@stacksjs/ts-cloud 0.11.4 → 0.11.6

package/dist/index.js

@@ -1,4 +1,4 @@
-import{$ as Vg,$a as wC,$b as wS,$c as JS,A as Ef,Aa as rC,Ab as rS,B as wf,Ba as nC,Bb as nS,Bc as yi,C as vf,Ca as iC,Cb as iS,Cc as Ci,D as Of,Da as oC,Db as oS,Dc as Si,E as gg,Ea as aC,Eb as aS,Ec as Ai,F as hg,Fa as sC,Fb as sS,Fc as bi,G as yg,Ga as cC,Gb as cS,Gc as Ri,H as Cg,Ha as lC,Hb as lS,Hc as Ti,I as Sg,Ia as dC,Ib as dS,J as Ag,Ja as uC,Jb as uS,K as bg,Ka as pC,Kb as pS,L as Rg,La as mC,Lb as mS,M as Tg,Ma as fC,Mb as fS,N as $g,Na as gC,Nb as gS,O as Pg,Oa as hC,Ob as hS,P as Ig,Pa as yC,Pb as yS,Pc as VS,Q as Dg,Qa as CC,Qb as CS,Qc as _S,R as Eg,Ra as SC,Rb as SS,Rc as BS,S as wg,Sa as AC,Sb as AS,Sc as WS,T as vg,Ta as bC,Tb as bS,Tc as zS,U as Og,Ua as RC,Ub as RS,Uc as HS,V as Ng,Va as TC,Vb as TS,Vc as GS,W as kg,Wa as $C,Wb as $S,Wc as KS,X as xg,Xa as PC,Xb as PS,Xc as US,Y as Lg,Ya as IC,Yb as IS,Yc as ZS,Z as Mg,Za as DC,Zb as DS,Zc as jS,_ as Fg,_a as EC,_b as ES,_c as qS,a as _m,aa as _g,ab as vC,ac as vS,ad as YS,b as Bm,ba as Bg,bb as OC,bc as OS,bd as QS,c as Wm,ca as Ny,cb as NC,cc as NS,cd as XS,d as zm,da as ky,db as kC,dc as kS,dd as eA,e as Hm,ea as xy,eb as xC,ec as xS,ed as tA,f as Gm,fa as Ly,fb as LC,fc as LS,fd as rA,g as Km,ga as My,gb as MC,gc as MS,gd as nA,h as Um,ha as Fy,hb as FC,hc as FS,hd as iA,i as Zm,ia as Vy,ib as VC,id as oA,j as jm,ja as _y,jb as _C,jd as aA,k as qm,ka as By,kb as BC,kd as sA,l as Jm,la as Wy,lb as WC,ld as cA,m as Ym,ma as zy,mb as zC,md as lA,n as Qm,na as Hy,nb as HC,nd as dA,o as Xm,oa as Gy,ob as GC,od as $i,p as ef,pa as Ky,pb as KC,pc as gi,pd as Pi,q as tf,qa as Uy,qb as UC,qd as Ii,r as rf,ra as Zy,rb as ZC,rd as Di,s as nf,sa as jy,sb as jC,t as of,ta as qy,tb as qC,u as af,ua as Jy,ub as JC,v as sf,va as Yy,vb as YC,w as cf,wa as Qy,wb as QC,x as lf,xa as Xy,xb as XC,y as If,ya as eC,yb as eS,z as Df,za as tC,zb as tS}from"./chunk-7pff0rv9.js";import{Ad as fi,sd as ai,td as si,ud as ci,vd as li,wd as di,xd as ui,yd as pi,zd as mi}from"./chunk-6v4k9ekm.js";import{Id as hi}from"./chunk-1ypkh8g6.js";import{$d as Dr,Be as Mr,Fe as Fr,Jd as Vt,Ld as _t,Le as Vr,Md as Bt,Nd as Wt,Od as zt,Oe as _r,Pd as Ht,Pe as Br,Qd as Gt,Qe as Wr,Re as zr,Sd as Ut,Td as yr,Ud as Sr,Vd as Ar,Wd as br,We as Hr,Xd as Rr,Yd as Tr,Zd as $r,_d as Pr,ae as Er,be as wr,ce as vr,de as Or,ef as Gr,if as Kr,ke as Nr,nf as Ur,pe as kr,te as xr,xe as Lr}from"./chunk-h1rc94df.js";import{of as At,pf as Rt,qf as Tt}from"./chunk-nnqxmh7f.js";import{sf as Me}from"./chunk-q2njk4hx.js";import{tf as hr}from"./chunk-ky5c6t5y.js";import{uf as Ir}from"./chunk-t0kh8haz.js";import{Af as Qt,Bf as Xt,Cf as er,Df as tr,Ef as rr,Ff as nr,Gf as ir,Hf as or,If as ar,Jf as sr,Kf as cr,Lf as lr,Mf as dr,Nf as q,Of as ur,Pf as pr,Qf as mr,Rf as fr,Sf as gr,vf as Zt,wf as jt,xf as qt,yf as Jt,zf as Yt}from"./chunk-hwan3cev.js";import{Tf as j}from"./chunk-qjk1v1gs.js";import{Ch as Mn,Dh as Fn,Eg as mn,Eh as Vn,Fg as fn,Fh as _n,Gh as Bn,Hg as gn,Hh as Wn,Ig as hn,Ih as zn,Jg as yn,Kg as Cn,Kh as Hn,Lg as Sn,Lh as Gn,Mh as Kn,Nh as Un,Og as An,Pg as bn,Qg as Rn,Uf as Zr,Ug as Tn,Vf as jr,Vg as $n,Wf as qr,Wg as Pn,Xf as Jr,Xg as In,Yf as ue,Yg as Dn,Zf as Yr,Zg as En,_f as Qr,fg as Ee,ig as Xr,jg as en,kg as tn,lg as rn,lh as wn,mh as vn,ng as nn,nh as On,og as on,oh as Nn,sg as an,tg as pe,wh as kn,xh as xn,yh as Ln}from"./chunk-7xpxzbkr.js";import{Sh as Kt,Th as Cr}from"./chunk-hbhxk5a0.js";import{Uh as Le}from"./chunk-8e0az001.js";import{Wh as bt}from"./chunk-p6vszgc2.js";import{Yh as St}from"./chunk-gk58959n.js";import{$h as df,$i as zg,$j as zh,Ai as Hf,Aj as gh,Ak as dy,Bi as Gf,Bj as hh,Bk as uy,Ci as Kf,Cj as yh,Ck as py,Di as Uf,Dj as Ch,Dk as my,Ei as Zf,Ej as Sh,Ek as fy,Fi as jf,Fj as Ah,Fk as wt,Gi as qf,Gj as bh,Gk as gy,Hi as Jf,Hj as Rh,Hk as hy,Ii as Yf,Ij as Th,Ik as yy,Ji as Qf,Jj as $h,Jk as Cy,Ki as Xf,Kj as Ph,Kk as Sy,Li as eg,Lj as Ih,Lk as Ay,Mi as tg,Mj as Dh,Mk as by,Ni as rg,Nj as Eh,Nk as Ry,Oi as ng,Oj as wh,Ok as Ty,Pi as ig,Pj as vh,Pk as $y,Qi as og,Qj as Oh,Qk as Py,Ri as ag,Rj as Nh,Rk as Iy,Si as sg,Sj as kh,Sk as Dy,Ti as cg,Tj as xh,Tk as Ey,Ui as lg,Uj as Lh,Uk as wy,Vi as dg,Vj as Mh,Vk as vy,Wi as ug,Wj as Fh,Wk as Oy,Xi as pg,Xj as Vh,Yi as mg,Yj as _h,Zi as fg,Zj as Bh,_i as Wg,_j as Wh,ai as uf,aj as Hg,ak as Hh,bi as pf,bj as Gg,bk as Gh,ci as mf,cj as Kg,ck as Kh,di as ff,dj as Ug,dk as Uh,ei as gf,ej as Zg,ek as Zh,fi as hf,fj as jg,fk as jh,gi as yf,gj as qg,gk as qh,hi as Cf,hj as Jg,hk as Jh,ii as Sf,ij as Yg,ik as Yh,ji as Af,jj as Qg,jk as Qh,ki as bf,kj as Xg,kk as Xh,li as Rf,lj as eh,lk as ey,mi as Tf,mj as th,mk as ty,ni as $f,nj as rh,nk as $t,oi as Pf,oj as nh,ok as Pt,pi as Nf,pj as ih,pk as It,qi as kf,qj as oh,qk as Dt,ri as xf,rj as ah,rk as Et,si as Lf,sj as sh,sk as ry,ti as Mf,tj as ch,tk as ny,ui as Ff,uj as lh,uk as iy,vi as Vf,vj as dh,vk as oy,wi as _f,wj as uh,wk as ay,xi as Bf,xj as ph,xk as sy,yi as Wf,yj as mh,yk as cy,zi as zf,zj as fh,zk as ly}from"./chunk-s3rpd72x.js";import{$k as Yn,Xk as Zn,Yk as jn,Zk as qn,_k as Jn,al as Qn,bl as Xn,dl as ei,el as ti,fl as ri,gl as ni,hl as ii,il as oi}from"./chunk-vz95qy3n.js";import{kl as sn,ll as cn,ml as ln,nl as dn,ol as un,pl as pn}from"./chunk-r5natbed.js";import{ql as vt,rl as Ot,sl as Nt,tl as kt,ul as xt,vl as Lt,wl as Mt,xl as Ft}from"./chunk-b10cbk8z.js";import{$l as za,$m as Ts,$n as Tc,$o as Tl,$p as Td,$q as Tu,$r as Tp,$s as mm,Al as ga,Am as Re,An as Js,Ao as Jc,Ap as Jl,Aq as Jd,Ar as Ju,As as Jp,Bl as ha,Bm as K,Bn as Ys,Bo as Yc,Bp as Yl,Bq as Yd,Br as Yu,Bs as Yp,Cl as ya,Cm as L,Cn as Qs,Co as Qc,Cp as Ql,Cq as Qd,Cr as Qu,Cs as Qp,Dl as Ca,Dm as ls,Dn as Xs,Do as Xc,Dp as Xl,Dq as Xd,Dr as Xu,Ds as Xp,El as Sa,Em as ds,En as ec,Eo as el,Ep as ed,Eq as eu,Er as ep,Es as em,Fl as Aa,Fm as te,Fn as tc,Fo as tl,Fp as td,Fq as tu,Fr as tp,Fs as tm,Gl as ba,Gm as us,Gn as rc,Go as rl,Gp as rd,Gq as ru,Gr as rp,Gs as rm,Hl as Ra,Hm as ps,Hn as nc,Ho as nl,Hp as nd,Hq as nu,Hr as np,Hs as nm,Il as Ta,Im as ms,In as ic,Io as il,Ip as id,Iq as iu,Ir as ip,Is as im,Jl as $a,Jm as fs,Jn as oc,Jo as ol,Jp as od,Jq as ou,Jr as op,Js as om,Kl as Pa,Km as Te,Kn as ac,Ko as al,Kp as ad,Kq as au,Kr as ap,Ks as lt,Ll as Ia,Lm as M,Ln as sc,Lo as sl,Lp as sd,Lq as su,Lr as sp,Ls as dt,Ml as Da,Mm as U,Mn as cc,Mo as cl,Mp as cd,Mq as cu,Mr as cp,Ms as ut,Nl as Ea,Nm as re,Nn as lc,No as ll,Np as ld,Nq as lu,Nr as lp,Ns as pt,Ol as wa,Om as $e,On as dc,Oo as dl,Op as dd,Oq as du,Or as dp,Os as mt,Pl as va,Pm as Pe,Pn as uc,Po as ul,Pp as ud,Pq as uu,Pr as up,Ps as ft,Ql as Oa,Qm as gs,Qn as pc,Qo as pl,Qp as pd,Qq as pu,Qr as pp,Qs as gt,Rl as Na,Rm as hs,Rn as mc,Ro as ml,Rp as md,Rq as mu,Rr as mp,Rs as ht,Sl as ka,Sm as Ie,Sn as fc,So as fl,Sp as fd,Sq as fu,Sr as fp,Ss as yt,Tl as xa,Tm as ys,Tn as gc,To as gl,Tp as gd,Tq as gu,Tr as gp,Ts as Ct,Ul as La,Um as Cs,Un as hc,Uo as hl,Up as hd,Uq as hu,Ur as hp,Us as am,Vl as Ma,Vm as Ss,Vn as yc,Vo as yl,Vp as yd,Vq as yu,Vr as yp,Vs as sm,Wl as Fa,Wm as As,Wn as Cc,Wo as Cl,Wp as Cd,Wq as Cu,Wr as Cp,Ws as cm,Xl as Va,Xm as bs,Xn as Sc,Xo as Sl,Xp as Sd,Xq as Su,Xr as Sp,Xs as lm,Yl as _a,Ym as De,Yn as Ac,Yo as Al,Yp as Ad,Yq as Au,Yr as Ap,Ys as dm,Zl as Ba,Zm as Z,Zn as bc,Zo as bl,Zp as bd,Zq as bu,Zr as bp,Zs as um,_l as Wa,_m as Rs,_n as Rc,_o as Rl,_p as Rd,_q as Ru,_r as Rp,_s as pm,am as Ha,an as $s,ao as $c,ap as $l,aq as $d,ar as $u,as as $p,at as fm,bm as Ga,bn as Ps,bo as Pc,bp as Pl,bq as Pd,br as Pu,bs as Pp,bt as gm,cm as Se,cn as Is,co as Ic,cp as Il,cq as Id,cr as Iu,cs as Ip,ct as hm,dm as Ka,dn as Ds,do as Dc,dp as Dl,dq as Dd,dr as Du,ds as Dp,dt as ym,em as Ae,en as Es,eo as Ec,ep as El,eq as Ed,er as Eu,es as Ep,et as Cm,fm as be,fn as ws,fo as wc,fp as wl,fq as wd,fr as wu,fs as wp,ft as Sm,gm as Ua,gn as vs,go as vc,gp as vl,gq as vd,gr as vu,gs as vp,gt as Am,hm as Za,hn as Os,ho as Oc,hp as Ol,hq as Od,hr as Ou,hs as Op,ht as bm,im as ja,in as Ns,io as Nc,ip as Nl,iq as Nd,ir as Nu,is as Np,it as Rm,jm as qa,jn as ks,jo as kc,jp as kl,jq as kd,jr as ku,js as kp,jt as Tm,km as Ja,kn as xs,ko as xc,kp as xl,kq as xd,kr as xu,ks as xp,kt as $m,lm as Ya,ln as Ls,lo as Lc,lp as Ll,lq as Ld,lr as Lu,ls as Lp,lt as Pm,mm as Qa,mn as Ms,mo as Mc,mp as Ml,mq as Md,mr as Mu,ms as Mp,mt as Im,nm as Xa,nn as Fs,no as Fc,np as Fl,nq as Fd,nr as Fu,ns as Fp,nt as Dm,om as es,on as Vs,oo as Vc,op as Vl,oq as Vd,or as Vu,os as Vp,ot as Em,pm as ts,pn as _s,po as _c,pp as _l,pq as _d,pr as _u,ps as _p,pt as wm,qm as rs,qn as Bs,qo as Bc,qp as Bl,qq as Bd,qr as Bu,qs as Bp,qt as vm,rm as ns,rn as Ws,ro as Wc,rp as Wl,rq as Wd,rr as Wu,rs as Wp,rt as Om,sm as is,sn as zs,so as zc,sp as zl,sq as zd,sr as zu,ss as zp,st as Nm,tm as os,tn as Hs,to as Hc,tp as Hl,tq as Hd,tr as Hu,ts as Hp,tt as km,um as X,un as Gs,uo as Gc,up as Gl,uq as Gd,ur as Gu,us as Gp,ut as xm,vm as as,vn as Ks,vo as Kc,vp as Kl,vq as Kd,vr as Ku,vs as Kp,vt as Lm,wm as ss,wn as Us,wo as Uc,wp as Ul,wq as Ud,wr as Uu,ws as Up,wt as Mm,xm as cs,xn as Zs,xo as Zc,xp as Zl,xq as Zd,xr as Zu,xs as Zp,xt as Fm,yl as ma,ym as ee,yn as js,yo as jc,yp as jl,yq as jd,yr as ju,ys as jp,yt as Vm,zl as fa,zm as w,zn as qs,zo as qc,zp as ql,zq as qd,zr as qu,zs as qp}from"./chunk-0hj552t7.js";import{zt as Je}from"./chunk-spx89gaw.js";import{createHmac as fe,createSign as _e,timingSafeEqual as Be}from"node:crypto";function B(e){let t=e instanceof Date?e.getTime():e;if(!Number.isFinite(t))throw TypeError("Media access timestamp must be finite");return Math.floor(t/1000)}function ge(e){return Buffer.from(e).toString("base64").replaceAll("+","-").replaceAll("=","_").replaceAll("/","~")}function We(e){return Buffer.from(e).toString("base64url")}function he(e,t=!1){if(!e||/[\r\n]/.test(e))throw TypeError("Media resource is invalid");let r=t?e.replaceAll("*","wildcard"):e,n=new URL(r);if(!["http:","https:"].includes(n.protocol))throw TypeError("Media resource must use HTTP or HTTPS");if(!t&&e.includes("*"))throw TypeError("Canned policies cannot contain wildcards")}function ye(e,t){let r=_e("RSA-SHA1");return r.update(e),r.end(),ge(r.sign(t))}function Ce(e){he(e.resource,!0);let r={DateLessThan:{"AWS:EpochTime":B(e.expiresAt)}};if(e.activeAt!==void 0)r.DateGreaterThan={"AWS:EpochTime":B(e.activeAt)};if(e.ipAddress)r.IpAddress={"AWS:SourceIp":e.ipAddress};return JSON.stringify({Statement:[{Resource:e.resource,Condition:r}]})}function wi(e,t,r){he(e);let n=B(t),o=e.includes("?")?"&":"?",l=Ce({resource:e,expiresAt:t}),c=ye(l,r.privateKey);return`${e}${o}Expires=${n}&Signature=${encodeURIComponent(c)}&Key-Pair-Id=${encodeURIComponent(r.keyPairId)}`}function vi(e,t){let r=Ce(e);return{"CloudFront-Key-Pair-Id":t.keyPairId,"CloudFront-Policy":ge(Buffer.from(r)),"CloudFront-Signature":ye(r,t.privateKey)}}function Oi(e){if(!e.resource||/[\r\n]/.test(e.resource))throw TypeError("Media resource is invalid");let t=We(Buffer.from(JSON.stringify({resource:e.resource,expiresAt:B(e.expiresAt),...e.keyId?{keyId:e.keyId}:{},...e.audience?{audience:e.audience}:{}}))),r=fe("sha256",e.secret).update(t).digest("base64url");return`${t}.${r}`}function Ni(e,t){let[r,n,o]=e.split(".");if(!r||!n||o)return null;let l=fe("sha256",t.secret).update(r).digest(),c;try{c=Buffer.from(n,"base64url")}catch{return null}if(l.length!==c.length||!Be(l,c))return null;try{let s=JSON.parse(Buffer.from(r,"base64url").toString("utf8")),d=B(t.now??Date.now());if(!s.resource||!Number.isSafeInteger(s.expiresAt)||s.expiresAt<=d)return null;if(t.resource&&s.resource!==t.resource)return null;if(t.audience&&s.audience!==t.audience)return null;return s}catch{return null}}function ki(e,t=!1){let r=new URL(e,"https://media.invalid").pathname.toLowerCase(),n=/\.(?:m3u8|mpd|vtt|json)$/.test(r),o=/\.(?:key|license)$/.test(r)||r.includes("/keys/")||r.includes("/licenses/");return{"Accept-Ranges":"bytes","Cache-Control":t&&(n||o)?"private, no-store":n?"public, max-age=5, s-maxage=30, stale-while-revalidate=30":"public, max-age=31536000, immutable","Cross-Origin-Resource-Policy":"cross-origin","X-Content-Type-Options":"nosniff"}}function xi(e){if(!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(e.bucket))throw TypeError("Media bucket is invalid");if(!/^[a-z0-9-]+$/.test(e.region))throw TypeError("Media bucket region is invalid");let t=e.prefix?`/${e.prefix.replace(/^\/+|\/+$/g,"")}`:"",r=e.protected??!1,n="public, max-age=31536000, immutable",o=r?"private, no-store":"public, max-age=5, s-maxage=30, stale-while-revalidate=30";return{originDomain:`${e.bucket}.s3.${e.region}.amazonaws.com`,originPath:t,domain:e.domain,trustedKeyGroupIds:[...new Set(e.trustedKeyGroupIds??[])],behaviors:[{pathPattern:"*.m3u8",cacheControl:o,compress:!0,signed:r},{pathPattern:"*.mpd",cacheControl:o,compress:!0,signed:r},{pathPattern:"*.vtt",cacheControl:o,compress:!0,signed:r},{pathPattern:"*",cacheControl:n,compress:!1,signed:r}],responseHeaders:{"Access-Control-Allow-Headers":"Range, If-Range","Access-Control-Allow-Methods":"GET, HEAD, OPTIONS","Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":"Accept-Ranges, Content-Length, Content-Range, ETag","X-Content-Type-Options":"nosniff"}}}class ze{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;constructor(e){this.config=e.config,this.environment=e.environment,this.builder=new Se(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let t=this.config.environments[this.environment]?.infrastructure;if(!t)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...t,compute:{...this.config.infrastructure?.compute,...t.compute},storage:{...this.config.infrastructure?.storage,...t.storage},functions:{...this.config.infrastructure?.functions,...t.functions},servers:{...this.config.infrastructure?.servers,...t.servers},databases:{...this.config.infrastructure?.databases,...t.databases},cdn:{...this.config.infrastructure?.cdn,...t.cdn},sftp:t.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...t.queues},redirects:{...this.config.infrastructure?.redirects,...t.redirects},realtime:{...this.config.infrastructure?.realtime,...t.realtime},cache:{...this.config.infrastructure?.cache,...t.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...t.fileSystem},email:{...this.config.infrastructure?.email,...t.email},search:{...this.config.infrastructure?.search,...t.search},ai:{...this.config.infrastructure?.ai,...t.ai}}}}shouldDeploy(e){if(e.environments&&!e.environments.includes(this.environment))return!1;if(e.requiresFeatures){let t=this.config.features||{};if(!e.requiresFeatures.every((n)=>t[n]===!0))return!1}if(e.regions){let t=this.config.environments[this.environment]?.region||this.config.project.region;if(!e.regions.includes(t))return!1}if(e.condition&&typeof e.condition==="function")return e.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let e=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,t=Number(e||3008);return Number.isFinite(t)&&t>0?t:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(e,t){return e==="public"||t.routeCompute===!0}storageBucketName(e,t,r){return this.mergedConfig.infrastructure?.storage?.[r]?.bucket??`${e}-${t}-${r}`}fileSystemLogicalId(e,t,r){return be(Ae({slug:`${e}-${r}`,environment:t,resourceType:"efs"}))}resolveSftpStorage(e,t,r){let n=e.storage;if(n?.type==="efs"&&n.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[n.fileSystem])throw Error(`sftp: storage.fileSystem "${n.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(t,r,n.fileSystem)},posixProfile:n.posixProfile}}if(n?.type==="s3"&&n.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[n.storageBucket])throw Error(`sftp: storage.storageBucket "${n.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(t,r,n.storageBucket)}}return}resolveComputeCachePathPatterns(e){if(e&&e.length>0)return e;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(e,t){return{PathPattern:e,TargetOriginId:t,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(e,t,r,n,o,l){let c=this.serverEipLogicalIds.get("app"),s=this.serverEipLogicalIds.get("appInstance");if(!c)return;let d=`EC2-${n}-${o}-api`,h=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",u=h==="us-east-1"?".compute-1.amazonaws.com":`.${h}.compute.amazonaws.com`,b={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:c}]}]},u]]},A=this.resolveApiOriginPort();if(e.push({Id:d,DomainName:b,CustomOriginConfig:{HTTPPort:A,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),r.push(c),s)r.push(s);for(let T of l)t.push(this.createComputeCacheBehavior(T,d))}buildCaddyfile(e){let t=e.filter(([,o])=>typeof o.domain==="string"&&o.domain&&typeof o.port==="number");if(t.length===0)return;let r=new Map;for(let[,o]of t){let l=r.get(o.domain)??[];l.push({port:o.port,path:o.path}),r.set(o.domain,l)}let n=[];for(let[o,l]of r){let s=[...l].sort((d,h)=>{let u=!d.path||d.path==="/",b=!h.path||h.path==="/";if(u&&!b)return 1;if(!u&&b)return-1;return(h.path?.length??0)-(d.path?.length??0)}).map((d)=>{let h=!d.path||d.path==="/",u=`reverse_proxy localhost:${d.port}`;return h?`  handle {
+import{$ as zg,$a as kC,$b as kS,$c as eA,A as Nf,Aa as aC,Ab as aS,B as kf,Ba as sC,Bb as sS,Bc as Ai,C as xf,Ca as cC,Cb as cS,Cc as bi,D as Lf,Da as lC,Db as lS,Dc as Ri,E as Sg,Ea as dC,Eb as dS,Ec as Ti,F as Ag,Fa as uC,Fb as uS,Fc as $i,G as bg,Ga as pC,Gb as pS,Gc as Pi,H as Rg,Ha as mC,Hb as mS,Hc as Ii,I as Tg,Ia as fC,Ib as fS,J as $g,Ja as gC,Jb as gS,K as Pg,Ka as hC,Kb as hS,L as Ig,La as yC,Lb as yS,M as Dg,Ma as CC,Mb as CS,N as Eg,Na as SC,Nb as SS,O as wg,Oa as AC,Ob as AS,P as vg,Pa as bC,Pb as bS,Pc as zS,Q as Og,Qa as RC,Qb as RS,Qc as HS,R as Ng,Ra as TC,Rb as TS,Rc as GS,S as kg,Sa as $C,Sb as $S,Sc as KS,T as xg,Ta as PC,Tb as PS,Tc as US,U as Lg,Ua as IC,Ub as IS,Uc as ZS,V as Mg,Va as DC,Vb as DS,Vc as jS,W as Fg,Wa as EC,Wb as ES,Wc as qS,X as Vg,Xa as wC,Xb as wS,Xc as JS,Y as _g,Ya as vC,Yb as vS,Yc as YS,Z as Bg,Za as OC,Zb as OS,Zc as QS,_ as Wg,_a as NC,_b as NS,_c as XS,a as Hm,aa as Hg,ab as xC,ac as xS,ad as tA,b as Gm,ba as Gg,bb as LC,bc as LS,bd as rA,c as Km,ca as My,cb as MC,cc as MS,cd as nA,d as Um,da as Fy,db as FC,dc as FS,dd as iA,e as Zm,ea as Vy,eb as VC,ec as VS,ed as oA,f as jm,fa as _y,fb as _C,fc as _S,fd as aA,g as qm,ga as By,gb as BC,gc as BS,gd as sA,h as Jm,ha as Wy,hb as WC,hc as WS,hd as cA,i as Ym,ia as zy,ib as zC,id as lA,j as Qm,ja as Hy,jb as HC,jd as dA,k as Xm,ka as Gy,kb as GC,kd as uA,l as ef,la as Ky,lb as KC,ld as pA,m as tf,ma as Uy,mb as UC,md as mA,n as rf,na as Zy,nb as ZC,nd as fA,o as nf,oa as jy,ob as jC,od as Di,p as of,pa as qy,pb as qC,pc as Ci,pd as Ei,q as af,qa as Jy,qb as JC,qd as wi,r as sf,ra as Yy,rb as YC,rd as vi,s as cf,sa as Qy,sb as QC,t as lf,ta as Xy,tb as XC,u as df,ua as eC,ub as eS,v as uf,va as tC,vb as tS,w as pf,wa as rC,wb as rS,x as mf,xa as nC,xb as nS,y as vf,ya as iC,yb as iS,z as Of,za as oC,zb as oS}from"./chunk-ywjkyg8p.js";import{Ad as yi,sd as li,td as di,ud as ui,vd as pi,wd as mi,xd as fi,yd as gi,zd as hi}from"./chunk-zam6ecam.js";import{Id as Si}from"./chunk-dr4pj8hp.js";import{$d as Dr,Be as Mr,Fe as Fr,Jd as Vt,Ld as _t,Le as Vr,Md as Bt,Nd as Wt,Od as zt,Oe as _r,Pd as Ht,Pe as Br,Qd as Gt,Qe as Wr,Re as zr,Sd as Ut,Td as yr,Ud as Sr,Vd as Ar,Wd as br,We as Hr,Xd as Rr,Yd as Tr,Zd as $r,_d as Pr,ae as Er,be as wr,ce as vr,de as Or,ef as Gr,if as Kr,ke as Nr,nf as Ur,pe as kr,te as xr,xe as Lr}from"./chunk-q0rc1ax9.js";import{of as At,pf as Rt,qf as Tt}from"./chunk-kasdm9tx.js";import{sf as Me}from"./chunk-by2bwzk6.js";import{tf as hr}from"./chunk-73ztr55z.js";import{uf as Ir}from"./chunk-xcj8zfmg.js";import{Af as Qt,Bf as Xt,Cf as er,Df as tr,Ef as rr,Ff as nr,Gf as ir,Hf as or,If as ar,Jf as sr,Kf as cr,Lf as lr,Mf as dr,Nf as q,Of as ur,Pf as pr,Qf as mr,Rf as fr,Sf as gr,vf as Zt,wf as jt,xf as qt,yf as Jt,zf as Yt}from"./chunk-tz9myq9a.js";import{Tf as j}from"./chunk-y4xkj2f1.js";import{$f as Xr,$g as vn,Ah as Fn,Bh as Vn,Fh as _n,Gh as Bn,Hg as hn,Hh as Wn,Ig as yn,Ih as zn,Jh as Hn,Kg as Cn,Kh as Gn,Lg as Sn,Lh as Kn,Mg as An,Ng as bn,Nh as Un,Og as Rn,Oh as Zn,Ph as jn,Qh as qn,Rg as Tn,Sg as $n,Tg as Pn,Uf as Zr,Vf as jr,Wf as qr,Xf as Jr,Xg as In,Yf as ue,Yg as Dn,Zf as Yr,Zg as En,_f as Qr,_g as wn,ag as en,ah as On,bg as tn,ig as Ee,lg as rn,mg as nn,ng as on,og as an,oh as Nn,ph as kn,qg as sn,qh as xn,rg as cn,rh as Ln,vg as ln,wg as pe,zh as Mn}from"./chunk-aw0spg20.js";import{Vh as Kt,Wh as Cr}from"./chunk-aj025v2s.js";import{Xh as Le}from"./chunk-wavjkdb8.js";import{Zh as bt}from"./chunk-nk7sav4r.js";import{$h as St}from"./chunk-mz0dk78z.js";import{$i as yg,$j as Hh,Ai as Gf,Aj as hh,Ak as uy,Bi as Kf,Bj as yh,Bk as py,Ci as Uf,Cj as Ch,Ck as my,Di as Zf,Dj as Sh,Dk as fy,Ei as jf,Ej as Ah,Ek as gy,Fi as qf,Fj as bh,Fk as hy,Gi as Jf,Gj as Rh,Gk as yy,Hi as Yf,Hj as Th,Hk as Cy,Ii as Qf,Ij as $h,Ik as wt,Ji as Xf,Jj as Ph,Jk as Sy,Ki as eg,Kj as Ih,Kk as Ay,Li as tg,Lj as Dh,Lk as by,Mi as rg,Mj as Eh,Mk as Ry,Ni as ng,Nj as wh,Nk as Ty,Oi as ig,Oj as vh,Ok as $y,Pi as og,Pj as Oh,Pk as Py,Qi as ag,Qj as Nh,Qk as Iy,Ri as sg,Rj as kh,Rk as Dy,Si as cg,Sj as xh,Sk as Ey,Ti as lg,Tj as Lh,Tk as wy,Ui as dg,Uj as Mh,Uk as vy,Vi as ug,Vj as Fh,Vk as Oy,Wi as pg,Wj as Vh,Wk as Ny,Xi as mg,Xj as _h,Xk as ky,Yi as fg,Yj as Bh,Yk as xy,Zi as gg,Zj as Wh,Zk as Ly,_i as hg,_j as zh,aj as Cg,ak as Gh,bj as Kg,bk as Kh,ci as ff,cj as Ug,ck as Uh,di as gf,dj as Zg,dk as Zh,ei as hf,ej as jg,ek as jh,fi as yf,fj as qg,fk as qh,gi as Cf,gj as Jg,gk as Jh,hi as Sf,hj as Yg,hk as Yh,ii as Af,ij as Qg,ik as Qh,ji as bf,jj as Xg,jk as Xh,ki as Rf,kj as eh,kk as ey,li as Tf,lj as th,lk as ty,mi as $f,mj as rh,mk as ry,ni as Pf,nj as nh,nk as ny,oi as If,oj as ih,ok as iy,pi as Df,pj as oh,pk as oy,qi as Ef,qj as ah,qk as $t,ri as wf,rj as sh,rk as Pt,si as Mf,sj as ch,sk as It,ti as Ff,tj as lh,tk as Dt,ui as Vf,uj as dh,uk as Et,vi as _f,vj as uh,vk as ay,wi as Bf,wj as ph,wk as sy,xi as Wf,xj as mh,xk as cy,yi as zf,yj as fh,yk as ly,zi as Hf,zj as gh,zk as dy}from"./chunk-aw0cgv5w.js";import{$k as Yn,_k as Jn,al as Qn,bl as Xn,cl as ei,dl as ti,el as ri,gl as ni,hl as ii,il as oi,jl as ai,kl as si,ll as ci}from"./chunk-1qdne0bf.js";import{nl as dn,ol as un,pl as pn,ql as mn,rl as fn,sl as gn}from"./chunk-hn40z11p.js";import{Al as Ft,tl as vt,ul as Ot,vl as Nt,wl as kt,xl as xt,yl as Lt,zl as Mt}from"./chunk-x3hay61c.js";import{$l as Ha,$m as De,$n as $c,$o as $l,$p as $d,$q as $u,$r as $p,$s as fm,Am as ps,An as Ys,Ao as