@stacksjs/ts-cloud 0.12.14 → 0.12.15

package/dist/bin/{chunk-w637s5q0.js → chunk-r1vtnn8w.js}

@@ -1,3 +1,3 @@
-import{Pe,Bs,So,Hs,sn,Io,Ws,Gs,Zs,ea}from"./chunk-bj5nq0kn.js";import{n,r,a,e,m,i,he}from"./chunk-2paqksap.js";import{u}from"./chunk-bckm6fre.js";import{v}from"./chunk-vymg9ywg.js";import{R}from"./chunk-4zbnwt9b.js";import{f}from"./chunk-80zkjpfz.js";import{existsSync as de,readdirSync as me,readFileSync as pe,statSync as fe}from"node:fs";import{join as ne,relative as Se}from"node:path";class H{client;region;constructor(t="us-east-1",s){this.region=t,this.client=new u}async createSecret(t){let s={Name:t.Name};if(t.Description)s.Description=t.Description;if(t.KmsKeyId)s.KmsKeyId=t.KmsKeyId;if(t.SecretBinary)s.SecretBinary=t.SecretBinary;if(t.SecretString)s.SecretString=t.SecretString;if(t.Tags&&t.Tags.length>0)s.Tags=t.Tags;if(t.AddReplicaRegions&&t.AddReplicaRegions.length>0)s.AddReplicaRegions=t.AddReplicaRegions;if(t.ForceOverwriteReplicaSecret!==void 0)s.ForceOverwriteReplicaSecret=t.ForceOverwriteReplicaSecret;s.ClientRequestToken=t.ClientRequestToken||crypto.randomUUID();let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.CreateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId,ReplicationStatus:o.ReplicationStatus}}async updateSecret(t){let s={SecretId:t.SecretId};if(t.Description)s.Description=t.Description;if(t.KmsKeyId)s.KmsKeyId=t.KmsKeyId;if(t.SecretBinary)s.SecretBinary=t.SecretBinary;if(t.SecretString)s.SecretString=t.SecretString;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.UpdateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId}}async putSecretValue(t){let s={SecretId:t.SecretId};if(t.SecretBinary)s.SecretBinary=t.SecretBinary;if(t.SecretString)s.SecretString=t.SecretString;if(t.VersionStages&&t.VersionStages.length>0)s.VersionStages=t.VersionStages;if(t.ClientRequestToken)s.ClientRequestToken=t.ClientRequestToken;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.PutSecretValue","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId,VersionStages:o.VersionStages}}async getSecretValue(t){let s={SecretId:t.SecretId};if(t.VersionId)s.VersionId=t.VersionId;if(t.VersionStage)s.VersionStage=t.VersionStage;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.GetSecretValue","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId,SecretBinary:o.SecretBinary,SecretString:o.SecretString,VersionStages:o.VersionStages,CreatedDate:o.CreatedDate}}async describeSecret(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DescribeSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return this.parseSecret(o)}async listSecrets(t){let s={};if(t?.MaxResults)s.MaxResults=t.MaxResults;if(t?.NextToken)s.NextToken=t.NextToken;if(t?.Filters&&t.Filters.length>0)s.Filters=t.Filters;if(t?.SortOrder)s.SortOrder=t.SortOrder;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.ListSecrets","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{SecretList:o.SecretList?.map((c)=>this.parseSecret(c)),NextToken:o.NextToken}}async deleteSecret(t){let s={SecretId:t.SecretId};if(t.RecoveryWindowInDays!==void 0)s.RecoveryWindowInDays=t.RecoveryWindowInDays;if(t.ForceDeleteWithoutRecovery!==void 0)s.ForceDeleteWithoutRecovery=t.ForceDeleteWithoutRecovery;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DeleteSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,DeletionDate:o.DeletionDate}}async restoreSecret(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.RestoreSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async rotateSecret(t){let s={SecretId:t.SecretId};if(t.ClientRequestToken)s.ClientRequestToken=t.ClientRequestToken;if(t.RotationLambdaARN)s.RotationLambdaARN=t.RotationLambdaARN;if(t.RotationRules)s.RotationRules=t.RotationRules;if(t.RotateImmediately!==void 0)s.RotateImmediately=t.RotateImmediately;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.RotateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId}}async cancelRotateSecret(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.CancelRotateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async getResourcePolicy(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.GetResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,ResourcePolicy:o.ResourcePolicy}}async putResourcePolicy(t){let s={SecretId:t.SecretId,ResourcePolicy:t.ResourcePolicy};if(t.BlockPublicPolicy!==void 0)s.BlockPublicPolicy=t.BlockPublicPolicy;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.PutResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async deleteResourcePolicy(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DeleteResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async tagResource(t){let s={SecretId:t.SecretId,Tags:t.Tags};await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.TagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)})}async untagResource(t){let s={SecretId:t.SecretId,TagKeys:t.TagKeys};await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.UntagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)})}async setString(t,s,o){try{let c=await this.putSecretValue({SecretId:t,SecretString:s});return{ARN:c.ARN,VersionId:c.VersionId}}catch(c){if(c.code==="ResourceNotFoundException"){let l=await this.createSecret({Name:t,SecretString:s,Description:o?.description,KmsKeyId:o?.kmsKeyId,Tags:o?.tags});return{ARN:l.ARN,VersionId:l.VersionId}}throw c}}async setJson(t,s,o){return this.setString(t,JSON.stringify(s),o)}async getString(t){return(await this.getSecretValue({SecretId:t})).SecretString}async getJson(t){let s=await this.getString(t);if(s)return JSON.parse(s);return}async listAll(){let t=[],s;do{let o=await this.listSecrets({NextToken:s});if(o.SecretList)t.push(...o.SecretList);s=o.NextToken}while(s);return t}parseSecret(t){return{ARN:t.ARN,Name:t.Name,Description:t.Description,KmsKeyId:t.KmsKeyId,RotationEnabled:t.RotationEnabled,RotationLambdaARN:t.RotationLambdaARN,RotationRules:t.RotationRules,LastRotatedDate:t.LastRotatedDate,LastChangedDate:t.LastChangedDate,LastAccessedDate:t.LastAccessedDate,DeletedDate:t.DeletedDate,NextRotationDate:t.NextRotationDate,Tags:t.Tags,SecretVersionsToStages:t.SecretVersionsToStages,CreatedDate:t.CreatedDate,PrimaryRegion:t.PrimaryRegion}}}function E(t,s){let o=t.environments?.[s]?.app;if(!o)throw Error(`No serverless app configured for environment '${s}'. Add environments.${s}.app to your config.`);let c=t.project.slug,l=t.environments?.[s]?.region||t.project.region||"us-east-1";return{app:o,slug:c,region:l,stackName:Pe(t,s),artifactBucket:Bs(c,s),assetsBucket:So(c,s)}}function dt(t,s){let o=E(t,s),c=`${o.slug}-${s}`;return{region:o.region,slug:o.slug,stackName:o.stackName,functions:{http:`${c}-http`,queue:`${c}-queue`,cli:`${c}-cli`}}}async function L(t,s=8){let o;for(let c=0;c<s;c++)try{return await t()}catch(l){let g=l?.code||l?.name||"",d=String(l?.message||"");if(g==="ResourceConflictException"||/update is in progress|currently in the following state/i.test(d)){o=l,await new Promise((p)=>setTimeout(p,3000));continue}throw l}throw o}var ie=(t,s)=>`releases/${t}/${s}/current.json`;async function G(t,s,o,c){try{return await t.getObjectJson(s,ie(o,c))}catch{return null}}async function ae(t,s,o,c,l){await t.putObjectJson(s,ie(o,c),l)}async function ye(t,s){if(!t.secrets)return{};let o=new H(s),c={},l=Array.isArray(t.secrets)?t.secrets.map((g)=>({envName:g.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:g})):Object.entries(t.secrets).map(([g,d])=>({envName:g,secretId:d}));if(Array.isArray(t.secrets)){let g=new Map;for(let{envName:p,secretId:S}of l)g.set(p,[...g.get(p)??[],S]);let d=[...g.entries()].filter(([,p])=>p.length>1);if(d.length){let p=d.map(([S,h])=>`${S} ← ${h.join(", ")}`).join("; ");throw Error(`serverless secrets: multiple secrets map to the same env var (${p}). Use the map form { ENV_NAME: 'secret/id' } to disambiguate.