parseSystemdRecords,Pa as parseXMLResponse,fy as pathTemplate,bh as percentOfLimit,zu as performanceManager,im as phpLayerBuildStage,nm as phpLayerPackages,Pm as phpRuntimeLayerAssets,Hf as planComposeTemplateUpgrade,wh as planEnforcement,Mt as planMitigation,ir as planZoneMigration,Qt as policyTag,Ll as previewManager,Bl as previewNotifications,xC as previewSchedule,ch as previousBudgetWindow,Qg as priceUsage,Xg as priceUsageLines,de as probeOriginTls,gl as processInChunks,Mg as processSourceWebhook,aC as productionChangeReview,Eu as progressiveDeploymentManager,Ah as projectSpend,yt as propagationHeaders,zt as providerEndpoint,NS as publicKeyFingerprint,Xt as qualifyName,Gp as queueManagementManager,il as quickHash,ti as rateLimitHeaders,Xn as rateLimitKey,Yr as reconcileAddressRecords,at as reconcileCloudflareCdn,tr as reconcileDeclaredRecords,VC as reconcileJobObservation,Hg as reconcileSourceWebhook,oC as recordDashboardHostPosture,nC as recordPreDeploySecretScan,iC as recordSkippedSecretScan,Ct as recursionBlockedResponse,pC as redactRuntimeConfig,py as redactTelemetryText,my as redactTelemetryValue,Ti as redeployServerlessApp,Rd as regionPairManager,Sg as releaseStrategyCapabilities,Tg as releaseTrafficPlan,jn as reloadRpxGateway,_t as remapKey,Gg as removeSourceWebhook,jr as removeStaleServerAddressRecords,Wf as renderComposeTemplate,Lt as renderDdosInstallScript,xt as renderNftablesRuleset,MC as renderServerCron,kt as renderSysctlFile,mn as renderWafConfig,fn as renderWafInstallScript,qn as renewRpxCertificates,Bu as replicaManager,Ny as requestHash,Cl as requiresReplacement,fm as resetRecursionRuntime,ym as resolveApp,Ha as resolveAppDatabase,lf as resolveAuthEncryptionKey,ja as resolveCloudProvider,ct as resolveCloudflareCdnPlan,Pc as resolveCredentials,wi as resolveDashboardAction,zn as resolveDashboardAuth,ec as resolveDashboardDomain,tc as resolveDashboardDomains,er as resolveDeclaredRecords,ns as resolveDeployBucketName,Wa as resolveDeploymentMode,Mn as resolveExecStart,Sn as resolveHetznerApiToken,Ka as resolveMailService,sc as resolveManagementDashboardSite,ac as resolveManagementDashboardSites,Ht as resolveObjectStorage,Qa as resolveProjectStackName,rn as resolveProxyUpstreams,em as resolveQueueNames,ng as resolveQueuedDeploymentCommand,Xp as resolveQueues,um as resolveRecursionConfig,Ic as resolveRegion,DC as resolveRuntimeInventory,is as resolveServerlessAppStackName,os as resolveServerlessArtifactBucketName,as as resolveServerlessAssetBucketName,Qp as resolveServerlessRuntime,ts as resolveSiteBucketName,on as resolveSiteDeployTarget,an as resolveSiteKind,es as resolveSiteResourceName,Xa as resolveSiteStackName,Va as resolveStatePath,rs as resolveStorageBucketName,Hn as resolveUiSource,xe as resolveZoneApex,zm as resourceManagementManager,Sm as responseToResult,Lh as robustZScore,yf as roleCapabilities,Pg as rollbackImmutableRelease,$i as rollbackServerlessApp,eh as roundCents,$p as route53ResolverManager,Ap as route53RoutingManager,Wh as routeMatches,Qn as ruleMatches,Zp as runBuildHooks,vh as runEnforcement,vm as runPhpBuildHooks,Ii as runRemoteCommand,cC as runtimeId,Di as sanitizeCloudConfig,Df as sanitizeControlPlaneValue,Ya as sanitizeName,df as sanitizeOidcReturnPath,dy as saveTelemetryPolicy,zy as scanForSecrets,Cf as scopeContains,yh as scopeKey,wn as scpUpload,rd as searchCommands,wf as searchControlPlane,ju as secretsManager,Uu as secretsRotationManager,sC as secureContainerRelease,Au as securityHubManager,Qu as securityScanningManager,tC as securityScope,sf as sendAuthenticationEmail,vp as senderReputationManager,ul as sequence,cA as serializeDotenv,Ln as serverPublicIpv4,ap as serviceMeshManager,Pi as setMaintenance,La as setStateDir,Xi as setupDns01Challenge,jp as sha256,mm as