@stacksjs/ts-cloud 0.11.7 → 0.12.1

package/dist/chunk-prf2pkvq.js

@@ -0,0 +1,5 @@
+import{tf as S}from"./chunk-zmmc9j5f.js";import{Js as b,kt as C,pt as k,qt as x,xs as j,zs as R}from"./chunk-6xcbfs2r.js";import{execFileSync as A}from"node:child_process";import{mkdirSync as v,mkdtempSync as u,rmSync as g,writeFileSync as L}from"node:fs";import{tmpdir as d}from"node:os";import{dirname as m,join as X}from"node:path";var K={reset:"\x1B[0m",bright:"\x1B[1m",dim:"\x1B[2m",red:"\x1B[31m",green:"\x1B[32m",yellow:"\x1B[33m",blue:"\x1B[34m",magenta:"\x1B[35m",cyan:"\x1B[36m",white:"\x1B[37m",gray:"\x1B[90m"};function F(q,J){return`${K[J]}${q}${K.reset}`}function c(q){console.log(`${K.green}✓${K.reset} ${q}`)}function n(q){console.error(`${K.red}✗${K.reset} ${q}`)}function l(q){console.warn(`${K.yellow}⚠${K.reset} ${q}`)}function V(q){console.log(`${K.blue}ℹ${K.reset} ${q}`)}function i(q){console.log(`${K.cyan}→${K.reset} ${q}`)}function t(q){console.log(`
+${K.bright}${K.cyan}${q}${K.reset}
+`)}var a=!!(process.env.CI||process.env.GITHUB_ACTIONS||process.env.BUILDKITE||process.env.CIRCLECI||process.env.GITLAB_CI);function r(q,J="cyan"){let N=q.split(`
+`),Y=Math.max(...N.map((B)=>B.length)),Z="─".repeat(Y+2);console.log(F(`┌${Z}┐`,J)),N.forEach((B)=>{console.log(F(`│ ${B.padEnd(Y)} │`,J))}),console.log(F(`└${Z}┘`,J))}function U(q,J){for(let N of J){let Y=X(q,N.name);v(m(Y),{recursive:!0}),L(Y,N.data,N.mode?{mode:N.mode}:void 0)}}async function Nq(q){let{app:J,projectRoot:N,region:Y,repository:Z}=q,B=J.architecture??"x86_64",f=B==="arm64"?"linux/arm64":"linux/amd64",y=J.kind==="php",$=q.onStep??(()=>{}),G=u(X(d(),"tscloud-img-"));try{let P=X(G,"app");v(P,{recursive:!0});let E,H;if(y){k({projectRoot:N,app:J,skipBuild:q.skipBuild,onStep:$}),$("staging application tree");let Q=x(N);U(P,Q),U(X(G,"runtime"),C().map((O)=>({name:O.path,data:O.contents,mode:O.mode})));let z=J.handlers?.http??"public/index.php";E={http:z,queue:J.handlers?.queue??z,cli:J.handlers?.cli??z},H=j(Q.map((O)=>`${O.name}:${O.data.length}`).join("|"))}else{$("bundling application");let Q=await R({projectRoot:N,app:J,skipBuild:q.skipBuild,onStep:$});L(X(P,"index.mjs"),Q.bundle),E=Q.handlers,H=Q.sha256}let D=H.slice(0,16);L(X(G,"Dockerfile"),b({kind:J.kind??"node",phpVersion:J.phpVersion,architecture:B}));let I=new S(Y),M;try{M=(await I.describeRepositories({repositoryNames:[Z]})).repositories?.[0]?.repositoryUri??""}catch{M=""}if(!M)$(`creating ECR repository ${Z}`),M=(await I.createRepository({repositoryName:Z,imageScanningConfiguration:{scanOnPush:!0}})).repository?.repositoryUri??"";if(!M)throw Error(`could not resolve ECR repository URI for ${Z}`);let T=`${M}:${D}`;$("docker build"),A("docker",["build","--platform",f,"--provenance=false","--sbom=false","-t",T,G],{stdio:"inherit"}),$("ecr auth + push");let _=(await I.getAuthorizationToken()).authorizationData?.[0];if(!_?.authorizationToken||!_.proxyEndpoint)throw Error("failed to get an ECR authorization token");let w=_.proxyEndpoint.replace(/^https?:\/\//,""),W=X(G,".docker");return v(W,{recursive:!0}),L(X(W,"config.json"),JSON.stringify({auths:{[w]:{auth:_.authorizationToken}}})),A("docker",["push",T],{stdio:"inherit",env:{...process.env,DOCKER_CONFIG:W}}),V(`Image: ${T}`),{imageUri:T,tag:D,handlers:E}}finally{g(G,{recursive:!0,force:!0})}}
+export{c as Bd,n as Cd,l as Dd,V as Ed,i as Fd,t as Gd,r as Hd,Nq as Id};

package/dist/chunk-q0wffgw5.js

@@ -0,0 +1,37 @@
+var Y={mode:"detection",paranoiaLevel:1,inboundThreshold:5,outboundThreshold:4,maxBodyBytes:13107200,rejectOversizedBody:!0,auditLogPath:"/var/log/ts-cloud/waf-audit.log",blockStatus:403},C={bypassBase:1e5,exclusionBase:101000,rateLimitBase:102000,customBase:109000};function X(q){return q.replace(/\\/g,"\\\\").replace(/"/g,"\\\"").replace(/[\r\n]+/g," ")}function W(q){if(q.length>1000)return!1;if(/\([^)]*[+*]\)[+*]/.test(q))return!1;if(/\[[^\]]*\][+*]\{/.test(q))return!1;try{return new RegExp(q),!0}catch{return!1}}function R(q,V){let G=[],K=[],J=V;for(let H of q){if(H.enabled===!1)continue;if(H.key&&(H.key.source==="cookie"||H.key.source==="header")&&!H.key.name){K.push({ruleId:H.id,reason:"The rule keys on a header or cookie but names none."});continue}let $=H.path?_(H.path):".*";if(!W($)){K.push({ruleId:H.id,reason:"The path pattern compiles to an unsafe regular expression."});continue}let Z=[`SecRule REQUEST_URI "@rx ${X($)}"`];if(H.methods?.length)Z.push(`  "chain,id:${J},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${X(H.id)}'"`);else Z.push(`  "id:${J},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${X(H.id)}'"`);if(G.push(`# Marks requests governed by the ts-cloud rate limit "${X(H.id)}".`),G.push(Z.join(" \\\n")),H.methods?.length)G.push(`  SecRule REQUEST_METHOD "@within ${X(H.methods.join(" ").toUpperCase())}" "t:none"`);G.push(""),J++}return{lines:G,unmapped:K}}function _(q){return`^${q.replace(/[.+^${}()|[\]\\]/g,"\\$&").replace(/\*\*/g,"\x01").replace(/\*/g,"[^/]*").replace(/\u0001/g,".*")}$`}function y(q={},V=[]){let G=q.mode??Y.mode,K=[],J=q.paranoiaLevel??Y.paranoiaLevel,H=q.inboundThreshold??Y.inboundThreshold,$=q.outboundThreshold??Y.outboundThreshold,Z=q.maxBodyBytes??Y.maxBodyBytes,j=q.rejectOversizedBody!==!1;if(G==="blocking"&&J>=3)K.push(`Paranoia level ${J} blocks legitimate traffic on most applications until it is tuned. Run it in detection mode first.`);if(G==="blocking")K.push("zig-waf is pre-alpha. Blocking mode makes it a failure path for every request.");if(!j)K.push("Oversized bodies are passed through uninspected, so padding a request bypasses every rule.");if(q.bypassPaths?.length)K.push(`${q.bypassPaths.length} path(s) bypass inspection entirely.`);let Q=["# Managed by ts-cloud. Edits are overwritten on the next deploy.",`# Mode: ${G}. Paranoia level: ${J}.`,""];if(G==="off")return Q.push("SecRuleEngine Off",""),{config:`${Q.join(`
+`)}
+`,unmappedRateLimits:[],warnings:K,mode:G};Q.push(`SecRuleEngine ${G==="blocking"?"On":"DetectionOnly"}`,"SecRequestBodyAccess On","SecResponseBodyAccess Off",`SecRequestBodyLimit ${Z}`,`SecRequestBodyNoFilesLimit ${Math.min(Z,131072)}`,`SecRequestBodyLimitAction ${j?"Reject":"ProcessPartial"}`,"SecRequestBodyInMemoryLimit 131072",`SecAuditEngine ${G==="blocking"?"RelevantOnly":"On"}`,"SecAuditLogParts ABIJDEFHZ",`SecAuditLog ${X(q.auditLogPath??Y.auditLogPath)}`,"SecAuditLogType Serial",`SecDefaultAction "phase:1,log,auditlog,${G==="blocking"?`deny,status:${q.blockStatus??Y.blockStatus}`:"pass"}"`,"","# CRS anomaly scoring setup.",`SecAction "id:900000,phase:1,pass,nolog,t:none,setvar:tx.paranoia_level=${J}"`,`SecAction "id:900001,phase:1,pass,nolog,t:none,setvar:tx.inbound_anomaly_score_threshold=${H}"`,`SecAction "id:900002,phase:1,pass,nolog,t:none,setvar:tx.outbound_anomaly_score_threshold=${$}"`,'SecAction "id:900003,phase:1,pass,nolog,t:none,setvar:tx.critical_anomaly_score=5,setvar:tx.error_anomaly_score=4,setvar:tx.warning_anomaly_score=3,setvar:tx.notice_anomaly_score=2"','SecAction "id:900004,phase:1,pass,nolog,t:none,setvar:tx.anomaly_score=0"',"");let z=C.bypassBase;for(let N of q.bypassPaths??[]){let k=_(N);if(!W(k)){K.push(`Bypass path "${N}" was dropped: it compiles to an unsafe regular expression.`);continue}Q.push(`# Inspection bypass for ${X(N)}. Every bypass is an unguarded route.`,`SecRule REQUEST_URI "@rx ${X(k)}" "id:${z},phase:1,pass,nolog,ctl:ruleEngine=Off"`,""),z++}let B=C.exclusionBase;for(let N of q.exclusions??[]){if(!Number.isInteger(N.ruleId)||N.ruleId<=0){K.push(`Exclusion with rule id "${N.ruleId}" was dropped: the id is not a positive integer.`);continue}if(Q.push(`# ${X(N.reason)}`),N.pathPattern){if(!W(N.pathPattern)){K.push(`Exclusion for rule ${N.ruleId} was dropped: its path pattern is unsafe.`);continue}Q.push(`SecRule REQUEST_URI "@rx ${X(N.pathPattern)}" "id:${B},phase:1,pass,nolog,ctl:ruleRemoveById=${N.ruleId}"`),B++}else Q.push(`SecRuleRemoveById ${N.ruleId}`);Q.push("")}let M=R(V,C.rateLimitBase);if(M.lines.length>0)Q.push("# Rate-limit route markers. SecLang has no counters, so the tag is set","# here and the counting stays in the ts-cloud limiter.",...M.lines);let O=C.customBase;for(let N of q.customRules??[])Q.push(`# Operator-supplied rule ${O}.`,N.trim(),""),O++;if(G==="blocking")Q.push("# Blocking decision: one rule, at the end, on the accumulated score.",`SecRule TX:ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" "id:949110,phase:2,deny,status:${q.blockStatus??Y.blockStatus},log,msg:'Inbound anomaly score exceeded (total: %{tx.anomaly_score})'"`,"");return{config:`${Q.join(`
+`)}
+`,unmappedRateLimits:M.unmapped,warnings:K,mode:G}}function A(q={},V=[],G={}){let K=G.binary??"/usr/local/bin/zig-waf",J=G.configPath??"/etc/ts-cloud/waf.conf",H=y(q,V);return`#!/usr/bin/env bash
+# Managed by ts-cloud. Installs the zig-waf ruleset.
+set -euo pipefail
+
+if [ ! -x "${K}" ]; then
+  echo "ts-cloud: ${K} is not installed; skipping WAF configuration" >&2
+  exit 0
+fi
+
+install -d -m 0755 "$(dirname "${J}")"
+install -d -m 0750 /var/log/ts-cloud
+
+cat > "${J}.new" <<'WAF_EOF'
+${H.config}WAF_EOF
+
+# Compile the config before it goes live. A config that does not validate
+# would leave the engine with no rules while still reporting itself enabled.
+if ! "${K}" validate "${J}.new"; then
+  echo "ts-cloud: generated WAF config failed validation, keeping the previous one" >&2
+  rm -f "${J}.new"
+  exit 1
+fi
+
+if [ -f "${J}" ] && cmp -s "${J}.new" "${J}"; then
+  rm -f "${J}.new"
+  echo "ts-cloud: WAF config unchanged"
+  exit 0
+fi
+
+mv "${J}.new" "${J}"
+echo "ts-cloud: WAF config installed (mode: ${H.mode})"
+`}function F(q,V){return q.map((G)=>({projectId:V.projectId,environmentId:V.environmentId,resourceId:V.resourceId,kind:"event",source:"zig-waf",name:G.action==="blocked"?"waf.blocked":"waf.matched",timestamp:G.timestamp,value:1,host:G.host,pathTemplate:G.path,method:G.method,attributes:{ruleId:G.ruleId??null,anomalyScore:G.anomalyScore,action:G.action,messages:G.messages.slice(0,5)}}))}
+export{X as nl,W as ol,_ as pl,y as ql,A as rl,F as sl};