`)}}for(let{envName:g,secretId:d}of l){let S=(await o.getSecretValue({SecretId:d})).SecretString??"";try{let h=JSON.parse(S);if(h&&typeof h==="object"&&!Array.isArray(h)){for(let[C,w]of Object.entries(h))c[C]=String(w);continue}}catch{}c[g]=S}return c}function zl(t,s){let o={},c=s.DbProxyEndpoint||s.DbEndpoint;if(c)o.DB_CONNECTION="mysql",o.DB_HOST=c,o.DB_PORT="3306",o.DB_DATABASE=o.DB_DATABASE||"app";if(s.CacheEndpoint){if(o.REDIS_HOST=s.CacheEndpoint,o.REDIS_PORT="6379",t.cache?.driver==="elasticache")o.CACHE_STORE="redis",o.CACHE_DRIVER="redis",o.SESSION_DRIVER="redis"}return o}function Yo(t,s,o,c,l,g,d,p={}){let S=t.kind==="php"?Zs({cacheDriver:t.cache?.driver==="elasticache"?"redis":"dynamodb"}):{};return{TSCLOUD_LAMBDA_MODE:c,TSCLOUD_ENV:o,MAINTENANCE_MODE:"0",...t.octane?{TSCLOUD_OCTANE:"1"}:{},...t.serveAssets?{TSCLOUD_SERVE_ASSETS:"1"}:{},...t.redirectRobotsTxt===!1?{TSCLOUD_REDIRECT_ROBOTS_TXT:"0"}:{},...S,...p,...s.app.cache?.driver!=="elasticache"?{TSCLOUD_CACHE_TABLE:`${s.slug}-${o}-cache`}:{},...d?{TSCLOUD_QUEUE:d,SQS_QUEUE:d}:{},...g?{ASSET_URL:g}:{},...t.env??{},...l}}function Re(t){let s=t.slice(t.lastIndexOf(".")).toLowerCase();return{".html":"text/html",".css":"text/css",".js":"text/javascript",".mjs":"text/javascript",".json":"application/json",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".ico":"image/x-icon",".woff":"font/woff",".woff2":"font/woff2",".txt":"text/plain",".map":"application/json"}[s]??"application/octet-stream"}function*oe(t){for(let s of me(t)){let o=ne(t,s);if(fe(o).isDirectory())yield*oe(o);else yield o}}async function ve(t,s,o,c,l=!1){let g=0;for(let d of oe(o)){let p=Se(o,d).replace(/\\/g,"/");if(!l&&p.split("/").some((S)=>S.startsWith(".")))continue;await t.putObject({bucket:s,key:`${c}/${p}`,body:pe(d),contentType:Re(d),cacheControl:"public, max-age=31536000, immutable"}),g++}return g}function Vi(t,s){let o=Object.entries(s).reduce((c,[l,g])=>c+Buffer.byteLength(`${l}=${g}`,"utf8"),0);if(o>4096){let c=Object.entries(s).map(([l,g])=>[l,Buffer.byteLength(`${l}=${g}`,"utf8")]).sort((l,g)=>g[1]-l[1]).slice(0,5).map(([l,g])=>`${l} (${g}B)`).join(", ");throw Error(`${t}: environment variables total ${o}B, over AWS's 4096B limit (${o-4096}B too large). Largest: ${c}. Move large/secret values out of env — store them in Secrets Manager and fetch at cold start.`)}}async function U(t,s,o,c){Vi(s,o),await L(()=>t.updateFunctionConfiguration({FunctionName:s,Environment:{Variables:o}})),await t.waitForFunctionActive(s,120);let l=c.kind==="image"?{FunctionName:s,ImageUri:c.imageUri}:{FunctionName:s,S3Bucket:c.bucket,S3Key:c.key};await L(()=>t.updateFunctionCode(l)),await t.waitForFunctionActive(s,120)}async function X(t,s){let c=(await L(()=>t.publishVersion({FunctionName:s}))).Version;if(!c)throw Error(`publishVersion returned no version for ${s}`);return await L(()=>t.updateAlias({FunctionName:s,Name:"live",FunctionVersion:c})),c}async function Pu(t,s,o={}){let c=E(t,s),{app:l,slug:g,region:d,stackName:p,artifactBucket:S}=c,h=o.projectRoot??process.cwd();i(`Deploying serverless app: ${g} (${s})`),e(`Stack: ${p}`),e(`Region: ${d}`);let C=new f(d),w=new v(d),b=new R(d),P=l.kind==="php",O=l.packaging==="image",N=Io(l),V,I,k,Y,z=[];if(O&&N.usesLayer&&N.layerKind!=="php")throw Error(`packaging: 'image' currently supports PHP and managed Node runtimes. ${N.kind}${N.kind==="node"?` ${N.version}`:""} uses a custom runtime — `+"use the default zip packaging (the runtime layer is built + attached automatically).");if(O){m("Building + pushing container image");let{buildAndPushServerlessImage:y}=await import("./chunk-f1ke4ygp.js"),A=await y({app:l,projectRoot:h,region:d,repository:`${g}-${s}`,skipBuild:o.skipBuild,onStep:(D)=>e(`  ${D}`)});V=A.handlers,I={kind:"image",imageUri:A.imageUri},k=A.tag,z.push({ParameterKey:"ImageUri",ParameterValue:A.imageUri})}else{m("Packaging application");let y=P?ea({projectRoot:h,app:l,skipBuild:o.skipBuild,onStep:(x)=>e(`  ${x}`)}):await sn({projectRoot:h,app:l,skipBuild:o.skipBuild,onStep:(x)=>e(`  ${x}`)}),A=Hs(g,s,y.sha256);if(e(`Artifact: ${y.sha256.slice(0,12)} (${(y.zip.length/1024).toFixed(0)} KB)`),V=y.handlers,k=y.sha256,N.usesLayer){let x=N.layerEnvVar?process.env[N.layerEnvVar]:void 0;if(Y=l.layers??(x?[x]:void 0),!Y?.length){let ge=N.layerKind==="php"?"serverless:build-php-layer":N.layerKind==="bun"?"serverless:build-bun-layer":"serverless:build-node-layer";throw Error(`${N.kind} apps on provided.al2023 need a runtime layer. Set environments.<env>.app.layers or the ${N.layerEnvVar} env var (build one with \`cloud ${ge}\`)${N.kind==="node"?", or use a managed Node version (18/20/22)":""}.`)}}if(!await C.bucketExists(S))m(`Creating artifact bucket ${S}`),await C.createBucket(S);if(await C.headObject(S,A).then((x)=>x!==null).catch(()=>!1))e("Artifact already uploaded — reusing");else m("Uploading artifact"),await C.putObject({bucket:S,key:A,body:y.zip,contentType:"application/zip"});I={kind:"zip",bucket:S,key:A},z.push({ParameterKey:"ArtifactBucket",ParameterValue:S},{ParameterKey:"ArtifactKey",ParameterValue:A})}let T=Gs({config:t,environment:s,app:l,handlers:V,runtimeLayers:Y}),te=JSON.stringify(T.template),re=["CAPABILITY_NAMED_IAM"],q=await w.describeStacks({stackName:p}).then((y)=>y.Stacks[0]?.StackStatus).catch(()=>{return}),M=q!==void 0;if(q&&/DELETE_IN_PROGRESS/.test(q))m("Waiting for an in-progress stack delete to finish"),await w.waitForStack(p,"stack-delete-complete").catch(()=>{}),M=!1;else if(q&&/(?:ROLLBACK_COMPLETE|REVIEW_IN_PROGRESS|CREATE_FAILED)/.test(q))m(`Deleting unusable stack (status ${q}) before recreate`),await w.deleteStack(p),await w.waitForStack(p,"stack-delete-complete").catch(()=>{}),M=!1;m(M?"Updating infrastructure stack":"Creating infrastructure stack");try{if(M)await w.updateStack({stackName:p,templateBody:te,parameters:z,capabilities:re}),await w.waitForStack(p,"stack-update-complete");else await w.createStack({stackName:p,templateBody:te,parameters:z,capabilities:re,onFailure:"DELETE"}),await w.waitForStack(p,"stack-create-complete")}catch(y){if(/No updates are to be performed/i.test(String(y?.message)))e("No infrastructure changes");else throw y}let Q=await w.getStackOutputs(p).catch(()=>({})),B;if(l.assets){let y=ne(h,l.assets);if(de(y)){let A=l.assetDomain||Q.AssetsCdnDomain;B=A?`https://${A}/${k}`:void 0,m(`Syncing assets from ${l.assets}`);let D=await ve(C,c.assetsBucket,y,k,l.dotFilesAsAssets);e(`Uploaded ${D} asset(s)${B?` → ${B}`:""}`)}else a(`Assets directory not found: ${y}`)}m("Resolving secrets");let _=await ye(l,d);if(l.database?.connection==="aurora-serverless")try{let A=await new H(d).getSecretValue({SecretId:`${g}/${s}/db`}),D=JSON.parse(A.SecretString??"{}");if(D.username)_.DB_USERNAME=D.username;if(D.password)_.DB_PASSWORD=D.password}catch(y){a(`Could not resolve Aurora DB credentials: ${y.message}`)}if(!await C.bucketExists(S))await C.createBucket(S);let J=await G(C,S,g,s),F={},Z=T.queueNames[0],ee=zl(l,Q);if(m("Activating functions"),F.http=Yo(l,c,s,"http",_,B,Z,ee),await U(b,T.functionNames.http,F.http,I),F.cli=Yo(l,c,s,"cli",_,B,Z,ee),await U(b,T.functionNames.cli,F.cli,I),T.queueNames.length)F.queue=Yo(l,c,s,"queue",_,B,Z,ee),await U(b,T.functionNames.queue,F.queue,I);let se=(l.provisionedConcurrency??0)>0,W={};if(se){if(m("Publishing versions + flipping live alias"),W.http=await X(b,T.functionNames.http),W.cli=await X(b,T.functionNames.cli),T.queueNames.length)W.queue=await X(b,T.functionNames.queue)}if(await ae(C,S,g,s,{sha:k,code:I,previousSha:J?.sha,previousCode:J?.code,previousFunctionEnv:J?.functionEnv,...se?{functionVersions:W,previousFunctionVersions:J?.functionVersions}:{},functionEnv:F,functionNames:{http:T.functionNames.http,cli:T.functionNames.cli,...T.queueNames.length?{queue:T.functionNames.queue}:{}},assetUrl:B,timestamp:new Date().toISOString()}),!o.skipDeployHooks&&l.deploy?.length){m("Running deploy hooks");for(let y of l.deploy){e(`  deploy: ${y}`);let A=await b.invoke({FunctionName:T.functionNames.cli,InvocationType:"RequestResponse",Payload:{command:y},LogType:"Tail"});if(A.FunctionError)throw r("Deploy hook failed — the new build is ALREADY LIVE."),e(`  Roll back with: cloud serverless:rollback --env ${s}`),Error(`Deploy hook failed (${y}): ${A.Payload}`)}}let K=Q.HttpApiEndpoint;if(!o.skipHealthCheck&&K){m("Health check");try{let y=await fetch(K,{method:"GET"});e(`GET ${K} → ${y.status}`)}catch(y){a(`Health check could not reach ${K}: ${y.message}`)}}he(["Serverless deploy complete","",K?`URL:   ${K}`:"",`Stack: ${p}`,`Build: ${k.slice(0,12)}`].filter(Boolean).join(`
