@stacksjs/ts-cloud 0.12.12 → 0.12.13

package/dist/chunk-n1fyryha.js

@@ -1,141 +0,0 @@
-import{tj as T}from"./chunk-ac87ds1k.js";class A{client;constructor(e,i){this.client=i??new T(void 0,{profile:e})}collectionItems(e,i){let t=e?.Items??e?.[i];if(!t)return[];if(Array.isArray(t))return t;let n=t[i]??t.Item;if(n===void 0)return typeof t==="object"&&(t.Id||t.PathPattern)?[t]:[];return Array.isArray(n)?n:[n]}validateExistingOriginInput(e,i){if(!/^[A-Z0-9]{8,32}$/.test(e))throw Error("CloudFront distribution ID is invalid");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(i.id))throw Error("CloudFront origin ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/.test(i.domainName))throw Error("CloudFront origin must be a hostname without a scheme or path");let t=i.pathPattern.startsWith("/")?i.pathPattern:`/${i.pathPattern}`;if(t==="/"||t==="/*"||!/^\/[A-Za-z0-9_.*?~!$&'()+,;=:@%/-]{1,255}$/.test(t))throw Error("CloudFront path pattern must be a non-default absolute pattern");if(i.originPath&&(!i.originPath.startsWith("/")||i.originPath.includes("..")))throw Error("CloudFront origin path must be absolute and traversal-free");if(Object.entries(i.customHeaders??{}).some(([n,s])=>!/^[A-Za-z0-9-]{1,64}$/.test(n)||!s||s.length>1024))throw Error("CloudFront custom origin headers are invalid");return{...i,pathPattern:t}}async upsertExistingDistributionOrigin(e,i){let t=this.validateExistingOriginInput(e,i),n=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),s=n.headers?.etag||n.headers?.ETag||n.ETag||"",r=n.body?.DistributionConfig||n.DistributionConfig||n.body;if(!r||r.Enabled===void 0||!s)throw Error("Failed to read an ETag-protected CloudFront distribution config");let o=this.collectionItems(r.Origins,"Origin"),a=this.collectionItems(r.CacheBehaviors,"CacheBehavior"),u=o.find((f)=>String(f.Id)===t.id),c=a.find((f)=>String(f.PathPattern)===t.pathPattern);if(u&&String(u.DomainName)!==t.domainName&&!t.replaceExisting)throw Error(`Origin ${t.id} already targets ${u.DomainName}; pass replaceExisting only after reviewing the live config`);if(c&&String(c.TargetOriginId)!==t.id&&!t.replaceExisting)throw Error(`Path ${t.pathPattern} already targets ${c.TargetOriginId}; pass replaceExisting only after reviewing the live config`);let g={Id:t.id,DomainName:t.domainName,OriginPath:t.originPath??"",CustomHeaders:{Quantity:Object.keys(t.customHeaders??{}).length,...Object.keys(t.customHeaders??{}).length?{Items:{OriginCustomHeader:Object.entries(t.customHeaders).map(([f,I])=>({HeaderName:f,HeaderValue:I}))}}:{}},CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:t.protocolPolicy??"https-only",OriginSslProtocols:{Quantity:1,Items:{SslProtocol:["TLSv1.2"]}},OriginReadTimeout:30,OriginKeepaliveTimeout:5},ConnectionAttempts:3,ConnectionTimeout:10,...t.originAccessControlId?{OriginAccessControlId:t.originAccessControlId}:{}},m=["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],d={PathPattern:t.pathPattern,TargetOriginId:t.id,ViewerProtocolPolicy:"redirect-to-https",Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac",AllowedMethods:{Quantity:m.length,Items:{Method:m},CachedMethods:{Quantity:2,Items:{Method:["GET","HEAD"]}}},SmoothStreaming:!1,FieldLevelEncryptionId:"",TrustedSigners:{Enabled:!1,Quantity:0},TrustedKeyGroups:{Enabled:!1,Quantity:0},LambdaFunctionAssociations:{Quantity:0},FunctionAssociations:{Quantity:0}},h=u?o.map((f)=>String(f.Id)===t.id?g:f):[...o,g],l=c?a.map((f)=>String(f.PathPattern)===t.pathPattern?d:f):[...a,d],y=JSON.stringify(o)!==JSON.stringify(h)||JSON.stringify(a)!==JSON.stringify(l);if(!y||t.dryRun)return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:y,applied:!1,etag:s};r.Origins={Quantity:h.length,Items:{Origin:h}},r.CacheBehaviors={Quantity:l.length,...l.length?{Items:{CacheBehavior:l}}:{}};let C=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:this.buildDistributionConfigXml(r),headers:{"Content-Type":"application/xml","If-Match":s}});return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!0,applied:!0,etag:C.ETag||C.headers?.etag||""}}async removeExistingDistributionOrigin(e,i){let t=this.validateExistingOriginInput(e,i),n=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),s=n.headers?.etag||n.headers?.ETag||n.ETag||"",r=n.body?.DistributionConfig||n.DistributionConfig||n.body;if(!r||r.Enabled===void 0||!s)throw Error("Failed to read an ETag-protected CloudFront distribution config");let o=this.collectionItems(r.Origins,"Origin"),a=this.collectionItems(r.CacheBehaviors,"CacheBehavior"),u=o.find((l)=>String(l.Id)===t.id),c=a.find((l)=>String(l.PathPattern)===t.pathPattern);if(u&&String(u.DomainName)!==t.domainName)throw Error(`Origin ${t.id} no longer targets ${t.domainName}; refusing ambiguous removal`);if(c&&String(c.TargetOriginId)!==t.id)throw Error(`Path ${t.pathPattern} no longer targets ${t.id}; refusing ambiguous removal`);if(!c)return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!1,applied:!1,originRemoved:!1,etag:s};let g=a.filter((l)=>String(l.PathPattern)!==t.pathPattern),m=String(r.DefaultCacheBehavior?.TargetOriginId)===t.id||g.some((l)=>String(l.TargetOriginId)===t.id),d=m?o:o.filter((l)=>String(l.Id)!==t.id);if(t.dryRun)return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!0,applied:!1,originRemoved:!m&&!!u,etag:s};r.Origins={Quantity:d.length,Items:{Origin:d}},r.CacheBehaviors={Quantity:g.length,...g.length?{Items:{CacheBehavior:g}}:{}};let h=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:this.buildDistributionConfigXml(r),headers:{"Content-Type":"application/xml","If-Match":s}});return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!0,applied:!0,originRemoved:!m&&!!u,etag:h.ETag||h.headers?.etag||""}}async createInvalidation(e){let i=e.callerReference||Date.now().toString(),t=`<?xml version="1.0" encoding="UTF-8"?>
-<InvalidationBatch>
-  <Paths>
-    <Quantity>${e.paths.length}</Quantity>
-    <Items>
-      ${e.paths.map((s)=>`<Path>${s}</Path>`).join(`
-      `)}
-    </Items>
-  </Paths>
-  <CallerReference>${i}</CallerReference>
-</InvalidationBatch>`,n=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:`/2020-05-31/distribution/${e.distributionId}/invalidation`,body:t,headers:{"Content-Type":"application/xml"}});return{Id:n.Id||n.Invalidation?.Id,Status:n.Status||n.Invalidation?.Status||"InProgress",CreateTime:n.CreateTime||n.Invalidation?.CreateTime||new Date().toISOString()}}async getInvalidation(e,i){let t=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/invalidation/${i}`});return{Id:t.Id||t.Invalidation?.Id,Status:t.Status||t.Invalidation?.Status,CreateTime:t.CreateTime||t.Invalidation?.CreateTime}}async listInvalidations(e){let i=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/invalidation`}),t=[];if(i.InvalidationSummary){let n=Array.isArray(i.InvalidationSummary)?i.InvalidationSummary:[i.InvalidationSummary];t.push(...n.map((s)=>({Id:s.Id,Status:s.Status,CreateTime:s.CreateTime})))}return t}async waitForInvalidation(e,i){let n=0;while(n<60){if((await this.getInvalidation(e,i)).Status==="Completed")return;await new Promise((r)=>setTimeout(r,5000)),n++}throw Error(`Timeout waiting for invalidation ${i} to complete`)}async listDistributions(){let e=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/distribution"}),i=[],n=(e.DistributionList||e).Items,s=[];if(Array.isArray(n))s=n;else if(n?.DistributionSummary)s=Array.isArray(n.DistributionSummary)?n.DistributionSummary:[n.DistributionSummary];return i.push(...s.map((r)=>({Id:r.Id,ARN:r.ARN,Status:r.Status,DomainName:r.DomainName,Aliases:r.Aliases||void 0,Enabled:r.Enabled==="true"||r.Enabled===!0}))),i}async getDistribution(e){let