package/dist/chunk-qcemnt35.js

@@ -0,0 +1,50 @@
+import{$h as L}from"./chunk-bpnhqb70.js";class Q{client;region;constructor(j="us-east-1"){this.region=j,this.client=new L}async createHostedZone(j){let k=j.CallerReference||`${Date.now()}-${Math.random().toString(36).slice(2)}`,F=`<?xml version="1.0" encoding="UTF-8"?>
+<CreateHostedZoneRequest xmlns="https://route53.amazonaws.com/doc/2013-04-01/">
+  <Name>${j.Name}</Name>
+  <CallerReference>${k}</CallerReference>`;if(j.HostedZoneConfig){if(F+=`
+  <HostedZoneConfig>`,j.HostedZoneConfig.Comment)F+=`
+    <Comment>${j.HostedZoneConfig.Comment}</Comment>`;if(j.HostedZoneConfig.PrivateZone!==void 0)F+=`
+    <PrivateZone>${j.HostedZoneConfig.PrivateZone}</PrivateZone>`;F+=`
+  </HostedZoneConfig>`}if(j.VPC)F+=`
+  <VPC>
+    <VPCRegion>${j.VPC.VPCRegion}</VPCRegion>
+    <VPCId>${j.VPC.VPCId}</VPCId>
+  </VPC>`;if(j.DelegationSetId)F+=`
+  <DelegationSetId>${j.DelegationSetId}</DelegationSetId>`;F+=`
+</CreateHostedZoneRequest>`;let J=await this.client.request({service:"route53",region:this.region,method:"POST",path:"/2013-04-01/hostedzone",headers:{"content-type":"application/xml"},body:F});return this.parseCreateHostedZoneResponse(J)}async listHostedZones(j){let k={};if(j?.Marker)k.marker=j.Marker;if(j?.MaxItems)k.maxitems=j.MaxItems;let F=await this.client.request({service:"route53",region:this.region,method:"GET",path:"/2013-04-01/hostedzone",queryParams:Object.keys(k).length>0?k:void 0});return this.parseListHostedZonesResponse(F)}async listHostedZonesByName(j){let k={};if(j?.DNSName)k.dnsname=j.DNSName;if(j?.HostedZoneId)k.hostedzoneid=j.HostedZoneId;if(j?.MaxItems)k.maxitems=j.MaxItems;let F=await this.client.request({service:"route53",region:this.region,method:"GET",path:"/2013-04-01/hostedzonesbyname",queryParams:Object.keys(k).length>0?k:void 0});return this.parseListHostedZonesResponse(F)}async getHostedZone(j){let k=j.Id.replace("/hostedzone/",""),F=await this.client.request({service:"route53",region:this.region,method:"GET",path:`/2013-04-01/hostedzone/${k}`});return this.parseGetHostedZoneResponse(F)}async deleteHostedZone(j){let k=j.Id.replace("/hostedzone/","");await this.client.request({service:"route53",region:this.region,method:"DELETE",path:`/2013-04-01/hostedzone/${k}`})}async listResourceRecordSets(j){let k=j.HostedZoneId.replace("/hostedzone/",""),F={};if(j.StartRecordName)F.name=j.StartRecordName;if(j.StartRecordType)F.type=j.StartRecordType;if(j.StartRecordIdentifier)F.identifier=j.StartRecordIdentifier;if(j.MaxItems)F.maxitems=j.MaxItems;let J=await this.client.request({service:"route53",region:this.region,method:"GET",path:`/2013-04-01/hostedzone/${k}/rrset`,queryParams:Object.keys(F).length>0?F:void 0});return this.parseListResourceRecordSetsResponse(J)}async changeResourceRecordSets(j){let k=j.HostedZoneId.replace("/hostedzone/",""),F=`<?xml version="1.0" encoding="UTF-8"?>
+<ChangeResourceRecordSetsRequest xmlns="https://route53.amazonaws.com/doc/2013-04-01/">
+  <ChangeBatch>`;if(j.ChangeBatch.Comment)F+=`
+    <Comment>${this.escapeXml(j.ChangeBatch.Comment)}</Comment>`;F+=`
+    <Changes>`;for(let H of j.ChangeBatch.Changes){if(F+=`
+      <Change>
+        <Action>${H.Action}</Action>
+        <ResourceRecordSet>
+          <Name>${H.ResourceRecordSet.Name}</Name>
+          <Type>${H.ResourceRecordSet.Type}</Type>`,H.ResourceRecordSet.TTL!==void 0)F+=`
+          <TTL>${H.ResourceRecordSet.TTL}</TTL>`;if(H.ResourceRecordSet.SetIdentifier)F+=`
+          <SetIdentifier>${H.ResourceRecordSet.SetIdentifier}</SetIdentifier>`;if(H.ResourceRecordSet.Weight!==void 0)F+=`
+          <Weight>${H.ResourceRecordSet.Weight}</Weight>`;if(H.ResourceRecordSet.Region)F+=`
+          <Region>${H.ResourceRecordSet.Region}</Region>`;if(H.ResourceRecordSet.Failover)F+=`
+          <Failover>${H.ResourceRecordSet.Failover}</Failover>`;if(H.ResourceRecordSet.HealthCheckId)F+=`
+          <HealthCheckId>${H.ResourceRecordSet.HealthCheckId}</HealthCheckId>`;if(H.ResourceRecordSet.ResourceRecords&&H.ResourceRecordSet.ResourceRecords.length>0){F+=`
+          <ResourceRecords>`;for(let K of H.ResourceRecordSet.ResourceRecords)F+=`
+            <ResourceRecord>
+              <Value>${this.escapeXml(K.Value)}</Value>
+            </ResourceRecord>`;F+=`
+          </ResourceRecords>`}if(H.ResourceRecordSet.AliasTarget)F+=`
+          <AliasTarget>
+            <HostedZoneId>${H.ResourceRecordSet.AliasTarget.HostedZoneId}</HostedZoneId>
+            <DNSName>${H.ResourceRecordSet.AliasTarget.DNSName}</DNSName>
+            <EvaluateTargetHealth>${H.ResourceRecordSet.AliasTarget.EvaluateTargetHealth}</EvaluateTargetHealth>
+          </AliasTarget>`;if(H.ResourceRecordSet.GeoLocation){if(F+=`
+          <GeoLocation>`,H.ResourceRecordSet.GeoLocation.ContinentCode)F+=`
+            <ContinentCode>${H.ResourceRecordSet.GeoLocation.ContinentCode}</ContinentCode>`;if(H.ResourceRecordSet.GeoLocation.CountryCode)F+=`
+            <CountryCode>${H.ResourceRecordSet.GeoLocation.CountryCode}</CountryCode>`;if(H.ResourceRecordSet.GeoLocation.SubdivisionCode)F+=`
+            <SubdivisionCode>${H.ResourceRecordSet.GeoLocation.SubdivisionCode}</SubdivisionCode>`;F+=`
+          </GeoLocation>`}F+=`
+        </ResourceRecordSet>
+      </Change>`}F+=`
+    </Changes>
+  </ChangeBatch>
+</ChangeResourceRecordSetsRequest>`;let J=await this.client.request({service:"route53",region:this.region,method:"POST",path:`/2013-04-01/hostedzone/${k}/rrset`,headers:{"content-type":"application/xml"},body:F});return this.parseChangeResourceRecordSetsResponse(J)}escapeXml(j){return j.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&apos;")}parseCreateHostedZoneResponse(j){let k=j.CreateHostedZoneResponse||j;return{HostedZone:this.parseHostedZone(k.HostedZone),ChangeInfo:{Id:k.ChangeInfo?.Id||"",Status:k.ChangeInfo?.Status||"",SubmittedAt:k.ChangeInfo?.SubmittedAt||""},DelegationSet:this.parseDelegationSet(k.DelegationSet),Location:k.Location||""}}parseListHostedZonesResponse(j){let k=j.ListHostedZonesResponse||j.ListHostedZonesByNameResponse||j,F=k.HostedZones?.HostedZone||k.HostedZones||[];if(!Array.isArray(F))F=F?[F]:[];return{HostedZones:F.map((J)=>this.parseHostedZone(J)),IsTruncated:k.IsTruncated==="true"||k.IsTruncated===!0,MaxItems:k.MaxItems||"100",Marker:k.Marker,NextMarker:k.NextMarker}}parseGetHostedZoneResponse(j){let k=j.GetHostedZoneResponse||j;return{HostedZone:this.parseHostedZone(k.HostedZone),DelegationSet:this.parseDelegationSet(k.DelegationSet),VPCs:k.VPCs?.VPC?Array.isArray(k.VPCs.VPC)?k.VPCs.VPC:[k.VPCs.VPC]:void 0}}parseListResourceRecordSetsResponse(j){let k=j.ListResourceRecordSetsResponse||j,F=k.ResourceRecordSets?.ResourceRecordSet||k.ResourceRecordSets||[];if(!Array.isArray(F))F=F?