+import{Pe,Bs,So,Hs,sn,Io,Ws,Gs,Zs,ea}from"./chunk-8tbj9h2a.js";import{n,r,a,e,m,i,ye}from"./chunk-77qpn2m8.js";import{u}from"./chunk-bckm6fre.js";import{v}from"./chunk-vymg9ywg.js";import{R}from"./chunk-4zbnwt9b.js";import{f}from"./chunk-80zkjpfz.js";import{existsSync as de,readdirSync as me,readFileSync as pe,statSync as fe}from"node:fs";import{join as ne,relative as Se}from"node:path";class H{client;region;constructor(t="us-east-1",s){this.region=t,this.client=new u}async createSecret(t){let s={Name:t.Name};if(t.Description)s.Description=t.Description;if(t.KmsKeyId)s.KmsKeyId=t.KmsKeyId;if(t.SecretBinary)s.SecretBinary=t.SecretBinary;if(t.SecretString)s.SecretString=t.SecretString;if(t.Tags&&t.Tags.length>0)s.Tags=t.Tags;if(t.AddReplicaRegions&&t.AddReplicaRegions.length>0)s.AddReplicaRegions=t.AddReplicaRegions;if(t.ForceOverwriteReplicaSecret!==void 0)s.ForceOverwriteReplicaSecret=t.ForceOverwriteReplicaSecret;s.ClientRequestToken=t.ClientRequestToken||crypto.randomUUID();let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.CreateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId,ReplicationStatus:o.ReplicationStatus}}async updateSecret(t){let s={SecretId:t.SecretId};if(t.Description)s.Description=t.Description;if(t.KmsKeyId)s.KmsKeyId=t.KmsKeyId;if(t.SecretBinary)s.SecretBinary=t.SecretBinary;if(t.SecretString)s.SecretString=t.SecretString;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.UpdateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId}}async putSecretValue(t){let s={SecretId:t.SecretId};if(t.SecretBinary)s.SecretBinary=t.SecretBinary;if(t.SecretString)s.SecretString=t.SecretString;if(t.VersionStages&&t.VersionStages.length>0)s.VersionStages=t.VersionStages;if(t.ClientRequestToken)s.ClientRequestToken=t.ClientRequestToken;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.PutSecretValue","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId,VersionStages:o.VersionStages}}async getSecretValue(t){let s={SecretId:t.SecretId};if(t.VersionId)s.VersionId=t.VersionId;if(t.VersionStage)s.VersionStage=t.VersionStage;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.GetSecretValue","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId,SecretBinary:o.SecretBinary,SecretString:o.SecretString,VersionStages:o.VersionStages,CreatedDate:o.CreatedDate}}async describeSecret(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DescribeSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return this.parseSecret(o)}async listSecrets(t){let s={};if(t?.MaxResults)s.MaxResults=t.MaxResults;if(t?.NextToken)s.NextToken=t.NextToken;if(t?.Filters&&t.Filters.length>0)s.Filters=t.Filters;if(t?.SortOrder)s.SortOrder=t.SortOrder;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.ListSecrets","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{SecretList:o.SecretList?.map((c)=>this.parseSecret(c)),NextToken:o.NextToken}}async deleteSecret(t){let s={SecretId:t.SecretId};if(t.RecoveryWindowInDays!==void 0)s.RecoveryWindowInDays=t.RecoveryWindowInDays;if(t.ForceDeleteWithoutRecovery!==void 0)s.ForceDeleteWithoutRecovery=t.ForceDeleteWithoutRecovery;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DeleteSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,DeletionDate:o.DeletionDate}}async restoreSecret(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.RestoreSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async rotateSecret(t){let s={SecretId:t.SecretId};if(t.ClientRequestToken)s.ClientRequestToken=t.ClientRequestToken;if(t.RotationLambdaARN)s.RotationLambdaARN=t.RotationLambdaARN;if(t.RotationRules)s.RotationRules=t.RotationRules;if(t.RotateImmediately!==void 0)s.RotateImmediately=t.RotateImmediately;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.RotateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId}}async cancelRotateSecret(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.CancelRotateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async getResourcePolicy(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.GetResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,ResourcePolicy:o.ResourcePolicy}}async putResourcePolicy(t){let s={SecretId:t.SecretId,ResourcePolicy:t.ResourcePolicy};if(t.BlockPublicPolicy!==void 0)s.BlockPublicPolicy=t.BlockPublicPolicy;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.PutResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async deleteResourcePolicy(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DeleteResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async tagResource(t){let s={SecretId:t.SecretId,Tags:t.Tags};await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.TagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)})}async untagResource(t){let s={SecretId:t.SecretId,TagKeys:t.TagKeys};await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.UntagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)})}async setString(t,s,o){try{let c=await this.putSecretValue({SecretId:t,SecretString:s});return{ARN:c.ARN,VersionId:c.VersionId}}catch(c){if(c.code==="ResourceNotFoundException"){let l=await this.createSecret({Name:t,SecretString:s,Description:o?.description,KmsKeyId:o?.kmsKeyId,Tags:o?.tags});return{ARN:l.ARN,VersionId:l.VersionId}}throw c}}async setJson(t,s,o){return this.setString(t,JSON.stringify(s),o)}async getString(t){return(await this.getSecretValue({SecretId:t})).SecretString}async getJson(t){let s=await this.getString(t);if(s)return JSON.parse(s);return}async listAll(){let t=[],s;do{let o=await this.listSecrets({NextToken:s});if(o.SecretList)t.push(...o.SecretList);s=o.NextToken}while(s);return t}parseSecret(t){return{ARN:t.ARN,Name:t.Name,Description:t.Description,KmsKeyId:t.KmsKeyId,RotationEnabled:t.RotationEnabled,RotationLambdaARN:t.RotationLambdaARN,RotationRules:t.RotationRules,LastRotatedDate:t.LastRotatedDate,LastChangedDate:t.LastChangedDate,LastAccessedDate:t.LastAccessedDate,DeletedDate:t.DeletedDate,NextRotationDate:t.NextRotationDate,Tags:t.Tags,SecretVersionsToStages:t.SecretVersionsToStages,CreatedDate:t.CreatedDate,PrimaryRegion:t.PrimaryRegion}}}function E(t,s){let o=t.environments?.[s]?.app;if(!o)throw Error(`No serverless app configured for environment '${s}'. Add environments.${s}.app to your config.`);let c=t.project.slug,l=t.environments?.[s]?.region||t.project.region||"us-east-1";return{app:o,slug:c,region:l,stackName:Pe(t,s),artifactBucket:Bs(c,s),assetsBucket:So(c,s)}}function ut(t,s){let o=E(t,s),c=`${o.slug}-${s}`;return{region:o.region,slug:o.slug,stackName:o.stackName,functions:{http:`${c}-http`,queue:`${c}-queue`,cli:`${c}-cli`}}}async function L(t,s=8){let o;for(let c=0;c<s;c++)try{return await t()}catch(l){let g=l?.code||l?.name||"",d=String(l?.message||"");if(g==="ResourceConflictException"||/update is in progress|currently in the following state/i.test(d)){o=l,await new Promise((p)=>setTimeout(p,3000));continue}throw l}throw o}var ie=(t,s)=>`releases/${t}/${s}/current.json`;async function G(t,s,o,c){try{return await t.getObjectJson(s,ie(o,c))}catch{return null}}async function ae(t,s,o,c,l){await t.putObjectJson(s,ie(o,c),l)}async function Re(t,s){if(!t.secrets)return{};let o=new H(s),c={},l=Array.isArray(t.secrets)?t.secrets.map((g)=>({envName:g.