i=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}`}),t=i.Distribution||i;return{Id:t.Id,ARN:t.ARN,Status:t.Status,DomainName:t.DomainName,Aliases:t.DistributionConfig?.Aliases?.Items||t.Aliases?.Items||[],Enabled:t.DistributionConfig?.Enabled==="true"||t.DistributionConfig?.Enabled===!0}}async getDistributionConfig(e){let i=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`});return{ETag:i.ETag||"",DistributionConfig:i.DistributionConfig||i}}async invalidateAll(e){return this.createInvalidation({distributionId:e,paths:["/*"]})}async invalidatePaths(e,i){let t=i.map((n)=>n.startsWith("/")?n:`/${n}`);return this.createInvalidation({distributionId:e,paths:t})}async invalidatePattern(e,i){let t=i.startsWith("/")?i:`/${i}`;return this.createInvalidation({distributionId:e,paths:[t]})}async invalidateAfterDeployment(e){let{distributionId:i,changedPaths:t,invalidateAll:n=!1,wait:s=!1}=e,r;if(n||!t||t.length===0)r=await this.invalidateAll(i);else r=await this.invalidatePaths(i,t);if(s)await this.waitForInvalidation(i,r.Id);return{invalidationId:r.Id,status:r.Status}}async findDistributionByDomain(e){return(await this.listDistributions()).find((n)=>{if(n.DomainName===e)return!0;if(n.Aliases?.Items&&n.Aliases.Items.includes(e))return!0;return!1})||null}async batchInvalidate(e,i=["/*"]){return await Promise.all(e.map(async(n)=>{let s=await this.createInvalidation({distributionId:n,paths:i});return{distributionId:n,invalidationId:s.Id,status:s.Status}}))}async updateCustomErrorResponses(e){let{distributionId:i,customErrorResponses:t}=e,n=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${i}/config`,returnHeaders:!0}),s=n.headers?.etag||n.headers?.ETag||"",r=n.body?.DistributionConfig||(n.body?.Enabled!==void 0?n.body:void 0)||n.DistributionConfig;if(!r||r.Enabled===void 0)throw Error("Failed to get current distribution config");if(t.length===0)r.CustomErrorResponses={Quantity:0};else r.CustomErrorResponses={Quantity:t.length,Items:{CustomErrorResponse:t.map((c)=>({ErrorCode:c.errorCode,...c.responsePagePath&&{ResponsePagePath:c.responsePagePath},...c.responseCode&&{ResponseCode:c.responseCode},...c.errorCachingMinTTL!==void 0&&{ErrorCachingMinTTL:c.errorCachingMinTTL}}))}};let o=this.buildDistributionConfigXml(r),a=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${i}/config`,body:o,headers:{"Content-Type":"application/xml","If-Match":s}}),u=a.Distribution||a;return{Distribution:{Id:u.Id,ARN:u.ARN,Status:u.Status,DomainName:u.DomainName,Aliases:u.DistributionConfig?.Aliases?.Items||[],Enabled:u.DistributionConfig?.Enabled==="true"||u.DistributionConfig?.Enabled===!0},ETag:a.ETag||""}}async removeCustomErrorResponses(e){return this.updateCustomErrorResponses({distributionId:e,customErrorResponses:[]})}async updateDistribution(e){let{distributionId:i,aliases:t,certificateArn:n,comment:s}=e,r=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${i}/config`,returnHeaders:!0}),o=r.headers?.etag||r.headers?.ETag||"",a=r.body?.DistributionConfig||(r.body?.Enabled!==void 0?r.body:void 0)||r.DistributionConfig;if(!a||a.Enabled===void 0)throw Error("Failed to get current distribution config");if(t&&t.length>0)a.Aliases={Quantity:t.length,Items:{Item:t}};if(n)a.ViewerCertificate={ACMCertificateArn:n,SSLSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021",CertificateSource:"acm"};if(s)a.Comment=s;let u=this.buildDistributionConfigXml(a),c=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${i}/config`,body:u,headers:{"Content-Type":"application/xml","If-Match":o}}),g=c.Distribution||c;return{Distribution:{Id:g.Id,ARN:g.ARN,Status:g.Status,DomainName:g.DomainName,Aliases:t?{Quantity:t.length,Items:t}:{Quantity:0,Items:[]},Enabled:g.DistributionConfig?.Enabled==="true"||g.DistributionConfig?.Enabled===!0},ETag:c.ETag||""}}buildDistributionConfigXml(e){let i=(r)=>r.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&apos;"),t={Items:"",Methods:"Method",Headers:"Name",Cookies:"Name",QueryStringCacheKeys:"Name",TrustedKeyGroups:"KeyGroup",TrustedSigners:"AwsAccountNumber",LambdaFunctionAssociations:"LambdaFunctionAssociation",FunctionAssociations:"FunctionAssociation",CacheBehaviors:"CacheBehavior",CustomErrorResponses:"CustomErrorResponse",GeoRestriction:"Location"},n={Origins:"Origin",Aliases:"CNAME",AllowedMethods:"Method",CachedMethods:"Method",CustomErrorResponses:"CustomErrorResponse",CacheBehaviors:"CacheBehavior"},s=(r,o,a="",u="")=>{if(o===null||o===void 0)return"";if(r.startsWith("@_")||r==="?xml")return"";if(typeof o==="boolean")return`${a}<${r}>${o}</${r}>
-`;if(typeof o==="number"||typeof o==="string")return`${a}<${r}>${i(String(o))}</${r}>
-`;if(Array.isArray(o)){let c=t[r]||r.replace(/s$/,"");return o.map((g)=>s(c,g,a,r)).join("")}if(typeof o==="object"){if(r==="Items"){let g=n[u]||"",m=Object.keys(o).filter((d)=>!d.startsWith("@_"));if(m.length===1&&!Array.isArray(o[m[0]])){let d=m[0],h=o[d];if(typeof h==="string")return`${a}<Items>
-${a}  <${d}>${i(h)}</${d}>
-${a}</Items>
-`;else if(typeof h==="object"&&!Array.isArray(h))return`${a}<Items>
-${s(d,h,a+"  ",r)}${a}</Items>
-`}if(m.length===1&&Array.isArray(o[m[0]])){let d=m[0],h=o[d],l="";for(let y of h)if(typeof y==="string")l+=`${a}  <${d}>${i(y)}</${d}>
-`;else l+=s(d,y,a+"  ",r);return`${a}<Items>
-${l}${a}</Items>
-`}if(Array.isArray(o)){let d="",h=g||"Item";for(let l of o)if(typeof l==="string")d+=`${a}  <${h}>${i(l)}</${h}>
-`;else d+=s(h,l,a+"  ",r);return`${a}<Items>
-${d}${a}</Items>
-`}}let c="";for(let[g,m]of Object.entries(o))if(!g.startsWith("@_"))c+=s(g,m,a+"  ",r);if(c==="")return`${a}<${r}/>
-`;return`${a}<${r}>
-${c}${a}</${r}>
-`}return""};return`<?xml version="1.0" encoding="UTF-8"?>
-<DistributionConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
-${Object.entries(e).filter(([r])=>!r.startsWith("@_")).map(([r,o])=>s(r,o,"  ","DistributionConfig")).join("")}</DistributionConfig>`}async ensureDynamicHttpMethods(e){let i=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),t=i.headers?.etag||i.headers?.ETag||"",n=i.body?.DistributionConfig||i.DistributionConfig||i.body;if(!n)throw Error("Failed to get current distribution config");let s=!1,r=["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],o=(c)=>{if(!c)return[];let g=c.Items;if(!g)return[];if(Array.isArray(g))return g.map(String);if(typeof g==="object"&&g.Method){let m=g.Method;return Array.isArray(m)?m.map(String):[String(m)]}if(g.Item)return Array.isArray(g.Item)?g.Item.map(String):[String(g.Item)];return[]},a=n.DefaultCacheBehavior;if(a){if(!o(a.AllowedMethods).includes("POST"))a.AllowedMethods={Quantity:r.length,Items:{Method:r},CachedMethods:{Quantity:2,Items:{Method:["GET","HEAD"]}}},s=!0}if(!s)return!1;let u=this.buildDistributionConfigXml(n);return await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:u,headers:{"Content-Type":"application/xml","If-Match":t}}),!0}async addAliases(e,i,t){return this.updateDistribution({distributionId:e,aliases:i,certificateArn:t})}async createFunction(e){let{name:i,code:t,comment:n="",runtime:s="cloudfront-js-2.0"}=e,r=`<?xml version="1.0" encoding="UTF-8"?>
-<CreateFunctionRequest xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
-  <Name>${i}</Name>
-  <FunctionConfig>
-    <Comment>${n}</Comment>
-    <Runtime>${s}</Runtime>
-  </FunctionConfig>
-  <FunctionCode>${Buffer.from(t).toString("base64")}</FunctionCode>
