@stacksjs/ts-cloud 0.16.10 → 0.16.12

package/dist/chunk-6e967ybg.js

@@ -0,0 +1,2 @@
+import{n}from"./chunk-4w8d2mf0.js";import{y}from"./chunk-ndm0r1vb.js";var tt=new Set(["A","AAAA","CNAME"]);function x(e,t=""){return e===408||e===409||e===425||e===429||e>=500||/rate limit|temporar|timed? ?out|try again/i.test(t)}async function b(e,t){let r=t?.headers.get("retry-after"),s=r===null||r===void 0?void 0:Number(r)*1000,o=Number.isFinite(s)?Math.max(0,s):Math.min(1000*2**(e-1),30000);await new Promise((i)=>setTimeout(i,o))}class se{name="porkbun";apiKey;secretKey;requestTimeoutMs;constructor(e,t,r=15000){this.apiKey=e,this.secretKey=t,this.requestTimeoutMs=r}async request(e,t={}){let r;for(let s=1;s<=8;s+=1){let o,i=new AbortController,a=setTimeout(()=>{i.abort(Error(`Porkbun API request timed out after ${this.requestTimeoutMs}ms`))},this.requestTimeoutMs);try{o=await fetch(`https://api.porkbun.com/api/json/v3${e}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({apikey:this.apiKey,secretapikey:this.secretKey,...t}),signal:i.signal})}catch(d){if(r=d,s===8)throw d;await b(s);continue}finally{clearTimeout(a)}if(!o.ok){let d=await o.clone().json().then((u)=>u?.message).catch(()=>{return});if(r=Error(`Porkbun API error: ${o.status} ${o.statusText}${d?`: ${d}`:""}`),!x(o.status)||s===8)throw r;await b(s,o);continue}let c=await o.json();if(c.status==="ERROR"){if(r=Error(`Porkbun API error: ${c.message||"Unknown error"}`),!x(0,c.message)||s===8)throw r;await b(s,o);continue}return c}throw r}getSubdomain(e,t){let r=e.replace(/\.$/,""),s=t.replace(/\.$/,"");if(r===s)return"";if(r.endsWith(`.${s}`))return r.slice(0,-(s.length+1));return r}getRootDomain(e){let t=e.replace(/\.$/,"").split(".");if(t.length>=2)return t.slice(-2).join(".");return e}static ADDRESS_TYPES=new Set(["A","AAAA"]);async clearConflictingAliases(e,t){if(!se.ADDRESS_TYPES.has(t.type))return[];let r=this.getRootDomain(e),s=this.getSubdomain(t.name,r),o=await this.listRecords(e);if(!o.success)return[`could not list records to clear ALIAS/CNAME conflicts: ${o.message??"unknown provider error"}`];let i=[];for(let a of o.records){if(a.type!=="ALIAS"&&a.type!=="CNAME")continue;if(this.getSubdomain(a.name,r)!==s)continue;let c=await this.deleteRecord(e,a);if(!c.success)i.push(`could not remove conflicting ${a.type} on ${a.name}: ${c.message??"unknown provider error"}`)}return i}async addressRecordExists(e,t){let r=this.getRootDomain(e),s=this.getSubdomain(t.name,r),o=await this.listRecords(e);if(!o.success)return!0;return o.records.some((i)=>i.type===t.type&&this.getSubdomain(i.name,r)===s&&i.content===t.content)}async createRecord(e,t){try{let r=this.getRootDomain(e),s=this.getSubdomain(t.name,r),o={type:t.type,content:t.content,ttl:String(t.ttl||600)};if(s)o.name=s;if((t.type==="MX"||t.type==="SRV")&&t.priority!==void 0)o.prio=String(t.priority);if(t.type==="SRV"&&t.weight!==void 0&&t.port!==void 0)o.content=`${t.weight} ${t.port} ${t.content}`;let i=await this.clearConflictingAliases(e,t),a=await this.request(`/dns/create/${r}`,o);if(se.ADDRESS_TYPES.has(t.type)&&!await this.addressRecordExists(e,t))return{success:!1,message:`Porkbun reported success but no ${t.type} record for ${t.name} exists${i.length>0?` (${i.join("; ")})`:""}. A conflicting ALIAS/CNAME on the same name silently voids the write.`};return{success:!0,id:a.id?.toString(),message:"Record created successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async upsertRecord(e,t){try{let r=this.getRootDomain(e),s=this.getSubdomain(t.name,r),o=await this.listRecords(e);if(o.success){let i=o.records.find((a)=>this.getSubdomain(a.name,r)===s&&a.type===t.type);if(i?.id&&i.content===t.content&&(t.ttl===void 0||i.ttl===t.ttl)&&(t.type!=="MX"&&t.type!=="SRV"||t.priority===void 0||i.priority===t.priority))return{success:!0,id:i.id,message:"Record already up to date"};if(i?.id){let a={type:t.type,content:t.content,ttl:String(t.ttl||600)};if(s)a.name=s;if((t.type==="MX"||t.type==="SRV")&&t.priority!==void 0)a.prio=String(t.priority);if(t.type==="SRV"&&t.weight!==void 0&&t.port!==void 0)a.content=`${t.weight} ${t.port} ${t.content}`;return await this.request(`/dns/edit/${r}/${i.id}`,a),{success:!0,id:i.id,message:"Record updated successfully"}}}return this.createRecord(e,t)}catch(r){return this.createRecord(e,t)}}async deleteRecord(e,t){try{let r=this.getRootDomain(e);if("id"in t&&t.id)return await this.request(`/dns/delete/${r}/${t.id}`),{success:!0,message:"Record deleted successfully"};let s=this.getSubdomain(t.name,r),o=await this.listRecords(e);if(!o.success)return{success:!1,message:"Failed to list records"};let i=o.records.find((a)=>this.getSubdomain(a.name,r)===s&&a.type===t.type&&a.content===t.content);if(!i?.id)return{success:!1,message:"Record not found"};return await this.request(`/dns/delete/${r}/${i.id}`),{success:!0,message:"Record deleted successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async listRecords(e,t){try{let r=this.getRootDomain(e),s=`/dns/retrieve/${r}`;if(t)s=`/dns/retrieveByNameType/${r}/${t}`;return{success:!0,records:((await this.request(s)).records||[]).map((a)=>({id:a.id,name:a.name||r,type:a.type,content:a.content,ttl:Number.parseInt(a.ttl,10),priority:a.prio?Number.parseInt(a.prio,10):void 0}))}}catch(r){return{success:!1,records:[],message:r instanceof Error?r.message:"Unknown error"}}}async canManageDomain(e){try{let t=this.getRootDomain(e);return await this.request(`/dns/retrieve/${t}`),!0}catch{return!1}}async listDomains(){try{return((await this.request("/domain/listAll")).domains||[]).map((t)=>t.domain)}catch{return[]}}async getNameServers(e){try{let t=this.getRootDomain(e);return(await this.request(`/domain/getNs/${t}`)).ns||[]}catch{return[]}}async updateNameServers(e,t){try{let r=this.getRootDomain(e);return await this.request(`/domain/updateNs/${r}`,{ns:t}),!0}catch{return!1}}}class xe{name="godaddy";apiKey;apiSecret;baseUrl;constructor(e,t="",r="production"){this.apiKey=e,this.apiSecret=t,this.baseUrl=r==="ote"?"https://api.ote-godaddy.com":"https://api.godaddy.com"}authorization(){if(!this.apiSecret||this.apiKey.startsWith("gd_pat_"))return`Bearer ${this.apiKey}`;return`sso-key ${this.apiKey}:${this.apiSecret}`}async request(e,t,r){let s=`${this.baseUrl}${t}`,o={Authorization:this.authorization(),"Content-Type":"application/json",Accept:"application/json"},i={method:e,headers:o};if(r)i.body=JSON.stringify(r);let a=await fetch(s,i);if(a.status===204)return{};if(a.ok){let d=await a.text();if(d)return JSON.parse(d);return{}}let c=`GoDaddy API error: ${a.status} ${a.statusText}`;try{let d=await a.json();if(d.message)c=`GoDaddy API error: ${d.message}`;if(d.fields)c+=` - Fields: ${JSON.stringify(d.fields)}`}catch{}throw Error(c)}getSubdomain(e,t){let r=e.replace(/\.$/,""),s=t.replace(/\.$/,"");if(r===s)return"@";if(r.endsWith(`.${s}`))return r.slice(0,-(s.length+1));return r}getRootDomain(e){let t=e.replace(/\.$/,"").split(".");if(t.length>=2)return t.slice(-2).join(".");return e}toGoDaddyRecord(e,t){let r=this.getRootDomain(t),s=this.getSubdomain(e.name,r),o={type:e.type,name:s,data:e.content,ttl:e.ttl||600};if(e.type==="MX"&&e.priority!==void 0)o.priority=e.priority;return o}fromGoDaddyRecord(e,t){let r=this.getRootDomain(t),s=e.name;if(s==="@")s=r;else if(!s.endsWith(r))s=`${s}.${r}`;return{name:s,type:e.type,content:e.data,ttl:e.ttl,priority:e.priority}}async createRecord(e,t){try{let r=this.getRootDomain(e),s=this.toGoDaddyRecord(t,e);return await this.request("PATCH",`/v1/domains/${r}/records`,[s]),{success:!0,message:"Record created successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async upsertRecord(e,t){try{let r=this.getRootDomain(e),s=this.toGoDaddyRecord(t,e);return await this.request("PUT",`/v1/domains/${r}/records/${t.type}/${s.name}`,[s]),{success:!0,message:"Record upserted successfully"}}catch(r){return this.createRecord(e,t)}}async deleteRecord(e,t){try{let r=this.getRootDomain(e),s=this.getSubdomain(t.name,r),o=await this.request("GET",`/v1/domains/${r}/records/${t.type}/${s}`),i=o.filter((a)=>a.data!==t.content);if(i.length===o.length)return{success:!1,message:"Record not found"};if(i.length===0)try{await this.request("DELETE",`/v1/domains/${r}/records/${t.type}/${s}`)}catch{}else await this.request("PUT",`/v1/domains/${r}/records/${t.type}/${s}`,i);return{success:!0,message:"Record deleted successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async listRecords(e,t){try{let r=this.getRootDomain(e),s=`/v1/domains/${r}/records`;if(t)s=`/v1/domains/${r}/records/${t}`;return{success:!0,records:(await this.request("GET",s)).map((i)=>this.fromGoDaddyRecord(i,e))}}catch(r){return{success:!1,records:[],message:r instanceof Error?r.message:"Unknown error"}}}async canManageDomain(e){try{let t=this.getRootDomain(e);return await this.request("GET",`/v1/domains/${t}`),!0}catch{return!1}}async listDomains(){try{return(await this.request("GET","/v1/domains")).map((t)=>t.domain)}catch{return[]}}async getDomainDetails(e){try{let t=this.getRootDomain(e),r=await this.request("GET",`/v1/domains/${t}`);return{domain:r.domain,status:r.status,nameServers:r.nameServers,expires:r.expires}}catch{return null}}async getNameServers(e){return(await this.getDomainDetails(e))?.nameServers??