@stacksjs/ts-cloud 0.12.0 → 0.12.1

package/dist/bin/chunk-tvz9c388.js

@@ -1 +0,0 @@
-import{gd as a}from"./chunk-3aph4c1w.js";import"./chunk-ja1vjdn1.js";import"./chunk-ehc63fvs.js";export{a as RDSClient};

package/dist/bin/chunk-x6f61g36.js

@@ -1,9 +0,0 @@
-import{Eh as re,Fh as ne}from"./chunk-4q6tad44.js";function it(e,t){return`/var/www/${e}-${t}`}var Ee=new Set(["laravel","php","statamic","wordpress"]);function se(e){return e.type!=null&&Ee.has(e.type)}function Pe(e){let t=e.proxyTo;if(t==null)return[];return(Array.isArray(t)?t:[t]).map((n)=>String(n).trim()).filter((n)=>n.length>0)}function be(e){return Pe(e).length>0}function oe(e){if(e.deploy)return e.deploy;if(se(e))return"server";if(e.start)return"server";return"bucket"}function M(e){if(e.redirect)return"redirect";if(be(e))return"proxy";if(se(e))return"server-php";if(oe(e)==="bucket")return"bucket";return e.start?"server-app":"server-static"}function Ce(e){return e.infrastructure?.compute!=null||Boolean(e.cloud?.attachTo?.trim())}function at(e,t={}){let r=[],n=[],i=e.sites||{},s=Ce(e),c=ne(e);if(c)r.push(c);let d=new Map;for(let[l,o]of Object.entries(i)){if(!o)continue;let S=oe(o),E=M(o);if(E==="redirect"){if(!o.domain)r.push(`Site '${l}' is a redirect site but has no \`domain\` to redirect from.`);if(!(typeof o.redirect==="string"?o.redirect:o.redirect?.to))r.push(`Site '${l}' is a redirect site but has no redirect target (\`redirect\` / \`redirect.to\`).`);if(!s)r.push(`Site '${l}' is a redirect site but no \`infrastructure.compute\` is configured to host the gateway that serves the redirect.`);let a=[];if(o.start)a.push("start");if(o.root)a.push("root");if(o.proxyTo)a.push("proxyTo");if(a.length>0)n.push(`Site '${l}' is a redirect site but also sets ${a.join(", ")}. These are ignored.`);continue}if(E==="proxy"){if(!o.domain)r.push(`Site '${l}' is a proxy site but has no \`domain\` to route from.`);if(!s)r.push(`Site '${l}' is a proxy site but no \`infrastructure.compute\` is configured to host the gateway that forwards it.`);let p=[];if(o.start)p.push("start");if(o.root)p.push("root");if(typeof o.port==="number")p.push("port");if(o.build)p.push("build");if(o.preStart&&o.preStart.length>0)p.push("preStart");if(p.length>0)n.push(`Site '${l}' sets \`proxyTo\`, so ts-cloud ships and supervises nothing for it. ${p.join(", ")} ${p.length===1?"is":"are"} ignored — remove ${p.length===1?"it":"them"}, or drop \`proxyTo\` to let ts-cloud own the service.`);continue}if(S==="server"&&!o.start&&!o.root){r.push(`Site '${l}' sets deploy:'server' but declares neither \`start\` (dynamic app) nor \`root\` (static site to serve). Add one.`);continue}if(E==="server-php"){if(!s)r.push(`Site '${l}' is a PHP site (type:'${o.type}') but no \`infrastructure.compute\` is configured. Add a server (infrastructure.compute) with PHP provisioning.`);if(!o.repository?.url)r.push(`Site '${l}' is a PHP site (type:'${o.type}') but has no \`repository.url\` to clone. PHP sites deploy via git.`)}else if(E==="server-app"){if(!s)r.push(`Site '${l}' deploys to a server (deploy:'server'${o.deploy?"":" inferred from `start`"}) but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`);if(typeof o.port==="number"){let p=t.occupiedPorts?.get(o.port);if(p)r.push(`Site '${l}' wants port ${o.port}, which project '${p}' already serves on this box. Attached projects share one port namespace. Give '${l}' a free port, or let the attach allocate one.`);let a=d.get(o.port);if(a)r.push(`Sites '${a}' and '${l}' both use port ${o.port}. Server apps sharing a box must use distinct ports.`);else d.set(o.port,l)}}else if(E==="server-static"){if(!o.root)r.push(`Site '${l}' is a server static site (deploy:'server', no \`start\`) but has no \`root\` directory to serve.`);if(!s)r.push(`Site '${l}' deploys to a server (deploy:'server') but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`)}else{if(!o.root)r.push(`Site '${l}' deploys to a bucket but has no \`root\` directory to upload.`);let p=[];if(o.start)p.push("start");if(typeof o.port==="number")p.push("port");if(o.preStart&&o.preStart.length>0)p.push("preStart");if(p.length>0)n.push(`Site '${l}' deploys to a bucket but sets server-only field(s): ${p.join(", ")}. These are ignored. Set deploy:'server' to use them.`)}}return{errors:r,warnings:n}}function ct(e){let t=M(e);return t!=="bucket"&&t!=="redirect"&&t!=="proxy"}function lt(e){return M(e)==="bucket"}function pt(e,t){if(re(e)==="serverless")return!0;let r=Object.entries(e.sites??{}).filter(([,i])=>i!=null),n=t?r.filter(([i])=>i===t):r;if(n.length===0)return!0;return!n.every(([,i])=>{let s=M(i);return s==="redirect"||s==="proxy"})}var U={php:"php.net",nginx:"nginx.org",composer:"getcomposer.org",mysql:"mysql.com",mariadb:"mariadb.com/server",postgres:"postgresql.org",vitess:"vitess.io",etcd:"etcd.io",redis:"redis.io",memcached:"memcached.org",meilisearch:"meilisearch.com",mail:"github.com/mail-os/mail",git:"git-scm.com",certbot:"certbot.eff.org",bun:"bun.sh",node:"nodejs.org",deno:"deno.land"};var R="/opt/pantry";function V(e){return`'${e.split("'").join("'\\''")}'`}function dt(e={}){return["export DEBIAN_FRONTEND=noninteractive","export PANTRY_SERVICE_SCOPE=system","export PANTRY_INSTALL_DIR=/usr/local/bin",e.version?`export PANTRY_VERSION=${V(e.version)}`:'export PANTRY_VERSION="${PANTRY_VERSION:-latest}"',"command -v curl >/dev/null 2>&1 || (apt-get update -y && apt-get install -y curl ca-certificates)","command -v unzip >/dev/null 2>&1 || (apt-get update -y && apt-get install -y unzip)",'OS=$(uname -s | tr \'[:upper:]\' \'[:lower:]\'); ARCH=$(uname -m); case "$ARCH" in x86_64|amd64) ARCH=x64 ;; arm64|aarch64) ARCH=arm64 ;; esac; ZIP="pantry-${OS}-${ARCH}.zip"; if [ "${PANTRY_VERSION:-latest}" = latest ]; then REL=\'latest/download\'; else REL="download/v${PANTRY_VERSION}"; fi; TMP=$(mktemp -d); curl -fsSL -o "${TMP}/${ZIP}" "https://github.com/pantry-pm/pantry/releases/${REL}/${ZIP}"; unzip -o "${TMP}/${ZIP}" -d /usr/local/bin; chmod +x /usr/local/bin/pantry; rm -rf "${TMP}"','export PATH="/usr/local/bin:$PATH"',"mkdir -p /opt/pantry"]}function G(){return'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true'}function D(e){if(e.length===0)return[];return[`(cd /opt/pantry && pantry install ${[...new Set(e)].map(V).join(" ")})`]}function ie(e){return[...new Set(e)].flatMap((t)=>[`(cd /opt/pantry && pantry start ${V(t)})`,`(cd /opt/pantry && pantry enable ${V(t)})`])}var _="/etc/mail",h="mail-server",F="mail",Y=`${R}/pantry/.bin`;function T(e){return`'${String(e).split("'").join("'\\''")}'`}function P(e){return`"${e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`}function Re(e){return[e.version?`${U.mail}@${e.version}`:U.mail]}function K(e,t){return`${_}/dkim/${t}.${e.dkim.selector}.pem`}function De(e){let t=["# Generated by ts-cloud. Edits are overwritten on the next deploy —","# change `services.mail` in the cloud config instead.","","[server]",`host = ${P(e.bindAddress)}`,`port = ${e.ports.smtp}`,`hostname = ${P(e.hostname)}`];if(e.domains.length>0)t.push(`local_domains = ${P(e.domains.join(", "))}`);if(e.mode==="catcher")t.push("catch_all = true");if(t.push(`max_message_size = ${e.maxMessageSize}`,"","[tls]",`enabled = ${e.tls.enabled}`),e.tls.certPath)t.push(`cert_path = ${P(e.tls.certPath)}`);if(e.tls.keyPath)t.push(`key_path = ${P(e.tls.keyPath)}`);if(t.push("","[auth]",`enabled = ${e.mode==="server"}`,"","[antispam]",`dnsbl = ${e.spam.dnsbl}`,`greylist = ${e.spam.greylist}`,`spam_filter = ${e.spam.enabled}`,`junk_score = ${e.spam.junkScore}`,`reject_score = ${e.spam.rejectScore}`,"","[dkim]",`rotation_enabled = ${e.dkim.enabled&&e.dkim.rotate}`,`rotation_interval_days = ${e.dkim.rotateIntervalDays}`,"","[acme]",`enabled = ${e.tls.acme}`),e.tls.acmeEmail)t.push(`email = ${P(e.tls.acmeEmail)}`);if(t.push("","[webhook]",`enabled = ${!!e.webhookUrl}`),e.webhookUrl)t.push(`url = ${P(e.webhookUrl)}`);return t.push(""),t.join(`
-`)}function Ae(e){let t=["# Generated by ts-cloud. See /etc/mail/config.toml for the rest.",`SMTP_DB_PATH=${e.storagePath}/mail.db`,`SMTP_DELIVERY_METHOD=${e.delivery==="ses"?"ses":"direct"}`];if(e.delivery==="ses")t.push(`SMTP_SES_REGION=${e.sesRegion}`);if(e.ports.submission)t.push(`SUBMISSION_PORT=${e.ports.submission}`);if(e.ports.submissions)t.push(`SMTPS_PORT=${e.ports.submissions}`);if(e.ports.imap)t.push("IMAP_ENABLED=1",`IMAP_PORT=${e.ports.imap}`);if(e.webmail.enabled)t.push("SMTP_ENABLE_WEBMAIL=true",`SMTP_WEBMAIL_PORT=${e.webmail.port}`,`SMTP_WEBMAIL_SECURE_COOKIES=${e.tls.enabled}`);if(e.tls.requireForAuth)t.push("SMTP_REQUIRE_TLS_FOR_AUTH=true");if(e.dkim.enabled&&e.domains.length>0){let[r,...n]=e.domains;if(t.push(`DKIM_DOMAIN=${r}`,`DKIM_SELECTOR=${e.dkim.selector}`,`DKIM_PRIVATE_KEY_PATH=${K(e,r)}`),n.length>0){let i=n.map((s)=>`${s}:${e.dkim.selector}:${K(e,s)}`);t.push(`DKIM_EXTRA_KEYS=${i.join(",")}`)}}return t.push(""),t.join(`
-`)}function Oe(e){let t=[e.ports.smtp,e.ports.submission,e.ports.submissions,e.ports.imap,e.ports.imaps].some((r)=>typeof r==="number"&&r<1024);return["[Unit]","Description=Mail server (SMTP/IMAP + webmail)","After=network-online.target","Wants=network-online.target","","[Service]","Type=simple",`User=${h}`,`Group=${h}`,`WorkingDirectory=${e.storagePath}`,`EnvironmentFile=${_}/mail.env`,`Environment="PATH=${Y}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"`,`ExecStart=${Y}/mail serve --config ${_}/config.toml`,"Restart=always","RestartSec=5","LimitNOFILE=65536",...t?["AmbientCapabilities=CAP_NET_BIND_SERVICE","CapabilityBoundingSet=CAP_NET_BIND_SERVICE"]:[],"NoNewPrivileges=true","PrivateTmp=true","ProtectSystem=strict","ProtectHome=true","ProtectKernelTunables=true","ProtectKernelModules=true","ProtectControlGroups=true",`ReadWritePaths=${e.storagePath} ${_}`,"","[Install]","WantedBy=multi-user.target",""].join(`
-`)}function Le(e){if(!e.dkim.enabled||e.domains.length===0)return[];let t=[`mkdir -p ${_}/dkim`];for(let r of e.domains){let n=K(e,r);t.push(`if [ ! -f ${T(n)} ]; then openssl genrsa -out ${T(n)} 2048; fi`,`chmod 0600 ${T(n)}`,`echo "DKIM ${e.dkim.selector}._domainkey.${r} IN TXT v=DKIM1; k=rsa; p=$(openssl rsa -in ${T(n)} -pubout -outform PEM 2>/dev/null | grep -v '^-----' | tr -d '\\n')"`)}return t.push(`chown -R ${h}:${h} ${_}/dkim`),t}function Ue(e){if(e.accounts.length===0)return[];let t=(r)=>`runuser -u ${h} -- env SMTP_DB_PATH=${T(`${e.storagePath}/mail.db`)} ${Y}/mail user:local ${r} || true`;return e.accounts.flatMap((r)=>[t(`create ${T(r.address)} ${T(r.password)} ${T(r.address)}`),t(`change-password ${T(r.address)} ${T(r.password)}`)])}function ae(e){if(!e.enabled)return[];return[...D(Re(e)),`id -u ${h} >/dev/null 2>&1 || useradd --system --no-create-home --shell /usr/sbin/nologin ${h}`,`mkdir -p ${e.storagePath} ${_}`,`chown -R ${h}:${h} ${e.storagePath}`,`cat > ${_}/config.toml <<'TS_CLOUD_MAIL_CONF_EOF'`,De(e),"TS_CLOUD_MAIL_CONF_EOF",`cat > ${_}/mail.env <<'TS_CLOUD_MAIL_ENV_EOF'`,Ae(e),"TS_CLOUD_MAIL_ENV_EOF",`chmod 0640 ${_}/mail.env`,`chown root:${h} ${_}/mail.env`,...Le(e),`cat > /etc/systemd/system/${F}.service <<'TS_CLOUD_MAIL_UNIT_EOF'`,Oe(e),"TS_CLOUD_MAIL_UNIT_EOF","systemctl daemon-reload",`systemctl enable ${F}`,`systemctl restart ${F}`,...Ue(e)]}var g=`${R}/pantry/.bin`,X=15306,j=15991,w=15999,ce=16101,B=2379,v="/var/lib/vitess",z=100;function xe(e){return e===!0||typeof e==="object"&&e!==null}function Ie(e){return typeof e==="object"&&e!==null?e:{}}function f(e){return`'${String(e).split("'").join("'\\''")}'`}function ke(e){let r=[e.version?`vitess.io@${e.version}`:"vitess.io"];if(e.mode!=="combo"&&!e.etcdEndpoint)r.push("etcd.io");return r.push("mysql.com@8.0.43"),r}var m="vitess",Ne=`${g}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`,de="/usr/local/lib/vitess",Q=new Map;function W(e){return`${de}/${e}.sh`}function A(e,t){return Q.set(e,Me(t)),`/bin/sh ${W(e)}`}function le(){let e=[`mkdir -p ${de}`];for(let[t,r]of Q)e.push(`cat > ${W(t)} <<'TS_CLOUD_VITESS_LAUNCHER_EOF'`,r,"TS_CLOUD_VITESS_LAUNCHER_EOF",`chmod 0755 ${W(t)}`);return e}function Me(e){return["#!/bin/sh","set -e",`cd ${R}`,`PANTRY_ENV="$(pantry env 2>/dev/null | grep -E '^(export [A-Za-z_]|[A-Za-z_][A-Za-z0-9_]*=)' || true)"`,'if [ -n "$PANTRY_ENV" ]; then eval "$PANTRY_ENV"; fi',`VT_MYSQL_ROOT="$(dirname "$(dirname "$(readlink -f ${g}/mysqld 2>/dev/null)")")"`,`VTROOT="$(dirname "$(dirname "$(readlink -f ${g}/mysqlctld 2>/dev/null)")")"`,"export VT_MYSQL_ROOT VTROOT",'LD_LIBRARY_PATH="$VT_MYSQL_ROOT/lib:$VTROOT/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"',"export LD_LIBRARY_PATH",`exec ${e.join(" ")}`].join(`