Yc,Ap as Yl,Aq as Yd,Ar as Yu,As as Yp,At as Wm,Bl as ya,Bm as ee,Bn as Qs,Bo as Qc,Bp as Ql,Bq as Qd,Br as Qu,Bs as Qp,Bt as zm,Cl as Ca,Cm as w,Cn as Xs,Co as Xc,Cp as Xl,Cq as Xd,Cr as Xu,Cs as Xp,Dl as Sa,Dm as Re,Dn as ec,Do as el,Dp as ed,Dq as eu,Dr as ep,Ds as em,El as Aa,Em as K,En as tc,Eo as tl,Ep as td,Eq as tu,Er as tp,Es as tm,Fl as ba,Fm as L,Fn as rc,Fo as rl,Fp as rd,Fq as ru,Fr as rp,Fs as rm,Gl as Ra,Gm as ms,Gn as nc,Go as nl,Gp as nd,Gq as nu,Gr as np,Gs as nm,Hl as Ta,Hm as fs,Hn as ic,Ho as il,Hp as id,Hq as iu,Hr as ip,Hs as im,Il as $a,Im as te,In as oc,Io as ol,Ip as od,Iq as ou,Ir as op,Is as om,Jl as Pa,Jm as gs,Jn as ac,Jo as al,Jp as ad,Jq as au,Jr as ap,Js as am,Kl as Ia,Km as hs,Kn as sc,Ko as sl,Kp as sd,Kq as su,Kr as sp,Ks as sm,Ll as Da,Lm as ys,Ln as cc,Lo as cl,Lp as cd,Lq as cu,Lr as cp,Ls as cm,Ml as Ea,Mm as Cs,Mn as lc,Mo as ll,Mp as ld,Mq as lu,Mr as lp,Ms as lm,Nl as wa,Nm as Te,Nn as dc,No as dl,Np as dd,Nq as du,Nr as dp,Ns as lt,Ol as va,Om as M,On as uc,Oo as ul,Op as ud,Oq as uu,Or as up,Os as dt,Pl as Oa,Pm as U,Pn as pc,Po as pl,Pp as pd,Pq as pu,Pr as pp,Ps as ut,Ql as Na,Qm as re,Qn as mc,Qo as ml,Qp as md,Qq as mu,Qr as mp,Qs as pt,Rl as ka,Rm as $e,Rn as fc,Ro as fl,Rp as fd,Rq as fu,Rr as fp,Rs as mt,Sl as xa,Sm as Pe,Sn as gc,So as gl,Sp as gd,Sq as gu,Sr as gp,Ss as ft,Tl as La,Tm as Ss,Tn as hc,To as hl,Tp as hd,Tq as hu,Tr as hp,Ts as gt,Ul as Ma,Um as As,Un as yc,Uo as yl,Up as yd,Uq as yu,Ur as yp,Us as ht,Vl as Fa,Vm as Ie,Vn as Cc,Vo as Cl,Vp as Cd,Vq as Cu,Vr as Cp,Vs as yt,Wl as Va,Wm as bs,Wn as Sc,Wo as Sl,Wp as Sd,Wq as Su,Wr as Sp,Ws as Ct,Xl as _a,Xm as Rs,Xn as Ac,Xo as Al,Xp as Ad,Xq as Au,Xr as Ap,Xs as dm,Yl as Ba,Ym as Ts,Yn as bc,Yo as bl,Yp as bd,Yq as bu,Yr as bp,Ys as um,Zl as Wa,Zm as $s,Zn as Rc,Zo as Rl,Zp as Rd,Zq as Ru,Zr as Rp,Zs as pm,_l as za,_m as Ps,_n as Tc,_o as Tl,_p as Td,_q as Tu,_r as Tp,_s as mm,am as Ga,an as Z,ao as Pc,ap as Pl,aq as Pd,ar as Pu,as as Pp,at as gm,bm as Ka,bn as Is,bo as Ic,bp as Il,bq as Id,br as Iu,bs as Ip,bt as hm,cm as Ua,cn as Ds,co as Dc,cp as Dl,cq as Dd,cr as Du,cs as Dp,ct as ym,dm as Za,dn as Es,do as Ec,dp as El,dq as Ed,dr as Eu,ds as Ep,dt as Cm,em as ja,en as ws,eo as wc,ep as wl,eq as wd,er as wu,es as wp,et as Sm,fm as Se,fn as vs,fo as vc,fp as vl,fq as vd,fr as vu,fs as vp,ft as Am,gm as qa,gn as Os,go as Oc,gp as Ol,gq as Od,gr as Ou,gs as Op,gt as bm,hm as Ae,hn as Ns,ho as Nc,hp as Nl,hq as Nd,hr as Nu,hs as Np,ht as Rm,im as be,in as ks,io as kc,ip as kl,iq as kd,ir as ku,is as kp,it as Tm,jm as Ja,jn as xs,jo as xc,jp as xl,jq as xd,jr as xu,js as xp,jt as $m,km as Ya,kn as Ls,ko as Lc,kp as Ll,kq as Ld,kr as Lu,ks as Lp,kt as Pm,lm as Qa,ln as Ms,lo as Mc,lp as Ml,lq as Md,lr as Mu,ls as Mp,lt as Im,mm as Xa,mn as Fs,mo as Fc,mp as Fl,mq as Fd,mr as Fu,ms as Fp,mt as Dm,nm as es,nn as Vs,no as Vc,np as Vl,nq as Vd,nr as Vu,ns as Vp,nt as Em,om as ts,on as _s,oo as _c,op as _l,oq as _d,or as _u,os as _p,ot as wm,pm as rs,pn as Bs,po as Bc,pp as Bl,pq as Bd,pr as Bu,ps as Bp,pt as vm,qm as ns,qn as Ws,qo as Wc,qp as Wl,qq as Wd,qr as Wu,qs as Wp,qt as Om,rm as is,rn as zs,ro as zc,rp as zl,rq as zd,rr as zu,rs as zp,rt as Nm,sm as os,sn as Hs,so as Hc,sp as Hl,sq as Hd,sr as Hu,ss as Hp,st as km,tm as as,tn as Gs,to as Gc,tp as Gl,tq as Gd,tr as Gu,ts as Gp,tt as xm,um as ss,un as Ks,uo as Kc,up as Kl,uq as Kd,ur as Ku,us as Kp,ut as Lm,vm as cs,vn as Us,vo as Uc,vp as Ul,vq as Ud,vr as Uu,vs as Up,vt as Mm,wm as ls,wn as Zs,wo as Zc,wp as Zl,wq as Zd,wr as Zu,ws as Zp,wt as Fm,xm as X,xn as js,xo as jc,xp as jl,xq as jd,xr as ju,xs as jp,xt as Vm,ym as ds,yn as qs,yo as qc,yp as ql,yq as qd,yr as qu,ys as qp,yt as _m,zm as us,zn as Js,zo as Jc,zp as Jl,zq as Jd,zr as Ju,zs as Jp,zt as Bm}from"./chunk-zz52xje8.js";import{Ct as Je}from"./chunk-z2qqwy7e.js";import{createHmac as fe,createSign as _e,timingSafeEqual as Be}from"node:crypto";function B(e){let t=e instanceof Date?e.getTime():e;if(!Number.isFinite(t))throw TypeError("Media access timestamp must be finite");return Math.floor(t/1000)}function ge(e){return Buffer.from(e).toString("base64").replaceAll("+","-").replaceAll("=","_").replaceAll("/","~")}function We(e){return Buffer.from(e).toString("base64url")}function he(e,t=!1){if(!e||/[\r\n]/.test(e))throw TypeError("Media resource is invalid");let r=t?e.replaceAll("*","wildcard"):e,n=new URL(r);if(!["http:","https:"].includes(n.protocol))throw TypeError("Media resource must use HTTP or HTTPS");if(!t&&e.includes("*"))throw TypeError("Canned policies cannot contain wildcards")}function ye(e,t){let r=_e("RSA-SHA1");return r.update(e),r.end(),ge(r.sign(t))}function Ce(e){he(e.resource,!0);let r={DateLessThan:{"AWS:EpochTime":B(e.expiresAt)}};if(e.activeAt!==void 0)r.DateGreaterThan={"AWS:EpochTime":B(e.activeAt)};if(e.ipAddress)r.IpAddress={"AWS:SourceIp":e.ipAddress};return JSON.stringify({Statement:[{Resource:e.resource,Condition:r}]})}function Ni(e,t,r){he(e);let n=B(t),o=e.includes("?")?"&":"?",l=Ce({resource:e,expiresAt:t}),c=ye(l,r.privateKey);return`${e}${o}Expires=${n}&Signature=${encodeURIComponent(c)}&Key-Pair-Id=${encodeURIComponent(r.keyPairId)}`}function ki(e,t){let r=Ce(e);return{"CloudFront-Key-Pair-Id":t.keyPairId,"CloudFront-Policy":ge(Buffer.from(r)),"CloudFront-Signature":ye(r,t.privateKey)}}function xi(e){if(!e.resource||/[\r\n]/.test(e.resource))throw TypeError("Media resource is invalid");let t=We(Buffer.from(JSON.stringify({resource:e.resource,expiresAt:B(e.expiresAt),...e.keyId?{keyId:e.keyId}:{},...e.audience?{audience:e.audience}:{}}))),r=fe("sha256",e.secret).update(t).digest("base64url");return`${t}.${r}`}function Li(e,t){let[r,n,o]=e.split(".");if(!r||!n||o)return null;let l=fe("sha256",t.secret).update(r).digest(),c;try{c=Buffer.from(n,"base64url")}catch{return null}if(l.length!==c.length||!Be(l,c))return null;try{let s=JSON.parse(Buffer.from(r,"base64url").toString("utf8")),d=B(t.now??Date.now());if(!s.resource||!Number.isSafeInteger(s.expiresAt)||s.expiresAt<=d)return null;if(t.resource&&s.resource!==t.resource)return null;if(t.audience&&s.audience!==t.audience)return null;return s}catch{return null}}function Mi(e,t=!1){let r=new URL(e,"https://media.invalid").pathname.toLowerCase(),n=/\.(?:m3u8|mpd|vtt|json)$/.test(r),o=/\.(?:key|license)$/.test(r)||r.includes("/keys/")||r.includes("/licenses/");return{"Accept-Ranges":"bytes","Cache-Control":t&&(n||o)?"private, no-store":n?"public, max-age=5, s-maxage=30, stale-while-revalidate=30":"public, max-age=31536000, immutable","Cross-Origin-Resource-Policy":"cross-origin","X-Content-Type-Options":"nosniff"}}function Fi(e){if(!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(e.bucket))throw TypeError("Media bucket is invalid");if(!/^[a-z0-9-]+$/.test(e.region))throw TypeError("Media bucket region is invalid");let t=e.prefix?`/${e.prefix.replace(/^\/+|\/+$/g,"")}`:"",r=e.protected??!1,n="public, max-age=31536000, immutable",o=r?"private, no-store":"public, max-age=5, s-maxage=30, stale-while-revalidate=30";return{originDomain:`${e.bucket}.s3.${e.region}.amazonaws.com`,originPath:t,domain:e.domain,trustedKeyGroupIds:[...new Set(e.trustedKeyGroupIds??[])],behaviors:[{pathPattern:"*.m3u8",cacheControl:o,compress:!0,signed:r},{pathPattern:"*.mpd",cacheControl:o,compress:!0,signed:r},{pathPattern:"*.vtt",cacheControl:o,compress:!0,signed:r},{pathPattern:"*",cacheControl:n,compress:!1,signed:r}],responseHeaders:{"Access-Control-Allow-Headers":"Range, If-Range","Access-Control-Allow-Methods":"GET, HEAD, OPTIONS","Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":"Accept-Ranges, Content-Length, Content-Range, ETag","X-Content-Type-Options":"nosniff"}}}class ze{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;constructor(e){this.config=e.config,this.environment=e.environment,this.builder=new Se(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let t=this.config.environments[this.environment]?.infrastructure;if(!t)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...t,compute:{...this.config.infrastructure?.compute,...t.compute},storage:{...this.config.infrastructure?.storage,...t.storage},functions:{...this.config.infrastructure?.functions,...t.functions},servers:{...this.config.infrastructure?.servers,...t.servers},databases:{...this.config.infrastructure?.databases,...t.databases},cdn:{...this.config.infrastructure?.cdn,...t.cdn},sftp:t.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...t.queues},redirects:{...this.config.infrastructure?.redirects,...t.redirects},realtime:{...this.config.infrastructure?.realtime,...t.realtime},cache:{...this.config.infrastructure?.cache,...t.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...t.fileSystem},email:{...this.config.infrastructure?.email,...t.email},search:{...this.config.infrastructure?.search,...t.search},ai:{...this.config.infrastructure?.ai,...t.ai}}}}shouldDeploy(e){if(e.environments&&!e.environments.includes(this.environment))return!1;if(e.requiresFeatures){let t=this.config.features||{};if(!e.requiresFeatures.every((n)=>t[n]===!0))return!1}if(e.regions){let t=this.config.environments[this.environment]?.region||this.config.project.region;if(!e.regions.includes(t))return!1}if(e.condition&&typeof e.condition==="function")return e.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let e=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,t=Number(e||3008);return Number.isFinite(t)&&t>0?t:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(e,t){return e==="public"||t.routeCompute===!0}storageBucketName(e,t,r){return this.mergedConfig.infrastructure?.storage?.[r]?.bucket??`${e}-${t}-${r}`}fileSystemLogicalId(e,t,r){return be(Ae({slug:`${e}-${r}`,environment:t,resourceType:"efs"}))}resolveSftpStorage(e,t,r){let n=e.storage;if(n?.type==="efs"&&n.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[n.fileSystem])throw Error(`sftp: storage.fileSystem "${n.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(t,r,n.fileSystem)},posixProfile:n.posixProfile}}if(n?.type==="s3"&&n.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[n.storageBucket])throw Error(`sftp: storage.storageBucket "${n.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(t,r,n.storageBucket)}}return}resolveComputeCachePathPatterns(e){if(e&&e.length>0)return e;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(e,t){return{PathPattern:e,TargetOriginId:t,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(e,t,r,n,o,l){let c=this.serverEipLogicalIds.get("app"),s=this.serverEipLogicalIds.get("appInstance");if(!c)return;let d=`EC2-${n}-${o}-api`,h=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",u=h==="us-east-1"?".compute-1.amazonaws.com":`.${h}.compute.amazonaws.com`,b={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:c}]}]},u]]},A=this.resolveApiOriginPort();if(e.push({Id:d,DomainName:b,CustomOriginConfig:{HTTPPort:A,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),r.push(c),s)r.push(s);for(let T of l)t.push(this.createComputeCacheBehavior(T,d))}buildCaddyfile(e){let t=e.filter(([,o])=>typeof o.domain==="string"&&o.domain&&typeof o.port==="number");if(t.length===0)return;let r=new Map;for(let[,o]of t){let l=r.get(o.domain)??[];l.push({port:o.port,path:o.path}),r.set(o.domain,l)}let n=[];for(let[o,l]of r){let s=[...l].sort((d,h)=>{let u=!d.path||d.path==="/",b=!h.path||h.path==="/";if(u&&!b)return 1;if(!u&&b)return-1;return(h.path?.length??0)-(d.path?.length??0)}).map((d)=>{let h=!d.path||d.path==="/",u=`reverse_proxy localhost:${d.port}`;return h?`  handle {
     ${u}
   }`:`  handle ${d.path} {
     ${u}
@@ -219,7 +219,7 @@ ${t.loadManagement?.enabled?`
   },
 `:""}
 } satisfies BroadcastConfig
-`}toYAML(){return this.builder.toYAML()}toJSON(){return this.builder.toJSON()}getBuilder(){return this.builder}}function He(e){let t=[],r=[];if(!e.AWSTemplateFormatVersion)t.push({path:"AWSTemplateFormatVersion",message:"AWSTemplateFormatVersion is required",severity:"error"});else if(e.AWSTemplateFormatVersion!=="2010-09-09")r.push({path:"AWSTemplateFormatVersion",message:'AWSTemplateFormatVersion should be "2010-09-09"',severity:"warning"});if(!e.Resources||Object.keys(e.Resources).length===0)t.push({path:"Resources",message:"At least one resource is required",severity:"error"});else for(let[n,o]of Object.entries(e.Resources))Ge(n,o,t,r);if(e.Resources){let n=Ze(e.Resources);if(n.length>0)t.push({path:"Resources",message:`Circular dependencies detected: ${n.join(" -> ")}`,severity:"error"})}if(e.Parameters)for(let[n,o]of Object.entries(e.Parameters))Ke(n,o,t,r);if(e.Outputs)for(let[n,o]of Object.entries(e.Outputs))Ue(n,o,t,r);return{valid:t.length===0,errors:t,warnings:r}}function Ge(e,t,r,n){if(!t.Type)r.push({path:`Resources.${e}.Type`,message:"Resource Type is required",severity:"error"});if(!/^[a-zA-Z0-9]+$/.test(e))n.push({path:`Resources.${e}`,message:"Logical ID should only contain alphanumeric characters",severity:"warning"});if(t.Type&&!t.Type.startsWith("AWS::")&&!t.Type.startsWith("Custom::"))r.push({path:`Resources.${e}.Type`,message:'Resource Type must start with "AWS::" or "Custom::"',severity:"error"});if(t.Properties){for(let[o,l]of Object.entries(t.Properties))if(l===void 0||l===null)n.push({path:`Resources.${e}.Properties.${o}`,message:"Property has undefined or null value",severity:"warning"})}if(t.DependsOn){if(typeof t.DependsOn==="string"){if(t.DependsOn===e)r.push({path:`Resources.${e}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}else if(Array.isArray(t.DependsOn)){if(t.DependsOn.includes(e))r.push({path:`Resources.${e}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}}}function Ke(e,t,r,n){if(!t.Type)r.push({path:`Parameters.${e}.Type`,message:"Parameter Type is required",severity:"error"});let o=["String","Number","List<Number>","CommaDelimitedList","AWS::SSM::Parameter::Value<String>"];if(t.Type&&!o.includes(t.Type)&&!t.Type.startsWith("AWS::"))n.push({path:`Parameters.${e}.Type`,message:`Uncommon parameter type: ${t.Type}`,severity:"warning"});if(t.NoEcho&&t.Default)n.push({path:`Parameters.${e}`,message:"NoEcho parameters should not have default values",severity:"warning"})}function Ue(e,t,r,n){if(!t.Value)r.push({path:`Outputs.${e}.Value`,message:"Output Value is required",severity:"error"})}function Ze(e){let t={};for(let[c,s]of Object.entries(e)){if(t[c]=[],s.DependsOn){if(typeof s.DependsOn==="string")t[c].push(s.DependsOn);else if(Array.isArray(s.DependsOn))t[c].push(...s.DependsOn)}let d=ne(s);t[c].push(...d)}let r=new Set,n=new Set,o=[];function l(c,s){r.add(c),n.add(c),s.push(c);let d=t[c]||[];for(let h of d)if(!r.has(h)){if(l(h,s))return!0}else if(n.has(h)){let u=s.indexOf(h);return o.push(...s.slice(u),h),!0}return s.pop(),n.delete(c),!1}for(let c of Object.keys(t))if(!r.has(c)){if(l(c,[]))return o}return[]}function ne(e,t=[]){if(typeof e!=="object"||e===null)return t;if(Array.isArray(e)){for(let r of e)ne(r,t);return t}if(e.Ref&&typeof e.Ref==="string"&&!e.Ref.startsWith("AWS::"))t.push(e.Ref);if(e["Fn::GetAtt"]){let r=e["Fn::GetAtt"];if(Array.isArray(r)&&r.length>0)t.push(r[0])}for(let r of Object.values(e))ne(r,t);return t}function je(e){let t=[],r=[],n=new TextEncoder().encode(e).length,o=51200,l=460800;if(n>51200)if(n>460800)t.push({path:"template",message:`Template size (${n} bytes) exceeds maximum allowed size of 460800 bytes`,severity:"error"});else r.push({path:"template",message:`Template size (${n} bytes) exceeds direct upload limit (51200 bytes). You must upload to S3 first.`,severity:"warning"});return{valid:t.length===0,errors:t,warnings:r}}function qe(e){let t=[],r=[],n=e.Resources?Object.keys(e.Resources).length:0,o=e.Parameters?Object.keys(e.Parameters).length:0,l=e.Outputs?Object.keys(e.Outputs).length:0;if(n>500)t.push({path:"Resources",message:`Template has ${n} resources, exceeding the limit of 500`,severity:"error"});else if(n>200)r.push({path:"Resources",message:`Template has ${n} resources. Consider using nested stacks for better organization.`,severity:"warning"});if(o>200)t.push({path:"Parameters",message:`Template has ${o} parameters, exceeding the limit of 200`,severity:"error"});if(l>200)t.push({path:"Outputs",message:`Template has ${l} outputs, exceeding the limit of 200`,severity:"error"});return{valid:t.length===0,errors:t,warnings:r}}function ji(e){let{domains:t,email:r,staging:n=!1,challengeType:o="http-01",certPath:l="/etc/letsencrypt/live",autoRenew:c=!0}=e,s=t[0],d=t.map((u)=>`-d ${u}`).join(" "),h=n?"--staging":"";if(o==="http-01")return Ye({domains:t,email:r,staging:n,certPath:l,autoRenew:c,domainFlags:d,stagingFlag:h,primaryDomain:s});else{let u=e.dnsProvider?.provider||(e.hostedZoneId?"route53":void 0);return Qe({domains:t,email:r,staging:n,certPath:l,autoRenew:c,domainFlags:d,stagingFlag:h,primaryDomain:s,hostedZoneId:e.hostedZoneId,dnsProvider:e.dnsProvider,dnsProviderType:u})}}function Ye(e){let{email:t,certPath:r,autoRenew:n,domainFlags:o,stagingFlag:l,primaryDomain:c}=e;return`
+`}toYAML(){return this.builder.toYAML()}toJSON(){return this.builder.toJSON()}getBuilder(){return this.builder}}function He(e){let t=[],r=[];if(!e.AWSTemplateFormatVersion)t.push({path:"AWSTemplateFormatVersion",message:"AWSTemplateFormatVersion is required",severity:"error"});else if(e.AWSTemplateFormatVersion!=="2010-09-09")r.push({path:"AWSTemplateFormatVersion",message:'AWSTemplateFormatVersion should be "2010-09-09"',severity:"warning"});if(!e.Resources||Object.keys(e.Resources).length===0)t.push({path:"Resources",message:"At least one resource is required",severity:"error"});else for(let[n,o]of Object.entries(e.Resources))Ge(n,o,t,r);if(e.Resources){let n=Ze(e.Resources);if(n.length>0)t.push({path:"Resources",message:`Circular dependencies detected: ${n.join(" -> ")}`,severity:"error"})}if(e.Parameters)for(let[n,o]of Object.entries(e.Parameters))Ke(n,o,t,r);if(e.Outputs)for(let[n,o]of Object.entries(e.Outputs))Ue(n,o,t,r);return{valid:t.length===0,errors:t,warnings:r}}function Ge(e,t,r,n){if(!t.Type)r.push({path:`Resources.${e}.Type`,message:"Resource Type is required",severity:"error"});if(!/^[a-zA-Z0-9]+$/.test(e))n.push({path:`Resources.${e}`,message:"Logical ID should only contain alphanumeric characters",severity:"warning"});if(t.Type&&!t.Type.startsWith("AWS::")&&!t.Type.startsWith("Custom::"))r.push({path:`Resources.${e}.Type`,message:'Resource Type must start with "AWS::" or "Custom::"',severity:"error"});if(t.Properties){for(let[o,l]of Object.entries(t.Properties))if(l===void 0||l===null)n.push({path:`Resources.${e}.Properties.${o}`,message:"Property has undefined or null value",severity:"warning"})}if(t.DependsOn){if(typeof t.DependsOn==="string"){if(t.DependsOn===e)r.push({path:`Resources.${e}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}else if(Array.isArray(t.DependsOn)){if(t.DependsOn.includes(e))r.push({path:`Resources.${e}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}}}function Ke(e,t,r,n){if(!t.Type)r.push({path:`Parameters.${e}.Type`,message:"Parameter Type is required",severity:"error"});let o=["String","Number","List<Number>","CommaDelimitedList","AWS::SSM::Parameter::Value<String>"];if(t.Type&&!o.includes(t.Type)&&!t.Type.startsWith("AWS::"))n.push({path:`Parameters.${e}.Type`,message:`Uncommon parameter type: ${t.Type}`,severity:"warning"});if(t.NoEcho&&t.Default)n.push({path:`Parameters.${e}`,message:"NoEcho parameters should not have default values",severity:"warning"})}function Ue(e,t,r,n){if(!t.Value)r.push({path:`Outputs.${e}.Value`,message:"Output Value is required",severity:"error"})}function Ze(e){let t={};for(let[c,s]of Object.entries(e)){if(t[c]=[],s.DependsOn){if(typeof s.DependsOn==="string")t[c].push(s.DependsOn);else if(Array.isArray(s.DependsOn))t[c].push(...s.DependsOn)}let d=ne(s);t[c].push(...d)}let r=new Set,n=new Set,o=[];function l(c,s){r.add(c),n.add(c),s.push(c);let d=t[c]||[];for(let h of d)if(!r.has(h)){if(l(h,s))return!0}else if(n.has(h)){let u=s.indexOf(h);return o.push(...s.slice(u),h),!0}return s.pop(),n.delete(c),!1}for(let c of Object.keys(t))if(!r.has(c)){if(l(c,[]))return o}return[]}function ne(e,t=[]){if(typeof e!=="object"||e===null)return t;if(Array.isArray(e)){for(let r of e)ne(r,t);return t}if(e.Ref&&typeof e.Ref==="string"&&!e.Ref.startsWith("AWS::"))t.push(e.Ref);if(e["Fn::GetAtt"]){let r=e["Fn::GetAtt"];if(Array.isArray(r)&&r.length>0)t.push(r[0])}for(let r of Object.values(e))ne(r,t);return t}function je(e){let t=[],r=[],n=new TextEncoder().encode(e).length,o=51200,l=460800;if(n>51200)if(n>460800)t.push({path:"template",message:`Template size (${n} bytes) exceeds maximum allowed size of 460800 bytes`,severity:"error"});else r.push({path:"template",message:`Template size (${n} bytes) exceeds direct upload limit (51200 bytes). You must upload to S3 first.`,severity:"warning"});return{valid:t.length===0,errors:t,warnings:r}}function qe(e){let t=[],r=[],n=e.Resources?Object.keys(e.Resources).length:0,o=e.Parameters?Object.keys(e.Parameters).length:0,l=e.Outputs?Object.keys(e.Outputs).length:0;if(n>500)t.push({path:"Resources",message:`Template has ${n} resources, exceeding the limit of 500`,severity:"error"});else if(n>200)r.push({path:"Resources",message:`Template has ${n} resources. Consider using nested stacks for better organization.`,severity:"warning"});if(o>200)t.push({path:"Parameters",message:`Template has ${o} parameters, exceeding the limit of 200`,severity:"error"});if(l>200)t.push({path:"Outputs",message:`Template has ${l} outputs, exceeding the limit of 200`,severity:"error"});return{valid:t.length===0,errors:t,warnings:r}}function Yi(e){let{domains:t,email:r,staging:n=!1,challengeType:o="http-01",certPath:l="/etc/letsencrypt/live",autoRenew:c=!0}=e,s=t[0],d=t.map((u)=>`-d ${u}`).join(" "),h=n?"--staging":"";if(o==="http-01")return Ye({domains:t,email:r,staging:n,certPath:l,autoRenew:c,domainFlags:d,stagingFlag:h,primaryDomain:s});else{let u=e.dnsProvider?.provider||(e.hostedZoneId?"route53":void 0);return Qe({domains:t,email:r,staging:n,certPath:l,autoRenew:c,domainFlags:d,stagingFlag:h,primaryDomain:s,hostedZoneId:e.hostedZoneId,dnsProvider:e.dnsProvider,dnsProviderType:u})}}function Ye(e){let{email:t,certPath:r,autoRenew:n,domainFlags:o,stagingFlag:l,primaryDomain:c}=e;return`
 # ==========================================
 # Let's Encrypt Certificate Setup (HTTP-01)
 # ==========================================
@@ -506,7 +506,7 @@ systemctl enable certbot-renewal.timer
 systemctl start certbot-renewal.timer
 