sharedRecursionGuard,sm as sharedRuntimeLoop,cn as shipsARelease,ki as signCloudFrontCookies,Ni as signCloudFrontUrl,Ca as signRequest,Sa as signRequestAsync,Gh as signalDefinition,by as spendNotificationText,Ly as spendOpenApiPaths,Dn as sshExec,En as sshExecOrThrow,Td as stackDependencyManager,vi as startLocalDashboardServer,Dy as startSpendLoop,Ma as stateDir,Fa as statePath,xm as staticSiteManager,Mm as storageAdvancedManager,Yh as streamFocusJsonl,Oh as strongestActiveAction,Ql as suggestCommand,id as suggestFlags,Kc as suggestIAMPolicy,qc as suggestQuotaIncrease,kd as suggestRegionPairs,Nd as suggestRegions,Wg as syncSourceRepositories,gg as synchronizeComposeVolumes,fA as synchronizeConfiguredConfiguration,GC as synchronizeConfiguredJobs,Mu as syntheticsManager,Nt as sysctlHardening,RC as systemdWorkloads,yy as telemetryBucketLabel,gy as telemetryCursor,uy as telemetryEstimatedMonthlyCost,hy as telemetryPercentile,cy as telemetryPolicyKey,Qc as templateCache,Bg as testSourceConnection,Jg as tieredMicroCents,le as toCloudflareZoneSettings,Jh as toFocusJsonl,qh as toFocusRecords,Jm as totp,Xm as totpUri,lC as unsupportedCapabilities,ag as unsupportedVolumeCapabilities,xS as updateCompatibility,fi as uploadStaticFiles,mh as usageDeltaKey,ah as utcInstantOfLocal,Ud as validateAccountStructure,Tl as validateAgainstSchema,lg as validateAttachment,zS as validateBackupDestination,sd as validateCommand,Bc as validateConfiguration,zc as validateCredentials,sn as validateDeploymentConfig,cg as validateMountPath,qe as validateResourceLimits,He as validateTemplate,je as validateTemplateSize,Qr as verifyAddressRecord,eC as verifyArtifactSignature,Li as verifyMediaAccessToken,Ym as verifyTotp,kS as verifyUpdateSignature,ar as verifyZoneParity,sg as volumeCapabilities,gn as wafEventTelemetry,On as waitForCloudInit,vn as waitForSsh,Fg as webhookEndpoint,hc as withCDN,gc as withCache,fc as withDatabase,hm as withInvocation,pc as withMonitoring,yc as withQueue,mc as withSecurity,pl as withTimeout,bn as wrapCloudInitUserData,vu as xrayManager,fS as zeroCapacity,Xh as zeroFill,oh as zoneOffsetMs,ih as zonedParts};

package/dist/protection/index.js

@@ -1 +1 @@
-import{$k as C,Xk as y,Yk as z,Zk as A,_k as B,al as D,bl as E,cl as F,dl as G,el as H,fl as I,gl as J,hl as K,il as L,jl as M}from"../chunk-vz95qy3n.js";import{kl as s,ll as t,ml as u,nl as v,ol as w,pl as x}from"../chunk-r5natbed.js";import{ql as k,rl as l,sl as m,tl as n,ul as o,vl as p,wl as q,xl as r}from"../chunk-b10cbk8z.js";import{Ks as a,Ls as b,Ms as c,Ns as d,Os as e,Ps as f,Qs as g,Rs as h,Ss as i,Ts as j}from"../chunk-0hj552t7.js";import"../chunk-spx89gaw.js";export{b as CHAIN_HEADER,H as DEFAULT_ATTACK_MODE_HOURS,k as DEFAULT_DDOS_THRESHOLDS,e as DEFAULT_RECURSION_LIMITS,a as DEPTH_HEADER,G as MAX_CONTROL_HOURS,F as PROTECTION_SETTING,I as ProtectionControlStore,y as RATE_LIMIT_KEY_SEPARATOR,C as RateLimiter,h as RecursionGuard,c as TRACE_HEADER,L as applyControlsToDdos,K as applyControlsToRateLimits,r as applyMitigationFactor,E as defaultRateLimitRules,J as describePosture,s as escapeSecLang,d as functionFingerprint,z as globMatches,u as globToRegex,g as inspectInvocation,t as isSafePattern,l as isValidCidr,M as mergeControlsIntoConfig,f as parseChain,q as planMitigation,i as propagationHeaders,D as rateLimitHeaders,B as rateLimitKey,j as recursionBlockedResponse,p as renderDdosInstallScript,o as renderNftablesRuleset,n as renderSysctlFile,v as renderWafConfig,w as renderWafInstallScript,A as ruleMatches,m as sysctlHardening,x as wafEventTelemetry};