[]}async updateNameServers(e,t){try{let r=this.getRootDomain(e);return await this.request("PATCH",`/v1/domains/${r}`,{nameServers:t}),!0}catch{return!1}}async checkDomainAvailability(e){try{let t=await this.request("GET",`/v1/domains/available?domain=${encodeURIComponent(e)}`);return{available:t.available,price:t.price,currency:t.currency}}catch{return{available:!1}}}}var O="https://api.cloudflare.com/client/v4",ts="[ts-cloud]";class fe{name="cloudflare";apiToken;zoneCache=new Map;configuredZoneId;accountId;configuredZoneName;constructor(e,t={}){this.apiToken=e,this.configuredZoneId=t.zoneId,this.accountId=t.accountId}async request(e,t,r){let s=`${O}${t}`,o={Authorization:`Bearer ${this.apiToken}`,"Content-Type":"application/json"},i={method:e,headers:o};if(r)i.body=JSON.stringify(r);let c=await(await fetch(s,i)).json();if(!c.success){let d=c.errors.map((u)=>u.message).join(", ");throw Error(`Cloudflare API error: ${d}`)}return c}getRootDomain(e){let t=e.replace(/\.$/,"").split(".");if(t.length>=2)return t.slice(-2).join(".");return e}async resolveZone(e){let t=e.replace(/\.$/,"").toLowerCase();if(this.configuredZoneId){let a=await this.resolveConfiguredZoneName();if(a&&(t===a||t.endsWith(`.${a}`)))return{id:this.configuredZoneId,name:a}}let r=this.getRootDomain(t),s=this.zoneCache.get(r);if(s)return{id:s,name:r};let o=await this.request("GET",`/zones?name=${encodeURIComponent(r)}`);if(!o.result||o.result.length===0)throw Error(`Zone not found for domain: ${r}. `+"If the API token is scoped to a single zone, set its zone id (CLOUDFLARE_ZONE_ID) — "+"zone lookup by name needs account-wide Zone:Read.");let i=o.result[0].id;return this.zoneCache.set(r,i),{id:i,name:o.result[0].name||r}}async resolveConfiguredZoneName(){if(!this.configuredZoneId)return;if(this.configuredZoneName)return this.configuredZoneName;try{let t=(await this.request("GET",`/zones/${this.configuredZoneId}`)).result?.name?.toLowerCase();if(!t)return;return this.configuredZoneName=t,this.zoneCache.set(t,this.configuredZoneId),t}catch{return}}async getZoneId(e){return(await this.resolveZone(e)).id}getFullRecordName(e,t){let r=e.replace(/\.$/,"");if(!r||r===t||r==="@")return t;if(r.endsWith(`.${t}`))return r;return`${r}.${t}`}toCloudflareRecord(e,t,r){let s={type:e.type,name:this.getFullRecordName(e.name,t),content:e.content||e.value||"",ttl:e.ttl||1},o=r??e.proxied;if(o!==void 0&&tt.has(e.type)){if(s.proxied=o,o)s.ttl=1}if(e.type==="MX"&&e.priority!==void 0)s.priority=e.priority;if(e.type==="SRV"){let i=L(e);if(i)s.data=i,delete s.content,delete s.priority;else if(e.priority!==void 0)s.priority=e.priority}return s}fromCloudflareRecord(e){return{id:e.id,name:e.name,type:e.type,content:e.content,ttl:e.ttl,priority:e.priority,proxied:e.proxied}}async createRecord(e,t){try{let r=await this.resolveZone(e),s=this.toCloudflareRecord(t,r.name);return{success:!0,id:(await this.request("POST",`/zones/${r.id}/dns_records`,s)).result.id,message:"Record created successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async upsertRecord(e,t){try{let r=await this.resolveZone(e),s=this.getFullRecordName(t.name,r.name),i=(await this.request("GET",`/zones/${r.id}/dns_records?type=${t.type}&name=${encodeURIComponent(s)}`)).result?.[0],a=t.proxied??i?.proxied,c=this.toCloudflareRecord(t,r.name,a);if(i)return{success:!0,id:(await this.request("PUT",`/zones/${r.id}/dns_records/${i.id}`,c)).result.id,message:"Record updated successfully"};return{success:!0,id:(await this.request("POST",`/zones/${r.id}/dns_records`,c)).result.id,message:"Record created successfully"}}catch(r){return this.createRecord(e,t)}}async deleteRecord(e,t){try{let r=await this.resolveZone(e),s=r.id,o=this.getFullRecordName(t.name,r.name),i=await this.request("GET",`/zones/${s}/dns_records?type=${t.type}&name=${encodeURIComponent(o)}`);if(!i.result||i.result.length===0)return{success:!1,message:"Record not found"};let a=i.result.find((c)=>c.content===t.content);if(!a)return{success:!1,message:"Record with matching content not found"};return await this.request("DELETE",`/zones/${s}/dns_records/${a.id}`),{success:!0,message:"Record deleted successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async listRecords(e,t){try{let s=`/zones/${await this.getZoneId(e)}/dns_records?per_page=100`;if(t)s+=`&type=${t}`;let o=[],i=1,a=!0;while(a){let c=await this.request("GET",`${s}&page=${i}`);if(o.push(...c.result||[]),c.result_info)a=i<c.result_info.total_pages,i++;else a=!1}return{success:!0,records:o.map((c)=>this.fromCloudflareRecord(c))}}catch(r){return{success:!1,records:[],message:r instanceof Error?r.message:"Unknown error"}}}async canManageDomain(e){try{return await this.getZoneId(e),!0}catch{return!1}}async listDomains(){try{let e=[],t=1,r=!0;while(r){let s=await this.request("GET",`/zones?per_page=50&page=${t}`);if(e.push(...s.result||[]),s.result_info)r=t<s.result_info.total_pages,t++;else r=!1}return e.map((s)=>s.name)}catch{return[]}}async createZone(e,t={}){let r=e.replace(/\.$/,"").toLowerCase(),s=t.accountId??this.accountId;if(!s)throw Error(`Cannot create zone ${r}: no Cloudflare account id. Set CLOUDFLARE_ACCOUNT_ID, or pass accountId.`);let o=await this.getZoneDetails(r);if(o)return{...o,created:!1};try{let a=(await this.request("POST","/zones",{name:r,account:{id:s},jump_start:t.jumpStart??!1})).result;return this.zoneCache.set(a.name,a.id),{id:a.id,name:a.name,status:a.status,nameServers:a.name_servers??[],created:!0}}catch(i){let a=i instanceof Error?i.message:String(i);if(!/already exists|1061/i.test(a))throw i;let c=await this.getZoneDetails(r);if(!c)throw i;return{...c,created:!1}}}async getZoneDetails(e){try{let t=await this.getZoneId(e),r=await this.request("GET",`/zones/${t}`);return{id:r.result.id,name:r.result.name,status:r.result.status,nameServers:r.result.name_servers,paused:r.result.paused}}catch{return null}}async listEdgeCertificateHosts(e){try{let t=await this.getZoneId(e),r=await this.request("GET",`/zones/${t}/ssl/certificate_packs?per_page=50`),s=new Set;for(let o of r.result||[]){if(o.status!=="active")continue;for(let i of o.hosts||[])s.add(i.toLowerCase())}return[...s]}catch{return null}}async purgeCache(e,t){try{let r=await this.getZoneId(e),s={};if(t?.purgeEverything)s.purge_everything=!0;else{if(t?.files)s.files=t.files;if(t?.tags)s.tags=t.tags;if(t?.hosts)s.hosts=t.hosts}if(Object.keys(s).length===0)s.purge_everything=!0;return await this.request("POST",`/zones/${r}/purge_cache`,s),!0}catch{return!1}}async getRecordProxyStatus(e,t){try{let r=await this.resolveZone(e),s=r.id,o=this.getFullRecordName(t.name,r.name),i=await this.request("GET",`/zones/${s}/dns_records?type=${t.type}&name=${encodeURIComponent(o)}`);if(i.result&&i.result.length>0)return i.result.find((c)=>c.content===t.content)?.proxied??null;return null}catch{return null}}async setRecordProxyStatus(e,t,r){try{let s=await this.resolveZone(e),o=s.id,i=this.getFullRecordName(t.name,s.name),a=await this.request("GET",`/zones/${o}/dns_records?type=${t.type}&name=${encodeURIComponent(i)}`);if(!a.result||a.result.length===0)return!1;let c=a.result.find((d)=>d.content===t.content);if(!c)return!1;return await this.request("PATCH",`/zones/${o}/dns_records/${c.id}`,{proxied:r}),!0}catch{return!1}}async zoneIdFor(e){return this.getZoneId(e)}get account(){return this.accountId}async getZoneSettings(e){let t=await this.getZoneId(e),r=await this.request("GET",`/zones/${t}/settings`),s={};for(let o of r.result||[])s[o.id]=o.value;return s}async applyZoneSettings(e,t){let r=await this.getZoneId(e),s=await this.getZoneSettings(e).catch(()=>({})),o=[],i=[];for(let[a,c]of Object.entries(t)){if(c===void 0)continue;let d=s[a];if(d!==void 0&&I(d,c))continue;try{await this.request("PATCH",`/zones/${r}/settings/${a}`,{value:c}),o.push({id:a,from:d,to:c})}catch(u){i.push({id:a,error:u instanceof Error?u.message:String(u)})}}return{changed:o,failed:i}}async getManagedRequestHeaders(e){let t=await this.getZoneId(e),r=await this.request("GET",`/zones/${t}/managed_headers`),s={};for(let o of r.result?.managed_request_headers||[])s[o.id]=o.enabled===!0;return s}async applyManagedRequestHeaders(e,t){let r=[],s=[],o=Object.entries(t).filter(([,d])=>d!==void 0);if(o.length===0)return{changed:r,failed:s};let i=await this.getZoneId(e),a;try{a=await this.getManagedRequestHeaders(e)}catch(d){let u=d instanceof Error?d.message:String(d);for(let[p]of o)s.push({id:p,error:`could not read managed headers — ${u}`});return{changed:r,failed:s}}let c=[];for(let[d,u]of o){if(!(d in a)){s.push({id:d,error:"not a managed request header transform on this zone"});continue}if(a[d]!==u)c.push([d,u])}if(c.length===0)return{changed:r,failed:s};try{await this.request("PATCH",`/zones/${i}/managed_headers`,{managed_request_headers:c.map(([d,u])=>({id:d,enabled:u})),managed_response_headers:[]});for(let[d,u]of c)r.push({id:d,from:a[d],to:u})}catch(d){let u=d instanceof Error?d.message:String(d);for(let[p]of c)s.push({id:p,error:u})}return{changed:r,failed:s}}async getPhaseRules(e,t){let r=await this.getZoneId(e);try{return(await this.request("GET",`/zones/${r}/rulesets/phases/${t}/entrypoint`)).result?.rules||[]}catch{return[]}}async putManagedPhaseRules(e,t,r){try{let s=await this.getZoneId(e),o=await this.getPhaseRules(e,t),i=new Set(r.flatMap((u)=>k(u.expression))),a=o.filter((u)=>{if(!