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:g})):Object.entries(t.secrets).map(([g,d])=>({envName:g,secretId:d}));if(Array.isArray(t.secrets)){let g=new Map;for(let{envName:p,secretId:S}of l)g.set(p,[...g.get(p)??[],S]);let d=[...g.entries()].filter(([,p])=>p.length>1);if(d.length){let p=d.map(([S,h])=>`${S} ← ${h.join(", ")}`).join("; ");throw Error(`serverless secrets: multiple secrets map to the same env var (${p}). Use the map form { ENV_NAME: 'secret/id' } to disambiguate.`)}}for(let{envName:g,secretId:d}of l){let S=(await o.getSecretValue({SecretId:d})).SecretString??"";try{let h=JSON.parse(S);if(h&&typeof h==="object"&&!Array.isArray(h)){for(let[C,w]of Object.entries(h))c[C]=String(w);continue}}catch{}c[g]=S}return c}function zl(t,s){let o={},c=s.DbProxyEndpoint||s.DbEndpoint;if(c)o.DB_CONNECTION="mysql",o.DB_HOST=c,o.DB_PORT="3306",o.DB_DATABASE=o.DB_DATABASE||"app";if(s.CacheEndpoint){if(o.REDIS_HOST=s.CacheEndpoint,o.REDIS_PORT="6379",t.cache?.driver==="elasticache")o.CACHE_STORE="redis",o.CACHE_DRIVER="redis",o.SESSION_DRIVER="redis"}return o}function Yo(t,s,o,c,l,g,d,p={}){let S=t.kind==="php"?Zs({cacheDriver:t.cache?.driver==="elasticache"?"redis":"dynamodb"}):{};return{TSCLOUD_LAMBDA_MODE:c,TSCLOUD_ENV:o,MAINTENANCE_MODE:"0",...t.octane?{TSCLOUD_OCTANE:"1"}:{},...t.serveAssets?{TSCLOUD_SERVE_ASSETS:"1"}:{},...t.redirectRobotsTxt===!1?{TSCLOUD_REDIRECT_ROBOTS_TXT:"0"}:{},...S,...p,...s.app.cache?.driver!=="elasticache"?{TSCLOUD_CACHE_TABLE:`${s.slug}-${o}-cache`}:{},...d?{TSCLOUD_QUEUE:d,SQS_QUEUE:d}:{},...g?{ASSET_URL:g}:{},...t.env??{},...l}}function he(t){let s=t.slice(t.lastIndexOf(".")).toLowerCase();return{".html":"text/html",".css":"text/css",".js":"text/javascript",".mjs":"text/javascript",".json":"application/json",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".ico":"image/x-icon",".woff":"font/woff",".woff2":"font/woff2",".txt":"text/plain",".map":"application/json"}[s]??"application/octet-stream"}function*oe(t){for(let s of me(t)){let o=ne(t,s);if(fe(o).isDirectory())yield*oe(o);else yield o}}async function ve(t,s,o,c,l=!1){let g=0;for(let d of oe(o)){let p=Se(o,d).replace(/\\/g,"/");if(!l&&p.split("/").some((S)=>S.startsWith(".")))continue;await t.putObject({bucket:s,key:`${c}/${p}`,body:pe(d),contentType:he(d),cacheControl:"public, max-age=31536000, immutable"}),g++}return g}function Vi(t,s){let o=Object.entries(s).reduce((c,[l,g])=>c+Buffer.byteLength(`${l}=${g}`,"utf8"),0);if(o>4096){let c=Object.entries(s).map(([l,g])=>[l,Buffer.byteLength(`${l}=${g}`,"utf8")]).sort((l,g)=>g[1]-l[1]).slice(0,5).map(([l,g])=>`${l} (${g}B)`).join(", ");throw Error(`${t}: environment variables total ${o}B, over AWS's 4096B limit (${o-4096}B too large). Largest: ${c}. Move large/secret values out of env — store them in Secrets Manager and fetch at cold start.`)}}async function U(t,s,o,c){Vi(s,o),await L(()=>t.updateFunctionConfiguration({FunctionName:s,Environment:{Variables:o}})),await t.waitForFunctionActive(s,120);let l=c.kind==="image"?{FunctionName:s,ImageUri:c.imageUri}:{FunctionName:s,S3Bucket:c.bucket,S3Key:c.key};await L(()=>t.updateFunctionCode(l)),await t.waitForFunctionActive(s,120)}async function X(t,s){let c=(await L(()=>t.publishVersion({FunctionName:s}))).Version;if(!c)throw Error(`publishVersion returned no version for ${s}`);return await L(()=>t.updateAlias({FunctionName:s,Name:"live",FunctionVersion:c})),c}async function Pu(t,s,o={}){let c=E(t,s),{app:l,slug:g,region:d,stackName:p,artifactBucket:S}=c,h=o.projectRoot??process.cwd();i(`Deploying serverless app: ${g} (${s})`),e(`Stack: ${p}`),e(`Region: ${d}`);let C=new f(d),w=new v(d),b=new R(d),P=l.kind==="php",O=l.packaging==="image",N=Io(l),V,I,k,Y,z=[];if(O&&N.usesLayer&&N.layerKind!=="php")throw Error(`packaging: 'image' currently supports PHP and managed Node runtimes. ${N.kind}${N.kind==="node"?` ${N.version}`:""} uses a custom runtime — `+"use the default zip packaging (the runtime layer is built + attached automatically).");if(O){m("Building + pushing container image");let{buildAndPushServerlessImage:y}=await import("./chunk-v7f4c62s.js"),A=await y({app:l,projectRoot:h,region:d,repository:`${g}-${s}`,skipBuild:o.skipBuild,onStep:(D)=>e(`  ${D}`)});V=A.handlers,I={kind:"image",imageUri:A.imageUri},k=A.tag,z.push({ParameterKey:"ImageUri",ParameterValue:A.imageUri})}else{m("Packaging application");let y=P?ea({projectRoot:h,app:l,skipBuild:o.skipBuild,onStep:(x)=>e(`  ${x}`)}):await sn({projectRoot:h,app:l,skipBuild:o.skipBuild,onStep:(x)=>e(`  ${x}`)}),A=Hs(g,s,y.sha256);if(e(`Artifact: ${y.sha256.slice(0,12)} (${(y.zip.length/1024).toFixed(0)} KB)`),V=y.handlers,k=y.sha256,N.usesLayer){let x=N.layerEnvVar?process.env[N.layerEnvVar]:void 0;if(Y=l.layers??(x?[x]:void 0),!Y?.length){let ge=N.layerKind==="php"?"serverless:build-php-layer":N.layerKind==="bun"?"serverless:build-bun-layer":"serverless:build-node-layer";throw Error(`${N.kind} apps on provided.al2023 need a runtime layer. Set environments.<env>.app.layers or the ${N.layerEnvVar} env var (build one with \`cloud ${ge}\`)${N.kind==="node"?", or use a managed Node version (18/20/22)":""}.`)}}if(!await C.bucketExists(S))m(`Creating artifact bucket ${S}`),await C.createBucket(S);if(await C.headObject(S,A).then((x)=>x!==null).catch(()=>!1))e("Artifact already uploaded — reusing");else m("Uploading artifact"),await C.putObject({bucket:S,key:A,body:y.zip,contentType:"application/zip"});I={kind:"zip",bucket:S,key:A},z.push({ParameterKey:"ArtifactBucket",ParameterValue:S},{ParameterKey:"ArtifactKey",ParameterValue:A})}let T=Gs({config:t,environment:s,app:l,handlers:V,runtimeLayers:Y}),te=JSON.stringify(T.template),re=["CAPABILITY_NAMED_IAM"],q=await w.describeStacks({stackName:p}).then((y)=>y.Stacks[0]?.StackStatus).catch(()=>{return}),M=q!==void 0;if(q&&/DELETE_IN_PROGRESS/.test(q))m("Waiting for an in-progress stack delete to finish"),await w.waitForStack(p,"stack-delete-complete").catch(()=>{}),M=!1;else if(q&&/(?:ROLLBACK_COMPLETE|REVIEW_IN_PROGRESS|CREATE_FAILED)/.test(q))m(`Deleting unusable stack (status ${q}) before recreate`),await w.deleteStack(p),await w.waitForStack(p,"stack-delete-complete").catch(()=>{}),M=!1;m(M?"Updating infrastructure stack":"Creating infrastructure stack");try{if(M)await w.updateStack({stackName:p,templateBody:te,parameters:z,capabilities:re}),await w.waitForStack(p,"stack-update-complete");else await w.createStack({stackName:p,templateBody:te,parameters:z,capabilities:re,onFailure:"DELETE"}),await w.waitForStack(p,"stack-create-complete")}catch(y){if(/No updates are to be performed/i.test(String(y?.message)))e("No infrastructure changes");else throw y}let Q=await w.getStackOutputs(p).catch(()=>({})),B;if(l.assets){let y=ne(h,l.assets);if(de(y)){let A=l.assetDomain||Q.AssetsCdnDomain;B=A?`https://${A}/${k}`:void 0,m(`Syncing assets from ${l.assets}`);let D=await ve(C,c.assetsBucket,y,k,l.dotFilesAsAssets);e(`Uploaded ${D} asset(s)${B?` → ${B}`:""}`)}else a(`Assets directory not found: ${y}`)}m("Resolving secrets");let _=await Re(l,d);if(l.database?.connection==="aurora-serverless")try{let A=await new H(d).getSecretValue({SecretId:`${g}/${s}/db`}),D=JSON.parse(A.SecretString??"