+import{$k as z,_k as y,al as A,bl as B,cl as C,dl as D,el as E,fl as F,gl as G,hl as H,il as I,jl as J,kl as K,ll as L,ml as M}from"../chunk-1qdne0bf.js";import{nl as s,ol as t,pl as u,ql as v,rl as w,sl as x}from"../chunk-hn40z11p.js";import{Al as r,tl as k,ul as l,vl as m,wl as n,xl as o,yl as p,zl as q}from"../chunk-x3hay61c.js";import{Ns as a,Os as b,Ps as c,Qs as d,Rs as e,Ss as f,Ts as g,Us as h,Vs as i,Ws as j}from"../chunk-zz52xje8.js";import"../chunk-z2qqwy7e.js";export{b as CHAIN_HEADER,H as DEFAULT_ATTACK_MODE_HOURS,k as DEFAULT_DDOS_THRESHOLDS,e as DEFAULT_RECURSION_LIMITS,a as DEPTH_HEADER,G as MAX_CONTROL_HOURS,F as PROTECTION_SETTING,I as ProtectionControlStore,y as RATE_LIMIT_KEY_SEPARATOR,C as RateLimiter,h as RecursionGuard,c as TRACE_HEADER,L as applyControlsToDdos,K as applyControlsToRateLimits,r as applyMitigationFactor,E as defaultRateLimitRules,J as describePosture,s as escapeSecLang,d as functionFingerprint,z as globMatches,u as globToRegex,g as inspectInvocation,t as isSafePattern,l as isValidCidr,M as mergeControlsIntoConfig,f as parseChain,q as planMitigation,i as propagationHeaders,D as rateLimitHeaders,B as rateLimitKey,j as recursionBlockedResponse,p as renderDdosInstallScript,o as renderNftablesRuleset,n as renderSysctlFile,v as renderWafConfig,w as renderWafInstallScript,A as ruleMatches,m as sysctlHardening,x as wafEventTelemetry};

package/dist/push/index.js

@@ -1 +1 @@
-import"../chunk-spx89gaw.js";import*as h from"node:http2";import{createSign as b}from"node:crypto";var f="api.push.apple.com",k="api.sandbox.push.apple.com",S=2700000;class R{config;token=null;tokenGeneratedAt=0;client=null;host;constructor(e){this.config=e,this.host=e.production?f:k}generateToken(){let e=Math.floor(Date.now()/1000);if(this.token&&Date.now()-this.tokenGeneratedAt<S)return this.token;let t={alg:"ES256",kid:this.config.keyId},s={iss:this.config.teamId,iat:e},r=Buffer.from(JSON.stringify(t)).toString("base64url"),n=Buffer.from(JSON.stringify(s)).toString("base64url"),i=`${r}.${n}`,o=b("SHA256");o.update(i);let a=o.sign(this.config.privateKey),l=this.derToRaw(a).toString("base64url");return this.token=`${i}.${l}`,this.tokenGeneratedAt=Date.now(),this.token}derToRaw(e){let t=2;if(e[t]!==2)throw Error("Invalid DER signature: expected 0x02 for R");t++;let s=e[t];t++;let r=e.subarray(t,t+s);if(t+=s,e[t]!==2)throw Error("Invalid DER signature: expected 0x02 for S");t++;let n=e[t];t++;let i=e.subarray(t,t+n);if(r[0]===0&&r.length===33)r=r.subarray(1);if(i[0]===0&&i.length===33)i=i.subarray(1);let o=Buffer.alloc(64);return r.copy(o,32-r.length),i.copy(o,64-i.length),o}async getClient(){if(this.client&&!this.client.destroyed)return this.client;return new Promise((e,t)=>{this.client=h.connect(`https://${this.host}`),this.client.on("error",(s)=>{t(s)}),this.client.on("connect",()=>{e(this.client)}),this.client.on("close",()=>{this.client=null})})}buildPayload(e){let t={};if(e.title||e.body||e.subtitle){if(t.alert={},e.title)t.alert.title=e.title;if(e.subtitle)t.alert.subtitle=e.subtitle;if(e.body)t.alert.body=e.body}if(e.badge!==void 0)t.badge=e.badge;if(e.sound!==void 0)t.sound=e.sound;if(e.category)t.category=e.category;if(e.threadId)t["thread-id"]=e.threadId;if(e.contentAvailable)t["content-available"]=1;if(e.mutableContent)t["mutable-content"]=1;if(e.targetContentId)t["target-content-id"]=e.targetContentId;let s={aps:t};if(e.data)Object.assign(s,e.data);return s}async send(e){try{let t=await this.getClient(),s=this.generateToken(),r=JSON.stringify(this.buildPayload(e)),n={":method":"POST",":path":`/3/device/${e.deviceToken}`,authorization:`bearer ${s}`,"apns-topic":this.config.bundleId,"apns-push-type":e.pushType||"alert","apns-priority":String(e.priority||10)};if(e.expiration!