(u.description||"").startsWith(ts))return!0;let p=k(u.expression);if(p.length===0)return i.size>0;return!p.some((m)=>i.has(m))}),c=r.map((u)=>({...u,description:u.description?.startsWith(ts)?u.description:`${ts} ${u.description||t}`})),d=[...a,...c].map(({id:u,...p})=>p);return await this.request("PUT",`/zones/${s}/rulesets/phases/${t}/entrypoint`,{rules:d}),{success:!0}}catch(s){return{success:!1,message:s instanceof Error?s.message:String(s)}}}}function k(e){let t=[];for(let r of e.matchAll(/http\.host eq "([^"]+)"/g))t.push(r[1]);for(let r of e.matchAll(/http\.host in \{([^}]*)\}/g))for(let s of r[1].matchAll(/"([^"]+)"/g))t.push(s[1]);return t}function I(e,t){if(e===t)return!0;if(typeof e!==typeof t||e===null||t===null)return!1;if(typeof e!=="object")return!1;if(Array.isArray(e)||Array.isArray(t)){if(!Array.isArray(e)||!Array.isArray(t)||e.length!==t.length)return!1;return e.every((o,i)=>I(o,t[i]))}let r=e,s=t;return Object.keys(s).every((o)=>I(r[o],s[o]))}function L(e){let t=(e.content||e.value||"").trim();if(e.weight!==void 0&&e.port!==void 0&&e.priority!==void 0&&t)return{priority:e.priority,weight:e.weight,port:e.port,target:_(t)};let r=t.split(/\s+/);if(r.length<4)return null;let[s,o,i]=r.slice(0,3).map(Number);if(![s,o,i].every(Number.isFinite))return null;return{priority:s,weight:o,port:i,target:_(r.slice(3).join(" "))}}function _(e){return e.replace(/\.$/,"")}var U=new Set(["A","AAAA","CNAME","ALIAS"]);function Tt(e){let t=e.trim().replace(/^"|"$/g,"").toLowerCase();if(t.startsWith("v=spf1"))return"v=spf1";if(t.startsWith("v=dmarc1"))return"v=dmarc1";return}function R(e){return e.trim().replace(/^"(.*)"$/s,"$1")}function v(e){return e.replace(/\.$/,"").toLowerCase()}function hn(e,t){let r=v(t),s=(e??"@").trim();if(!s||s==="@")return r;let o=v(s);if(o===r||o.endsWith(`.${r}`))return o;return`${o}.${r}`}function rs(e,t){return e.map((r)=>({...r,name:hn(r.name,t),proxied:r.proxied??!1}))}function q(e,t){if(e.type!==t.type)return!1;if(v(e.name)!==v(t.name))return!1;if(U.has(t.type))return!0;if(t.type==="TXT"){let r=Tt(t.content);if(r)return Tt(R(e.content))===r;return R(e.content)===R(t.content)}return R(e.content)===R(t.content)}function j(e,t){if(R(e.content)!==R(t.content))return!1;if(t.priority!==void 0&&e.priority!==t.priority)return!1;if(t.proxied!==void 0&&e.proxied!==void 0&&e.proxied!==t.proxied)return!1;return!0}async function ns(e){let{provider:t,zone:r,records:s}=e,o={outcomes:[],warnings:[]};if(s.length===0)return o;let i=await t.listRecords(r);if(!i.success)return o.warnings.push(`could not list ${r}: ${i.message||"unknown provider error"} — records not reconciled`),o;let a=i.records;for(let c of s){let d=a.filter((g)=>q(g,c));if(d.length>0&&d.every((g)=>j(g,c))){o.outcomes.push({record:c,action:"unchanged"});continue}let u={name:c.name,type:c.type,content:c.content,ttl:c.ttl??3600,...c.priority!==void 0?{priority:c.priority}:{},...c.proxied!==void 0?{proxied:c.proxied}:{}},p=c.type==="TXT"&&Tt(c.content)!==void 0;if(p)for(let g of d){let w=await t.deleteRecord(r,{name:g.name,type:g.type,content:g.content});if(!w.success)o.warnings.push(`could not remove superseded ${g.type} at ${g.name}: ${w.message||"unknown error"}`)}let m=p||d.length===0?await t.createRecord(r,u):await t.upsertRecord(r,u);if(m.success)o.outcomes.push({record:c,action:d.length>0?"updated":"created"});else o.outcomes.push({record:c,action:"failed",message:m.message})}for(let c of["MX"]){let d=new Set(s.filter((u)=>u.type===c).map((u)=>v(u.name)));for(let u of d){let p=new Set(s.filter((g)=>g.type===c&&v(g.name)===u).map((g)=>R(g.content).toLowerCase())),m=a.filter((g)=>g.type===c&&v(g.name)===u&&!p.has(R(g.content).toLowerCase()));for(let g of m)o.warnings.push(`${u} has an undeclared ${c} record (${g.content}) alongside the declared one — mail will be split between them. Remove it at the provider if it is stale.`)}}return o}function nr(e){if(!e||typeof e!=="object")return!1;let t=e;return typeof t.getNameServers==="function"&&typeof t.updateNameServers==="function"}function ir(e){return Boolean(e&&typeof e.createZone==="function")}var H=new Set(["NS"]);function D(e){return e.replace(/\.$/,"").toLowerCase()}function fn(e,t){if(e.length===0||t.length===0)return!1;let r=new Set(e.map(D)),s=new Set(t.map(D));if(r.size!==s.size)return!1;for(let o of r)if(!s.has(o))return!1;return!0}function F(e){let t=e.content.trim(),r=t.startsWith('"')&&t.endsWith('"')?t.slice(1,-1):t;return e.type==="TXT"?r:D(r)}var K=new Set(["MX","SRV"]),G=new Set(["A","AAAA","CNAME"]);function S(e){let t=K.has(e.type)&&e.priority!==void 0&&e.priority!==null?String(Number(e.priority)):"";return`${e.type}|${D(e.name)}|${F(e)}|${t}`}function W(e,t){return S(e)===S(t)}async function sr(e){let{domain:t,registrar:r,host:s,dryRun:o=!1}=e,i=new Set([...e.proxiedHosts??[]].map(D)),a=[],c=await s.createZone(t,{accountId:e.accountId,jumpStart:!1}),d=await r.getNameServers(t),u={status:"ready",domain:t,zoneId:c.id,targetNameservers:c.nameServers,currentNameservers:d,records:[],missing:[],warnings:a};if(fn(d,c.nameServers))return u.status="already-delegated",u;if(c.nameServers.length===0)return a.push(`${s.name} did not report nameservers for ${t}; cannot delegate.`),u.status="blocked",u;let p=await r.listRecords(t);if(!p.success)return a.push(`Could not read ${t} from ${r.name}: ${p.message??"unknown error"}`),u.status="blocked",u;let m=[];for(let l of p.records){if(H.has(l.type)){u.records.push({record:l,status:"skipped",reason:`${l.type} describes the delegation itself; ${s.name} owns it`});continue}let f=tt.has(l.type)&&i.has(D(l.name));m.push({name:l.name,type:l.type,content:l.content,ttl:l.ttl,priority:l.priority,...tt.has(l.type)?{proxied:f}:{}})}if(o){for(let l of m)u.records.push({record:l,status:"copied",reason:"dry run"});return u}let g=new Map;for(let l of m){let f=`${l.type}|${D(l.name)}`;g.set(f,(g.get(f)??0)+1)}let w=new Set;try{let l=await s.listRecords(t);for(let f of l.records??[])w.add(S(f))}catch{}for(let l of m){let f=G.has(l.type)&&g.get(`${l.type}|${D(l.name)}`)===1;if(!f&&w.has(S(l))){u.records.push({record:l,status:"present"});continue}let A;try{A=f?await s.upsertRecord(t,l):await s.createRecord(t,l)}catch(N){A={success:!1,message:N instanceof Error?N.message:String(N)}}if(A.success)w.add(S(l));u.records.push(A.success?{record:l,status:"copied"}:{record:l,status:"failed",reason:A.message})}let P=await s.listRecords(t);if(!P.success)return a.push(`Could not read back ${t} from ${s.name}: ${P.message??"unknown error"}`),u.status="blocked",u;for(let l of m)if(!P.records.some((f)=>W(l,f)))u.missing.push(l);if(u.missing.length>0)return a.push(`${u.missing.length} record(s) did not arrive at ${s.name}; leaving ${r.name}'s nameservers alone. Delegating now would take the domain off a complete zone and onto an incomplete one.`),u.status="blocked",u;if(!await r.updateNameServers(t,c.nameServers))return a.push(`${r.name} refused the nameserver update for ${t}.`),u.status="blocked",u;return u.status="delegated",u}var B={add_visitor_location_headers:"visitorLocationHeaders"};function V(e){return{porkbunApiKey:e.PORKBUN_API_KEY,porkbunSecretKey:e.PORKBUN_SECRET_KEY,godaddyApiKey:e.GODADDY_API_KEY,godaddyApiSecret:e.GODADDY_API_SECRET,cloudflareApiToken:e.CLOUDFLARE_API_TOKEN,cloudflareAccountId:e.CLOUDFLARE_ACCOUNT_ID}}function X(e,t){if(e==="porkbun"){if(!t.porkbunApiKey||!t.porkbunSecretKey)return"PORKBUN_API_KEY / PORKBUN_SECRET_KEY are not set";return new se(t.porkbunApiKey,t.porkbunSecretKey)}if(!t.godaddyApiKey||!t.godaddyApiSecret)return"GODADDY_API_KEY / GODADDY_API_SECRET are not set";let r=new xe(t.godaddyApiKey,t.godaddyApiSecret);if(!nr(r))return"the GoDaddy provider cannot change nameservers";return r}async function is(e,t={}){let r=e.registrar;if(!r)return{status:"skipped",reason:"no dns.registrar configured"};if(r.delegate===!1)return{status:"skipped",reason:"dns.registrar.delegate is false"};if(!e.domain)return{status:"skipped",reason:"no dns.domain configured"};if(!e.provider||e.provider===r.provider)return{status:"skipped",reason:`dns.provider is already ${r.provider}`};if(e.provider!=="cloudflare")return{status:"skipped",reason:`delegation to ${e.provider} is not supported yet`};let s=t.credentials??V(t.env??process.env);if(!s.cloudflareApiToken)return{status:"skipped",reason:"CLOUDFLARE_API_TOKEN is not set"};let o=X(r.provider,s);if(typeof o==="string")return{status:"skipped",reason:o};let i=new fe(s.cloudflareApiToken,{accountId:s.cloudflareAccountId});if(!ir(i))return{status:"skipped",reason:"the Cloudflare provider cannot create zones"};return sr({domain:e.domain,registrar:o,host:i,proxiedHosts:r.proxied,accountId:s.cloudflareAccountId,dryRun:r.dryRun})}function ss(e){if(e.status==="skipped")return[`dns: delegation skipped — ${e.reason}`];let t=[];switch(e.status){case"already-delegated":t.push(`dns: ${e.domain} already delegated to ${e.targetNameservers.join(", ")}`);break;case"delegated":t.push(`dns: ${e.domain} delegated to ${e.targetNameservers.join(", ")} (${e.records.filter((r)=>r.status==="copied").length} record(s) copied)`),t.push("dns: nameserver changes take up to 24h to propagate; the old zone answers until then");break;case"ready":t.push(`dns: ${e.domain} would delegate to ${e.targetNameservers.join(", ")} (dry run)`);break;case"blocked":t.push(`dns: ${e.domain} NOT delegated — nameservers left at ${e.currentNameservers.join(", ")}`);for(let r of e.missing)t.push(`  missing at destination: ${r.type} ${r.name}`);break}for(let r of e.warnings)t.push(`  ${r}`);return t}function Y(e){let t={};if(e.ssl!