-`)}function O(e){let t=["[Unit]",`Description=${e.description}`,`After=network.target${e.after?.length?` ${e.after.join(" ")}`:""}`];if(e.requires?.length)t.push(`Requires=${e.requires.join(" ")}`);return t.push("","[Service]","Type=simple",`User=${m}`,`Group=${m}`,`Environment="PATH=${Ne}"`,`Environment="VTDATAROOT=${v}"`,...Object.entries(e.environment??{}).map(([r,n])=>`Environment="${r}=${n}"`),...(e.execStartPre??[]).map((r)=>`ExecStartPre=${r}`),`ExecStart=${e.execStart}`,"Restart=always","RestartSec=5","LimitNOFILE=65535","","[Install]","WantedBy=multi-user.target"),t.join(`
-`)}function pe(e,t){return[`cat > /etc/systemd/system/${e}.service <<'TS_CLOUD_VITESS_UNIT_EOF'`,t,"TS_CLOUD_VITESS_UNIT_EOF"]}function Ve(e){let t=e.cell??"zone1",r=e.vtgatePort??X,i=`${((e.keyspaces?.length)?e.keyspaces:[{name:"app"}]).map((s)=>{let c=(s.sharded?["-80","80-"]:["0"]).map((d)=>`shards:{name:"${d}"}`).join(" ");return`keyspaces:{name:"${s.name}" ${c}}`}).join(" ")} cells:"${t}"`;return O({description:"Vitess (vtcombo, single-process development stack)",execStart:A("vtcombo",[`${g}/vtcombo`,`--cell ${t}`,`--proto-topo ${f(i)}`,`--mysql-server-port ${r}`,"--mysql-server-bind-address 127.0.0.1","--mysql-auth-server-impl none","--start-mysql",`--port ${j}`,`--grpc-port ${w}`])})}function we(){return O({description:"etcd (Vitess topology store)",execStart:A("etcd",[`${g}/etcd`,`--data-dir ${v}/etcd`,`--listen-client-urls http://127.0.0.1:${B}`,`--advertise-client-urls http://127.0.0.1:${B}`]),execStartPre:[`+/bin/mkdir -p ${v}/etcd`,`+/bin/chown ${m}:${m} ${v}/etcd`]})}function J(e){return["--topo-implementation etcd2",`--topo-global-server-address ${e.etcdEndpoint??`http://127.0.0.1:${B}`}`,"--topo-global-root /vitess/global"]}function Be(e){let t=!e.etcdEndpoint;return O({description:"Vitess vtctld (control plane)",after:t?["vitess-etcd.service"]:[],requires:t?["vitess-etcd.service"]:[],execStart:A("vtctld",[`${g}/vtctld`,...J(e),`--cell ${e.cell??"zone1"}`,"--service-map grpc-vtctl,grpc-vtctld",`--grpc-port ${w}`,`--port ${w+1}`])})}function qe(e,t,r){let n=e.cell??"zone1";return O({description:`Vitess vttablet (${t}/${r})`,after:["vitess-vtctld.service","vitess-mysqlctld.service"],requires:["vitess-mysqlctld.service"],execStart:A("vttablet",[`${g}/vttablet`,...J(e),`--tablet-path ${n}-${String(z).padStart(10,"0")}`,`--init-keyspace ${t}`,`--init-shard ${r}`,"--init-tablet-type replica",`--service-map ${f("grpc-queryservice,grpc-tabletmanager,grpc-updatestream")}`,`--port ${ce}`,`--grpc-port ${ce+1}`,`--db-port ${e.mysqlPort??3306}`,`--mycnf-mysql-port ${e.mysqlPort??3306}`])})}function He(e){return O({description:"Vitess mysqlctld (managed mysqld)",execStart:A("mysqlctld",[`${g}/mysqlctld`,`--tablet-uid ${z}`,`--mysql-port ${e.mysqlPort??3306}`,'--init-db-sql-file "$VTROOT/config/init_db.sql"',"--wait-time 2m"]),execStartPre:[`+/bin/mkdir -p ${v}`,`+/bin/chown ${m}:${m} ${v}`]})}var $e="/etc/vitess/auth.json",x="/var/lib/vitess/vtgate-auth.sha256";function Ge(e){let t=e.username??"vitess",r=e.password??"";return["mkdir -p /etc/vitess",'VTESS_AUTH_TMP="$(mktemp)"',`cat > "$VTESS_AUTH_TMP" <<'TS_CLOUD_VITESS_AUTH_EOF'`,JSON.stringify({[t]:[{Password:r,UserData:t}]}),"TS_CLOUD_VITESS_AUTH_EOF",`VTESS_VTGATE_AUTH_SHA="$(sha256sum "$VTESS_AUTH_TMP" | awk '{print $1}')"`,"VTESS_VTGATE_AUTH_CHANGED=1",`if [ -f ${x} ] && [ "$(cat ${x})" = "$VTESS_VTGATE_AUTH_SHA" ]; then VTESS_VTGATE_AUTH_CHANGED=0; fi`,`install -o ${m} -g ${m} -m 0600 "$VTESS_AUTH_TMP" ${$e}`,'rm -f "$VTESS_AUTH_TMP"']}function Fe(e){let t=e.cell??"zone1";return O({description:"Vitess vtgate (query router)",after:["vitess-vtctld.service"],execStart:A("vtgate",[`${g}/vtgate`,...J(e),`--cell ${t}`,`--cells-to-watch ${t}`,"--tablet-types-to-wait PRIMARY,REPLICA",`--service-map ${f("grpc-vtgateservice")}`,`--mysql-server-port ${e.vtgatePort??X}`,`--mysql-server-bind-address ${e.bindAddress??"127.0.0.1"}`,"--mysql-auth-server-impl static",`--mysql-auth-server-static-file ${$e}`,`--port ${j}`,`--grpc-port ${j+1}`])})}function Ye(e){let t=e.cell??"zone1",r=e.etcdEndpoint??`http://127.0.0.1:${B}`,n=`${g}/vtctldclient --server 127.0.0.1:${w}`,i=[`for i in $(seq 1 30); do ${n} GetCellInfoNames >/dev/null 2>&1 && break; sleep 2; done`,`if ! ${n} GetCellInfoNames 2>/dev/null | grep -qx ${f(t)}; then`,`  ${n} AddCellInfo --root ${f(`/vitess/${t}`)} --server-address ${f(r)} ${f(t)}`,"fi"];for(let s of e.keyspaces??[]){let c=s.sharded?" --sharded":"";i.push(`if ! ${n} GetKeyspace ${f(s.name)} >/dev/null 2>&1; then`,`  ${n} CreateKeyspace${c} ${f(s.name)}`,"fi");let d=`${t}-${String(z).padStart(10,"0")}`;for(let l of s.sharded?["-80","80-"]:["0"]){let o=`${s.name}/${l}`;i.push("for i in $(seq 1 90); do",`  if ${n} GetShard ${f(o)} 2>/dev/null | grep -q '"is_primary_serving": *true'; then break; fi`,`  ${n} PlannedReparentShard ${f(o)} --new-primary ${f(d)} >/dev/null 2>&1 && break`,`  ${n} InitShardPrimary --force ${f(o)} ${f(d)} >/dev/null 2>&1 && break`,"  sleep 2","done",`if ! ${n} GetShard ${f(o)} 2>/dev/null | grep -q '"is_primary_serving": *true'; then`,`  echo "no primary could be elected for ${o}" >&2; exit 1`,"fi")}i.push(`${n} RebuildKeyspaceGraph ${f(s.name)} >/dev/null`)}return i}function ue(e){let t=e.vtgatePort??X;return["for i in $(seq 1 60); do",`  if (cd ${R} && eval "$(pantry env 2>/dev/null)"; MYSQL_PWD=${f(e.password??"")} ${g}/mysql -h 127.0.0.1 -P ${t} -u ${f(e.username??"vitess")} --connect-timeout=2 -e 'SHOW KEYSPACES') >/dev/null 2>&1; then`,`    echo "vtgate is serving on ${t}"; exit 0`,"  fi","  sleep 2","done",`echo "vtgate did not become ready on port ${t}" >&2`,"exit 1"]}function fe(e){if(!xe(e))return[];let t=Ie(e),r=t.mode==="combo";Q.clear();let n=[...D(ke(t)),`VT_MYSQL_LIB="$(dirname "$(dirname "$(readlink -f ${g}/mysqld)")")/lib"`,'if [ -d "$VT_MYSQL_LIB" ]; then',`  printf '%s\\n' "$VT_MYSQL_LIB" > /etc/ld.so.conf.d/vitess-mysql.conf`,"  ldconfig","else",'  echo "mysqld library directory not found under $VT_MYSQL_LIB" >&2; exit 1',"fi",`id -u ${m} >/dev/null 2>&1 || useradd --system --home-dir ${v} --shell /usr/sbin/nologin ${m}`,`mkdir -p ${v}`,`chown -R ${m}:${m} ${v}`];if(r)return n.push(...pe("vitess-vtcombo",Ve(t)),...le(),"systemctl daemon-reload","systemctl enable --now vitess-vtcombo.service",...ue(t)),n;n.push(...Ge(t));let i=[];if(!t.etcdEndpoint)i.push(["vitess-etcd",we()]);i.push(["vitess-vtctld",Be(t)],["vitess-mysqlctld",He(t)],["vitess-vtgate",Fe(t)]);for(let s of t.keyspaces??[])for(let c of s.sharded?["-80","80-"]:["0"])i.push([`vitess-vttablet-${s.name}-${c.replace(/-/g,"x")}`,qe(t,s.name,c)]);for(let[s,c]of i)n.push(...pe(s,c));n.push(...le()),n.push("systemctl daemon-reload");for(let[s]of i)n.push(`systemctl enable --now ${s}.service`);return n.push(`if [ "$VTESS_VTGATE_AUTH_CHANGED" = 1 ]; then systemctl restart vitess-vtgate.service; printf '%s\\n' "$VTESS_VTGATE_AUTH_SHA" > ${x}; chown ${m}:${m} ${x}; chmod 0600 ${x}; fi`,...Ye(t),...ue(t)),n}var Ke=new Set(["singlestore","vitess"]);function me(e){if(e?.engine&&Ke.has(e.engine))return!1;return!e?.host||e.host==="127.0.0.1"||e.host==="localhost"}function Z(e,t="psql"){let r=e?.port??5432;if(me(e))return`${t} -p ${r} -U postgres`;let n=e?.username||"postgres";return`${e?.password?`PGPASSWORD='${e.password.replace(/'/g,"'\\''")}' `:""}${t} -h ${e.host} -p ${r} -U ${n} -w`}function y(e){return e===!0||typeof e==="object"&&e!=null}function je(e){let t=[],r=[];if(y(e.mysql))t.push(typeof e.mysql==="object"&&e.mysql.version?`mysql.com@${e.mysql.version}`:"mysql.com@8.0.43"),r.push("mysql");else if(y(e.mariadb))t.push(U.mariadb),r.push("mariadb");if(y(e.postgres))t.push("postgresql.org"),r.push("postgres");if(y(e.redis))t.push("redis.io"),r.push("redis");if(y(e.memcached))t.push("memcached.org"),r.push("memcached");if(y(e.meilisearch))t.push("meilisearch.com"),r.push("meilisearch");return{packages:t,services:r}}function Pt(e={},t={}){let r=je(e),n=fe(e.vitess),i=t.mail?ae(t.mail):[];if(r.packages.length===0)return[...n,...i];return[...D(r.packages),...ie(r.services),...n,...i]}function bt(e,t={}){if(!e?.name)return[];if(!me(e))return[];let r=e.name,n=e.username||r,i=e.password||"",s=y(t.postgres)||e.engine==="postgres",c=y(t.mariadb)||e.engine==="mariadb",d=y(t.mysql)||e.engine==="mysql";if(s&&!d&&!c){let a=(u)=>`"${u.replace(/"/g,'""')}"`,C=(u)=>`'${u.replace(/'/g,"''")}'`,L=(u,N)=>["DO $$ BEGIN",`  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = ${C(u)}) THEN`,`    CREATE ROLE ${a(u)} LOGIN PASSWORD ${C(N)};`,"  ELSE",`    ALTER ROLE ${a(u)} LOGIN PASSWORD ${C(N)};`,"  END IF;","END $$;"],I=(u)=>{let N=u.databases&&u.databases.length>0?u.databases:[r],q=[];for(let H of N)if(u.access==="readonly")q.push(`GRANT CONNECT ON DATABASE ${a(H)} TO ${a(u.username)};`,`\\connect ${a(H)}`,`GRANT USAGE ON SCHEMA public TO ${a(u.username)};`,`GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${a(u.username)};`,`ALTER DEFAULT PRIVILEGES FOR ROLE ${a(n)} IN SCHEMA public GRANT SELECT ON TABLES TO ${a(u.username)};`,"\\connect postgres");else q.push(`GRANT ALL PRIVILEGES ON DATABASE ${a(H)} TO ${a(u.username)};`);return q},k=e.users||[],ye=e.port??5432;return[G(),`for i in $(seq 1 30); do pg_isready -p ${ye} -q && break; sleep 2; done`,`${Z(e)} <<'TS_CLOUD_PG_EOF'`,...L(n,i),`SELECT 'CREATE DATABASE ${a(r)} OWNER ${a(n)}' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = ${C(r)})\\gexec`,...k.flatMap((u)=>[...L(u.username,u.password),...I(u)]),"TS_CLOUD_PG_EOF"]}let l=c?"/var/lib/pantry/mariadb/mariadbd.sock":"/var/lib/pantry/mysql/mysqld.sock",o=(a)=>a.replace(/`/g,"``"),S=(a)=>a.replace(/\\/g,"\\\\").replace(/'/g,"\\'"),E=(a)=>{let C=a.databases&&a.databases.length>0?a.databases:[r],L=a.access==="readonly"?"SELECT":"ALL PRIVILEGES",I=[`CREATE USER IF NOT EXISTS '${S(a.username)}'@'%' IDENTIFIED BY '${S(a.password)}';`,`CREATE USER IF NOT EXISTS '${S(a.username)}'@'localhost' IDENTIFIED BY '${S(a.password)}';`,`ALTER USER '${S(a.username)}'@'%' IDENTIFIED BY '${S(a.password)}';`,`ALTER USER '${S(a.username)}'@'localhost' IDENTIFIED BY '${S(a.password)}';`];for(let k of C)I.push(`GRANT ${L} ON \`${o(k)}\`.* TO '${S(a.username)}'@'%';`,`GRANT ${L} ON \`${o(k)}\`.* TO '${S(a.username)}'@'localhost';`);return I},p=e.users||[];return[G(),`for i in $(seq 1 30); do mysqladmin --socket=${l} -u root ping 2>/dev/null | grep -q alive && break; sleep 2; done`,`mysql --socket=${l} -u root <<'TS_CLOUD_SQL_EOF'`,`CREATE DATABASE IF NOT EXISTS \`${o(r)}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`,...E({username:n,password:i}),...p.flatMap(E),"FLUSH PRIVILEGES;","TS_CLOUD_SQL_EOF"]}function Ct(e){if(!e?.name)return{};let t=e.engine==="singlestore",r=e.engine==="vitess",n=e.engine==="postgres"?"pgsql":t?"singlestore":r?"vitess":"mysql",i=e.port??(e.engine==="postgres"?5432:r?15306:3306),s={DB_CONNECTION:n,DB_HOST:e.host||"127.0.0.1",DB_PORT:String(i),DB_DATABASE:e.name};if(e.username)s.DB_USERNAME=e.username;if(e.password)s.DB_PASSWORD=e.password;if((t||r)&&e.ssl!==!1)s.DB_SSL="true";return s}var te="/var/backups/ts-cloud",We="/etc/ts-cloud/backups.config.ts",Se="/etc/cron.d/ts-cloud-backups",ee="/usr/local/bin/ts-cloud-backup.sh";function Xe(e){if(!e.name)return null;let t=e.host||"127.0.0.1",r=e.engine==="postgres",n=r?"postgresql":"mysql",i=e.port??(r?5432:3306),s=(c)=>c.replace(/\\/g,"\\\\").replace(/'/g,"\\'");return["  {",`    type: '${n}',`,`    name: '${s(e.name)}',`,"    connection: {",`      hostname: '${s(t)}',`,`      port: ${i},`,`      database: '${s(e.name)}',`,`      username: '${s(e.username||e.name)}',`,`      password: '${s(e.password||"")}',`,"      ssl: false,","    },","    includeSchema: true,","    includeData: true,","  },"].join(`