==void 0)n["apns-expiration"]=String(e.expiration);if(e.collapseId)n["apns-collapse-id"]=e.collapseId;return new Promise((i)=>{let o=t.request(n),a="",d=0,l;o.on("response",(c)=>{d=c[":status"],l=c["apns-id"]}),o.on("data",(c)=>{a+=c.toString()}),o.on("end",()=>{if(d===200)i({success:!0,deviceToken:e.deviceToken,apnsId:l,statusCode:d});else{let c="Unknown error",g,u;if(a)try{let p=JSON.parse(a);g=p.reason,u=p.timestamp,c=g||c}catch{c=a}i({success:!1,deviceToken:e.deviceToken,apnsId:l,statusCode:d,error:c,reason:g,timestamp:u})}}),o.on("error",(c)=>{i({success:!1,deviceToken:e.deviceToken,error:c.message})}),o.write(r),o.end()})}catch(t){return{success:!1,deviceToken:e.deviceToken,error:t.message}}}async sendBatch(e,t){let s=t?.concurrency||10,r=[];for(let n=0;n<e.length;n+=s){let i=e.slice(n,n+s),o=await Promise.all(i.map((a)=>this.send(a)));r.push(...o)}return{sent:r.filter((n)=>n.success).length,failed:r.filter((n)=>!n.success).length,results:r}}async sendSimple(e,t,s,r){return this.send({deviceToken:e,title:t,body:s,data:r})}async sendSilent(e,t){return this.send({deviceToken:e,contentAvailable:!0,pushType:"background",priority:5,data:t})}close(){if(this.client)this.client.close(),this.client=null;this.token=null,this.tokenGeneratedAt=0}}import{createSign as T}from"node:crypto";var C="https://fcm.googleapis.com/v1/projects",y="https://oauth2.googleapis.com/token",P=3300000;class m{config;accessToken=null;tokenExpiresAt=0;constructor(e){this.config=e}static fromServiceAccount(e){return new m({projectId:e.project_id,clientEmail:e.client_email,privateKey:e.private_key})}generateJWT(){let e=Math.floor(Date.now()/1000),t=e+3600,s={alg:"RS256",typ:"JWT"},r={iss:this.config.clientEmail,sub:this.config.clientEmail,aud:y,iat:e,exp:t,scope:"https://www.googleapis.com/auth/firebase.messaging"},n=Buffer.from(JSON.stringify(s)).toString("base64url"),i=Buffer.from(JSON.stringify(r)).toString("base64url"),o=`${n}.${i}`,a=T("SHA256");a.update(o);let d=a.sign(this.config.privateKey,"base64url");return`${o}.${d}`}async getAccessToken(){if(this.accessToken&&Date.now()<this.tokenExpiresAt)return this.accessToken;let e=this.generateJWT(),t=await fetch(y,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:e}).toString()});if(!t.ok){let r=await t.text();throw Error(`Failed to get access token: ${r}`)}let s=await t.json();return this.accessToken=s.access_token,this.tokenExpiresAt=Date.now()+P,this.accessToken}buildMessage(e){let t={};if(e.token)t.token=e.token;else if(e.topic)t.topic=e.topic;else if(e.condition)t.condition=e.condition;if(e.title||e.body||e.imageUrl){if(t.notification={},e.title)t.notification.title=e.title;if(e.body)t.notification.body=e.body;if(e.imageUrl)t.notification.image=e.imageUrl}if(e.data&&Object.keys(e.data).length>0)t.data=e.data;if(e.android){if(t.android={priority:e.android.priority||"high"},e.android.ttl)t.android.ttl=`${e.android.ttl}s`;if(e.android.collapseKey)t.android.collapse_key=e.android.collapseKey;if(e.android.directBootOk)t.android.direct_boot_ok=e.android.directBootOk;let s={};if(e.android.channelId)s.channel_id=e.android.channelId;if(e.android.icon)s.icon=e.android.icon;if(e.android.color)s.color=e.android.color;if(e.android.sound)s.sound=e.android.sound;if(e.android.clickAction)s.click_action=e.android.clickAction;if(e.android.tag)s.tag=e.android.tag;if(e.android.visibility)s.visibility=e.android.visibility;if(e.android.notificationCount!==void 0)s.notification_count=e.android.notificationCount;if(Object.keys(s).length>0)t.android.notification=s}if(e.webpush)t.webpush=e.webpush;if(e.apns)t.apns=e.apns;if(e.fcmOptions)t.fcm_options=e.fcmOptions;return{message:t}}async send(e){try{let t=await this.getAccessToken(),s=this.buildMessage(e),r=await fetch(`${C}/${this.config.projectId}/messages:send`,{method:"POST",headers:{Authorization:`Bearer ${t}`,"Content-Type":"application/json"},body:JSON.stringify(s)}),n=await r.json();if(r.ok)return{success:!0,messageId:n.name};else return{success:!1,error:n.error?.message||"Unknown