[F]:[];return{ResourceRecordSets:F.map((J)=>this.parseResourceRecordSet(J)),IsTruncated:k.IsTruncated==="true"||k.IsTruncated===!0,MaxItems:k.MaxItems||"100",NextRecordName:k.NextRecordName,NextRecordType:k.NextRecordType,NextRecordIdentifier:k.NextRecordIdentifier}}parseChangeResourceRecordSetsResponse(j){let k=j.ChangeResourceRecordSetsResponse||j;return{ChangeInfo:{Id:k.ChangeInfo?.Id||"",Status:k.ChangeInfo?.Status||"",SubmittedAt:k.ChangeInfo?.SubmittedAt||"",Comment:k.ChangeInfo?.Comment}}}parseHostedZone(j){if(!j)return{Id:"",Name:""};return{Id:j.Id||"",Name:j.Name||"",CallerReference:j.CallerReference,Config:j.Config?{Comment:j.Config.Comment,PrivateZone:j.Config.PrivateZone==="true"||j.Config.PrivateZone===!0}:void 0,ResourceRecordSetCount:j.ResourceRecordSetCount?Number(j.ResourceRecordSetCount):void 0}}parseDelegationSet(j){if(!j)return{NameServers:[]};let k=j.NameServers?.NameServer||j.NameServers||[];if(!Array.isArray(k))k=k?[k]:[];return{Id:j.Id,CallerReference:j.CallerReference,NameServers:k}}parseResourceRecordSet(j){if(!j)return{Name:"",Type:""};let k=j.ResourceRecords?.ResourceRecord||j.ResourceRecords||[];if(!Array.isArray(k))k=k?[k]:[];return{Name:j.Name||"",Type:j.Type||"",TTL:j.TTL?Number(j.TTL):void 0,ResourceRecords:k.map((F)=>({Value:F.Value||F})),AliasTarget:j.AliasTarget?{HostedZoneId:j.AliasTarget.HostedZoneId,DNSName:j.AliasTarget.DNSName,EvaluateTargetHealth:j.AliasTarget.EvaluateTargetHealth==="true"||j.AliasTarget.EvaluateTargetHealth===!0}:void 0,SetIdentifier:j.SetIdentifier,Weight:j.Weight?Number(j.Weight):void 0,Region:j.Region,GeoLocation:j.GeoLocation,Failover:j.Failover,HealthCheckId:j.HealthCheckId}}async findHostedZoneByName(j){let k=j.endsWith(".")?j:`${j}.`;return(await this.listHostedZonesByName({DNSName:k})).HostedZones.find((H)=>H.Name===k)||null}async createARecord(j){let k=Array.isArray(j.Value)?j.Value:[j.Value];return this.changeResourceRecordSets({HostedZoneId:j.HostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:j.Name,Type:"A",TTL:j.TTL||300,ResourceRecords:k.map((F)=>({Value:F}))}}]}})}async createCnameRecord(j){return this.changeResourceRecordSets({HostedZoneId:j.HostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:j.Name,Type:"CNAME",TTL:j.TTL||300,ResourceRecords:[{Value:j.Value}]}}]}})}async createAliasRecord(j){return this.changeResourceRecordSets({HostedZoneId:j.HostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:j.Name,Type:j.Type||"A",AliasTarget:{HostedZoneId:j.TargetHostedZoneId,DNSName:j.TargetDNSName,EvaluateTargetHealth:j.EvaluateTargetHealth??!1}}}]}})}async createTxtRecord(j){let F=(Array.isArray(j.Value)?j.Value:[j.Value]).map((J)=>{if(!J.startsWith('"'))return`"${J}"`;return J});return this.changeResourceRecordSets({HostedZoneId:j.HostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:j.Name,Type:"TXT",TTL:j.TTL||300,ResourceRecords:F.map((J)=>({Value:J}))}}]}})}async createMxRecord(j){return this.changeResourceRecordSets({HostedZoneId:j.HostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:j.Name,Type:"MX",TTL:j.TTL||300,ResourceRecords:j.Values.map((k)=>({Value:`${k.priority} ${k.mailServer}`}))}}]}})}async deleteRecord(j){return this.changeResourceRecordSets({HostedZoneId:j.HostedZoneId,ChangeBatch:{Changes:[{Action:"DELETE",ResourceRecordSet:j.RecordSet}]}})}async waitForChange(j,k=60,F=5000){let J=j.replace("/change/","");for(let H=0;H<k;H++){let K=await this.client.request({service:"route53",region:this.region,method:"GET",path:`/2013-04-01/change/${J}`});if((K.GetChangeResponse?.ChangeInfo?.Status||K.ChangeInfo?.Status)==="INSYNC")return!0;await new Promise((O)=>setTimeout(O,F))}return!1}async findOrCreateHostedZone(j){let k=j.domainName.endsWith(".")?j.domainName:`${j.domainName}.`,F=await this.findHostedZoneByName(k);if(F){let H=await this.getHostedZone({Id:F.Id});return{hostedZone:F,nameServers:H.DelegationSet.NameServers,isNew:!1}}let J=await this.createHostedZone({Name:k,HostedZoneConfig:{Comment:j.comment||`Hosted zone for ${j.domainName}`,PrivateZone:j.privateZone},VPC:j.vpc});return{hostedZone:J.HostedZone,nameServers:J.DelegationSet.NameServers,isNew:!0}}static getRootDomain(j){let k=j.replace(/\.$/,"").split(".");if(k.length<=2)return j;return k.slice(-2).join(".")}async findHostedZoneForDomain(j){let F=j.replace(/\.$/,"").split(".");for(let J=0;J<F.length-1;J++){let H=F.slice(J).join("."),K=await this.findHostedZoneByName(H);if(K)return K}return null}async ensureHostedZone(j){let k=await this.findOrCreateHostedZone({domainName:j.domainName,comment:j.comment});return{hostedZoneId:k.hostedZone.Id.replace("/hostedzone/",""),nameServers:k.nameServers,isNew:k.isNew,action:k.isNew?"created":"found"}}async setupDomainDns(j){let{domain:k,createIfNotExists:F=!0}=j,J=await this.findHostedZoneByName(k);if(J){let K=await this.getHostedZone({Id:J.Id});return{success:!0,hostedZoneId:J.Id.replace("/hostedzone/",""),nameServers:K.DelegationSet.NameServers,isNew:!1,message:`Found existing hosted zone for ${k}`}}if(!F)return{success:!1,hostedZoneId:null,nameServers:[],isNew:!1,message:`No hosted zone found for ${k} and createIfNotExists is false`};let H=await this.createHostedZone({Name:k,HostedZoneConfig:{Comment:`Created automatically by ts-cloud for ${k}`}});return{success:!0,hostedZoneId:H.HostedZone.Id.replace("/hostedzone/",""),nameServers:H.DelegationSet.NameServers,isNew:!0,message:`Created new hosted zone for ${k}. Please update your domain registrar with these name servers: ${H.DelegationSet.NameServers.join(", ")}`}}static CloudFrontHostedZoneId="Z2FDTNDATAQYW2";static S3WebsiteHostedZoneIds={"us-east-1":"Z3AQBSTGFYJSTF","us-east-2":"Z2O1EMRO9K5GLX","us-west-1":"Z2F56UZL2M1ACD","us-west-2":"Z3BJ6K6RIION7M","ap-east-1":"ZNB98KWMFR0R6","ap-south-1":"Z11RGJOFQNVJUP","ap-northeast-1":"Z2M4EHUR26P7ZW","ap-northeast-2":"Z3W03O7B5YMIYP","ap-northeast-3":"Z2YQB5RD63NC85","ap-southeast-1":"Z3O0J2DXBE1FTB","ap-southeast-2":"Z1WCIGYICN2BYD","ca-central-1":"Z1QDHH18159H29","eu-central-1":"Z21DNDUVLTQW6Q","eu-west-1":"Z1BKCTXD74EZPE","eu-west-2":"Z3GKZC51ZF0DB4","eu-west-3":"Z3R1K369G5AVDG","eu-north-1":"Z3BAZG2TWCNX0D","sa-east-1":"Z7KQH4QJS55SO"};static ALBHostedZoneIds={"us-east-1":"Z35SXDOTRQ7X7K","us-east-2":"Z3AADJGX6KTTL2","us-west-1":"Z368ELLRRE2KJ0","us-west-2":"Z1H1FL5HABSF5","ap-east-1":"Z3DQVH9N71FHZ0","ap-south-1":"ZP97RAFLXTNZK","ap-northeast-1":"Z14GRHDCWA56QT","ap-northeast-2":"ZWKZPGTI48KDX","ap-northeast-3":"Z5LXEBD8Y73MNV","ap-southeast-1":"Z1LMS91P8CMLE5","ap-southeast-2":"Z1GM3OXH4ZPM65","ca-central-1":"ZQSVJUPU6J1EY","eu-central-1":"Z215JYRZR1TBD5","eu-west-1":"Z32O12XQLNTSW2","eu-west-2":"ZHURV8PSTC4K8","eu-west-3":"Z3Q77PNBQS71R4","eu-north-1":"Z23TAZ6LKFMNIO","sa-east-1":"Z2P70J7HTTTPLU"};static APIGatewayHostedZoneIds={"us-east-1":"Z1UJRXOUMOOFQ8","us-east-2":"ZOJJZC49E0EPZ","us-west-1":"Z2MUQ32089INYE","us-west-2":"Z2OJLYMUO9EFXC","ap-east-1":"Z3FD1VL90ND7K5","ap-south-1":"Z3VO1THU9YC4UR","ap-northeast-1":"Z1YSHQZHG15GKL","ap-northeast-2":"Z20JF4UZKIW1U8","ap-northeast-3":"Z2YQB5RD63NC85","ap-southeast-1":"ZL327KTPIQFUL","ap-southeast-2":"Z2RPCDW04V8134","ca-central-1":"Z19DQILCV0OWEC","eu-central-1":"Z1U9ULNL0V5AJ3","eu-west-1":"ZLY8HYME6SFDD","eu-west-2":"ZJ5UAJN8Y3Z2Q","eu-west-3":"Z3KY65QIEKYHQQ","eu-north-1":"Z3UWIKFBOOGXPP","sa-east-1":"ZCMLWB8V5SYIT"}}
+export{Q as Tf};