-`)}function ze(e,t){let r=e?Xe(e):null,n=t.bucket?["  destinations: [","    {","      type: 's3',",`      bucket: '${t.bucket}',`,"      prefix: 'db-backups',",...t.endpoint?[`      endpoint: '${t.endpoint}',`]:[],"      optional: false,","    },","  ],"]:[];return["import type { BackupConfig } from 'ts-backups'","","const config: BackupConfig = {","  verbose: true,",`  outputPath: '${te}',`,"  retention: {",`    count: ${t.retentionCount??5},`,`    maxAge: ${t.retentionDays??30},`,"  },","  databases: [",...r?[r]:[],"  ],",...n,"}","","export default config",""].join(`
-`)}function At(e){let{database:t,backups:r}=e;if(!r.enabled)return[];let n=r.schedule||"0 2 * * *",i=ze(t,r);return["export DEBIAN_FRONTEND=noninteractive",`mkdir -p /etc/ts-cloud ${te}`,"command -v bun >/dev/null 2>&1 || (curl -fsSL https://bun.sh/install | bash && ln -sf /root/.bun/bin/bun /usr/local/bin/bun)","bun add -g ts-backups || true",`cat > ${We} <<'TS_CLOUD_BACKUP_CFG_EOF'`,i.replace(/\n$/,""),"TS_CLOUD_BACKUP_CFG_EOF",`cat > ${ee} <<'TS_CLOUD_BACKUP_RUN_EOF'`,"#!/bin/bash","set -uo pipefail",'export PATH="/root/.bun/bin:/usr/local/bin:$PATH"','notify() { [ -x /usr/local/bin/ts-cloud-notify ] && /usr/local/bin/ts-cloud-notify "$1" || true; }',"cd /etc/ts-cloud",'if ! ts-backups backup --config /etc/ts-cloud/backups.config.ts; then notify "❌ ts-cloud backup failed"; exit 1; fi',"TS_CLOUD_BACKUP_RUN_EOF",`chmod +x ${ee}`,`cat > ${Se} <<'TS_CLOUD_BACKUP_CRON_EOF'`,`${n} root ${ee} >> /var/log/ts-cloud-backup.log 2>&1`,"TS_CLOUD_BACKUP_CRON_EOF",`chmod 644 ${Se}`]}function Qe(e){return e==="mariadb"?"/var/lib/pantry/mariadb/mariadbd.sock":"/var/lib/pantry/mysql/mysqld.sock"}function Ot(e,t={}){if(!e?.name)return[];let r=e.name,n=e.engine==="postgres",i=t.from?`TS_CLOUD_DUMP="${t.from}"`:`TS_CLOUD_DUMP="$(find ${te} -type f -name '*${r}*.sql' -o -type f -name '*${r}*.sql.gz' 2>/dev/null | xargs -r ls -1t 2>/dev/null | head -1)"`,s=n?`${Z(e)} -d "${r}"`:`mysql --socket=${Qe(e.engine)} -u root "${r}"`;return["set -uo pipefail",'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true',i,'[ -n "$TS_CLOUD_DUMP" ] && [ -f "$TS_CLOUD_DUMP" ] || { echo "no backup dump found to restore" >&2; exit 1; }','echo "[ts-cloud] restoring '+r+' from $TS_CLOUD_DUMP"',`case "$TS_CLOUD_DUMP" in *.gz) gunzip -c "$TS_CLOUD_DUMP" ;; *) cat "$TS_CLOUD_DUMP" ;; esac | ${s}`,'echo "restore complete"']}var _e=["storage",".env"],Ut=4;function b(e){return`${e.replace(/\/+$/,"")}/.ts-cloud`}function Je(e){return`${b(e)}/deploy-history.log`}function Ze(e,t){return`${b(e)}/deploys/${t}.log`}function Te(e){return`${b(e)}/shared-paths`}function xt(e,t){let r=e.replace(/\/+$/,"");return{base:r,releases:`${r}/releases`,shared:`${r}/shared`,current:`${r}/current`,release:`${r}/releases/${t}`}}function he(e){let t=e.split("/").pop()||e;if(t===".env"||t.startsWith(".env."))return!0;return/\.[a-z0-9]+$/i.test(t)}function et(e){return typeof e==="string"?e:e.path}function It(e){let t=new Map;for(let r of e)t.set(et(r),r);return[...t.values()]}function ve(e,t){if(typeof t==="string")return{path:t,target:`${e.shared}/${t}`,seed:!0};return{path:t.path,target:t.target??`${e.shared}/${t.path}`,seed:t.seed!==!1}}function tt(e){return["ts_cloud_adopt_shared() {",'  TS_CLOUD_SP="$1"','  TS_CLOUD_DST="$2"',`  TS_CLOUD_SRC="${e.current}/$TS_CLOUD_SP"`,'  if [ -e "$TS_CLOUD_DST" ]; then return 0; fi','  if [ -L "$TS_CLOUD_SRC" ] || [ ! -e "$TS_CLOUD_SRC" ]; then return 0; fi','  mkdir -p "$(dirname "$TS_CLOUD_DST")"','  cp -a "$TS_CLOUD_SRC" "$TS_CLOUD_DST"',"  for TS_CLOUD_SIDECAR in -wal -shm; do",'    if [ -f "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" ]; then cp -a "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" "$TS_CLOUD_DST$TS_CLOUD_SIDECAR"; fi',"  done",'  echo "[ts-cloud] adopted $TS_CLOUD_SP from the live release into shared/ — it now survives deploys"',"  return 0","}"]}function kt(e,t=_e){let r=[`mkdir -p ${e.releases} ${e.shared}`,...tt(e)],n=t.map((s)=>ve(e,s));for(let{path:s,target:c,seed:d}of n){if(!d)continue;if(r.push(`ts_cloud_adopt_shared '${s}' '${c}'`),he(s))r.push(`mkdir -p "$(dirname ${c})"`,`touch ${c}`);else if(s==="storage")r.push(`mkdir -p ${c}/app/public`,`mkdir -p ${c}/framework/cache/data`,`mkdir -p ${c}/framework/sessions`,`mkdir -p ${c}/framework/testing`,`mkdir -p ${c}/framework/views`,`mkdir -p ${c}/logs`);else r.push(`mkdir -p ${c}`)}let i=Te(e.base);return r.push(`mkdir -p ${b(e.base)}`,`cat > ${i} <<'TS_CLOUD_SHARED_PATHS_EOF'`,...n.map((s)=>`${s.path}	${s.target}`),"TS_CLOUD_SHARED_PATHS_EOF"),r}function Nt(e,t=900){let r=`${b(e.base)}/deploy.lock`;return[`mkdir -p "$(dirname ${r})"`,`exec 9>${r}`,`flock -w ${t} 9 || { echo "[ts-cloud] another deploy of this site has held the lock for ${t}s — refusing to race it" >&2; exit 1; }`]}function Mt(e){let t=`${e.release}.incoming`;return[`rm -rf ${t}`,`mkdir -p ${t}`,...rt(e),'if [ "$TS_CLOUD_IS_LIVE" = "yes" ]; then',`  TS_CLOUD_STAGED=${t}`,"else",`  rm -rf ${e.release}`,`  mkdir -p ${e.release}`,`  rmdir ${t}`,`  TS_CLOUD_STAGED=${e.release}`,"fi"]}function Vt(e){let t=`TS_CLOUD_TRAP_LIVE="$(readlink -f ${e.current} 2>/dev/null || true)"`,r=`TS_CLOUD_TRAP_TARGET="$(readlink -f ${e.release} 2>/dev/null || echo ${e.release})"`;return`trap '${`if [ $? -ne 0 ]; then ${t}; ${r}; [ "$TS_CLOUD_TRAP_LIVE" = "$TS_CLOUD_TRAP_TARGET" ] || rm -rf ${e.release}; fi`}' EXIT`}function rt(e){return[`TS_CLOUD_LIVE_PATH="$(readlink -f ${e.current} 2>/dev/null || true)"`,`TS_CLOUD_RELEASE_PATH="$(readlink -f ${e.release} 2>/dev/null || echo ${e.release})"`,'if [ -n "$TS_CLOUD_LIVE_PATH" ] && [ "$TS_CLOUD_LIVE_PATH" = "$TS_CLOUD_RELEASE_PATH" ]; then TS_CLOUD_IS_LIVE=yes; else TS_CLOUD_IS_LIVE=no; fi']}function wt(e){let t=`${e.release}.incoming`;return[`if [ "$TS_CLOUD_STAGED" = "${t}" ]; then`,`  rm -rf ${e.release}.previous`,`  mv ${e.release} ${e.release}.previous`,`  mv ${t} ${e.release}`,`  rm -rf ${e.release}.previous`,"fi"]}function nt(e,t){return[`if [ -f ${e} ] && [ ! -L ${e} ] && [ -s ${e} ] && [ ! -s ${t} ]; then`,`  cp -a ${e} ${t}`,`  echo "[ts-cloud] seeded shared/ from the release's own copy of the file"`,"fi"]}function Bt(e,t=_e){let r=[];for(let n of t){let{path:i,target:s,seed:c}=ve(e,n),d=`${e.release}/${i}`,l=[`rm -rf ${d}`,`mkdir -p "$(dirname ${d})"`,`ln -sfn ${s} ${d}`];if(c){if(i!==".env"&&he(i))r.push(...nt(d,s));r.push(...l);continue}r.push(`if [ -e ${s} ]; then`,...l.map((o)=>`  ${o}`),"fi")}return r}function ge(e,t){let r=Te(e.base);return[`if [ -f ${r} ]; then`,'  while IFS="\t" read -r TS_CLOUD_SP TS_CLOUD_TGT; do','    [ -n "$TS_CLOUD_SP" ] || continue',`    [ -n "$TS_CLOUD_TGT" ] || TS_CLOUD_TGT="${e.shared}/$TS_CLOUD_SP"`,'    [ -e "$TS_CLOUD_TGT" ] || continue',`    rm -rf ${t}/"$TS_CLOUD_SP"`,`    mkdir -p "$(dirname ${t}/"$TS_CLOUD_SP")"`,`    ln -sfn "$TS_CLOUD_TGT" ${t}/"$TS_CLOUD_SP"`,`  done < ${r}`,"fi"]}function qt(e){return[`ln -sfn ${e.release} ${e.current}.tmp`,`mv -Tf ${e.current}.tmp ${e.current}`]}function Ht(e,t={}){let r=t.to?[`[ -d ${e.releases}/${t.to} ] || { echo "rollback target ${e.releases}/${t.to} not found" >&2; exit 1; }`,...ge(e,`${e.releases}/${t.to}`),`ln -sfn ${e.releases}/${t.to} ${e.current}.tmp`,`mv -Tf ${e.current}.tmp ${e.current}`]:[`TS_CLOUD_CURRENT=$(readlink -f ${e.current} 2>/dev/null || true)`,`TS_CLOUD_PREV=$(ls -1dt ${e.releases}/*/ 2>/dev/null | sed 's#/$##' | while read -r r; do [ "$(readlink -f "$r")" != "$TS_CLOUD_CURRENT" ] && { echo "$r"; break; }; done)`,'[ -n "$TS_CLOUD_PREV" ] || { echo "no previous release to roll back to" >&2; exit 1; }',...ge(e,'"$TS_CLOUD_PREV"'),`ln -sfn "$TS_CLOUD_PREV" ${e.current}.tmp`,`mv -Tf ${e.current}.tmp ${e.current}`,'echo "rolled back to $TS_CLOUD_PREV"'];if(!t.unitBase)return r;let n=t.unitBase;return[...r,`TS_CLOUD_RB_ID=$(basename "$(readlink -f ${e.current})")`,`if [ -f /etc/systemd/system/${n}@.service ]; then systemctl start "${n}@\${TS_CLOUD_RB_ID}.service"; sleep 2; systemctl is-active --quiet "${n}@\${TS_CLOUD_RB_ID}.service" || { echo "rolled-back release failed to start" >&2; exit 1; }; systemctl enable "${n}@\${TS_CLOUD_RB_ID}.service" 2>/dev/null || true; systemctl list-units --plain --no-legend --type=service "${n}@*.service" 2>/dev/null | awk '{print $1}' | { grep -v "^${n}@\${TS_CLOUD_RB_ID}.service$" || true; } | while read -r TS_CLOUD_U; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done; elif [ -f /etc/systemd/system/${n}.service ]; then systemctl restart ${n}.service; fi`]}function Gt(e,t=4){let r=Math.max(1,t);return[`TS_CLOUD_CURRENT=$(readlink -f ${e.current} 2>/dev/null || true)`,`ls -1dt ${e.releases}/*/ 2>/dev/null | sed 's#/$##' | tail -n +${r+1} | while read -r TS_CLOUD_OLD; do`,'  [ "$(readlink -f "$TS_CLOUD_OLD")" = "$TS_CLOUD_CURRENT" ] || rm -rf "$TS_CLOUD_OLD"',"done"]}function st(e){return`${b(e)}/owner`}function Ft(e,t){let r=st(e);return[`if [ -f "${r}" ]; then`,`  TS_CLOUD_OWNER=$(cat "${r}")`,`  if [ "$TS_CLOUD_OWNER" != "${t}" ]; then`,`    echo "[ts-cloud] REFUSING deploy: ${e} belongs to project '$TS_CLOUD_OWNER', not '${t}'. Another project on this box derives the same site key — give one of them a distinct site name/domain, or remove ${r} to transfer ownership." >&2`,"    exit 1","  fi","else",`  mkdir -p "$(dirname "${r}")"`,`  printf '%s\\n' "${t}" > "${r}"`,"fi"]}function Yt(e,t){let r=b(e),n=Ze(e,t.releaseId),i=Je(e),s=Math.max(1,t.keepLogs??20),c=t.commit||"",d=t.branch||"";return[`mkdir -p ${r}/deploys`,`exec > >(tee -a ${n}) 2>&1`,`echo "[ts-cloud] deploy ${t.releaseId} commit=${c} branch=${d} starting $(date -u +%Y-%m-%dT%H:%M:%SZ)"`,"ts_cloud_record_deploy() {","  TS_CLOUD_RC=$?",'  if [ "$TS_CLOUD_RC" -eq 0 ]; then TS_CLOUD_ST=success; else TS_CLOUD_ST=failed; fi',`  printf '%s\\t%s\\t%s\\t%s\\trc=%s\\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "${t.releaseId}" "${c}" "$TS_CLOUD_ST" "$TS_CLOUD_RC" >> ${i}`,"}","trap ts_cloud_record_deploy EXIT",`ls -1t ${r}/deploys/*.log 2>/dev/null | tail -n +${s+1} | while read -r TS_CLOUD_OLDLOG; do rm -f "$TS_CLOUD_OLDLOG"; done`]}
-export{it as vf,se as wf,Pe as xf,M as yf,Ce as zf,at as Af,ct as Bf,lt as Cf,pt as Df,R as Ef,dt as Ff,G as Gf,D as Hf,ie as If,fe as Jf,me as Kf,Z as Lf,Pt as Mf,bt as Nf,Ct as Of,ee as Pf,At as Qf,Ot as Rf,_e as Sf,Ut as Tf,Je as Uf,xt as Vf,et as Wf,It as Xf,kt as Yf,Nt as Zf,Mt as _f,Vt as $f,wt as ag,Bt as bg,qt as cg,Ht as dg,Gt as eg,Ft as fg,Yt as gg};