{}");if(D.username)_.DB_USERNAME=D.username;if(D.password)_.DB_PASSWORD=D.password}catch(y){a(`Could not resolve Aurora DB credentials: ${y.message}`)}if(!await C.bucketExists(S))await C.createBucket(S);let J=await G(C,S,g,s),F={},Z=T.queueNames[0],ee=zl(l,Q);if(m("Activating functions"),F.http=Yo(l,c,s,"http",_,B,Z,ee),await U(b,T.functionNames.http,F.http,I),F.cli=Yo(l,c,s,"cli",_,B,Z,ee),await U(b,T.functionNames.cli,F.cli,I),T.queueNames.length)F.queue=Yo(l,c,s,"queue",_,B,Z,ee),await U(b,T.functionNames.queue,F.queue,I);let se=(l.provisionedConcurrency??0)>0,W={};if(se){if(m("Publishing versions + flipping live alias"),W.http=await X(b,T.functionNames.http),W.cli=await X(b,T.functionNames.cli),T.queueNames.length)W.queue=await X(b,T.functionNames.queue)}if(await ae(C,S,g,s,{sha:k,code:I,previousSha:J?.sha,previousCode:J?.code,previousFunctionEnv:J?.functionEnv,...se?{functionVersions:W,previousFunctionVersions:J?.functionVersions}:{},functionEnv:F,functionNames:{http:T.functionNames.http,cli:T.functionNames.cli,...T.queueNames.length?{queue:T.functionNames.queue}:{}},assetUrl:B,timestamp:new Date().toISOString()}),!o.skipDeployHooks&&l.deploy?.length){m("Running deploy hooks");for(let y of l.deploy){e(`  deploy: ${y}`);let A=await b.invoke({FunctionName:T.functionNames.cli,InvocationType:"RequestResponse",Payload:{command:y},LogType:"Tail"});if(A.FunctionError)throw r("Deploy hook failed — the new build is ALREADY LIVE."),e(`  Roll back with: cloud serverless:rollback --env ${s}`),Error(`Deploy hook failed (${y}): ${A.Payload}`)}}let K=Q.HttpApiEndpoint;if(!o.skipHealthCheck&&K){m("Health check");try{let y=await fetch(K,{method:"GET"});e(`GET ${K} → ${y.status}`)}catch(y){a(`Health check could not reach ${K}: ${y.message}`)}}ye(["Serverless deploy complete","",K?`URL:   ${K}`:"",`Stack: ${p}`,`Build: ${k.slice(0,12)}`].filter(Boolean).join(`
 `),"green")}async function Zo(t,s){let o=E(t,s),c=new f(o.region),l=new R(o.region),g=await G(c,o.artifactBucket,o.slug,s);if(!g)throw Error("No previous release to redeploy. Run a full deploy first.");i(`Redeploying ${o.slug} (${s}) — build ${g.sha.slice(0,12)}`);for(let[d,p]of Object.entries(g.functionNames)){if(!p)continue;m(`Re-activating ${d} (${p})`),await U(l,p,g.functionEnv[d]??{},g.code);let S=g.functionVersions?.[d];if(S)await L(()=>l.updateAlias({FunctionName:p,Name:"live",FunctionVersion:S}))}n("Redeploy complete")}async function es(t,s){let o=E(t,s),c=new f(o.region),l=new R(o.region),g=await G(c,o.artifactBucket,o.slug,s);if(!g?.previousCode)throw Error("No previous release to roll back to.");i(`Rolling back ${o.slug} (${s}) → ${g.previousSha?.slice(0,12)}`);for(let[d,p]of Object.entries(g.functionNames)){if(!p)continue;m(`Restoring ${d} (${p})`);let S=g.previousFunctionEnv?.[d]??g.functionEnv[d]??{};await U(l,p,S,g.previousCode);let h=g.previousFunctionVersions?.[d];if(h)await L(()=>l.updateAlias({FunctionName:p,Name:"live",FunctionVersion:h}))}await ae(c,o.artifactBucket,o.slug,s,{...g,sha:g.previousSha??g.sha,code:g.previousCode,functionEnv:g.previousFunctionEnv??g.functionEnv,functionVersions:g.previousFunctionVersions??g.functionVersions,previousSha:void 0,previousCode:void 0,previousFunctionEnv:void 0,previousFunctionVersions:void 0,timestamp:new Date().toISOString()}),n("Rollback complete")}async function zi(t,s,o,c){let l=E(t,s),g=new R(l.region),d=`${l.slug}-${s}-http`,S={...(await g.getFunction(d)).Configuration?.Environment?.Variables??{}};if(S.MAINTENANCE_MODE=o?"1":"0",o&&c)S.MAINTENANCE_BYPASS_SECRET=c;if(!o)delete S.MAINTENANCE_BYPASS_SECRET;if(await L(()=>g.updateFunctionConfiguration({FunctionName:d,Environment:{Variables:S}})),(l.app.provisionedConcurrency??0)>0)await g.waitForFunctionActive(d,120),await X(g,d);n(o?"Application is now in maintenance mode (503)":"Application is live")}async function _t(t,s,o){let c=E(t,s),l=new R(c.region),g=`${c.slug}-${s}-cli`,d=await l.invoke({FunctionName:g,InvocationType:"RequestResponse",Payload:{command:o},LogType:"Tail"});if(d.FunctionError)throw Error(`Command failed: ${d.Payload}`);return d.Payload??""}var ce=(t,s)=>`commands/${t}/${s}/history.json`,Ne=50;async function le(t,s,o,c){try{return(await t.getObjectJson(s,ce(o,c)))?.records??[]}catch{return[]}}async function Nu(t,s,o){let c=E(t,s),l=new R(c.region),g=`${c.slug}-${s}-cli`,d=await l.invoke({FunctionName:g,InvocationType:"RequestResponse",Payload:{command:o},LogType:"Tail"}),p=d.Payload??"",S=d.FunctionError?"error":"ok",h=-1;try{let C=new f(c.region);if(await C.bucketExists(c.artifactBucket)){let w=await le(C,c.artifactBucket,c.slug,s);h=w.reduce((b,P)=>Math.max(b,P.id),0)+1,w.push({id:h,command:o,timestamp:new Date().toISOString(),status:S,output:p.slice(0,4000)}),await C.putObjectJson(c.artifactBucket,ce(c.slug,s),{records:w.slice(-Ne)})}}catch{}if(d.FunctionError)throw Error(`Command failed${h>0?` (#${h})`:""}: ${p}`);return{id:h,status:S,output:p}}async function ql(t,s){let o=E(t,s),c=new f(o.region);return le(c,o.artifactBucket,o.slug,s)}async function ku(t,s,o){let c=await ql(t,s);if(!c.length)return;return o==null?c[c.length-1]:c.find((l)=>l.id===o)}async function Du(t,s,o){let c=Buffer.from(o,"utf-8").toString("base64");return _t(t,s,`tscloud:db-query --sql-base64=${c}`)}async function j(t,s){let o=E(t,s),c=new v(o.region),l=new R(o.region),g=new f(o.region),d="not deployed",p={};try{let{Stacks:O}=await c.describeStacks({stackName:o.stackName});d=O?.[0]?.StackStatus??d;for(let N of O?.[0]?.Outputs??[])if(N.OutputKey)p[N.OutputKey]=N.OutputValue??""}catch{}let S=Ws(o.app,o.slug,s),h=o.app.provisionedConcurrency??0,C=["http","cli",...S.length?["queue"]:[]],w=`${o.slug}-${s}`,b=[];for(let O of C){let N=`${w}-${O}`,V={mode:O,name:N,version:"$LATEST"};if(h>0){let I=await l.getAlias(N,"live").catch(()=>null);if(I?.FunctionVersion){V.version=I.FunctionVersion;let k=await l.getProvisionedConcurrencyConfig(N,"live").catch(()=>null);if(k)V.provisioned={status:k.Status??"-",allocated:k.AllocatedProvisionedConcurrentExecutions??0,requested:k.RequestedProvisionedConcurrentExecutions??0}}}b.push(V)}let P=await G(g,o.artifactBucket,o.slug,s).catch(()=>null);return{slug:o.slug,environment:s,region:o.region,stackStatus:d,endpoint:p.HttpApiEndpoint,assetUrl:P?.assetUrl,scheduler:o.app.scheduler??"on",queues:S,provisionedConcurrency:h,functions:b,lastRelease:P?{sha:P.sha,timestamp:P.timestamp}:void 0}}function ue(t,s){return`${t}-${s}-db`}async function ts(t,s,o,c){let l=E(t,s);if(l.app.database?.connection!=="aurora-serverless")throw Error("No Aurora Serverless v2 database is configured for this environment.");let{RDSClient:g}=await import("./chunk-7x0hrna6.js"),d=new g(l.region),p=ue(l.slug,s);m(`Scaling ${p} → ${o}–${c} ACUs`),await d.modifyDBCluster({DBClusterIdentifier:p,ServerlessV2ScalingConfiguration:{MinCapacity:o,MaxCapacity:c},ApplyImmediately:!0}),n(`Scaling applied to ${p} (takes effect shortly).`)}async function xu(t,s,o){let c=E(t,s);if(c.app.database?.connection!=="aurora-serverless")throw Error("No Aurora Serverless v2 database is configured for this environment.");if(!o.toTime&&!o.latest)throw Error("Specify a restore point: --to <ISO timestamp> or --latest.");let{RDSClient:l}=await import("./chunk-7x0hrna6.js"),g=new l(c.region),d=ue(c.slug,s),p=o.latest?"latest":o.toTime.toISOString().replace(/[^0-9]/g,"").slice(0,14),S=o.target??`${d}-restore-${p}`;m(`Restoring ${d} → new cluster ${S} (${o.latest?"latest restorable time":o.toTime.toISOString()})`),await g.restoreDBClusterToPointInTime({DBClusterIdentifier:S,SourceDBClusterIdentifier:d,RestoreToTime:o.toTime,UseLatestRestorableTime:o.latest}),m("Waiting for the restored cluster to be ready");for(let h=0;h<120;h++){let{DBClusters:C}=await g.describeDBClusters({DBClusterIdentifier:S}),w=C?.[0]?.Status;if(w&&w!=="creating")break;await new Promise((b)=>setTimeout(b,15000))}return m("Adding a writer instance"),await g.createDBInstance({DBInstanceIdentifier:`${S}-1`,DBClusterIdentifier:S,Engine:"aurora-mysql",DBInstanceClass:"db.serverless"}),n(`Restore complete → cluster ${S} with writer ${S}-1. Point an env's database at it once available.`),S}