package/dist/chunk-qvbwsaay.js

@@ -0,0 +1 @@
+import{qf as a,rf as b}from"./chunk-5m29dhke.js";import"./chunk-qcemnt35.js";import"./chunk-wte9mh18.js";import"./chunk-bpnhqb70.js";import"./chunk-rr1yaj55.js";export{b as email,a as EmailClient};

package/dist/chunk-r2pbqcnz.js

@@ -0,0 +1,2 @@
+import{$h as _}from"./chunk-bpnhqb70.js";class ${client;region;constructor(j="us-east-1",q){this.region=j,this.client=new _(void 0,{profile:q})}async createStack(j){let q={Action:"CreateStack",StackName:j.stackName,Version:"2010-05-15"};if(j.templateBody)q.TemplateBody=j.templateBody;else if(j.templateUrl)q.TemplateURL=j.templateUrl;else throw Error("Either templateBody or templateUrl must be provided");if(j.parameters)j.parameters.forEach((z,H)=>{q[`Parameters.member.${H+1}.ParameterKey`]=z.ParameterKey,q[`Parameters.member.${H+1}.ParameterValue`]=z.ParameterValue});if(j.capabilities)j.capabilities.forEach((z,H)=>{q[`Capabilities.member.${H+1}`]=z});if(j.roleArn)q.RoleARN=j.roleArn;if(j.tags)j.tags.forEach((z,H)=>{q[`Tags.member.${H+1}.Key`]=z.Key,q[`Tags.member.${H+1}.Value`]=z.Value});if(j.timeoutInMinutes)q.TimeoutInMinutes=j.timeoutInMinutes;if(j.onFailure)q.OnFailure=j.onFailure;let G=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(q).toString()});return{StackId:G.StackId||G.CreateStackResult?.StackId}}async updateStack(j){let q={Action:"UpdateStack",StackName:j.stackName,Version:"2010-05-15"};if(j.templateBody)q.TemplateBody=j.templateBody;else if(j.templateUrl)q.TemplateURL=j.templateUrl;if(j.parameters)j.parameters.forEach((z,H)=>{if(q[`Parameters.member.${H+1}.ParameterKey`]=z.ParameterKey,z.UsePreviousValue)q[`Parameters.member.${H+1}.UsePreviousValue`]="true";else q[`Parameters.member.${H+1}.ParameterValue`]=z.ParameterValue});if(j.capabilities)j.capabilities.forEach((z,H)=>{q[`Capabilities.member.${H+1}`]=z});if(j.roleArn)q.RoleARN=j.roleArn;if(j.tags)j.tags.forEach((z,H)=>{q[`Tags.member.${H+1}.Key`]=z.Key,q[`Tags.member.${H+1}.Value`]=z.Value});let G=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(q).toString()});return{StackId:G.StackId||G.UpdateStackResult?.StackId}}async deleteStack(j,q,G){let z={Action:"DeleteStack",StackName:j,Version:"2010-05-15"};if(q)z.RoleARN=q;if(G&&G.length>0)G.forEach((H,Q)=>{z[`RetainResources.member.${Q+1}`]=H});await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(z).toString()})}async describeStacks(j={}){let q={Action:"DescribeStacks",Version:"2010-05-15"};if(j.stackName)q.StackName=j.stackName;let G=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(q).toString()});return{Stacks:this.parseStacksResponse(G)}}async describeStackEvents(j){let q={Action:"DescribeStackEvents",StackName:j,Version:"2010-05-15"},G=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(q).toString()});return{StackEvents:this.parseStackEvents(G)}}async listStackResources(j){let q={Action:"ListStackResources",StackName:j,Version:"2010-05-15"},z=(await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(q).toString()}))?.ListStackResourcesResult?.StackResourceSummaries?.member,H=[];if(z)H=Array.isArray(z)?z:[z];return{StackResourceSummaries:H}}async waitForStack(j,q){let G={"stack-create-complete":["CREATE_COMPLETE"],"stack-update-complete":["UPDATE_COMPLETE"],"stack-delete-complete":["DELETE_COMPLETE"]},z=["CREATE_FAILED","ROLLBACK_FAILED","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE"],H=G[q],Q=360,J=0;while(J<360)try{let I=await this.describeStacks({stackName:j});if(I.Stacks.length===0){if(q==="stack-delete-complete")return;if(J%10===0)console.log(`[waitForStack] Attempt ${J}: Stack not visible yet`);await new Promise((O)=>setTimeout(O,2000)),J++;continue}let L=I.Stacks[0];if(J%10===0)console.log(`[waitForStack] Attempt ${J}: Status = ${L.StackStatus}${L.StackStatusReason?` (${L.StackStatusReason})`:""}`);if(H.includes(L.StackStatus))return;if((q==="stack-create-complete"||q==="stack-update-complete")&&(L.StackStatus==="DELETE_IN_PROGRESS"||L.StackStatus==="DELETE_COMPLETE")){console.log("[waitForStack] Stack is being deleted (creation/update failed)");let O="";try{let U=await this.describeStackEvents(j);console.log("[waitForStack] Stack events (most recent first):");for(let X of U.StackEvents.slice(0,15))if(X.ResourceStatus.includes("FAILED")||X.ResourceStatusReason){if(console.log(`  ${X.LogicalResourceId}: ${X.ResourceStatus} - ${X.ResourceStatusReason||"No reason provided"}`),X.ResourceStatus.includes("FAILED")&&X.ResourceStatusReason&&!O)O=X.ResourceStatusReason}}catch{}let V=O||L.StackStatusReason||"Check CloudFormation console for details.";throw Error(`Stack creation/update failed - stack is being deleted. Reason: ${V}`)}if(L.StackStatus==="DELETE_FAILED"&&q==="stack-delete-complete"){let O=Error("Stack deletion failed - may have resources that need to be retained");throw O.code="DELETE_FAILED",O.stackStatus=L.StackStatus,O.statusReason=L.StackStatusReason,O}if(z.includes(L.StackStatus))throw Error(`Stack reached failure status: ${L.StackStatus}`);await new Promise((O)=>setTimeout(O,5000)),J++}catch(I){if(q==="stack-delete-complete"&&I.message?.includes("does not exist"))return;if(q==="stack-create-complete"&&I.message?.includes("does not exist")){if(J%10===0)console.log(`[waitForStack] Attempt ${J}: Stack does not exist (error), retrying...`);await new Promise((L)=>setTimeout(L,2000)),J++;continue}throw console.log(`[waitForStack] Unexpected error: ${I.message}`),I}throw console.log(`[waitForStack] Timeout after ${J} attempts`),Error(`Timeout waiting for stack to reach ${q}`)}async validateTemplate(j){let q={Action:"ValidateTemplate",TemplateBody:j,Version:"2010-05-15"};return await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(q).toString()})}async listStacks(j){let q={Action:"ListStacks",Version:"2010-05-15"};if(j)j.forEach((I,L)=>{q[`StackStatusFilter.member.${L+1}`]=I});let G=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(q).toString()}),z=G.ListStacksResponse||G,H=z.ListStacksResult||z,Q=H.StackSummaries?.member||H.StackSummaries||[];return{StackSummaries:(Array.isArray(Q)?Q:Q?[Q]:[]).map((I)=>({StackId:I.StackId||"",StackName:I.StackName||"",TemplateDescription:I.TemplateDescription,CreationTime:I.CreationTime||"",LastUpdatedTime:I.LastUpdatedTime,DeletionTime:I.DeletionTime,StackStatus:I.StackStatus||""}))}}async createChangeSet(j){let q={Action:"CreateChangeSet",StackName:j.stackName,ChangeSetName:j.changeSetName,Version:"2010-05-15"};if(j.templateBody)q.TemplateBody=j.templateBody;else if(j.templateUrl)q.TemplateURL=j.templateUrl;if(j.parameters)j.parameters.forEach((z,H)=>{q[`Parameters.member.${H+1}.ParameterKey`]=z.ParameterKey,q[`Parameters.member.${H+1}.ParameterValue`]=z.ParameterValue});if(j.capabilities)j.capabilities.forEach((z,H)=>{q[`Capabilities.member.${H+1}`]=z});if(j.changeSetType)q.ChangeSetType=j.changeSetType;let G=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(q).toString()});return{Id:G.Id,StackId:G.StackId}}async describeChangeSet(j,q){let G={Action:"DescribeChangeSet",StackName:j,ChangeSetName:q,Version:"2010-05-15"};return await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(G).toString()})}async executeChangeSet(j,q){let G={Action:"ExecuteChangeSet",StackName:j,ChangeSetName:q,Version:"2010-05-15"};await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(G).toString()})}async deleteChangeSet(j,q){let G={Action:"DeleteChangeSet",StackName:j,ChangeSetName:q,Version:"2010-05-15"};await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(G).toString()})}async getStackOutputs(j){let q=await this.describeStacks({stackName:j});if(!q.Stacks||q.Stacks.length===0)throw Error(`Stack ${j} not found`);let G=q.Stacks[0],z={};if(G.Outputs)for(let H of G.Outputs)z[H.OutputKey]=H.OutputValue;return z}async getTemplate(j){let q={Action:"GetTemplate",StackName:j,Version:"2010-05-15"},G=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(q).toString()});return{TemplateBody:G?.GetTemplateResult?.TemplateBody||G?.TemplateBody||""}}parseStacksResponse(j){let q=[],G=j?.DescribeStacksResult?.Stacks?.member||j?.Stacks?.member||j?.Stacks||j;if(G&&!Array.isArray(G))G=[G];if(Array.isArray(G)){for(let z of G)if(z.StackId||z.StackName){let H;if(z.Outputs?.member)H=(Array.isArray(z.Outputs.member)?z.Outputs.member:[z.Outputs.member]).map((J)=>({OutputKey:J.OutputKey,OutputValue:J.OutputValue,Description:J.Description,ExportName:J.ExportName}));q.push({StackId:z.StackId,StackName:z.StackName,StackStatus:z.StackStatus,CreationTime:z.CreationTime,LastUpdatedTime:z.LastUpdatedTime,StackStatusReason:z.StackStatusReason,Outputs:H})}}else if(j.StackId)q.push({StackId:j.StackId,StackName:j.StackName,StackStatus:j.StackStatus,CreationTime:j.CreationTime,LastUpdatedTime:j.LastUpdatedTime});return q}parseStackEvents(j){let q=[],G=j?.DescribeStackEventsResult?.StackEvents?.member||j?.StackEvents?.member||j?.StackEvents||[];if(G&&!Array.isArray(G))G=[G];for(let z of G)if(z.LogicalResourceId)q.push({Timestamp:z.Timestamp,ResourceType:z.ResourceType,LogicalResourceId:z.LogicalResourceId,ResourceStatus:z.ResourceStatus,ResourceStatusReason:z.ResourceStatusReason});return q}async waitForStackWithProgress(j,q,G){let z={"stack-create-complete":["CREATE_COMPLETE"],"stack-update-complete":["UPDATE_COMPLETE"],"stack-delete-complete":["DELETE_COMPLETE"]},H=["CREATE_FAILED","ROLLBACK_FAILED","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE"],Q=z[q],J=360,I=0,L=new Set;while(I<360)try{if(G)try{let X=[...(await this.describeStackEvents(j)).StackEvents||[]].reverse();for(let Y of X){let Z=`${Y.LogicalResourceId}-${Y.ResourceStatus}-${Y.Timestamp}`;if(!L.has(Z))L.add(Z),G({resourceId:Y.LogicalResourceId,resourceType:Y.ResourceType,status:Y.ResourceStatus,reason:Y.ResourceStatusReason,timestamp:Y.Timestamp})}}catch{}let O=await this.describeStacks({stackName:j});if(O.Stacks.length===0){if(q==="stack-delete-complete")return;await new Promise((U)=>setTimeout(U,2000)),I++;continue}let V=O.Stacks[0];if(Q.includes(V.StackStatus))return;if(V.StackStatus==="DELETE_FAILED"&&q==="stack-delete-complete"){let U=Error("Stack deletion failed - may have resources that need to be retained");throw U.code="DELETE_FAILED",U.stackStatus=V.StackStatus,U.statusReason=V.StackStatusReason,U}if(H.includes(V.StackStatus))throw Error(`Stack reached failure status: ${V.StackStatus}`);await new Promise((U)=>setTimeout(U,3000)),I++}catch(O){if(q==="stack-delete-complete"&&O.message?.includes("does not exist"))return;if(q==="stack-create-complete"&&O.message?.includes("does not exist")){await new Promise((V)=>setTimeout(V,2000)),I++;continue}throw O}throw Error(`Timeout waiting for stack to reach ${q}`)}async waitForStackComplete(j,q=120,G=5000){let z=["CREATE_COMPLETE","UPDATE_COMPLETE","DELETE_COMPLETE"],H=["CREATE_FAILED","UPDATE_FAILED","DELETE_FAILED","ROLLBACK_COMPLETE","ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED"];for(let Q=0;Q<q;Q++)try{let J=await this.describeStacks({stackName:j});if(J.Stacks.length===0)return{success:!0,status:"DELETE_COMPLETE"};let I=J.Stacks[0],L=I.StackStatus;if(z.includes(L))return{success:!0,status:L};if(H.includes(L))return{success:!1,status:L,reason:I.StackStatusReason};await new Promise((O)=>setTimeout(O,G))}catch(J){if(J.message?.includes("does not exist"))return{success:!0,status:"DELETE_COMPLETE"};throw J}return{success:!1,status:"TIMEOUT",reason:"Timeout waiting for stack operation"}}}
+export{$ as Xh};

package/dist/chunk-r6110zv2.js

@@ -0,0 +1 @@
+import{$h as b,_h as a,ai as c,bi as d}from"./chunk-bpnhqb70.js";import"./chunk-rr1yaj55.js";export{a as resolveS3Endpoint,d as detectCredentialSource,c as buildQueryParams,b as AWSClient};

package/dist/chunk-rr1yaj55.js

@@ -0,0 +1,2 @@
+import{createRequire as q}from"node:module";var j=Object.create;var{getPrototypeOf:k,defineProperty:i,getOwnPropertyNames:l}=Object;var m=Object.prototype.hasOwnProperty;function n(a){return this[a]}var o,p,r=(a,b,d)=>{var f=a!=null&&typeof a==="object";if(f){var g=b?o??=new WeakMap:p??=new WeakMap,h=g.get(a);if(h)return h}d=a!=null?j(k(a)):{};let c=b||!a||!a.__esModule?i(d,"default",{value:a,enumerable:!0}):d;for(let e of l(a))if(!m.call(c,e))i(c,e,{get:n.bind(a,e),enumerable:!0});if(f)g.set(a,c);return c};var s=(a,b)=>()=>(b||a((b={exports:{}}).exports,b),b.exports);var u=q(import.meta.url);
+export{r as Ct,s as Dt,u as Et};