package/dist/bin/chunk-xhwqpgwq.js

@@ -1,2 +0,0 @@
-var M=[{index:0,id:"clients",label:"Clients"},{index:1,id:"dns",label:"DNS & TLS"},{index:2,id:"edge",label:"Edge"},{index:3,id:"routing",label:"Routing"},{index:4,id:"apps",label:"Applications"},{index:5,id:"runtime",label:"Background runtime"},{index:6,id:"data",label:"Data services"},{index:7,id:"durability",label:"Durability"}],N=[{index:0,id:"clients",label:"Clients"},{index:1,id:"dns",label:"DNS & TLS"},{index:2,id:"edge",label:"Edge"},{index:3,id:"entry",label:"Entry points"},{index:4,id:"compute",label:"Compute"},{index:5,id:"messaging",label:"Messaging & pooling"},{index:6,id:"data",label:"Data services"},{index:7,id:"durability",label:"Durability"}],P=[{match:/^redis/,kind:"cache",label:"Redis"},{match:/^(?:mysql|mariadb)/,kind:"database",label:"MySQL"},{match:/^postgres/,kind:"database",label:"PostgreSQL"},{match:/^meilisearch/,kind:"database",label:"Meilisearch"},{match:/^vitess|^vtgate/,kind:"database",label:"Vitess"},{match:/^memcached/,kind:"cache",label:"Memcached"}],j=/^(?:rpx-gateway|nginx|caddy|traefik|haproxy)$/;function e(n,u=""){let a=n==null?"":String(n).trim();return a&&a!=="-"&&a!=="—"?a:u}function F(n){return Array.isArray(n)?n.length:0}function h(n){let u=e(n).toLowerCase();if(!u)return"unknown";if(["running","live","active","available","success","ok","healthy","enabled"].includes(u))return"ok";if(["failed","stopped","unreachable","error","critical","disabled"].includes(u))return"bad";if(["configured","creating","pending","degraded","shadowed","warn","unknown"].includes(u))return"warn";return"warn"}function r(n,u,a){if(a.has(u.source)&&a.has(u.target))n.push(u)}function I(n,u={}){let a=[],o=[],q=[],f=n.server??{},c=Array.isArray(n.sites)?n.sites:[],L=Array.isArray(n.services)?n.services:[],k=Array.isArray(n.workers)?n.workers:[],m=n.security??{},C=!!n._serverReachable&&!n.metricsUnavailable,T="box";if(!C)q.push("The compute box could not be probed, so live service state is missing; the shape comes from your cloud config.");a.push({id:"internet",label:"Internet",kind:"internet",layer:0,status:"ok",sub:"Public traffic",facts:[],external:!0});let i=[...new Set(c.map((t)=>e(t.domain)||e(t.route).split("/")[0]).filter((t)=>t&&t!=="internal"&&t!=="loopback"))],E=Array.isArray(m.tlsCertificates)?m.tlsCertificates:[],g=E.filter((t)=>Number(t?.daysRemaining??999)<21).length;a.push({id:"dns",label:i.length===1?i[0]:"Public domains",kind:"dns",layer:1,status:g?"warn":i.length?"ok":"unknown",sub:i.length>1?`${i.length} domains`:"DNS & certificates",facts:[{label:"Domains",value:i.length?i.slice(0,6).join(", "):"none resolved"},{label:"Certificates",value:E.length?`${E.length} issued`:"none reported"},...g?[{label:"Expiring",value:`${g} within 21 days`}]:[]],href:"/server/security",external:!0});let v=m.firewall??{},w=Array.isArray(m.ports)?m.ports:[];a.push({id:"firewall",label:"Host firewall",kind:"firewall",layer:2,status:h(v.status),sub:e(v.summary,"Inbound filtering"),facts:[{label:"State",value:e(v.status,"unknown")},{label:"Open ports",value:w.length?w.map((t)=>e(t.listen)).join(", "):"not reported"}],href:"/server/firewall",group:"box"});let y=L.find((t)=>j.test(e(t.name)));a.push({id:"proxy",label:e(y?.name,"Reverse proxy"),kind:"proxy",layer:3,status:y?h(y.status):"unknown",sub:"TLS termination & routing",facts:[{label:"Service",value:e(y?.name,"not detected")},{label:"State",value:e(y?.status,C?"not running":"not probed")},{label:"Routes",value:`${c.length} site${c.length===1?"":"s"}`}],href:"/server/services",group:"box"});for(let t of c){let d=`site:${e(t.name)}`;if(!e(t.name))continue;a.push({id:d,label:e(t.name),kind:"site",layer:4,status:h(t.status),sub:e(t.runtime,"runtime"),facts:[{label:"Route",value:e(t.route,"internal")},{label:"Runtime",value:e(t.runtime,"unknown")},{label:"Delivery",value:e(t.deploy,"unknown")},{label:"TLS",value:e(t.tls,"unknown")},...t.responseMs!=null?[{label:"Response",value:`${Math.round(Number(t.responseMs))} ms`}]:[],...t.httpStatus!=null?[{label:"HTTP",value:String(t.httpStatus)}]:[]],href:"/server/sites",group:"box"})}for(let t of k){let d=`worker:${e(t.name)}`;if(!e(t.name))continue;a.push({id:d,label:e(t.name),kind:"worker",layer:5,status:h(t.status),sub:`${Number(t.processes??1)} process${Number(t.processes??1)===1?"":"es"}`,facts:[{label:"Processes",value:String(t.processes??1)},{label:"State",value:e(t.status,"unknown")},...e(t.site)?[{label:"Site",value:e(t.site)}]:[]],href:"/operations/jobs",group:"box"})}let A=n.serverScheduler??{};if(A.enabled)a.push({id:"scheduler",label:"Scheduler",kind:"scheduler",layer:5,status:"ok",sub:"Cron dispatch",facts:[{label:"Last run",value:e(A.lastRun,"unknown")}],href:"/operations/jobs",group:"box"});let l=L.map((t)=>{let d=e(t.name),s=P.find((p)=>p.match.test(d));return s?{service:t,name:d,...s}:null}).filter((t)=>!!t);for(let t of l)a.push({id:`data:${t.name}`,label:t.label,kind:t.kind,layer:6,status:h(t.service.status),sub:t.name,facts:[{label:"Unit",value:t.name},{label:"State",value:e(t.service.status,"unknown")}],href:"/data/services",group:"box"});let x=n.backup??{};if(x.enabled)a.push({id:"backup",label:"Backups",kind:"backup",layer:7,status:"ok",sub:e(x.destination,"destination"),facts:[{label:"Destination",value:e(x.destination,"unknown")},{label:"Schedule",value:e(x.schedule,"unknown")},{label:"Retention",value:`${x.retention??0} copies`},{label:"Last run",value:e(x.last,"unknown")}],href:"/data/backups"});let b=new Set(a.map((t)=>t.id));r(o,{source:"internet",target:"dns",flow:"request",label:"https"},b),r(o,{source:"dns",target:"firewall",flow:"request",label:"443/80"},b),r(o,{source:"firewall",target:"proxy",flow:"request"},b);for(let t of c){let d=`site:${e(t.name)}`;r(o,{source:"proxy",target:d,flow:"request",label:e(t.path)||void 0,status:h(t.status)},b)}for(let t of k){let d=`worker:${e(t.name)}`,s=`site:${e(t.site)}`;if(b.has(s))r(o,{source:s,target:d,flow:"async",label:"queue"},b);else r(o,{source:"proxy",target:d,flow:"async",label:"queue"},b)}for(let t of k)r(o,{source:"scheduler",target:`worker:${e(t.name)}`,flow:"async",label:"dispatch"},b);let D=[...c.map((t)=>`site:${e(t.name)}`),...k.map((t)=>`worker:${e(t.name)}`)];for(let t of l)for(let d of D)r(o,{source:d,target:`data:${t.name}`,flow:"data",label:"localhost"},b);if(l.length&&D.length)q.push("Data-service edges show co-location on the box: every process on it can reach localhost. They are not a declared per-site binding.");for(let t of l)r(o,{source:`data:${t.name}`,target:"backup",flow:"backup",label:"snapshot"},b);for(let t of c)r(o,{source:`site:${e(t.name)}`,target:"backup",flow:"backup"},b);return{mode:"server",project:e(u.project)||e(n.project?.name)||e(f.name,"project"),environment:e(u.environment)||e(n.environment,"production"),provider:e(f.provider,"unknown"),region:e(f.region,"unknown"),generatedAt:new Date().toISOString(),layers:M,groups:[{id:"box",label:e(f.name,"App server"),sub:[e(f.provider),e(f.region),e(f.ip)].filter(Boolean).join(" · ")}],nodes:a,links:o,notes:q}}function B(n,u={}){let a=[],o=[],q=[],f=n.app??{},c=Array.isArray(n.functions)?n.functions:[],L=Array.isArray(n.queues)?n.queues:[],k=n.metrics??{};if(!c.length)q.push("No Lambda functions were read for this environment, so the compute layer is empty rather than assumed.");a.push({id:"internet",label:"Internet",kind:"internet",layer:0,status:"ok",sub:"Public traffic",facts:[],external:!0});let m=e(f.url),C=m.replace(/^https?:\/\//,"").split("/")[0];a.push({id:"dns",label:C||"Application domain",kind:"dns",layer:1,status:C?"ok":"unknown",sub:"DNS & certificates",facts:[{label:"Endpoint",value:m||"not resolved"}],external:!0});let T=n.waf;if(T)a.push({id:"waf",label:"WAF",kind:"waf",layer:2,status:h(T.status??"active"),sub:e(T.scope,"Managed rules"),facts:[{label:"Web ACL",value:e(T.name,"unnamed")},...T.blocked!=null?[{label:"Blocked (24h)",value:String(T.blocked)}]:[],{label:"Rules",value:String(F(n.wafRules))}],href:"/serverless/firewall"});let i=n.assetsInfo;if(i)a.push({id:"cdn",label:"Asset CDN",kind:"cdn",layer:2,status:"ok",sub:e(i.cdn,"CloudFront"),facts:[{label:"Distribution",value:e(i.cdn,"unknown")},{label:"Custom domain",value:e(i.customDomain,"none")}],href:"/serverless/assets"}),a.push({id:"assets",label:"Asset bucket",kind:"storage",layer:6,status:"ok",sub:e(i.bucket,"S3"),facts:[{label:"Bucket",value:e(i.bucket,"unknown")},...i.files?[{label:"Objects",value:String(i.files)}]:[],...i.sizeMb?[{label:"Size",value:`${i.sizeMb} MB`}]:[]],href:"/serverless/assets"});let E=c.find((s)=>e(s.key).startsWith("http"));a.push({id:"gateway",label:"HTTP entry point",kind:"gateway",layer:3,status:E?"ok":"unknown",sub:"Function URL / API Gateway",facts:[{label:"Endpoint",value:m||"not resolved"},{label:"Invocations (24h)",value:String(k.invocations??0)},...k.errorRatePct!=null?[{label:"Error rate",value:`${k.errorRatePct}%`}]:[]],href:"/serverless/metrics"});for(let s of c){let p=`fn:${e(s.name)}`;if(!e(s.name))continue;let S=Number(s.errors??0),R=Number(s.invocations??0);a.push({id:p,label:e(s.key,e(s.name)),kind:"function",layer:4,status:S>0?R&&S/R>0.02?"bad":"warn":R?"ok":"idle",sub:e(s.runtime,"lambda"),facts:[{label:"Function",value:e(s.name)},{label:"Memory",value:`${s.memory??0} MB`},{label:"Timeout",value:`${s.timeout??0}s`},{label:"Invocations (24h)",value:String(R)},{label:"Errors (24h)",value:String(S)},{label:"p95",value:`${s.p95??0} ms`},...s.provisioned?[{label:"Provisioned",value:e(s.provisioned)}]:[]],href:"/serverless/functions"})}for(let s of L){let p=`queue:${e(s.name)}`;if(!e(s.name))continue;let S=Number(s.dlq??0);a.push({id:p,label:e(s.name),kind:"queue",layer:5,status:S>0?"bad":Number(s.visible??0)>0?"warn":"ok",sub:"SQS",facts:[{label:"Visible",value:String(s.visible??0)},{label:"In flight",value:String(s.inFlight??0)},{label:"Processed (24h)",value:String(s.processed??0)},{label:"Dead letter",value:String(S)}],href:"/serverless/queues"})}let g=n.aurora;if(g)a.push({id:"database",label:"Aurora Serverless",kind:"database",layer:6,status:h(g.status),sub:e(g.engine,"aurora"),facts:[{label:"Cluster",value:e(g.id,"unknown")},{label:"Capacity",value:`${g.currentAcu??0} ACU (${g.minAcu??0}–${g.maxAcu??0})`},{label:"Connections",value:String(g.connections??0)}],href:"/serverless/data"});let v=n.proxy;if(v)a.push({id:"rds-proxy",label:"RDS Proxy",kind:"database",layer:5,status:h(v.status),sub:"Connection pooling",facts:[{label:"Proxy",value:e(v.name,"unknown")},{label:"Endpoint",value:e(v.endpoint,"unknown")},{label:"Pooled",value:String(v.pooledConns??0)}],href:"/serverless/data"});let w=n.redis;if(w)a.push({id:"cache",label:"ElastiCache",kind:"cache",layer:6,status:h(w.status),sub:e(w.node,"redis"),facts:[{label:"Group",value:e(w.id,"unknown")},{label:"Hit rate",value:`${w.hitRate??0}%`}],href:"/serverless/data"});let y=n.efs;if(y)a.push({id:"efs",label:"EFS",kind:"filesystem",layer:6,status:h(y.status),sub:e(y.mount,"/mnt/local"),facts:[{label:"File system",value:e(y.id,"unknown")},{label:"Mount",value:e(y.mount,"unknown")},{label:"Size",value:`${y.sizeMb??0} MB`}],href:"/data/volumes"});let A=n.scheduler??{};if(A.enabled)a.push({id:"scheduler",label:"Scheduler",kind:"scheduler",layer:3,status:"ok",sub:e(A.expression,"rate(1 minute)"),facts:[{label:"Expression",value:e(A.expression,"unknown")},{label:"Last run",value:e(A.lastRun,"unknown")}],href:"/operations/jobs"});let l=new Set(a.map((s)=>s.id)),x=l.has("waf")?"waf":"gateway";r(o,{source:"internet",target:"dns",flow:"request",label:"https"},l),r(o,{source:"dns",target:x,flow:"request"},l),r(o,{source:"dns",target:"cdn",flow:"request",label:"assets"},l),r(o,{source:"waf",target:"gateway",flow:"request",label:"allowed"},l),r(o,{source:"cdn",target:"assets",flow:"data",label:"origin"},l);let b=c.filter((s)=>e(s.key).startsWith("http")),D=c.filter((s)=>e(s.key).startsWith("queue")),t=c.filter((s)=>e(s.key).startsWith("cli"));for(let s of b)r(o,{source:"gateway",target:`fn:${e(s.name)}`,flow:"request",label:"invoke"},l);for(let s of t)r(o,{source:"scheduler",target:`fn:${e(s.name)}`,flow:"async",label:"schedule"},l);for(let s of L){for(let p of b)r(o,{source:`fn:${e(p.name)}`,target:`queue:${e(s.name)}`,flow:"async",label:"publish"},l);for(let p of D)r(o,{source:`queue:${e(s.name)}`,target:`fn:${e(p.name)}`,flow:"async",label:"consume"},l)}let d=["rds-proxy","database","cache","efs","assets"];for(let s of c){let p=`fn:${e(s.name)}`;if(l.has("rds-proxy"))r(o,{source:p,target:"rds-proxy",flow:"data",label:"pooled"},l);else r(o,{source:p,target:"database",flow:"data",label:"sql"},l);for(let S of d.filter((R)=>R!=="rds-proxy"&&R!=="database"))r(o,{source:p,target:S,flow:"data"},l)}return r(o,{source:"rds-proxy",target:"database",flow:"data",label:"sql"},l),{mode:"serverless",project:e(u.project)||e(f.name,"application"),environment:e(u.environment)||e(f.env,"production"),provider:"aws",region:e(f.region,"unknown"),generatedAt:new Date().toISOString(),layers:N,groups:[],nodes:a,links:o,notes:q}}
-export{I as hg,B as ig};

package/dist/bin/chunk-xk08030d.js

@@ -1,6 +0,0 @@
-import{Ah as S,Bh as _,nj as C,qj as I,rj as m}from"./chunk-4q6tad44.js";import{execSync as O}from"node:child_process";import{randomBytes as P}from"node:crypto";import{chmodSync as B,copyFileSync as F,existsSync as u,mkdirSync as L,readFileSync as T,statSync as J,writeFileSync as b}from"node:fs";import{tmpdir as z}from"node:os";import{basename as V,dirname as y,isAbsolute as k,join as a,resolve as W}from"node:path";import{fileURLToPath as A}from"node:url";function h(e){if(!e||typeof e!=="object")return e;return Object.fromEntries(Object.keys(e).map((r)=>[r,""]))}function E(e){let r=JSON.parse(JSON.stringify(e??{}));if(r.hetzner)delete r.hetzner.apiToken;delete r.aws,delete r.stateDir;for(let t of Object.values(r.sites??{})){if(t?.env)t.env=h(t.env);if(t?.environment)t.environment=h(t.environment)}for(let t of Object.values(r.environments??{}))if(t?.variables)t.variables=h(t.variables);for(let t of Object.values(r.infrastructure?.databases??{}))if(t?.password)t.password="";if(r.infrastructure?.appDatabase?.password)r.infrastructure.appDatabase.password="";if(r.infrastructure?.compute?.database?.password)r.infrastructure.compute.database.password="";if(r.infrastructure?.compute?.managedServices?.vitess?.password)r.infrastructure.compute.managedServices.vitess.password="";return r}function U(e){let r=E(e);return["// Generated by ts-cloud for the management dashboard — do not edit.","//","// This is the project's resolved cloud config, inlined so it needs no","// imports on the box. Credentials are deliberately absent.",`export default ${JSON.stringify(r,null,2)}`,""].join(`
-`)}var G="dashboard";function M(){return S("dashboard-credentials.json")}function H(){return P(24).toString("base64url")}function q(e,r,t){let s=process.env.TS_CLOUD_UI_PASSWORD?.trim();if(s)return{password:s,source:"env"};if(v(process.env.TS_CLOUD_UI_PUBLIC))return{password:void 0,source:"public"};let n=M(),i=_(e,"dashboard-credentials.json");try{if(u(i)){let o=JSON.parse(T(i,"utf8"));if(o?.password)return{password:o.password,source:"generated"}}}catch{}let d=H();try{L(y(i),{recursive:!0}),b(i,`${JSON.stringify({username:r,password:d,generatedAt:new Date().toISOString()},null,2)}
-`),B(i,384),t.info(`Management dashboard: generated a password for '${r}' and saved it to ${n} (read it there — it is not printed). Set TS_CLOUD_UI_PASSWORD to pin your own, or TS_CLOUD_UI_PUBLIC=1 to serve without auth.`)}catch(o){t.warn(`Management dashboard: could not persist the generated password (${o?.message??o}). Using it for this deploy only — pass: ${d}
-This password is now in your deploy log. Set TS_CLOUD_UI_PASSWORD to a value of your own and redeploy once ${n} is writable.`)}return{password:d,source:"generated"}}var R={info:()=>{},warn:()=>{}};function v(e){return e!=null&&e!==""&&e!=="0"&&e.toLowerCase()!=="false"}function K(){return S("dashboard-release")}function j(){let e=y(A(import.meta.url));for(let r of[a(e,"..","..","package.json"),a(e,"..","package.json")])try{let t=JSON.parse(T(r,"utf8"));if(t.name==="@stacksjs/ts-cloud"&&t.version)return`^${t.version}`}catch{}return"latest"}function Q(){return process.env.TS_CLOUD_UI_VERSION?.trim()||j()}function X(e,r,t){if(!e?.project?.slug)return t.warn("Management dashboard: the cloud config has no project slug — skipping the live dashboard."),null;let s=_(r,"dashboard-release");try{L(s,{recursive:!0}),b(a(s,"cloud.config.ts"),U(e));let n=Q();if(n.startsWith("file:")){let d=n.slice(5),o=k(d)?d:W(r,d);if(!u(o)||!J(o).isFile())n=j(),t.warn(`Management dashboard: TS_CLOUD_UI_VERSION points to a missing package file (${o}); using the deploying ts-cloud version ${n} instead.`);else{let c=V(o),l=a(s,c);if(o!==l)F(o,l);n=`file:./${c}`}}let i={name:"ts-cloud-dashboard",private:!0,type:"module",dependencies:{"@stacksjs/ts-cloud":n}};return b(a(s,"package.json"),`${JSON.stringify(i,null,2)}
-`),K()}catch(n){return t.warn(`Management dashboard: could not stage the live release (${n?.message??n}) — skipping.`),null}}function Y(e){if(u(a(e,"packages","ui","pages"))||u(a(e,"packages","ui","package.json")))return{uiRoot:"packages/ui/dist",build:"cd packages/ui && bun install && bun run build"};let r=y(A(import.meta.url)),t=[a(r,"ui"),a(r,"..","ui"),a(r,"..","..","ui"),a(r,"..","dist","ui")];for(let s of t)if(u(a(s,"index.html"))||u(a(s,"serverless.html")))return{uiRoot:s,build:!1};return null}function de(e,r={}){let t=r.logger??R,s=r.cwd??process.cwd();if(v(process.env.TS_CLOUD_UI_DISABLE))return t.info("Management dashboard: skipped (TS_CLOUD_UI_DISABLE set)."),e;if(e.cloud?.attachTo)return t.info(`Management dashboard: ${e.project.slug} is attached to ${e.cloud.attachTo}; the server owner's dashboard monitors every attached project.`),e;if(C(e))return e;let n=e.environments&&Object.keys(e.environments)[0],i=process.env.TS_CLOUD_UI_DOMAIN?.trim()||void 0,d=Number(process.env.TS_CLOUD_UI_PORT)||void 0,o={...e.sites??{}};if(!v(process.env.TS_CLOUD_UI_STATIC)){let g=X(e,s,t);if(!g)return e;let p=m(e,n??"production",{uiRoot:g,build:!1,domain:i,port:d,live:!0});if(p.length===0)return t.info("Management dashboard: no domain resolved (set TS_CLOUD_UI_DOMAIN or configure a site domain) — skipping."),e;for(let{name:N,site:w}of p)o[N]=w,t.info(`Management dashboard → https://${w.domain} (sign in with your ts-cloud account; the first deploy prints an admin password once)`);return e.sites=o,e}let c=Y(s);if(!c)return t.info("Management dashboard: UI not found (no local ui/ or packaged dist/ui) — skipping auto-deploy."),e;let l=process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin",f=q(s,l,t),D=m(e,n??"production",{uiRoot:c.uiRoot,build:c.build,domain:i,username:l,password:f.password,realm:process.env.TS_CLOUD_UI_REALM?.trim()||void 0,live:!1,port:d});if(D.length===0)return t.info("Management dashboard: no domain resolved (set TS_CLOUD_UI_DOMAIN or configure a site domain) — skipping."),e;let x=f.source==="public"?"NO AUTH — TS_CLOUD_UI_PUBLIC is set (dashboard is publicly reachable)":f.source==="env"?"htpasswd-protected (TS_CLOUD_UI_PASSWORD)":`htpasswd-protected (auto-generated — see ${M()})`;t.warn("Management dashboard: static mode — one shared password, and no per-site collaborators. Unset TS_CLOUD_UI_STATIC for the live dashboard.");for(let{name:g,site:p}of D)o[g]=p,t.info(`Management dashboard → https://${p.domain} (${x})`);return e.sites=o,e}function ue(e){return Object.keys(e.sites??{}).filter(I)}function ce(e,r){if(!e?.root)return null;let t=r.cwd??process.cwd(),s=r.logger??R;try{if(typeof e.build==="string"&&e.build.trim())s.info(`Management dashboard: building UI (${e.build})`),O(e.build,{cwd:t,stdio:"inherit"});let n=k(e.root)?e.root:a(t,e.root);if(!u(n))return s.warn(`Management dashboard: build output not found at ${n} — skipping dashboard artifact.`),null;let i=a(z(),`${r.slug}-${r.siteName??G}-${r.sha}.tar.gz`);return O(`tar czf "${i}" -C "${n}" .`,{stdio:"inherit"}),i}catch(n){return s.warn(`Management dashboard: failed to build artifact — ${n?.message??n}. Skipping dashboard deploy.`),null}}
-export{G as lf,M as mf,q as nf,K as of,Q as pf,X as qf,Y as rf,de as sf,ue as tf,ce as uf};