==void 0)t.ssl=e.ssl;if(e.alwaysUseHttps!==void 0)t.always_use_https=e.alwaysUseHttps?"on":"off";if(e.minTlsVersion!==void 0)t.min_tls_version=e.minTlsVersion;return t}function J(e){let t={};for(let[r,s]of Object.entries(B)){let o=e[s];if(typeof o==="boolean")t[r]=o}return t}async function os(e,t={}){if(!e.zone)return{status:"skipped",reason:"no dns.zone configured"};if(!e.domain)return{status:"skipped",reason:"no dns.domain configured"};if(e.provider!=="cloudflare")return{status:"skipped",reason:`zone settings are not supported for ${e.provider??"this provider"}`};let r=Y(e.zone),s=J(e.zone);if(Object.keys(r).length===0&&Object.keys(s).length===0)return{status:"skipped",reason:"dns.zone declares no settings"};let o=t.credentials??V(t.env??process.env);if(!o.cloudflareApiToken)return{status:"skipped",reason:"CLOUDFLARE_API_TOKEN is not set"};let i=new fe(o.cloudflareApiToken,{accountId:o.cloudflareAccountId}),a=await i.applyZoneSettings(e.domain,r),c=Object.keys(s).length>0?await i.applyManagedRequestHeaders(e.domain,s):{changed:[],failed:[]},d=[...a.changed,...c.changed],u=[...a.failed,...c.failed];return{status:d.length>0?"applied":"unchanged",domain:e.domain,changed:d,failed:u}}function as(e){if(e.status==="skipped")return[`dns: zone settings skipped — ${e.reason}`];let t=[];for(let r of e.changed)t.push(`dns: ${e.domain} ${r.id}: ${String(r.from)} → ${String(r.to)}`);if(e.status==="unchanged"&&e.failed.length===0)t.push(`dns: ${e.domain} zone settings already as declared`);for(let r of e.failed)t.push(`dns: ${e.domain} could not set ${r.id} — ${r.error}`);return t}class z{name="route53";client;hostedZoneCache=new Map;providedHostedZoneId;constructor(e="us-east-1",t){this.client=new y(e),this.providedHostedZoneId=t}getRootDomain(e){let t=e.replace(/\.$/,"").split(".");if(t.length>=2)return t.slice(-2).join(".");return e}async getHostedZoneId(e){if(this.providedHostedZoneId)return this.providedHostedZoneId;let t=this.getRootDomain(e),r=this.hostedZoneCache.get(t);if(r)return r;let s=await this.client.findHostedZoneForDomain(e);if(s){let o=s.Id.replace("/hostedzone/","");return this.hostedZoneCache.set(t,o),o}return null}normalizeName(e,t){let r=e.replace(/\.$/,""),s=t.replace(/\.$/,"");if(!s||s==="@")return`${r}.`;if(s===r||s.endsWith(`.${r}`))return`${s}.`;return`${s}.${r}.`}formatValue(e){let t=e.content;if(e.type==="TXT"&&!t.startsWith('"'))t=Q(t);if(e.type==="MX"&&e.priority!==void 0)t=`${e.priority} ${t}`;return t}sameValue(e,t,r){return e==="TXT"?E(t)===E(r):t===r}async currentSet(e,t,r){let o=(await this.client.listResourceRecordSets({HostedZoneId:e,StartRecordName:t,StartRecordType:r,MaxItems:"1"})).ResourceRecordSets?.[0];if(!o||o.Name.toLowerCase()!==t.toLowerCase()||o.Type!==r||o.AliasTarget||o.SetIdentifier)return null;return{ttl:o.TTL??300,values:(o.ResourceRecords??[]).map((i)=>i.Value)}}async createRecord(e,t){try{let r=await this.getHostedZoneId(e);if(!r)return{success:!1,message:`No hosted zone found for domain: ${e}`};let s=this.normalizeName(e,t.name),o=this.formatValue(t),i=await this.currentSet(r,s,t.type);if(i?.values.some((d)=>this.sameValue(t.type,d,o)))return{success:!0,message:"Record already present"};let a=[...i?.values??[],o];return{success:!0,id:(await this.client.changeResourceRecordSets({HostedZoneId:r,ChangeBatch:{Comment:"Created by ts-cloud DNS provider",Changes:[{Action:i?"UPSERT":"CREATE",ResourceRecordSet:{Name:s,Type:t.type,TTL:i?.ttl??t.ttl??300,ResourceRecords:a.map((d)=>({Value:d}))}}]}})).ChangeInfo?.Id,message:"Record created successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async upsertRecord(e,t){try{let r=await this.getHostedZoneId(e);if(!r)return{success:!1,message:`No hosted zone found for domain: ${e}`};let s=this.normalizeName(e,t.name),o=this.formatValue(t);return{success:!0,id:(await this.client.changeResourceRecordSets({HostedZoneId:r,ChangeBatch:{Comment:"Upserted by ts-cloud DNS provider",Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:s,Type:t.type,TTL:t.ttl||300,ResourceRecords:[{Value:o}]}}]}})).ChangeInfo?.Id,message:"Record upserted successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async deleteRecord(e,t){try{let r=await this.getHostedZoneId(e);if(!r)return{success:!1,message:`No hosted zone found for domain: ${e}`};let s=this.normalizeName(e,t.name),o=this.formatValue(t),i=await this.currentSet(r,s,t.type);if(!i||!i.values.some((c)=>this.sameValue(t.type,c,o)))return{success:!0,message:"Record already absent"};let a=i.values.filter((c)=>!this.sameValue(t.type,c,o));return await this.client.changeResourceRecordSets({HostedZoneId:r,ChangeBatch:{Comment:"Deleted by ts-cloud DNS provider",Changes:[{Action:a.length>0?"UPSERT":"DELETE",ResourceRecordSet:{Name:s,Type:t.type,TTL:i.ttl,ResourceRecords:(a.length>0?a:i.values).map((c)=>({Value:c}))}}]}}),{success:!0,message:"Record deleted successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async listRecords(e,t){try{let r=await this.getHostedZoneId(e);if(!r)return{success:!1,records:[],message:`No hosted zone found for domain: ${e}`};let s=await this.client.listResourceRecordSets({HostedZoneId:r,StartRecordType:t}),o=[];for(let i of s.ResourceRecordSets){if(t&&i.Type!==t)continue;if(i.AliasTarget)continue;for(let a of i.ResourceRecords||[]){let c=a.Value,d;if(i.Type==="MX"){let u=c.split(" ");if(u.length>=2)d=Number.parseInt(u[0],10),c=u.slice(1).join(" ")}if(i.Type==="TXT"&&c.startsWith('"'))c=E(c);o.push({name:i.Name.replace(/\.$/,""),type:i.Type,content:c,ttl:i.TTL,priority:d})}}return{success:!0,records:o}}catch(r){return{success:!1,records:[],message:r instanceof Error?r.message:"Unknown error"}}}async canManageDomain(e){return await this.getHostedZoneId(e)!==null}async listDomains(){try{return(await this.client.listHostedZones()).HostedZones.map((t)=>t.Name.replace(/\.$/,""))}catch{return[]}}getRoute53Client(){return this.client}async createAliasRecord(e){try{let t=await this.getHostedZoneId(e.domain);if(!t)return{success:!1,message:`No hosted zone found for domain: ${e.domain}`};return{success:!0,id:(await this.client.createAliasRecord({HostedZoneId:t,Name:this.normalizeName(e.domain,e.name),TargetHostedZoneId:e.targetHostedZoneId,TargetDNSName:e.targetDnsName,EvaluateTargetHealth:e.evaluateTargetHealth,Type:e.type})).ChangeInfo?.Id,message:"Alias record created successfully"}}catch(t){return{success:!1,message:t instanceof Error?t.message:"Unknown error"}}}async createCloudFrontAlias(e){return this.createAliasRecord({domain:e.domain,name:e.name,targetHostedZoneId:y.CloudFrontHostedZoneId,targetDnsName:e.cloudFrontDomainName,evaluateTargetHealth:!1})}async createAlbAlias(e){let t=y.ALBHostedZoneIds[e.region];if(!t)return{success:!1,message:`Unknown region for ALB: ${e.region}`};return this.createAliasRecord({domain:e.domain,name:e.name,targetHostedZoneId:t,targetDnsName:e.albDnsName,evaluateTargetHealth:!0})}}var Z=255;function Q(e){let t=[];for(let r=0;r<e.length;r+=Z)t.push(e.slice(r,r+Z));if(t.length===0)t.push("");return t.map((r)=>`"${r.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`).join(" ")}function E(e){if(!e.startsWith('"'))return e;let t="",r=!1;for(let s=0;s<e.length;s++){let o=e[s];if(!r){if(o==='"')r=!0;continue}if(o==="\\"&&s+1<e.length){t+=e[++s];continue}if(o==='"'){r=!1;continue}t+=o}return t}async function cs(e,t){let r=[],s,o;for(;;){let i=await e.listResourceRecordSets({HostedZoneId:t,StartRecordName:s,StartRecordType:o,MaxItems:"100"});if(r.push(...i.ResourceRecordSets),!i.IsTruncated)break;if(s=i.NextRecordName,o=i.NextRecordType,!s)break}return r}function h(e){return e.replace(/\.$/,"").toLowerCase()}function M(e){return e.replace(/\.$/,"")}function C(e){if(e.type==="SRV"&&e.weight!==void 0&&e.port!==void 0)return`${e.weight} ${e.port} ${M(e.content)}`;return M(e.content)}function ee(e){let t=e.match(/"(?:[^"\\]|\\.)*"/g);if(!t)return e;return t.map((r)=>r.slice(1,-1).replace(/\\(.)