error",errorCode:n.error?.status}}catch(t){return{success:!1,error:t.message}}}async sendBatch(e,t,s){let r=s?.concurrency||10,n=[];for(let i=0;i<e.length;i+=r){let a=e.slice(i,i+r).map(async(l)=>({...await this.send({...t,token:l}),token:l})),d=await Promise.all(a);n.push(...d)}return{sent:n.filter((i)=>i.success).length,failed:n.filter((i)=>!i.success).length,results:n}}async sendToTopic(e,t){return this.send({...t,topic:e})}async sendToCondition(e,t){return this.send({...t,condition:e})}async sendSimple(e,t,s,r){return this.send({token:e,title:t,body:s,data:r})}async sendSilent(e,t){return this.send({token:e,data:t,android:{priority:"high"}})}async subscribeToTopic(e,t){try{let s=await this.getAccessToken(),r=await fetch("https://iid.googleapis.com/iid/v1:batchAdd",{method:"POST",headers:{Authorization:`Bearer ${s}`,"Content-Type":"application/json"},body:JSON.stringify({to:`/topics/${t}`,registration_tokens:e})});if(r.ok)return{success:!0};else return{success:!1,error:(await r.json()).error?.message||"Failed to subscribe"}}catch(s){return{success:!1,error:s.message}}}async unsubscribeFromTopic(e,t){try{let s=await this.getAccessToken(),r=await fetch("https://iid.googleapis.com/iid/v1:batchRemove",{method:"POST",headers:{Authorization:`Bearer ${s}`,"Content-Type":"application/json"},body:JSON.stringify({to:`/topics/${t}`,registration_tokens:e})});if(r.ok)return{success:!0};else return{success:!1,error:(await r.json()).error?.message||"Failed to unsubscribe"}}catch(s){return{success:!1,error:s.message}}}}export{R as APNsClient,m as FCMClient};
+import"../chunk-z2qqwy7e.js";import*as h from"node:http2";import{createSign as b}from"node:crypto";var f="api.push.apple.com",k="api.sandbox.push.apple.com",S=2700000;class R{config;token=null;tokenGeneratedAt=0;client=null;host;constructor(e){this.config=e,this.host=e.production?f:k}generateToken(){let e=Math.floor(Date.now()/1000);if(this.token&&Date.now()-this.tokenGeneratedAt<S)return this.token;let t={alg:"ES256",kid:this.config.keyId},s={iss:this.config.teamId,iat:e},r=Buffer.from(JSON.stringify(t)).toString("base64url"),n=Buffer.from(JSON.stringify(s)).toString("base64url"),i=`${r}.${n}`,o=b("SHA256");o.update(i);let a=o.sign(this.config.privateKey),l=this.derToRaw(a).toString("base64url");return this.token=`${i}.${l}`,this.tokenGeneratedAt=Date.now(),this.token}derToRaw(e){let t=2;if(e[t]!==2)throw Error("Invalid DER signature: expected 0x02 for R");t++;let s=e[t];t++;let r=e.subarray(t,t+s);if(t+=s,e[t]!==2)throw Error("Invalid DER signature: expected 0x02 for S");t++;let n=e[t];t++;let i=e.subarray(t,t+n);if(r[0]===0&&r.length===33)r=r.subarray(1);if(i[0]===0&&i.length===33)i=i.subarray(1);let o=Buffer.alloc(64);return r.copy(o,32-r.length),i.copy(o,64-i.length),o}async getClient(){if(this.client&&!this.client.destroyed)return this.client;return new Promise((e,t)=>{this.client=h.connect(`https://${this.host}`),this.client.on("error",(s)=>{t(s)}),this.client.on("connect",()=>{e(this.client)}),this.client.on("close",()=>{this.client=null})})}buildPayload(e){let t={};if(e.title||e.body||e.subtitle){if(t.alert={},e.title)t.alert.title=e.title;if(e.subtitle)t.alert.subtitle=e.subtitle;if(e.body)t.alert.body=e.body}if(e.badge!==void 0)t.badge=e.badge;if(e.sound!==void 0)t.sound=e.sound;if(e.category)t.category=e.category;if(e.threadId)t["thread-id"]=e.threadId;if(e.contentAvailable)t["content-available"]=1;if(e.mutableContent)t["mutable-content"]=1;if(e.targetContentId)t["target-content-id"]=e.targetContentId;let s={aps:t};if(e.data)Object.assign(s,e.data);return s}async send(e){try{let t=await this.getClient(),s=this.generateToken(),r=JSON.stringify(this.buildPayload(e)),n={":method":"POST",":path":`/3/device/${e.deviceToken}`,authorization:`bearer ${s}`,"apns-topic":this.config.bundleId,"apns-push-type":e.pushType||"alert","apns-priority":String(e.priority||10)};if(e.expiration!