package/dist/bin/chunk-xkfrqqcs.js

@@ -1 +0,0 @@
-import{ef as w}from"./chunk-9kf0np8j.js";var L="\x00";function k(t,i){if(t==="*"||t==="**")return!0;let e=t.replace(/[.+^${}()|[\]\\]/g,"\\$&").replace(/\*\*/g,"\x01").replace(/\*/g,"[^/]*").replace(/\u0001/g,".*");return new RegExp(`^${e}$`).test(i)}function y(t,i){if(t.startsWith("*.")){let e=t.slice(1);return i.endsWith(e)&&i.length>e.length}return t===i}function d(t,i){if(t.enabled===!1)return!1;if(t.methods?.length&&!t.methods.some((e)=>e.toUpperCase()===i.method.toUpperCase()))return!1;if(t.path&&!k(t.path,i.path))return!1;if(t.host&&!y(t.host,i.host??""))return!1;return!0}function m(t,i){let e=t.key??{source:"ip"},o=e.fallbackToIp!==!1,r;if(e.source==="ip")r=i.ip;else if(e.source==="global")r="global";else if(e.source==="host")r=i.host??"";else if(e.source==="path")r=i.path;else if(e.source==="header")r=e.name?i.headers?.[e.name.toLowerCase()]:void 0;else if(e.source==="cookie")r=e.name?i.cookies?.[e.name]:void 0;if(!r&&e.source!=="global")r=o?i.ip:"__missing__";return`${t.id}\x00${r}`}class A{clock;maxTrackedKeys;buckets=new Map;windows=new Map;rules;constructor(t,i=()=>Date.now(),e=1e5){this.clock=i;this.maxTrackedKeys=e;this.rules=[...t].sort((o,r)=>(o.priority??0)-(r.priority??0))}check(t){let i=this.clock(),e=this.rules.filter((n)=>d(n,t)),o;for(let n of e){let s=this.test(n,t,i);if(s.allowed)continue;if(!o||p(s.action)>p(o.action))o=s}if(o)return o;let r={action:"allow",allowed:!0};for(let n of e){let s=this.consume(n,t,i);if(s.remaining!=null&&(r.remaining??1/0)>s.remaining)r=s}return r}test(t,i,e){let o=m(t,i);if((t.algorithm??"token_bucket")==="token_bucket"){let n=t.burst??t.limit,s=this.buckets.get(o),a=s?Math.min(n,s.tokens+this.refill(t,e-s.updatedAt)):n;if(a>=1)return{action:"allow",allowed:!0};return this.blocked(t,o,0,this.msPerToken(t)*(1-a),e)}let r=(this.windows.get(o)?.hits??[]).filter((n)=>n>e-t.windowMs);if(r.length<t.limit)return{action:"allow",allowed:!0};return this.blocked(t,o,0,r[0]+t.windowMs-e,e)}peek(t){let i=this.clock();for(let e of this.rules){if(!d(e,t))continue;let o=this.test(e,t,i);if(!o.allowed)return o}return{action:"allow",allowed:!0}}msPerToken(t){return t.windowMs/Math.max(1,t.limit)}refill(t,i){return Math.max(0,i)/this.msPerToken(t)}blocked(t,i,e,o,r){let n=t.action??"deny";return{action:n,allowed:n==="allow"||n==="log",ruleId:t.id,limit:t.limit,remaining:e,retryAfterMs:Math.max(0,Math.ceil(o)),resetAt:r+Math.max(0,o),key:i}}consume(t,i,e){let o=m(t,i);if((t.algorithm??"token_bucket")==="token_bucket"){let l=t.burst??t.limit,u=this.buckets.get(o)??{tokens:l,updatedAt:e},c=Math.min(l,u.tokens+this.refill(t,e-u.updatedAt));if(c<1)return this.buckets.set(o,{tokens:c,updatedAt:e}),this.blocked(t,o,0,this.msPerToken(t)*(1-c),e);return this.evictIfNeeded(this.buckets),this.buckets.set(o,{tokens:c-1,updatedAt:e}),{action:"allow",allowed:!0,ruleId:t.id,limit:l,remaining:Math.floor(c-1),resetAt:e+this.msPerToken(t)*(l-(c-1)),key:o}}let n=this.windows.get(o)??{hits:[]},s=e-t.windowMs,a=n.hits.filter((l)=>l>s);if(a.length>=t.limit)return this.windows.set(o,{hits:a}),this.blocked(t,o,0,a[0]+t.windowMs-e,e);return a.push(e),this.evictIfNeeded(this.windows),this.windows.set(o,{hits:a}),{action:"allow",allowed:!0,ruleId:t.id,limit:t.limit,remaining:t.limit-a.length,resetAt:a[0]+t.windowMs,key:o}}evictIfNeeded(t){if(t.size<this.maxTrackedKeys)return;let i=t.size-this.maxTrackedKeys+1,e=0;for(let o of t.keys())if(t.delete(o),++e>=i)break}sweep(){let t=this.clock(),i=0;for(let[e,o]of this.windows){let r=e.split("\x00")[0],n=this.rules.find((s)=>s.id===r);if(!n){this.windows.delete(e),i++;continue}if(o.hits.every((s)=>s<=t-n.windowMs))this.windows.delete(e),i++}for(let[e,o]of this.buckets){let r=e.split("\x00")[0],n=this.rules.find((s)=>s.id===r);if(!n||t-o.updatedAt>n.windowMs*2)this.buckets.delete(e),i++}return i}get trackedKeys(){return this.buckets.size+this.windows.size}}function p(t){return{allow:0,log:1,throttle:2,challenge:3,deny:4}[t]}function I(t){let i={};if(t.limit!=null)i["ratelimit-limit"]=String(t.limit);if(t.remaining!=null)i["ratelimit-remaining"]=String(t.remaining);if(t.resetAt!=null)i["ratelimit-reset"]=String(Math.max(0,Math.ceil((t.resetAt-Date.now())/1000)));if(!t.allowed&&t.retryAfterMs!=null)i["retry-after"]=String(Math.max(1,Math.ceil(t.retryAfterMs/1000)));return i}function C(){return[{id:"global-ip",limit:600,windowMs:60000,burst:100,key:{source:"ip"},action:"deny",priority:100},{id:"api-ip",limit:120,windowMs:60000,burst:30,path:"/api/**",key:{source:"ip"},action:"deny",priority:50},{id:"auth-ip",limit:10,windowMs:60000,algorithm:"sliding_window",path:"/auth/**",methods:["POST"],key:{source:"ip"},action:"challenge",priority:10}]}var h="protection.controls",b=24,x=4,M={ipRules:{allow:[],block:[]}};function f(t,i){if(!t?.enabled)return;return new Date(t.expiresAt).getTime()>i.getTime()?t:void 0}function g(t,i){let e=Number.isFinite(t)?Number(t):i;return Math.min(b,Math.max(0.25,e))}var R=500;class P{controlPlane;options;constructor(t,i={}){this.controlPlane=t;this.options=i}now(){return this.options.now?.()??new Date}read(){let t=this.controlPlane.getSetting(h);if(!t||typeof t!=="object"||Array.isArray(t))return{...M,ipRules:{allow:[],block:[]}};let i=t;return{attackMode:i.attackMode,mitigationPause:i.mitigationPause,ipRules:{allow:Array.isArray(i.ipRules?.allow)?i.ipRules.allow:[],block:Array.isArray(i.ipRules?.block)?i.ipRules.block:[]},updatedAt:i.updatedAt}}write(t){let i={...t,updatedAt:this.now().toISOString()};return this.controlPlane.setSetting(h,i),i}raw(){return this.read()}current(){let t=this.now(),i=this.read();return{attackMode:f(i.attackMode,t),mitigationPause:f(i.mitigationPause,t),ipRules:i.ipRules}}enableAttackMode(t){let i=this.now(),e={enabled:!0,startedAt:i.toISOString(),expiresAt:new Date(i.getTime()+g(t.hours,x)*3600000).toISOString(),reason:t.reason.trim()||"Attack mode enabled by an operator.",actorId:t.actorId};return this.write({...this.read(),attackMode:e}),e}disableAttackMode(){let t=this.read();if(!t.attackMode?.enabled)return!1;return this.write({...t,attackMode:{...t.attackMode,enabled:!1}}),!0}pauseMitigations(t){let i=t.reason.trim();if(!i)throw Error("Pausing mitigations requires a reason: you are liable for the traffic it admits.");let e=this.now(),o={enabled:!0,startedAt:e.toISOString(),expiresAt:new Date(e.getTime()+g(t.hours,b)*3600000).toISOString(),reason:i,actorId:t.actorId};return this.write({...this.read(),mitigationPause:o}),o}resumeMitigations(){let t=this.read();if(!t.mitigationPause?.enabled)return!1;return this.write({...t,mitigationPause:{...t.mitigationPause,enabled:!1}}),!0}addIpRule(t,i){let e=i.trim();if(!w(e))throw Error(`Not a valid IP or CIDR: ${i}`);let o=this.read(),r={...o.ipRules,[t]:[...new Set([...o.ipRules[t],e])]};if(r[t].length>R)throw Error(`At most ${R} ${t} rules are supported.`);let n=t==="allow"?"block":"allow";return r[n]=r[n].filter((s)=>s!==e),this.write({...o,ipRules:r}),r}removeIpRule(t,i){let e=this.read(),o={...e.ipRules,[t]:e.ipRules[t].filter((r)=>r!==i.trim())};return this.write({...e,ipRules:o}),o}}function D(t){if(t.mitigationPause)return{attackMode:!!t.attackMode,mitigationPaused:!0,summary:`Automatic mitigation is paused until ${t.mitigationPause.expiresAt}. All traffic is being served and billed.`,expiresAt:t.mitigationPause.expiresAt};if(t.attackMode)return{attackMode:!0,mitigationPaused:!1,summary:`Attack mode is on until ${t.attackMode.expiresAt}. Every visitor is being challenged.`,expiresAt:t.attackMode.expiresAt};return{attackMode:!1,mitigationPaused:!1,summary:"Protection is in its normal posture."}}function E(t,i){if(i.mitigationPause)return t.map((e)=>({...e,enabled:!1}));if(!i.attackMode)return[...t];return t.map((e)=>({...e,action:e.action==="deny"?"deny":"challenge",burst:Math.max(1,Math.min(e.burst??e.limit,5))}))}function T(t,i){let e=[...new Set([...t.allowlist??[],...i.ipRules.allow])],o=[...new Set([...t.blocklist??[],...i.ipRules.block])];if(i.mitigationPause)return{...t,allowlist:e,blocklist:o,monitorOnly:!0};if(!i.attackMode)return{...t,allowlist:e,blocklist:o};let r=t.thresholds??{};return{...t,allowlist:e,blocklist:o,thresholds:{...r,newConnectionsPerSecond:Math.max(1,Math.floor((r.newConnectionsPerSecond??50)/5)),concurrentPerSource:Math.max(1,Math.floor((r.concurrentPerSource??100)/5))}}}function v(t,i){let e=t?.infrastructure?.compute;if(!e||e.ddos===!1)return t;let o=typeof e.ddos==="object"&&e.ddos!==null?e.ddos:{};return{...t,infrastructure:{...t.infrastructure,compute:{...e,ddos:T(o,i)}}}}export{L as a,k as b,d as c,m as d,A as e,I as f,C as g,h,b as i,x as j,P as k,D as l,E as m,T as n,v as o};

package/dist/bin/chunk-y1h63vpm.js

@@ -1 +0,0 @@
-import{fd as a}from"./chunk-s4yzes15.js";import"./chunk-ja1vjdn1.js";import"./chunk-ehc63fvs.js";export{a as STSClient};

package/dist/bin/chunk-zdt2rjk6.js

@@ -1 +0,0 @@
-import{p as a,q as b,r as c,s as d,t as e,u as f}from"./chunk-b4wt9jcg.js";import"./chunk-mfrf9q4b.js";import"./chunk-82mj52xr.js";import"./chunk-a7w13qfm.js";import"./chunk-e5ab5twy.js";import"./chunk-btsyjhk7.js";import"./chunk-ja1vjdn1.js";import"./chunk-ehc63fvs.js";export{e as deleteStaticSite,b as deployStaticSite,f as deployStaticSiteFull,a as generateStaticSiteTemplate,d as invalidateCache,c as uploadStaticFiles};

package/dist/bin/chunk-zh2d4704.js

@@ -1 +0,0 @@
-import{qg as a}from"./chunk-btsyjhk7.js";import"./chunk-ja1vjdn1.js";import"./chunk-ehc63fvs.js";export{a as S3Client};

package/dist/bin/chunk-zpe64t4r.js

@@ -1 +0,0 @@
-import{lf as a,mf as b,nf as c,of as d,pf as e,qf as f,rf as g,sf as h,tf as i,uf as j}from"./chunk-xk08030d.js";import"./chunk-4q6tad44.js";import"./chunk-ehc63fvs.js";export{a as MANAGEMENT_DASHBOARD_SITE,j as buildManagementDashboardArtifact,b as dashboardCredentialsFile,h as ensureManagementDashboard,d as liveStageDir,i as managementDashboardSiteNames,c as resolveDashboardAuth,e as resolveDashboardVersion,g as resolveUiSource,f as stageLiveDashboardRoot};