/g,"$1")).join("")}function ds(e,t){let r=h(t),s=[],o=[],i=[],a=new Set;for(let c of e){let d=h(c.Name),u=c.Type;if(u==="SOA"||u==="NS"&&d===r){o.push({name:d,type:u,reason:"owned by the destination provider"});continue}if(c.SetIdentifier){o.push({name:d,type:u,reason:`routing policy record (SetIdentifier=${c.SetIdentifier}) has no equivalent — recreate by hand`}),i.push(`${u} ${d} is part of a Route53 routing policy and was NOT migrated`);continue}if(c.AliasTarget){if(a.has(d))continue;a.add(d);let p=h(c.AliasTarget.DNSName);if(s.push({name:d,type:"CNAME",content:p,ttl:300,translatedFrom:`${u} ALIAS → ${p}`}),c.AliasTarget.EvaluateTargetHealth)i.push(`${d} was an ALIAS with health evaluation enabled; the CNAME that replaces it has no health check`);continue}for(let p of c.ResourceRecords||[]){let m=te(d,u,p.Value,c.TTL);if("reason"in m){o.push({name:d,type:u,reason:m.reason}),i.push(`${u} ${d}: ${m.reason}`);continue}s.push(m)}}return{zone:r,records:s,skipped:o,warnings:i}}function te(e,t,r,s){let o={name:e,ttl:s};switch(t){case"A":case"AAAA":case"CNAME":case"PTR":return{...o,type:t==="PTR"?"CNAME":t,content:h(r)};case"TXT":return{...o,type:"TXT",content:ee(r)};case"MX":{let[i,...a]=r.trim().split(/\s+/);if(!a.length)return{reason:`malformed MX value "${r}"`};return{...o,type:"MX",content:h(a.join(" ")),priority:Number(i)}}case"SRV":{let i=r.trim().split(/\s+/);if(i.length<4)return{reason:`malformed SRV value "${r}"`};let[a,c,d]=i.slice(0,3).map(Number);return{...o,type:"SRV",content:h(i.slice(3).join(" ")),priority:a,weight:c,port:d}}case"NS":return{...o,type:"NS",content:h(r)};case"CAA":return{...o,type:"CAA",content:r.trim()};default:return{reason:`unsupported record type ${t}`}}}var re=new Set(["TXT","MX","SRV","NS","CAA"]);async function ls(e,t){let r=[],s=[],o=new Set;try{let i=await e.listRecords(t.zone);for(let a of i.records||[])o.add(`${h(a.name)}|${a.type}|${C(a)}`)}catch{}for(let i of t.records){let a={...i,proxied:!1},c=`${h(i.name)}|${i.type}|${C(i)}`;if(!re.has(i.type)){let u=await e.upsertRecord(t.zone,a);if(u.success)r.push(i);else s.push({record:i,message:u.message||"unknown provider error"});continue}if(o.has(c)){r.push(i);continue}let d=await e.createRecord(t.zone,a);if(d.success)o.add(c),r.push(i);else s.push({record:i,message:d.message||"unknown provider error"})}return{applied:r,failed:s}}async function us(e,t){let r=await e.listRecords(t.zone),s=[],o=[],i=new Map;for(let a of r.records||[]){let c=`${h(a.name)}|${a.type}`,d=i.get(c)??[];d.push(C(a)),i.set(c,d)}for(let a of t.records){let c=i.get(`${h(a.name)}|${a.type}`),d=C(a);if(c?.some((u)=>u===d))s.push(a);else o.push({record:a,found:c?.join(", ")})}return{matched:s,missing:o,ok:o.length===0}}class ae{client;region;constructor(e="us-east-1"){this.client=new n,this.region=e}async requestCertificate(e){let t={DomainName:e.DomainName,ValidationMethod:e.ValidationMethod||"DNS"};if(e.SubjectAlternativeNames)t.SubjectAlternativeNames=e.SubjectAlternativeNames;return{CertificateArn:(await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.RequestCertificate"},body:JSON.stringify(t)})).CertificateArn||""}}async describeCertificate(e){let r=(await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.DescribeCertificate"},body:JSON.stringify({CertificateArn:e.CertificateArn})})).Certificate||{};return{CertificateArn:r.CertificateArn||"",DomainName:r.DomainName||"",SubjectAlternativeNames:r.SubjectAlternativeNames,Status:r.Status||"PENDING_VALIDATION",Type:r.Type,DomainValidationOptions:r.DomainValidationOptions?.map((s)=>({DomainName:s.DomainName,ValidationDomain:s.ValidationDomain,ValidationStatus:s.ValidationStatus,ResourceRecord:s.ResourceRecord?{Name:s.ResourceRecord.Name,Type:s.ResourceRecord.Type,Value:s.ResourceRecord.Value}:void 0,ValidationMethod:s.ValidationMethod})),CreatedAt:r.CreatedAt,IssuedAt:r.IssuedAt,NotBefore:r.NotBefore,NotAfter:r.NotAfter}}async listCertificates(e){let t={};if(e?.CertificateStatuses)t.CertificateStatuses=e.CertificateStatuses;if(e?.MaxItems)t.MaxItems=e.MaxItems;if(e?.NextToken)t.NextToken=e.NextToken;let r=await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.ListCertificates"},body:JSON.stringify(t)});return{CertificateSummaryList:(r.CertificateSummaryList||[]).map((s)=>({CertificateArn:s.CertificateArn,DomainName:s.DomainName})),NextToken:r.NextToken}}async deleteCertificate(e){await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.DeleteCertificate"},body:JSON.stringify({CertificateArn:e.CertificateArn})})}async listTagsForCertificate(e){return{Tags:(await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.ListTagsForCertificate"},body:JSON.stringify({CertificateArn:e.CertificateArn})})).Tags||[]}}async addTagsToCertificate(e){await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.AddTagsToCertificate"},body:JSON.stringify({CertificateArn:e.CertificateArn,Tags:e.Tags})})}async resendValidationEmail(e){await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.ResendValidationEmail"},body:JSON.stringify({CertificateArn:e.CertificateArn,Domain:e.Domain,ValidationDomain:e.ValidationDomain})})}async findCertificateByDomain(e){let r=(await this.listCertificates({CertificateStatuses:["ISSUED"]})).CertificateSummaryList.find((s)=>s.DomainName===e||s.DomainName===`*.${e.split(".").slice(1).join(".")}`);if(!r)return null;return this.describeCertificate({CertificateArn:r.CertificateArn})}async waitForCertificateValidation(e,t=60,r=30000){for(let s=0;s<t;s++){let o=await this.describeCertificate({CertificateArn:e});if(o.Status==="ISSUED")return o;if(o.Status==="FAILED"||o.Status==="VALIDATION_TIMED_OUT")return null;await new Promise((i)=>setTimeout(i,r))}return null}async getDnsValidationRecords(e){let t=await this.describeCertificate({CertificateArn:e});if(!t.DomainValidationOptions)return[];return t.DomainValidationOptions.filter((r)=>r.ResourceRecord&&r.ValidationMethod==="DNS").map((r)=>({domainName:r.DomainName,recordName:r.ResourceRecord.Name,recordType:r.ResourceRecord.Type,recordValue:r.ResourceRecord.Value}))}async requestCertificateWithSans(e){let t=new Set;if(t.add(e.DomainName),e.IncludeWww!==!1)t.add(`www.${e.DomainName}`);if(e.IncludeWildcard)t.add(`*.${e.DomainName}`);if(e.AdditionalSans)for(let r of e.AdditionalSans)t.add(r);return this.requestCertificate({DomainName:e.DomainName,SubjectAlternativeNames:Array.from(t),ValidationMethod:"DNS"})}async isCertificateValidForDomain(e,t){let r=await this.describeCertificate({CertificateArn:e});if(r.Status!=="ISSUED")return!1;if(r.DomainName===t)return!0;if(r.DomainName?.startsWith("*.")){let s=r.DomainName.slice(2),o=t.split("."),i=s.split(".");if(o.slice(-i.length).join(".")===s)return!0}if(r.SubjectAlternativeNames)for(let s of r.SubjectAlternativeNames){if(s===t)return!0;if(s.startsWith("*.")){let o=s.slice(2),i=t.split("."),a=o.split(".");if(i.slice(-a.length).join(".")===o)return!0}}return!1}}class or{acm;route53;dnsProvider;constructor(e="us-east-1",t){if(this.acm=new ae(e),this.route53=new y,t&&t.provider!=="route53")this.dnsProvider=T(t)}async requestAndValidate(e){let{domainName:t,hostedZoneId:r,subjectAlternativeNames:s=[],waitForValidation:o=!1,maxWaitMinutes:i=30}=e;if(!this.dnsProvider&&!r)throw Error("Either hostedZoneId or external DNS provider configuration is required");let{CertificateArn:a}=await this.acm.requestCertificate({DomainName:t,SubjectAlternativeNames:s.length>0?[t,...s]:void 0,ValidationMethod:"DNS"});await this.waitForValidationOptions(a);let c=await this.acm.getDnsValidationRecords(a);if(this.dnsProvider)for(let d of c){let u=await this.dnsProvider.upsertRecord(t,{name:d.recordName,type:d.recordType,content:d.recordValue,ttl:300});if(!u.success)console.warn(`Failed to create validation record for ${d.domainName}: ${u.message}`)}else if(r)for(let d of c)await this.route53.changeResourceRecordSets({HostedZoneId:r,ChangeBatch:{Comment:`ACM DNS validation for ${d.domainName}`,Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:d.recordName,Type:d.recordType,TTL:300,ResourceRecords:[{Value:d.recordValue}]}}]}});if(o){if(!await this.acm.waitForCertificateValidation(a,i*2,30000))throw Error(`Certificate validation timed out after ${i} minutes`)}return{certificateArn:a,validationRecords:c}}async waitForValidationOptions(e,t=30){for(let r=0;r<t;r++){let s=await this.acm.describeCertificate({CertificateArn:e});if(s.DomainValidationOptions&&s.DomainValidationOptions.length>0&&s.DomainValidationOptions[0].ResourceRecord)return;await new Promise((o)=>setTimeout(o,2000))}throw Error("Timeout waiting for DNS validation options")}async createValidationRecords(e){let{certificateArn:t,hostedZoneId:r,domain:s}=e;if(!this.dnsProvider&&!r)throw Error("Either hostedZoneId or external DNS provider configuration is required");let o=await this.acm.getDnsValidationRecords(t),i=[];if(this.dnsProvider){let a=s||o[0]?.domainName;for(let c of o){let d=await this.dnsProvider.upsertRecord(a,{name:c.recordName,type:c.recordType,content:c.recordValue,ttl:300});i.push({...c,changeId:d.success?d.id:void 0})}}else if(r)for(let a of o){let c=await this.route53.changeResourceRecordSets({HostedZoneId:r,ChangeBatch:{Comment:`ACM DNS validation for ${a.domainName}`,Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:a.recordName,Type:a.recordType,TTL:300,ResourceRecords:[{Value:a.recordValue}]}}]}});i.push({...a,changeId:c.ChangeInfo?.Id})}return i}async deleteValidationRecords(e){let{certificateArn:t,hostedZoneId:r,domain:s}=e,o=await this.acm.getDnsValidationRecords(t);if(this.dnsProvider){let i=s||o[0]?.domainName;for(let a of o)try{await this.dnsProvider.deleteRecord(i,{name:a.recordName,type:a.recordType,content:a.recordValue})}catch{}}else if(r)for(let i of o)try{await this.route53.changeResourceRecordSets({HostedZoneId:r,ChangeBatch:{Comment:`Cleanup ACM DNS validation for ${i.domainName}`,Changes:[{Action:"DELETE",ResourceRecordSet:{Name:i.recordName,Type:i.recordType,TTL:300,ResourceRecords:[{Value:i.recordValue}]}}]}})}catch{}}async findOrCreateCertificate(e){let{domainName:t,hostedZoneId:r,subjectAlternativeNames:s,waitForValidation:o=!0}=e;if(!this.dnsProvider&&!r)throw Error("Either hostedZoneId or external DNS provider configuration is required");let i=await this.acm.findCertificateByDomain(t);if(i&&i.Status==="ISSUED")return{certificateArn:i.CertificateArn,isNew:!1};let{certificateArn:a}=await this.requestAndValidate({domainName:t,hostedZoneId:r,subjectAlternativeNames:s,waitForValidation:o});return{certificateArn:a,isNew:!0}}hasExternalDnsProvider(){return this.dnsProvider!