==void 0)n["apns-expiration"]=String(e.expiration);if(e.collapseId)n["apns-collapse-id"]=e.collapseId;return new Promise((i)=>{let o=t.request(n),a="",d=0,l;o.on("response",(c)=>{d=c[":status"],l=c["apns-id"]}),o.on("data",(c)=>{a+=c.toString()}),o.on("end",()=>{if(d===200)i({success:!0,deviceToken:e.deviceToken,apnsId:l,statusCode:d});else{let c="Unknown error",g,u;if(a)try{let p=JSON.parse(a);g=p.reason,u=p.timestamp,c=g||c}catch{c=a}i({success:!1,deviceToken:e.deviceToken,apnsId:l,statusCode:d,error:c,reason:g,timestamp:u})}}),o.on("error",(c)=>{i({success:!1,deviceToken:e.deviceToken,error:c.message})}),o.write(r),o.end()})}catch(t){return{success:!1,deviceToken:e.deviceToken,error:t.message}}}async sendBatch(e,t){let s=t?.concurrency||10,r=[];for(let n=0;n<e.length;n+=s){let i=e.slice(n,n+s),o=await Promise.all(i.map((a)=>this.send(a)));r.push(...o)}return{sent:r.filter((n)=>n.success).length,failed:r.filter((n)=>!n.success).length,results:r}}async sendSimple(e,t,s,r){return this.send({deviceToken:e,title:t,body:s,data:r})}async sendSilent(e,t){return this.send({deviceToken:e,contentAvailable:!0,pushType:"background",priority:5,data:t})}close(){if(this.client)this.client.close(),this.client=null;this.token=null,this.tokenGeneratedAt=0}}import{createSign as T}from"node:crypto";var C="https://fcm.googleapis.com/v1/projects",y="https://oauth2.googleapis.com/token",P=3300000;class m{config;accessToken=null;tokenExpiresAt=0;constructor(e){this.config=e}static fromServiceAccount(e){return new m({projectId:e.project_id,clientEmail:e.client_email,privateKey:e.private_key})}generateJWT(){let e=Math.floor(Date.now()/1000),t=e+3600,s={alg:"RS256",typ:"JWT"},r={iss:this.config.clientEmail,sub:this.config.clientEmail,aud:y,iat:e,exp:t,scope:"https://www.googleapis.com/auth/firebase.messaging"},n=Buffer.from(JSON.stringify(s)).toString("base64url"),i=Buffer.from(JSON.stringify(r)).toString("base64url"),o=`${n}.${i}`,a=T("SHA256");a.update(o);let d=a.sign(this.config.privateKey,"base64url");return`${o}.${d}`}async getAccessToken(){if(this.accessToken&&Date.now()<this.tokenExpiresAt)return this.accessToken;let e=this.generateJWT(),t=await fetch(y,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:e}).toString()});if(!t.ok){let r=await t.text();throw Error(`Failed to get access token: ${r}`)}let s=await t.json();return this.accessToken=s.access_token,this.tokenExpiresAt=Date.now()+P,this.accessToken}buildMessage(e){let t={};if(e.token)t.token=e.token;else if(e.topic)t.topic=e.topic;else if(e.condition)t.condition=e.condition;if(e.title||e.body||e.imageUrl){if(t.notification={},e.title)t.notification.title=e.title;if(e.body)t.notification.body=e.body;if(e.imageUrl)t.notification.image=e.imageUrl}if(e.data&&Object.keys(e.data).length>0)t.data=e.data;if(e.android){if(t.android={priority:e.android.priority||"high"},e.android.ttl)t.android.ttl=`${e.android.ttl}s`;if(e.android.collapseKey)t.android.collapse_key=e.android.collapseKey;if(e.android.directBootOk)t.android.direct_boot_ok=e.android.directBootOk;let s={};if(e.android.channelId)s.channel_id=e.android.channelId;if(e.android.icon)s.icon=e.android.icon;if(e.android.color)s.color=e.android.color;if(e.android.sound)s.sound=e.android.sound;if(e.android.clickAction)s.click_action=e.android.clickAction;if(e.android.tag)s.tag=e.android.tag;if(e.android.visibility)s.visibility=e.android.visibility;if(e.android.notificationCount!