 echo "Certificate auto-renewal configured"
-`}function qi(e){let{httpPort:t=80,httpsPort:r=443,certPath:n="/etc/ssl/stacks",redirectHttp:o=!0}=e;return`
+`}function Qi(e){let{httpPort:t=80,httpsPort:r=443,certPath:n="/etc/ssl/stacks",redirectHttp:o=!0}=e;return`
 // HTTPS Server with Let's Encrypt certificates
 import { readFileSync, existsSync } from 'node:fs'
 
@@ -592,5 +592,5 @@ async function handleRequest(request: Request): Promise<Response> {
   // Implement your request handling here
   return new Response('Hello from Stacks!')
 }
-`}async function Ji(e){let{domain:t,challengeValue:r,hostedZoneId:n,dnsProvider:o,region:l="us-east-1"}=e;if(o){let s=await q(o).upsertRecord(t,{name:`_acme-challenge.${t}`,type:"TXT",content:r,ttl:60});if(!s.success)throw Error(`Failed to create DNS challenge record: ${s.message}`);return}if(n){await new j(l).changeResourceRecordSets({HostedZoneId:n,ChangeBatch:{Comment:"ACME DNS-01 challenge",Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:`_acme-challenge.${t}`,Type:"TXT",TTL:60,ResourceRecords:[{Value:`"${r}"`}]}}]}});return}throw Error("Either dnsProvider or hostedZoneId must be provided")}async function Yi(e){let{domain:t,challengeValue:r,hostedZoneId:n,dnsProvider:o,region:l="us-east-1"}=e;if(o){let s=await q(o).deleteRecord(t,{name:`_acme-challenge.${t}`,type:"TXT",content:r});if(!s.success)console.warn(`Failed to delete DNS challenge record: ${s.message}`);return}if(n){await new j(l).changeResourceRecordSets({HostedZoneId:n,ChangeBatch:{Comment:"Remove ACME DNS-01 challenge",Changes:[{Action:"DELETE",ResourceRecordSet:{Name:`_acme-challenge.${t}`,Type:"TXT",TTL:60,ResourceRecords:[{Value:`"${r}"`}]}}]}});return}throw Error("Either dnsProvider or hostedZoneId must be provided")}function Qi(e){try{let{execSync:t}=Je("node:child_process"),r=t(`openssl x509 -checkend 2592000 -noout -in ${e}/cert.pem`,{encoding:"utf-8",stdio:["pipe","pipe","pipe"]});return!1}catch{return!0}}import{createHash as we,createSign as rt,generateKeyPairSync as ve}from"node:crypto";var Oe={production:"https://acme-v02.api.letsencrypt.org/directory",staging:"https://acme-staging-v02.api.letsencrypt.org/directory"};class nt{directoryUrl;email;accountKey;accountUrl=null;directory=null;nonce=null;constructor(e){this.directoryUrl=e.staging?Oe.staging:Oe.production,this.email=e.email,this.accountKey=e.accountKey||this.generateAccountKey()}generateAccountKey(){let{privateKey:e}=ve("ec",{namedCurve:"P-256"});return e.export({type:"pkcs8",format:"pem"})}async getDirectory(){if(this.directory)return this.directory;let e=await fetch(this.directoryUrl);if(!e.ok)throw Error(`Failed to fetch ACME directory: ${e.status}`);return this.directory=await e.json(),this.directory}async getNonce(){if(this.nonce){let n=this.nonce;return this.nonce=null,n}let e=await this.getDirectory(),r=(await fetch(e.newNonce,{method:"HEAD"})).headers.get("replay-nonce");if(!r)throw Error("Failed to get nonce from ACME server");return r}getJwk(){let e=this.accountKey.split(`
-`).filter((l)=>!l.startsWith("-----")).join(""),t=Buffer.from(e,"base64"),r=t.length-65,n=t.subarray(r+1,r+33),o=t.subarray(r+33,r+65);return{kty:"EC",crv:"P-256",x:this.base64UrlEncode(n),y:this.base64UrlEncode(o)}}getJwkThumbprint(){let e=this.getJwk(),t=JSON.stringify({crv:e.crv,kty:e.kty,x:e.x,y:e.y}),r=we("sha256").update(t).digest();return this.base64UrlEncode(r)}base64UrlEncode(e){return(typeof e==="string"?Buffer.from(e):e).toString("base64").replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async signPayload(e,t){let r=await this.getNonce(),n=this.getJwk(),o={alg:"ES256",nonce:r,url:e};if(this.accountUrl)o.kid=this.accountUrl;else o.jwk=n;let l=this.base64UrlEncode(JSON.stringify(o)),c=t===""?"":this.base64UrlEncode(JSON.stringify(t)),s=`${l}.${c}`,d=rt("SHA256");d.update(s);let h=d.sign(this.accountKey),u=h.subarray(4,4+h[3]),b=4+h[3]+2,A=h.subarray(b,b+h[b-1]),T=Buffer.alloc(32),g=Buffer.alloc(32);u.copy(T,32-u.length),A.copy(g,32-A.length);let m=Buffer.concat([T,g]);return JSON.stringify({protected:l,payload:c,signature:this.base64UrlEncode(m)})}async acmeRequest(e,t){let r=await this.signPayload(e,t),n=await fetch(e,{method:"POST",headers:{"Content-Type":"application/jose+json"},body:r}),o=n.headers.get("replay-nonce");if(o)this.nonce=o;let l,c=n.headers.get("content-type");if(c?.includes("application/json")||c?.includes("application/problem+json"))l=await n.json();else l=await n.text();if(!n.ok)throw Error(`ACME request failed: ${JSON.stringify(l)}`);return{body:l,headers:n.headers}}async registerAccount(){let e=await this.getDirectory(),{body:t,headers:r}=await this.acmeRequest(e.newAccount,{termsOfServiceAgreed:!0,contact:[`mailto:${this.email}`]}),n=r.get("location");if(!n)throw Error("No account URL returned");return this.accountUrl=n,n}async createOrder(e){if(!this.accountUrl)await this.registerAccount();let t=await this.getDirectory(),{body:r,headers:n}=await this.acmeRequest(t.newOrder,{identifiers:e.map((l)=>({type:"dns",value:l}))}),o=n.get("location");if(!o)throw Error("No order URL returned");return{orderUrl:o,authorizations:r.authorizations,finalize:r.finalize}}async getAuthorization(e){let{body:t}=await this.acmeRequest(e,""),r=t.identifier.value,n=this.getJwkThumbprint(),o=t.challenges.filter((l)=>l.type==="http-01"||l.type==="dns-01").map((l)=>{let c=`${l.token}.${n}`;if(l.type==="http-01")return{type:"http-01",token:l.token,keyAuthorization:c,identifier:`/.well-known/acme-challenge/${l.token}`};else{let s=this.base64UrlEncode(we("sha256").update(c).digest());return{type:"dns-01",token:l.token,keyAuthorization:c,identifier:`_acme-challenge.${r}`,dnsValue:s}}});return{domain:r,challenges:o}}async respondToChallenge(e){await this.acmeRequest(e,{})}async waitForAuthorization(e,t=30){for(let r=0;r<t;r++){let{body:n}=await this.acmeRequest(e,"");if(n.status==="valid")return;if(n.status==="invalid")throw Error(`Authorization failed: ${JSON.stringify(n)}`);await new Promise((o)=>setTimeout(o,2000))}throw Error("Authorization timed out")}generateCsr(e){let{privateKey:t}=ve("rsa",{modulusLength:2048}),r=t.export({type:"pkcs8",format:"pem"});return{csr:this.createSimpleCsr(e,t),privateKey:r}}createSimpleCsr(e,t){throw Error("CSR generation requires additional implementation. Consider using the shell-based certbot approach instead.")}async finalizeOrder(e,t){let{csr:r,privateKey:n}=this.generateCsr(t),{body:o}=await this.acmeRequest(e,{csr:this.base64UrlEncode(Buffer.from(r,"base64"))}),l=o.certificate;if(!l)throw Error("Certificate not immediately available - polling not implemented");let s=await(await fetch(l)).text(),d=s.split(/(?=-----BEGIN CERTIFICATE-----)/g),h=d[0],u=d.slice(1).join("");return{certificate:h,privateKey:n,chain:u,fullchain:s,expiresAt:new Date(Date.now()+7776000000)}}getAccountKey(){return this.accountKey}}var Ne=["js","mjs","cjs","css","map","woff","woff2","ttf","otf","eot","png","jpg","jpeg","gif","webp","avif","svg","ico","mp4","webm","ogg","mp3","wav","pdf","wasm"];function oe(e){return`"${e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`}function ke(e){return`{${e.map(oe).join(" ")}}`}function ae(e){if(e.length===1)return`http.host eq ${oe(e[0])}`;return`http.host in ${ke(e)}`}function se(e,t={}){if(t.enabled===!1||e.length===0)return[];let r=ae(e),n=[],o=t.bypassPaths??[],l=o.length>0?`(${o.map((h)=>`starts_with(http.request.uri.path, ${oe(h)})`).join(" or ")})`:void 0;if(l)n.push({action:"set_cache_settings",description:"bypass cache",expression:`(${r} and ${l})`,enabled:!0,action_parameters:{cache:!1}});let c=l?`${r} and not ${l}`:r,s=t.assetExtensions??Ne,d=s.length>0?`lower(http.request.uri.path.extension) in ${ke([...s])}`:void 0;if(d)n.push({action:"set_cache_settings",description:"cache fingerprinted assets",expression:`(${c} and ${d})`,enabled:!0,action_parameters:{cache:!0,edge_ttl:{mode:"override_origin",default:t.assetEdgeTtl??2592000},browser_ttl:{mode:"override_origin",default:t.assetBrowserTtl??31536000}}});return n.push({action:"set_cache_settings",description:"cache documents",expression:d?`(${c} and not ${d})`:`(${c})`,enabled:!0,action_parameters:{cache:!0,edge_ttl:{mode:"override_origin",default:t.documentEdgeTtl??3600},browser_ttl:{mode:"override_origin",default:t.documentBrowserTtl??0}}}),n}function ce(e,t,r){if(e.length===0||!t||!r)return[];return[{action:"rewrite",description:"origin guard header",expression:`(${ae(e)})`,enabled:!0,action_parameters:{headers:{[t]:{operation:"set",value:r}}}}]}var N=(e)=>e===void 0?void 0:e?"on":"off";function le(e){let t={ssl:e.ssl,always_use_https:N(e.alwaysUseHttps),automatic_https_rewrites:N(e.automaticHttpsRewrites),min_tls_version:e.minTlsVersion,tls_1_3:N(e.tls13),brotli:N(e.brotli),http3:N(e.http3),"0rtt":N(e.zeroRtt),early_hints:N(e.earlyHints),browser_cache_ttl:e.browserCacheTtl,always_online:N(e.alwaysOnline),websockets:N(e.websockets),email_obfuscation:N(e.emailObfuscation)};if(e.hsts)t.security_header={strict_transport_security:{enabled:e.hsts.enabled,max_age:e.hsts.maxAge??31536000,include_subdomains:e.hsts.includeSubdomains??!1,preload:e.hsts.preload??!1,nosniff:e.hsts.noSniff??!0}};for(let r of Object.keys(t))if(t[r]===void 0)delete t[r];return{...t,...e.raw??{}}}var W={ssl:"strict",alwaysUseHttps:!0,automaticHttpsRewrites:!0,minTlsVersion:"1.2",tls13:!0,brotli:!0,http3:!0,earlyHints:!0,alwaysOnline:!0,emailObfuscation:!1,browserCacheTtl:0};import{connect as it}from"node:tls";async function de(e){let{address:t,serverName:r,port:n=443,timeoutMs:o=5000}=e;return new Promise((l)=>{let c=!1,s=(h)=>{if(c)return;c=!0;try{d.destroy()}catch{}l(h)},d=it({host:t,port:n,servername:r,rejectUnauthorized:!1,timeout:o});d.once("secureConnect",()=>{if(d.authorized){s({reachable:!0,trusted:!0});return}s({reachable:!0,trusted:!1,reason:d.authorizationError?String(d.authorizationError):"origin certificate is not trusted for this hostname"})}),d.once("timeout",()=>{s({reachable:!1,trusted:!1,reason:`no TLS handshake within ${o}ms`})}),d.once("error",(h)=>{s({reachable:!1,trusted:!1,reason:h.message})})})}function ot(e,t){let r=t.replace(/\.$/,"").toLowerCase();return e.some((n)=>{let o=n.replace(/\.$/,"").toLowerCase();if(o===r)return!0;if(!o.startsWith("*."))return!1;let l=o.slice(2);if(!r.endsWith(`.${l}`))return!1;return!r.slice(0,r.length-l.length-1).includes(".")})}async function at(e){let{provider:t,zone:r,hosts:n,ipv4:o,ipv6:l,proxied:c=!0,settings:s=W,cache:d,originGuard:h,purge:u=!0,ttl:b=300,skipOriginProbe:A=!1,skipEdgeCertificateCheck:T=!1}=e,g={records:[],settingsChanged:[],cacheRules:0,originGuard:!1,purged:!1,deferredProxy:[],warnings:[]};if(n.length===0)return g;let m=[],a=c&&!T?await t.listEdgeCertificateHosts(r):null;for(let i of n){let p=c;if(p&&a&&!ot(a,i)){p=!1;let C=a.length===0?"the zone has no active edge certificate yet":`no active edge certificate covers it (${a.join(", ")})`;g.deferredProxy.push({host:i,reason:C}),g.warnings.push(`${i}: publishing DNS-only — ${C}. Proxying it would make Cloudflare terminate TLS with no certificate for the name, which fails the handshake outright rather than degrading. Universal SSL covers the apex and ONE level of subdomain, so a deeper name needs its own certificate; otherwise re-run the deploy once the certificate is active.`)}if(p&&!A){let C=await de({address:o,serverName:i});if(!C.trusted){p=!1;let S=C.reason||"origin is not serving a trusted certificate";g.deferredProxy.push({host:i,reason:S}),g.warnings.push(`${i}: publishing DNS-only for now — the origin does not yet serve a certificate this proxy can verify (${S}). The origin issues certificates over HTTP-01, which needs the name to reach it directly; re-run the deploy once it has one and the record will be proxied.`)}}if(p)m.push(i);let f=[{type:"A",content:o}];if(l&&ue(i))f.push({type:"AAAA",content:l});for(let{type:C,content:S}of f){let R=await t.upsertRecord(r,{name:i,type:C,content:S,ttl:b,proxied:p});if(R.success)g.records.push({host:i,type:C,content:S,proxied:p});else g.warnings.push(`${i} ${C} → ${S} failed: ${R.message||"unknown provider error"}`)}}if(m.length===0){if(c)g.warnings.push("No host is proxied yet, so zone settings, cache rules and purge were skipped — they only take effect through the proxy.");return g}try{let i=le(s),p=await t.applyZoneSettings(r,i);g.settingsChanged=p.changed;for(let f of p.failed)g.warnings.push(`zone setting '${f.id}' could not be applied: ${f.error}`)}catch(i){g.warnings.push(`zone settings could not be read: ${i instanceof Error?i.message:String(i)}`)}let y=se(m,d);if(y.length>0){let i=await t.putManagedPhaseRules(r,"http_request_cache_settings",y);if(i.success)g.cacheRules=y.length;else g.warnings.push(`cache rules could not be written: ${i.message}`)}if(h){let i=ce(m,h.header,h.value);if(i.length>0){let p=await t.putManagedPhaseRules(r,"http_request_late_transform",i);if(p.success)g.originGuard=!0;else g.warnings.push(`origin guard header could not be written: ${p.message}. `+"The gateway will reject requests that lack it — disable the guard or grant the token Transform Rules: Edit.")}}if(u){if(g.purged=await t.purgeCache(r,{hosts:m}),!g.purged)g.warnings.push("edge cache purge failed — new content may take until TTL expiry to appear.")}return g}var st=(e)=>process.env[e];function xe(e,t){let r=e.replace(/\.$/,"").toLowerCase();if(t){let n=t.replace(/\.$/,"").toLowerCase();if(r===n||r.endsWith(`.${n}`))return n}return r.split(".").slice(-2).join(".")}function ct(e,t={}){let r=t.env??st,n=e.infrastructure?.compute?.proxy?.cdn,o=[];if(!n||n.provider!=="cloudflare")return{plan:null,errors:o};if(n.originDomain)o.push(`compute.proxy.cdn.originDomain (${n.originDomain}) is ignored for Cloudflare: the proxy forwards to the address in the record it fronts, `+"so no separate origin hostname is needed — and publishing one gives clients a documented way around the edge.");let l=r("CLOUDFLARE_API_TOKEN");if(!l)return o.push("CLOUDFLARE_API_TOKEN is not set — the Cloudflare CDN cannot be reconciled."),{plan:null,errors:o};let c=e.sites??{},s=n.frontedHosts?.length?[...new Set(n.frontedHosts.map((A)=>A.toLowerCase()))]:pe(c,{autoWww:e.infrastructure?.compute?.proxy?.autoWww!==!1});if(s.length===0)return o.push("No hostnames to front — set compute.proxy.cdn.frontedHosts, or give a site a domain."),{plan:null,errors:o};let d=e.infrastructure?.dns?.domain,h=new Set(s.map((A)=>xe(A,d)));if(h.size>1)return o.push(`Fronted hosts span more than one zone (${[...h].join(", ")}). A Cloudflare zone is configured as a unit, so run one CDN config per zone.`),{plan:null,errors:o};let u=n.cloudflare??{},b=n.secret?{header:n.secretHeader??"X-Origin-Verify",value:n.secret}:void 0;return{plan:{zone:[...h][0],hosts:s,apiToken:l,zoneId:u.zoneId??r("CLOUDFLARE_ZONE_ID"),accountId:u.accountId??r("CLOUDFLARE_ACCOUNT_ID"),proxied:u.proxied!==!1,settings:u.settings??W,cache:u.cache,originGuard:b,purge:u.purgeOnDeploy!==!1,skipOriginProbe:u.skipOriginProbe===!0},errors:o}}export{bu as ABTestManager,fr as ACMClient,gr as ACMDnsValidator,Oe as ACME_DIRECTORIES,M as AI,Ef as API_IDEMPOTENCY_TTL_MS,If as API_TOKEN_DEFAULT_TTL_MS,Df as API_TOKEN_MAX_TTL_MS,Ny as API_VERSION,pf as AUTHORIZATION_CAPABILITIES,Qm as AUTH_ACTION_TOKEN_TTL_MS,Xm as AUTH_MFA_CHALLENGE_TTL_MS,ef as AUTH_OIDC_TRANSACTION_TTL_MS,Ym as AUTH_SESSION_ABSOLUTE_TTL_MS,Jm as AUTH_SESSION_IDLE_TTL_MS,Oc as AWSAPIError,St as AWSClient,Le as AWSCloudFormationClient,Me as AWSCloudFrontClient,lu as AWSConfigManager,Ps as AWS_PSEUDO_PARAMETERS,Ad as AWS_REGIONS,nt as AcmeClient,Pt as AlertEvaluator,$t as AlertStore,Vh as AnomalyConfigStore,Pe as ApiGateway,Dy as ApiServiceError,zr as ApplicationAutoScalingClient,$s as Arn,Ss as AssetHasher,ys as Auth,tf as AuthenticationStore,wy as AutomationApiService,wf as AutomationIdentityStore,qC as AwsAuroraDataAdapter,eS as AwsAuroraTransport,US as AwsDatabaseBackupSource,fn as AwsDriver,JC as AwsElastiCacheDataAdapter,tS as AwsElastiCacheTransport,Hy as AwsIamCapabilityScanner,tA as AwsInfrastructureBackupSource,jC as AwsRdsDataAdapter,XC as AwsRdsTransport,TS as AwsRegionalDriver,aA as AwsSecretsManagerConfigurationBackend,$y as AwsSpendTransport,sA as AwsSsmConfigurationBackend,GS as BackupCoordinator,ou as BackupManager,_S as BackupStore,Fp as BatchProcessingManager,Or as BedrockClient,vr as BedrockRuntimeClient,Eg as BitbucketSourceAdapter,yu as BlueGreenManager,bp as BounceComplaintHandler,Yu as BuildOptimizationManager,rS as BunDockerRuntime,QS as BunDockerVolumeRuntime,qS as BunFilesystemArchiveRuntime,ss as CDN,dt as CHAIN_HEADER,Jt as CLOUDFLARE_MANAGED_RULE_PREFIX,_d as COMMON_CROSS_ACCOUNT_ROLES,df as CONTROL_PLANE_SCHEMA_VERSION,re as Cache,Su as CanaryManager,Ku as CertificateManager,dg as CloudBlockVolumeDriver,bn as CloudDriverFactory,Ic as CloudError,Is as CloudFormationBuilder,Le as CloudFormationClient,Me as CloudFrontClient,uu as CloudTrailManager,Tr as CloudWatchLogsClient,Yt as CloudflareProvider,sd as CommandHistory,Rs as Communication,fg as ComposeApplicationService,mg as ComposeApplicationStore,Nr as ComprehendClient,w as Compute,Py as ComputeSpendTransport,Dc as ConfigurationError,lA as ConfigurationService,rA as ConfigurationStore,$r as ConnectClient,QC as ContainerDataAdapter,Xu as ContainerRegistryManager,eA as ControlPlaneBackupSource,MS as ControlPlaneCleanupDriver,$f as ControlPlaneStore,dh as CounterTracker,Ec as CredentialError,pd as CrossRegionReferenceManager,Us as DASHBOARD_ENTRY,Zs as DASHBOARD_PORT_BASE,js as DASHBOARD_PORT_SPAN,Ks as DASHBOARD_STATE_DIR,ti as DEFAULT_ATTACK_MODE_HOURS,vt as DEFAULT_DDOS_THRESHOLDS,sh as DEFAULT_METER_MAPPINGS,Qg as DEFAULT_PRICE_BOOK,mt as DEFAULT_RECURSION_LIMITS,zc as DEFAULT_SERVICE_LIMITS,wa as DEFAULT_STATE_DIR,Ne as DEFAULT_STATIC_ASSET_EXTENSIONS,ry as DEFAULT_TELEMETRY_POLICY,fh as DEFAULT_THRESHOLDS,Qf as DEPLOYMENT_QUEUE_KINDS,lt as DEPTH_HEADER,_h as DETECTABLE_SIGNALS,PC as DIAGNOSTIC_PRESETS,Lp as DLQMonitoringManager,cs as DNS,yp as DNSSECManager,UC as DataServiceLifecycle,GC as DataServiceStore,U as Database,_u as DatabaseUserManager,Lc as DebugLogger,ns as DependencyGraph,Cs as Deployment,wc as DeploymentError,su as DisasterRecoveryManager,pr as DnsProviderFactory,nS as DockerDataTransport,hC as DockerDiscoveryAdapter,cg as DockerNamedVolumeDriver,XS as DockerVolumeBackupSource,jf as DurableOperationQueue,qf as DurableQueueWorker,Dr as DynamoDBClient,Kt as EC2Client,hr as ECRClient,yr as ECSClient,Ur as EFSClient,Pr as ELBv2Client,Hg as ENFORCEMENT_ACTIONS,Th as ENFORCEMENT_DESCRIPTIONS,Gg as ENFORCEMENT_SEVERITY,AC as EcsRuntimeAdapter,Yn as EdgeRateLimiter,Br as ElastiCacheClient,L as Email,wp as EmailAdvanced,Tp as EmailAnalyticsManager,Tt as EmailClient,vp as EmailHandlers,Dp as EmailTemplateManager,iS as EncryptedDataSecretStore,Nc as ErrorCodes,_r as EventBridgeClient,VC as EventBridgeJobAdapter,cA as ExternalConfigurationBackend,kp as FIFOQueueManager,Gh as FOCUS_VERSION,Uc as FileCache,K as FileSystem,JS as FilesystemBackupSource,lS as FleetService,cS as FleetStore,Ts as Fn,wg as GiteaSourceAdapter,Ig as GithubSourceAdapter,Dg as GitlabSourceAdapter,md as GlobalResourceManager,qt as GoDaddyProvider,mu as GuardDutyManager,rl as HashCache,km as HealthCheckManager,Et as HealthCheckRunner,gn as HetznerClient,Sn as HetznerDriver,At as IAMClient,Jr as IPV6_EXCLUDED_HOST_LABELS,qu as ImageScanningManager,ze as InfrastructureGenerator,Cf as InvalidOperationTransitionError,us as JobLoader,_C as JobProviderReconciler,WC as JobService,LC as JobStore,Vr as KendraClient,Tm as LARAVEL_SERVERLESS_BUILD_STEPS,Rr as LambdaClient,sp as LambdaConcurrencyManager,mp as LambdaDLQManager,lp as LambdaDestinationsManager,np as LambdaLayersManager,bC as LambdaRuntimeAdapter,up as LambdaVPCManager,op as LambdaVersionsManager,oA as LocalEncryptedConfigurationBackend,YS as LogicalDatabaseBackupSource,wu as LogsManager,Zp as MANAGED_NODE_VERSIONS,Fn as MANAGEMENT_DASHBOARD_SITE,Xs as MANAGEMENT_DASHBOARD_SITE_PREFIX,ei as MAX_CONTROL_HOURS,Rf as MAX_CONTROL_PLANE_ERROR_BYTES,bf as MAX_CONTROL_PLANE_JSON_BYTES,zg as METERS,Wg as METER_KEYS,Kg as MICRO_CENTS,Sh as MIN_PROJECTION_CONFIDENCE,kS as MaintenanceService,OS as MaintenanceStore,gs as Messaging,Du as MetricsManager,ku as MigrationManager,Il as MockCloudFormation,El as MockDynamoDB,Dl as MockS3,Ie as Monitoring,kd as MultiAccountManager,dd as MultiRegionManager,Kl as MultiStepProgress,Re as Network,Lm as NetworkSecurityManager,Dt as NotificationRouter,Er as OpenSearchClient,yf as OptimisticConcurrencyError,xd as OrganizationManager,Pm as PHP_DEFAULT_EXCLUDES,Qp as PHP_LAYER_EXTENSIONS,Zt as PROXIABLE_RECORD_TYPES,bs as ParameterStore,Fu as PerformanceManager,$e as Permissions,Fr as PersonalizeClient,ds as Phone,Op as PhoneAdvanced,ls as PhoneHandlers,mS as PlacementService,pS as PlacementStore,Lr as PollyClient,jt as PorkbunProvider,Fy as PreDeployScanner,vl as PreviewEnvironmentManager,Yf as PreviewEnvironmentService,Jf as PreviewEnvironmentStore,Ll as PreviewNotificationService,Gl as ProgressBar,Tu as ProgressiveDeploymentManager,ri as ProtectionControlStore,Ka as Pseudo,te as Queue,Kf as QueueCancellationError,_p as QueueManagementManager,Da as QueuePresets,Uf as QueueTimeoutError,Zn as RATE_LIMIT_KEY_SEPARATOR,Ir as RDSClient,Fd as RECOMMENDED_ACCOUNT_STRUCTURES,Vd as RECOMMENDED_SCPS,Rg as RELEASE_QUEUE_KINDS,id as REPL,ad as REPLCommandBuilder,od as REPLContext,ll as RateLimiter,Ea as RealtimePresets,ty as RecordingSpendTransport,ht as RecursionGuard,Z as Redirects,fd as RegionPairManager,bS as RegionService,AS as RegionStore,as as Registry,kr as RekognitionClient,Cg as ReleaseService,yg as ReleaseStore,fS as RemoteBuildService,Lu as ReplicaManager,Fm as ResourceManagementManager,Zf as RetryableOperationError,j as Route53Client,Ut as Route53DomainsClient,rr as Route53Provider,Sp as Route53ResolverManager,gp as Route53RoutingManager,IC as RuntimeOperationService,DC as RuntimeStreamRegistry,HS as S3BackupDestinationAdapter,bt as S3Client,$c as S3Error,My as SECRET_PATTERNS,Mh as SENSITIVITY_THRESHOLDS,Rt as SESClient,fs as SMS,Ar as SNSClient,Ry as SPEND_CYCLE_SECONDS,Jh as SPEND_GATE_SETTING,Sy as SPEND_LEASE_SETTING,br as SQSClient,Cr as SSMClient,va as STATE_DIR_ENV_VAR,W as STATIC_SITE_ZONE_SETTINGS,Vt as STSClient,Wr as SchedulerClient,De as Search,Wy as SecretFindingScanner,As as Secrets,Hu as SecretsManager,Sr as SecretsManagerClient,Wu as SecretsRotationManager,ee as Security,gu as SecurityHubManager,Ly as SecurityPostureStore,By as SecurityScannerRunner,Zu as SecurityScanningManager,Pp as SenderReputationManager,FC as ServerCronJobAdapter,YC as ServerDataAdapter,lg as ServerPathVolumeDriver,tp as ServiceMeshManager,Te as Sftp,Wh as SignalSource,Np as SmsAdvanced,Hr as SmsClient,ms as SmsHandlers,$g as SourceConnectionStore,Pg as SourceProviderError,Qh as SpendCapError,Yh as SpendGate,Ay as SpendLoopLease,Cy as SpendNotificationRouter,by as SpendRunner,jh as SpendService,gh as SpendStore,Ul as Spinner,aS as SshFleetDriver,gd as StackDependencyManager,ps as StacksIntegration,wm as StaticSiteManager,X as Storage,Om as StorageAdvancedManager,Kr as SupportClient,Ou as SyntheticsManager,oS as SystemFleetSshTransport,SC as SystemdDiscoveryAdapter,ut as TRACE_HEADER,Zl as TaskList,fy as TelemetryStore,Se as TemplateBuilder,Zc as TemplateCache,xr as TextractClient,wr as TranscribeClient,Mr as TranslateClient,FS as TransportDisasterRecoveryDriver,LS as TransportPlatformMaintenanceDriver,hS as TransportRemoteBuildDriver,zy as TrivyImageScanner,vf as TsCloudApiError,Of as TsCloudClient,gy as URGENT_SPEND_EVENTS,$h as USER_VISIBLE_ACTIONS,$S as UnavailableRegionalDriver,sr as UnifiedDnsValidator,Sf as UnsupportedSchemaVersionError,vc as ValidationError,Gr as VoiceClient,ag as VolumeService,tg as VolumeStore,hs as Workflow,Pu as XRayManager,Ru as abTestManager,Ag as activateImmutableRelease,lC as ageSeconds,ph as aggregateDeltas,is as analyzeStackDiff,Lh as anomalyOptionsForSignal,oi as applyControlsToDdos,ii as applyControlsToRateLimits,Ft as applyMitigationFactor,or as applyZoneMigration,Kp as artifactKey,hg as assertReleaseStrategy,Xh as assertSpendAllows,qy as attachProvenanceToRelease,Uy as attachSbomToRelease,Zy as attachVulnerabilitySummary,nf as authEncryptionKeyFile,gf as authorizeOrganization,$C as authorizeRuntimePath,Xl as autocomplete,du as awsConfigManager,zS as backupCredentialStatus,au as backupManager,il as batch,Vp as batchProcessingManager,cf as beginOidcAuthorization,Cu as blueGreenManager,Rp as bounceComplaintHandler,nh as budgetWindow,hi as buildAndPushServerlessImage,om as buildBunRuntimeLayerZip,Ds as buildCloudFormationTemplate,Hf as buildComposeLogsCommand,Wf as buildComposeRuntimeCommand,zf as buildComposeScaleCommand,Gf as buildComposeShellCommand,Ci as buildFunctionEnv,Mn as buildHostCleanupScript,Ha as buildMailEnv,zn as buildManagementDashboardArtifact,xi as buildMediaCdnPlan,im as buildNodeRuntimeLayerZip,Qu as buildOptimizationManager,ce as buildOriginGuardRule,$m as buildPhpRuntimeLayerZip,xn as buildSiteDeployScript,Tn as buildSshArgs,se as buildStaticSiteCacheRules,Ln as buildStaticSiteDeployScript,dC as bytes,Au as canaryManager,PS as canonicalJson,aC as capabilities,uS as capacity,gl as categorizeChanges,Uu as certificateManager,_c as checkIAMPermissions,um as checkInvocation,Hc as checkServiceQuotas,dl as chunk,Yi as cleanupDns01Challenge,Ta as clearSigningKeyCache,Lg as cloneSourceBinding,Cl as cloudConfigSchema,Rn as cloudDrivers,pu as cloudTrailManager,Dm as collectPhpAppEntries,Zr as collectServerDnsDomains,pg as completeComposeVolumeDeletion,lf as completeOidcAuthorization,oc as composePresets,Bf as composeProjectName,Yp as composeServerlessAppTemplate,Iy as compositeSpendTransport,ZS as compressBackup,zm as config,KC as connectionGuidance,ep as containerRegistryManager,Af as controlPlaneDatabaseFile,uf as controlPlaneMigrations,xs as createApiBackendPreset,xy as createApiV1Handler,SS as createAsgBuildDriver,KS as createBackupQueueHandlers,Cm as createCliHandler,An as createCloudDriver,Ce as createCloudFrontPolicy,Ac as createCredentialProvider,Gs as createDashboardSite,_s as createDataPipelinePreset,ZC