-</CreateFunctionRequest>`,o=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/function",body:r,headers:{"Content-Type":"application/xml"}}),a=o.FunctionSummary||o;return{FunctionARN:a.FunctionMetadata?.FunctionARN||a.FunctionARN,Name:a.Name||i,Stage:a.FunctionMetadata?.Stage||"DEVELOPMENT",ETag:o.ETag||""}}async listFunctions(){let e=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/function"}),i=[],t=e.FunctionList?.Items?.FunctionSummary;if(t){let n=Array.isArray(t)?t:[t];for(let s of n)i.push({Name:s.Name,FunctionARN:s.FunctionMetadata?.FunctionARN,Stage:s.FunctionMetadata?.Stage,CreatedTime:s.FunctionMetadata?.CreatedTime,LastModifiedTime:s.FunctionMetadata?.LastModifiedTime})}return i}async getFunction(e,i="LIVE"){try{let t=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/function/${e}`,queryParams:{Stage:i},returnHeaders:!0}),n=t.body?.FunctionSummary||t.FunctionSummary||t.body||t;return{FunctionARN:n.FunctionMetadata?.FunctionARN,Name:n.Name||e,Stage:n.FunctionMetadata?.Stage||i,ETag:t.headers?.etag||t.ETag||"",FunctionCode:n.FunctionCode}}catch(t){if(t.message?.includes("404")||t.message?.includes("NoSuchFunctionExists"))return null;throw t}}async publishFunction(e,i){let t,n;if(typeof e==="object")t=e.Name,n=e.IfMatch;else t=e,n=i;if(!n){let o=await this.getFunction(t,"DEVELOPMENT");if(!o)throw Error(`Function ${t} not found`);n=o.ETag}let s=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:`/2020-05-31/function/${t}/publish`,headers:{"If-Match":n}}),r=s.FunctionSummary||s;return{FunctionARN:r.FunctionMetadata?.FunctionARN,Stage:r.FunctionMetadata?.Stage||"LIVE",FunctionSummary:r}}async describeFunction(e){let{Name:i,Stage:t="DEVELOPMENT"}=e,n=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/function/${i}/describe`,queryParams:{Stage:t},returnHeaders:!0});return{ETag:n.headers?.etag||n.ETag||"",FunctionSummary:n.body?.FunctionSummary||n.FunctionSummary||n.body||n}}async updateFunction(e){let{Name:i,FunctionCode:t,FunctionConfig:n,IfMatch:s}=e,r=`<?xml version="1.0" encoding="UTF-8"?>
-<UpdateFunctionRequest xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
-  <FunctionConfig>
-    <Comment>${n.Comment}</Comment>
-    <Runtime>${n.Runtime}</Runtime>
-  </FunctionConfig>
-  <FunctionCode>${Buffer.from(t).toString("base64")}</FunctionCode>
-</UpdateFunctionRequest>`,o=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/function/${i}`,body:r,headers:{"Content-Type":"application/xml","If-Match":s},returnHeaders:!0});return{ETag:o.headers?.etag||o.ETag||"",FunctionSummary:o.body?.FunctionSummary||o.FunctionSummary||o.body||o}}async deleteFunction(e,i){let t=i;if(!t){let n=await this.getFunction(e,"DEVELOPMENT");if(!n)return;t=n.ETag}await this.client.request({service:"cloudfront",region:"us-east-1",method:"DELETE",path:`/2020-05-31/function/${e}`,headers:{"If-Match":t}})}async createIndexRewriteFunction(e){return this.createFunction({name:e,code:`function handler(event) {
-    const request = event.request;
-    var uri = request.uri;
-
-    // Check if the request is for a directory (ends with /)
-    if (uri.endsWith('/')) {
-        request.uri += 'index.html';
-    }
-    // Check if the request doesn't have a file extension
-    else if (!uri.includes('.')) {
-        // Add trailing slash to redirect to directory
-        request.uri += '/index.html';
-    }
-
-    return request;
-}`,comment:"Rewrite directory requests to index.html for S3 static sites",runtime:"cloudfront-js-2.0"})}async listOriginAccessControls(){let e=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/origin-access-control"}),i=[];if(e.OriginAccessControlList?.Items?.OriginAccessControlSummary){let t=Array.isArray(e.OriginAccessControlList.Items.OriginAccessControlSummary)?e.OriginAccessControlList.Items.OriginAccessControlSummary:[e.OriginAccessControlList.Items.OriginAccessControlSummary];i.push(...t.map((n)=>({Id:n.Id,Name:n.Name,Description:n.Description,SigningProtocol:n.SigningProtocol,SigningBehavior:n.SigningBehavior,OriginAccessControlOriginType:n.OriginAccessControlOriginType})))}return i}async createOriginAccessControl(e){let{name:i,description:t=`OAC for ${i}`,signingProtocol:n="sigv4",signingBehavior:s="always",originType:r="s3"}=e,o=`<?xml version="1.0" encoding="UTF-8"?>
-<OriginAccessControlConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
-  <Name>${i}</Name>
-  <Description>${t}</Description>
-  <SigningProtocol>${n}</SigningProtocol>
-  <SigningBehavior>${s}</SigningBehavior>
-  <OriginAccessControlOriginType>${r}</OriginAccessControlOriginType>
-</OriginAccessControlConfig>`,a=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/origin-access-control",body:o,headers:{"Content-Type":"application/xml"},returnHeaders:!0}),u=a.body?.OriginAccessControl||a.OriginAccessControl||a.body||a;return{Id:u.Id,Name:u.OriginAccessControlConfig?.Name||i,Description:u.OriginAccessControlConfig?.Description||t,SigningProtocol:u.OriginAccessControlConfig?.SigningProtocol||n,SigningBehavior:u.OriginAccessControlConfig?.SigningBehavior||s,OriginAccessControlOriginType:u.OriginAccessControlConfig?.OriginAccessControlOriginType||r,ETag:a.headers?.etag||a.ETag||""}}async findOrCreateOriginAccessControl(e,i="s3"){let n=(await this.listOriginAccessControls()).find((r)=>r.Name===e&&r.OriginAccessControlOriginType===i);if(n)return{Id:n.Id,Name:n.Name,isNew:!1};let s=await this.createOriginAccessControl({name:e,originType:i});return{Id:s.Id,Name:s.Name,isNew:!0}}async createDistributionForS3(e){let{bucketName:i,bucketRegion:t,originAccessControlId:n,aliases:s=[],certificateArn:r,defaultRootObject:o="index.html",comment:a=`Distribution for ${i}`,priceClass:u="PriceClass_100",enabled:c=!0,trustedKeyGroupIds:g=[],mediaDelivery:m=!1}=e,d=`S3-${i}`,h=`${i}.s3.${t}.amazonaws.com`,l=`${Date.now()}-${Math.random().toString(36).slice(2)}`,y=g.length>0?`<TrustedKeyGroups>
-      <Enabled>true</Enabled>
-      <Quantity>${g.length}</Quantity>
-      <Items>${g.map((E)=>`<KeyGroup>${E}</KeyGroup>`).join("")}</Items>
-    </TrustedKeyGroups>`:"<TrustedKeyGroups><Enabled>false</Enabled><Quantity>0</Quantity></TrustedKeyGroups>",C="<Aliases><Quantity>0</Quantity></Aliases>";if(s.length>0)C=`<Aliases>
-    <Quantity>${s.length}</Quantity>
-    <Items>
-      ${s.map((E)=>`<CNAME>${E}</CNAME>`).join(`
-      `)}
-    </Items>
-  </Aliases>`;let f=`<ViewerCertificate>
-    <CloudFrontDefaultCertificate>true</CloudFrontDefaultCertificate>
-  </ViewerCertificate>`;if(r&&s.length>0)f=`<ViewerCertificate>
-    <ACMCertificateArn>${r}</ACMCertificateArn>
-    <SSLSupportMethod>sni-only</SSLSupportMethod>
-    <MinimumProtocolVersion>TLSv1.2_2021</MinimumProtocolVersion>
-    <CertificateSource>acm</CertificateSource>
-  </ViewerCertificate>`;let I=`<?xml version="1.0" encoding="UTF-8"?>
-<DistributionConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
-  <CallerReference>${l}</CallerReference>
-  <Comment>${a}</Comment>
-  <DefaultRootObject>${o}</DefaultRootObject>
-  <Origins>
-    <Quantity>1</Quantity>
-    <Items>
-      <Origin>
-        <Id>${d}</Id>
-        <DomainName>${h}</DomainName>
-        <OriginPath></OriginPath>
-        <S3OriginConfig>
-          <OriginAccessIdentity></OriginAccessIdentity>
-        </S3OriginConfig>
-        <OriginAccessControlId>${n}</OriginAccessControlId>
-      </Origin>
-    </Items>
-  </Origins>
-  <DefaultCacheBehavior>
-    <TargetOriginId>${d}</TargetOriginId>
-    <ViewerProtocolPolicy>redirect-to-https</ViewerProtocolPolicy>
-    <AllowedMethods>
-      <Quantity>2</Quantity>
-      <Items>
-        <Method>GET</Method>
-        <Method>HEAD</Method>
-      </Items>
-      <CachedMethods>
-        <Quantity>2</Quantity>
-        <Items>
-          <Method>GET</Method>
-          <Method>HEAD</Method>
-        </Items>
-      </CachedMethods>
-    </AllowedMethods>
-    <Compress>true</Compress>
-    <CachePolicyId>658327ea-f89d-4fab-a63d-7e88639e58f6</CachePolicyId>
-    ${y}
-  </DefaultCacheBehavior>
-  ${C}
-  ${f}
-  <PriceClass>${u}</PriceClass>
-  <Enabled>${c}</Enabled>
-  <HttpVersion>http2and3</HttpVersion>
-  <IsIPV6Enabled>true</IsIPV6Enabled>
-  ${m?"<CustomErrorResponses><Quantity>0</Quantity></CustomErrorResponses>":`<CustomErrorResponses>
-    <Quantity>1</Quantity>
-    <Items>
-      <CustomErrorResponse>
-        <ErrorCode>403</ErrorCode>