package/dist/chunk-152he7m3.js

@@ -1,92 +0,0 @@
-import{$h as L,_h as U}from"./chunk-mz0dk78z.js";import{Et as K}from"./chunk-13qjvbqh.js";import*as c from"node:crypto";import{readFileSync as D}from"node:fs";import{readdir as z}from"node:fs/promises";import{join as M}from"node:path";function R(e){if(e){let r=O(e);if(!r)throw Error(`AWS profile '${e}' not found in ~/.aws/credentials`);return r}let t=process.env.AWS_ACCESS_KEY_ID,s=process.env.AWS_SECRET_ACCESS_KEY;if(t&&s)return{accessKeyId:t,secretAccessKey:s,sessionToken:process.env.AWS_SESSION_TOKEN};return O(process.env.AWS_PROFILE||"default")??{accessKeyId:"",secretAccessKey:""}}function O(e){let{existsSync:t,readFileSync:s}=K("node:fs"),{homedir:r}=K("node:os"),{join:n}=K("node:path"),i=process.env.AWS_SHARED_CREDENTIALS_FILE||n(r(),".aws","credentials");if(!t(i))return null;let o=s(i,"utf-8"),a=null,g,l,u;for(let d of o.split(`
-`)){let y=d.trim();if(!y||y.startsWith("#")||y.startsWith(";"))continue;let h=y.match(/^\[([^\]]+)\]$/);if(h){if(a===e&&g&&l)return{accessKeyId:g,secretAccessKey:l,sessionToken:u};a=h[1],g=void 0,l=void 0,u=void 0;continue}if(a===e){let[S,...m]=y.split("="),p=m.join("=").trim();switch(S.trim().toLowerCase()){case"aws_access_key_id":g=p;break;case"aws_secret_access_key":l=p;break;case"aws_session_token":u=p;break}}}if(a===e&&g&&l)return{accessKeyId:g,secretAccessKey:l,sessionToken:u};return null}function B(e){let{buffer:t,byteOffset:s,byteLength:r}=e;if(t instanceof ArrayBuffer)return t.slice(s,s+r);let n=new ArrayBuffer(r);return new Uint8Array(n).set(new Uint8Array(e)),n}class V{client;region;explicitProfile;endpoint;endpointProtocol="https";forcePathStyle;explicitCredentials;constructor(e="us-east-1",t,s){let r=typeof e==="string"?s:e,n=typeof e==="string"?e:e.region??"us-east-1",i=typeof e==="string"?t:e.profile,o=r?.endpoint?U({region:n,path:"/",endpoint:r.endpoint}):void 0;this.region=n,this.explicitProfile=i,this.endpoint=o?.host,this.endpointProtocol=o?.protocol??"https",this.forcePathStyle=r?.forcePathStyle,this.explicitCredentials=r?.credentials,this.client=new L(r?.credentials,{profile:i,endpoint:r?.endpoint,forcePathStyle:r?.forcePathStyle})}getCredentials(){if(this.explicitCredentials?.accessKeyId&&this.explicitCredentials.secretAccessKey)return this.explicitCredentials;let e=R(this.explicitProfile);if(e.accessKeyId&&e.secretAccessKey)return e;throw Error("S3 credentials not found. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (or pass explicit credentials/profile), or configure ~/.aws/credentials.")}s3BaseHost(){return this.endpoint||`s3.${this.region}.amazonaws.com`}s3VirtualHost(e){return this.forcePathStyle?this.s3BaseHost():`${e}.${this.s3BaseHost()}`}objectPath(e,t){return this.forcePathStyle?`/${e}/${t}`:`/${t}`}objectUrl(e,t){return`${this.endpointProtocol}://${this.s3VirtualHost(e)}${this.objectPath(e,t)}`}async listBuckets(){let e=await this.client.request({service:"s3",region:this.region,method:"GET",path:"/"}),t=[],r=(e?.ListAllMyBucketsResult??e)?.Buckets?.Bucket;if(r){let n=Array.isArray(r)?r:[r];for(let i of n)t.push({Name:i.Name,CreationDate:i.CreationDate})}return{Buckets:t}}async createBucket(e,t){let s={};if(t?.acl)s["x-amz-acl"]=t.acl;let r;if(this.region!=="us-east-1"&&!this.endpoint)r=`<?xml version="1.0" encoding="UTF-8"?>
-<CreateBucketConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
-  <LocationConstraint>${this.region}</LocationConstraint>
-</CreateBucketConfiguration>`,s["Content-Type"]="application/xml";await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,headers:s,body:r})}async deleteBucket(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`})}async emptyAndDeleteBucket(e){let t=!0;while(t){let s=await this.listAllObjects({bucket:e});if(s.length===0){t=!1;break}let r=s.map((n)=>n.Key);for(let n=0;n<r.length;n+=1000){let i=r.slice(n,n+1000);await this.deleteObjects(e,i)}}await this.deleteBucket(e)}async listAllObjects(e){let t=[],s;do{let r={"list-type":"2","max-keys":"1000"};if(e.prefix)r.prefix=e.prefix;if(s)r["continuation-token"]=s;let n=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e.bucket}`,queryParams:r}),i=n?.ListBucketResult??n,o=i?.Contents;if(o){let g=Array.isArray(o)?o:[o];for(let l of g)t.push({Key:l.Key,LastModified:l.LastModified||"",Size:Number.parseInt(l.Size||"0"),ETag:l.ETag})}let a=i?.IsTruncated;s=a==="true"||a===!0?i?.NextContinuationToken:void 0}while(s);return t}async list(e){let t=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e.bucket}`}),s=[],n=(t?.ListBucketResult??t)?.Contents;if(n){let i=Array.isArray(n)?n:[n];for(let o of i){if(e.prefix&&!o.Key?.startsWith(e.prefix))continue;if(s.push({Key:o.Key||"",LastModified:o.LastModified||"",Size:Number.parseInt(o.Size||"0"),ETag:o.ETag}),e.maxKeys&&s.length>=e.maxKeys)break}}return s}async putObject(e){let t={};if(e.acl)t["x-amz-acl"]=e.acl;if(e.cacheControl)t["Cache-Control"]=e.cacheControl;if(e.contentType)t["Content-Type"]=e.contentType;if(e.metadata)for(let[n,i]of Object.entries(e.metadata))t[`x-amz-meta-${n}`]=i;let s=e.key.split("/").map((n)=>encodeURIComponent(n)).join("/"),r=e.body instanceof Uint8Array&&!Buffer.isBuffer(e.body)?Buffer.from(e.body):e.body;if(Buffer.isBuffer(r)||r instanceof Uint8Array){let n=Buffer.isBuffer(r)?r:Buffer.from(r),{accessKeyId:i,secretAccessKey:o,sessionToken:a}=this.getCredentials(),g=this.s3VirtualHost(e.bucket),l=this.objectPath(e.bucket,s),u=this.objectUrl(e.bucket,s),d=new Date,y=d.toISOString().replace(/[:-]|\.\d{3}/g,""),h=d.toISOString().slice(0,10).replace(/-/g,""),S=c.createHash("sha256").update(n).digest("hex"),m={host:g,"x-amz-date":y,"x-amz-content-sha256":S,...t};if(a)m["x-amz-security-token"]=a;let p=Object.keys(m).sort().map((f)=>`${f.toLowerCase()}:${m[f].trim()}
-`).join(""),C=Object.keys(m).sort().map((f)=>f.toLowerCase()).join(";"),P=["PUT",l,"",p,C,S].join(`
-`),k="AWS4-HMAC-SHA256",b=`${h}/${this.region}/s3/aws4_request`,v=[k,y,b,c.createHash("sha256").update(P).digest("hex")].join(`
-`),q=c.createHmac("sha256",`AWS4${o}`).update(h).digest(),H=c.createHmac("sha256",q).update(this.region).digest(),E=c.createHmac("sha256",H).update("s3").digest(),w=c.createHmac("sha256",E).update("aws4_request").digest(),x=c.createHmac("sha256",w).update(v).digest("hex"),T=`${k} Credential=${i}/${b}, SignedHeaders=${C}, Signature=${x}`,A=await fetch(u,{method:"PUT",headers:{...m,Authorization:T},body:B(n)});if(!A.ok){let f=await A.text();throw Error(`S3 PUT failed: ${A.status} ${f}`)}return}await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${s}`,bucket:e.bucket,headers:t,body:e.body})}async getObject(e,t){let s=t.split("/").map((n)=>encodeURIComponent(n)).join("/");return await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${s}`,bucket:e,rawResponse:!0})}async getObjectBytes(e,t){let{accessKeyId:s,secretAccessKey:r,sessionToken:n}=this.getCredentials(),i=this.s3VirtualHost(e),o=t.split("/").map((f)=>encodeURIComponent(f)).join("/"),a=this.objectPath(e,o),g=this.objectUrl(e,o),l=new Date,u=l.toISOString().replace(/[:-]|\.\d{3}/g,""),d=l.toISOString().slice(0,10).replace(/-/g,""),y=c.createHash("sha256").update("").digest("hex"),h={host:i,"x-amz-date":u,"x-amz-content-sha256":y};if(n)h["x-amz-security-token"]=n;let S=Object.keys(h).sort().map((f)=>`${f.toLowerCase()}:${h[f].trim()}
-`).join(""),m=Object.keys(h).sort().map((f)=>f.toLowerCase()).join(";"),p=["GET",a,"",S,m,y].join(`
-`),C="AWS4-HMAC-SHA256",P=`${d}/${this.region}/s3/aws4_request`,k=[C,u,P,c.createHash("sha256").update(p).digest("hex")].join(`
-`),b=c.createHmac("sha256",`AWS4${r}`).update(d).digest(),v=c.createHmac("sha256",b).update(this.region).digest(),q=c.createHmac("sha256",v).update("s3").digest(),H=c.createHmac("sha256",q).update("aws4_request").digest(),E=c.createHmac("sha256",H).update(k).digest("hex"),w=`${C} Credential=${s}/${P}, SignedHeaders=${m}, Signature=${E}`,x=await fetch(g,{method:"GET",headers:{...h,Authorization:w}});if(!x.ok){let f=await x.text();throw Error(`S3 GET failed: ${x.status} ${f}`)}let T=await x.arrayBuffer(),A=x.headers.get("content-length");return{body:new Uint8Array(T),contentType:x.headers.get("content-type")??void 0,contentLength:A?Number.parseInt(A,10):void 0}}async copyObject(e){let t={"x-amz-copy-source":`/${e.sourceBucket}/${e.sourceKey}`};if(e.metadataDirective)t["x-amz-metadata-directive"]=e.metadataDirective;if(e.contentType)t["Content-Type"]=e.contentType;if(e.metadata)for(let[s,r]of Object.entries(e.metadata))t[`x-amz-meta-${s}`]=r;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e.destinationBucket}/${e.destinationKey}`,headers:t})}async deleteObject(e,t){let s=t.split("/").map((r)=>encodeURIComponent(r)).join("/");await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${s}`,bucket:e})}async deleteObjects(e,t){let s=`<?xml version="1.0" encoding="UTF-8"?>
-<Delete>
-  ${t.map((n)=>`<Object><Key>${n}</Key></Object>`).join(`
-  `)}
-</Delete>`,r=c.createHash("md5").update(s).digest("base64");await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${e}`,queryParams:{delete:""},body:s,headers:{"Content-Type":"application/xml","Content-MD5":r}})}async bucketExists(e){try{return await this.client.request({service:"s3",region:this.region,method:"HEAD",path:`/${e}`}),!0}catch{return!1}}async copy(e){let t=D(e.source);await this.putObject({bucket:e.bucket,key:e.key,body:t,acl:e.acl,cacheControl:e.cacheControl,contentType:e.contentType,metadata:e.metadata})}async sync(e){let t=await this.listFilesRecursive(e.source);for(let s of t){if(e.exclude&&e.exclude.some((i)=>s.includes(i)))continue;if(e.include&&!e.include.some((i)=>s.includes(i)))continue;let r=s.substring(e.source.length+1),n=e.prefix?`${e.prefix}/${r}`:r;if(!e.dryRun){let i=D(s);await this.putObject({bucket:e.bucket,key:n,body:i,acl:e.acl,cacheControl:e.cacheControl,contentType:e.contentType,metadata:e.metadata})}}}async delete(e,t){await this.deleteObject(e,t)}async deletePrefix(e,t){let r=(await this.list({bucket:e,prefix:t})).map((n)=>n.Key);if(r.length>0)await this.deleteObjects(e,r)}async getBucketSize(e,t){return(await this.list({bucket:e,prefix:t})).reduce((r,n)=>r+n.Size,0)}async listFilesRecursive(e){let t=[],s=await z(e,{withFileTypes:!0});for(let r of s){let n=M(e,r.name);if(r.isDirectory()){let i=await this.listFilesRecursive(n);t.push(...i)}else t.push(n)}return t}async putBucketPolicy(e,t){let{accessKeyId:s,secretAccessKey:r,sessionToken:n}=this.getCredentials(),i=this.s3BaseHost(),o=typeof t==="string"?t:JSON.stringify(t),a=new Date,g=a.toISOString().replace(/[:-]|\.\d{3}/g,""),l=a.toISOString().slice(0,10).replace(/-/g,""),u=c.createHash("sha256").update(o).digest("hex"),d="/"+e,y="policy=",h={host:i,"x-amz-date":g,"x-amz-content-sha256":u,"content-type":"application/json"};if(n)h["x-amz-security-token"]=n;let S=Object.keys(h).sort().map((A)=>`${A.toLowerCase()}:${h[A].trim()}
-`).join(""),m=Object.keys(h).sort().map((A)=>A.toLowerCase()).join(";"),p=["PUT",d,"policy=",S,m,u].join(`
-`),C="AWS4-HMAC-SHA256",P=`${l}/${this.region}/s3/aws4_request`,k=[C,g,P,c.createHash("sha256").update(p).digest("hex")].join(`
-`),b=c.createHmac("sha256","AWS4"+r).update(l).digest(),v=c.createHmac("sha256",b).update(this.region).digest(),q=c.createHmac("sha256",v).update("s3").digest(),H=c.createHmac("sha256",q).update("aws4_request").digest(),E=c.createHmac("sha256",H).update(k).digest("hex"),w=`${C} Credential=${s}/${P}, SignedHeaders=${m}, Signature=${E}`,x=`${this.endpointProtocol}://${i}${d}?policy=`,T=await fetch(x,{method:"PUT",headers:{...h,Authorization:w},body:o});if(!T.ok){let A=await T.text();throw Error(`Failed to put bucket policy: ${T.status} ${A}`)}}async getBucketPolicy(e){let{accessKeyId:t,secretAccessKey:s,sessionToken:r}=this.getCredentials(),n=this.s3BaseHost(),i=new Date,o=i.toISOString().replace(/[:-]|\.\d{3}/g,""),a=i.toISOString().slice(0,10).replace(/-/g,""),g=c.createHash("sha256").update("").digest("hex"),l="/"+e,u="policy=",d={host:n,"x-amz-date":o,"x-amz-content-sha256":g};if(r)d["x-amz-security-token"]=r;let y=Object.keys(d).sort().map((T)=>`${T.toLowerCase()}:${d[T].trim()}
-`).join(""),h=Object.keys(d).sort().map((T)=>T.toLowerCase()).join(";"),S=["GET",l,"policy=",y,h,g].join(`
-`),m="AWS4-HMAC-SHA256",p=`${a}/${this.region}/s3/aws4_request`,C=[m,o,p,c.createHash("sha256").update(S).digest("hex")].join(`
-`),P=c.createHmac("sha256","AWS4"+s).update(a).digest(),k=c.createHmac("sha256",P).update(this.region).digest(),b=c.createHmac("sha256",k).update("s3").digest(),v=c.createHmac("sha256",b).update("aws4_request").digest(),q=c.createHmac("sha256",v).update(C).digest("hex"),H=`${m} Credential=${t}/${p}, SignedHeaders=${h}, Signature=${q}`,E=`${this.endpointProtocol}://${n}${l}?policy=`,w=await fetch(E,{method:"GET",headers:{...d,Authorization:H}});if(w.status===404)return null;if(!w.ok){let T=await w.text();throw Error(`Failed to get bucket policy: ${w.status} ${T}`)}let x=await w.text();return JSON.parse(x)}async deleteBucketPolicy(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{policy:""}})}async headBucket(e){try{return{exists:!0,region:(await this.client.request({service:"s3",region:this.region,method:"HEAD",path:`/${e}`,returnHeaders:!0}))?.headers?.["x-amz-bucket-region"]}}catch(t){if(t.statusCode===404)return{exists:!1};throw t}}async headObject(e,t){try{let s=await this.client.request({service:"s3",region:this.region,method:"HEAD",path:`/${e}/${t}`,returnHeaders:!0});return{ContentLength:s?.headers?.["content-length"]?parseInt(s.headers["content-length"]):void 0,ContentType:s?.headers?.["content-type"],ETag:s?.headers?.etag,LastModified:s?.headers?.["last-modified"]}}catch(s){if(s.statusCode===404)return null;throw s}}async getObjectBuffer(e,t){let s=await this.getObject(e,t);return Buffer.from(s)}async getObjectJson(e,t){let s=await this.getObject(e,t);return JSON.parse(s)}async putObjectJson(e,t,s,r){await this.putObject({bucket:e,key:t,body:JSON.stringify(s),contentType:"application/json",...r})}async getBucketVersioning(e){return{Status:(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{versioning:""}}))?.VersioningConfiguration?.Status}}async putBucketVersioning(e,t){let s=`<?xml version="1.0" encoding="UTF-8"?>
-<VersioningConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
-  <Status>${t}</Status>
-</VersioningConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{versioning:""},headers:{"Content-Type":"application/xml"},body:s})}async getBucketLifecycleConfiguration(e){try{return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{lifecycle:""}}))?.LifecycleConfiguration}catch(t){if(t.statusCode===404)return null;throw t}}async putBucketLifecycleConfiguration(e,t){let r=`<?xml version="1.0" encoding="UTF-8"?>
-<LifecycleConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
-  ${t.map((n)=>{let i=`<Rule><ID>${n.ID}</ID><Status>${n.Status}</Status>`;if(n.Filter)i+=`<Filter><Prefix>${n.Filter.Prefix||""}</Prefix></Filter>`;else i+="<Filter><Prefix></Prefix></Filter>";if(n.Expiration){if(n.Expiration.Days)i+=`<Expiration><Days>${n.Expiration.Days}</Days></Expiration>`;else if(n.Expiration.Date)i+=`<Expiration><Date>${n.Expiration.Date}</Date></Expiration>`}if(n.Transitions)for(let o of n.Transitions)i+=`<Transition><Days>${o.Days}</Days><StorageClass>${o.StorageClass}</StorageClass></Transition>`;if(n.NoncurrentVersionExpiration)i+=`<NoncurrentVersionExpiration><NoncurrentDays>${n.NoncurrentVersionExpiration.NoncurrentDays}</NoncurrentDays></NoncurrentVersionExpiration>`;return i+="</Rule>",i}).join("")}
-</LifecycleConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{lifecycle:""},headers:{"Content-Type":"application/xml"},body:r})}async deleteBucketLifecycleConfiguration(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{lifecycle:""}})}async getBucketCors(e){try{return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{cors:""}}))?.CORSConfiguration}catch(t){if(t.statusCode===404)return null;throw t}}async putBucketCors(e,t){let r=`<?xml version="1.0" encoding="UTF-8"?>
-<CORSConfiguration>
-  ${t.map((n)=>{let i="<CORSRule>";for(let o of n.AllowedOrigins)i+=`<AllowedOrigin>${o}</AllowedOrigin>`;for(let o of n.AllowedMethods)i+=`<AllowedMethod>${o}</AllowedMethod>`;if(n.AllowedHeaders)for(let o of n.AllowedHeaders)i+=`<AllowedHeader>${o}</AllowedHeader>`;if(n.ExposeHeaders)for(let o of n.ExposeHeaders)i+=`<ExposeHeader>${o}</ExposeHeader>`;if(n.MaxAgeSeconds)i+=`<MaxAgeSeconds>${n.MaxAgeSeconds}</MaxAgeSeconds>`;return i+="</CORSRule>",i}).join("")}