as createDataServiceQueueHandlers,eg as createDeploymentQueueHandlers,q as createDnsProvider,CS as createEcsBuildDriver,ey as createEnforcementHandlers,xc as createError,Ns as createExistingStaticFullStackPreset,sS as createFleetQueueHandlers,ks as createFullStackAppPreset,lr as createGoDaddyValidator,Sm as createHandlers,hm as createHttpHandler,Ms as createJamstackPreset,zC as createJobQueueHandlers,zs as createLaravelPreset,Bs as createMLApiPreset,xS as createMaintenanceQueueHandlers,Oi as createMediaAccessToken,Fs as createMicroservicesPreset,wl as createMockAWS,ws as createNodeJsServerPreset,vs as createNodeJsServerlessPreset,Gt as createObjectStorageClient,cr as createPorkbunValidator,ac as createPreset,ha as createPresignedUrl,ya as createPresignedUrlAsync,ym as createQueueHandler,Vs as createRealtimeAppPreset,RS as createRegionQueueHandlers,jy as createReleaseProvenance,Tg as createReleaseQueueHandlers,gS as createRemoteBuildQueueHandlers,dr as createRoute53Validator,RC as createRuntimeAdapters,Pc as createS3Client,yS as createServerBuildDriver,Hs as createServerlessLaravelPreset,Os as createServerlessNodePreset,vg as createSourceAdapter,Es as createStaticSitePreset,Ws as createTraditionalWebAppPreset,sg as createVolumeQueueHandlers,Ls as createWordPressPreset,Wp as createZip,hd as crossRegionReferenceManager,Pi as dashboardActions,Vn as dashboardCredentialsFile,HC as dataServiceCapabilities,Bu as databaseUserManager,Gm as decodeBase32,jS as decompressBackup,WS as decryptBackup,_m as defaultConfig,Al as defaultLocalConfig,Xn as defaultRateLimitRules,mi as deleteStaticSite,Gn as deployAllComputeSites,Si as deployServerlessApp,gi as deploySite,Hn as deploySiteRelease,di as deployStaticSite,fi as deployStaticSiteFull,si as deployStaticSiteWithExternalDns,ci as deployStaticSiteWithExternalDnsFull,Va as deploymentCoexistenceError,qs as deriveManagementDashboardPort,ni as describePosture,MC as desiredJobProviderState,kh as detectAnomalies,Ma as detectDeploymentTargets,ur as detectDnsProvider,xh as detectLatestAnomaly,Fc as detectMisconfigurations,ma as detectServiceRegion,xf as diffCompose,pl as diffTemplates,xg as discoverGitRefs,sf as discoverOidcProvider,uC as discoverRuntimeInventory,Mp as dlqMonitoringManager,mr as dnsProviders,Cp as dnssecManager,gC as dockerWorkloads,DS as documentDigest,cu as drManager,pC as ecsWorkloads,hf as effectiveCapabilities,$p as emailAnalyticsManager,Ep as emailTemplateManager,Hm as encodeBase32,BS as encryptBackup,Qy as ensureDefaultSecurityPolicies,vn as ensureFirewall,Wn as ensureManagementDashboard,On as ensureServer,wn as ensureSshKey,sn as escapeSecLang,bh as evaluateBudget,wt as evaluateTelemetryAlertRules,kC as eventBridgeScheduleInput,fm as eventToRequest,Nh as ewma,kf as exportCompose,nr as exportRoute53Zone,ic as extendPreset,xp as fifoQueueManager,tl as findChangedFiles,ch as findMapping,Zg as findPriceEntry,Hd as formatAccountStructure,Bl as formatBytes,hy as formatCents,os as formatDiff,Wl as formatDuration,td as formatFlagSuggestions,cd as formatHistory,ld as formatHistoryStats,Hl as formatKeyValue,zl as formatList,_l as formatProgressBar,vd as formatRegion,Od as formatRegionList,_y as formatScanResults,ql as formatSuggestion,Fl as formatTable,Ch as formatTimeToExhaustion,Vl as formatTree,hc as fromEC2Metadata,yc as fromECSMetadata,fc as fromEnvironment,gc as fromSharedCredentials,Cc as fromWebIdentity,pt as functionFingerprint,pe as gatewayHostnames,rm as generateAppImageDockerfile,nu as generateApprovalConfig,zp as generateBootstrap,kl as generateCleanupWorkflow,xl as generateCostReportWorkflow,Wd as generateCrossAccountRoleCF,Gy as generateCycloneDxSbom,eu as generateDeploymentConfig,qd as generateDeploymentPipeline,Gd as generateDeploymentWorkflow,ai as generateExternalDnsStaticSiteTemplate,qi as generateHttpsServerCode,Ky as generateImageSbom,ji as generateLetsEncryptUserData,be as generateLogicalId,Xd as generateManualPipeline,jd as generateMatrixWorkflow,tu as generateMultiEnvConfig,Jd as generateMultiEnvPipeline,Kd as generateMultiEnvWorkflow,Ud as generatePRPreviewWorkflow,iu as generateParallelConfig,Am as generatePhpFpmConfig,tm as generatePhpLayerDockerfile,Yd as generatePreviewPipeline,Nl as generatePreviewWorkflow,Ae as generateResourceName,ru as generateScheduledConfig,Qd as generateScheduledPipeline,Zd as generateScheduledWorkflow,li as generateStaticSiteTemplate,mn as generateUbuntuAppCloudInit,Tc as getAccountId,Rd as getAllRegions,Dd as getClosestRegion,rd as getCommandUsage,Mf as getComposeTemplate,Bm as getConfig,Yl as getContextualHelp,Sc as getCredentials,hl as getDeploymentStrategy,yl as getDiffStats,ml as getDiffSummary,kc as getErrorDetails,bl as getLocalConfig,$l as getLocalCredentials,Tl as getLocalEndpoint,Pl as getLocalEnvVars,Gc as getQuotaUsageSummary,Bd as getRecommendedStructure,bd as getRegion,Nd as getRegionStats,$d as getRegionsByCompliance,Td as getRegionsByLocation,Pd as getRegionsByPricingTier,Bc as getRequiredPermissions,$a as getSigningKeyCacheSize,Ua as getTimestamp,jn as globMatches,ln as globToRegex,yd as globalResourceManager,Ah as governingLimitCents,fu as guardDutyManager,vy as handleSpendRequest,an as hasAutoWwwVariant,Qs as hasManagementDashboardSite,en as hasProxyUpstream,Yc as hashBuffer,Qc as hashDirectory,qc as hashFile,Xc as hashManifest,Jc as hashString,xm as healthCheckManager,ue as hostAcceptsIpv6,ae as hostCondition,Km as hotp,oh as hourBucket,ah as hourBucketsBetween,Ju as imageScanningManager,yi as infraEnvFromOutputs,gt as inspectInvocation,cm as installRecursionFetch,pi as invalidateCache,am as invocationContext,Jl as isLikelyTypo,Rl as isLocalDevelopment,tc as isManagementDashboardSiteName,Pa as isNodeCryptoAvailable,Eh as isOperationAllowed,It as isQuietHours,cn as isSafePattern,La as isStatePath,Ot as isValidCidr,Id as isValidRegion,Xg as isValidTimeZone,Ia as isWebCryptoAvailable,OC as jobProviderCapability,Bt as keyMatchesFilters,cp as lambdaConcurrencyManager,fp as lambdaDLQManager,dp as lambdaDestinationsManager,ip as lambdaLayersManager,pp as lambdaVPCManager,ap as lambdaVersionsManager,mC as lambdaWorkloads,Rm as laravelServerlessEnvDefaults,Lf as listComposeTemplates,Vg as listSourceReferences,Wm as loadCloudConfig,oy as loadTelemetryPolicy,vu as logsManager,Hh as lookbackHoursForSignal,Ba as mailEnabled,za as mailFirewallPorts,NS as maintenanceWindowOpen,Ca as makeAWSRequest,Aa as makeAWSRequestAsync,Sa as makeAWSRequestOnce,ec as managementDashboardSiteName,IS as manifestDigest,jm as matchTotpCounter,ki as mediaObjectHeaders,wh as median,vh as medianAbsoluteDeviation,Rh as mergeDecisions,sc as mergeInfrastructure,Yg as mergePriceBooks,uh as meterTelemetry,Eu as metricsManager,Wt as migrateObjectStorage,xu as migrationManager,Ld as multiAccountManager,ud as multiRegionManager,Qi as needsRenewal,Mm as networkSecurityManager,wC as nextScheduleRuns,qr as normalizePublicIpv6,sC as normalizeRuntimeStatus,EC as normalizeScheduleExpression,Og as normalizeSourceEvent,yn as normalizeSshPublicKey,ny as normalizeTelemetryPolicy,ky as openApiDocument,zh as optionsForSignal,Md as organizationManager,Em as packagePhpApp,Up as packageServerlessApp,nl as parallel,ol as parallelMap,al as parallelWithRetry,ft as parseChain,Nf as parseCompose,Vf as parseComposeCatalog,fC as parseDockerInspect,nA as parseDotenv,Ra as parseJSONResponse,yC as parseSystemdRecords,ba as parseXMLResponse,dy as pathTemplate,yh as percentOfLimit,Vu as performanceManager,em as phpLayerBuildStage,Xp as phpLayerPackages,bm as phpRuntimeLayerAssets,_f as planComposeTemplateUpgrade,Ph as planEnforcement,Mt as planMitigation,ir as planZoneMigration,Qt as policyTag,Ol as previewManager,Ml as previewNotifications,vC as previewSchedule,ih as previousBudgetWindow,jg as priceUsage,qg as priceUsageLines,de as probeOriginTls,ul as processInChunks,Ng as processSourceWebhook,rC as productionChangeReview,$u as progressiveDeploymentManager,hh as projectSpend,yt as propagationHeaders,zt as providerEndpoint,ES as publicKeyFingerprint,Xt as qualifyName,Bp as queueManagementManager,el as quickHash,Qn as rateLimitHeaders,Jn as rateLimitKey,Yr as reconcileAddressRecords,at as reconcileCloudflareCdn,tr as reconcileDeclaredRecords,xC as reconcileJobObservation,_g as reconcileSourceWebhook,tC as recordDashboardHostPosture,Xy as recordPreDeploySecretScan,eC as recordSkippedSecretScan,Ct as recursionBlockedResponse,cC as redactRuntimeConfig,cy as redactTelemetryText,ly as redactTelemetryValue,Ai as redeployServerlessApp,Cd as regionPairManager,gg as releaseStrategyCapabilities,Sg as releaseTrafficPlan,Kn as reloadRpxGateway,_t as remapKey,Bg as removeSourceWebhook,jr as removeStaleServerAddressRecords,Ff as renderComposeTemplate,Lt as renderDdosInstallScript,xt as renderNftablesRuleset,NC as renderServerCron,kt as renderSysctlFile,dn as renderWafConfig,un as renderWafInstallScript,Un as renewRpxCertificates,Mu as replicaManager,Ey as requestHash,fl as requiresReplacement,dm as resetRecursionRuntime,mm as resolveApp,_a as resolveAppDatabase,of as resolveAuthEncryptionKey,Ga as resolveCloudProvider,ct as resolveCloudflareCdnPlan,bc as resolveCredentials,Ii as resolveDashboardAction,_n as resolveDashboardAuth,Js as resolveDashboardDomain,Ys as resolveDashboardDomains,er as resolveDeclaredRecords,Xa as resolveDeployBucketName,Fa as resolveDeploymentMode,kn as resolveExecStart,hn as resolveHetznerApiToken,Wa as resolveMailService,nc as resolveManagementDashboardSite,rc as resolveManagementDashboardSites,Ht as resolveObjectStorage,ja as resolveProjectStackName,Xr as resolveProxyUpstreams,Jp as resolveQueueNames,Xf as resolveQueuedDeploymentCommand,qp as resolveQueues,sm as resolveRecursionConfig,Rc as resolveRegion,TC as resolveRuntimeInventory,es as resolveServerlessAppStackName,ts as resolveServerlessArtifactBucketName,rs as resolveServerlessAssetBucketName,jp as resolveServerlessRuntime,Ya as resolveSiteBucketName,tn as resolveSiteDeployTarget,rn as resolveSiteKind,Ja as resolveSiteResourceName,qa as resolveSiteStackName,xa as resolveStatePath,Qa as resolveStorageBucketName,Bn as resolveUiSource,xe as resolveZoneApex,Vm as resourceManagementManager,gm as responseToResult,Oh as robustZScore,mf as roleCapabilities,bg as rollbackImmutableRelease,bi as rollbackServerlessApp,Jg as roundCents,Ap as route53ResolverManager,hp as route53RoutingManager,Fh as routeMatches,qn as ruleMatches,Hp as runBuildHooks,Ih as runEnforcement,Im as runPhpBuildHooks,Ti as runRemoteCommand,iC as runtimeId,$i as sanitizeCloudConfig,Tf as sanitizeControlPlaneValue,Za as sanitizeName,af as sanitizeOidcReturnPath,ay as saveTelemetryPolicy,Vy as scanForSecrets,ff as scopeContains,mh as scopeKey,In as scpUpload,Ql as searchCommands,Pf as searchControlPlane,Gu as secretsManager,zu as secretsRotationManager,nC as secureContainerRelease,hu as securityHubManager,ju as securityScanningManager,Yy as securityScope,rf as sendAuthenticationEmail,Ip as senderReputationManager,sl as sequence,iA as serializeDotenv,Nn as serverPublicIpv4,rp as serviceMeshManager,Ri as setMaintenance,Oa as setStateDir,Ji as setupDns01Challenge,Gp as sha256,lm as sharedRecursionGuard,nm as sharedRuntimeLoop,on as shipsARelease,vi as signCloudFrontCookies,wi as signCloudFrontUrl,fa as signRequest,ga as signRequestAsync,Bh as signalDefinition,yy as spendNotificationText,Oy as spendOpenApiPaths,$n as sshExec,Pn as sshExecOrThrow,Sd as stackDependencyManager,Di as startLocalDashboardServer,Ty as startSpendLoop,Na as stateDir,ka as statePath,vm as staticSiteManager,Nm as storageAdvancedManager,Zh as streamFocusJsonl,Dh as strongestActiveAction,jl as suggestCommand,ed as suggestFlags,Wc as suggestIAMPolicy,Kc as suggestQuotaIncrease,wd as suggestRegionPairs,Ed as suggestRegions,Fg as syncSourceRepositories,ug as synchronizeComposeVolumes,dA as synchronizeConfiguredConfiguration,BC as synchronizeConfiguredJobs,Nu as syntheticsManager,Nt as sysctlHardening,CC as systemdWorkloads,my as telemetryBucketLabel,uy as telemetryCursor,sy as telemetryEstimatedMonthlyCost,py as telemetryPercentile,iy as telemetryPolicyKey,jc as templateCache,Mg as testSourceConnection,Ug as tieredMicroCents,le as toCloudflareZoneSettings,Uh as toFocusJsonl,Kh as toFocusRecords,Um as totp,qm as totpUri,oC as unsupportedCapabilities,rg as unsupportedVolumeCapabilities,vS as updateCompatibility,ui as uploadStaticFiles,lh as usageDeltaKey,rh as utcInstantOfLocal,zd as validateAccountStructure,Sl as validateAgainstSchema,og as validateAttachment,VS as validateBackupDestination,nd as validateCommand,Mc as validateConfiguration,Vc as validateCredentials,nn as validateDeploymentConfig,ig as validateMountPath,qe as validateResourceLimits,He as validateTemplate,je as validateTemplateSize,Qr as verifyAddressRecord,Jy as verifyArtifactSignature,Ni as verifyMediaAccessToken,Zm as verifyTotp,wS as verifyUpdateSignature,ar as verifyZoneParity,ng as volumeCapabilities,pn as wafEventTelemetry,En as waitForCloudInit,Dn as waitForSsh,kg as webhookEndpoint,pc as withCDN,uc as withCache,dc as withDatabase,pm as withInvocation,cc as withMonitoring,mc as withQueue,lc as withSecurity,cl as withTimeout,Cn as wrapCloudInitUserData,Iu as xrayManager,dS as zeroCapacity,qh as zeroFill,th as zoneOffsetMs,eh as zonedParts};
+`}async function Xi(e){let{domain:t,challengeValue:r,hostedZoneId:n,dnsProvider:o,region:l="us-east-1"}=e;if(o){let s=await q(o).upsertRecord(t,{name:`_acme-challenge.${t}`,type:"TXT",content:r,ttl:60});if(!s.success)throw Error(`Failed to create DNS challenge record: ${s.message}`);return}if(n){await new j(l).changeResourceRecordSets({HostedZoneId:n,ChangeBatch:{Comment:"ACME DNS-01 challenge",Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:`_acme-challenge.${t}`,Type:"TXT",TTL:60,ResourceRecords:[{Value:`"${r}"`}]}}]}});return}throw Error("Either dnsProvider or hostedZoneId must be provided")}async function eo(e){let{domain:t,challengeValue:r,hostedZoneId:n,dnsProvider:o,region:l="us-east-1"}=e;if(o){let s=await q(o).deleteRecord(t,{name:`_acme-challenge.${t}`,type:"TXT",content:r});if(!s.success)console.warn(`Failed to delete DNS challenge record: ${s.message}`);return}if(n){await new j(l).changeResourceRecordSets({HostedZoneId:n,ChangeBatch:{Comment:"Remove ACME DNS-01 challenge",Changes:[{Action:"DELETE",ResourceRecordSet:{Name:`_acme-challenge.${t}`,Type:"TXT",TTL:60,ResourceRecords:[{Value:`"${r}"`}]}}]}});return}throw Error("Either dnsProvider or hostedZoneId must be provided")}function to(e){try{let{execSync:t}=Je("node:child_process"),r=t(`openssl x509 -checkend 2592000 -noout -in ${e}/cert.pem`,{encoding:"utf-8",stdio:["pipe","pipe","pipe"]});return!1}catch{return!0}}import{createHash as we,createSign as rt,generateKeyPairSync as ve}from"node:crypto";var Oe={production:"https://acme-v02.api.letsencrypt.org/directory",staging:"https://acme-staging-v02.api.letsencrypt.org/directory"};class nt{directoryUrl;email;accountKey;accountUrl=null;directory=null;nonce=null;constructor(e){this.directoryUrl=e.staging?Oe.staging:Oe.production,this.email=e.email,this.accountKey=e.accountKey||this.generateAccountKey()}generateAccountKey(){let{privateKey:e}=ve("ec",{namedCurve:"P-256"});return e.export({type:"pkcs8",format:"pem"})}async getDirectory(){if(this.directory)return this.directory;let e=await fetch(this.directoryUrl);if(!e.ok)throw Error(`Failed to fetch ACME directory: ${e.status}`);return this.directory=await e.json(),this.directory}async getNonce(){if(this.nonce){let n=this.nonce;return this.nonce=null,n}let e=await this.getDirectory(),r=(await fetch(e.newNonce,{method:"HEAD"})).headers.get("replay-nonce");if(!r)throw Error("Failed to get nonce from ACME server");return r}getJwk(){let e=this.accountKey.split(`
+`).filter((l)=>!l.startsWith("-----")).join(""),t=Buffer.from(e,"base64"),r=t.length-65,n=t.subarray(r+1,r+33),o=t.subarray(r+33,r+65);return{kty:"EC",crv:"P-256",x:this.base64UrlEncode(n),y:this.base64UrlEncode(o)}}getJwkThumbprint(){let e=this.getJwk(),t=JSON.stringify({crv:e.crv,kty:e.kty,x:e.x,y:e.y}),r=we("sha256").update(t).digest();return this.base64UrlEncode(r)}base64UrlEncode(e){return(typeof e==="string"?Buffer.from(e):e).toString("base64").replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async signPayload(e,t){let r=await this.getNonce(),n=this.getJwk(),o={alg:"ES256",nonce:r,url:e};if(this.accountUrl)o.kid=this.accountUrl;else o.jwk=n;let l=this.base64UrlEncode(JSON.stringify(o)),c=t===""?"":this.base64UrlEncode(JSON.stringify(t)),s=`${l}.${c}`,d=rt("SHA256");d.update(s);let h=d.sign(this.accountKey),u=h.subarray(4,4+h[3]),b=4+h[3]+2,A=h.subarray(b,b+h[b-1]),T=Buffer.alloc(32),g=Buffer.alloc(32);u.copy(T,32-u.length),A.copy(g,32-A.length);let m=Buffer.concat([T,g]);return JSON.stringify({protected:l,payload:c,signature:this.base64UrlEncode(m)})}async acmeRequest(e,t){let r=await this.signPayload(e,t),n=await fetch(e,{method:"POST",headers:{"Content-Type":"application/jose+json"},body:r}),o=n.headers.get("replay-nonce");if(o)this.nonce=o;let l,c=n.headers.get("content-type");if(c?.includes("application/json")||c?.includes("application/problem+json"))l=await n.json();else l=await n.text();if(!n.ok)throw Error(`ACME request failed: ${JSON.stringify(l)}`);return{body:l,headers:n.headers}}async registerAccount(){let e=await this.getDirectory(),{body:t,headers:r}=await this.acmeRequest(e.newAccount,{termsOfServiceAgreed:!0,contact:[`mailto:${this.email}`]}),n=r.get("location");if(!n)throw Error("No account URL returned");return this.accountUrl=n,n}async createOrder(e){if(!this.accountUrl)await this.registerAccount();let t=await this.getDirectory(),{body:r,headers:n}=await this.acmeRequest(t.newOrder,{identifiers:e.map((l)=>({type:"dns",value:l}))}),o=n.get("location");if(!o)throw Error("No order URL returned");return{orderUrl:o,authorizations:r.authorizations,finalize:r.finalize}}async getAuthorization(e){let{body:t}=await this.acmeRequest(e,""),r=t.identifier.value,n=this.getJwkThumbprint(),o=t.challenges.filter((l)=>l.type==="http-01"||l.type==="dns-01").map((l)=>{let c=`${l.token}.${n}`;if(l.type==="http-01")return{type:"http-01",token:l.token,keyAuthorization:c,identifier:`/.well-known/acme-challenge/${l.token}`};else{let s=this.base64UrlEncode(we("sha256").update(c).digest());return{type:"dns-01",token:l.token,keyAuthorization:c,identifier:`_acme-challenge.${r}`,dnsValue:s}}});return{domain:r,challenges:o}}async respondToChallenge(e){await this.acmeRequest(e,{})}async waitForAuthorization(e,t=30){for(let r=0;r<t;r++){let{body:n}=await this.acmeRequest(e,"");if(n.status==="valid")return;if(n.status==="invalid")throw Error(`Authorization failed: ${JSON.stringify(n)}`);await new Promise((o)=>setTimeout(o,2000))}throw Error("Authorization timed out")}generateCsr(e){let{privateKey:t}=ve("rsa",{modulusLength:2048}),r=t.export({type:"pkcs8",format:"pem"});return{csr:this.createSimpleCsr(e,t),privateKey:r}}createSimpleCsr(e,t){throw Error("CSR generation requires additional implementation. Consider using the shell-based certbot approach instead.")}async finalizeOrder(e,t){let{csr:r,privateKey:n}=this.generateCsr(t),{body:o}=await this.acmeRequest(e,{csr:this.base64UrlEncode(Buffer.from(r,"base64"))}),l=o.certificate;if(!l)throw Error("Certificate not immediately available - polling not implemented");let s=await(await fetch(l)).text(),d=s.split(/(?=-----BEGIN CERTIFICATE-----)/g),h=d[0],u=d.slice(1).join("");return{certificate:h,privateKey:n,chain:u,fullchain:s,expiresAt:new Date(Date.now()+7776000000)}}getAccountKey(){return this.accountKey}}var Ne=["js","mjs","cjs","css","map","woff","woff2","ttf","otf","eot","png","jpg","jpeg","gif","webp","avif","svg","ico","mp4","webm","ogg","mp3","wav","pdf","wasm"];function oe(e){return`"${e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`}function ke(e){return`{${e.map(oe).join(" ")}}`}function ae(e){if(e.length===1)return`http.host eq ${oe(e[0])}`;return`http.host in ${ke(e)}`}function se(e,t={}){if(t.enabled===!1||e.length===0)return[];let r=ae(e),n=[],o=t.bypassPaths??[],l=o.length>0?`(${o.map((h)=>`starts_with(http.request.uri.path, ${oe(h)})`).join(" or ")})`:void 0;if(l)n.push({action:"set_cache_settings",description:"bypass cache",expression:`(${r} and ${l})`,enabled:!0,action_parameters:{cache:!1}});let c=l?`${r} and not ${l}`:r,s=t.assetExtensions??Ne,d=s.length>0?`lower(http.request.uri.path.extension) in ${ke([...s])}`:void 0;if(d)n.push({action:"set_cache_settings",description:"cache fingerprinted assets",expression:`(${c} and ${d})`,enabled:!0,action_parameters:{cache:!0,edge_ttl:{mode:"override_origin",default:t.assetEdgeTtl??2592000},browser_ttl:{mode:"override_origin",default:t.assetBrowserTtl??31536000}}});return n.push({action:"set_cache_settings",description:"cache documents",expression:d?`(${c} and not ${d})`:`(${c})`,enabled:!0,action_parameters:{cache:!0,edge_ttl:{mode:"override_origin",default:t.documentEdgeTtl??3600},browser_ttl:{mode:"override_origin",default:t.documentBrowserTtl??0}}}),n}function ce(e,t,r){if(e.length===0||!t||!r)return[];return[{action:"rewrite",description:"origin guard header",expression:`(${ae(e)})`,enabled:!0,action_parameters:{headers:{[t]:{operation:"set",value:r}}}}]}var N=(e)=>e===void 0?void 0:e?"on":"off";function le(e){let t={ssl:e.ssl,always_use_https:N(e.alwaysUseHttps),automatic_https_rewrites:N(e.automaticHttpsRewrites),min_tls_version:e.minTlsVersion,tls_1_3:N(e.tls13),brotli:N(e.brotli),http3:N(e.http3),"0rtt":N(e.zeroRtt),early_hints:N(e.earlyHints),browser_cache_ttl:e.browserCacheTtl,always_online:N(e.alwaysOnline),websockets:N(e.websockets),email_obfuscation:N(e.emailObfuscation)};if(e.hsts)t.security_header={strict_transport_security:{enabled:e.hsts.enabled,max_age:e.hsts.maxAge??31536000,include_subdomains:e.hsts.includeSubdomains??!1,preload:e.hsts.preload??!1,nosniff:e.hsts.noSniff??!0}};for(let r of Object.keys(t))if(t[r]===void 0)delete t[r];return{...t,...e.raw??{}}}var W={ssl:"strict",alwaysUseHttps:!0,automaticHttpsRewrites:!0,minTlsVersion:"1.2",tls13:!0,brotli:!0,http3:!0,earlyHints:!0,alwaysOnline:!0,emailObfuscation:!1,browserCacheTtl:0};import{connect as it}from"node:tls";async function de(e){let{address:t,serverName:r,port:n=443,timeoutMs:o=5000}=e;return new Promise((l)=>{let c=!1,s=(h)=>{if(c)return;c=!0;try{d.destroy()}catch{}l(h)},d=it({host:t,port:n,servername:r,rejectUnauthorized:!1,timeout:o});d.once("secureConnect",()=>{if(d.authorized){s({reachable:!0,trusted:!0});return}s({reachable:!0,trusted:!1,reason:d.authorizationError?String(d.authorizationError):"origin certificate is not trusted for this hostname"})}),d.once("timeout",()=>{s({reachable:!1,trusted:!1,reason:`no TLS handshake within ${o}ms`})}),d.once("error",(h)=>{s({reachable:!1,trusted:!1,reason:h.message})})})}function ot(e,t){let r=t.replace(/\.$/,"").toLowerCase();return e.some((n)=>{let o=n.replace(/\.$/,"").toLowerCase();if(o===r)return!0;if(!o.startsWith("*."))return!1;let l=o.slice(2);if(!r.endsWith(`.${l}`))return!1;return!r.slice(0,r.length-l.length-1).includes(".")})}async function at(e){let{provider:t,zone:r,hosts:n,ipv4:o,ipv6:l,proxied:c=!0,settings:s=W,cache:d,originGuard:h,purge:u=!0,ttl:b=300,skipOriginProbe:A=!1,skipEdgeCertificateCheck:T=!1}=e,g={records:[],settingsChanged:[],cacheRules:0,originGuard:!1,purged:!1,deferredProxy:[],warnings:[]};if(n.length===0)return g;let m=[],a=c&&!T?await t.listEdgeCertificateHosts(r):null;for(let i of n){let p=c;if(p&&a&&!ot(a,i)){p=!1;let C=a.length===0?"the zone has no active edge certificate yet":`no active edge certificate covers it (${a.join(", ")})`;g.deferredProxy.push({host:i,reason:C}),g.warnings.push(`${i}: publishing DNS-only — ${C}. Proxying it would make Cloudflare terminate TLS with no certificate for the name, which fails the handshake outright rather than degrading. Universal SSL covers the apex and ONE level of subdomain, so a deeper name needs its own certificate; otherwise re-run the deploy once the certificate is active.`)}if(p&&!A){let C=await de({address:o,serverName:i});if(!C.trusted){p=!1;let S=C.reason||"origin is not serving a trusted certificate";g.deferredProxy.push({host:i,reason:S}),g.warnings.push(`${i}: publishing DNS-only for now — the origin does not yet serve a certificate this proxy can verify (${S}). The origin issues certificates over HTTP-01, which needs the name to reach it directly; re-run the deploy once it has one and the record will be proxied.`)}}if(p)m.push(i);let f=[{type:"A",content:o}];if(l&&ue(i))f.push({type:"AAAA",content:l});for(let{type:C,content:S}of f){let R=await t.upsertRecord(r,{name:i,type:C,content:S,ttl:b,proxied:p});if(R.success)g.records.push({host:i,type:C,content:S,proxied:p});else g.warnings.push(`${i} ${C} → ${S} failed: ${R.message||"unknown provider error"}`)}}if(m.length===0){if(c)g.warnings.push("No host is proxied yet, so zone settings, cache rules and purge were skipped — they only take effect through the proxy.");return g}try{let i=le(s),p=await t.applyZoneSettings(r,i);g.settingsChanged=p.changed;for(let f of p.failed)g.warnings.push(`zone setting '${f.id}' could not be applied: ${f.error}`)}catch(i){g.warnings.push(`zone settings could not be read: ${i instanceof Error?i.message:String(i)}`)}let y=se(m,d);if(y.length>0){let i=await t.putManagedPhaseRules(r,"http_request_cache_settings",y);if(i.success)g.cacheRules=y.length;else g.warnings.push(`cache rules could not be written: ${i.message}`)}if(h){let i=ce(m,h.header,h.value);if(i.length>0){let p=await t.putManagedPhaseRules(r,"http_request_late_transform",i);if(p.success)g.originGuard=!0;else g.warnings.push(`origin guard header could not be written: ${p.message}. `+"The gateway will reject requests that lack it — disable the guard or grant the token Transform Rules: Edit.")}}if(u){if(g.purged=await t.purgeCache(r,{hosts:m}),!g.purged)g.warnings.push("edge cache purge failed — new content may take until TTL expiry to appear.")}return g}var st=(e)=>process.env[e];function xe(e,t){let r=e.replace(/\.$/,"").toLowerCase();if(t){let n=t.replace(/\.$/,"").toLowerCase();if(r===n||r.endsWith(`.