package/dist/chunk-wcrj06cg.js

@@ -0,0 +1,44 @@
+var V={newConnectionsPerSecond:50,concurrentPerSource:100,synPerSecond:2000,burst:100,icmpPerSecond:5,banSeconds:600};function N(j){return{...V,...j.thresholds}}var m=/^(?:\d{1,3}\.){3}\d{1,3}(?:\/\d{1,2})?$|^[0-9a-f:]+(?:\/\d{1,3})?$/i;function I(j){if(!m.test(j))return!1;let[q,z]=j.split("/");if(q.includes(":"))return z==null||Number(z)>=0&&Number(z)<=128;let K=q.split(".");if(K.length!==4||K.some((W)=>Number(W)>255||W===""))return!1;return z==null||Number(z)>=0&&Number(z)<=32}function U(j){return[...new Set((j??[]).map((q)=>q.trim()).filter(I))]}function O(j){let q=(j??[80,443]).filter((z)=>Number.isInteger(z)&&z>=1&&z<=65535);return[...new Set(q)].sort((z,K)=>z-K)}function k(j={}){let q=N(j);return{"net.ipv4.tcp_syncookies":"1","net.ipv4.tcp_max_syn_backlog":String(Math.max(4096,q.synPerSecond*4)),"net.ipv4.tcp_synack_retries":"2","net.ipv4.tcp_abort_on_overflow":"1","net.ipv4.tcp_fin_timeout":"15","net.ipv4.tcp_keepalive_time":"300","net.ipv4.tcp_keepalive_intvl":"30","net.ipv4.tcp_keepalive_probes":"3","net.core.somaxconn":"4096","net.core.netdev_max_backlog":"16384","net.ipv4.conf.all.rp_filter":"1","net.ipv4.conf.default.rp_filter":"1","net.ipv4.conf.all.accept_source_route":"0","net.ipv4.conf.all.accept_redirects":"0","net.ipv4.conf.all.send_redirects":"0","net.ipv6.conf.all.accept_redirects":"0","net.ipv6.conf.all.accept_source_route":"0","net.ipv4.icmp_echo_ignore_broadcasts":"1","net.ipv4.icmp_ignore_bogus_error_responses":"1","net.netfilter.nf_conntrack_max":"262144","net.netfilter.nf_conntrack_tcp_timeout_established":"3600"}}function _(j={}){let q=["# Managed by ts-cloud. Edits are overwritten on the next deploy.","# Network hardening against L3/L4 floods.",""];for(let[z,K]of Object.entries(k(j)))q.push(`${z} = ${K}`);return`${q.join(`
+`)}
+`}function y(j={}){let q=N(j),z=O(j.ports),K=U(j.allowlist),W=U(j.blocklist),X=j.monitorOnly?"counter":"counter drop",M=j.originProtection?.enabled?U(j.originProtection.cdnRanges):[],Q=K.filter((J)=>!J.includes(":")),Z=K.filter((J)=>J.includes(":")),$=W.filter((J)=>!J.includes(":")),G=["#!/usr/sbin/nft -f","# Managed by ts-cloud. Edits are overwritten on the next deploy.","","table inet ts_cloud_ddos","delete table inet ts_cloud_ddos","","table inet ts_cloud_ddos {","  # Sources that tripped a limit, with a timeout so a ban self-expires.",`  set banned4 { type ipv4_addr; flags timeout; timeout ${q.banSeconds}s; }`,`  set banned6 { type ipv6_addr; flags timeout; timeout ${q.banSeconds}s; }`];if(Q.length>0)G.push(`  set allow4 { type ipv4_addr; flags interval; elements = { ${Q.join(", ")} } }`);if(Z.length>0)G.push(`  set allow6 { type ipv6_addr; flags interval; elements = { ${Z.join(", ")} } }`);if($.length>0)G.push(`  set block4 { type ipv4_addr; flags interval; elements = { ${$.join(", ")} } }`);if(M.length>0)G.push(`  set cdn4 { type ipv4_addr; flags interval; elements = { ${M.filter((J)=>!J.includes(":")).join(", ")} } }`);if(G.push("","  chain input {","    type filter hook input priority -150; policy accept;","","    # Established traffic is already paid for; never re-inspect it.","    ct state established,related accept","    iif lo accept","","    # Invalid packets are never legitimate and are cheap to drop early.","    ct state invalid counter drop"),Q.length>0)G.push("    ip saddr @allow4 accept");if(Z.length>0)G.push("    ip6 saddr @allow6 accept");if($.length>0)G.push("    ip saddr @block4 counter drop");if(G.push("    ip saddr @banned4 counter drop","    ip6 saddr @banned6 counter drop",""),G.push("    # Nonsense TCP flag combinations: scanners and stack fingerprinting.","    tcp flags & (fin|syn) == (fin|syn) counter drop","    tcp flags & (syn|rst) == (syn|rst) counter drop","    tcp flags & (fin|rst) == (fin|rst) counter drop","    tcp flags & (fin|ack) == fin counter drop","    tcp flags & (syn|fin|ack|rst|psh|urg) == 0x0 counter drop","","    # Ping stays usable, ping floods do not.",`    ip protocol icmp icmp type echo-request limit rate ${q.icmpPerSecond}/second burst ${q.burst} packets accept`,"    ip protocol icmp icmp type echo-request counter drop",""),z.length>0){let J=z.join(", ");if(G.push("    # Platform-wide SYN ceiling. Above it the kernel falls back to cookies.",`    tcp dport { ${J} } ct state new limit rate ${q.synPerSecond}/second burst ${q.burst} packets accept`,"","    # Per-source new-connection rate. This is what stops one host hammering.",`    tcp dport { ${J} } ct state new meter conn_rate4 { ip saddr limit rate over ${q.newConnectionsPerSecond}/second burst ${q.burst} packets } add @banned4 { ip saddr } ${X}`,`    tcp dport { ${J} } ct state new meter conn_rate6 { ip6 saddr limit rate over ${q.newConnectionsPerSecond}/second burst ${q.burst} packets } add @banned6 { ip6 saddr } ${X}`,"","    # Concurrency ceiling per source: the slow-loris defence.",`    tcp dport { ${J} } ct state new meter conn_count4 { ip saddr ct count over ${q.concurrentPerSource} } ${X}`,`    tcp dport { ${J} } ct state new meter conn_count6 { ip6 saddr ct count over ${q.concurrentPerSource} } ${X}`,""),M.length>0)G.push("    # Origin protection: reject traffic that skipped the CDN and came","    # straight to the box, which is how an attacker bypasses the edge.",`    tcp dport { ${J} } ip saddr != @cdn4 counter drop`,"")}return G.push("  }","}",""),G.join(`
+`)}function C(j={}){return`#!/usr/bin/env bash
+# Managed by ts-cloud. Installs L3/L4 flood mitigation.
+set -euo pipefail
+
+if ! command -v nft >/dev/null 2>&1; then
+  export DEBIAN_FRONTEND=noninteractive
+  apt-get update -qq
+  apt-get install -y -qq nftables
+fi
+
+install -d -m 0755 /etc/ts-cloud /etc/nftables.d
+cat > /etc/sysctl.d/90-ts-cloud-ddos.conf <<'SYSCTL_EOF'
+${_(j)}SYSCTL_EOF
+sysctl --system >/dev/null
+
+cat > /etc/nftables.d/ts-cloud-ddos.nft.new <<'NFT_EOF'
+${y(j)}NFT_EOF
+
+# Syntax-check before applying: a bad ruleset would leave the box unprotected.
+if ! nft -c -f /etc/nftables.d/ts-cloud-ddos.nft.new; then
+  echo "ts-cloud: generated nftables ruleset failed validation, keeping the previous one" >&2
+  rm -f /etc/nftables.d/ts-cloud-ddos.nft.new
+  exit 1
+fi
+
+mv /etc/nftables.d/ts-cloud-ddos.nft.new /etc/nftables.d/ts-cloud-ddos.nft
+nft -f /etc/nftables.d/ts-cloud-ddos.nft
+
+# Applying the ruleset does not survive a reboot on its own: nftables.service
+# loads /etc/nftables.conf, so the file has to be included from there or the box
+# comes back up unprotected and nothing says so.
+touch /etc/nftables.conf
+if ! grep -q 'ts-cloud-ddos.nft' /etc/nftables.conf; then
+  printf '
+include "/etc/nftables.d/ts-cloud-ddos.nft"
+' >> /etc/nftables.conf
+fi
+systemctl enable nftables >/dev/null 2>&1 || true
+echo "ts-cloud: L3/L4 mitigation active"
+`}var F=["off","monitor","rate_limit","challenge","lockdown"];function L(j,q=[]){let z=[],K=Math.max(1,j.baselineRequestsPerSecond),W=j.requestsPerSecond/K,X=0,M=(B,H)=>{z.push(H),X=Math.max(X,F.indexOf(B))},Q=W>=3;if(Q)M("monitor",`Traffic is ${W.toFixed(1)}x the baseline.`);let Z=j.topSourceShare>=0.25,$=j.errorRate>=0.25,G=(j.suspiciousAgentShare??0)>=0.5,J=j.uniqueSources>0&&j.requestsPerSecond/j.uniqueSources>=50;if(Q&&Z)M("rate_limit",`One source accounts for ${(j.topSourceShare*100).toFixed(0)}% of traffic.`);if(Q&&J)M("rate_limit","Request rate per unique source is far above what a browser produces.");if(Q&&$)M("challenge",`Error rate is ${(j.errorRate*100).toFixed(0)}% under load.`);if(Q&&G)M("challenge","Most requests carry no recognisable browser agent.");if(W>=20&&(Z||$||G||J))M("lockdown",`Traffic is ${W.toFixed(0)}x the baseline with attack-shaped characteristics.`);if(!Q&&j.topSourceShare>=0.6&&j.requestsPerSecond>K)M("rate_limit","A single source dominates traffic without an overall surge.");let Y=F[X],P={off:1,monitor:1,rate_limit:0.5,challenge:0.25,lockdown:0.1}[Y];return{level:Y,reasons:z,rateLimitFactor:P,challengeEnabled:Y==="challenge"||Y==="lockdown",staticOnly:Y==="lockdown",banCandidates:Y==="off"||Y==="monitor"?[]:U(q)}}function T(j,q){return Math.max(1,Math.floor(j*q.rateLimitFactor))}
+export{V as tl,I as ul,k as vl,_ as wl,y as xl,C as yl,L as zl,T as Al};