-        <ResponsePagePath>/index.html</ResponsePagePath>
-        <ResponseCode>200</ResponseCode>
-        <ErrorCachingMinTTL>300</ErrorCachingMinTTL>
-      </CustomErrorResponse>
-    </Items>
-  </CustomErrorResponses>`}
-</DistributionConfig>`,p=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/distribution",body:I,headers:{"Content-Type":"application/xml"},returnHeaders:!0}),b=p.body?.Distribution||p.Distribution||p.body||p;return{Id:b.Id,ARN:b.ARN,DomainName:b.DomainName,Status:b.Status,ETag:p.headers?.etag||p.ETag||""}}async createMediaDistributionForS3(e){return this.createDistributionForS3({...e,defaultRootObject:"",mediaDelivery:!0,comment:e.comment??`Media distribution for ${e.bucketName}`})}async listPublicKeys(){let e=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/public-key"});return this.collectionItems(e.PublicKeyList??e,"PublicKeySummary").map((t)=>({Id:String(t.Id),Name:String(t.Name),Comment:t.Comment?String(t.Comment):void 0}))}async createPublicKey(e){if(!/^[A-Za-z0-9_-]{1,128}$/.test(e.name))throw TypeError("CloudFront public key name is invalid");if(!e.encodedKey.includes("BEGIN PUBLIC KEY"))throw TypeError("CloudFront public key must be PEM encoded");let i=(s)=>s.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;"),t=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/public-key",headers:{"Content-Type":"application/xml"},body:`<PublicKeyConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/"><CallerReference>${i(e.callerReference??`${Date.now()}-${e.name}`)}</CallerReference><Name>${i(e.name)}</Name><EncodedKey>${i(e.encodedKey)}</EncodedKey><Comment>${i(e.comment??"")}</Comment></PublicKeyConfig>`}),n=t.PublicKey??t;return{Id:String(n.Id),Name:String(n.PublicKeyConfig?.Name??e.name),EncodedKey:String(n.PublicKeyConfig?.EncodedKey??e.encodedKey),Comment:String(n.PublicKeyConfig?.Comment??e.comment??"")}}async listKeyGroups(){let e=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/key-group"});return this.collectionItems(e.KeyGroupList??e,"KeyGroupSummary").map((t)=>({Id:String(t.KeyGroup?.Id??t.Id),Name:String(t.KeyGroup?.KeyGroupConfig?.Name??t.KeyGroupConfig?.Name??t.Name),Items:this.collectionItems(t.KeyGroup?.KeyGroupConfig?.Items??t.KeyGroupConfig?.Items??t.Items,"Item").map(String),Comment:t.KeyGroup?.KeyGroupConfig?.Comment??t.KeyGroupConfig?.Comment??t.Comment}))}async createKeyGroup(e){if(!/^[A-Za-z0-9_-]{1,128}$/.test(e.name))throw TypeError("CloudFront key group name is invalid");let i=[...new Set(e.publicKeyIds)];if(i.length===0)throw TypeError("CloudFront key group requires at least one public key");let t=(o)=>o.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;"),n=i.map((o)=>`<Item>${t(o)}</Item>`).join(""),s=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/key-group",headers:{"Content-Type":"application/xml"},body:`<KeyGroupConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/"><Name>${t(e.name)}</Name><Items>${n}</Items><Comment>${t(e.comment??"")}</Comment></KeyGroupConfig>`}),r=s.KeyGroup??s;return{Id:String(r.Id),Name:String(r.KeyGroupConfig?.Name??e.name),Items:i,Comment:String(r.KeyGroupConfig?.Comment??e.comment??"")}}static getS3BucketPolicyForCloudFront(e,i){return{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:`arn:aws:s3:::${e}/*`,Condition:{StringEquals:{"AWS:SourceArn":i}}}]}}async waitForDistributionDeployed(e,i=60){for(let t=0;t<i;t++){if((await this.getDistribution(e)).Status==="Deployed")return!0;await new Promise((s)=>setTimeout(s,30000))}return!1}async disableDistribution(e){let i=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),t=i.headers?.etag||i.headers?.ETag||"",n=i.body?.DistributionConfig||(i.body?.Enabled!==void 0?i.body:void 0)||i.DistributionConfig;if(!n||n.Enabled===void 0)throw Error("Failed to get current distribution config");n.Enabled=!1;let s=this.buildDistributionConfigXml(n),r=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:s,headers:{"Content-Type":"application/xml","If-Match":t},returnHeaders:!0});return{ETag:r.headers?.etag||r.headers?.ETag||r.ETag||""}}async deleteDistribution(e,i){let t=i||"";if(!t){let n=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}`,returnHeaders:!0});t=n.headers?.etag||n.headers?.ETag||""}await this.client.request({service:"cloudfront",region:"us-east-1",method:"DELETE",path:`/2020-05-31/distribution/${e}`,headers:{"If-Match":t}})}async waitForDistributionDisabled(e,i=60){for(let t=0;t<i;t++){let n=await this.getDistribution(e);if(n.Status==="Deployed"&&!n.Enabled)return!0;await new Promise((s)=>setTimeout(s,30000))}return!1}async removeAlias(e,i){let t=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),n=t.headers?.etag||t.headers?.ETag||"",s=t.body?.DistributionConfig||(t.body?.Enabled!==void 0?t.body:void 0)||t.DistributionConfig;if(!s||s.Enabled===void 0)throw Error("Failed to get current distribution config");let r=[];if(s.Aliases?.Items){if(Array.isArray(s.Aliases.Items))r=s.Aliases.Items;else if(typeof s.Aliases.Items==="object"){let c=s.Aliases.Items.CNAME;if(typeof c==="string")r=[c];else if(Array.isArray(c))r=c}}if(r.length===0)throw Error("Distribution has no aliases to remove");let o=r.filter((c)=>c!==i);if(o.length===r.length)throw Error(`Alias ${i} not found in distribution`);if(s.Aliases.Quantity=o.length,s.Aliases.Items=o.length>0?o:void 0,o.length===0)s.ViewerCertificate={CloudFrontDefaultCertificate:!0,MinimumProtocolVersion:"TLSv1.2_2021"};let a=this.buildDistributionConfigXml(s),u=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:a,headers:{"Content-Type":"application/xml","If-Match":n},returnHeaders:!0});return{ETag:u.headers?.etag||u.headers?.ETag||u.ETag||""}}}
-export{A as Uf};

package/dist/chunk-n1hg0jxs.js

@@ -1,2 +0,0 @@
-import{ho as h,io as y}from"./chunk-r8t25tbm.js";function P(t,s){return`/var/www/${t}-${s}`}var v=new Set(["laravel","php","statamic","wordpress"]);function g(t){return t.type!=null&&v.has(t.type)}function b(t){let s=t.proxyTo;if(s==null)return[];return(Array.isArray(s)?s:[s]).map((n)=>String(n).trim()).filter((n)=>n.length>0)}function x(t){return b(t).length>0}function S(t){if(t.deploy)return t.deploy;if(g(t))return"server";if(t.start)return"server";return"bucket"}function l(t){if(t.redirect)return"redirect";if(x(t))return"proxy";if(g(t))return"server-php";if(S(t)==="bucket")return"bucket";return t.start?"server-app":"server-static"}function C(t){return t.infrastructure?.compute!=null||Boolean(t.cloud?.attachTo?.trim())}function T(t,s={}){let r=[],n=[],a=t.sites||{},p=C(t),f=y(t);if(f)r.push(f);let d=new Map;for(let[o,e]of Object.entries(a)){if(!e)continue;let m=S(e),c=l(e);if(c==="redirect"){if(!e.domain)r.push(`Site '${o}' is a redirect site but has no \`domain\` to redirect from.`);if(!(typeof e.redirect==="string"?e.redirect:e.redirect?.to))r.push(`Site '${o}' is a redirect site but has no redirect target (\`redirect\` / \`redirect.to\`).`);if(!p)r.push(`Site '${o}' is a redirect site but no \`infrastructure.compute\` is configured to host the gateway that serves the redirect.`);let u=[];if(e.start)u.push("start");if(e.root)u.push("root");if(e.proxyTo)u.push("proxyTo");if(u.length>0)n.push(`Site '${o}' is a redirect site but also sets ${u.join(", ")}. These are ignored.`);continue}if(c==="proxy"){if(!e.domain)r.push(`Site '${o}' is a proxy site but has no \`domain\` to route from.`);if(!p)r.push(`Site '${o}' is a proxy site but no \`infrastructure.compute\` is configured to host the gateway that forwards it.`);let i=[];if(e.start)i.push("start");if(e.root)i.push("root");if(typeof e.port==="number")i.push("port");if(e.build)i.push("build");if(e.preStart&&e.preStart.length>0)i.push("preStart");if(i.length>0)n.push(`Site '${o}' sets \`proxyTo\`, so ts-cloud ships and supervises nothing for it. ${i.join(", ")} ${i.length===1?"is":"are"} ignored — remove ${i.length===1?"it":"them"}, or drop \`proxyTo\` to let ts-cloud own the service.