${n}`))return n}return r.split(".").slice(-2).join(".")}function ct(e,t={}){let r=t.env??st,n=e.infrastructure?.compute?.proxy?.cdn,o=[];if(!n||n.provider!=="cloudflare")return{plan:null,errors:o};if(n.originDomain)o.push(`compute.proxy.cdn.originDomain (${n.originDomain}) is ignored for Cloudflare: the proxy forwards to the address in the record it fronts, `+"so no separate origin hostname is needed — and publishing one gives clients a documented way around the edge.");let l=r("CLOUDFLARE_API_TOKEN");if(!l)return o.push("CLOUDFLARE_API_TOKEN is not set — the Cloudflare CDN cannot be reconciled."),{plan:null,errors:o};let c=e.sites??{},s=n.frontedHosts?.length?[...new Set(n.frontedHosts.map((A)=>A.toLowerCase()))]:pe(c,{autoWww:e.infrastructure?.compute?.proxy?.autoWww!==!1});if(s.length===0)return o.push("No hostnames to front — set compute.proxy.cdn.frontedHosts, or give a site a domain."),{plan:null,errors:o};let d=e.infrastructure?.dns?.domain,h=new Set(s.map((A)=>xe(A,d)));if(h.size>1)return o.push(`Fronted hosts span more than one zone (${[...h].join(", ")}). A Cloudflare zone is configured as a unit, so run one CDN config per zone.`),{plan:null,errors:o};let u=n.cloudflare??{},b=n.secret?{header:n.secretHeader??"X-Origin-Verify",value:n.secret}:void 0;return{plan:{zone:[...h][0],hosts:s,apiToken:l,zoneId:u.zoneId??r("CLOUDFLARE_ZONE_ID"),accountId:u.accountId??r("CLOUDFLARE_ACCOUNT_ID"),proxied:u.proxied!==!1,settings:u.settings??W,cache:u.cache,originGuard:b,purge:u.purgeOnDeploy!==!1,skipOriginProbe:u.skipOriginProbe===!0},errors:o}}export{Pu as ABTestManager,fr as ACMClient,gr as ACMDnsValidator,Oe as ACME_DIRECTORIES,M as AI,Nf as API_IDEMPOTENCY_TTL_MS,vf as API_TOKEN_DEFAULT_TTL_MS,Of as API_TOKEN_MAX_TTL_MS,My as API_VERSION,hf as AUTHORIZATION_CAPABILITIES,rf as AUTH_ACTION_TOKEN_TTL_MS,nf as AUTH_MFA_CHALLENGE_TTL_MS,of as AUTH_OIDC_TRANSACTION_TTL_MS,tf as AUTH_SESSION_ABSOLUTE_TTL_MS,ef as AUTH_SESSION_IDLE_TTL_MS,Lc as AWSAPIError,St as AWSClient,Le as AWSCloudFormationClient,Me as AWSCloudFrontClient,mu as AWSConfigManager,ws as AWS_PSEUDO_PARAMETERS,$d as AWS_REGIONS,nt as AcmeClient,Pt as AlertEvaluator,$t as AlertStore,zh as AnomalyConfigStore,Pe as ApiGateway,Oy as ApiServiceError,zr as ApplicationAutoScalingClient,Es as Arn,Ts as AssetHasher,bs as Auth,af as AuthenticationStore,ky as AutomationApiService,kf as AutomationIdentityStore,XC as AwsAuroraDataAdapter,iS as AwsAuroraTransport,JS as AwsDatabaseBackupSource,yn as AwsDriver,eS as AwsElastiCacheDataAdapter,oS as AwsElastiCacheTransport,Zy as AwsIamCapabilityScanner,oA as AwsInfrastructureBackupSource,QC as AwsRdsDataAdapter,nS as AwsRdsTransport,DS as AwsRegionalDriver,dA as AwsSecretsManagerConfigurationBackend,Ey as AwsSpendTransport,uA as AwsSsmConfigurationBackend,jS as BackupCoordinator,lu as BackupManager,HS as BackupStore,Wp as BatchProcessingManager,Or as BedrockClient,vr as BedrockRuntimeClient,Ng as BitbucketSourceAdapter,bu as BlueGreenManager,Pp as BounceComplaintHandler,tp as BuildOptimizationManager,aS as BunDockerRuntime,rA as BunDockerVolumeRuntime,XS as BunFilesystemArchiveRuntime,us as CDN,dt as CHAIN_HEADER,Jt as CLOUDFLARE_MANAGED_RULE_PREFIX,Hd as COMMON_CROSS_ACCOUNT_ROLES,ff as CONTROL_PLANE_SCHEMA_VERSION,re as Cache,Tu as CanaryManager,qu as CertificateManager,fg as CloudBlockVolumeDriver,$n as CloudDriverFactory,vc as CloudError,vs as CloudFormationBuilder,Le as CloudFormationClient,Me as CloudFrontClient,gu as CloudTrailManager,Tr as CloudWatchLogsClient,Yt as CloudflareProvider,ud as CommandHistory,Is as Communication,Cg as ComposeApplicationService,yg as ComposeApplicationStore,Nr as ComprehendClient,w as Compute,wy as ComputeSpendTransport,Oc as ConfigurationError,mA as ConfigurationService,aA as ConfigurationStore,$r as ConnectClient,rS as ContainerDataAdapter,np as ContainerRegistryManager,iA as ControlPlaneBackupSource,BS as ControlPlaneCleanupDriver,Ef as ControlPlaneStore,fh as CounterTracker,Nc as CredentialError,hd as CrossRegionReferenceManager,Js as DASHBOARD_ENTRY,Ys as DASHBOARD_PORT_BASE,Qs as DASHBOARD_PORT_SPAN,qs as DASHBOARD_STATE_DIR,ii as DEFAULT_ATTACK_MODE_HOURS,vt as DEFAULT_DDOS_THRESHOLDS,uh as DEFAULT_METER_MAPPINGS,rh as DEFAULT_PRICE_BOOK,mt as DEFAULT_RECURSION_LIMITS,Uc as DEFAULT_SERVICE_LIMITS,ka as DEFAULT_STATE_DIR,Ne as DEFAULT_STATIC_ASSET_EXTENSIONS,ay as DEFAULT_TELEMETRY_POLICY,Ch as DEFAULT_THRESHOLDS,rg as DEPLOYMENT_QUEUE_KINDS,lt as DEPTH_HEADER,Hh as DETECTABLE_SIGNALS,wC as DIAGNOSTIC_PRESETS,_p as DLQMonitoringManager,ps as DNS,bp as DNSSECManager,JC as DataServiceLifecycle,jC as DataServiceStore,U as Database,Hu as DatabaseUserManager,_c as DebugLogger,ss as DependencyGraph,Rs as Deployment,kc as DeploymentError,uu as DisasterRecoveryManager,pr as DnsProviderFactory,sS as DockerDataTransport,AC as DockerDiscoveryAdapter,pg as DockerNamedVolumeDriver,nA as DockerVolumeBackupSource,Qf as DurableOperationQueue,Xf as DurableQueueWorker,Dr as DynamoDBClient,Kt as EC2Client,hr as ECRClient,yr as ECSClient,Ur as EFSClient,Pr as ELBv2Client,Zg as ENFORCEMENT_ACTIONS,Dh as ENFORCEMENT_DESCRIPTIONS,jg as ENFORCEMENT_SEVERITY,$C as EcsRuntimeAdapter,ei as EdgeRateLimiter,Br as ElastiCacheClient,L as Email,kp as EmailAdvanced,Dp as EmailAnalyticsManager,Tt as EmailClient,xp as EmailHandlers,Op as EmailTemplateManager,cS as EncryptedDataSecretStore,Mc as ErrorCodes,_r as EventBridgeClient,zC as EventBridgeJobAdapter,pA as ExternalConfigurationBackend,Fp as FIFOQueueManager,jh as FOCUS_VERSION,Jc as FileCache,K as FileSystem,eA as FilesystemBackupSource,mS as FleetService,pS as FleetStore,Ds as Fn,kg as GiteaSourceAdapter,vg as GithubSourceAdapter,Og as GitlabSourceAdapter,yd as GlobalResourceManager,qt as GoDaddyProvider,yu as GuardDutyManager,al as HashCache,Fm as HealthCheckManager,Et as HealthCheckRunner,Cn as HetznerClient,Rn as HetznerDriver,At as IAMClient,Jr as IPV6_EXCLUDED_HOST_LABELS,Xu as ImageScanningManager,ze as InfrastructureGenerator,Rf as InvalidOperationTransitionError,gs as JobLoader,HC as JobProviderReconciler,KC as JobService,_C as JobStore,Vr as KendraClient,Dm as LARAVEL_SERVERLESS_BUILD_STEPS,Rr as LambdaClient,up as LambdaConcurrencyManager,yp as LambdaDLQManager,mp as LambdaDestinationsManager,sp as LambdaLayersManager,PC as LambdaRuntimeAdapter,gp as LambdaVPCManager,lp as LambdaVersionsManager,lA as LocalEncryptedConfigurationBackend,tA as LogicalDatabaseBackupSource,ku as LogsManager,Yp as MANAGED_NODE_VERSIONS,Bn as MANAGEMENT_DASHBOARD_SITE,nc as MANAGEMENT_DASHBOARD_SITE_PREFIX,ni as MAX_CONTROL_HOURS,If as MAX_CONTROL_PLANE_ERROR_BYTES,Pf as MAX_CONTROL_PLANE_JSON_BYTES,Ug as METERS,Kg as METER_KEYS,qg as MICRO_CENTS,Th as MIN_PROJECTION_CONFIDENCE,en as MTA_STS_PORT,FS as MaintenanceService,LS as MaintenanceStore,Ss as Messaging,Ou as MetricsManager,Fu as MigrationManager,vl as MockCloudFormation,Nl as MockDynamoDB,Ol as MockS3,Ie as Monitoring,Fd as MultiAccountManager,fd as MultiRegionManager,ql as MultiStepProgress,Re as Network,_m as NetworkSecurityManager,Dt as NotificationRouter,Er as OpenSearchClient,bf as OptimisticConcurrencyError,Vd as OrganizationManager,wm as PHP_DEFAULT_EXCLUDES,rm as PHP_LAYER_EXTENSIONS,Zt as PROXIABLE_RECORD_TYPES,Ps as ParameterStore,Wu as PerformanceManager,$e as Permissions,Fr as PersonalizeClient,fs as Phone,Lp as PhoneAdvanced,ms as PhoneHandlers,yS as PlacementService,hS as PlacementStore,Lr as PollyClient,jt as PorkbunProvider,Wy as PreDeployScanner,xl as PreviewEnvironmentManager,tg as PreviewEnvironmentService,eg as PreviewEnvironmentStore,_l as PreviewNotificationService,jl as ProgressBar,Du as ProgressiveDeploymentManager,oi as ProtectionControlStore,qa as Pseudo,te as Queue,qf as QueueCancellationError,Hp as QueueManagementManager,Oa as QueuePresets,Jf as QueueTimeoutError,Jn as RATE_LIMIT_KEY_SEPARATOR,Ir as RDSClient,Wd as RECOMMENDED_ACCOUNT_STRUCTURES,zd as RECOMMENDED_SCPS,Ig as RELEASE_QUEUE_KINDS,cd as REPL,dd as REPLCommandBuilder,ld as REPLContext,ml as RateLimiter,Na as RealtimePresets,oy as RecordingSpendTransport,ht as RecursionGuard,Z as Redirects,Cd as RegionPairManager,PS as RegionService,$S as RegionStore,ds as Registry,kr as RekognitionClient,Rg as ReleaseService,bg as ReleaseStore,CS as RemoteBuildService,_u as ReplicaManager,Wm as ResourceManagementManager,Yf as RetryableOperationError,j as Route53Client,Ut as Route53DomainsClient,rr as Route53Provider,Tp as Route53ResolverManager,Sp as Route53RoutingManager,vC as RuntimeOperationService,OC as RuntimeStreamRegistry,ZS as S3BackupDestinationAdapter,bt as S3Client,Ec as S3Error,By as SECRET_PATTERNS,Bh as SENSITIVITY_THRESHOLDS,Rt as SESClient,Cs as SMS,Ar as SNSClient,Iy as SPEND_CYCLE_SECONDS,ey as SPEND_GATE_SETTING,Ty as SPEND_LEASE_SETTING,br as SQSClient,Cr as SSMClient,xa as STATE_DIR_ENV_VAR,W as STATIC_SITE_ZONE_SETTINGS,Vt as STSClient,Wr as SchedulerClient,De as Search,Ky as SecretFindingScanner,$s as Secrets,Zu as SecretsManager,Sr as SecretsManagerClient,Ku as SecretsRotationManager,ee as Security,Su as SecurityHubManager,_y as SecurityPostureStore,Gy as SecurityScannerRunner,Yu as SecurityScanningManager,wp as SenderReputationManager,WC as ServerCronJobAdapter,tS as ServerDataAdapter,mg as ServerPathVolumeDriver,op as ServiceMeshManager,Te as Sftp,Kh as SignalSource,Mp as SmsAdvanced,Hr as SmsClient,ys as SmsHandlers,Eg as SourceConnectionStore,wg as SourceProviderError,ry as SpendCapError,ty as SpendGate,$y as SpendLoopLease,Ry as SpendNotificationRouter,Py as SpendRunner,Qh as SpendService,Sh as SpendStore,Jl as Spinner,dS as SshFleetDriver,Sd as StackDependencyManager,hs as StacksIntegration,km as StaticSiteManager,X as Storage,Lm as StorageAdvancedManager,Kr as SupportClient,Lu as SyntheticsManager,lS as SystemFleetSshTransport,TC as SystemdDiscoveryAdapter,ut as TRACE_HEADER,Yl as TaskList,Cy as TelemetryStore,Se as TemplateBuilder,Yc as TemplateCache,xr as TextractClient,wr as TranscribeClient,Mr as TranslateClient,WS as TransportDisasterRecoveryDriver,_S as TransportPlatformMaintenanceDriver,AS as TransportRemoteBuildDriver,Uy as TrivyImageScanner,xf as TsCloudApiError,Lf as TsCloudClient,Sy as URGENT_SPEND_EVENTS,Eh as USER_VISIBLE_ACTIONS,ES as UnavailableRegionalDriver,sr as UnifiedDnsValidator,Tf as UnsupportedSchemaVersionError,xc as ValidationError,Gr as VoiceClient,dg as VolumeService,og as VolumeStore,As as Workflow,wu as XRayManager,Iu as abTestManager,$g as activateImmutableRelease,mC as ageSeconds,hh as aggregateDeltas,cs as analyzeStackDiff,_h as anomalyOptionsForSignal,ci as applyControlsToDdos,si as applyControlsToRateLimits,Ft as applyMitigationFactor,or as applyZoneMigration,qp as artifactKey,Ag as assertReleaseStrategy,ny as assertSpendAllows,Xy as attachProvenanceToRelease,Jy as attachSbomToRelease,Yy as attachVulnerabilitySummary,cf as authEncryptionKeyFile,Sf as authorizeOrganization,EC as authorizeRuntimePath,nd as autocomplete,fu as awsConfigManager,US as backupCredentialStatus,du as backupManager,cl as batch,zp as batchProcessingManager,pf as beginOidcAuthorization,Ru as blueGreenManager,Ip as bounceComplaintHandler,sh as budgetWindow,Si as buildAndPushServerlessImage,lm as buildBunRuntimeLayerZip,Os as buildCloudFormationTemplate,Zf as buildComposeLogsCommand,Kf as buildComposeRuntimeCommand,Uf as buildComposeScaleCommand,jf as buildComposeShellCommand,bi as buildFunctionEnv,_n as buildHostCleanupScript,Za as buildMailEnv,Kn as buildManagementDashboardArtifact,Fi as buildMediaCdnPlan,Xr as buildMtaStsPolicy,tn as buildMtaStsServer,cm as buildNodeRuntimeLayerZip,rp as buildOptimizationManager,ce as buildOriginGuardRule,Em as buildPhpRuntimeLayerZip,Fn as buildSiteDeployScript,In as buildSshArgs,se as buildStaticSiteCacheRules,Vn as buildStaticSiteDeployScript,fC as bytes,$u as canaryManager,wS as canonicalJson,dC as capabilities,gS as capacity,Sl as categorizeChanges,Ju as certificateManager,Hc as checkIAMPermissions,gm as checkInvocation,Zc as checkServiceQuotas,fl as chunk,eo as cleanupDns01Challenge,Da as clearSigningKeyCache,_g as cloneSourceBinding,Rl as cloudConfigSchema,Pn as cloudDrivers,hu as cloudTrailManager,Om as collectPhpAppEntries,Zr as collectServerDnsDomains,hg as completeComposeVolumeDeletion,mf as completeOidcAuthorization,lc as composePresets,Gf as composeProjectName,tm as composeServerlessAppTemplate,vy as compositeSpendTransport,YS as compressBackup,Um as config,qC as connectionGuidance,ip as containerRegistryManager,$f as controlPlaneDatabaseFile,gf as controlPlaneMigrations,Vs as createApiBackendPreset,Vy as createApiV1Handler,TS as createAsgBuildDriver,qS as createBackupQueueHandlers,Rm as createCliHandler,Tn as createCloudDriver,Ce as createCloudFrontPolicy,$c as createCredentialProvider,js as createDashboardSite,Hs as createDataPipelinePreset,YC as createDataServiceQueueHandlers,ig as createDeploymentQueueHandlers,q as createDnsProvider,RS as createEcsBuildDriver,iy as createEnforcementHandlers,Vc as createError,Ms as createExistingStaticFullStackPreset,uS as createFleetQueueHandlers,Fs as createFullStackAppPreset,lr as createGoDaddyValidator,Tm as createHandlers,Am as createHttpHandler,Bs as createJamstackPreset,UC as createJobQueueHandlers,Us as createLaravelPreset,Gs as createMLApiPreset,VS as createMaintenanceQueueHandlers,xi as createMediaAccessToken,Ws as createMicroservicesPreset,kl as createMockAWS,ks as createNodeJsServerPreset,xs as createNodeJsServerlessPreset,Gt as createObjectStorageClient,cr as createPorkbunValidator,dc as createPreset,Aa as createPresignedUrl,ba as createPresignedUrlAsync,bm as createQueueHandler,zs as createRealtimeAppPreset,IS as createRegionQueueHandlers,Qy as createReleaseProvenance,Dg as createReleaseQueueHandlers,SS as createRemoteBuildQueueHandlers,dr as createRoute53Validator,IC as createRuntimeAdapters,wc as createS3Client,bS as createServerBuildDriver,Zs as createServerlessLaravelPreset,Ls as createServerlessNodePreset,xg as createSourceAdapter,Ns as createStaticSitePreset,Ks as createTraditionalWebAppPreset,ug as createVolumeQueueHandlers,_s as createWordPressPreset,Kp as createZip,Ad as crossRegionReferenceManager,Ei as dashboardActions,Wn as dashboardCredentialsFile,ZC as dataServiceCapabilities,Gu as databaseUserManager,jm as decodeBase32,QS as decompressBackup,KS as decryptBackup,Hm as defaultConfig,$l as defaultLocalConfig,ri as defaultRateLimitRules,hi as deleteStaticSite,Zn as deployAllComputeSites,Ri as deployServerlessApp,Ci as deploySite,Un as deploySiteRelease,mi as deployStaticSite,yi as deployStaticSiteFull,di as deployStaticSiteWithExternalDns,ui as deployStaticSiteWithExternalDnsFull,za as deploymentCoexistenceError,Xs as deriveManagementDashboardPort,ai as describePosture,BC as desiredJobProviderState,Fh as detectAnomalies,Ba as detectDeploymentTargets,ur as detectDnsProvider,Vh as detectLatestAnomaly,Wc as detectMisconfigurations,ya as detectServiceRegion,Vf as diffCompose,hl as diffTemplates,Vg as discoverGitRefs,uf as discoverOidcProvider,gC as discoverRuntimeInventory,Bp as dlqMonitoringManager,mr as dnsProviders,Rp as dnssecManager,SC as dockerWorkloads,OS as documentDigest,pu as drManager,hC as ecsWorkloads,Af as effectiveCapabilities,Ep as emailAnalyticsManager,Np as emailTemplateManager,Zm as encodeBase32,GS as encryptBackup,rC as ensureDefaultSecurityPolicies,kn as ensureFirewall,Gn as ensureManagementDashboard,xn as ensureServer,Nn as ensureSshKey,dn as escapeSecLang,Ph as evaluateBudget,wt as evaluateTelemetryAlertRules,FC as eventBridgeScheduleInput,Cm as eventToRequest,Mh as ewma,Ff as exportCompose,nr as exportRoute53Zone,cc as extendPreset,Vp as fifoQueueManager,ol as findChangedFiles,ph as findMapping,Yg as findPriceEntry,Zd as formatAccountStructure,Gl as formatBytes,Ay as formatCents,ls as formatDiff,Kl as formatDuration,od as formatFlagSuggestions,pd as formatHistory,md as formatHistoryStats,Zl as formatKeyValue,Ul as formatList,Hl as formatProgressBar,xd as formatRegion,Ld as formatRegionList,Hy as formatScanResults,Xl as formatSuggestion,Wl as formatTable,Rh as formatTimeToExhaustion,zl as formatTree,Ac as fromEC2Metadata,bc as fromECSMetadata,Cc as fromEnvironment,Sc as fromSharedCredentials,Rc as fromWebIdentity,pt as functionFingerprint,pe as gatewayHostnames,am as generateAppImageDockerfile,su as generateApprovalConfig,Up as generateBootstrap,Fl as generateCleanupWorkflow,Vl as generateCostReportWorkflow,Kd as generateCrossAccountRoleCF,jy as generateCycloneDxSbom,iu as generateDeploymentConfig,Xd as generateDeploymentPipeline,jd as generateDeploymentWorkflow,li as generateExternalDnsStaticSiteTemplate,Qi as generateHttpsServerCode,qy as generateImageSbom,Yi as generateLetsEncryptUserData,be as generateLogicalId,nu as generateManualPipeline,Qd as generateMatrixWorkflow,ou as generateMultiEnvConfig,eu as generateMultiEnvPipeline,qd as generateMultiEnvWorkflow,Jd as generatePRPreviewWorkflow,cu as generateParallelConfig,$m as generatePhpFpmConfig,om as generatePhpLayerDockerfile,tu as generatePreviewPipeline,Ml as generatePreviewWorkflow,Ae as generateResourceName,au as generateScheduledConfig,ru as generateScheduledPipeline,Yd as generateScheduledWorkflow,pi as generateStaticSiteTemplate,hn as generateUbuntuAppCloudInit,Dc as getAccountId,Id as getAllRegions,Od as getClosestRegion,ad as getCommandUsage,Bf as getComposeTemplate,Gm as getConfig,td as getContextualHelp,Tc as getCredentials,Al as getDeploymentStrategy,bl as getDiffStats,yl as getDiffSummary,Fc as getErrorDetails,Pl as getLocalConfig,El as getLocalCredentials,Dl as getLocalEndpoint,wl as getLocalEnvVars,jc as getQuotaUsageSummary,Gd as getRecommendedStructure,Pd as getRegion,Md as getRegionStats,Ed as getRegionsByCompliance,Dd as getRegionsByLocation,wd as getRegionsByPricingTier,Gc as getRequiredPermissions,Ea as getSigningKeyCacheSize,Ja as getTimestamp,Yn as globMatches,pn as globToRegex,bd as globalResourceManager,$h as governingLimitCents,Cu as guardDutyManager,xy as handleSpendRequest,ln as hasAutoWwwVariant,rc as hasManagementDashboardSite,nn as hasProxyUpstream,tl as hashBuffer,rl as hashDirectory,Xc as hashFile,nl as hashManifest,el as hashString,Vm as healthCheckManager,ue as hostAcceptsIpv6,ae as hostCondition,qm as hotp,lh as hourBucket,dh as hourBucketsBetween,ep as imageScanningManager,Ai as infraEnvFromOutputs,gt as inspectInvocation,pm as installRecursionFetch,gi as invalidateCache,dm as invocationContext,ed as isLikelyTypo,Il as isLocalDevelopment,oc as isManagementDashboardSiteName,wa as isNodeCryptoAvailable,Nh as isOperationAllowed,It as isQuietHours,un as isSafePattern,_a as isStatePath,Ot as isValidCidr,vd as isValidRegion,nh as isValidTimeZone,va as isWebCryptoAvailable,LC as jobProviderCapability,Bt as keyMatchesFilters,pp as lambdaConcurrencyManager,Cp as lambdaDLQManager,fp as lambdaDestinationsManager,cp as lambdaLayersManager,hp as lambdaVPCManager,dp as lambdaVersionsManager,yC as lambdaWorkloads,Im as laravelServerlessEnvDefaults,_f as listComposeTemplates,zg as listSourceReferences,Km as loadCloudConfig,ly as loadTelemetryPolicy,xu as logsManager,Zh as lookbackHoursForSignal,Ga as mailEnabled,Ua as mailFirewallPorts,MS as maintenanceWindowOpen,Ra as makeAWSRequest,$a as makeAWSRequestAsync,Ta as makeAWSRequestOnce,ic as managementDashboardSiteName,vS as manifestDigest,Qm as matchTotpCounter,Mi as mediaObjectHeaders,kh as median,xh as medianAbsoluteDeviation,Ih as mergeDecisions,uc as mergeInfrastructure,th as mergePriceBooks,gh as meterTelemetry,Nu as metricsManager,Wt as migrateObjectStorage,Vu as migrationManager,_d as multiAccountManager,gd as multiRegionManager,to as needsRenewal,Bm as networkSecurityManager,kC as nextScheduleRuns,qr as normalizePublicIpv6,uC as normalizeRuntimeStatus,NC as normalizeScheduleExpression,Lg as normalizeSourceEvent,An as normalizeSshPublicKey,sy as normalizeTelemetryPolicy,Fy as openApiDocument,Uh as optionsForSignal,Bd as organizationManager,Nm as packagePhpApp,Jp as packageServerlessApp,sl as parallel,ll as parallelMap,dl as parallelWithRetry,ft as parseChain,Mf as parseCompose,zf as parseComposeCatalog,CC as parseDockerInspect,sA as parseDotenv,Ia as parseJSONResponse,bC as parseSystemdRecords,Pa as parseXMLResponse,fy as pathTemplate,bh as percentOfLimit,zu as performanceManager,im as phpLayerBuildStage,nm as phpLayerPackages,Pm as phpRuntimeLayerAssets,Hf as planComposeTemplateUpgrade,wh as planEnforcement,Mt as planMitigation,ir as planZoneMigration,Qt as policyTag,Ll as previewManager,Bl as previewNotifications,xC as previewSchedule,ch as previousBudgetWindow,Qg as priceUsage,Xg as priceUsageLines,de as probeOriginTls,gl as processInChunks,Mg as processSourceWebhook,aC as productionChangeReview,Eu as progressiveDeploymentManager,Ah as projectSpend,yt as propagationHeaders,zt as providerEndpoint,NS as publicKeyFingerprint,Xt as qualifyName,Gp as queueManagementManager,il as quickHash,ti as rateLimitHeaders,Xn as rateLimitKey,Yr as reconcileAddressRecords,at as reconcileCloudflareCdn,tr as reconcileDeclaredRecords,VC as reconcileJobObservation,Hg as reconcileSourceWebhook,oC as recordDashboardHostPosture,nC as recordPreDeploySecretScan,iC as recordSkippedSecretScan,Ct as recursionBlockedResponse,pC as redactRuntimeConfig,py as redactTelemetryText,my as redactTelemetryValue,Ti as redeployServerlessApp,Rd as regionPairManager,Sg as releaseStrategyCapabilities,Tg as releaseTrafficPlan,jn as reloadRpxGateway,_t as remapKey,Gg as removeSourceWebhook,jr as removeStaleServerAddressRecords,Wf as renderComposeTemplate,Lt as renderDdosInstallScript,xt as renderNftablesRuleset,MC as renderServerCron,kt as renderSysctlFile,mn as renderWafConfig,fn as renderWafInstallScript,qn as renewRpxCertificates,Bu as replicaManager,Ny as requestHash,Cl as requiresReplacement,fm as resetRecursionRuntime,ym as resolveApp,Ha as resolveAppDatabase,lf as resolveAuthEncryptionKey,ja as resolveCloudProvider,ct as resolveCloudflareCdnPlan,Pc as resolveCredentials,wi as resolveDashboardAction,zn as resolveDashboardAuth,ec as resolveDashboardDomain,tc as resolveDashboardDomains,er as resolveDeclaredRecords,ns as resolveDeployBucketName,Wa as resolveDeploymentMode,Mn as resolveExecStart,Sn as resolveHetznerApiToken,Ka as resolveMailService,sc as resolveManagementDashboardSite,ac as resolveManagementDashboardSites,Ht as resolveObjectStorage,Qa as resolveProjectStackName,rn as resolveProxyUpstreams,em as resolveQueueNames,ng as resolveQueuedDeploymentCommand,Xp as resolveQueues,um as resolveRecursionConfig,Ic as resolveRegion,DC as resolveRuntimeInventory,is as resolveServerlessAppStackName,os as resolveServerlessArtifactBucketName,as as resolveServerlessAssetBucketName,Qp as resolveServerlessRuntime,ts as resolveSiteBucketName,on as resolveSiteDeployTarget,an as resolveSiteKind,es as resolveSiteResourceName,Xa as resolveSiteStackName,Va as resolveStatePath,rs as resolveStorageBucketName,Hn as resolveUiSource,xe as resolveZoneApex,zm as resourceManagementManager,Sm as responseToResult,Lh as robustZScore,yf as roleCapabilities,Pg as rollbackImmutableRelease,$i as rollbackServerlessApp,eh as roundCents,$p as route53ResolverManager,Ap as route53RoutingManager,Wh as routeMatches,Qn as ruleMatches,Zp as runBuildHooks,vh as runEnforcement,vm as runPhpBuildHooks,Ii as runRemoteCommand,cC as runtimeId,Di as sanitizeCloudConfig,Df as sanitizeControlPlaneValue,Ya as sanitizeName,df as sanitizeOidcReturnPath,dy as saveTelemetryPolicy,zy as scanForSecrets,Cf as scopeContains,yh as scopeKey,wn as scpUpload,rd as searchCommands,wf as searchControlPlane,ju as secretsManager,Uu as secretsRotationManager,sC as secureContainerRelease,Au as securityHubManager,Qu as securityScanningManager,tC as securityScope,sf as sendAuthenticationEmail,vp as senderReputationManager,ul as sequence,cA as serializeDotenv,Ln as serverPublicIpv4,ap as serviceMeshManager,Pi as setMaintenance,La as setStateDir,Xi as setupDns01Challenge,jp as sha256,mm as sharedRecursionGuard,sm as sharedRuntimeLoop,cn as shipsARelease,ki as signCloudFrontCookies,Ni as signCloudFrontUrl,Ca as signRequest,Sa as signRequestAsync,Gh as signalDefinition,by as spendNotificationText,Ly as spendOpenApiPaths,Dn as sshExec,En as sshExecOrThrow,Td as stackDependencyManager,vi as startLocalDashboardServer,Dy as startSpendLoop,Ma as stateDir,Fa as statePath,xm as staticSiteManager,Mm as storageAdvancedManager,Yh as streamFocusJsonl,Oh as strongestActiveAction,Ql as suggestCommand,id as suggestFlags,Kc as suggestIAMPolicy,qc as suggestQuotaIncrease,kd as suggestRegionPairs,Nd as suggestRegions,Wg as syncSourceRepositories,gg as synchronizeComposeVolumes,fA as synchronizeConfiguredConfiguration,GC as synchronizeConfiguredJobs,Mu as syntheticsManager,Nt as sysctlHardening,RC as systemdWorkloads,yy as telemetryBucketLabel,gy as telemetryCursor,uy as telemetryEstimatedMonthlyCost,hy as telemetryPercentile,cy as telemetryPolicyKey,Qc as templateCache,Bg as testSourceConnection,Jg as tieredMicroCents,le as toCloudflareZoneSettings,Jh as toFocusJsonl,qh as toFocusRecords,Jm as totp,Xm as totpUri,lC as unsupportedCapabilities,ag as unsupportedVolumeCapabilities,xS as updateCompatibility,fi as uploadStaticFiles,mh as usageDeltaKey,ah as utcInstantOfLocal,Ud as validateAccountStructure,Tl as validateAgainstSchema,lg as validateAttachment,zS as validateBackupDestination,sd as validateCommand,Bc as validateConfiguration,zc as validateCredentials,sn as validateDeploymentConfig,cg as validateMountPath,qe as validateResourceLimits,He as validateTemplate,je as validateTemplateSize,Qr as verifyAddressRecord,eC as verifyArtifactSignature,Li as verifyMediaAccessToken,Ym as verifyTotp,kS as verifyUpdateSignature,ar as verifyZoneParity,sg as volumeCapabilities,gn as wafEventTelemetry,On as waitForCloudInit,vn as waitForSsh,Fg as webhookEndpoint,hc as withCDN,gc as withCache,fc as withDatabase,hm as withInvocation,pc as withMonitoring,yc as withQueue,mc as withSecurity,pl as withTimeout,bn as wrapCloudInitUserData,vu as xrayManager,fS as zeroCapacity,Xh as zeroFill,oh as zoneOffsetMs,ih as zonedParts};