==void 0}getDnsProviderName(){return this.dnsProvider?.name||"route53"}}class oe{acm;dnsProvider;constructor(e,t="us-east-1"){if(this.acm=new ae(t),"provider"in e)this.dnsProvider=T(e);else this.dnsProvider=e}getProvider(){return this.dnsProvider}async requestAndValidate(e){let{domainName:t,subjectAlternativeNames:r=[],waitForValidation:s=!1,maxWaitMinutes:o=30}=e,{CertificateArn:i}=await this.acm.requestCertificate({DomainName:t,SubjectAlternativeNames:r.length>0?[t,...r]:void 0,ValidationMethod:"DNS"});await this.waitForValidationOptions(i);let a=await this.acm.getDnsValidationRecords(i);for(let d of a){let u=await this.dnsProvider.upsertRecord(t,{name:d.recordName,type:d.recordType,content:d.recordValue,ttl:300});if(!u.success)console.warn(`Failed to create validation record for ${d.domainName}: ${u.message}`)}let c="pending";if(s)c=(await this.acm.waitForCertificateValidation(i,o*2,30000))?.Status==="ISSUED"?"issued":"failed";return{certificateArn:i,validationRecords:a.map((d)=>({domainName:d.domainName,recordName:d.recordName,recordType:d.recordType,recordValue:d.recordValue})),isNew:!0,status:c}}async createValidationRecords(e){let{certificateArn:t,domain:r}=e,s=[],o=await this.acm.getDnsValidationRecords(t);for(let i of o){let a=await this.dnsProvider.upsertRecord(r,{name:i.recordName,type:i.recordType,content:i.recordValue,ttl:300});if(!a.success)s.push(`Failed to create record for ${i.domainName}: ${a.message}`)}return{success:s.length===0,records:o.map((i)=>({domainName:i.domainName,recordName:i.recordName,recordType:i.recordType,recordValue:i.recordValue})),errors:s}}async deleteValidationRecords(e){let{certificateArn:t,domain:r}=e,s=[],o=await this.acm.getDnsValidationRecords(t);for(let i of o){let a=await this.dnsProvider.deleteRecord(r,{name:i.recordName,type:i.recordType,content:i.recordValue});if(!a.success)s.push(`Failed to delete record for ${i.domainName}: ${a.message}`)}return{success:s.length===0,errors:s}}async findOrCreateCertificate(e){let{domainName:t,subjectAlternativeNames:r=[],waitForValidation:s=!0,maxWaitMinutes:o}=e,i=await this.acm.findCertificateByDomain(t);if(i&&i.Status==="ISSUED"){let a=i.SubjectAlternativeNames||[i.DomainName],c=a.some((u)=>u===`*.${t}`);if(r.every((u)=>a.includes(u)||c))return{certificateArn:i.CertificateArn,validationRecords:[],isNew:!1,status:"issued"};console.log("Existing certificate doesn't cover all required SANs, requesting new certificate...")}return this.requestAndValidate({domainName:t,subjectAlternativeNames:r,waitForValidation:s,maxWaitMinutes:o})}async requestCertificateWithCommonSans(e){let{domainName:t,includeWww:r=!0,includeWildcard:s=!1,additionalSans:o=[],waitForValidation:i=!1}=e,a=[];if(r)a.push(`www.${t}`);if(s)a.push(`*.${t}`);return a.push(...o),this.requestAndValidate({domainName:t,subjectAlternativeNames:a,waitForValidation:i})}async waitForValidationOptions(e,t=30){for(let r=0;r<t;r++){let s=await this.acm.describeCertificate({CertificateArn:e});if(s.DomainValidationOptions&&s.DomainValidationOptions.length>0&&s.DomainValidationOptions[0].ResourceRecord)return;await new Promise((o)=>setTimeout(o,2000))}throw Error("Timeout waiting for DNS validation options")}async getCertificateStatus(e){let t=await this.acm.describeCertificate({CertificateArn:e});return{status:t.Status,domainValidations:(t.DomainValidationOptions||[]).map((r)=>({domain:r.DomainName,status:r.ValidationStatus||"UNKNOWN"}))}}}function ps(e,t,r){return new oe({provider:"porkbun",apiKey:e,secretKey:t},r)}function gs(e,t,r,s){return new oe({provider:"godaddy",apiKey:e,apiSecret:t,environment:s},r)}function ms(e,t,r){return new oe({provider:"route53",region:e,hostedZoneId:t},r||e)}function T(e){switch(e.provider){case"route53":return new z(e.region,e.hostedZoneId);case"porkbun":return new se(e.apiKey,e.secretKey);case"godaddy":return new xe(e.apiKey,e.apiSecret,e.environment);case"cloudflare":return new fe(e.apiToken,{zoneId:e.zoneId,accountId:e.accountId});default:throw Error(`Unknown DNS provider: ${e.provider}`)}}async function $a(e,t){for(let r of t){let s=T(r);if(await s.canManageDomain(e))return s}return null}class An{providers=new Map;configs=[];addConfig(e){return this.configs.push(e),this}addRoute53(e,t){return this.configs.push({provider:"route53",region:e,hostedZoneId:t}),this}addPorkbun(e,t){return this.configs.push({provider:"porkbun",apiKey:e,secretKey:t}),this}addGoDaddy(e,t,r){return this.configs.push({provider:"godaddy",apiKey:e,apiSecret:t,environment:r}),this}addCloudflare(e,t={}){return this.configs.push({provider:"cloudflare",apiToken:e,zoneId:t.zoneId,accountId:t.accountId}),this}loadFromEnv(){if(process.env.AWS_ACCESS_KEY_ID||process.env.AWS_REGION)this.addRoute53(process.env.AWS_REGION);let e=process.env.PORKBUN_API_KEY,t=process.env.PORKBUN_SECRET_KEY;if(e&&t)this.addPorkbun(e,t);let r=process.env.GODADDY_API_KEY,s=process.env.GODADDY_API_SECRET;if(r&&s){let i=process.env.GODADDY_ENVIRONMENT;this.addGoDaddy(r,s,i)}let o=process.env.CLOUDFLARE_API_TOKEN;if(o)this.addCloudflare(o,{zoneId:process.env.CLOUDFLARE_ZONE_ID,accountId:process.env.CLOUDFLARE_ACCOUNT_ID});return this}getProvider(e){let t=this.providers.get(e);if(t)return t;let r=this.configs.find((o)=>o.provider===e);if(!r)return null;let s=T(r);return this.providers.set(e,s),s}async getProviderForDomain(e){for(let t of this.configs){let r=T(t);if(await r.canManageDomain(e))return r}return null}getAllProviders(){return this.configs.map((e)=>T(e))}}var Ma=new An;
+export{tt,se,xe,ts,fe,Tt,hn,rs,ns,nr,ir,fn,sr,is,ss,os,as,z,cs,ds,ls,us,oe,ps,gs,ms,T,$a,An,Ma,ae,or};

package/dist/{chunk-s4r2tfpx.js → chunk-adj8jak1.js}

@@ -1,4 +1,4 @@
-import{nd,_,d,sd,O,p,le,g,Ft,ld,Js,gd,md,Ad,Mr,io,qt,yd,Id,wd,Rd}from"./chunk-dbzveymg.js";import{B,u}from"./chunk-w41zkaey.js";import{de,Bt,w,xt,s,ti,ws,br,wc,Rc,X,c,Ps,Ue,Er,Dc,_t,ks,Pc,vr,Bs,Tr,ii,$t,ci,di,Qe,Mt,Jc,Xc,ui,pi,lt,Vs,i,gi,zs,Ks}from"./chunk-wkbk6pdg.js";import{n,l}from"./chunk-4w8d2mf0.js";import{kt,a}from"./chunk-t5e5phth.js";import{sn}from"./chunk-7248warz.js";import{on,Kl,Wi,P,v,Ji,Wl}from"./chunk-fjqx22m1.js";import{ge,Xt,es,Xe,V,ne,C,me,er,Ze,rr}from"./chunk-wp6pg5sx.js";import{j}from"./chunk-1bxqrj7m.js";import{b,cr,hs,Dt,dr,ou,za,Le,it,Dn,k,Pt,_u,Nt,fr}from"./chunk-jf7w1v9z.js";import{he}from"./chunk-3nccgrzf.js";import{A}from"./chunk-30504159.js";import{Be}from"./chunk-r5pjnw74.js";import{be}from"./chunk-aszeyg2w.js";import{h}from"./chunk-f5mqecfk.js";function Jr(e){let t=Mc(e.name),r=Ju(e.configText);if(XS(e.configText,r.start,r.end,t))throw Error(`Site '${t}' already exists in cloud.config.ts`);let o=vm({...e,name:t}),m=e.configText.slice(0,r.end).trimEnd(),f=e.configText.slice(r.end),y=m.endsWith("{")?`
+import{nd,_,d,sd,O,p,le,g,Ft,ld,Js,gd,md,Ad,Mr,io,qt,yd,Id,wd,Rd}from"./chunk-dbzveymg.js";import{B,u}from"./chunk-w41zkaey.js";import{de,Bt,w,xt,s,ti,ws,br,wc,Rc,X,c,Ps,Ue,Er,Dc,_t,ks,Pc,vr,Bs,Tr,ii,$t,ci,di,Qe,Mt,Jc,Xc,ui,pi,lt,Vs,i,gi,zs,Ks}from"./chunk-wkbk6pdg.js";import{n,l}from"./chunk-4w8d2mf0.js";import{kt,a}from"./chunk-t5e5phth.js";import{sn}from"./chunk-kksj2fy7.js";import{on,Kl,Wi,P,v,Ji,Wl}from"./chunk-fjqx22m1.js";import{ge,Xt,es,Xe,V,ne,C,me,er,Ze,rr}from"./chunk-wp6pg5sx.js";import{j}from"./chunk-1bxqrj7m.js";import{b,cr,hs,Dt,dr,ou,za,Le,it,Dn,k,Pt,_u,Nt,fr}from"./chunk-jf7w1v9z.js";import{he}from"./chunk-3nccgrzf.js";import{A}from"./chunk-30504159.js";import{Be}from"./chunk-r5pjnw74.js";import{be}from"./chunk-aszeyg2w.js";import{h}from"./chunk-f5mqecfk.js";function Jr(e){let t=Mc(e.name),r=Ju(e.configText);if(XS(e.configText,r.start,r.end,t))throw Error(`Site '${t}' already exists in cloud.config.ts`);let o=vm({...e,name:t}),m=e.configText.slice(0,r.end).trimEnd(),f=e.configText.slice(r.end),y=m.endsWith("{")?`
 `:m.endsWith(",")?`
 
 `:`,

package/dist/{chunk-7248warz.js → chunk-kksj2fy7.js}

@@ -1,4 +1,4 @@
-import{z,oe,T,ae,or}from"./chunk-nz7swfds.js";import{a}from"./chunk-t5e5phth.js";import{A}from"./chunk-30504159.js";import{y}from"./chunk-ndm0r1vb.js";import{h}from"./chunk-f5mqecfk.js";function ba(t){let{bucketName:s,domain:u,aliases:e,certificateArn:p,defaultRootObject:i="index.html",errorDocument:r="404.html",passthroughUrls:c=!1,singlePageApp:g=!1,dynamicApp:C=!1,computeOriginDomain:w,computeOriginPort:x=3008,computeOriginId:E="app-compute",retainOnStackDelete:M=!1}=t,S=M?{DeletionPolicy:"Retain",UpdateReplacePolicy:"Retain"}:{},N=C&&!!w,j=N?["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"]:["GET","HEAD"],v=N?["GET","HEAD"]:["GET","HEAD"],O={},B={};O.S3Bucket={Type:"AWS::S3::Bucket",...S,Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},B.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},B.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},O.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",...S,Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}};let I;if(c&&N)I="InstallRootRedirectFunction",O[I]={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-install-root-redirect"},AutoPublish:!0,FunctionConfig:{Comment:"Redirect curl pantry.dev | bash (GET /) to /install.sh on S3",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