`);continue}if(m==="server"&&!e.start&&!e.root){r.push(`Site '${o}' sets deploy:'server' but declares neither \`start\` (dynamic app) nor \`root\` (static site to serve). Add one.`);continue}if(c==="server-php"){if(!p)r.push(`Site '${o}' is a PHP site (type:'${e.type}') but no \`infrastructure.compute\` is configured. Add a server (infrastructure.compute) with PHP provisioning.`);if(!e.repository?.url)r.push(`Site '${o}' is a PHP site (type:'${e.type}') but has no \`repository.url\` to clone. PHP sites deploy via git.`)}else if(c==="server-app"){if(!p)r.push(`Site '${o}' deploys to a server (deploy:'server'${e.deploy?"":" inferred from `start`"}) but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`);if(typeof e.port==="number"){let i=s.occupiedPorts?.get(e.port);if(i)r.push(`Site '${o}' wants port ${e.port}, which project '${i}' already serves on this box. Attached projects share one port namespace. Give '${o}' a free port, or let the attach allocate one.`);let u=d.get(e.port);if(u)r.push(`Sites '${u}' and '${o}' both use port ${e.port}. Server apps sharing a box must use distinct ports.`);else d.set(e.port,o)}}else if(c==="server-static"){if(!e.root)r.push(`Site '${o}' is a server static site (deploy:'server', no \`start\`) but has no \`root\` directory to serve.`);if(!p)r.push(`Site '${o}' deploys to a server (deploy:'server') but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`)}else{if(!e.root)r.push(`Site '${o}' deploys to a bucket but has no \`root\` directory to upload.`);let i=[];if(e.start)i.push("start");if(typeof e.port==="number")i.push("port");if(e.preStart&&e.preStart.length>0)i.push("preStart");if(i.length>0)n.push(`Site '${o}' deploys to a bucket but sets server-only field(s): ${i.join(", ")}. These are ignored. Set deploy:'server' to use them.`)}}return{errors:r,warnings:n}}function k(t){let s=l(t);return s!=="bucket"&&s!=="redirect"&&s!=="proxy"}function D(t){return l(t)==="bucket"}function j(t,s){if(h(t)==="serverless")return!0;let r=Object.entries(t.sites??{}).filter(([,a])=>a!=null),n=s?r.filter(([a])=>a===s):r;if(n.length===0)return!0;return!n.every(([,a])=>{let p=l(a);return p==="redirect"||p==="proxy"})}
-export{P as vk,g as wk,b as xk,x as yk,S as zk,l as Ak,C as Bk,T as Ck,k as Dk,D as Ek,j as Fk};

package/dist/chunk-n5xmh0ma.js

@@ -1,37 +0,0 @@
-var u={mode:"detection",paranoiaLevel:1,inboundThreshold:5,outboundThreshold:4,maxBodyBytes:13107200,rejectOversizedBody:!0,auditLogPath:"/var/log/ts-cloud/waf-audit.log",blockStatus:403},p={bypassBase:1e5,exclusionBase:101000,rateLimitBase:102000,customBase:109000};function l(e){return e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"").replace(/[\r\n]+/g," ")}function g(e){if(e.length>1000)return!1;if(/\([^)]*[+*]\)[+*]/.test(e))return!1;if(/\[[^\]]*\][+*]\{/.test(e))return!1;try{return new RegExp(e),!0}catch{return!1}}function S(e,r){let t=[],o=[],s=r;for(let n of e){if(n.enabled===!1)continue;if(n.key&&(n.key.source==="cookie"||n.key.source==="header")&&!n.key.name){o.push({ruleId:n.id,reason:"The rule keys on a header or cookie but names none."});continue}let d=n.path?R(n.path):".*";if(!g(d)){o.push({ruleId:n.id,reason:"The path pattern compiles to an unsafe regular expression."});continue}let c=[`SecRule REQUEST_URI "@rx ${l(d)}"`];if(n.methods?.length)c.push(`  "chain,id:${s},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${l(n.id)}'"`);else c.push(`  "id:${s},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${l(n.id)}'"`);if(t.push(`# Marks requests governed by the ts-cloud rate limit "${l(n.id)}".`),t.push(c.join(" \\\n")),n.methods?.length)t.push(`  SecRule REQUEST_METHOD "@within ${l(n.methods.join(" ").toUpperCase())}" "t:none"`);t.push(""),s++}return{lines:t,unmapped:o}}function R(e){return`^${e.replace(/[.+^${}()|[\]\\]/g,"\\$&").replace(/\*\*/g,"\x01").replace(/\*/g,"[^/]*").replace(/\u0001/g,".*")}$`}function v(e={},r=[]){let t=e.mode??u.mode,o=[],s=e.paranoiaLevel??u.paranoiaLevel,n=e.inboundThreshold??u.inboundThreshold,d=e.outboundThreshold??u.outboundThreshold,c=e.maxBodyBytes??u.maxBodyBytes,m=e.rejectOversizedBody!==!1;if(t==="blocking"&&s>=3)o.push(`Paranoia level ${s} blocks legitimate traffic on most applications until it is tuned. Run it in detection mode first.`);if(t==="blocking")o.push("zig-waf is pre-alpha. Blocking mode makes it a failure path for every request.");if(!m)o.push("Oversized bodies are passed through uninspected, so padding a request bypasses every rule.");if(e.bypassPaths?.length)o.push(`${e.bypassPaths.length} path(s) bypass inspection entirely.`);let i=["# Managed by ts-cloud. Edits are overwritten on the next deploy.",`# Mode: ${t}. Paranoia level: ${s}.`,""];if(t==="off")return i.push("SecRuleEngine Off",""),{config:`${i.join(`
-`)}
-`,unmappedRateLimits:[],warnings:o,mode:t};i.push(`SecRuleEngine ${t==="blocking"?"On":"DetectionOnly"}`,"SecRequestBodyAccess On","SecResponseBodyAccess Off",`SecRequestBodyLimit ${c}`,`SecRequestBodyNoFilesLimit ${Math.min(c,131072)}`,`SecRequestBodyLimitAction ${m?"Reject":"ProcessPartial"}`,"SecRequestBodyInMemoryLimit 131072",`SecAuditEngine ${t==="blocking"?"RelevantOnly":"On"}`,"SecAuditLogParts ABIJDEFHZ",`SecAuditLog ${l(e.auditLogPath??u.auditLogPath)}`,"SecAuditLogType Serial",`SecDefaultAction "phase:1,log,auditlog,${t==="blocking"?`deny,status:${e.blockStatus??u.blockStatus}`:"pass"}"`,"","# CRS anomaly scoring setup.",`SecAction "id:900000,phase:1,pass,nolog,t:none,setvar:tx.paranoia_level=${s}"`,`SecAction "id:900001,phase:1,pass,nolog,t:none,setvar:tx.inbound_anomaly_score_threshold=${n}"`,`SecAction "id:900002,phase:1,pass,nolog,t:none,setvar:tx.outbound_anomaly_score_threshold=${d}"`,'SecAction "id:900003,phase:1,pass,nolog,t:none,setvar:tx.critical_anomaly_score=5,setvar:tx.error_anomaly_score=4,setvar:tx.warning_anomaly_score=3,setvar:tx.notice_anomaly_score=2"','SecAction "id:900004,phase:1,pass,nolog,t:none,setvar:tx.anomaly_score=0"',"");let f=p.bypassBase;for(let a of e.bypassPaths??[]){let x=R(a);if(!g(x)){o.push(`Bypass path "${a}" was dropped: it compiles to an unsafe regular expression.`);continue}i.push(`# Inspection bypass for ${l(a)}. Every bypass is an unguarded route.`,`SecRule REQUEST_URI "@rx ${l(x)}" "id:${f},phase:1,pass,nolog,ctl:ruleEngine=Off"`,""),f++}let y=p.exclusionBase;for(let a of e.exclusions??[]){if(!Number.isInteger(a.ruleId)||a.ruleId<=0){o.push(`Exclusion with rule id "${a.ruleId}" was dropped: the id is not a positive integer.`);continue}if(i.push(`# ${l(a.reason)}`),a.pathPattern){if(!g(a.pathPattern)){o.push(`Exclusion for rule ${a.ruleId} was dropped: its path pattern is unsafe.`);continue}i.push(`SecRule REQUEST_URI "@rx ${l(a.pathPattern)}" "id:${y},phase:1,pass,nolog,ctl:ruleRemoveById=${a.ruleId}"`),y++}else i.push(`SecRuleRemoveById ${a.ruleId}`);i.push("")}let h=S(r,p.rateLimitBase);if(h.lines.length>0)i.push("# Rate-limit route markers. SecLang has no counters, so the tag is set","# here and the counting stays in the ts-cloud limiter.",...h.lines);let b=p.customBase;for(let a of e.customRules??[])i.push(`# Operator-supplied rule ${b}.`,a.trim(),""),b++;if(t==="blocking")i.push("# Blocking decision: one rule, at the end, on the accumulated score.",`SecRule TX:ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" "id:949110,phase:2,deny,status:${e.blockStatus??u.blockStatus},log,msg:'Inbound anomaly score exceeded (total: %{tx.anomaly_score})'"`,"");return{config:`${i.join(`
-`)}
-`,unmappedRateLimits:h.unmapped,warnings:o,mode:t}}function I(e={},r=[],t={}){let o=t.binary??"/usr/local/bin/zig-waf",s=t.configPath??"/etc/ts-cloud/waf.conf",n=v(e,r);return`#!/usr/bin/env bash
-# Managed by ts-cloud. Installs the zig-waf ruleset.