package/dist/protection/index.js

@@ -1 +1 @@
-import{$k as C,Xk as y,Yk as z,Zk as A,_k as B,al as D,bl as E,cl as F,dl as G,el as H,fl as I,gl as J,hl as K,il as L,jl as M}from"../chunk-vz95qy3n.js";import{kl as s,ll as t,ml as u,nl as v,ol as w,pl as x}from"../chunk-r5natbed.js";import{ql as k,rl as l,sl as m,tl as n,ul as o,vl as p,wl as q,xl as r}from"../chunk-b10cbk8z.js";import{Ks as a,Ls as b,Ms as c,Ns as d,Os as e,Ps as f,Qs as g,Rs as h,Ss as i,Ts as j}from"../chunk-0hj552t7.js";import"../chunk-spx89gaw.js";export{b as CHAIN_HEADER,H as DEFAULT_ATTACK_MODE_HOURS,k as DEFAULT_DDOS_THRESHOLDS,e as DEFAULT_RECURSION_LIMITS,a as DEPTH_HEADER,G as MAX_CONTROL_HOURS,F as PROTECTION_SETTING,I as ProtectionControlStore,y as RATE_LIMIT_KEY_SEPARATOR,C as RateLimiter,h as RecursionGuard,c as TRACE_HEADER,L as applyControlsToDdos,K as applyControlsToRateLimits,r as applyMitigationFactor,E as defaultRateLimitRules,J as describePosture,s as escapeSecLang,d as functionFingerprint,z as globMatches,u as globToRegex,g as inspectInvocation,t as isSafePattern,l as isValidCidr,M as mergeControlsIntoConfig,f as parseChain,q as planMitigation,i as propagationHeaders,D as rateLimitHeaders,B as rateLimitKey,j as recursionBlockedResponse,p as renderDdosInstallScript,o as renderNftablesRuleset,n as renderSysctlFile,v as renderWafConfig,w as renderWafInstallScript,A as ruleMatches,m as sysctlHardening,x as wafEventTelemetry};
+import{$k as z,_k as y,al as A,bl as B,cl as C,dl as D,el as E,fl as F,gl as G,hl as H,il as I,jl as J,kl as K,ll as L,ml as M}from"../chunk-1qdne0bf.js";import{nl as s,ol as t,pl as u,ql as v,rl as w,sl as x}from"../chunk-hn40z11p.js";import{Al as r,tl as k,ul as l,vl as m,wl as n,xl as o,yl as p,zl as q}from"../chunk-x3hay61c.js";import{Ns as a,Os as b,Ps as c,Qs as d,Rs as e,Ss as f,Ts as g,Us as h,Vs as i,Ws as j}from"../chunk-zz52xje8.js";import"../chunk-z2qqwy7e.js";export{b as CHAIN_HEADER,H as DEFAULT_ATTACK_MODE_HOURS,k as DEFAULT_DDOS_THRESHOLDS,e as DEFAULT_RECURSION_LIMITS,a as DEPTH_HEADER,G as MAX_CONTROL_HOURS,F as PROTECTION_SETTING,I as ProtectionControlStore,y as RATE_LIMIT_KEY_SEPARATOR,C as RateLimiter,h as RecursionGuard,c as TRACE_HEADER,L as applyControlsToDdos,K as applyControlsToRateLimits,r as applyMitigationFactor,E as defaultRateLimitRules,J as describePosture,s as escapeSecLang,d as functionFingerprint,z as globMatches,u as globToRegex,g as inspectInvocation,t as isSafePattern,l as isValidCidr,M as mergeControlsIntoConfig,f as parseChain,q as planMitigation,i as propagationHeaders,D as rateLimitHeaders,B as rateLimitKey,j as recursionBlockedResponse,p as renderDdosInstallScript,o as renderNftablesRuleset,n as renderSysctlFile,v as renderWafConfig,w as renderWafInstallScript,A as ruleMatches,m as sysctlHardening,x as wafEventTelemetry};