-export{H,dt,zl,Yo,Vi,Pu,Zo,es,zi,_t,Nu,ql,ku,Du,j,ts,xu};
+export{H,ut,zl,Yo,Vi,Pu,Zo,es,zi,_t,Nu,ql,ku,Du,j,ts,xu};

package/dist/bin/{chunk-nrnq9adz.js → chunk-r1w08y38.js}

@@ -1 +1 @@
-import{pu,Br,Ri,re,mu,ua,Pl,Lo,gu,fu,hu,pa,Pi,Mo,ma,Fr,rr,yu,Wn,Su,ga,Nl,kl,Uo,fa,ha,nr,Ni,ir,ya,Bo,Gn,Dl,ki,Sa,ba,Di,xl,va,Ta,Ea,wa,Fo,_l,$l,bu,Ol,Ca,xi,Ll,Ml,jo,kt,Vo,zo,qo,Aa,Ul,Ia,Ho,vu,st,Tu,Ra,Dt,Pa,Eu,Na,Bl,wu,J,Fl,Wo,Cu,_i,Kn,Jn,Go,jl,Vl,Au,Ko,Jo}from"./chunk-y7ece16e.js";import"./chunk-wr6a423y.js";import"./chunk-bj5nq0kn.js";export{jo as AnomalyConfigStore,jl as AwsSpendTransport,Vl as ComputeSpendTransport,Uo as CounterTracker,ga as DEFAULT_METER_MAPPINGS,pa as DEFAULT_PRICE_BOOK,Ni as DEFAULT_THRESHOLDS,kt as DETECTABLE_SIGNALS,Ri as ENFORCEMENT_ACTIONS,Di as ENFORCEMENT_DESCRIPTIONS,re as ENFORCEMENT_SEVERITY,Ul as FOCUS_VERSION,Br as METERS,pu as METER_KEYS,mu as MICRO_CENTS,Dl as MIN_PROJECTION_CONFIDENCE,Bl as RecordingSpendTransport,Ll as SENSITIVITY_THRESHOLDS,Jn as SPEND_CYCLE_SECONDS,Ra as SPEND_GATE_SETTING,Cu as SPEND_LEASE_SETTING,zo as SignalSource,Pa as SpendCapError,Dt as SpendGate,_i as SpendLoopLease,Wo as SpendNotificationRouter,Kn as SpendRunner,st as SpendService,ir as SpendStore,wu as URGENT_SPEND_EVENTS,xl as USER_VISIBLE_ACTIONS,ha as aggregateDeltas,xi as anomalyOptionsForSignal,Eu as assertSpendAllows,rr as budgetWindow,Au as compositeSpendTransport,Na as createEnforcementHandlers,Ol as detectAnomalies,Ca as detectLatestAnomaly,Sa as evaluateBudget,bu as ewma,Nl as findMapping,Pl as findPriceEntry,J as formatCents,Gn as formatTimeToExhaustion,ki as governingLimitCents,Ko as handleSpendRequest,Wn as hourBucket,Su as hourBucketsBetween,wa as isOperationAllowed,Pi as isValidTimeZone,Aa as lookbackHoursForSignal,Fo as median,_l as medianAbsoluteDeviation,ba as mergeDecisions,hu as mergePriceBooks,fa as meterTelemetry,qo as optionsForSignal,Bo as percentOfLimit,va as planEnforcement,yu as previousBudgetWindow,Lo as priceUsage,gu as priceUsageLines,ya as projectSpend,$l as robustZScore,fu as roundCents,Ml as routeMatches,Ta as runEnforcement,nr as scopeKey,Vo as signalDefinition,Fl as spendNotificationText,Jo as spendOpenApiPaths,Go as startSpendLoop,vu as streamFocusJsonl,Ea as strongestActiveAction,ua as tieredMicroCents,Ho as toFocusJsonl,Ia as toFocusRecords,kl as usageDeltaKey,Fr as utcInstantOfLocal,Tu as zeroFill,ma as zoneOffsetMs,Mo as zonedParts};
+import{pu,Br,Ri,re,mu,ua,Pl,Lo,gu,fu,hu,pa,Pi,Mo,ma,Fr,rr,yu,Wn,Su,ga,Nl,kl,Uo,fa,ha,nr,Ni,ir,ya,Bo,Gn,Dl,ki,Sa,ba,Di,xl,va,Ta,Ea,wa,Fo,_l,$l,bu,Ol,Ca,xi,Ll,Ml,jo,kt,Vo,zo,qo,Aa,Ul,Ia,Ho,vu,at,Tu,Ra,Dt,Pa,Eu,Na,Bl,wu,J,Fl,Wo,Cu,_i,Kn,Jn,Go,jl,Vl,Au,Ko,Jo}from"./chunk-swete552.js";import"./chunk-gd4w6bht.js";import"./chunk-8tbj9h2a.js";export{jo as AnomalyConfigStore,jl as AwsSpendTransport,Vl as ComputeSpendTransport,Uo as CounterTracker,ga as DEFAULT_METER_MAPPINGS,pa as DEFAULT_PRICE_BOOK,Ni as DEFAULT_THRESHOLDS,kt as DETECTABLE_SIGNALS,Ri as ENFORCEMENT_ACTIONS,Di as ENFORCEMENT_DESCRIPTIONS,re as ENFORCEMENT_SEVERITY,Ul as FOCUS_VERSION,Br as METERS,pu as METER_KEYS,mu as MICRO_CENTS,Dl as MIN_PROJECTION_CONFIDENCE,Bl as RecordingSpendTransport,Ll as SENSITIVITY_THRESHOLDS,Jn as SPEND_CYCLE_SECONDS,Ra as SPEND_GATE_SETTING,Cu as SPEND_LEASE_SETTING,zo as SignalSource,Pa as SpendCapError,Dt as SpendGate,_i as SpendLoopLease,Wo as SpendNotificationRouter,Kn as SpendRunner,at as SpendService,ir as SpendStore,wu as URGENT_SPEND_EVENTS,xl as USER_VISIBLE_ACTIONS,ha as aggregateDeltas,xi as anomalyOptionsForSignal,Eu as assertSpendAllows,rr as budgetWindow,Au as compositeSpendTransport,Na as createEnforcementHandlers,Ol as detectAnomalies,Ca as detectLatestAnomaly,Sa as evaluateBudget,bu as ewma,Nl as findMapping,Pl as findPriceEntry,J as formatCents,Gn as formatTimeToExhaustion,ki as governingLimitCents,Ko as handleSpendRequest,Wn as hourBucket,Su as hourBucketsBetween,wa as isOperationAllowed,Pi as isValidTimeZone,Aa as lookbackHoursForSignal,Fo as median,_l as medianAbsoluteDeviation,ba as mergeDecisions,hu as mergePriceBooks,fa as meterTelemetry,qo as optionsForSignal,Bo as percentOfLimit,va as planEnforcement,yu as previousBudgetWindow,Lo as priceUsage,gu as priceUsageLines,ya as projectSpend,$l as robustZScore,fu as roundCents,Ml as routeMatches,Ta as runEnforcement,nr as scopeKey,Vo as signalDefinition,Fl as spendNotificationText,Jo as spendOpenApiPaths,Go as startSpendLoop,vu as streamFocusJsonl,Ea as strongestActiveAction,ua as tieredMicroCents,Ho as toFocusJsonl,Ia as toFocusRecords,kl as usageDeltaKey,Fr as utcInstantOfLocal,Tu as zeroFill,ma as zoneOffsetMs,Mo as zonedParts};

package/dist/bin/{chunk-1wvrtg42.js → chunk-raj6j2j5.js}

@@ -1,4 +1,4 @@
-import{h}from"./chunk-wr6a423y.js";var y=(e)=>e==null?void 0:String(e),w=(e)=>Number(e)===1,C=(e,r)=>{try{return e==null?r:JSON.parse(String(e))}catch{return r}};function b(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),scope:{type:String(e.scope_type),id:String(e.scope_id),environmentId:y(e.environment_id),resourceId:y(e.resource_id),previewId:y(e.preview_id)},key:String(e.key),kind:String(e.kind),value:y(e.value),valueFingerprint:String(e.value_fingerprint),secretRef:y(e.secret_ref),backend:String(e.backend),backendVersion:y(e.backend_version),origin:String(e.origin),required:w(e.required),metadata:C(e.metadata,{}),lastUsedAt:y(e.last_used_at),rotatedAt:y(e.rotated_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function I(e){return{entryId:String(e.entry_id),resourceId:String(e.resource_id),injectionTarget:String(e.injection_target),required:w(e.required),requiresRedeploy:w(e.requires_redeploy),lastDeployedVersion:e.last_deployed_version==null?void 0:Number(e.last_deployed_version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class hr{controlPlane;now;constructor(e,r=()=>new Date){this.controlPlane=e;this.now=r}get(e){let r=this.controlPlane.database.query("SELECT * FROM configuration_entries WHERE id=?").get(e);return r?b(r):void 0}find(e,r,n){let t=this.controlPlane.database.query("SELECT * FROM configuration_entries WHERE project_id=? AND scope_type=? AND scope_id=? AND key=?").get(e,r.type,r.id,n);return t?b(t):void 0}list(e){let r=["project_id=?"],n=[e.projectId];if(e.scope)r.push("scope_type=?","scope_id=?"),n.push(e.scope.type,e.scope.id);if(e.kind)r.push("kind=?"),n.push(e.kind);return this.controlPlane.database.query(`SELECT * FROM configuration_entries WHERE ${r.join(" AND ")} ORDER BY key,scope_type,scope_id`).all(...n).map(b)}create(e){this.validateScope(e),this.validateEntry(e);let r=crypto.randomUUID(),n=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_entries (id,organization_id,project_id,scope_type,scope_id,environment_id,resource_id,preview_id,key,kind,value,value_fingerprint,secret_ref,backend,backend_version,origin,required,metadata,last_used_at,rotated_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.organizationId,e.projectId,e.scope.type,e.scope.id,e.scope.environmentId??null,e.scope.resourceId??null,e.scope.previewId??null,e.key,e.kind,e.value??null,e.valueFingerprint,e.secretRef??null,e.backend,e.backendVersion??null,e.origin,e.required?1:0,JSON.stringify(e.metadata),e.lastUsedAt??null,e.rotatedAt??null,1,n,n]),this.get(r)}update(e,r,n){let t=this.get(e);if(!t)throw Error("Configuration entry was not found.");if(this.validateEntry({...t,...n}),this.controlPlane.database.run("UPDATE configuration_entries SET value=?,value_fingerprint=?,secret_ref=?,backend=?,backend_version=?,required=?,metadata=?,rotated_at=?,version=version+1,updated_at=? WHERE id=? AND version=?",[n.value??null,n.valueFingerprint,n.secretRef??null,n.backend,n.backendVersion??null,n.required?1:0,JSON.stringify(n.metadata),n.rotatedAt??null,this.now().toISOString(),e,r]).changes!