package/dist/chunk-wte9mh18.js

@@ -0,0 +1,92 @@
+import{$h as b,_h as y}from"./chunk-bpnhqb70.js";import{Et as H}from"./chunk-rr1yaj55.js";import*as J from"node:crypto";import{readFileSync as m}from"node:fs";import{readdir as d}from"node:fs/promises";import{join as p}from"node:path";function f(_){if(_){let C=h(_);if(!C)throw Error(`AWS profile '${_}' not found in ~/.aws/credentials`);return C}let E=process.env.AWS_ACCESS_KEY_ID,W=process.env.AWS_SECRET_ACCESS_KEY;if(E&&W)return{accessKeyId:E,secretAccessKey:W,sessionToken:process.env.AWS_SESSION_TOKEN};return h(process.env.AWS_PROFILE||"default")??{accessKeyId:"",secretAccessKey:""}}function h(_){let{existsSync:E,readFileSync:W}=H("node:fs"),{homedir:C}=H("node:os"),{join:A}=H("node:path"),Y=process.env.AWS_SHARED_CREDENTIALS_FILE||A(C(),".aws","credentials");if(!E(Y))return null;let $=W(Y,"utf-8"),G=null,V,Z,Q;for(let N of $.split(`
+`)){let L=N.trim();if(!L||L.startsWith("#")||L.startsWith(";"))continue;let w=L.match(/^\[([^\]]+)\]$/);if(w){if(G===_&&V&&Z)return{accessKeyId:V,secretAccessKey:Z,sessionToken:Q};G=w[1],V=void 0,Z=void 0,Q=void 0;continue}if(G===_){let[M,...U]=L.split("="),F=U.join("=").trim();switch(M.trim().toLowerCase()){case"aws_access_key_id":V=F;break;case"aws_secret_access_key":Z=F;break;case"aws_session_token":Q=F;break}}}if(G===_&&V&&Z)return{accessKeyId:V,secretAccessKey:Z,sessionToken:Q};return null}function g(_){let{buffer:E,byteOffset:W,byteLength:C}=_;if(E instanceof ArrayBuffer)return E.slice(W,W+C);let A=new ArrayBuffer(C);return new Uint8Array(A).set(new Uint8Array(_)),A}class l{client;region;explicitProfile;endpoint;endpointProtocol="https";forcePathStyle;explicitCredentials;constructor(_="us-east-1",E,W){let C=typeof _==="string"?W:_,A=typeof _==="string"?_:_.region??"us-east-1",Y=typeof _==="string"?E:_.profile,$=C?.endpoint?y({region:A,path:"/",endpoint:C.endpoint}):void 0;this.region=A,this.explicitProfile=Y,this.endpoint=$?.host,this.endpointProtocol=$?.protocol??"https",this.forcePathStyle=C?.forcePathStyle,this.explicitCredentials=C?.credentials,this.client=new b(C?.credentials,{profile:Y,endpoint:C?.endpoint,forcePathStyle:C?.forcePathStyle})}getCredentials(){if(this.explicitCredentials?.accessKeyId&&this.explicitCredentials.secretAccessKey)return this.explicitCredentials;let _=f(this.explicitProfile);if(_.accessKeyId&&_.secretAccessKey)return _;throw Error("S3 credentials not found. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (or pass explicit credentials/profile), or configure ~/.aws/credentials.")}s3BaseHost(){return this.endpoint||`s3.${this.region}.amazonaws.com`}s3VirtualHost(_){return this.forcePathStyle?this.s3BaseHost():`${_}.${this.s3BaseHost()}`}objectPath(_,E){return this.forcePathStyle?`/${_}/${E}`:`/${E}`}objectUrl(_,E){return`${this.endpointProtocol}://${this.s3VirtualHost(_)}${this.objectPath(_,E)}`}async listBuckets(){let _=await this.client.request({service:"s3",region:this.region,method:"GET",path:"/"}),E=[],C=(_?.ListAllMyBucketsResult??_)?.Buckets?.Bucket;if(C){let A=Array.isArray(C)?C:[C];for(let Y of A)E.push({Name:Y.Name,CreationDate:Y.CreationDate})}return{Buckets:E}}async createBucket(_,E){let W={};if(E?.acl)W["x-amz-acl"]=E.acl;let C;if(this.region!=="us-east-1"&&!this.endpoint)C=`<?xml version="1.0" encoding="UTF-8"?>
+<CreateBucketConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  <LocationConstraint>${this.region}</LocationConstraint>
+</CreateBucketConfiguration>`,W["Content-Type"]="application/xml";await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${_}`,headers:W,body:C})}async deleteBucket(_){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${_}`})}async emptyAndDeleteBucket(_){let E=!0;while(E){let W=await this.listAllObjects({bucket:_});if(W.length===0){E=!1;break}let C=W.map((A)=>A.Key);for(let A=0;A<C.length;A+=1000){let Y=C.slice(A,A+1000);await this.deleteObjects(_,Y)}}await this.deleteBucket(_)}async listAllObjects(_){let E=[],W;do{let C={"list-type":"2","max-keys":"1000"};if(_.prefix)C.prefix=_.prefix;if(W)C["continuation-token"]=W;let A=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${_.bucket}`,queryParams:C}),Y=A?.ListBucketResult??A,$=Y?.Contents;if($){let V=Array.isArray($)?$:[$];for(let Z of V)E.push({Key:Z.Key,LastModified:Z.LastModified||"",Size:Number.parseInt(Z.Size||"0"),ETag:Z.ETag})}let G=Y?.IsTruncated;W=G==="true"||G===!0?Y?.NextContinuationToken:void 0}while(W);return E}async list(_){let E=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${_.bucket}`}),W=[],A=(E?.ListBucketResult??E)?.Contents;if(A){let Y=Array.isArray(A)?A:[A];for(let $ of Y){if(_.prefix&&!$.Key?.startsWith(_.prefix))continue;if(W.push({Key:$.Key||"",LastModified:$.LastModified||"",Size:Number.parseInt($.Size||"0"),ETag:$.ETag}),_.maxKeys&&W.length>=_.maxKeys)break}}return W}async putObject(_){let E={};if(_.acl)E["x-amz-acl"]=_.acl;if(_.cacheControl)E["Cache-Control"]=_.cacheControl;if(_.contentType)E["Content-Type"]=_.contentType;if(_.metadata)for(let[A,Y]of Object.entries(_.metadata))E[`x-amz-meta-${A}`]=Y;let W=_.key.split("/").map((A)=>encodeURIComponent(A)).join("/"),C=_.body instanceof Uint8Array&&!Buffer.isBuffer(_.body)?Buffer.from(_.body):_.body;if(Buffer.isBuffer(C)||C instanceof Uint8Array){let A=Buffer.isBuffer(C)?C:Buffer.from(C),{accessKeyId:Y,secretAccessKey:$,sessionToken:G}=this.getCredentials(),V=this.s3VirtualHost(_.bucket),Z=this.objectPath(_.bucket,W),Q=this.objectUrl(_.bucket,W),N=new Date,L=N.toISOString().replace(/[:-]|\.\d{3}/g,""),w=N.toISOString().slice(0,10).replace(/-/g,""),M=J.createHash("sha256").update(A).digest("hex"),U={host:V,"x-amz-date":L,"x-amz-content-sha256":M,...E};if(G)U["x-amz-security-token"]=G;let F=Object.keys(U).sort().map((B)=>`${B.toLowerCase()}:${U[B].trim()}
+`).join(""),x=Object.keys(U).sort().map((B)=>B.toLowerCase()).join(";"),I=["PUT",Z,"",F,x,M].join(`
+`),z="AWS4-HMAC-SHA256",P=`${w}/${this.region}/s3/aws4_request`,K=[z,L,P,J.createHash("sha256").update(I).digest("hex")].join(`
+`),v=J.createHmac("sha256",`AWS4${$}`).update(w).digest(),X=J.createHmac("sha256",v).update(this.region).digest(),O=J.createHmac("sha256",X).update("s3").digest(),j=J.createHmac("sha256",O).update("aws4_request").digest(),T=J.createHmac("sha256",j).update(K).digest("hex"),R=`${z} Credential=${Y}/${P}, SignedHeaders=${x}, Signature=${T}`,D=await fetch(Q,{method:"PUT",headers:{...U,Authorization:R},body:g(A)});if(!D.ok){let B=await D.text();throw Error(`S3 PUT failed: ${D.status} ${B}`)}return}await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${W}`,bucket:_.bucket,headers:E,body:_.body})}async getObject(_,E){let W=E.split("/").map((A)=>encodeURIComponent(A)).join("/");return await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${W}`,bucket:_,rawResponse:!0})}async getObjectBytes(_,E){let{accessKeyId:W,secretAccessKey:C,sessionToken:A}=this.getCredentials(),Y=this.s3VirtualHost(_),$=E.split("/").map((B)=>encodeURIComponent(B)).join("/"),G=this.objectPath(_,$),V=this.objectUrl(_,$),Z=new Date,Q=Z.toISOString().replace(/[:-]|\.\d{3}/g,""),N=Z.toISOString().slice(0,10).replace(/-/g,""),L=J.createHash("sha256").update("").digest("hex"),w={host:Y,"x-amz-date":Q,"x-amz-content-sha256":L};if(A)w["x-amz-security-token"]=A;let M=Object.keys(w).sort().map((B)=>`${B.toLowerCase()}:${w[B].trim()}
+`).join(""),U=Object.keys(w).sort().map((B)=>B.toLowerCase()).join(";"),F=["GET",G,"",M,U,L].join(`
+`),x="AWS4-HMAC-SHA256",I=`${N}/${this.region}/s3/aws4_request`,z=[x,Q,I,J.createHash("sha256").update(F).digest("hex")].join(`
+`),P=J.createHmac("sha256",`AWS4${C}`).update(N).digest(),K=J.createHmac("sha256",P).update(this.region).digest(),v=J.createHmac("sha256",K).update("s3").digest(),X=J.createHmac("sha256",v).update("aws4_request").digest(),O=J.createHmac("sha256",X).update(z).digest("hex"),j=`${x} Credential=${W}/${I}, SignedHeaders=${U}, Signature=${O}`,T=await fetch(V,{method:"GET",headers:{...w,Authorization:j}});if(!T.ok){let B=await T.text();throw Error(`S3 GET failed: ${T.status} ${B}`)}let R=await T.arrayBuffer(),D=T.headers.get("content-length");return{body:new Uint8Array(R),contentType:T.headers.get("content-type")??void 0,contentLength:D?Number.parseInt(D,10):void 0}}async copyObject(_){let E={"x-amz-copy-source":`/${_.sourceBucket}/${_.sourceKey}`};if(_.metadataDirective)E["x-amz-metadata-directive"]=_.metadataDirective;if(_.contentType)E["Content-Type"]=_.contentType;if(_.metadata)for(let[W,C]of Object.entries(_.metadata))E[`x-amz-meta-${W}`]=C;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${_.destinationBucket}/${_.destinationKey}`,headers:E})}async deleteObject(_,E){let W=E.split("/").map((C)=>encodeURIComponent(C)).join("/");await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${W}`,bucket:_})}async deleteObjects(_,E){let W=`<?xml version="1.0" encoding="UTF-8"?>
+<Delete>
+  ${E.map((A)=>`<Object><Key>${A}</Key></Object>`).join(`
+  `)}
+</Delete>`,C=J.createHash("md5").update(W).digest("base64");await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${_}`,queryParams:{delete:""},body:W,headers:{"Content-Type":"application/xml","Content-MD5":C}})}async bucketExists(_){try{return await this.client.request({service:"s3",region:this.region,method:"HEAD",path:`/${_}`}),!0}catch{return!1}}async copy(_){let E=m(_.source);await this.putObject({bucket:_.bucket,key:_.key,body:E,acl:_.acl,cacheControl:_.cacheControl,contentType:_.contentType,metadata:_.metadata})}async sync(_){let E=await this.listFilesRecursive(_.source);for(let W of E){if(_.exclude&&_.exclude.some((Y)=>W.includes(Y)))continue;if(_.include&&!_.include.some((Y)=>W.includes(Y)))continue;let C=W.substring(_.source.length+1),A=_.prefix?`${_.prefix}/${C}`:C;if(!_.dryRun){let Y=m(W);await this.putObject({bucket:_.bucket,key:A,body:Y,acl:_.acl,cacheControl:_.cacheControl,contentType:_.contentType,metadata:_.metadata})}}}async delete(_,E){await this.deleteObject(_,E)}async deletePrefix(_,E){let C=(await this.list({bucket:_,prefix:E})).map((A)=>A.Key);if(C.length>0)await this.deleteObjects(_,C)}async getBucketSize(_,E){return(await this.list({bucket:_,prefix:E})).reduce((C,A)=>C+A.Size,0)}async listFilesRecursive(_){let E=[],W=await d(_,{withFileTypes:!0});for(let C of W){let A=p(_,C.name);if(C.isDirectory()){let Y=await this.listFilesRecursive(A);E.push(...Y)}else E.push(A)}return E}async putBucketPolicy(_,E){let{accessKeyId:W,secretAccessKey:C,sessionToken:A}=this.getCredentials(),Y=this.s3BaseHost(),$=typeof E==="string"?E:JSON.stringify(E),G=new Date,V=G.toISOString().replace(/[:-]|\.\d{3}/g,""),Z=G.toISOString().slice(0,10).replace(/-/g,""),Q=J.createHash("sha256").update($).digest("hex"),N="/"+_,L="policy=",w={host:Y,"x-amz-date":V,"x-amz-content-sha256":Q,"content-type":"application/json"};if(A)w["x-amz-security-token"]=A;let M=Object.keys(w).sort().map((D)=>`${D.toLowerCase()}:${w[D].trim()}
+`).join(""),U=Object.keys(w).sort().map((D)=>D.toLowerCase()).join(";"),F=["PUT",N,"policy=",M,U,Q].join(`
+`),x="AWS4-HMAC-SHA256",I=`${Z}/${this.region}/s3/aws4_request`,z=[x,V,I,J.createHash("sha256").update(F).digest("hex")].join(`