package/dist/push/index.js

@@ -1 +1 @@
-import"../chunk-spx89gaw.js";import*as h from"node:http2";import{createSign as b}from"node:crypto";var f="api.push.apple.com",k="api.sandbox.push.apple.com",S=2700000;class R{config;token=null;tokenGeneratedAt=0;client=null;host;constructor(e){this.config=e,this.host=e.production?f:k}generateToken(){let e=Math.floor(Date.now()/1000);if(this.token&&Date.now()-this.tokenGeneratedAt<S)return this.token;let t={alg:"ES256",kid:this.config.keyId},s={iss:this.config.teamId,iat:e},r=Buffer.from(JSON.stringify(t)).toString("base64url"),n=Buffer.from(JSON.stringify(s)).toString("base64url"),i=`${r}.${n}`,o=b("SHA256");o.update(i);let a=o.sign(this.config.privateKey),l=this.derToRaw(a).toString("base64url");return this.token=`${i}.${l}`,this.tokenGeneratedAt=Date.now(),this.token}derToRaw(e){let t=2;if(e[t]!==2)throw Error("Invalid DER signature: expected 0x02 for R");t++;let s=e[t];t++;let r=e.subarray(t,t+s);if(t+=s,e[t]!==2)throw Error("Invalid DER signature: expected 0x02 for S");t++;let n=e[t];t++;let i=e.subarray(t,t+n);if(r[0]===0&&r.length===33)r=r.subarray(1);if(i[0]===0&&i.length===33)i=i.subarray(1);let o=Buffer.alloc(64);return r.copy(o,32-r.length),i.copy(o,64-i.length),o}async getClient(){if(this.client&&!this.client.destroyed)return this.client;return new Promise((e,t)=>{this.client=h.connect(`https://${this.host}`),this.client.on("error",(s)=>{t(s)}),this.client.on("connect",()=>{e(this.client)}),this.client.on("close",()=>{this.client=null})})}buildPayload(e){let t={};if(e.title||e.body||e.subtitle){if(t.alert={},e.title)t.alert.title=e.title;if(e.subtitle)t.alert.subtitle=e.subtitle;if(e.body)t.alert.body=e.body}if(e.badge!==void 0)t.badge=e.badge;if(e.sound!==void 0)t.sound=e.sound;if(e.category)t.category=e.category;if(e.threadId)t["thread-id"]=e.threadId;if(e.contentAvailable)t["content-available"]=1;if(e.mutableContent)t["mutable-content"]=1;if(e.targetContentId)t["target-content-id"]=e.targetContentId;let s={aps:t};if(e.data)Object.assign(s,e.data);return s}async send(e){try{let t=await this.getClient(),s=this.generateToken(),r=JSON.stringify(this.buildPayload(e)),n={":method":"POST",":path":`/3/device/${e.deviceToken}`,authorization:`bearer ${s}`,"apns-topic":this.config.bundleId,"apns-push-type":e.pushType||"alert","apns-priority":String(e.priority||10)};if(e.expiration!==void 0)n["apns-expiration"]=String(e.expiration);if(e.collapseId)n["apns-collapse-id"]=e.collapseId;return new Promise((i)=>{let o=t.request(n),a="",d=0,l;o.on("response",(c)=>{d=c[":status"],l=c["apns-id"]}),o.on("data",(c)=>{a+=c.toString()}),o.on("end",()=>{if(d===200)i({success:!0,deviceToken:e.deviceToken,apnsId:l,statusCode:d});else{let c="Unknown error",g,u;if(a)try{let p=JSON.parse(a);g=p.reason,u=p.timestamp,c=g||c}catch{c=a}i({success:!1,deviceToken:e.deviceToken,apnsId:l,statusCode:d,error:c,reason:g,timestamp:u})}}),o.on("error",(c)=>{i({success:!1,deviceToken:e.deviceToken,error:c.message})}),o.write(r),o.end()})}catch(t){return{success:!1,deviceToken:e.deviceToken,error:t.message}}}async sendBatch(e,t){let s=t?.concurrency||10,r=[];for(let n=0;n<e.length;n+=s){let i=e.slice(n,n+s),o=await Promise.all(i.map((a)=>this.send(a)));r.push(...o)}return{sent:r.filter((n)=>n.success).length,failed:r.filter((n)=>!n.success).length,results:r}}async sendSimple(e,t,s,r){return this.send({deviceToken:e,title:t,body:s,data:r})}async sendSilent(e,t){return this.send({deviceToken:e,contentAvailable:!0,pushType:"background",priority:5,data:t})}close(){if(this.client)this.client.close(),this.client=null;this.token=null,this.tokenGeneratedAt=0}}import{createSign as T}from"node:crypto";var C="https://fcm.googleapis.com/v1/projects",y="https://oauth2.googleapis.com/token",P=3300000;class m{config;accessToken=null;tokenExpiresAt=0;constructor(e){this.config=e}static fromServiceAccount(e){return new m({projectId:e.project_id,clientEmail:e.client_email,privateKey:e.private_key})}generateJWT(){let e=Math.floor(Date.now()/1000),t=e+3600,s={alg:"RS256",typ:"JWT"},r={iss:this.config.clientEmail,sub:this.config.clientEmail,aud:y,iat:e,exp:t,scope:"https://www.googleapis.com/auth/firebase.messaging"},n=Buffer.from(JSON.stringify(s)).toString("base64url"),i=Buffer.from(JSON.stringify(r)).toString("base64url"),o=`${n}.${i}`,a=T("SHA256");a.update(o);let d=a.sign(this.config.privateKey,"base64url");return`${o}.${d}`}async getAccessToken(){if(this.accessToken&&Date.now()<this.tokenExpiresAt)return this.accessToken;let e=this.generateJWT(),t=await fetch(y,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:e}).toString()});if(!t.ok){let r=await t.text();throw Error(`Failed to get access token: ${r}`)}let s=await t.json();return this.accessToken=s.access_token,this.tokenExpiresAt=Date.now()+P,this.accessToken}buildMessage(e){let t={};if(e.token)t.token=e.token;else if(e.topic)t.topic=e.topic;else if(e.condition)t.condition=e.condition;if(e.title||e.body||e.imageUrl){if(t.notification={},e.title)t.notification.title=e.title;if(e.body)t.notification.body=e.body;if(e.imageUrl)t.notification.image=e.imageUrl}if(e.data&&Object.keys(e.data).length>0)t.data=e.data;if(e.android){if(t.android={priority:e.android.priority||"high"},e.android.ttl)t.android.ttl=`${e.android.ttl}s`;if(e.android.collapseKey)t.android.collapse_key=e.android.collapseKey;if(e.android.directBootOk)t.android.direct_boot_ok=e.android.directBootOk;let s={};if(e.android.channelId)s.channel_id=e.android.channelId;if(e.android.icon)s.icon=e.android.icon;if(e.android.color)s.color=e.android.color;if(e.android.sound)s.sound=e.android.sound;if(e.android.clickAction)s.click_action=e.android.clickAction;if(e.android.tag)s.tag=e.android.tag;if(e.android.visibility)s.visibility=e.android.visibility;if(e.android.notificationCount!==void 0)s.notification_count=e.android.notificationCount;if(Object.keys(s).length>0)t.android.notification=s}if(e.webpush)t.webpush=e.webpush;if(e.apns)t.apns=e.apns;if(e.fcmOptions)t.fcm_options=e.fcmOptions;return{message:t}}async send(e){try{let t=await this.getAccessToken(),s=this.buildMessage(e),r=await fetch(`${C}/${this.config.projectId}/messages:send`,{method:"POST",headers:{Authorization:`Bearer ${t}`,"Content-Type":"application/json"},body:JSON.stringify(s)}),n=await r.json();if(r.ok)return{success:!0,messageId:n.name};else return{success:!1,error:n.error?.message||"Unknown error",errorCode:n.error?.status}}catch(t){return{success:!1,error:t.message}}}async sendBatch(e,t,s){let r=s?.concurrency||10,n=[];for(let i=0;i<e.length;i+=r){let a=e.slice(i,i+r).map(async(l)=>({...await this.send({...t,token:l}),token:l})),d=await Promise.all(a);n.push(...d)}return{sent:n.filter((i)=>i.success).length,failed:n.filter((i)=>!i.success).length,results:n}}async sendToTopic(e,t){return this.send({...t,topic:e})}async sendToCondition(e,t){return this.send({...t,condition:e})}async sendSimple(e,t,s,r){return this.send({token:e,title:t,body:s,data:r})}async sendSilent(e,t){return this.send({token:e,data:t,android:{priority:"high"}})}async subscribeToTopic(e,t){try{let s=await this.getAccessToken(),r=await fetch("https://iid.googleapis.com/iid/v1:batchAdd",{method:"POST",headers:{Authorization:`Bearer ${s}`,"Content-Type":"application/json"},body:JSON.stringify({to:`/topics/${t}`,registration_tokens:e})});if(r.ok)return{success:!0};else return{success:!1,error:(await r.json()).error?.message||"Failed to subscribe"}}catch(s){return{success:!1,error:s.message}}}async unsubscribeFromTopic(e,t){try{let s=await this.getAccessToken(),r=await fetch("https://iid.googleapis.com/iid/v1:batchRemove",{method:"POST",headers:{Authorization:`Bearer ${s}`,"Content-Type":"application/json"},body:JSON.stringify({to:`/topics/${t}`,registration_tokens:e})});if(r.ok)return{success:!0};else return{success:!1,error:(await r.json()).error?.message||"Failed to unsubscribe"}}catch(s){return{success:!1,error:s.message}}}}export{R as APNsClient,m as FCMClient};
+import"../chunk-z2qqwy7e.js";import*as h from"node:http2";import{createSign as b}from"node:crypto";var f="api.push.apple.com",k="api.sandbox.push.apple.com",S=2700000;class R{config;token=null;tokenGeneratedAt=0;client=null;host;constructor(e){this.config=e,this.host=e.production?f:k}generateToken(){let e=Math.floor(Date.now()/1000);if(this.token&&Date.now()-this.tokenGeneratedAt<S)return this.token;let t={alg:"ES256",kid:this.config.keyId},s={iss:this.config.teamId,iat:e},r=Buffer.from(JSON.stringify(t)).toString("base64url"),n=Buffer.from(JSON.stringify(s)).toString("base64url"),i=`${r}.${n}`,o=b("SHA256");o.update(i);let a=o.sign(this.config.privateKey),l=this.derToRaw(a).toString("base64url");return this.token=`${i}.${l}`,this.tokenGeneratedAt=Date.now(),this.token}derToRaw(e){let t=2;if(e[t]!==2)throw Error("Invalid DER signature: expected 0x02 for R");t++;let s=e[t];t++;let r=e.subarray(t,t+s);if(t+=s,e[t]!==2)throw Error("Invalid DER signature: expected 0x02 for S");t++;let n=e[t];t++;let i=e.subarray(t,t+n);if(r[0]===0&&r.length===33)r=r.subarray(1);if(i[0]===0&&i.length===33)i=i.subarray(1);let o=Buffer.alloc(64);return r.copy(o,32-r.length),i.copy(o,64-i.length),o}async getClient(){if(this.client&&!this.client.destroyed)return this.client;return new Promise((e,t)=>{this.client=h.connect(`https://${this.host}`),this.client.on("error",(s)=>{t(s)}),this.client.on("connect",()=>{e(this.client)}),this.client.on("close",()=>{this.client=null})})}buildPayload(e){let t={};if(e.title||e.body||e.subtitle){if(t.alert={},e.title)t.alert.title=e.title;if(e.subtitle)t.alert.subtitle=e.subtitle;if(e.body)t.alert.body=e.body}if(e.badge!==void 0)t.badge=e.badge;if(e.sound!==void 0)t.sound=e.sound;if(e.category)t.category=e.category;if(e.threadId)t["thread-id"]=e.threadId;if(e.contentAvailable)t["content-available"]=1;if(e.mutableContent)t["mutable-content"]=1;if(e.targetContentId)t["target-content-id"]=e.targetContentId;let s={aps:t};if(e.data)Object.assign(s,e.data);return s}async send(e){try{let t=await this.getClient(),s=this.generateToken(),r=JSON.stringify(this.buildPayload(e)),n={":method":"POST",":path":`/3/device/${e.deviceToken}`,authorization:`bearer ${s}`,"apns-topic":this.config.bundleId,"apns-push-type":e.pushType||"alert","apns-priority":String(e.priority||10)};if(e.expiration!==void 0)n["apns-expiration"]=String(e.expiration);if(e.collapseId)n["apns-collapse-id"]=e.collapseId;return new Promise((i)=>{let o=t.request(n),a="",d=0,l;o.on("response",(c)=>{d=c[":status"],l=c["apns-id"]}),o.on("data",(c)=>{a+=c.toString()}),o.on("end",()=>{if(d===200)i({success:!0,deviceToken:e.deviceToken,apnsId:l,statusCode:d});else{let c="Unknown error",g,u;if(a)try{let p=JSON.parse(a);g=p.reason,u=p.timestamp,c=g||c}catch{c=a}i({success:!1,deviceToken:e.deviceToken,apnsId:l,statusCode:d,error:c,reason:g,timestamp:u})}}),o.on("error",(c)=>{i({success:!1,deviceToken:e.deviceToken,error:c.message})}),o.write(r),o.end()})}catch(t){return{success:!1,deviceToken:e.deviceToken,error:t.message}}}async sendBatch(e,t){let s=t?.concurrency||10,r=[];for(let n=0;n<e.length;n+=s){let i=e.slice(n,n+s),o=await Promise.all(i.map((a)=>this.send(a)));r.push(...o)}return{sent:r.filter((n)=>n.success).length,failed:r.filter((n)=>!n.success).length,results:r}}async sendSimple(e,t,s,r){return this.send({deviceToken:e,title:t,body:s,data:r})}async sendSilent(e,t){return this.send({deviceToken:e,contentAvailable:!0,pushType:"background",priority:5,data:t})}close(){if(this.client)this.client.close(),this.client=null;this.token=null,this.tokenGeneratedAt=0}}import{createSign as T}from"node:crypto";var C="https://fcm.googleapis.com/v1/projects",y="https://oauth2.googleapis.com/token",P=3300000;class m{config;accessToken=null;tokenExpiresAt=0;constructor(e){this.config=e}static fromServiceAccount(e){return new m({projectId:e.project_id,clientEmail:e.client_email,privateKey:e.private_key})}generateJWT(){let e=Math.floor(Date.now()/1000),t=e+3600,s={alg:"RS256",typ:"JWT"},r={iss:this.config.clientEmail,sub:this.config.clientEmail,aud:y,iat:e,exp:t,scope:"https://www.googleapis.com/auth/firebase.messaging"},n=Buffer.from(JSON.stringify(s)).toString("base64url"),i=Buffer.from(JSON.stringify(r)).toString("base64url"),o=`${n}.${i}`,a=T("SHA256");a.update(o);let d=a.sign(this.config.privateKey,"base64url");return`${o}.${d}`}async getAccessToken(){if(this.accessToken&&Date.now()<this.tokenExpiresAt)return this.accessToken;let e=this.generateJWT(),t=await fetch(y,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:e}).toString()});if(!t.ok){let r=await t.text();throw Error(`Failed to get access token: ${r}`)}let s=await t.json();return this.accessToken=s.access_token,this.tokenExpiresAt=Date.now()+P,this.accessToken}buildMessage(e){let t={};if(e.token)t.token=e.token;else if(e.topic)t.topic=e.topic;else if(e.condition)t.condition=e.condition;if(e.title||e.body||e.imageUrl){if(t.notification={},e.title)t.notification.title=e.title;if(e.body)t.notification.body=e.body;if(e.imageUrl)t.notification.image=e.imageUrl}if(e.data&&Object.keys(e.data).length>0)t.data=e.data;if(e.android){if(t.android={priority:e.android.priority||"high"},e.android.ttl)t.android.ttl=`${e.android.ttl}s`;if(e.android.collapseKey)t.android.collapse_key=e.android.collapseKey;if(e.android.directBootOk)t.android.direct_boot_ok=e.android.directBootOk;let s={};if(e.android.channelId)s.channel_id=e.android.channelId;if(e.android.icon)s.icon=e.android.icon;if(e.android.color)s.color=e.android.color;if(e.android.sound)s.sound=e.android.sound;if(e.android.clickAction)s.click_action=e.android.clickAction;if(e.android.tag)s.tag=e.android.tag;if(e.android.visibility)s.visibility=e.android.visibility;if(e.android.notificationCount!==void 0)s.notification_count=e.android.notificationCount;if(Object.keys(s).length>0)t.android.notification=s}if(e.webpush)t.webpush=e.webpush;if(e.apns)t.apns=e.apns;if(e.fcmOptions)t.fcm_options=e.fcmOptions;return{message:t}}async send(e){try{let t=await this.getAccessToken(),s=this.buildMessage(e),r=await fetch(`${C}/${this.config.projectId}/messages:send`,{method:"POST",headers:{Authorization:`Bearer ${t}`,"Content-Type":"application/json"},body:JSON.stringify(s)}),n=await r.json();if(r.ok)return{success:!0,messageId:n.name};else return{success:!1,error:n.error?.message||"Unknown error",errorCode:n.error?.status}}catch(t){return{success:!1,error:t.message}}}async sendBatch(e,t,s){let r=s?.concurrency||10,n=[];for(let i=0;i<e.length;i+=r){let a=e.slice(i,i+r).map(async(l)=>({...await this.send({...t,token:l}),token:l})),d=await Promise.all(a);n.push(...d)}return{sent:n.filter((i)=>i.success).length,failed:n.filter((i)=>!i.success).length,results:n}}async sendToTopic(e,t){return this.send({...t,topic:e})}async sendToCondition(e,t){return this.send({...t,condition:e})}async sendSimple(e,t,s,r){return this.send({token:e,title:t,body:s,data:r})}async sendSilent(e,t){return this.send({token:e,data:t,android:{priority:"high"}})}async subscribeToTopic(e,t){try{let s=await this.getAccessToken(),r=await fetch("https://iid.googleapis.com/iid/v1:batchAdd",{method:"POST",headers:{Authorization:`Bearer ${s}`,"Content-Type":"application/json"},body:JSON.stringify({to:`/topics/${t}`,registration_tokens:e})});if(r.ok)return{success:!0};else return{success:!1,error:(await r.json()).error?.message||"Failed to subscribe"}}catch(s){return{success:!1,error:s.message}}}async unsubscribeFromTopic(e,t){try{let s=await this.getAccessToken(),r=await fetch("https://iid.googleapis.com/iid/v1:batchRemove",{method:"POST",headers:{Authorization:`Bearer ${s}`,"Content-Type":"application/json"},body:JSON.stringify({to:`/topics/${t}`,registration_tokens:e})});if(r.ok)return{success:!0};else return{success:!1,error:(await r.json()).error?.message||"Failed to unsubscribe"}}catch(s){return{success:!1,error:s.message}}}}export{R as APNsClient,m as FCMClient};

package/dist/spend/index.js

@@ -1 +1 @@
-import{$i as b,$j as ca,Aj as C,Bj as D,Cj as E,Dj as F,Ej as G,Fj as H,Gj as I,Gk as qa,Hj as J,Hk as ra,Ij as K,Ik as sa,Jj as L,Jk as ta,Kj as M,Kk as ua,Lj as N,Lk as va,Mj as O,Mk as wa,Nj as P,Nk as xa,Oj as Q,Ok as ya,Pj as R,Pk as za,Qj as S,Qk as Aa,Rj as T,Rk as Ba,Sj as U,Tj as V,Uj as W,Vj as X,Vk as Ca,Wj as Y,Wk as Da,Xj as Z,Yj as _,Zj as aa,_i as a,_j as ba,aj as c,ak as da,bj as d,bk as ea,cj as e,ck as fa,dj as f,dk as ga,ej as g,ek as ha,fj as h,fk as ia,gj as i,gk as ja,hj as j,hk as ka,ij as k,ik as la,jj as l,jk as ma,kj as m,kk as na,lj as n,lk as oa,mj as o,mk as pa,nj as p,oj as q,pj as r,qj as s,rj as t,sj as u,tj as v,uj as w,vj as x,wj as y,xj as z,yj as A,zj as B}from"../chunk-s3rpd72x.js";import"../chunk-b10cbk8z.js";import"../chunk-0hj552t7.js";import"../chunk-spx89gaw.js";export{Z as AnomalyConfigStore,za as AwsSpendTransport,Aa as ComputeSpendTransport,x as CounterTracker,u as DEFAULT_METER_MAPPINGS,l as DEFAULT_PRICE_BOOK,B as DEFAULT_THRESHOLDS,_ as DETECTABLE_SIGNALS,c as ENFORCEMENT_ACTIONS,K as ENFORCEMENT_DESCRIPTIONS,d as ENFORCEMENT_SEVERITY,ea as FOCUS_VERSION,b as METERS,a as METER_KEYS,e as MICRO_CENTS,G as MIN_PROJECTION_CONFIDENCE,pa as RecordingSpendTransport,X as SENSITIVITY_THRESHOLDS,xa as SPEND_CYCLE_SECONDS,ka as SPEND_GATE_SETTING,ua as SPEND_LEASE_SETTING,ba as SignalSource,ma as SpendCapError,la as SpendGate,va as SpendLoopLease,ta as SpendNotificationRouter,wa as SpendRunner,ia as SpendService,C as SpendStore,qa as URGENT_SPEND_EVENTS,L as USER_VISIBLE_ACTIONS,z as aggregateDeltas,W as anomalyOptionsForSignal,na as assertSpendAllows,q as budgetWindow,Ba as compositeSpendTransport,oa as createEnforcementHandlers,U as detectAnomalies,V as detectLatestAnomaly,I as evaluateBudget,T as ewma,v as findMapping,g as findPriceEntry,ra as formatCents,F as formatTimeToExhaustion,H as governingLimitCents,Ca as handleSpendRequest,s as hourBucket,t as hourBucketsBetween,P as isOperationAllowed,m as isValidTimeZone,da as lookbackHoursForSignal,Q as median,R as medianAbsoluteDeviation,J as mergeDecisions,k as mergePriceBooks,y as meterTelemetry,ca as optionsForSignal,E as percentOfLimit,M as planEnforcement,r as previousBudgetWindow,h as priceUsage,i as priceUsageLines,D as projectSpend,S as robustZScore,j as roundCents,Y as routeMatches,N as runEnforcement,A as scopeKey,aa as signalDefinition,sa as spendNotificationText,Da as spendOpenApiPaths,ya as startSpendLoop,ha as streamFocusJsonl,O as strongestActiveAction,f as tieredMicroCents,ga as toFocusJsonl,fa as toFocusRecords,w as usageDeltaKey,p as utcInstantOfLocal,ja as zeroFill,o as zoneOffsetMs,n as zonedParts};
+import{$j as _,Aj as z,Bj as A,Cj as B,Dj as C,Ej as D,Fj as E,Gj as F,Hj as G,Ij as H,Jj as I,Jk as qa,Kj as J,Kk as ra,Lj as K,Lk as sa,Mj as L,Mk as ta,Nj as M,Nk as ua,Oj as N,Ok as va,Pj as O,Pk as wa,Qj as P,Qk as xa,Rj as Q,Rk as ya,Sj as R,Sk as za,Tj as S,Tk as Aa,Uj as T,Uk as Ba,Vj as U,Wj as V,Xj as W,Yj as X,Yk as Ca,Zj as Y,Zk as Da,_j as Z,ak as aa,bj as a,bk as ba,cj as b,ck as ca,dj as c,dk as da,ej as d,ek as ea,fj as e,fk as fa,gj as f,gk as ga,hj as g,hk as ha,ij as h,ik as ia,jj as i,jk as ja,kj as j,kk as ka,lj as k,lk as la,mj as l,mk as ma,nj as m,nk as na,oj as n,ok as oa,pj as o,pk as pa,qj as p,rj as q,sj as r,tj as s,uj as t,vj as u,wj as v,xj as w,yj as x,zj as y}from"../chunk-aw0cgv5w.js";import"../chunk-x3hay61c.js";import"../chunk-zz52xje8.js";import"../chunk-z2qqwy7e.js";export{Z as AnomalyConfigStore,za as AwsSpendTransport,Aa as ComputeSpendTransport,x as CounterTracker,u as DEFAULT_METER_MAPPINGS,l as DEFAULT_PRICE_BOOK,B as DEFAULT_THRESHOLDS,_ as DETECTABLE_SIGNALS,c as ENFORCEMENT_ACTIONS,K as ENFORCEMENT_DESCRIPTIONS,d as ENFORCEMENT_SEVERITY,ea as FOCUS_VERSION,b as METERS,a as METER_KEYS,e as MICRO_CENTS,G as MIN_PROJECTION_CONFIDENCE,pa as RecordingSpendTransport,X as SENSITIVITY_THRESHOLDS,xa as SPEND_CYCLE_SECONDS,ka as SPEND_GATE_SETTING,ua as SPEND_LEASE_SETTING,ba as SignalSource,ma as SpendCapError,la as SpendGate,va as SpendLoopLease,ta as SpendNotificationRouter,wa as SpendRunner,ia as SpendService,C as SpendStore,qa as URGENT_SPEND_EVENTS,L as USER_VISIBLE_ACTIONS,z as aggregateDeltas,W as anomalyOptionsForSignal,na as assertSpendAllows,q as budgetWindow,Ba as compositeSpendTransport,oa as createEnforcementHandlers,U as detectAnomalies,V as detectLatestAnomaly,I as evaluateBudget,T as ewma,v as findMapping,g as findPriceEntry,ra as formatCents,F as formatTimeToExhaustion,H as governingLimitCents,Ca as handleSpendRequest,s as hourBucket,t as hourBucketsBetween,P as isOperationAllowed,m as isValidTimeZone,da as lookbackHoursForSignal,Q as median,R as medianAbsoluteDeviation,J as mergeDecisions,k as mergePriceBooks,y as meterTelemetry,ca as optionsForSignal,E as percentOfLimit,M as planEnforcement,r as previousBudgetWindow,h as priceUsage,i as priceUsageLines,D as projectSpend,S as robustZScore,j as roundCents,Y as routeMatches,N as runEnforcement,A as scopeKey,aa as signalDefinition,sa as spendNotificationText,Da as spendOpenApiPaths,ya as startSpendLoop,ha as streamFocusJsonl,O as strongestActiveAction,f as tieredMicroCents,ga as toFocusJsonl,fa as toFocusRecords,w as usageDeltaKey,p as utcInstantOfLocal,ja as zeroFill,o as zoneOffsetMs,n as zonedParts};

package/dist/ui/404.html

@@ -2,7 +2,7 @@
 <html lang="en" data-theme="dark">
 <head>
   <meta charset="UTF-8">
-  <meta name="stx-build" content="mt3u6o68ittj80">
+  <meta name="stx-build" content="mt61k46cy0nuki">
 