+import{z,oe,T,ae,or}from"./chunk-6e967ybg.js";import{a}from"./chunk-t5e5phth.js";import{A}from"./chunk-30504159.js";import{y}from"./chunk-ndm0r1vb.js";import{h}from"./chunk-f5mqecfk.js";function ba(t){let{bucketName:s,domain:u,aliases:e,certificateArn:p,defaultRootObject:i="index.html",errorDocument:r="404.html",passthroughUrls:c=!1,singlePageApp:g=!1,dynamicApp:C=!1,computeOriginDomain:w,computeOriginPort:x=3008,computeOriginId:E="app-compute",retainOnStackDelete:M=!1}=t,S=M?{DeletionPolicy:"Retain",UpdateReplacePolicy:"Retain"}:{},N=C&&!!w,j=N?["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"]:["GET","HEAD"],v=N?["GET","HEAD"]:["GET","HEAD"],O={},B={};O.S3Bucket={Type:"AWS::S3::Bucket",...S,Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},B.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},B.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},O.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",...S,Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}};let I;if(c&&N)I="InstallRootRedirectFunction",O[I]={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-install-root-redirect"},AutoPublish:!0,FunctionConfig:{Comment:"Redirect curl pantry.dev | bash (GET /) to /install.sh on S3",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
   var request = event.request;
   if (request.uri === '/' || request.uri === '') {
     return {
@@ -42,7 +42,7 @@ import{z,oe,T,ae,or}from"./chunk-nz7swfds.js";import{a}from"./chunk-t5e5phth.js"
 │                                                                             │
 │  Verification typically takes 1-2 business days.                            │
 │  After verification, re-run: bunx bunpress deploy                           │
-└─────────────────────────────────────────────────────────────────────────────┘`),{success:!1,stackId:B,stackName:i,bucket:N,message:"CloudFront account verification required. Please contact AWS Support."}}return{success:!1,stackId:B,stackName:i,bucket:N,message:`Stack deployment failed: ${o.message}`}}let d=(await r.describeStacks({stackName:i})).Stacks[0]?.Outputs||[],k=(o)=>d.find((n)=>n.OutputKey===o)?.OutputValue,b=k("DistributionDomain");if(b&&g)console.log(`Creating DNS records via ${g.name}...`),await H(g,e,b);else if(b&&!g)console.log("Skipping DNS record creation (DNS verification was skipped)");return{success:!0,stackId:B,stackName:i,bucket:k("BucketName")||N,distributionId:k("DistributionId"),distributionDomain:b,domain:e,certificateArn:C,message:"Static site infrastructure deployed successfully with external DNS"}}async function H(t,s,u){if(!t){console.log("Skipping DNS record creation (DNS verification was skipped)");return}if(s.split(".").length===2)if(t instanceof z){console.log(`Creating Route53 alias record for apex domain ${s} -> ${u}`);let i=await t.createCloudFrontAlias({domain:s,name:s,cloudFrontDomainName:u});if(!i.success)console.warn(`Warning: Could not create Route53 alias record: ${i.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${s} -> ${u}`);else console.log(`Created Route53 alias record: ${s} -> ${u}`);let r=`www.${s}`;console.log(`Creating Route53 alias record for ${r} -> ${u}`);let c=await t.createCloudFrontAlias({domain:s,name:r,cloudFrontDomainName:u});if(!c.success)console.warn(`Warning: Could not create www Route53 alias: ${c.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${r} -> ${u}`);else console.log(`Created Route53 alias record: ${r} -> ${u}`)}else{try{let g=await t.listRecords(s,"A");if(g.success)for(let C of g.records){let w=C.name.replace(/\.$/,"");if(w===s||w==="")console.log(`Removing existing root A record (${C.content}) to make room for ALIAS...`),await t.deleteRecord(s,{name:s,type:"A",content:C.content})}}catch(g){console.log(`Note: Could not check for conflicting A records: ${g instanceof Error?g.message:g}`)}console.log(`Creating ALIAS record for apex domain ${s} -> ${u}`);let i=await t.upsertRecord(s,{name:s,type:"ALIAS",content:u,ttl:600});if(!i.success)console.warn(`Warning: Could not create ALIAS record: ${i.message}`),console.warn("Please manually create an ALIAS record in your DNS provider:"),console.warn(`  ${s} -> ${u}`);else console.log(`Created ALIAS record: ${s} -> ${u}`);let r=`www.${s}`;console.log(`Creating CNAME record for ${r} -> ${u}`);let c=await t.upsertRecord(s,{name:r,type:"CNAME",content:u,ttl:600});if(!c.success)console.warn(`Warning: Could not create www DNS record: ${c.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${r} -> ${u}`);else console.log(`Created CNAME record: ${r} -> ${u}`)}else{console.log(`Creating CNAME record for ${s} -> ${u}`);let i=await t.upsertRecord(s,{name:s,type:"CNAME",content:u,ttl:600});if(!i.success)console.warn(`Warning: Could not create DNS record: ${i.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${s} -> ${u}`);else console.log(`Created CNAME record: ${s} -> ${u}`)}}async function sn(t){let{sourceDir:s,cleanBucket:u=!1,onProgress:e,...p}=t;e?.("infrastructure","Deploying CloudFormation stack...");let i=await nn(p);if(!i.success)return i;if(u){e?.("clean","Cleaning old files from S3...");try{await new a(p.region||"us-east-1").emptyBucket(i.bucket)}catch(C){console.log(`Note: Could not clean bucket: ${C.message}`)}}e?.("upload","Uploading files to S3...");let{uploadStaticFiles:r}=await import("./chunk-hewc4z2a.js"),c=await r({sourceDir:s,bucket:i.bucket,region:p.region||"us-east-1",cacheControl:p.cacheControl,onProgress:(C,w,x)=>{e?.("upload",`${C}/${w}: ${x}`)}});if(c.errors.length>0)return{...i,success:!1,message:`Upload errors: ${c.errors.join(", ")}`,filesUploaded:c.uploaded};if(i.distributionId&&c.uploaded>0){e?.("invalidate","Invalidating CloudFront cache...");let{invalidateCache:C}=await import("./chunk-hewc4z2a.js");await C(i.distributionId)}e?.("complete","Deployment complete!");let g=c.skipped>0?`Deployed ${c.uploaded} files (${c.skipped} unchanged) with external DNS`:`Deployed ${c.uploaded} files successfully with external DNS`;return{...i,filesUploaded:c.uploaded,filesSkipped:c.skipped,message:g}}function Vi(t){let{bucketName:s,domain:u,certificateArn:e,hostedZoneId:p,defaultRootObject:i="index.html",errorDocument:r="404.html"}=t,c={},g={};c.S3Bucket={Type:"AWS::S3::Bucket",Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},g.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},g.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},c.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},c.UrlRewriteFunction={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-url-rewrite"},AutoPublish:!0,FunctionConfig:{Comment:"Append .html extension to URLs without extensions",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
+└─────────────────────────────────────────────────────────────────────────────┘`),{success:!1,stackId:B,stackName:i,bucket:N,message:"CloudFront account verification required. Please contact AWS Support."}}return{success:!1,stackId:B,stackName:i,bucket:N,message:`Stack deployment failed: ${o.message}`}}let d=(await r.describeStacks({stackName:i})).Stacks[0]?.Outputs||[],k=(o)=>d.find((n)=>n.OutputKey===o)?.OutputValue,b=k("DistributionDomain");if(b&&g)console.log(`Creating DNS records via ${g.name}...`),await H(g,e,b);else if(b&&!g)console.log("Skipping DNS record creation (DNS verification was skipped)");return{success:!0,stackId:B,stackName:i,bucket:k("BucketName")||N,distributionId:k("DistributionId"),distributionDomain:b,domain:e,certificateArn:C,message:"Static site infrastructure deployed successfully with external DNS"}}async function H(t,s,u){if(!t){console.log("Skipping DNS record creation (DNS verification was skipped)");return}if(s.split(".").length===2)if(t instanceof z){console.log(`Creating Route53 alias record for apex domain ${s} -> ${u}`);let i=await t.createCloudFrontAlias({domain:s,name:s,cloudFrontDomainName:u});if(!i.success)console.warn(`Warning: Could not create Route53 alias record: ${i.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${s} -> ${u}`);else console.log(`Created Route53 alias record: ${s} -> ${u}`);let r=`www.${s}`;console.log(`Creating Route53 alias record for ${r} -> ${u}`);let c=await t.createCloudFrontAlias({domain:s,name:r,cloudFrontDomainName:u});if(!c.success)console.warn(`Warning: Could not create www Route53 alias: ${c.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${r} -> ${u}`);else console.log(`Created Route53 alias record: ${r} -> ${u}`)}else{try{let g=await t.listRecords(s,"A");if(g.success)for(let C of g.records){let w=C.name.replace(/\.$/,"");if(w===s||w==="")console.log(`Removing existing root A record (${C.content}) to make room for ALIAS...`),await t.deleteRecord(s,{name:s,type:"A",content:C.content})}}catch(g){console.log(`Note: Could not check for conflicting A records: ${g instanceof Error?g.message:g}`)}console.log(`Creating ALIAS record for apex domain ${s} -> ${u}`);let i=await t.upsertRecord(s,{name:s,type:"ALIAS",content:u,ttl:600});if(!i.success)console.warn(`Warning: Could not create ALIAS record: ${i.message}`),console.warn("Please manually create an ALIAS record in your DNS provider:"),console.warn(`  ${s} -> ${u}`);else console.log(`Created ALIAS record: ${s} -> ${u}`);let r=`www.${s}`;console.log(`Creating CNAME record for ${r} -> ${u}`);let c=await t.upsertRecord(s,{name:r,type:"CNAME",content:u,ttl:600});if(!c.success)console.warn(`Warning: Could not create www DNS record: ${c.