+`),P=J.createHmac("sha256","AWS4"+C).update(Z).digest(),K=J.createHmac("sha256",P).update(this.region).digest(),v=J.createHmac("sha256",K).update("s3").digest(),X=J.createHmac("sha256",v).update("aws4_request").digest(),O=J.createHmac("sha256",X).update(z).digest("hex"),j=`${x} Credential=${W}/${I}, SignedHeaders=${U}, Signature=${O}`,T=`${this.endpointProtocol}://${Y}${N}?policy=`,R=await fetch(T,{method:"PUT",headers:{...w,Authorization:j},body:$});if(!R.ok){let D=await R.text();throw Error(`Failed to put bucket policy: ${R.status} ${D}`)}}async getBucketPolicy(_){let{accessKeyId:E,secretAccessKey:W,sessionToken:C}=this.getCredentials(),A=this.s3BaseHost(),Y=new Date,$=Y.toISOString().replace(/[:-]|\.\d{3}/g,""),G=Y.toISOString().slice(0,10).replace(/-/g,""),V=J.createHash("sha256").update("").digest("hex"),Z="/"+_,Q="policy=",N={host:A,"x-amz-date":$,"x-amz-content-sha256":V};if(C)N["x-amz-security-token"]=C;let L=Object.keys(N).sort().map((R)=>`${R.toLowerCase()}:${N[R].trim()}
+`).join(""),w=Object.keys(N).sort().map((R)=>R.toLowerCase()).join(";"),M=["GET",Z,"policy=",L,w,V].join(`
+`),U="AWS4-HMAC-SHA256",F=`${G}/${this.region}/s3/aws4_request`,x=[U,$,F,J.createHash("sha256").update(M).digest("hex")].join(`
+`),I=J.createHmac("sha256","AWS4"+W).update(G).digest(),z=J.createHmac("sha256",I).update(this.region).digest(),P=J.createHmac("sha256",z).update("s3").digest(),K=J.createHmac("sha256",P).update("aws4_request").digest(),v=J.createHmac("sha256",K).update(x).digest("hex"),X=`${U} Credential=${E}/${F}, SignedHeaders=${w}, Signature=${v}`,O=`${this.endpointProtocol}://${A}${Z}?policy=`,j=await fetch(O,{method:"GET",headers:{...N,Authorization:X}});if(j.status===404)return null;if(!j.ok){let R=await j.text();throw Error(`Failed to get bucket policy: ${j.status} ${R}`)}let T=await j.text();return JSON.parse(T)}async deleteBucketPolicy(_){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${_}`,queryParams:{policy:""}})}async headBucket(_){try{return{exists:!0,region:(await this.client.request({service:"s3",region:this.region,method:"HEAD",path:`/${_}`,returnHeaders:!0}))?.headers?.["x-amz-bucket-region"]}}catch(E){if(E.statusCode===404)return{exists:!1};throw E}}async headObject(_,E){try{let W=await this.client.request({service:"s3",region:this.region,method:"HEAD",path:`/${_}/${E}`,returnHeaders:!0});return{ContentLength:W?.headers?.["content-length"]?parseInt(W.headers["content-length"]):void 0,ContentType:W?.headers?.["content-type"],ETag:W?.headers?.etag,LastModified:W?.headers?.["last-modified"]}}catch(W){if(W.statusCode===404)return null;throw W}}async getObjectBuffer(_,E){let W=await this.getObject(_,E);return Buffer.from(W)}async getObjectJson(_,E){let W=await this.getObject(_,E);return JSON.parse(W)}async putObjectJson(_,E,W,C){await this.putObject({bucket:_,key:E,body:JSON.stringify(W),contentType:"application/json",...C})}async getBucketVersioning(_){return{Status:(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${_}`,queryParams:{versioning:""}}))?.VersioningConfiguration?.Status}}async putBucketVersioning(_,E){let W=`<?xml version="1.0" encoding="UTF-8"?>
+<VersioningConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  <Status>${E}</Status>
+</VersioningConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${_}`,queryParams:{versioning:""},headers:{"Content-Type":"application/xml"},body:W})}async getBucketLifecycleConfiguration(_){try{return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${_}`,queryParams:{lifecycle:""}}))?.LifecycleConfiguration}catch(E){if(E.statusCode===404)return null;throw E}}async putBucketLifecycleConfiguration(_,E){let C=`<?xml version="1.0" encoding="UTF-8"?>
+<LifecycleConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  ${E.map((A)=>{let Y=`<Rule><ID>${A.ID}</ID><Status>${A.Status}</Status>`;if(A.Filter)Y+=`<Filter><Prefix>${A.Filter.Prefix||""}</Prefix></Filter>`;else Y+="<Filter><Prefix></Prefix></Filter>";if(A.Expiration){if(A.Expiration.Days)Y+=`<Expiration><Days>${A.Expiration.Days}</Days></Expiration>`;else if(A.Expiration.Date)Y+=`<Expiration><Date>${A.Expiration.Date}</Date></Expiration>`}if(A.Transitions)for(let $ of A.Transitions)Y+=`<Transition><Days>${$.Days}</Days><StorageClass>${$.StorageClass}</StorageClass></Transition>`;if(A.NoncurrentVersionExpiration)Y+=`<NoncurrentVersionExpiration><NoncurrentDays>${A.NoncurrentVersionExpiration.NoncurrentDays}</NoncurrentDays></NoncurrentVersionExpiration>`;return Y+="</Rule>",Y}).join("")}
+</LifecycleConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${_}`,queryParams:{lifecycle:""},headers:{"Content-Type":"application/xml"},body:C})}async deleteBucketLifecycleConfiguration(_){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${_}`,queryParams:{lifecycle:""}})}async getBucketCors(_){try{return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${_}`,queryParams:{cors:""}}))?.CORSConfiguration}catch(E){if(E.statusCode===404)return null;throw E}}async putBucketCors(_,E){let C=`<?xml version="1.0" encoding="UTF-8"?>
+<CORSConfiguration>
+  ${E.map((A)=>{let Y="<CORSRule>";for(let $ of A.AllowedOrigins)Y+=`<AllowedOrigin>${$}</AllowedOrigin>`;for(let $ of A.AllowedMethods)Y+=`<AllowedMethod>${$}</AllowedMethod>`;if(A.AllowedHeaders)for(let $ of A.AllowedHeaders)Y+=`<AllowedHeader>${$}</AllowedHeader>`;if(A.ExposeHeaders)for(let $ of A.ExposeHeaders)Y+=`<ExposeHeader>${$}</ExposeHeader>`;if(A.MaxAgeSeconds)Y+=`<MaxAgeSeconds>${A.MaxAgeSeconds}</MaxAgeSeconds>`;return Y+="</CORSRule>",Y}).join("")}
+</CORSConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${_}`,queryParams:{cors:""},headers:{"Content-Type":"application/xml"},body:C})}async deleteBucketCors(_){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${_}`,queryParams:{cors:""}})}async getBucketEncryption(_){try{return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${_}`,queryParams:{encryption:""}}))?.ServerSideEncryptionConfiguration}catch(E){if(E.statusCode===404)return null;throw E}}async putBucketEncryption(_,E,W){let C=`<ApplyServerSideEncryptionByDefault><SSEAlgorithm>${E}</SSEAlgorithm>`;if(W)C+=`<KMSMasterKeyID>${W}</KMSMasterKeyID>`;C+="</ApplyServerSideEncryptionByDefault>";let A=`<?xml version="1.0" encoding="UTF-8"?>
+<ServerSideEncryptionConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  <Rule>${C}</Rule>
+</ServerSideEncryptionConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${_}`,queryParams:{encryption:""},headers:{"Content-Type":"application/xml"},body:A})}async deleteBucketEncryption(_){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${_}`,queryParams:{encryption:""}})}async getBucketTagging(_){try{let W=(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${_}`,queryParams:{tagging:""}}))?.Tagging?.TagSet?.Tag;if(!W)return[];return Array.isArray(W)?W:[W]}catch(E){if(E.statusCode===404)return[];throw E}}async putBucketTagging(_,E){let C=`<?xml version="1.0" encoding="UTF-8"?>
+<Tagging>
+  <TagSet>${E.map((A)=>`<Tag><Key>${A.Key}</Key><Value>${A.Value}</Value></Tag>`).join("")}</TagSet>
+</Tagging>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${_}`,queryParams:{tagging:""},headers:{"Content-Type":"application/xml"},body:C})}async deleteBucketTagging(_){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${_}`,queryParams:{tagging:""}})}async getObjectTagging(_,E){try{let C=(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${_}/${E}`,queryParams:{tagging:""}}))?.Tagging?.TagSet?.Tag;if(!C)return[];return Array.isArray(C)?C:[C]}catch(W){if(W.statusCode===404)return[];throw W}}async putObjectTagging(_,E,W){let A=`<?xml version="1.0" encoding="UTF-8"?>
+<Tagging>
+  <TagSet>${W.map((Y)=>`<Tag><Key>${Y.Key}</Key><Value>${Y.Value}</Value></Tag>`).join("")}</TagSet>
+</Tagging>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${_}/${E}`,queryParams:{tagging:""},headers:{"Content-Type":"application/xml"},body:A})}async deleteObjectTagging(_,E){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${_}/${E}`,queryParams:{tagging:""}})}async getBucketAcl(_){return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${_}`,queryParams:{acl:""}}))?.AccessControlPolicy}async putBucketAcl(_,E){await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${_}`,queryParams:{acl:""},headers:{"x-amz-acl":E}})}async getObjectAcl(_,E){return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${_}/${E}`,queryParams:{acl:""}}))?.AccessControlPolicy}async putObjectAcl(_,E,W){await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${_}/${E}`,queryParams:{acl:""},headers:{"x-amz-acl":W}})}async getBucketLocation(_){return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${_}`,queryParams:{location:""}}))?.LocationConstraint||"us-east-1"}async getBucketLogging(_){return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${_}`,queryParams:{logging:""}}))?.BucketLoggingStatus}async putBucketLogging(_,E,W){let C=`<?xml version="1.0" encoding="UTF-8"?>
+<BucketLoggingStatus xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  <LoggingEnabled>
+    <TargetBucket>${E}</TargetBucket>
+    <TargetPrefix>${W}</TargetPrefix>
+  </LoggingEnabled>
+</BucketLoggingStatus>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${_}`,queryParams:{logging:""},headers:{"Content-Type":"application/xml"},body:C})}async getBucketNotificationConfiguration(_){return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${_}`,queryParams:{notification:""}}))?.NotificationConfiguration}async putBucketNotificationConfiguration(_,E){let W="";if(E.LambdaFunctionConfigurations)for(let A of E.LambdaFunctionConfigurations){if(W+="<CloudFunctionConfiguration>",A.Id)W+=`<Id>${A.Id}</Id>`;W+=`<CloudFunction>${A.LambdaFunctionArn}</CloudFunction>`;for(let Y of A.Events)W+=`<Event>${Y}</Event>`;if(A.Filter?.Key?.FilterRules){W+="<Filter><S3Key>";for(let Y of A.Filter.Key.FilterRules)W+=`<FilterRule><Name>${Y.Name}</Name><Value>${Y.Value}</Value></FilterRule>`;W+="</S3Key></Filter>"}W+="</CloudFunctionConfiguration>"}if(E.TopicConfigurations)for(let A of E.TopicConfigurations){if(W+="<TopicConfiguration>",A.Id)W+=`<Id>${A.Id}</Id>`;W+=`<Topic>${A.TopicArn}</Topic>`;for(let Y of A.Events)W+=`<Event>${Y}</Event>`;W+="</TopicConfiguration>"}if(E.QueueConfigurations)for(let A of E.QueueConfigurations){if(W+="<QueueConfiguration>",A.Id)W+=`<Id>${A.Id}</Id>`;W+=`<Queue>${A.QueueArn}</Queue>`;for(let Y of A.Events)W+=`<Event>${Y}</Event>`;W+="</QueueConfiguration>"}let C=`<?xml version="1.0" encoding="UTF-8"?>
+<NotificationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  ${W}
+</NotificationConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${_}`,queryParams:{notification:""},headers:{"Content-Type":"application/xml"},body:C})}async getBucketWebsite(_){try{return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${_}`,queryParams:{website:""}}))?.WebsiteConfiguration}catch(E){if(E.statusCode===404)return null;throw E}}async putBucketWebsite(_,E){let W="";if(E.RedirectAllRequestsTo)W=`<RedirectAllRequestsTo>
+        <HostName>${E.RedirectAllRequestsTo.HostName}</HostName>
+        ${E.RedirectAllRequestsTo.Protocol?`<Protocol>${E.RedirectAllRequestsTo.Protocol}</Protocol>`:""}
+      </RedirectAllRequestsTo>`;else if(W=`<IndexDocument><Suffix>${E.IndexDocument}</Suffix></IndexDocument>`,E.ErrorDocument)W+=`<ErrorDocument><Key>${E.ErrorDocument}</Key></ErrorDocument>`;let C=`<?xml version="1.0" encoding="UTF-8"?>