-set -euo pipefail
-
-if [ ! -x "${o}" ]; then
-  echo "ts-cloud: ${o} is not installed; skipping WAF configuration" >&2
-  exit 0
-fi
-
-install -d -m 0755 "$(dirname "${s}")"
-install -d -m 0750 /var/log/ts-cloud
-
-cat > "${s}.new" <<'WAF_EOF'
-${n.config}WAF_EOF
-
-# Compile the config before it goes live. A config that does not validate
-# would leave the engine with no rules while still reporting itself enabled.
-if ! "${o}" validate "${s}.new"; then
-  echo "ts-cloud: generated WAF config failed validation, keeping the previous one" >&2
-  rm -f "${s}.new"
-  exit 1
-fi
-
-if [ -f "${s}" ] && cmp -s "${s}.new" "${s}"; then
-  rm -f "${s}.new"
-  echo "ts-cloud: WAF config unchanged"
-  exit 0
-fi
-
-mv "${s}.new" "${s}"
-echo "ts-cloud: WAF config installed (mode: ${n.mode})"
-`}function _(e,r){return e.map((t)=>({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,kind:"event",source:"zig-waf",name:t.action==="blocked"?"waf.blocked":"waf.matched",timestamp:t.timestamp,value:1,host:t.host,pathTemplate:t.path,method:t.method,attributes:{ruleId:t.ruleId??null,anomalyScore:t.anomalyScore,action:t.action,messages:t.messages.slice(0,5)}}))}
-export{l as hj,g as ij,R as jj,v as kj,I as lj,_ as mj};

package/dist/chunk-q22qfwsc.js

@@ -1,22 +0,0 @@
-import{ok as g,rk as w,sk as y,tk as v}from"./chunk-7z50g5xz.js";function D(t){return t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function tt(t,e="/var/www"){let n=`${e}/${t}-`;return["set -u",`for TS_CLOUD_DIR in ${n}*; do`,'  [ -d "$TS_CLOUD_DIR" ] || continue','  [ -d "$TS_CLOUD_DIR/releases" ] || continue',`  TS_CLOUD_SITE="\${TS_CLOUD_DIR#${n}}"`,"  TS_CLOUD_ACTIVE=no",`  for TS_CLOUD_UNIT in $(ls /etc/systemd/system/ 2>/dev/null | grep -E "^${D(t)}-$TS_CLOUD_SITE[-@.]" || true); do`,'    systemctl is-active "$TS_CLOUD_UNIT" >/dev/null 2>&1 && TS_CLOUD_ACTIVE=yes',"  done",'  TS_CLOUD_SIZE="$(du -sh "$TS_CLOUD_DIR" 2>/dev/null | cut -f1)"','  echo "site:$TS_CLOUD_SITE:$TS_CLOUD_ACTIVE:${TS_CLOUD_SIZE:-?}"',"done","exit 0"]}function et(t){if(!t)return[];let e=[];for(let n of t.split(`
-`)){let r=n.trim();if(!r.startsWith("site:"))continue;let[,s,o,i]=r.split(":");if(!s||o!=="no")continue;e.push({name:s,size:i||"?"})}return e}function nt(t,e,n){let r=t.map((o)=>`  ${e}-${o.name} (${o.size})`).join(`
-`),s=t.length===1?"it":"them";return`This server still holds ${t.length} site tree${t.length===1?"":"s"} with nothing running for ${s}:
-${r}
-`+"A site moved off this box keeps its files here on purpose — they are the rollback, and they are what makes "+`the move reversible until this server is destroyed. Destroying it now discards that.
-Verify the site is serving from its new home first, then re-run with ${n} to destroy it anyway.`}var R="ts-cloud/project",T="ts-cloud/environment",E="ts-cloud/role";function d(t){return typeof t==="string"&&t.trim()?t.trim():void 0}function m(t){if(typeof t==="string")return d(t);if(t&&typeof t==="object")return d(t.name);return}function ot(t){let e={};for(let[n,r]of Object.entries(t?.labels??{}))if(typeof r==="string")e[n]=r;return{id:String(t?.id??""),name:d(t?.name)??"(unnamed)",status:d(t?.status)??"unknown",ipv4:d(t?.public_net?.ipv4?.ip)??d(t?.ipv4),ipv6:d(t?.public_net?.ipv6?.ip)??d(t?.ipv6),type:d(t?.server_type?.name)??d(t?.type),location:m(t?.location)??m(t?.datacenter?.location)??m(t?.datacenter),labels:e,project:d(e[R]),environment:d(e[T]),role:d(e[E])}}function _(t){return t.slug?.trim()||"app"}function j(t){let e=[];for(let n of t){let r=_(n);for(let s of n.proxies??[]){let o=d(s?.to);if(!o)continue;e.push({slug:r,host:o,path:d(s?.path)??"/",...I(s)})}}return e.sort((n,r)=>n.slug.localeCompare(r.slug)||n.host.localeCompare(r.host)||n.path.localeCompare(r.path))}function I(t){let e=t?.from;if(typeof e==="string"&&e.trim())return{target:e.trim(),kind:"app"};if(Array.isArray(e)&&e.length>0)return{target:e.filter((s)=>typeof s==="string").join(", "),kind:"app"};let n=t?.static;if(typeof n==="string"&&n.trim())return{target:n.trim(),kind:"static"};if(n&&typeof n==="object"&&d(n.dir))return{target:d(n.dir),kind:"static"};let r=typeof t?.redirect==="string"?d(t.redirect):d(t?.redirect?.to);if(r)return{target:r,kind:"redirect"};return{target:"(no upstream)",kind:"unknown"}}function H(t){let e=new Map;for(let n of t){let r=e.get(n.slug);if(r)r.push(n);else e.set(n.slug,[n])}return[...e.entries()].map(([n,r])=>({slug:n,routes:r})).sort((n,r)=>r.routes.length-n.routes.length||n.slug.localeCompare(r.slug))}async function st(t,e,n=g){if(!t.ipv4)return{server:t.name,routes:[],unavailable:"no public IPv4 address to reach it on"};if(t.status!=="running")return{server:t.name,ip:t.ipv4,routes:[],unavailable:`server is ${t.status}`};try{let r=await e(t.ipv4,y(n));if(r.code!==0){let s=r.stderr.trim().split(`
-`)[0]||`remote command exited ${r.code}`;return{server:t.name,ip:t.ipv4,routes:[],unavailable:s}}return{server:t.name,ip:t.ipv4,routes:j(v(r.stdout))}}catch(r){let s=r instanceof Error?r.message.split(`
-`)[0]:String(r);return{server:t.name,ip:t.ipv4,routes:[],unavailable:s}}}function u(t,e){let n=e==="/"?"/":e.replace(/\/+$/,"");return`${t.toLowerCase()}${n||"/"}`}function at(t,e,n){let r=new Set(e.filter((a)=>a.slug===n).map((a)=>u(a.host,a.path))),s=[],o=[],i=[];for(let a of t)if(a.loopbackOnly)i.push(a);else if(a.domain&&r.has(u(a.domain,a.path)))s.push(a);else o.push(a);return{present:s,absent:o,loopback:i,foreign:e.filter((a)=>a.slug!==n)}}function A(t,e,n){let r=new Set;for(let s of e)for(let o of s.routes)if(o.slug===n)r.add(u(o.host,o.path));return t.filter((s)=>!s.loopbackOnly&&s.domain!==void 0&&!r.has(u(s.domain,s.path)))}function ct(t){let{slug:e,servers:n,probes:r,declared:s}=t,o=[];if(o.push(n.length===0?"No servers found.":`${n.length} server${n.length===1?"":"s"}:`),n.length>0)o.push("");let i=new Map(r.map((a)=>[a.server,a]));for(let a of n){let p=[a.ipv4,a.type,a.location,a.status].filter(Boolean);o.push(`  ${a.name}  ${p.join("  ")}`),o.push(`    ${L(a)}`);let c=i.get(a.name);if(!c)o.push("    not probed, so co-tenants on this box are not listed");else if(c.unavailable)o.push(`    could not read ${g}: ${c.unavailable}`);else o.push(...U(c,e));o.push("")}return o.push(...M(t)),o}function L(t){if(!t.project)return"no ts-cloud labels: provisioned outside ts-cloud, or by a version that did not label boxes";let e=[t.environment,t.role&&`role ${t.role}`].filter(Boolean).join(", ");return`owned by '${t.project}'${e?` (${e})`:""}`}function U(t,e){let n=H(t.routes);if(n.length===0)return[`    serves nothing: ${g} is empty or absent`];let r=[`    serves ${t.routes.length} route${t.routes.length===1?"":"s"} for ${n.length} project${n.length===1?"":"s"}:`];for(let s of n){r.push(`      ${s.slug}${s.slug===e?" (this project)":""}`);for(let o of s.routes)r.push(`        ${o.host}${o.path==="/"?"/":o.path}  ->  ${N(o)}`)}return r}function N(t){if(t.kind==="redirect")return`redirect to ${t.target}`;if(t.kind==="static")return`static ${t.target}`;return t.target}function M(t){let{slug:e,declared:n,probes:r,servers:s}=t;if(n.length===0)return[`This project ('${e}') declares no sites.