-</CORSConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{cors:""},headers:{"Content-Type":"application/xml"},body:r})}async deleteBucketCors(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{cors:""}})}async getBucketEncryption(e){try{return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{encryption:""}}))?.ServerSideEncryptionConfiguration}catch(t){if(t.statusCode===404)return null;throw t}}async putBucketEncryption(e,t,s){let r=`<ApplyServerSideEncryptionByDefault><SSEAlgorithm>${t}</SSEAlgorithm>`;if(s)r+=`<KMSMasterKeyID>${s}</KMSMasterKeyID>`;r+="</ApplyServerSideEncryptionByDefault>";let n=`<?xml version="1.0" encoding="UTF-8"?>
-<ServerSideEncryptionConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
-  <Rule>${r}</Rule>
-</ServerSideEncryptionConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{encryption:""},headers:{"Content-Type":"application/xml"},body:n})}async deleteBucketEncryption(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{encryption:""}})}async getBucketTagging(e){try{let s=(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{tagging:""}}))?.Tagging?.TagSet?.Tag;if(!s)return[];return Array.isArray(s)?s:[s]}catch(t){if(t.statusCode===404)return[];throw t}}async putBucketTagging(e,t){let r=`<?xml version="1.0" encoding="UTF-8"?>
-<Tagging>
-  <TagSet>${t.map((n)=>`<Tag><Key>${n.Key}</Key><Value>${n.Value}</Value></Tag>`).join("")}</TagSet>
-</Tagging>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{tagging:""},headers:{"Content-Type":"application/xml"},body:r})}async deleteBucketTagging(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{tagging:""}})}async getObjectTagging(e,t){try{let r=(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}/${t}`,queryParams:{tagging:""}}))?.Tagging?.TagSet?.Tag;if(!r)return[];return Array.isArray(r)?r:[r]}catch(s){if(s.statusCode===404)return[];throw s}}async putObjectTagging(e,t,s){let n=`<?xml version="1.0" encoding="UTF-8"?>
-<Tagging>
-  <TagSet>${s.map((i)=>`<Tag><Key>${i.Key}</Key><Value>${i.Value}</Value></Tag>`).join("")}</TagSet>
-</Tagging>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}/${t}`,queryParams:{tagging:""},headers:{"Content-Type":"application/xml"},body:n})}async deleteObjectTagging(e,t){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}/${t}`,queryParams:{tagging:""}})}async getBucketAcl(e){return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{acl:""}}))?.AccessControlPolicy}async putBucketAcl(e,t){await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{acl:""},headers:{"x-amz-acl":t}})}async getObjectAcl(e,t){return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}/${t}`,queryParams:{acl:""}}))?.AccessControlPolicy}async putObjectAcl(e,t,s){await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}/${t}`,queryParams:{acl:""},headers:{"x-amz-acl":s}})}async getBucketLocation(e){return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{location:""}}))?.LocationConstraint||"us-east-1"}async getBucketLogging(e){return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{logging:""}}))?.BucketLoggingStatus}async putBucketLogging(e,t,s){let r=`<?xml version="1.0" encoding="UTF-8"?>
-<BucketLoggingStatus xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
-  <LoggingEnabled>
-    <TargetBucket>${t}</TargetBucket>
-    <TargetPrefix>${s}</TargetPrefix>
-  </LoggingEnabled>
-</BucketLoggingStatus>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{logging:""},headers:{"Content-Type":"application/xml"},body:r})}async getBucketNotificationConfiguration(e){return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{notification:""}}))?.NotificationConfiguration}async putBucketNotificationConfiguration(e,t){let s="";if(t.LambdaFunctionConfigurations)for(let n of t.LambdaFunctionConfigurations){if(s+="<CloudFunctionConfiguration>",n.Id)s+=`<Id>${n.Id}</Id>`;s+=`<CloudFunction>${n.LambdaFunctionArn}</CloudFunction>`;for(let i of n.Events)s+=`<Event>${i}</Event>`;if(n.Filter?.Key?.FilterRules){s+="<Filter><S3Key>";for(let i of n.Filter.Key.FilterRules)s+=`<FilterRule><Name>${i.Name}</Name><Value>${i.Value}</Value></FilterRule>`;s+="</S3Key></Filter>"}s+="</CloudFunctionConfiguration>"}if(t.TopicConfigurations)for(let n of t.TopicConfigurations){if(s+="<TopicConfiguration>",n.Id)s+=`<Id>${n.Id}</Id>`;s+=`<Topic>${n.TopicArn}</Topic>`;for(let i of n.Events)s+=`<Event>${i}</Event>`;s+="</TopicConfiguration>"}if(t.QueueConfigurations)for(let n of t.QueueConfigurations){if(s+="<QueueConfiguration>",n.Id)s+=`<Id>${n.Id}</Id>`;s+=`<Queue>${n.QueueArn}</Queue>`;for(let i of n.Events)s+=`<Event>${i}</Event>`;s+="</QueueConfiguration>"}let r=`<?xml version="1.0" encoding="UTF-8"?>
-<NotificationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
-  ${s}
-</NotificationConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{notification:""},headers:{"Content-Type":"application/xml"},body:r})}async getBucketWebsite(e){try{return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{website:""}}))?.WebsiteConfiguration}catch(t){if(t.statusCode===404)return null;throw t}}async putBucketWebsite(e,t){let s="";if(t.RedirectAllRequestsTo)s=`<RedirectAllRequestsTo>
-        <HostName>${t.RedirectAllRequestsTo.HostName}</HostName>
-        ${t.RedirectAllRequestsTo.Protocol?`<Protocol>${t.RedirectAllRequestsTo.Protocol}</Protocol>`:""}
-      </RedirectAllRequestsTo>`;else if(s=`<IndexDocument><Suffix>${t.IndexDocument}</Suffix></IndexDocument>`,t.ErrorDocument)s+=`<ErrorDocument><Key>${t.ErrorDocument}</Key></ErrorDocument>`;let r=`<?xml version="1.0" encoding="UTF-8"?>
-<WebsiteConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
-  ${s}
-</WebsiteConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{website:""},headers:{"Content-Type":"application/xml"},body:r})}async deleteBucketWebsite(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{website:""}})}async getBucketReplication(e){try{return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{replication:""}}))?.ReplicationConfiguration}catch(t){if(t.statusCode===404)return null;throw t}}async deleteBucketReplication(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{replication:""}})}async getPublicAccessBlock(e){try{return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{publicAccessBlock:""}}))?.PublicAccessBlockConfiguration}catch(t){if(t.statusCode===404)return null;throw t}}async putPublicAccessBlock(e,t){let s=`<?xml version="1.0" encoding="UTF-8"?>
-<PublicAccessBlockConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
-  <BlockPublicAcls>${t.BlockPublicAcls??!0}</BlockPublicAcls>
-  <IgnorePublicAcls>${t.IgnorePublicAcls??!0}</IgnorePublicAcls>
-  <BlockPublicPolicy>${t.BlockPublicPolicy??!0}</BlockPublicPolicy>
-  <RestrictPublicBuckets>${t.RestrictPublicBuckets??!0}</RestrictPublicBuckets>
-</PublicAccessBlockConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{publicAccessBlock:""},headers:{"Content-Type":"application/xml"},body:s})}async deletePublicAccessBlock(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{publicAccessBlock:""}})}generatePresignedGetUrl(e,t,s=3600){let{accessKeyId:r,secretAccessKey:n}=this.getCredentials(),i=this.s3VirtualHost(e),o=new Date,a=o.toISOString().replace(/[:-]|\.\d{3}/g,""),g=o.toISOString().slice(0,10).replace(/-/g,""),l=`${g}/${this.region}/s3/aws4_request`,u=`${r}/${l}`,d=t.split("/").map((b)=>encodeURIComponent(b)).join("/"),y=new URLSearchParams({"X-Amz-Algorithm":"AWS4-HMAC-SHA256","X-Amz-Credential":u,"X-Amz-Date":a,"X-Amz-Expires":s.toString(),"X-Amz-SignedHeaders":"host"}),h=["GET",this.objectPath(e,d),y.toString(),`host:${i}
-`,"host","UNSIGNED-PAYLOAD"].join(`
-`),S=["AWS4-HMAC-SHA256",a,l,c.createHash("sha256").update(h).digest("hex")].join(`
-`),m=c.createHmac("sha256",`AWS4${n}`).update(g).digest(),p=c.createHmac("sha256",m).update(this.region).digest(),C=c.createHmac("sha256",p).update("s3").digest(),P=c.createHmac("sha256",C).update("aws4_request").digest(),k=c.createHmac("sha256",P).update(S).digest("hex");return y.append("X-Amz-Signature",k),`${this.endpointProtocol}://${i}${this.objectPath(e,d)}?${y.toString()}`}generatePresignedPutUrl(e,t,s,r=3600){let{accessKeyId:n,secretAccessKey:i}=this.getCredentials(),o=this.s3VirtualHost(e),a=new Date,g=a.toISOString().replace(/[:-]|\.\d{3}/g,""),l=a.toISOString().slice(0,10).replace(/-/g,""),u=`${l}/${this.region}/s3/aws4_request`,d=`${n}/${u}`,y=t.split("/").map((v)=>encodeURIComponent(v)).join("/"),h=new URLSearchParams({"X-Amz-Algorithm":"AWS4-HMAC-SHA256","X-Amz-Credential":d,"X-Amz-Date":g,"X-Amz-Expires":r.toString(),"X-Amz-SignedHeaders":"content-type;host"}),S=["PUT",this.objectPath(e,y),h.toString(),`content-type:${s}
-host:${o}
-`,"content-type;host","UNSIGNED-PAYLOAD"].join(`
-`),m=["AWS4-HMAC-SHA256",g,u,c.createHash("sha256").update(S).digest("hex")].join(`
-`),p=c.createHmac("sha256",`AWS4${i}`).update(l).digest(),C=c.createHmac("sha256",p).update(this.region).digest(),P=c.createHmac("sha256",C).update("s3").digest(),k=c.createHmac("sha256",P).update("aws4_request").digest(),b=c.createHmac("sha256",k).update(m).digest("hex");return h.append("X-Amz-Signature",b),`${this.endpointProtocol}://${o}${this.objectPath(e,y)}?${h.toString()}`}async createMultipartUpload(e,t,s){let r={};if(s?.contentType)r["Content-Type"]=s.contentType;if(s?.metadata)for(let[a,g]of Object.entries(s.metadata))r[`x-amz-meta-${a}`]=g;let n=t.split("/").map((a)=>encodeURIComponent(a)).join("/"),i=await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${n}`,bucket:e,queryParams:{uploads:""},headers:r});return{UploadId:(i?.InitiateMultipartUploadResult??i)?.UploadId}}async uploadPart(e,t,s,r,n){let{accessKeyId:i,secretAccessKey:o,sessionToken:a}=this.getCredentials(),g=this.s3VirtualHost(e),l=t.split("/").map((j)=>encodeURIComponent(j)).join("/"),u=this.objectPath(e,l),d=`${this.objectUrl(e,l)}?partNumber=${r}&uploadId=${encodeURIComponent(s)}`,y=new Date,h=y.toISOString().replace(/[:-]|\.\d{3}/g,""),S=y.toISOString().slice(0,10).replace(/-/g,""),m=c.createHash("sha256").update(n).digest("hex"),p={host:g,"x-amz-date":h,"x-amz-content-sha256":m};if(a)p["x-amz-security-token"]=a;let C=Object.keys(p).sort().map((j)=>`${j.toLowerCase()}:${p[j].trim()}
-`).join(""),P=Object.keys(p).sort().map((j)=>j.toLowerCase()).join(";"),k=["PUT",u,`partNumber=${r}&uploadId=${encodeURIComponent(s)}`,C,P,m].join(`
-`),b="AWS4-HMAC-SHA256",v=`${S}/${this.region}/s3/aws4_request`,q=[b,h,v,c.createHash("sha256").update(k).digest("hex")].join(`
-`),H=c.createHmac("sha256",`AWS4${o}`).update(S).digest(),E=c.createHmac("sha256",H).update(this.region).digest(),w=c.createHmac("sha256",E).update("s3").digest(),x=c.createHmac("sha256",w).update("aws4_request").digest(),T=c.createHmac("sha256",x).update(q).digest("hex"),A=`${b} Credential=${i}/${v}, SignedHeaders=${P}, Signature=${T}`,f=await fetch(d,{method:"PUT",headers:{...p,Authorization:A},body:B(n)});if(!f.ok){let j=await f.text();throw Error(`Upload part failed: ${f.status} ${j}`)}return{ETag:f.headers.get("etag")||""}}async completeMultipartUpload(e,t,s,r){let n=t.split("/").map((a)=>encodeURIComponent(a)).join("/"),o=`<?xml version="1.0" encoding="UTF-8"?>
-<CompleteMultipartUpload>${r.sort((a,g)=>a.PartNumber-g.PartNumber).map((a)=>`<Part><PartNumber>${a.PartNumber}</PartNumber><ETag>${a.ETag}</ETag></Part>`).join("")}</CompleteMultipartUpload>`;await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${n}`,bucket:e,queryParams:{uploadId:s},headers:{"Content-Type":"application/xml"},body:o})}async abortMultipartUpload(e,t,s){let r=t.split("/").map((n)=>encodeURIComponent(n)).join("/");await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${r}`,bucket:e,queryParams:{uploadId:s}})}async listMultipartUploads(e){let t=await this.client.request({service:"s3",region:this.region,method:"GET",path:"/",bucket:e,queryParams:{uploads:""}}),s=(t?.ListMultipartUploadsResult??t)?.Upload;if(!s)return[];return(Array.isArray(s)?s:[s]).map((n)=>({Key:n.Key,UploadId:n.UploadId,Initiated:n.Initiated}))}async restoreObject(e,t,s,r="Standard"){let n=`<?xml version="1.0" encoding="UTF-8"?>
-<RestoreRequest>
-  <Days>${s}</Days>
-  <GlacierJobParameters>
-    <Tier>${r}</Tier>
-  </GlacierJobParameters>
-</RestoreRequest>`;await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${e}/${t}`,queryParams:{restore:""},headers:{"Content-Type":"application/xml"},body:n})}async selectObjectContent(e,t,s,r,n="JSON"){let i="";if(r==="CSV")i="<CSV><FileHeaderInfo>USE</FileHeaderInfo></CSV>";else if(r==="JSON")i="<JSON><Type>DOCUMENT</Type></JSON>";else i="<Parquet/>";let o="";if(n==="CSV")o="<CSV/>";else o="<JSON/>";let a=`<?xml version="1.0" encoding="UTF-8"?>
-<SelectObjectContentRequest>
-  <Expression>${s}</Expression>
-  <ExpressionType>SQL</ExpressionType>
-  <InputSerialization>${i}</InputSerialization>
-  <OutputSerialization>${o}</OutputSerialization>
-</SelectObjectContentRequest>`;return await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${e}/${t}`,queryParams:{select:"","select-type":"2"},headers:{"Content-Type":"application/xml"},body:a,rawResponse:!0})}async getSignedUrl(e){let{bucket:t,key:s,expiresIn:r=3600,operation:n="getObject"}=e,{accessKeyId:i,secretAccessKey:o,sessionToken:a}=this.getCredentials(),g=new Date,l=g.toISOString().replace(/[:-]|\.\d{3}/g,""),u=g.toISOString().slice(0,10).replace(/-/g,""),d=this.s3VirtualHost(t),y=n==="putObject"?"PUT":"GET",h="AWS4-HMAC-SHA256",S=`${u}/${this.region}/s3/aws4_request`,p={"X-Amz-Algorithm":"AWS4-HMAC-SHA256","X-Amz-Credential":`${i}/${S}`,"X-Amz-Date":l,"X-Amz-Expires":r.toString(),"X-Amz-SignedHeaders":"host"};if(a)p["X-Amz-Security-Token"]=a;let P=Object.keys(p).sort().map((I)=>`${encodeURIComponent(I)}=${encodeURIComponent(p[I])}`).join("&"),k=s.split("/").map((I)=>encodeURIComponent(I)).join("/"),b=this.objectPath(t,k),v=`host:${d}
-`,E=[y,b,P,v,"host","UNSIGNED-PAYLOAD"].join(`
-`),w=["AWS4-HMAC-SHA256",l,S,c.createHash("sha256").update(E).digest("hex")].join(`
-`),x=c.createHmac("sha256",`AWS4${o}`).update(u).digest(),T=c.createHmac("sha256",x).update(this.region).digest(),A=c.createHmac("sha256",T).update("s3").digest(),f=c.createHmac("sha256",A).update("aws4_request").digest(),j=c.createHmac("sha256",f).update(w).digest("hex");return`${this.endpointProtocol}://${d}${b}?${P}&X-Amz-Signature=${j}`}async listObjects(e){let{bucket:t,prefix:s,maxKeys:r=1000,continuationToken:n}=e,i={"list-type":"2","max-keys":r.toString()};if(s)i.prefix=s;if(n)i["continuation-token"]=n;let o=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${t}`,queryParams:i}),a=[],g=o?.ListBucketResult??o;if(g?.Contents){let l=Array.isArray(g.Contents)?g.Contents:[g.Contents];for(let u of l)a.push({Key:u.Key||"",LastModified:u.LastModified||"",Size:Number.parseInt(u.Size||"0"),ETag:u.ETag})}return{objects:a,nextContinuationToken:g?.NextContinuationToken}}async emptyBucket(e){let t=0,s=await this.listAllObjects({bucket:e});if(s.length>0)for(let r=0;r<s.length;r+=1000){let i=s.slice(r,r+1000).map((o)=>o.Key);await this.deleteObjects(e,i),t+=i.length}try{let r,n;do{let i=await this.listObjectVersions({bucket:e,keyMarker:r,versionIdMarker:n,maxKeys:1000}),o=[];if(i.versions)for(let a of i.versions)o.push({Key:a.Key,VersionId:a.VersionId});if(i.deleteMarkers)for(let a of i.deleteMarkers)o.push({Key:a.Key,VersionId:a.VersionId});if(o.length>0)await this.deleteObjectVersions(e,o),t+=o.length;r=i.nextKeyMarker,n=i.nextVersionIdMarker}while(r)}catch{}return{deletedCount:t}}async listObjectVersions(e){let{bucket:t,prefix:s,keyMarker:r,versionIdMarker:n,maxKeys:i=1000}=e,o={versions:"","max-keys":i.toString()};if(s)o.prefix=s;if(r)o["key-marker"]=r;if(n)o["version-id-marker"]=n;let a=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${t}`,queryParams:o}),g=[],l=[];if(a.Version){let u=Array.isArray(a.Version)?a.Version:[a.Version];for(let d of u)g.push({Key:d.Key,VersionId:d.VersionId,IsLatest:d.IsLatest==="true"})}if(a.DeleteMarker){let u=Array.isArray(a.DeleteMarker)?a.DeleteMarker:[a.DeleteMarker];for(let d of u)l.push({Key:d.Key,VersionId:d.VersionId,IsLatest:d.IsLatest==="true"})}return{versions:g,deleteMarkers:l,nextKeyMarker:a.NextKeyMarker,nextVersionIdMarker:a.NextVersionIdMarker}}async deleteObjectVersions(e,t){let s=`<?xml version="1.0" encoding="UTF-8"?>
-<Delete>
-  <Quiet>true</Quiet>
-  ${t.map((n)=>`<Object><Key>${n.Key}</Key>${n.VersionId?`<VersionId>${n.VersionId}</VersionId>`:""}</Object>`).join(`
-  `)}
-</Delete>`,r=c.createHash("md5").update(s).digest("base64");await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${e}`,queryParams:{delete:""},body:s,headers:{"Content-Type":"application/xml","Content-MD5":r}})}}
-export{R as Yh,V as Zh};