==1)throw Error("Configuration entry changed; refresh and retry.");return this.get(e)}remove(e,r){let n=this.get(e);if(!n)throw Error("Configuration entry was not found.");if(n.version!==r)throw Error("Configuration entry changed; refresh and retry.");if(this.controlPlane.database.run("DELETE FROM configuration_entries WHERE id=? AND version=?",[e,r]).changes<1)throw Error("Configuration entry changed; refresh and retry.");return n}setDependency(e){let r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_dependencies (entry_id,resource_id,injection_target,required,requires_redeploy,last_deployed_version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?) ON CONFLICT(entry_id,resource_id) DO UPDATE SET injection_target=excluded.injection_target,required=excluded.required,requires_redeploy=excluded.requires_redeploy,last_deployed_version=excluded.last_deployed_version,updated_at=excluded.updated_at",[e.entryId,e.resourceId,e.injectionTarget,e.required?1:0,e.requiresRedeploy?1:0,e.lastDeployedVersion??null,r,r]),this.dependencies(e.entryId).find((n)=>n.resourceId===e.resourceId)}dependencies(e){return this.controlPlane.database.query("SELECT * FROM configuration_dependencies WHERE entry_id=? ORDER BY resource_id").all(e).map(I)}dependenciesForResource(e){return this.controlPlane.database.query("SELECT * FROM configuration_dependencies WHERE resource_id=? ORDER BY entry_id").all(e).map(I)}mutation(e){let r=this.controlPlane.database.query("SELECT request_hash,result FROM configuration_mutations WHERE idempotency_key=?").get(e);return r?{requestHash:r.request_hash,result:C(r.result,{})}:void 0}recordMutation(e){this.controlPlane.database.run("INSERT INTO configuration_mutations (id,project_id,idempotency_key,request_hash,result,actor_id,created_at) VALUES (?,?,?,?,?,?,?)",[crypto.randomUUID(),e.projectId,e.idempotencyKey,e.requestHash,JSON.stringify(e.result),e.actorId??null,this.now().toISOString()])}validateEntry(e){if(!/^[A-Za-z_][A-Za-z0-9_]{0,255}$/.test(e.key))throw Error(`Invalid configuration key: ${e.key}`);if(e.kind==="variable"&&(e.value==null||e.secretRef||e.backend!=="plaintext"))throw Error("Variables require a plaintext value and cannot use a secret backend.");if(e.kind==="secret"&&(e.value!=null||!e.secretRef||e.backend==="plaintext"))throw Error("Secrets require a non-plaintext backend reference and cannot store a plaintext value.")}validateScope(e){let r=this.controlPlane.getProject(e.projectId);if(!r||r.organizationId!==e.organizationId)throw Error("Configuration project does not belong to the organization.");let n=e.scope;if(n.type==="project"){if(n.id!==e.projectId||n.environmentId||n.resourceId||n.previewId)throw Error("Project configuration scope must reference only its project.");return}if(n.type==="environment"){let i=this.controlPlane.database.query("SELECT project_id FROM environments WHERE id=?").get(n.id);if(!i||i.project_id!==e.projectId||n.environmentId&&n.environmentId!==n.id||n.resourceId||n.previewId)throw Error("Environment configuration scope does not belong to the project.");return}if(n.type==="service"||n.type==="function"){let i=this.controlPlane.getResource(n.id);if(!i||i.projectId!==e.projectId||n.type==="function"&&i.kind!=="function"||n.resourceId&&n.resourceId!==n.id||n.environmentId&&i.environmentId!==n.environmentId||n.previewId)throw Error(`${n.type==="function"?"Function":"Service"} configuration scope does not belong to the project.`);return}let t=this.controlPlane.database.query("SELECT project_id,base_environment_id,resource_id FROM preview_instances WHERE id=?").get(n.id);if(!t||t.project_id!==e.projectId||n.previewId&&n.previewId!==n.id||n.environmentId&&n.environmentId!==t.base_environment_id||n.resourceId&&n.resourceId!==t.resource_id)throw Error("Preview configuration scope does not belong to the project.")}}var E=/^[A-Za-z_][A-Za-z0-9_]{0,255}$/;function j(e){let r={n:`
+import{h}from"./chunk-gd4w6bht.js";var y=(e)=>e==null?void 0:String(e),w=(e)=>Number(e)===1,C=(e,r)=>{try{return e==null?r:JSON.parse(String(e))}catch{return r}};function b(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),scope:{type:String(e.scope_type),id:String(e.scope_id),environmentId:y(e.environment_id),resourceId:y(e.resource_id),previewId:y(e.preview_id)},key:String(e.key),kind:String(e.kind),value:y(e.value),valueFingerprint:String(e.value_fingerprint),secretRef:y(e.secret_ref),backend:String(e.backend),backendVersion:y(e.backend_version),origin:String(e.origin),required:w(e.required),metadata:C(e.metadata,{}),lastUsedAt:y(e.last_used_at),rotatedAt:y(e.rotated_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function I(e){return{entryId:String(e.entry_id),resourceId:String(e.resource_id),injectionTarget:String(e.injection_target),required:w(e.required),requiresRedeploy:w(e.requires_redeploy),lastDeployedVersion:e.last_deployed_version==null?void 0:Number(e.last_deployed_version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class hr{controlPlane;now;constructor(e,r=()=>new Date){this.controlPlane=e;this.now=r}get(e){let r=this.controlPlane.database.query("SELECT * FROM configuration_entries WHERE id=?").get(e);return r?b(r):void 0}find(e,r,n){let t=this.controlPlane.database.query("SELECT * FROM configuration_entries WHERE project_id=? AND scope_type=? AND scope_id=? AND key=?").get(e,r.type,r.id,n);return t?b(t):void 0}list(e){let r=["project_id=?"],n=[e.projectId];if(e.scope)r.push("scope_type=?","scope_id=?"),n.push(e.scope.type,e.scope.id);if(e.kind)r.push("kind=?"),n.push(e.kind);return this.controlPlane.database.query(`SELECT * FROM configuration_entries WHERE ${r.join(" AND ")} ORDER BY key,scope_type,scope_id`).all(...n).map(b)}create(e){this.validateScope(e),this.validateEntry(e);let r=crypto.randomUUID(),n=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_entries (id,organization_id,project_id,scope_type,scope_id,environment_id,resource_id,preview_id,key,kind,value,value_fingerprint,secret_ref,backend,backend_version,origin,required,metadata,last_used_at,rotated_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.organizationId,e.projectId,e.scope.type,e.scope.id,e.scope.environmentId??null,e.scope.resourceId??null,e.scope.previewId??null,e.key,e.kind,e.value??null,e.valueFingerprint,e.secretRef??null,e.backend,e.backendVersion??null,e.origin,e.required?1:0,JSON.stringify(e.metadata),e.lastUsedAt??null,e.rotatedAt??null,1,n,n]),this.get(r)}update(e,r,n){let t=this.get(e);if(!t)throw Error("Configuration entry was not found.");if(this.validateEntry({...t,...n}),this.controlPlane.database.run("UPDATE configuration_entries SET value=?,value_fingerprint=?,secret_ref=?,backend=?,backend_version=?,required=?,metadata=?,rotated_at=?,version=version+1,updated_at=? WHERE id=? AND version=?",[n.value??null,n.valueFingerprint,n.secretRef??null,n.backend,n.backendVersion??null,n.required?1:0,JSON.stringify(n.metadata),n.rotatedAt??null,this.now().toISOString(),e,r]).changes!==1)throw Error("Configuration entry changed; refresh and retry.");return this.get(e)}remove(e,r){let n=this.get(e);if(!n)throw Error("Configuration entry was not found.");if(n.version!