`];let o=[`This project ('${e}') declares ${n.length} site${n.length===1?"":"s"}: `+n.map((c)=>c.name).join(", ")],i=n.filter((c)=>c.loopbackOnly);if(i.length>0)o.push(`  ${i.length} with no domain, so the gateway never routes ${i.length===1?"it":"them"} (reached through another site's proxy): ${i.map((c)=>c.name).join(", ")}`);let a=r.filter((c)=>!c.unavailable);if(a.length===0)return o.push("  Nothing to reconcile them against: no box reported what it serves."),o;let p=A(n,a,e);if(o.push(`  ${n.length-i.length-p.length} routed by a box above`),p.length>0){o.push(`  ${p.length} not routed by any box above: ${p.map((C)=>C.name).join(", ")}`);let c=r.length-a.length,f=s.length-r.length;if(c>0)o.push(`    Either they were never deployed, or they are on one of the ${c} server${c===1?"":"s"} that could not be read.`);else if(f>0)o.push(`    Either they were never deployed, or they are on one of the ${f} server${f===1?"":"s"} this run did not probe.`);else o.push("    Either they were never deployed, or they are on a server this listing did not cover.")}return o}async function dt(t){let e=[];for(let n of t.steps)try{e.push({step:n,state:await n.satisfied()?"satisfied":"pending"})}catch(r){e.push({step:n,state:"unknown",reason:r instanceof Error?r.message:String(r)})}return e}function b(t){return t.filter((e)=>e.state!=="satisfied")}function z(t){return b(t).some((e)=>e.step.destructive===!0)}function pt(t,e){let n=b(e),r=[`${t.operation} ${t.target}`];if(n.length===0)return r.push("  Nothing to do — every step is already satisfied."),r;for(let{step:o,state:i,reason:a}of e){let p=i==="satisfied"?"ok  ":i==="unknown"?"?   ":"→   ",c=[o.destructive?"DESTRUCTIVE":"",i==="satisfied"?"already done":""].filter(Boolean);if(r.push(`  ${p}${o.title}${c.length>0?` [${c.join(", ")}]`:""}`),o.change)r.push(`        ${o.change.from} → ${o.change.to}`);if(a)r.push(`        could not check: ${a}`)}let s=n.filter((o)=>o.step.destructive).length;return r.push(`  ${n.length} step(s) would run`+(s>0?`, ${s} irreversible — re-run with --confirm ${t.target}`:"")),r}async function ut(t,e,n={}){let r={operation:t.operation,target:t.target,steps:[],success:!0};if(z(e)&&n.confirm!==t.target)throw Error(`${t.operation} includes an irreversible step. Re-run with --confirm ${t.target} to authorize it.`);for(let{step:s,state:o}of e){if(o==="satisfied"){r.steps.push({id:s.id,title:s.title,state:"skipped"}),n.log?.(`skip  ${s.title} (already done)`);continue}n.audit?.({operation:t.operation,target:t.target,step:s.id,state:"started"});try{await s.apply(),r.steps.push({id:s.id,title:s.title,state:"applied"}),n.log?.(`done  ${s.title}`),n.audit?.({operation:t.operation,target:t.target,step:s.id,state:"applied"})}catch(i){let a=i instanceof Error?i.message:String(i);return r.steps.push({id:s.id,title:s.title,state:"failed",error:a}),r.success=!1,n.log?.(`FAIL  ${s.title}: ${a}`),n.audit?.({operation:t.operation,target:t.target,step:s.id,state:"failed",error:a}),r}}return r}function B(t){if(t.length===0)throw Error("A server name cannot be empty.");if(t.length>253)throw Error(`'${t}' is longer than the 253 characters a hostname allows.`);for(let e of t.split(".")){if(e.length===0)throw Error(`'${t}' has an empty label — a hostname cannot contain '..'.`);if(e.length>63)throw Error(`'${e}' is longer than the 63 characters a hostname label allows.`);if(!/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(e))throw Error(`'${e}' is not a valid hostname label. Use letters, digits and hyphens, not starting or ending with a hyphen.`)}}async function ht(t,e,n){if(B(e),t===e)throw Error(`'${t}' is already named that.`);if((await n.takenNames()).some((o)=>o===e&&o!==t))throw Error(`'${e}' is already taken. Server names have to be unique within a provider project.`);let s=[];if(n.providerName&&n.renameProvider){let{providerName:o,renameProvider:i}=n;s.push({id:"provider",title:"Rename the server at the provider",change:{from:t,to:e},satisfied:async()=>await o()===e,apply:()=>i(e)})}if(n.stateName&&n.writeStateName){let{stateName:o,writeStateName:i}=n;s.push({id:"state-pin",title:"Update the recorded name in the local driver state",change:{from:t,to:e},satisfied:async()=>{let a=await o();return a===void 0||a===e},apply:()=>i(e)})}if(n.remoteHostname&&n.setRemoteHostname){let{remoteHostname:o,setRemoteHostname:i}=n;s.push({id:"hostname",title:"Set the hostname on the box",change:{from:t,to:e},satisfied:async()=>await o()===e,apply:()=>i(e)})}return s.push({id:"inventory",title:"Rename the fleet inventory record",change:{from:t,to:e},satisfied:async()=>n.inventoryName()===e,apply:async()=>{await n.renameInventory(e)}}),{operation:"server:rename",target:t,steps:s}}function ft(t){let e=`'${t.replace(/'/g,`'"'"'`)}'`;return["set -eu",'TS_CLOUD_OLD="$(hostname)"',`hostnamectl set-hostname ${e} 2>/dev/null || { echo ${e} > /etc/hostname && hostname ${e}; }`,'if grep -q "^127.0.1.1" /etc/hosts; then',`  TS_CLOUD_HOSTS="$(sed -E "s/^127\\.0\\.1\\.1.*/127.0.1.1\\t${t}/" /etc/hosts)"`,`  printf '%s\\n' "$TS_CLOUD_HOSTS" > /etc/hosts`,"else",`  printf '127.0.1.1\\t%s\\n' ${e} >> /etc/hosts`,"fi",'printf "%s -> %s\\n" "$TS_CLOUD_OLD" "$(hostname)"'].join(`
-`)}function yt(t,e,n){let r=e.trim();if(!r)return{problem:"No server named."};let[s,...o]=t.filter((c)=>c.name===r);if(s&&o.length===0)return{server:s};let i=t.filter((c)=>c.project===r);if(i.length>1&&n)i=i.filter((c)=>!c.environment||c.environment===n);let[a,...p]=i;if(a&&p.length===0)return{server:a};if(i.length>1)return{problem:`'${r}' owns ${i.length} servers (${i.map((c)=>c.name).join(", ")}). Name one of them, or narrow it by environment.`};return{problem:`No server matched '${r}'. Nothing is named that, and no box carries the label ts-cloud/project=${r}.`}}function vt(t,e){let n=[];if(!e.project)n.push(`'${e.name}' carries no ts-cloud/project label, so it is not a box ts-cloud provisioned. Attaching to it would deploy into a host nothing manages.`);else if(e.project===t)n.push(`This project's slug is '${t}', which is also the slug that owns '${e.name}'. A tenant deploy owns the gateway fragment named after its slug, so attaching would overwrite '${e.project}'s own fragment and take its sites down. Change this project's slug first.`);if(e.status!=="running")n.push(`'${e.name}' is ${e.status}, so what it serves could not be read.`);if(!e.ipv4)n.push(`'${e.name}' has no public IPv4 address, so it cannot be reached to check what it serves.`);return n}function S(t,e){let n=e==="/"?"/":e.replace(/\/+$/,"");return`${t.toLowerCase()}${n||"/"}`}function bt(t,e,n){let r=[],s=w(n.filter((i)=>i.kind==="app").map((i)=>({slug:i.slug,proxies:[{from:i.target.split(",").map((a)=>a.trim())}]})),{ignoreSlug:t}),o=new Map;for(let i of n)if(i.slug!==t)o.set(S(i.host,i.path),i.slug);for(let i of e){if(i.port!==void 0){let a=s.get(i.port);if(a)r.push({kind:"port",site:i.name,detail:`port ${i.port}`,heldBy:a})}if(i.domain){let a=o.get(S(i.domain,i.path));if(a)r.push({kind:"route",site:i.name,detail:`${i.domain}${i.path==="/"?"/":i.path}`,heldBy:a})}}return r}function St(t){return t.registryRead&&t.conflicts.length===0}function wt(t){let{slug:e,owner:n,server:r,declared:s,conflicts:o}=t,i=[];i.push(`Attach '${e}' to '${r.name}' (${r.ipv4??"no IPv4"}), owned by '${n}'.`,""),i.push(`  ${s.length} site${s.length===1?"":"s"} would deploy onto this box:`);for(let a of s){let p=a.loopbackOnly?`loopback only${a.port?` on :${a.port}`:""}`:`${a.domain}${a.path==="/"?"/":a.path}${a.port?` on :${a.port}`:""}`;i.push(`    ${a.name}  ${p}  ->  ${a.installBase??"(install path unresolved)"}`)}if(i.push(""),!t.registryRead)i.push(`  Could not read what '${r.name}' already serves: ${t.registryProblem??"unknown reason"}`),i.push("  So this attach is UNCHECKED: a port or hostname already taken by another"),i.push("  project would not error, it would serve that project's site from your domain.");else if(o.length>0){i.push(`  ${o.length} conflict${o.length===1?"":"s"} with what the box already serves:`);for(let a of o)i.push(`    site '${a.site}' wants ${a.detail}, held by '${a.heldBy}'`);i.push(""),i.push("  Two services on one port do not error: the kernel load-balances, and each"),i.push("  domain serves the other's site about half the time. Pick free ports and"),i.push("  hostnames, then re-run.")}else i.push(`  No conflicts with what '${r.name}' already serves.`);return i}function h(t,e){return`/tmp/ts-cloud-move-${t}-${e}.tar.gz`}function x(t,e){return`${t}-${e}*.service`}function l(t){return`'${t.split("'").join("'\\''")}'`}function W(t,e){return["set -eu",`for unit in $(ls /etc/systemd/system/ 2>/dev/null | grep -E ${l(k(t,e))} || true); do`,'  systemctl stop "$unit" 2>/dev/null || true',"done"].join(`