package/dist/chunk-1qdne0bf.js

@@ -1 +0,0 @@
-import{ul as w}from"./chunk-x3hay61c.js";var L="\x00";function k(t,i){if(t==="*"||t==="**")return!0;let e=t.replace(/[.+^${}()|[\]\\]/g,"\\$&").replace(/\*\*/g,"\x01").replace(/\*/g,"[^/]*").replace(/\u0001/g,".*");return new RegExp(`^${e}$`).test(i)}function y(t,i){if(t.startsWith("*.")){let e=t.slice(1);return i.endsWith(e)&&i.length>e.length}return t===i}function d(t,i){if(t.enabled===!1)return!1;if(t.methods?.length&&!t.methods.some((e)=>e.toUpperCase()===i.method.toUpperCase()))return!1;if(t.path&&!k(t.path,i.path))return!1;if(t.host&&!y(t.host,i.host??""))return!1;return!0}function m(t,i){let e=t.key??{source:"ip"},o=e.fallbackToIp!==!1,r;if(e.source==="ip")r=i.ip;else if(e.source==="global")r="global";else if(e.source==="host")r=i.host??"";else if(e.source==="path")r=i.path;else if(e.source==="header")r=e.name?i.headers?.[e.name.toLowerCase()]:void 0;else if(e.source==="cookie")r=e.name?i.cookies?.[e.name]:void 0;if(!r&&e.source!=="global")r=o?i.ip:"__missing__";return`${t.id}\x00${r}`}class A{clock;maxTrackedKeys;buckets=new Map;windows=new Map;rules;constructor(t,i=()=>Date.now(),e=1e5){this.clock=i;this.maxTrackedKeys=e;this.rules=[...t].sort((o,r)=>(o.priority??0)-(r.priority??0))}check(t){let i=this.clock(),e=this.rules.filter((n)=>d(n,t)),o;for(let n of e){let s=this.test(n,t,i);if(s.allowed)continue;if(!o||p(s.action)>p(o.action))o=s}if(o)return o;let r={action:"allow",allowed:!0};for(let n of e){let s=this.consume(n,t,i);if(s.remaining!=null&&(r.remaining??1/0)>s.remaining)r=s}return r}test(t,i,e){let o=m(t,i);if((t.algorithm??"token_bucket")==="token_bucket"){let n=t.burst??t.limit,s=this.buckets.get(o),a=s?Math.min(n,s.tokens+this.refill(t,e-s.updatedAt)):n;if(a>=1)return{action:"allow",allowed:!0};return this.blocked(t,o,0,this.msPerToken(t)*(1-a),e)}let r=(this.windows.get(o)?.hits??[]).filter((n)=>n>e-t.windowMs);if(r.length<t.limit)return{action:"allow",allowed:!0};return this.blocked(t,o,0,r[0]+t.windowMs-e,e)}peek(t){let i=this.clock();for(let e of this.rules){if(!d(e,t))continue;let o=this.test(e,t,i);if(!o.allowed)return o}return{action:"allow",allowed:!0}}msPerToken(t){return t.windowMs/Math.max(1,t.limit)}refill(t,i){return Math.max(0,i)/this.msPerToken(t)}blocked(t,i,e,o,r){let n=t.action??"deny";return{action:n,allowed:n==="allow"||n==="log",ruleId:t.id,limit:t.limit,remaining:e,retryAfterMs:Math.max(0,Math.ceil(o)),resetAt:r+Math.max(0,o),key:i}}consume(t,i,e){let o=m(t,i);if((t.algorithm??"token_bucket")==="token_bucket"){let l=t.burst??t.limit,u=this.buckets.get(o)??{tokens:l,updatedAt:e},c=Math.min(l,u.tokens+this.refill(t,e-u.updatedAt));if(c<1)return this.buckets.set(o,{tokens:c,updatedAt:e}),this.blocked(t,o,0,this.msPerToken(t)*(1-c),e);return this.evictIfNeeded(this.buckets),this.buckets.set(o,{tokens:c-1,updatedAt:e}),{action:"allow",allowed:!0,ruleId:t.id,limit:l,remaining:Math.floor(c-1),resetAt:e+this.msPerToken(t)*(l-(c-1)),key:o}}let n=this.windows.get(o)??{hits:[]},s=e-t.windowMs,a=n.hits.filter((l)=>l>s);if(a.length>=t.limit)return this.windows.set(o,{hits:a}),this.blocked(t,o,0,a[0]+t.windowMs-e,e);return a.push(e),this.evictIfNeeded(this.windows),this.windows.set(o,{hits:a}),{action:"allow",allowed:!0,ruleId:t.id,limit:t.limit,remaining:t.limit-a.length,resetAt:a[0]+t.windowMs,key:o}}evictIfNeeded(t){if(t.size<this.maxTrackedKeys)return;let i=t.size-this.maxTrackedKeys+1,e=0;for(let o of t.keys())if(t.delete(o),++e>=i)break}sweep(){let t=this.clock(),i=0;for(let[e,o]of this.windows){let r=e.split("\x00")[0],n=this.rules.find((s)=>s.id===r);if(!n){this.windows.delete(e),i++;continue}if(o.hits.every((s)=>s<=t-n.windowMs))this.windows.delete(e),i++}for(let[e,o]of this.buckets){let r=e.split("\x00")[0],n=this.rules.find((s)=>s.id===r);if(!n||t-o.updatedAt>n.windowMs*2)this.buckets.delete(e),i++}return i}get trackedKeys(){return this.buckets.size+this.windows.size}}function p(t){return{allow:0,log:1,throttle:2,challenge:3,deny:4}[t]}function I(t){let i={};if(t.limit!=null)i["ratelimit-limit"]=String(t.limit);if(t.remaining!=null)i["ratelimit-remaining"]=String(t.remaining);if(t.resetAt!=null)i["ratelimit-reset"]=String(Math.max(0,Math.ceil((t.resetAt-Date.now())/1000)));if(!t.allowed&&t.retryAfterMs!=null)i["retry-after"]=String(Math.max(1,Math.ceil(t.retryAfterMs/1000)));return i}function C(){return[{id:"global-ip",limit:600,windowMs:60000,burst:100,key:{source:"ip"},action:"deny",priority:100},{id:"api-ip",limit:120,windowMs:60000,burst:30,path:"/api/**",key:{source:"ip"},action:"deny",priority:50},{id:"auth-ip",limit:10,windowMs:60000,algorithm:"sliding_window",path:"/auth/**",methods:["POST"],key:{source:"ip"},action:"challenge",priority:10}]}var h="protection.controls",b=24,x=4,M={ipRules:{allow:[],block:[]}};function f(t,i){if(!t?.enabled)return;return new Date(t.expiresAt).getTime()>i.getTime()?t:void 0}function g(t,i){let e=Number.isFinite(t)?Number(t):i;return Math.min(b,Math.max(0.25,e))}var R=500;class P{controlPlane;options;constructor(t,i={}){this.controlPlane=t;this.options=i}now(){return this.options.now?.()??new Date}read(){let t=this.controlPlane.getSetting(h);if(!t||typeof t!=="object"||Array.isArray(t))return{...M,ipRules:{allow:[],block:[]}};let i=t;return{attackMode:i.attackMode,mitigationPause:i.mitigationPause,ipRules:{allow:Array.isArray(i.ipRules?.allow)?i.ipRules.allow:[],block:Array.isArray(i.ipRules?.block)?i.ipRules.block:[]},updatedAt:i.updatedAt}}write(t){let i={...t,updatedAt:this.now().toISOString()};return this.controlPlane.setSetting(h,i),i}raw(){return this.read()}current(){let t=this.now(),i=this.read();return{attackMode:f(i.attackMode,t),mitigationPause:f(i.mitigationPause,t),ipRules:i.ipRules}}enableAttackMode(t){let i=this.now(),e={enabled:!0,startedAt:i.toISOString(),expiresAt:new Date(i.getTime()+g(t.hours,x)*3600000).toISOString(),reason:t.reason.trim()||"Attack mode enabled by an operator.",actorId:t.actorId};return this.write({...this.read(),attackMode:e}),e}disableAttackMode(){let t=this.read();if(!t.attackMode?.enabled)return!1;return this.write({...t,attackMode:{...t.attackMode,enabled:!1}}),!0}pauseMitigations(t){let i=t.reason.trim();if(!i)throw Error("Pausing mitigations requires a reason: you are liable for the traffic it admits.");let e=this.now(),o={enabled:!0,startedAt:e.toISOString(),expiresAt:new Date(e.getTime()+g(t.hours,b)*3600000).toISOString(),reason:i,actorId:t.actorId};return this.write({...this.read(),mitigationPause:o}),o}resumeMitigations(){let t=this.read();if(!t.mitigationPause?.enabled)return!1;return this.write({...t,mitigationPause:{...t.mitigationPause,enabled:!1}}),!0}addIpRule(t,i){let e=i.trim();if(!w(e))throw Error(`Not a valid IP or CIDR: ${i}`);let o=this.read(),r={...o.ipRules,[t]:[...new Set([...o.ipRules[t],e])]};if(r[t].length>R)throw Error(`At most ${R} ${t} rules are supported.`);let n=t==="allow"?"block":"allow";return r[n]=r[n].filter((s)=>s!==e),this.write({...o,ipRules:r}),r}removeIpRule(t,i){let e=this.read(),o={...e.ipRules,[t]:e.ipRules[t].filter((r)=>r!==i.trim())};return this.write({...e,ipRules:o}),o}}function D(t){if(t.mitigationPause)return{attackMode:!!t.attackMode,mitigationPaused:!0,summary:`Automatic mitigation is paused until ${t.mitigationPause.expiresAt}. All traffic is being served and billed.`,expiresAt:t.mitigationPause.expiresAt};if(t.attackMode)return{attackMode:!0,mitigationPaused:!1,summary:`Attack mode is on until ${t.attackMode.expiresAt}. Every visitor is being challenged.`,expiresAt:t.attackMode.expiresAt};return{attackMode:!1,mitigationPaused:!1,summary:"Protection is in its normal posture."}}function E(t,i){if(i.mitigationPause)return t.map((e)=>({...e,enabled:!1}));if(!i.attackMode)return[...t];return t.map((e)=>({...e,action:e.action==="deny"?"deny":"challenge",burst:Math.max(1,Math.min(e.burst??e.limit,5))}))}function T(t,i){let e=[...new Set([...t.allowlist??[],...i.ipRules.allow])],o=[...new Set([...t.blocklist??[],...i.ipRules.block])];if(i.mitigationPause)return{...t,allowlist:e,blocklist:o,monitorOnly:!0};if(!i.attackMode)return{...t,allowlist:e,blocklist:o};let r=t.thresholds??{};return{...t,allowlist:e,blocklist:o,thresholds:{...r,newConnectionsPerSecond:Math.max(1,Math.floor((r.newConnectionsPerSecond??50)/5)),concurrentPerSource:Math.max(1,Math.floor((r.concurrentPerSource??100)/5))}}}function v(t,i){let e=t?.infrastructure?.compute;if(!e||e.ddos===!1)return t;let o=typeof e.ddos==="object"&&e.ddos!==null?e.ddos:{};return{...t,infrastructure:{...t.infrastructure,compute:{...e,ddos:T(o,i)}}}}export{L as _k,k as $k,d as al,m as bl,A as cl,I as dl,C as el,h as fl,b as gl,x as hl,P as il,D as jl,E as kl,T as ll,v as ml};

package/dist/chunk-3mgj3hrh.js

@@ -1,5 +0,0 @@
-import{tf as L}from"./chunk-73ztr55z.js";import{Js as E,kt as T,pt as M,qt as U,xs as R,zs as P}from"./chunk-jm5mg890.js";import{execFileSync as C}from"node:child_process";import{mkdirSync as I,mkdtempSync as q,rmSync as N,writeFileSync as d}from"node:fs";import{tmpdir as z}from"node:os";import{dirname as G,join as s}from"node:path";var r={reset:"\x1B[0m",bright:"\x1B[1m",dim:"\x1B[2m",red:"\x1B[31m",green:"\x1B[32m",yellow:"\x1B[33m",blue:"\x1B[34m",magenta:"\x1B[35m",cyan:"\x1B[36m",white:"\x1B[37m",gray:"\x1B[90m"};function b(t,e){return`${r[e]}${t}${r.reset}`}function _(t){console.log(`${r.green}✓${r.reset} ${t}`)}function H(t){console.error(`${r.red}✗${r.reset} ${t}`)}function K(t){console.warn(`${r.yellow}⚠${r.reset} ${t}`)}function k(t){console.log(`${r.blue}ℹ${r.reset} ${t}`)}function V(t){console.log(`${r.cyan}→${r.reset} ${t}`)}function J(t){console.log(`
-${r.bright}${r.cyan}${t}${r.reset}
-`)}var Q=!!(process.env.CI||process.env.GITHUB_ACTIONS||process.env.BUILDKITE||process.env.CIRCLECI||process.env.GITLAB_CI);function X(t,e="cyan"){let n=t.split(`
-`),i=Math.max(...n.map((l)=>l.length)),a="─".repeat(i+2);console.log(b(`┌${a}┐`,e)),n.forEach((l)=>{console.log(b(`│ ${l.padEnd(i)} │`,e))}),console.log(b(`└${a}┘`,e))}function A(t,e){for(let n of e){let i=s(t,n.name);I(G(i),{recursive:!0}),d(i,n.data,n.mode?{mode:n.mode}:void 0)}}async function ot(t){let{app:e,projectRoot:n,region:i,repository:a}=t,l=e.architecture??"x86_64",O=l==="arm64"?"linux/arm64":"linux/amd64",j=e.kind==="php",c=t.onStep??(()=>{}),p=q(s(z(),"tscloud-img-"));try{let f=s(p,"app");I(f,{recursive:!0});let y,w;if(j){M({projectRoot:n,app:e,skipBuild:t.skipBuild,onStep:c}),c("staging application tree");let o=U(n);A(f,o),A(s(p,"runtime"),T().map((g)=>({name:g.path,data:g.contents,mode:g.mode})));let B=e.handlers?.http??"public/index.php";y={http:B,queue:e.handlers?.queue??B,cli:e.handlers?.cli??B},w=R(o.map((g)=>`${g.name}:${g.data.length}`).join("|"))}else{c("bundling application");let o=await P({projectRoot:n,app:e,skipBuild:t.skipBuild,onStep:c});d(s(f,"index.mjs"),o.bundle),y=o.handlers,w=o.sha256}let S=w.slice(0,16);d(s(p,"Dockerfile"),E({kind:e.kind??"node",phpVersion:e.phpVersion,architecture:l}));let v=new L(i),u;try{u=(await v.describeRepositories({repositoryNames:[a]})).repositories?.[0]?.repositoryUri??""}catch{u=""}if(!u)c(`creating ECR repository ${a}`),u=(await v.createRepository({repositoryName:a,imageScanningConfiguration:{scanOnPush:!0}})).repository?.repositoryUri??"";if(!u)throw Error(`could not resolve ECR repository URI for ${a}`);let m=`${u}:${S}`;c("docker build"),C("docker",["build","--platform",O,"--provenance=false","--sbom=false","-t",m,p],{stdio:"inherit"}),c("ecr auth + push");let h=(await v.getAuthorizationToken()).authorizationData?.[0];if(!h?.authorizationToken||!h.proxyEndpoint)throw Error("failed to get an ECR authorization token");let D=h.proxyEndpoint.replace(/^https?:\/\//,""),x=s(p,".docker");return I(x,{recursive:!0}),d(s(x,"config.json"),JSON.stringify({auths:{[D]:{auth:h.authorizationToken}}})),C("docker",["push",m],{stdio:"inherit",env:{...process.env,DOCKER_CONFIG:x}}),k(`Image: ${m}`),{imageUri:m,tag:S,handlers:y}}finally{N(p,{recursive:!0,force:!0})}}
-export{_ as Bd,H as Cd,K as Dd,k as Ed,V as Fd,J as Gd,X as Hd,ot as Id};