==void 0)s.notification_count=e.android.notificationCount;if(Object.keys(s).length>0)t.android.notification=s}if(e.webpush)t.webpush=e.webpush;if(e.apns)t.apns=e.apns;if(e.fcmOptions)t.fcm_options=e.fcmOptions;return{message:t}}async send(e){try{let t=await this.getAccessToken(),s=this.buildMessage(e),r=await fetch(`${C}/${this.config.projectId}/messages:send`,{method:"POST",headers:{Authorization:`Bearer ${t}`,"Content-Type":"application/json"},body:JSON.stringify(s)}),n=await r.json();if(r.ok)return{success:!0,messageId:n.name};else return{success:!1,error:n.error?.message||"Unknown error",errorCode:n.error?.status}}catch(t){return{success:!1,error:t.message}}}async sendBatch(e,t,s){let r=s?.concurrency||10,n=[];for(let i=0;i<e.length;i+=r){let a=e.slice(i,i+r).map(async(l)=>({...await this.send({...t,token:l}),token:l})),d=await Promise.all(a);n.push(...d)}return{sent:n.filter((i)=>i.success).length,failed:n.filter((i)=>!i.success).length,results:n}}async sendToTopic(e,t){return this.send({...t,topic:e})}async sendToCondition(e,t){return this.send({...t,condition:e})}async sendSimple(e,t,s,r){return this.send({token:e,title:t,body:s,data:r})}async sendSilent(e,t){return this.send({token:e,data:t,android:{priority:"high"}})}async subscribeToTopic(e,t){try{let s=await this.getAccessToken(),r=await fetch("https://iid.googleapis.com/iid/v1:batchAdd",{method:"POST",headers:{Authorization:`Bearer ${s}`,"Content-Type":"application/json"},body:JSON.stringify({to:`/topics/${t}`,registration_tokens:e})});if(r.ok)return{success:!0};else return{success:!1,error:(await r.json()).error?.message||"Failed to subscribe"}}catch(s){return{success:!1,error:s.message}}}async unsubscribeFromTopic(e,t){try{let s=await this.getAccessToken(),r=await fetch("https://iid.googleapis.com/iid/v1:batchRemove",{method:"POST",headers:{Authorization:`Bearer ${s}`,"Content-Type":"application/json"},body:JSON.stringify({to:`/topics/${t}`,registration_tokens:e})});if(r.ok)return{success:!0};else return{success:!1,error:(await r.json()).error?.message||"Failed to unsubscribe"}}catch(s){return{success:!1,error:s.message}}}}export{R as APNsClient,m as FCMClient};

package/dist/spend/index.js

@@ -1 +1 @@
-import{$i as b,$j as ca,Aj as C,Bj as D,Cj as E,Dj as F,Ej as G,Fj as H,Gj as I,Gk as qa,Hj as J,Hk as ra,Ij as K,Ik as sa,Jj as L,Jk as ta,Kj as M,Kk as ua,Lj as N,Lk as va,Mj as O,Mk as wa,Nj as P,Nk as xa,Oj as Q,Ok as ya,Pj as R,Pk as za,Qj as S,Qk as Aa,Rj as T,Rk as Ba,Sj as U,Tj as V,Uj as W,Vj as X,Vk as Ca,Wj as Y,Wk as Da,Xj as Z,Yj as _,Zj as aa,_i as a,_j as ba,aj as c,ak as da,bj as d,bk as ea,cj as e,ck as fa,dj as f,dk as ga,ej as g,ek as ha,fj as h,fk as ia,gj as i,gk as ja,hj as j,hk as ka,ij as k,ik as la,jj as l,jk as ma,kj as m,kk as na,lj as n,lk as oa,mj as o,mk as pa,nj as p,oj as q,pj as r,qj as s,rj as t,sj as u,tj as v,uj as w,vj as x,wj as y,xj as z,yj as A,zj as B}from"../chunk-s3rpd72x.js";import"../chunk-b10cbk8z.js";import"../chunk-0hj552t7.js";import"../chunk-spx89gaw.js";export{Z as AnomalyConfigStore,za as AwsSpendTransport,Aa as ComputeSpendTransport,x as CounterTracker,u as DEFAULT_METER_MAPPINGS,l as DEFAULT_PRICE_BOOK,B as DEFAULT_THRESHOLDS,_ as DETECTABLE_SIGNALS,c as ENFORCEMENT_ACTIONS,K as ENFORCEMENT_DESCRIPTIONS,d as ENFORCEMENT_SEVERITY,ea as FOCUS_VERSION,b as METERS,a as METER_KEYS,e as MICRO_CENTS,G as MIN_PROJECTION_CONFIDENCE,pa as RecordingSpendTransport,X as SENSITIVITY_THRESHOLDS,xa as SPEND_CYCLE_SECONDS,ka as SPEND_GATE_SETTING,ua as SPEND_LEASE_SETTING,ba as SignalSource,ma as SpendCapError,la as SpendGate,va as SpendLoopLease,ta as SpendNotificationRouter,wa as SpendRunner,ia as SpendService,C as SpendStore,qa as URGENT_SPEND_EVENTS,L as USER_VISIBLE_ACTIONS,z as aggregateDeltas,W as anomalyOptionsForSignal,na as assertSpendAllows,q as budgetWindow,Ba as compositeSpendTransport,oa as createEnforcementHandlers,U as detectAnomalies,V as detectLatestAnomaly,I as evaluateBudget,T as ewma,v as findMapping,g as findPriceEntry,ra as