-`)}function k(t,e){return`^${t}-${e}-((queue|daemon)-.*|scheduler)\\.service$`}function F(t,e){return P(k(t,e))}function P(t){return[`ls /etc/systemd/system/ 2>/dev/null | grep -E ${l(t)} | while read -r unit; do`,'  systemctl is-active "$unit" >/dev/null 2>&1 && echo "active:$unit" || true',"done"].join(`
-`)}function V(t){return!t.split(`
-`).some((e)=>e.trim().startsWith("active:"))}function q(t,e,n){let r=h(t,e);return["set -eu",`test -d ${l(n)} || { echo "no site tree at ${n}" >&2; exit 1; }`,`rm -f ${l(r)}`,`tar czf ${l(r)} -C "$(dirname ${l(n)})" "$(basename ${l(n)})" -C /etc/systemd/system $(cd /etc/systemd/system && ls ${x(t,e)} 2>/dev/null | tr '\\n' ' ')`,`sha256sum ${l(r)} | cut -d' ' -f1`].join(`
-`)}function G(t,e,n){let r=h(t,e);return["set -eu",`test -f ${l(r)} || { echo "archive not staged at ${r}" >&2; exit 1; }`,`mkdir -p "$(dirname ${l(n)})"`,`tar xzf ${l(r)} -C "$(dirname ${l(n)})" "$(basename ${l(n)})"`,`tar xzf ${l(r)} -C /etc/systemd/system --wildcards ${l(x(t,e))} 2>/dev/null || true`,"systemctl daemon-reload",`systemctl enable ${t}-${e}.service 2>/dev/null || true`,`systemctl restart ${t}-${e}.service`,`rm -f ${l(r)}`].join(`
-`)}function K(t,e,n){return[`test -d ${l(n)} && echo tree:present || echo tree:absent`,`systemctl is-active ${t}-${e}.service >/dev/null 2>&1 && echo unit:active || echo unit:inactive`].join(`
-`)}function Z(t){return t.includes("tree:present")&&t.includes("unit:active")}function J(t,e="/",n=10){let r=`http://127.0.0.1:${t}${e.startsWith("/")?e:`/${e}`}`;return["set -eu",`for i in $(seq 1 ${n}); do`,`  if curl -fsS -o /dev/null --max-time 5 ${l(r)}; then echo healthy; exit 0; fi`,"  sleep 3","done",`echo "no healthy response from ${r}" >&2`,"exit 1"].join(`
-`)}function Q(t,e){return["set -eu",`for unit in $(ls /etc/systemd/system/ 2>/dev/null | grep -E ${l(O(t,e))} || true); do`,'  systemctl disable --now "$unit" 2>/dev/null || true',"done",`rm -f /etc/rpx/sites.d/${t}.json 2>/dev/null || true`,"systemctl reload rpx-gateway.service 2>/dev/null || systemctl restart rpx-gateway.service 2>/dev/null || true"].join(`
-`)}function O(t,e){return`^${t}-${e}[-@.]`}function X(t,e){return P(O(t,e))}function Y(t){return!t.split(`
-`).some((e)=>e.trim().startsWith("active:"))}function kt(t,e){return`/tmp/ts-cloud-move-${t}-${e}-certs.tar.gz`}function Pt(t,e){return["set -u",...e.map((n)=>`if [ -s ${l(`${t}/${n}.crt`)} ]; then echo "cert:${n}:$(sha256sum ${l(`${t}/${n}.crt`)} | cut -d' ' -f1)"; else echo "cert:${n}:absent"; fi`)].join(`
-`)}function Ot(t){let e=new Map;for(let n of t.split(`
-`)){let r=n.trim();if(!r.startsWith("cert:"))continue;let[,s,o]=r.split(":");if(s&&o)e.set(s,o)}return e}function Ct(t,e){for(let[n,r]of t){if(r==="absent")continue;if(e.get(n)!==r)return!1}return!0}function Dt(t,e,n){let r=e.flatMap((s)=>[`${s}.crt`,`${s}.key`]);return["set -eu",`rm -f ${l(n)}`,`cd ${l(t)} 2>/dev/null || { echo "no certs dir at ${t}" >&2; exit 0; }`,`TS_CLOUD_CERTS="$(ls ${r.map(l).join(" ")} 2>/dev/null | tr '\\n' ' ' || true)"`,'[ -n "$TS_CLOUD_CERTS" ] || { echo "no certificates to carry"; exit 0; }',`tar czf ${l(n)} $TS_CLOUD_CERTS`].join(`
-`)}function Rt(t,e){return["set -eu",`[ -s ${l(e)} ] || { echo "no certificate archive staged"; exit 0; }`,`mkdir -p ${l(t)}`,`tar xzf ${l(e)} -C ${l(t)}`,`chmod 600 ${l(t)}/*.key 2>/dev/null || true`,`rm -f ${l(e)}`].join(`
-`)}async function Tt(t,e){let{slug:n,siteName:r,appBase:s,from:o,to:i,targetAddress:a}=t;if(o===i)throw Error(`'${r}' is already on ${i}.`);if(t.database&&!e.database)throw Error(`'${r}' uses the on-box database '${t.database.name}', which lives in the engine's own data directory rather than in the site tree, and this move has no way to carry it. Moving the site without it would cut traffic over to an empty database.`);if(t.database&&e.database&&await e.database.targetHasData())throw Error(`${i} already has a database named '${t.database.name}' with tables in it. Restoring this site's dump over it would destroy that data. Rename or drop it on the target first, or point this project at a different database name.`);let p=[{id:"pause-workers",title:`Stop background work on ${o} so the snapshot is consistent`,satisfied:async()=>V(await e.runOnSource(F(n,r))),apply:async()=>{await e.runOnSource(W(n,r))}},...e.database?[{id:"database-dump",title:`Dump the '${t.database?.name}' database on ${o}`,satisfied:async()=>!1,apply:()=>e.database.dump()}]:[],{id:"snapshot",title:`Archive the site's tree and units on ${o}`,change:{from:`${o}:${s}`,to:h(n,r)},satisfied:async()=>!1,apply:async()=>{await e.runOnSource(q(n,r,s))}},{id:"transfer",title:`Carry the archive to ${i}`,change:{from:o,to:i},satisfied:()=>e.archiveStaged(),apply:()=>e.transferArchive()},...e.database?[{id:"database-transfer",title:`Carry the database dump to ${i}`,change:{from:o,to:i},satisfied:()=>e.database.dumpStaged(),apply:()=>e.database.transferDump()},{id:"database-restore",title:`Create and load '${t.database?.name}' on ${i}`,satisfied:async()=>!1,apply:()=>e.database.restore()}]:[],{id:"restore",title:`Unpack the site on ${i} and start it`,change:{from:h(n,r),to:`${i}:${s}`},satisfied:async()=>Z(await e.runOnTarget(K(n,r,s))),apply:async()=>{await e.runOnTarget(G(n,r,s))}}];if(t.port!=null){let{port:c}=t;p.push({id:"health",title:`Wait for the site to answer on ${i} (127.0.0.1:${c})`,satisfied:async()=>!1,apply:async()=>{await e.runOnTarget(J(c,t.healthCheckPath??"/"))}})}return p.push(...e.certificates?[{id:"certificates",title:`Carry the site's TLS material to ${i}`,satisfied:()=>e.certificates.inPlace(),apply:()=>e.certificates.carry()}]:[],{id:"gateway",title:`Route the site on ${i}`,satisfied:()=>e.targetRoutesSite(),apply:()=>e.refreshTargetGateway()},{id:"dns",title:`Point DNS at ${i}`,change:{from:`${o}`,to:a},satisfied:async()=>await e.publishedAddress()===a,apply:async()=>{let c=await e.cutoverDns();if(c.length>0)throw Error(c.join("; "))}},{id:"drain-source",title:`Stop the site on ${o}, leaving its files in place`,satisfied:async()=>Y(await e.runOnSource(X(n,r))),apply:async()=>{await e.runOnSource(Q(n,r))}}),{operation:"site:move",target:r,steps:p}}export{tt as wj,et as xj,nt as yj,R as zj,T as Aj,E as Bj,ot as Cj,j as Dj,H as Ej,st as Fj,at as Gj,A as Hj,ct as Ij,dt as Jj,b as Kj,z as Lj,pt as Mj,ut as Nj,B as Oj,ht as Pj,ft as Qj,yt as Rj,vt as Sj,bt as Tj,St as Uj,wt as Vj,h as Wj,x as Xj,W as Yj,F as Zj,V as _j,q as $j,G as ak,K as bk,Z as ck,J as dk,Q as ek,X as fk,Y as gk,kt as hk,Pt as ik,Ot as jk,Ct as kk,Dt as lk,Rt as mk,Tt as nk};