==r)throw Error("Configuration entry changed; refresh and retry.");if(this.controlPlane.database.run("DELETE FROM configuration_entries WHERE id=? AND version=?",[e,r]).changes<1)throw Error("Configuration entry changed; refresh and retry.");return n}setDependency(e){let r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_dependencies (entry_id,resource_id,injection_target,required,requires_redeploy,last_deployed_version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?) ON CONFLICT(entry_id,resource_id) DO UPDATE SET injection_target=excluded.injection_target,required=excluded.required,requires_redeploy=excluded.requires_redeploy,last_deployed_version=excluded.last_deployed_version,updated_at=excluded.updated_at",[e.entryId,e.resourceId,e.injectionTarget,e.required?1:0,e.requiresRedeploy?1:0,e.lastDeployedVersion??null,r,r]),this.dependencies(e.entryId).find((n)=>n.resourceId===e.resourceId)}dependencies(e){return this.controlPlane.database.query("SELECT * FROM configuration_dependencies WHERE entry_id=? ORDER BY resource_id").all(e).map(I)}dependenciesForResource(e){return this.controlPlane.database.query("SELECT * FROM configuration_dependencies WHERE resource_id=? ORDER BY entry_id").all(e).map(I)}mutation(e){let r=this.controlPlane.database.query("SELECT request_hash,result FROM configuration_mutations WHERE idempotency_key=?").get(e);return r?{requestHash:r.request_hash,result:C(r.result,{})}:void 0}recordMutation(e){this.controlPlane.database.run("INSERT INTO configuration_mutations (id,project_id,idempotency_key,request_hash,result,actor_id,created_at) VALUES (?,?,?,?,?,?,?)",[crypto.randomUUID(),e.projectId,e.idempotencyKey,e.requestHash,JSON.stringify(e.result),e.actorId??null,this.now().toISOString()])}validateEntry(e){if(!/^[A-Za-z_][A-Za-z0-9_]{0,255}$/.test(e.key))throw Error(`Invalid configuration key: ${e.key}`);if(e.kind==="variable"&&(e.value==null||e.secretRef||e.backend!=="plaintext"))throw Error("Variables require a plaintext value and cannot use a secret backend.");if(e.kind==="secret"&&(e.value!=null||!e.secretRef||e.backend==="plaintext"))throw Error("Secrets require a non-plaintext backend reference and cannot store a plaintext value.")}validateScope(e){let r=this.controlPlane.getProject(e.projectId);if(!r||r.organizationId!==e.organizationId)throw Error("Configuration project does not belong to the organization.");let n=e.scope;if(n.type==="project"){if(n.id!==e.projectId||n.environmentId||n.resourceId||n.previewId)throw Error("Project configuration scope must reference only its project.");return}if(n.type==="environment"){let i=this.controlPlane.database.query("SELECT project_id FROM environments WHERE id=?").get(n.id);if(!i||i.project_id!==e.projectId||n.environmentId&&n.environmentId!==n.id||n.resourceId||n.previewId)throw Error("Environment configuration scope does not belong to the project.");return}if(n.type==="service"||n.type==="function"){let i=this.controlPlane.getResource(n.id);if(!i||i.projectId!==e.projectId||n.type==="function"&&i.kind!=="function"||n.resourceId&&n.resourceId!==n.id||n.environmentId&&i.environmentId!==n.environmentId||n.previewId)throw Error(`${n.type==="function"?"Function":"Service"} configuration scope does not belong to the project.`);return}let t=this.controlPlane.database.query("SELECT project_id,base_environment_id,resource_id FROM preview_instances WHERE id=?").get(n.id);if(!t||t.project_id!==e.projectId||n.previewId&&n.previewId!==n.id||n.environmentId&&n.environmentId!==t.base_environment_id||n.resourceId&&n.resourceId!==t.resource_id)throw Error("Preview configuration scope does not belong to the project.")}}var E=/^[A-Za-z_][A-Za-z0-9_]{0,255}$/;function j(e){let r={n:`
 `,r:"\r",t:"\t","\\":"\\",'"':'"',$:"$"};return e.replace(/\\(n|r|t|\\|"|\$)/g,(n,t)=>r[t])}function qa(e){let r={},n=[],t=e.replace(/\r\n?/g,`
 `).split(`
 `);for(let i=0;i<t.length;i++){let s=i+1,c=t[i];if(!c.trim()||c.trimStart().startsWith("#"))continue;if(/^\s*export\s+/.test(c))c=c.replace(/^\s*export\s+/,"");let u=c.match(/^\s*([^=\s]+)\s*=\s*(.*)$/);if(!u){n.push({line:s,severity:"error",code:"invalid_line",message:"Expected KEY=VALUE."});continue}let o=u[1],a=u[2];if(!E.test(o)){n.push({line:s,key:o,severity:"error",code:"invalid_key",message:`Invalid environment variable name: ${o}`});continue}let d=a;if(a.startsWith('"')||a.startsWith("'")){let g=a[0],l=[a.slice(1)],v=!1;while(!0){let f=l[l.length-1],m=!1,S=-1;for(let k=0;k<f.length;k++){if(g==='"'&&f[k]==="\\"&&!m){m=!0;continue}if(f[k]===g&&!m){S=k;break}m=!1}if(S>=0){l[l.length-1]=f.slice(0,S),v=!0;break}if(++i>=t.length)break;l.push(t[i])}if(!v){n.push({line:s,key:o,severity:"error",code:"unterminated_quote",message:`Unterminated quoted value for ${o}.`});continue}if(d=l.join(`

package/dist/bin/{chunk-3gwmejhk.js → chunk-s1j941z1.js}

@@ -1 +1 @@
-import{hr,qa,Ha,St,yr,Sr,br,vr,Yr}from"./chunk-1wvrtg42.js";import"./chunk-wr6a423y.js";import"./chunk-bj5nq0kn.js";export{yr as AwsSecretsManagerConfigurationBackend,Sr as AwsSsmConfigurationBackend,vr as ConfigurationService,hr as ConfigurationStore,br as ExternalConfigurationBackend,St as LocalEncryptedConfigurationBackend,qa as parseDotenv,Ha as serializeDotenv,Yr as synchronizeConfiguredConfiguration};
+import{hr,qa,Ha,St,yr,Sr,br,vr,Yr}from"./chunk-raj6j2j5.js";import"./chunk-gd4w6bht.js";import"./chunk-8tbj9h2a.js";export{yr as AwsSecretsManagerConfigurationBackend,Sr as AwsSsmConfigurationBackend,vr as ConfigurationService,hr as ConfigurationStore,br as ExternalConfigurationBackend,St as LocalEncryptedConfigurationBackend,qa as parseDotenv,Ha as serializeDotenv,Yr as synchronizeConfiguredConfiguration};

package/dist/bin/{chunk-fnr6k11h.js → chunk-sdwr2tnp.js}

@@ -1 +1 @@
-import{su,El,ta,ra,wl,au,cu,Vt,an,zt,vi,lu,cn,ko}from"./chunk-pt2bz3kr.js";import{We,us,Oa,ri,ps,_u}from"./chunk-z2ez8wn9.js";import{Hl,to,Wl,Gl,Kl,mr,$u,ro}from"./chunk-f35pte64.js";import{Js,Xs,Qs,dl,Ro,ul,pl,Ys,ml,gl}from"./chunk-bj5nq0kn.js";export{Xs as CHAIN_HEADER,an as DEFAULT_ATTACK_MODE_HOURS,Hl as DEFAULT_DDOS_THRESHOLDS,Ro as DEFAULT_RECURSION_LIMITS,Js as DEPTH_HEADER,Vt as MAX_CONTROL_HOURS,zt as ProtectionControlStore,su as RATE_LIMIT_KEY_SEPARATOR,wl as RateLimiter,Ys as RecursionGuard,Qs as TRACE_HEADER,cn as applyControlsToDdos,lu as applyControlsToRateLimits,ro as applyMitigationFactor,cu as defaultRateLimitRules,vi as describePosture,We as escapeSecLang,dl as functionFingerprint,El as globMatches,Oa as globToRegex,pl as inspectInvocation,us as isSafePattern,to as isValidCidr,ko as mergeControlsIntoConfig,ul as parseChain,$u as planMitigation,ml as propagationHeaders,au as rateLimitHeaders,ra as rateLimitKey,gl as recursionBlockedResponse,mr as renderDdosInstallScript,Kl as renderNftablesRuleset,Gl as renderSysctlFile,ri as renderWafConfig,ps as renderWafInstallScript,ta as ruleMatches,Wl as sysctlHardening,_u as wafEventTelemetry};
+import{su,El,ta,ra,wl,au,cu,Vt,an,zt,vi,lu,cn,ko}from"./chunk-pt2bz3kr.js";import{Ge,us,Oa,ri,ps,_u}from"./chunk-9k60q9qz.js";import{Hl,to,Wl,Gl,Kl,mr,$u,ro}from"./chunk-f35pte64.js";import{Js,Xs,Qs,dl,Ro,ul,pl,Ys,ml,gl}from"./chunk-8tbj9h2a.js";export{Xs as CHAIN_HEADER,an as DEFAULT_ATTACK_MODE_HOURS,Hl as DEFAULT_DDOS_THRESHOLDS,Ro as DEFAULT_RECURSION_LIMITS,Js as DEPTH_HEADER,Vt as MAX_CONTROL_HOURS,zt as ProtectionControlStore,su as RATE_LIMIT_KEY_SEPARATOR,wl as RateLimiter,Ys as RecursionGuard,Qs as TRACE_HEADER,cn as applyControlsToDdos,lu as applyControlsToRateLimits,ro as applyMitigationFactor,cu as defaultRateLimitRules,vi as describePosture,Ge as escapeSecLang,dl as functionFingerprint,El as globMatches,Oa as globToRegex,pl as inspectInvocation,us as isSafePattern,to as isValidCidr,ko as mergeControlsIntoConfig,ul as parseChain,$u as planMitigation,ml as propagationHeaders,au as rateLimitHeaders,ra as rateLimitKey,gl as recursionBlockedResponse,mr as renderDdosInstallScript,Kl as renderNftablesRuleset,Gl as renderSysctlFile,ri as renderWafConfig,ps as renderWafInstallScript,ta as ruleMatches,Wl as sysctlHardening,_u as wafEventTelemetry};