formatCents,F as formatTimeToExhaustion,H as governingLimitCents,Ca as handleSpendRequest,s as hourBucket,t as hourBucketsBetween,P as isOperationAllowed,m as isValidTimeZone,da as lookbackHoursForSignal,Q as median,R as medianAbsoluteDeviation,J as mergeDecisions,k as mergePriceBooks,y as meterTelemetry,ca as optionsForSignal,E as percentOfLimit,M as planEnforcement,r as previousBudgetWindow,h as priceUsage,i as priceUsageLines,D as projectSpend,S as robustZScore,j as roundCents,Y as routeMatches,N as runEnforcement,A as scopeKey,aa as signalDefinition,sa as spendNotificationText,Da as spendOpenApiPaths,ya as startSpendLoop,ha as streamFocusJsonl,O as strongestActiveAction,f as tieredMicroCents,ga as toFocusJsonl,fa as toFocusRecords,w as usageDeltaKey,p as utcInstantOfLocal,ja as zeroFill,o as zoneOffsetMs,n as zonedParts};
+import{$j as _,Aj as z,Bj as A,Cj as B,Dj as C,Ej as D,Fj as E,Gj as F,Hj as G,Ij as H,Jj as I,Jk as qa,Kj as J,Kk as ra,Lj as K,Lk as sa,Mj as L,Mk as ta,Nj as M,Nk as ua,Oj as N,Ok as va,Pj as O,Pk as wa,Qj as P,Qk as xa,Rj as Q,Rk as ya,Sj as R,Sk as za,Tj as S,Tk as Aa,Uj as T,Uk as Ba,Vj as U,Wj as V,Xj as W,Yj as X,Yk as Ca,Zj as Y,Zk as Da,_j as Z,ak as aa,bj as a,bk as ba,cj as b,ck as ca,dj as c,dk as da,ej as d,ek as ea,fj as e,fk as fa,gj as f,gk as ga,hj as g,hk as ha,ij as h,ik as ia,jj as i,jk as ja,kj as j,kk as ka,lj as k,lk as la,mj as l,mk as ma,nj as m,nk as na,oj as n,ok as oa,pj as o,pk as pa,qj as p,rj as q,sj as r,tj as s,uj as t,vj as u,wj as v,xj as w,yj as x,zj as y}from"../chunk-aw0cgv5w.js";import"../chunk-x3hay61c.js";import"../chunk-zz52xje8.js";import"../chunk-z2qqwy7e.js";export{Z as AnomalyConfigStore,za as AwsSpendTransport,Aa as ComputeSpendTransport,x as CounterTracker,u as DEFAULT_METER_MAPPINGS,l as DEFAULT_PRICE_BOOK,B as DEFAULT_THRESHOLDS,_ as DETECTABLE_SIGNALS,c as ENFORCEMENT_ACTIONS,K as ENFORCEMENT_DESCRIPTIONS,d as ENFORCEMENT_SEVERITY,ea as FOCUS_VERSION,b as METERS,a as METER_KEYS,e as MICRO_CENTS,G as MIN_PROJECTION_CONFIDENCE,pa as RecordingSpendTransport,X as SENSITIVITY_THRESHOLDS,xa as SPEND_CYCLE_SECONDS,ka as SPEND_GATE_SETTING,ua as SPEND_LEASE_SETTING,ba as SignalSource,ma as SpendCapError,la as SpendGate,va as SpendLoopLease,ta as SpendNotificationRouter,wa as SpendRunner,ia as SpendService,C as SpendStore,qa as URGENT_SPEND_EVENTS,L as USER_VISIBLE_ACTIONS,z as aggregateDeltas,W as anomalyOptionsForSignal,na as assertSpendAllows,q as budgetWindow,Ba as compositeSpendTransport,oa as createEnforcementHandlers,U as detectAnomalies,V as detectLatestAnomaly,I as evaluateBudget,T as ewma,v as findMapping,g as findPriceEntry,ra as formatCents,F as formatTimeToExhaustion,H as governingLimitCents,Ca as handleSpendRequest,s as hourBucket,t as hourBucketsBetween,P as isOperationAllowed,m as isValidTimeZone,da as lookbackHoursForSignal,Q as median,R as medianAbsoluteDeviation,J as mergeDecisions,k as mergePriceBooks,y as meterTelemetry,ca as optionsForSignal,E as percentOfLimit,M as planEnforcement,r as previousBudgetWindow,h as priceUsage,i as priceUsageLines,D as projectSpend,S as robustZScore,j as roundCents,Y as routeMatches,N as runEnforcement,A as scopeKey,aa as signalDefinition,sa as spendNotificationText,Da as spendOpenApiPaths,ya as startSpendLoop,ha as streamFocusJsonl,O as strongestActiveAction,f as tieredMicroCents,ga as toFocusJsonl,fa as toFocusRecords,w as usageDeltaKey,p as utcInstantOfLocal,ja as zeroFill,o as zoneOffsetMs,n as zonedParts};

package/dist/ui/404.html

@@ -2,7 +2,7 @@
 <html lang="en" data-theme="dark">
 <head>
   <meta charset="UTF-8">
-  <meta name="stx-build" content="mt3u6o68ittj80">
+  <meta name="stx-build" content="mt4laich07wedk">
 
 <!-- stx SEO Tags -->
 <meta name="title" content="Page not found · ts-cloud">