+<WebsiteConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  ${W}
+</WebsiteConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${_}`,queryParams:{website:""},headers:{"Content-Type":"application/xml"},body:C})}async deleteBucketWebsite(_){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${_}`,queryParams:{website:""}})}async getBucketReplication(_){try{return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${_}`,queryParams:{replication:""}}))?.ReplicationConfiguration}catch(E){if(E.statusCode===404)return null;throw E}}async deleteBucketReplication(_){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${_}`,queryParams:{replication:""}})}async getPublicAccessBlock(_){try{return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${_}`,queryParams:{publicAccessBlock:""}}))?.PublicAccessBlockConfiguration}catch(E){if(E.statusCode===404)return null;throw E}}async putPublicAccessBlock(_,E){let W=`<?xml version="1.0" encoding="UTF-8"?>
+<PublicAccessBlockConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  <BlockPublicAcls>${E.BlockPublicAcls??!0}</BlockPublicAcls>
+  <IgnorePublicAcls>${E.IgnorePublicAcls??!0}</IgnorePublicAcls>
+  <BlockPublicPolicy>${E.BlockPublicPolicy??!0}</BlockPublicPolicy>
+  <RestrictPublicBuckets>${E.RestrictPublicBuckets??!0}</RestrictPublicBuckets>
+</PublicAccessBlockConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${_}`,queryParams:{publicAccessBlock:""},headers:{"Content-Type":"application/xml"},body:W})}async deletePublicAccessBlock(_){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${_}`,queryParams:{publicAccessBlock:""}})}generatePresignedGetUrl(_,E,W=3600){let{accessKeyId:C,secretAccessKey:A}=this.getCredentials(),Y=this.s3VirtualHost(_),$=new Date,G=$.toISOString().replace(/[:-]|\.\d{3}/g,""),V=$.toISOString().slice(0,10).replace(/-/g,""),Z=`${V}/${this.region}/s3/aws4_request`,Q=`${C}/${Z}`,N=E.split("/").map((P)=>encodeURIComponent(P)).join("/"),L=new URLSearchParams({"X-Amz-Algorithm":"AWS4-HMAC-SHA256","X-Amz-Credential":Q,"X-Amz-Date":G,"X-Amz-Expires":W.toString(),"X-Amz-SignedHeaders":"host"}),w=["GET",this.objectPath(_,N),L.toString(),`host:${Y}
+`,"host","UNSIGNED-PAYLOAD"].join(`
+`),M=["AWS4-HMAC-SHA256",G,Z,J.createHash("sha256").update(w).digest("hex")].join(`
+`),U=J.createHmac("sha256",`AWS4${A}`).update(V).digest(),F=J.createHmac("sha256",U).update(this.region).digest(),x=J.createHmac("sha256",F).update("s3").digest(),I=J.createHmac("sha256",x).update("aws4_request").digest(),z=J.createHmac("sha256",I).update(M).digest("hex");return L.append("X-Amz-Signature",z),`${this.endpointProtocol}://${Y}${this.objectPath(_,N)}?${L.toString()}`}generatePresignedPutUrl(_,E,W,C=3600){let{accessKeyId:A,secretAccessKey:Y}=this.getCredentials(),$=this.s3VirtualHost(_),G=new Date,V=G.toISOString().replace(/[:-]|\.\d{3}/g,""),Z=G.toISOString().slice(0,10).replace(/-/g,""),Q=`${Z}/${this.region}/s3/aws4_request`,N=`${A}/${Q}`,L=E.split("/").map((K)=>encodeURIComponent(K)).join("/"),w=new URLSearchParams({"X-Amz-Algorithm":"AWS4-HMAC-SHA256","X-Amz-Credential":N,"X-Amz-Date":V,"X-Amz-Expires":C.toString(),"X-Amz-SignedHeaders":"content-type;host"}),M=["PUT",this.objectPath(_,L),w.toString(),`content-type:${W}
+host:${$}
+`,"content-type;host","UNSIGNED-PAYLOAD"].join(`
+`),U=["AWS4-HMAC-SHA256",V,Q,J.createHash("sha256").update(M).digest("hex")].join(`
+`),F=J.createHmac("sha256",`AWS4${Y}`).update(Z).digest(),x=J.createHmac("sha256",F).update(this.region).digest(),I=J.createHmac("sha256",x).update("s3").digest(),z=J.createHmac("sha256",I).update("aws4_request").digest(),P=J.createHmac("sha256",z).update(U).digest("hex");return w.append("X-Amz-Signature",P),`${this.endpointProtocol}://${$}${this.objectPath(_,L)}?${w.toString()}`}async createMultipartUpload(_,E,W){let C={};if(W?.contentType)C["Content-Type"]=W.contentType;if(W?.metadata)for(let[G,V]of Object.entries(W.metadata))C[`x-amz-meta-${G}`]=V;let A=E.split("/").map((G)=>encodeURIComponent(G)).join("/"),Y=await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${A}`,bucket:_,queryParams:{uploads:""},headers:C});return{UploadId:(Y?.InitiateMultipartUploadResult??Y)?.UploadId}}async uploadPart(_,E,W,C,A){let{accessKeyId:Y,secretAccessKey:$,sessionToken:G}=this.getCredentials(),V=this.s3VirtualHost(_),Z=E.split("/").map((q)=>encodeURIComponent(q)).join("/"),Q=this.objectPath(_,Z),N=`${this.objectUrl(_,Z)}?partNumber=${C}&uploadId=${encodeURIComponent(W)}`,L=new Date,w=L.toISOString().replace(/[:-]|\.\d{3}/g,""),M=L.toISOString().slice(0,10).replace(/-/g,""),U=J.createHash("sha256").update(A).digest("hex"),F={host:V,"x-amz-date":w,"x-amz-content-sha256":U};if(G)F["x-amz-security-token"]=G;let x=Object.keys(F).sort().map((q)=>`${q.toLowerCase()}:${F[q].trim()}
+`).join(""),I=Object.keys(F).sort().map((q)=>q.toLowerCase()).join(";"),z=["PUT",Q,`partNumber=${C}&uploadId=${encodeURIComponent(W)}`,x,I,U].join(`
+`),P="AWS4-HMAC-SHA256",K=`${M}/${this.region}/s3/aws4_request`,v=[P,w,K,J.createHash("sha256").update(z).digest("hex")].join(`
+`),X=J.createHmac("sha256",`AWS4${$}`).update(M).digest(),O=J.createHmac("sha256",X).update(this.region).digest(),j=J.createHmac("sha256",O).update("s3").digest(),T=J.createHmac("sha256",j).update("aws4_request").digest(),R=J.createHmac("sha256",T).update(v).digest("hex"),D=`${P} Credential=${Y}/${K}, SignedHeaders=${I}, Signature=${R}`,B=await fetch(N,{method:"PUT",headers:{...F,Authorization:D},body:g(A)});if(!B.ok){let q=await B.text();throw Error(`Upload part failed: ${B.status} ${q}`)}return{ETag:B.headers.get("etag")||""}}async completeMultipartUpload(_,E,W,C){let A=E.split("/").map((G)=>encodeURIComponent(G)).join("/"),$=`<?xml version="1.0" encoding="UTF-8"?>
+<CompleteMultipartUpload>${C.sort((G,V)=>G.PartNumber-V.PartNumber).map((G)=>`<Part><PartNumber>${G.PartNumber}</PartNumber><ETag>${G.ETag}</ETag></Part>`).join("")}</CompleteMultipartUpload>`;await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${A}`,bucket:_,queryParams:{uploadId:W},headers:{"Content-Type":"application/xml"},body:$})}async abortMultipartUpload(_,E,W){let C=E.split("/").map((A)=>encodeURIComponent(A)).join("/");await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${C}`,bucket:_,queryParams:{uploadId:W}})}async listMultipartUploads(_){let E=await this.client.request({service:"s3",region:this.region,method:"GET",path:"/",bucket:_,queryParams:{uploads:""}}),W=(E?.ListMultipartUploadsResult??E)?.Upload;if(!W)return[];return(Array.isArray(W)?W:[W]).map((A)=>({Key:A.Key,UploadId:A.UploadId,Initiated:A.Initiated}))}async restoreObject(_,E,W,C="Standard"){let A=`<?xml version="1.0" encoding="UTF-8"?>
+<RestoreRequest>
+  <Days>${W}</Days>
+  <GlacierJobParameters>
+    <Tier>${C}</Tier>
+  </GlacierJobParameters>
+</RestoreRequest>`;await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${_}/${E}`,queryParams:{restore:""},headers:{"Content-Type":"application/xml"},body:A})}async selectObjectContent(_,E,W,C,A="JSON"){let Y="";if(C==="CSV")Y="<CSV><FileHeaderInfo>USE</FileHeaderInfo></CSV>";else if(C==="JSON")Y="<JSON><Type>DOCUMENT</Type></JSON>";else Y="<Parquet/>";let $="";if(A==="CSV")$="<CSV/>";else $="<JSON/>";let G=`<?xml version="1.0" encoding="UTF-8"?>
+<SelectObjectContentRequest>
+  <Expression>${W}</Expression>
+  <ExpressionType>SQL</ExpressionType>
+  <InputSerialization>${Y}</InputSerialization>
+  <OutputSerialization>${$}</OutputSerialization>
+</SelectObjectContentRequest>`;return await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${_}/${E}`,queryParams:{select:"","select-type":"2"},headers:{"Content-Type":"application/xml"},body:G,rawResponse:!0})}async getSignedUrl(_){let{bucket:E,key:W,expiresIn:C=3600,operation:A="getObject"}=_,{accessKeyId:Y,secretAccessKey:$,sessionToken:G}=this.getCredentials(),V=new Date,Z=V.toISOString().replace(/[:-]|\.\d{3}/g,""),Q=V.toISOString().slice(0,10).replace(/-/g,""),N=this.s3VirtualHost(E),L=A==="putObject"?"PUT":"GET",w="AWS4-HMAC-SHA256",M=`${Q}/${this.region}/s3/aws4_request`,F={"X-Amz-Algorithm":"AWS4-HMAC-SHA256","X-Amz-Credential":`${Y}/${M}`,"X-Amz-Date":Z,"X-Amz-Expires":C.toString(),"X-Amz-SignedHeaders":"host"};if(G)F["X-Amz-Security-Token"]=G;let I=Object.keys(F).sort().map((S)=>`${encodeURIComponent(S)}=${encodeURIComponent(F[S])}`).join("&"),z=W.split("/").map((S)=>encodeURIComponent(S)).join("/"),P=this.objectPath(E,z),K=`host:${N}
+`,O=[L,P,I,K,"host","UNSIGNED-PAYLOAD"].join(`
+`),j=["AWS4-HMAC-SHA256",Z,M,J.createHash("sha256").update(O).digest("hex")].join(`
+`),T=J.createHmac("sha256",`AWS4${$}`).update(Q).digest(),R=J.createHmac("sha256",T).update(this.region).digest(),D=J.createHmac("sha256",R).update("s3").digest(),B=J.createHmac("sha256",D).update("aws4_request").digest(),q=J.createHmac("sha256",B).update(j).digest("hex");return`${this.endpointProtocol}://${N}${P}?${I}&X-Amz-Signature=${q}`}async listObjects(_){let{bucket:E,prefix:W,maxKeys:C=1000,continuationToken:A}=_,Y={"list-type":"2","max-keys":C.toString()};if(W)Y.prefix=W;if(A)Y["continuation-token"]=A;let $=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${E}`,queryParams:Y}),G=[],V=$?.ListBucketResult??$;if(V?.Contents){let Z=Array.isArray(V.Contents)?V.Contents:[V.Contents];for(let Q of Z)G.push({Key:Q.Key||"",LastModified:Q.LastModified||"",Size:Number.parseInt(Q.Size||"0"),ETag:Q.ETag})}return{objects:G,nextContinuationToken:V?.NextContinuationToken}}async emptyBucket(_){let E=0,W=await this.listAllObjects({bucket:_});if(W.length>0)for(let C=0;C<W.length;C+=1000){let Y=W.slice(C,C+1000).map(($)=>$.Key);await this.deleteObjects(_,Y),E+=Y.length}try{let C,A;do{let Y=await this.listObjectVersions({bucket:_,keyMarker:C,versionIdMarker:A,maxKeys:1000}),$=[];if(Y.versions)for(let G of Y.versions)$.push({Key:G.Key,VersionId:G.VersionId});if(Y.deleteMarkers)for(let G of Y.deleteMarkers)$.push({Key:G.Key,VersionId:G.VersionId});if($.length>0)await this.deleteObjectVersions(_,$),E+=$.length;C=Y.nextKeyMarker,A=Y.nextVersionIdMarker}while(C)}catch{}return{deletedCount:E}}async listObjectVersions(_){let{bucket:E,prefix:W,keyMarker:C,versionIdMarker:A,maxKeys:Y=1000}=_,$={versions:"","max-keys":Y.toString()};if(W)$.prefix=W;if(C)$["key-marker"]=C;if(A)$["version-id-marker"]=A;let G=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${E}`,queryParams:$}),V=[],Z=[];if(G.Version){let Q=Array.isArray(G.Version)?G.Version:[G.Version];for(let N of Q)V.push({Key:N.Key,VersionId:N.VersionId,IsLatest:N.IsLatest==="true"})}if(G.DeleteMarker){let Q=Array.isArray(G.DeleteMarker)?G.DeleteMarker:[G.DeleteMarker];for(let N of Q)Z.push({Key:N.Key,VersionId:N.VersionId,IsLatest:N.IsLatest==="true"})}return{versions:V,deleteMarkers:Z,nextKeyMarker:G.NextKeyMarker,nextVersionIdMarker:G.NextVersionIdMarker}}async deleteObjectVersions(_,E){let W=`<?xml version="1.0" encoding="UTF-8"?>
+<Delete>
+  <Quiet>true</Quiet>
+  ${E.map((A)=>`<Object><Key>${A.Key}</Key>${A.VersionId?`<VersionId>${A.VersionId}</VersionId>`:""}</Object>`).join(`
+  `)}
+</Delete>`,C=J.createHash("md5").update(W).digest("base64");await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${_}`,queryParams:{delete:""},body:W,headers:{"Content-Type":"application/xml","Content-MD5":C}})}}
+export{f as Yh,l as Zh};