 <!-- stx SEO Tags -->
 <meta name="title" content="Page not found · ts-cloud">

package/dist/ui/accept-invitation.html

@@ -1,4 +1,4 @@
-<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mt3u6820xxaean"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - Accept invitation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.616c25f3.css"></head><body class="auth-page"><main class="auth-card" id="main-content"><a class="brand" href="/"><span class="dot"></span><span>ts-cloud</span></a><div><span class="context-label">Organization invitation</span><h1>Join your team</h1><p>Choose the dashboard username and password you will use after this invitation is accepted.</p></div><form id="accept-invitation-form" class="auth-form"><div class="field-block"><label for="invite-name">Name</label><input id="invite-name" name="name" autocomplete="name" placeholder="Chris Breuer"></div><div class="field-block"><label for="invite-username">Username</label><input id="invite-username" name="username" autocomplete="username" minlength="2" maxlength="32" required></div><div class="field-block"><label for="invite-password">Password</label><input id="invite-password" name="password" type="password" autocomplete="new-password" minlength="12" required><small>At least 12 characters.</small></div><button class="btn" type="submit">Accept invitation</button><div id="invitation-status" class="auth-status" role="status"></div></form><p class="note">If this link expired or was already used, ask an organization owner to resend the invitation.</p></main> <script data-stx-scoped data-stx-run="always">
+<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mt61jpq58ij9e5"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - Accept invitation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.616c25f3.css"></head><body class="auth-page"><main class="auth-card" id="main-content"><a class="brand" href="/"><span class="dot"></span><span>ts-cloud</span></a><div><span class="context-label">Organization invitation</span><h1>Join your team</h1><p>Choose the dashboard username and password you will use after this invitation is accepted.</p></div><form id="accept-invitation-form" class="auth-form"><div class="field-block"><label for="invite-name">Name</label><input id="invite-name" name="name" autocomplete="name" placeholder="Chris Breuer"></div><div class="field-block"><label for="invite-username">Username</label><input id="invite-username" name="username" autocomplete="username" minlength="2" maxlength="32" required></div><div class="field-block"><label for="invite-password">Password</label><input id="invite-password" name="password" type="password" autocomplete="new-password" minlength="12" required><small>At least 12 characters.</small></div><button class="btn" type="submit">Accept invitation</button><div id="invitation-status" class="auth-status" role="status"></div></form><p class="note">If this link expired or was already used, ask an organization owner to resend the invitation.</p></main> <script data-stx-scoped data-stx-run="always">
 ;(function() {
   'use strict';
 (() => {

package/dist/ui/access-denied.html

@@ -1,4 +1,4 @@
-<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mt3u6820xxaean"><meta name="title" content="Access unavailable · ts-cloud"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="Access unavailable · ts-cloud"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="Access unavailable · ts-cloud"><meta name="twitter:description" content="A website built with stx templating engine"> <script data-stx-runtime src="/_stx/runtime.c696d17a.js"></script> <meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Access unavailable · ts-cloud</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.906ee17c.css"></head><body data-stx-auto><a data-stx-scope="stx_scope_nav_50" class="skip-link" href="#main-content">Skip to content</a><button class="nav-toggle-button" type="button" aria-label="Open navigation" aria-controls="primary-navigation" aria-expanded="false"><span></span><span></span><span></span></button><button class="nav-scrim" type="button" aria-label="Close navigation"></button><aside class="app-sidebar" id="primary-navigation" aria-label="Primary navigation"><a class="brand" href="/?env=production"><span class="dot"></span><span>ts-cloud</span></a><div class="sidebar-context"><span class="context-label">Project</span><strong>ts-cloud</strong></div><div class="environment-picker" aria-label="Environment"><span class="context-label">Environment</span><details><summary class="environment-current production"><span>PROD</span><strong>production</strong></summary></details></div><button class="command-trigger" type="button" aria-keyshortcuts="Meta+K Control+K"><span>Search resources</span><kbd>⌘ K</kbd></button><div class="nav-groups"><section class="nav-group"><h2>Overview</h2><a class="" href="/?env=production">Dashboard</a><a href="/server/activity?env=production">Activity</a></section><section class="nav-group"><h2>Applications</h2><a class="" href="/server/sites?env=production">Services</a><a class="" href="/server/deployments?env=production">Deployments</a><a class="" href="/server/logs?env=production">Logs</a><a class="" href="/integrations?env=production">Git integrations</a><a class="" href="/applications/new?env=production">Create application</a><a class="" href="/applications/compose?env=production">Compose applications</a></section><section class="nav-group"><h2>Operations</h2><a class="" href="/operations/queue?env=production">Deployment queue</a><a class="" href="/operations/previews?env=production">Preview environments</a><a class="" href="/operations/releases?env=production">Releases & promotion</a><a class="" href="/operations/regions?env=production">Regions & failover</a><a class="" href="/operations/maintenance?env=production">Maintenance & DR</a><a class="" href="/operations/workloads?env=production">Workloads</a><a class="" href="/operations/observability?env=production">Observability</a><a class="" href="/operations/alerts?env=production">Alerts & health</a><a class="" href="/operations/spend?env=production">Spend & budgets</a><a href="/server/metrics?env=production">Metrics</a><a href="/server/services?env=production">Runtime services</a><a class="" href="/operations/jobs?env=production">Workers & schedules</a><a class="" href="/operations/configuration?env=production">Environment &amp; secrets</a><a class="" href="/data/backups?env=production">Backups &amp; recovery</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/actions?env=production">Run operations</a></section><section class="nav-group"><h2>Infrastructure</h2><a class="" href="/infrastructure/topology?env=production">Infrastructure map</a><a class="" href="/data/services?env=production">Data services</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/firewall?env=production">Network & firewall</a><a href="/server/ssh-keys?env=production">SSH keys</a><a class="" href="/server/fleet?env=production">Fleet inventory</a><a class="" href="/server/capacity?env=production">Capacity & placement</a><a href="/security?env=production">Security posture</a><a href="/server/terminal?env=production">Terminal</a></section><section class="nav-group"><h2>Organization</h2><a class="" href="/server/team?env=production">People & access</a><a class="" href="/account/automation?env=production">API & automation</a></section><section class="nav-group"><h2>Account</h2><a class="" href="/account/security?env=production">Sign-in & security</a></section></div><form method="post" action="/api/logout" class="signout"><button type="submit">Sign out</button></form></aside><dialog class="command-palette" aria-labelledby="command-title"><div class="command-search"><span aria-hidden="true">⌕</span><input type="search" placeholder="Search services, domains, deployments…" aria-label="Search resources" autocomplete="off"><button type="button" class="command-close" aria-label="Close search">Esc</button></div><h2 id="command-title" class="sr-only">Search resources and navigation</h2><div class="command-status" role="status">Start typing to search this project.</div><section class="saved-views" aria-labelledby="saved-views-title"><div class="saved-views-heading"><h3 id="saved-views-title">Saved views</h3><form class="save-view-form"><label class="sr-only" for="save-view-name">Saved view name</label><input id="save-view-name" maxlength="64" placeholder="Name this view" autocomplete="off"><button type="submit">Save current filters</button></form></div><div class="saved-view-list"></div></section><form class="tag-result-form"><label for="tag-result-name">Tag selected resource</label><input id="tag-result-name" maxlength="32" placeholder="customer-facing" pattern="[A-Za-z0-9][A-Za-z0-9 -]{0,31}" autocomplete="off"><input class="tag-color" type="color" value="#5a8be0" aria-label="Tag color"><button type="submit">Add tag</button></form><div class="command-results" role="listbox" aria-label="Search results"></div><footer><span>↑ ↓ navigate</span><span>Enter open</span><span>Esc close</span></footer></dialog><div class="context-bar" aria-label="Current scope"><div class="context-path"><div class="context-breadcrumb"><span>ts-cloud</span><i>/</i><strong>production</strong></div><div class="context-filters" aria-label="Active filters"></div></div><span class="scope-safety production">Production scope</span></div> <script data-stx-scoped data-stx-run="always">
+<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mt61jpq58ij9e5"><meta name="title" content="Access unavailable · ts-cloud"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="Access unavailable · ts-cloud"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="Access unavailable · ts-cloud"><meta name="twitter:description" content="A website built with stx templating engine"> <script data-stx-runtime src="/_stx/runtime.c696d17a.js"></script> <meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Access unavailable · ts-cloud</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.906ee17c.css"></head><body data-stx-auto><a data-stx-scope="stx_scope_nav_50" class="skip-link" href="#main-content">Skip to content</a><button class="nav-toggle-button" type="button" aria-label="Open navigation" aria-controls="primary-navigation" aria-expanded="false"><span></span><span></span><span></span></button><button class="nav-scrim" type="button" aria-label="Close navigation"></button><aside class="app-sidebar" id="primary-navigation" aria-label="Primary navigation"><a class="brand" href="/?env=production"><span class="dot"></span><span>ts-cloud</span></a><div class="sidebar-context"><span class="context-label">Project</span><strong>ts-cloud</strong></div><div class="environment-picker" aria-label="Environment"><span class="context-label">Environment</span><details><summary class="environment-current production"><span>PROD</span><strong>production</strong></summary></details></div><button class="command-trigger" type="button" aria-keyshortcuts="Meta+K Control+K"><span>Search resources</span><kbd>⌘ K</kbd></button><div class="nav-groups"><section class="nav-group"><h2>Overview</h2><a class="" href="/?env=production">Dashboard</a><a href="/server/activity?env=production">Activity</a></section><section class="nav-group"><h2>Applications</h2><a class="" href="/server/sites?env=production">Services</a><a class="" href="/server/deployments?env=production">Deployments</a><a class="" href="/server/logs?env=production">Logs</a><a class="" href="/integrations?env=production">Git integrations</a><a class="" href="/applications/new?env=production">Create application</a><a class="" href="/applications/compose?env=production">Compose applications</a></section><section class="nav-group"><h2>Operations</h2><a class="" href="/operations/queue?env=production">Deployment queue</a><a class="" href="/operations/previews?env=production">Preview environments</a><a class="" href="/operations/releases?env=production">Releases & promotion</a><a class="" href="/operations/regions?env=production">Regions & failover</a><a class="" href="/operations/maintenance?env=production">Maintenance & DR</a><a class="" href="/operations/workloads?env=production">Workloads</a><a class="" href="/operations/observability?env=production">Observability</a><a class="" href="/operations/alerts?env=production">Alerts & health</a><a class="" href="/operations/spend?env=production">Spend & budgets</a><a href="/server/metrics?env=production">Metrics</a><a href="/server/services?env=production">Runtime services</a><a class="" href="/operations/jobs?env=production">Workers & schedules</a><a class="" href="/operations/configuration?env=production">Environment &amp; secrets</a><a class="" href="/data/backups?env=production">Backups &amp; recovery</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/actions?env=production">Run operations</a></section><section class="nav-group"><h2>Infrastructure</h2><a class="" href="/infrastructure/topology?env=production">Infrastructure map</a><a class="" href="/data/services?env=production">Data services</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/firewall?env=production">Network & firewall</a><a href="/server/ssh-keys?env=production">SSH keys</a><a class="" href="/server/fleet?env=production">Fleet inventory</a><a class="" href="/server/capacity?env=production">Capacity & placement</a><a href="/security?env=production">Security posture</a><a href="/server/terminal?env=production">Terminal</a></section><section class="nav-group"><h2>Organization</h2><a class="" href="/server/team?env=production">People & access</a><a class="" href="/account/automation?env=production">API & automation</a></section><section class="nav-group"><h2>Account</h2><a class="" href="/account/security?env=production">Sign-in & security</a></section></div><form method="post" action="/api/logout" class="signout"><button type="submit">Sign out</button></form></aside><dialog class="command-palette" aria-labelledby="command-title"><div class="command-search"><span aria-hidden="true">⌕</span><input type="search" placeholder="Search services, domains, deployments…" aria-label="Search resources" autocomplete="off"><button type="button" class="command-close" aria-label="Close search">Esc</button></div><h2 id="command-title" class="sr-only">Search resources and navigation</h2><div class="command-status" role="status">Start typing to search this project.</div><section class="saved-views" aria-labelledby="saved-views-title"><div class="saved-views-heading"><h3 id="saved-views-title">Saved views</h3><form class="save-view-form"><label class="sr-only" for="save-view-name">Saved view name</label><input id="save-view-name" maxlength="64" placeholder="Name this view" autocomplete="off"><button type="submit">Save current filters</button></form></div><div class="saved-view-list"></div></section><form class="tag-result-form"><label for="tag-result-name">Tag selected resource</label><input id="tag-result-name" maxlength="32" placeholder="customer-facing" pattern="[A-Za-z0-9][A-Za-z0-9 -]{0,31}" autocomplete="off"><input class="tag-color" type="color" value="#5a8be0" aria-label="Tag color"><button type="submit">Add tag</button></form><div class="command-results" role="listbox" aria-label="Search results"></div><footer><span>↑ ↓ navigate</span><span>Enter open</span><span>Esc close</span></footer></dialog><div class="context-bar" aria-label="Current scope"><div class="context-path"><div class="context-breadcrumb"><span>ts-cloud</span><i>/</i><strong>production</strong></div><div class="context-filters" aria-label="Active filters"></div></div><span class="scope-safety production">Production scope</span></div> <script data-stx-scoped data-stx-run="always">
 (function() {
   var { batch, computed, configureFetch, defineEmits, defineExpose, definePageMeta, defineProps, defineSlots, defineStore, derived, effect, goBack, goForward, inject, invalidateRoute, isDerived, isSignal, navigate, nextTick, onBeforeMount, onBeforeUnmount, onDestroy, onMount, onMounted, onUnmounted, peek, provide, reactive, ref, refresh, registerStoresClient, setRouteParams, state, untrack, useAsync, useClickOutside, useColorMode, useCookie, useCounter, useDark, useDebounce, useDebouncedValue, useEventListener, useFetch, useFocus, useHead, useId, useInterval, useLocalStorage, useMediaQuery, useMutation, useOptimistic, usePreferredContrast, usePreferredDark, usePreferredLight, usePreferredReducedMotion, useQuery, useReactiveProp, useRef, useRoute, useRouteParam, useRouteParams, useScrollLock, useSearchParams, useSeoMeta, useSessionStorage, useSlots, useStore, useThrottle, useTimeout, useToggle, useWebSocket, watch, watchEffect, watchMultiple, withDefaults } = window.stx;
   var __destroyHooks = [];

package/dist/ui/account/automation.html

@@ -1,5 +1,5 @@
-<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mt3u6820xxaean"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"> <script data-stx-runtime src="/_stx/runtime.c696d17a.js"></script> <meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - API &amp; automation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"> <script data-stx-scoped>
-function __stx_setup_1787370375147_0() {
+<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mt61jpq58ij9e5"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"> <script data-stx-runtime src="/_stx/runtime.c696d17a.js"></script> <meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - API &amp; automation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"> <script data-stx-scoped>
+function __stx_setup_1787503694252_0() {
   const { batch, computed, configureFetch, defineEmits, defineExpose, definePageMeta, defineProps, defineSlots, defineStore, derived, effect, goBack, goForward, inject, invalidateRoute, isDerived, isSignal, navigate, nextTick, onBeforeMount, onBeforeUnmount, onDestroy, onMount, onMounted, onUnmounted, peek, provide, reactive, ref, refresh, registerStoresClient, setRouteParams, state, untrack, useAsync, useClickOutside, useColorMode, useCookie, useCounter, useDark, useDebounce, useDebouncedValue, useEventListener, useFetch, useFocus, useHead, useId, useInterval, useLocalStorage, useMediaQuery, useMutation, useOptimistic, usePreferredContrast, usePreferredDark, usePreferredLight, usePreferredReducedMotion, useQuery, useReactiveProp, useRef, useRoute, useRouteParam, useRouteParams, useScrollLock, useSearchParams, useSeoMeta, useSessionStorage, useSlots, useStore, useThrottle, useTimeout, useToggle, useWebSocket, watch, watchEffect, watchMultiple, withDefaults } = window.stx;
 
 const accounts = state([]);
@@ -189,9 +189,9 @@ onMount(() => {
 
   return { accounts, project, environments, resources, message, messageKind, reveal, accountSlug, accountName, accountRole, accountScopeType, accountScopeId, selectedAccount, tokenName, tokenCapabilities, tokenScopeType, tokenScopeId, tokenExpiry, password, mfaCode, capabilities, setMessage, setScope, scopeLabel, tokenState, toggleCapability, load, selectAccount, stepUp, createAccount, createToken, tokenAction, disableAccount, curlExample, cliExample, copy };
 }
-window.__stx_latestSetup=__stx_setup_1787370375147_0;
-if(window.stx)window.stx._latestSetup=__stx_setup_1787370375147_0;
-</script> <style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.906ee17c.css"></head><body data-stx="__stx_setup_1787370375147_0"><a data-stx-scope="stx_scope_nav_1" class="skip-link" href="#main-content">Skip to content</a><button class="nav-toggle-button" type="button" aria-label="Open navigation" aria-controls="primary-navigation" aria-expanded="false"><span></span><span></span><span></span></button><button class="nav-scrim" type="button" aria-label="Close navigation"></button><aside class="app-sidebar" id="primary-navigation" aria-label="Primary navigation"><a class="brand" href="/?env=production"><span class="dot"></span><span>ts-cloud</span></a><div class="sidebar-context"><span class="context-label">Project</span><strong>ts-cloud</strong></div><div class="environment-picker" aria-label="Environment"><span class="context-label">Environment</span><details><summary class="environment-current production"><span>PROD</span><strong>production</strong></summary></details></div><button class="command-trigger" type="button" aria-keyshortcuts="Meta+K Control+K"><span>Search resources</span><kbd>⌘ K</kbd></button><div class="nav-groups"><section class="nav-group"><h2>Overview</h2><a class="" href="/?env=production">Dashboard</a><a href="/server/activity?env=production">Activity</a></section><section class="nav-group"><h2>Applications</h2><a class="" href="/server/sites?env=production">Services</a><a class="" href="/server/deployments?env=production">Deployments</a><a class="" href="/server/logs?env=production">Logs</a><a class="" href="/integrations?env=production">Git integrations</a><a class="" href="/applications/new?env=production">Create application</a><a class="" href="/applications/compose?env=production">Compose applications</a></section><section class="nav-group"><h2>Operations</h2><a class="" href="/operations/queue?env=production">Deployment queue</a><a class="" href="/operations/previews?env=production">Preview environments</a><a class="" href="/operations/releases?env=production">Releases & promotion</a><a class="" href="/operations/regions?env=production">Regions & failover</a><a class="" href="/operations/maintenance?env=production">Maintenance & DR</a><a class="" href="/operations/workloads?env=production">Workloads</a><a class="" href="/operations/observability?env=production">Observability</a><a class="" href="/operations/alerts?env=production">Alerts & health</a><a class="" href="/operations/spend?env=production">Spend & budgets</a><a href="/server/metrics?env=production">Metrics</a><a href="/server/services?env=production">Runtime services</a><a class="" href="/operations/jobs?env=production">Workers & schedules</a><a class="" href="/operations/configuration?env=production">Environment &amp; secrets</a><a class="" href="/data/backups?env=production">Backups &amp; recovery</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/actions?env=production">Run operations</a></section><section class="nav-group"><h2>Infrastructure</h2><a class="" href="/infrastructure/topology?env=production">Infrastructure map</a><a class="" href="/data/services?env=production">Data services</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/firewall?env=production">Network & firewall</a><a href="/server/ssh-keys?env=production">SSH keys</a><a class="" href="/server/fleet?env=production">Fleet inventory</a><a class="" href="/server/capacity?env=production">Capacity & placement</a><a href="/security?env=production">Security posture</a><a href="/server/terminal?env=production">Terminal</a></section><section class="nav-group"><h2>Organization</h2><a class="" href="/server/team?env=production">People & access</a><a class="active" href="/account/automation?env=production">API & automation</a></section><section class="nav-group"><h2>Account</h2><a class="" href="/account/security?env=production">Sign-in & security</a></section></div><form method="post" action="/api/logout" class="signout"><button type="submit">Sign out</button></form></aside><dialog class="command-palette" aria-labelledby="command-title"><div class="command-search"><span aria-hidden="true">⌕</span><input type="search" placeholder="Search services, domains, deployments…" aria-label="Search resources" autocomplete="off"><button type="button" class="command-close" aria-label="Close search">Esc</button></div><h2 id="command-title" class="sr-only">Search resources and navigation</h2><div class="command-status" role="status">Start typing to search this project.</div><section class="saved-views" aria-labelledby="saved-views-title"><div class="saved-views-heading"><h3 id="saved-views-title">Saved views</h3><form class="save-view-form"><label class="sr-only" for="save-view-name">Saved view name</label><input id="save-view-name" maxlength="64" placeholder="Name this view" autocomplete="off"><button type="submit">Save current filters</button></form></div><div class="saved-view-list"></div></section><form class="tag-result-form"><label for="tag-result-name">Tag selected resource</label><input id="tag-result-name" maxlength="32" placeholder="customer-facing" pattern="[A-Za-z0-9][A-Za-z0-9 -]{0,31}" autocomplete="off"><input class="tag-color" type="color" value="#5a8be0" aria-label="Tag color"><button type="submit">Add tag</button></form><div class="command-results" role="listbox" aria-label="Search results"></div><footer><span>↑ ↓ navigate</span><span>Enter open</span><span>Esc close</span></footer></dialog><div class="context-bar" aria-label="Current scope"><div class="context-path"><div class="context-breadcrumb"><span>ts-cloud</span><i>/</i><strong>production</strong></div><div class="context-filters" aria-label="Active filters"></div></div><span class="scope-safety production">Production scope</span></div> <script data-stx-scoped data-stx-run="always">
+window.__stx_latestSetup=__stx_setup_1787503694252_0;
+if(window.stx)window.stx._latestSetup=__stx_setup_1787503694252_0;
+</script> <style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.906ee17c.css"></head><body data-stx="__stx_setup_1787503694252_0"><a data-stx-scope="stx_scope_nav_1" class="skip-link" href="#main-content">Skip to content</a><button class="nav-toggle-button" type="button" aria-label="Open navigation" aria-controls="primary-navigation" aria-expanded="false"><span></span><span></span><span></span></button><button class="nav-scrim" type="button" aria-label="Close navigation"></button><aside class="app-sidebar" id="primary-navigation" aria-label="Primary navigation"><a class="brand" href="/?env=production"><span class="dot"></span><span>ts-cloud</span></a><div class="sidebar-context"><span class="context-label">Project</span><strong>ts-cloud</strong></div><div class="environment-picker" aria-label="Environment"><span class="context-label">Environment</span><details><summary class="environment-current production"><span>PROD</span><strong>production</strong></summary></details></div><button class="command-trigger" type="button" aria-keyshortcuts="Meta+K Control+K"><span>Search resources</span><kbd>⌘ K</kbd></button><div class="nav-groups"><section class="nav-group"><h2>Overview</h2><a class="" href="/?env=production">Dashboard</a><a href="/server/activity?env=production">Activity</a></section><section class="nav-group"><h2>Applications</h2><a class="" href="/server/sites?env=production">Services</a><a class="" href="/server/deployments?env=production">Deployments</a><a class="" href="/server/logs?env=production">Logs</a><a class="" href="/integrations?env=production">Git integrations</a><a class="" href="/applications/new?env=production">Create application</a><a class="" href="/applications/compose?env=production">Compose applications</a></section><section class="nav-group"><h2>Operations</h2><a class="" href="/operations/queue?env=production">Deployment queue</a><a class="" href="/operations/previews?env=production">Preview environments</a><a class="" href="/operations/releases?env=production">Releases & promotion</a><a class="" href="/operations/regions?env=production">Regions & failover</a><a class="" href="/operations/maintenance?env=production">Maintenance & DR</a><a class="" href="/operations/workloads?env=production">Workloads</a><a class="" href="/operations/observability?env=production">Observability</a><a class="" href="/operations/alerts?env=production">Alerts & health</a><a class="" href="/operations/spend?env=production">Spend & budgets</a><a href="/server/metrics?env=production">Metrics</a><a href="/server/services?env=production">Runtime services</a><a class="" href="/operations/jobs?env=production">Workers & schedules</a><a class="" href="/operations/configuration?env=production">Environment &amp; secrets</a><a class="" href="/data/backups?env=production">Backups &amp; recovery</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/actions?env=production">Run operations</a></section><section class="nav-group"><h2>Infrastructure</h2><a class="" href="/infrastructure/topology?env=production">Infrastructure map</a><a class="" href="/data/services?env=production">Data services</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/firewall?env=production">Network & firewall</a><a href="/server/ssh-keys?env=production">SSH keys</a><a class="" href="/server/fleet?env=production">Fleet inventory</a><a class="" href="/server/capacity?env=production">Capacity & placement</a><a href="/security?env=production">Security posture</a><a href="/server/terminal?env=production">Terminal</a></section><section class="nav-group"><h2>Organization</h2><a class="" href="/server/team?env=production">People & access</a><a class="active" href="/account/automation?env=production">API & automation</a></section><section class="nav-group"><h2>Account</h2><a class="" href="/account/security?env=production">Sign-in & security</a></section></div><form method="post" action="/api/logout" class="signout"><button type="submit">Sign out</button></form></aside><dialog class="command-palette" aria-labelledby="command-title"><div class="command-search"><span aria-hidden="true">⌕</span><input type="search" placeholder="Search services, domains, deployments…" aria-label="Search resources" autocomplete="off"><button type="button" class="command-close" aria-label="Close search">Esc</button></div><h2 id="command-title" class="sr-only">Search resources and navigation</h2><div class="command-status" role="status">Start typing to search this project.</div><section class="saved-views" aria-labelledby="saved-views-title"><div class="saved-views-heading"><h3 id="saved-views-title">Saved views</h3><form class="save-view-form"><label class="sr-only" for="save-view-name">Saved view name</label><input id="save-view-name" maxlength="64" placeholder="Name this view" autocomplete="off"><button type="submit">Save current filters</button></form></div><div class="saved-view-list"></div></section><form class="tag-result-form"><label for="tag-result-name">Tag selected resource</label><input id="tag-result-name" maxlength="32" placeholder="customer-facing" pattern="[A-Za-z0-9][A-Za-z0-9 -]{0,31}" autocomplete="off"><input class="tag-color" type="color" value="#5a8be0" aria-label="Tag color"><button type="submit">Add tag</button></form><div class="command-results" role="listbox" aria-label="Search results"></div><footer><span>↑ ↓ navigate</span><span>Enter open</span><span>Esc close</span></footer></dialog><div class="context-bar" aria-label="Current scope"><div class="context-path"><div class="context-breadcrumb"><span>ts-cloud</span><i>/</i><strong>production</strong></div><div class="context-filters" aria-label="Active filters"></div></div><span class="scope-safety production">Production scope</span></div> <script data-stx-scoped data-stx-run="always">
 (function() {
   var { batch, computed, configureFetch, defineEmits, defineExpose, definePageMeta, defineProps, defineSlots, defineStore, derived, effect, goBack, goForward, inject, invalidateRoute, isDerived, isSignal, navigate, nextTick, onBeforeMount, onBeforeUnmount, onDestroy, onMount, onMounted, onUnmounted, peek, provide, reactive, ref, refresh, registerStoresClient, setRouteParams, state, untrack, useAsync, useClickOutside, useColorMode, useCookie, useCounter, useDark, useDebounce, useDebouncedValue, useEventListener, useFetch, useFocus, useHead, useId, useInterval, useLocalStorage, useMediaQuery, useMutation, useOptimistic, usePreferredContrast, usePreferredDark, usePreferredLight, usePreferredReducedMotion, useQuery, useReactiveProp, useRef, useRoute, useRouteParam, useRouteParams, useScrollLock, useSearchParams, useSeoMeta, useSessionStorage, useSlots, useStore, useThrottle, useTimeout, useToggle, useWebSocket, watch, watchEffect, watchMultiple, withDefaults } = window.stx;
   var __destroyHooks = [];