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${r} -> ${u}`);else console.log(`Created CNAME record: ${r} -> ${u}`)}else{console.log(`Creating CNAME record for ${s} -> ${u}`);let i=await t.upsertRecord(s,{name:s,type:"CNAME",content:u,ttl:600});if(!i.success)console.warn(`Warning: Could not create DNS record: ${i.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${s} -> ${u}`);else console.log(`Created CNAME record: ${s} -> ${u}`)}}async function sn(t){let{sourceDir:s,cleanBucket:u=!1,onProgress:e,...p}=t;e?.("infrastructure","Deploying CloudFormation stack...");let i=await nn(p);if(!i.success)return i;if(u){e?.("clean","Cleaning old files from S3...");try{await new a(p.region||"us-east-1").emptyBucket(i.bucket)}catch(C){console.log(`Note: Could not clean bucket: ${C.message}`)}}e?.("upload","Uploading files to S3...");let{uploadStaticFiles:r}=await import("./chunk-mgq54dyz.js"),c=await r({sourceDir:s,bucket:i.bucket,region:p.region||"us-east-1",cacheControl:p.cacheControl,onProgress:(C,w,x)=>{e?.("upload",`${C}/${w}: ${x}`)}});if(c.errors.length>0)return{...i,success:!1,message:`Upload errors: ${c.errors.join(", ")}`,filesUploaded:c.uploaded};if(i.distributionId&&c.uploaded>0){e?.("invalidate","Invalidating CloudFront cache...");let{invalidateCache:C}=await import("./chunk-mgq54dyz.js");await C(i.distributionId)}e?.("complete","Deployment complete!");let g=c.skipped>0?`Deployed ${c.uploaded} files (${c.skipped} unchanged) with external DNS`:`Deployed ${c.uploaded} files successfully with external DNS`;return{...i,filesUploaded:c.uploaded,filesSkipped:c.skipped,message:g}}function Vi(t){let{bucketName:s,domain:u,certificateArn:e,hostedZoneId:p,defaultRootObject:i="index.html",errorDocument:r="404.html"}=t,c={},g={};c.S3Bucket={Type:"AWS::S3::Bucket",Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},g.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},g.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},c.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},c.UrlRewriteFunction={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-url-rewrite"},AutoPublish:!0,FunctionConfig:{Comment:"Append .html extension to URLs without extensions",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
   const request = event.request;
   var uri = request.uri;
 

package/dist/{chunk-hewc4z2a.js → chunk-mgq54dyz.js}

@@ -1 +1 @@
-import{Vi,ji,zi,Ki,Ea,va}from"./chunk-7248warz.js";import"./chunk-30504159.js";import"./chunk-nz7swfds.js";import"./chunk-ndm0r1vb.js";import"./chunk-f5mqecfk.js";import"./chunk-t5e5phth.js";import"./chunk-4w8d2mf0.js";export{Ea as deleteStaticSite,ji as deployStaticSite,va as deployStaticSiteFull,Vi as generateStaticSiteTemplate,Ki as invalidateCache,zi as uploadStaticFiles};
+import{Vi,ji,zi,Ki,Ea,va}from"./chunk-kksj2fy7.js";import"./chunk-30504159.js";import"./chunk-6e967ybg.js";import"./chunk-ndm0r1vb.js";import"./chunk-f5mqecfk.js";import"./chunk-t5e5phth.js";import"./chunk-4w8d2mf0.js";export{Ea as deleteStaticSite,ji as deployStaticSite,va as deployStaticSiteFull,Vi as generateStaticSiteTemplate,Ki as invalidateCache,zi as uploadStaticFiles};

package/dist/deploy/index.js

@@ -1 +1 @@
-import{Jr,Xr,Dl,Mi,Pl,Nl,kl,sa,Bl,xl,vm,_l,S,Ol,Fi,Pe,Ll,$l,NA,Ml,Tm,kA,BA,xA,wm,Rm,_A,OA,Dm,Pm,LA,Ui,Wt,oa,Yr,Zr,Jt,Je,It,Qi,Nm,en,Fl,Ul,aa,Gi,rn,qi,Ca}from"../chunk-s4r2tfpx.js";import{ba,nn,sn,Vi,ji,zi,Ki,Ea,va}from"../chunk-7248warz.js";import{Ta}from"../chunk-fjqx22m1.js";import"../chunk-wp6pg5sx.js";import"../chunk-3nccgrzf.js";import"../chunk-30504159.js";import"../chunk-r5pjnw74.js";import"../chunk-1bxqrj7m.js";import"../chunk-nz7swfds.js";import"../chunk-ndm0r1vb.js";import{ru,Fa,Ae,Ua,yn,nu,Qa,lc,Ss,uc,Nt,zn,Cs}from"../chunk-jf7w1v9z.js";import"../chunk-aszeyg2w.js";import"../chunk-f5mqecfk.js";import"../chunk-t5e5phth.js";import"../chunk-4w8d2mf0.js";import{ot,_h,Ac,Yn,Zn,ei,tp}from"../chunk-v99q99bs.js";import{B,Ir,Sr,yc,vs,u,Oh,rp,np,gy,my}from"../chunk-w41zkaey.js";import"../chunk-wkbk6pdg.js";import"../chunk-dbzveymg.js";export{_h as DEFAULT_SITE_PORT_RANGE,ot as HOST_SITES_DIR,Ua as IPV6_EXCLUDED_HOST_LABELS,lc as MANAGEMENT_DASHBOARD_SITE,Jr as addSiteToCloudConfig,tp as allocateSitePorts,LA as buildAndPushContainerImage,Ta as buildAndPushServerlessImage,Wt as buildFunctionEnv,Zn as buildHostSitePortsScript,Cs as buildManagementDashboardArtifact,It as buildServerTopology,Qi as buildServerlessTopology,Nm as buildTopology,aa as collectEgressMetrics,ru as collectServerDnsDomains,Pm as createContainerImageDependencies,wm as createExistingStaticFullStackDependencies,Tm as createStaticApiOriginDependencies,rn as dashboardActions,Ss as dashboardCredentialsFile,Ll as dashboardPageRoutes,Ea as deleteStaticSite,_A as deployExistingStaticFullStack,oa as deployServerlessApp,my as deployShipsFiles,Ml as deploySite,kA as deployStaticApiOrigin,ji as deployStaticSite,va as deployStaticSiteFull,nn as deployStaticSiteWithExternalDns,sn as deployStaticSiteWithExternalDnsFull,Fl as egressReportMetrics,S as ensureDashboardActor,zn as ensureManagementDashboard,OA as estimateExistingStaticFullStackMonthlyCost,xA as estimateStaticApiOriginMonthlyCost,Ul as fetchEgressReport,Rm as generateExistingStaticFullStackTemplate,ba as generateExternalDnsStaticSiteTemplate,Vi as generateStaticSiteTemplate,Oh as hasComputeConfigured,yc as hasProxyUpstream,Dm as hashContainerContext,yn as hostAcceptsIpv6,Ui as infraEnvFromOutputs,Ol as initializeDashboardControlPlane,Ki as invalidateCache,Ir as isPhpSite,sa as isValidHostname,Ae as normalizePublicIpv6,Yn as occupiedHostPorts,ei as parseHostSiteFragments,Ac as parseUpstreamPort,nu as reconcileAddressRecords,Yr as redeployServerlessApp,Xr as removeSiteFromCloudConfig,Fa as removeStaleServerAddressRecords,Bl as renderAliasesValue,kl as renderEnvValue,xl as renderRedirectsValue,vm as renderSiteSnippet,Pl as renderSslValue,Nl as renderStringValue,qi as resolveDashboardAction,uc as resolveDashboardAuth,en as resolveDashboardData,$l as resolveLegacyDashboardRoute,Sr as resolveProxyUpstreams,vs as resolveSiteDeployTarget,u as resolveSiteKind,Nt as resolveUiSource,Zr as rollbackServerlessApp,NA as routesForDashboard,Je as runRemoteCommand,Gi as sanitizeCloudConfig,_l as setAttachToInCloudConfig,Jt as setMaintenance,Mi as setSitePropertyInCloudConfig,np as shipsARelease,gy as shipsToBucket,B as siteInstallBase,Ca as startLocalDashboardServer,Fi as synchronizeDashboardUsers,Pe as trackDashboardOperation,Dl as updateSiteInCloudConfig,zi as uploadStaticFiles,rp as validateDeploymentConfig,Qa as verifyAddressRecord,BA as verifyStaticApiOrigin};
+import{Jr,Xr,Dl,Mi,Pl,Nl,kl,sa,Bl,xl,vm,_l,S,Ol,Fi,Pe,Ll,$l,NA,Ml,Tm,kA,BA,xA,wm,Rm,_A,OA,Dm,Pm,LA,Ui,Wt,oa,Yr,Zr,Jt,Je,It,Qi,Nm,en,Fl,Ul,aa,Gi,rn,qi,Ca}from"../chunk-adj8jak1.js";import{ba,nn,sn,Vi,ji,zi,Ki,Ea,va}from"../chunk-kksj2fy7.js";import{Ta}from"../chunk-fjqx22m1.js";import"../chunk-wp6pg5sx.js";import"../chunk-3nccgrzf.js";import"../chunk-30504159.js";import"../chunk-r5pjnw74.js";import"../chunk-1bxqrj7m.js";import"../chunk-6e967ybg.js";import"../chunk-ndm0r1vb.js";import{ru,Fa,Ae,Ua,yn,nu,Qa,lc,Ss,uc,Nt,zn,Cs}from"../chunk-jf7w1v9z.js";import"../chunk-aszeyg2w.js";import"../chunk-f5mqecfk.js";import"../chunk-t5e5phth.js";import"../chunk-4w8d2mf0.js";import{ot,_h,Ac,Yn,Zn,ei,tp}from"../chunk-v99q99bs.js";import{B,Ir,Sr,yc,vs,u,Oh,rp,np,gy,my}from"../chunk-w41zkaey.js";import"../chunk-wkbk6pdg.js";import"../chunk-dbzveymg.js";export{_h as DEFAULT_SITE_PORT_RANGE,ot as HOST_SITES_DIR,Ua as IPV6_EXCLUDED_HOST_LABELS,lc as MANAGEMENT_DASHBOARD_SITE,Jr as addSiteToCloudConfig,tp as allocateSitePorts,LA as buildAndPushContainerImage,Ta as buildAndPushServerlessImage,Wt as buildFunctionEnv,Zn as buildHostSitePortsScript,Cs as buildManagementDashboardArtifact,It as buildServerTopology,Qi as buildServerlessTopology,Nm as buildTopology,aa as collectEgressMetrics,ru as collectServerDnsDomains,Pm as createContainerImageDependencies,wm as createExistingStaticFullStackDependencies,Tm as createStaticApiOriginDependencies,rn as dashboardActions,Ss as dashboardCredentialsFile,Ll as dashboardPageRoutes,Ea as deleteStaticSite,_A as deployExistingStaticFullStack,oa as deployServerlessApp,my as deployShipsFiles,Ml as deploySite,kA as deployStaticApiOrigin,ji as deployStaticSite,va as deployStaticSiteFull,nn as deployStaticSiteWithExternalDns,sn as deployStaticSiteWithExternalDnsFull,Fl as egressReportMetrics,S as ensureDashboardActor,zn as ensureManagementDashboard,OA as estimateExistingStaticFullStackMonthlyCost,xA as estimateStaticApiOriginMonthlyCost,Ul as fetchEgressReport,Rm as generateExistingStaticFullStackTemplate,ba as generateExternalDnsStaticSiteTemplate,Vi as generateStaticSiteTemplate,Oh as hasComputeConfigured,yc as hasProxyUpstream,Dm as hashContainerContext,yn as hostAcceptsIpv6,Ui as infraEnvFromOutputs,Ol as initializeDashboardControlPlane,Ki as invalidateCache,Ir as isPhpSite,sa as isValidHostname,Ae as normalizePublicIpv6,Yn as occupiedHostPorts,ei as parseHostSiteFragments,Ac as parseUpstreamPort,nu as reconcileAddressRecords,Yr as redeployServerlessApp,Xr as removeSiteFromCloudConfig,Fa as removeStaleServerAddressRecords,Bl as renderAliasesValue,kl as renderEnvValue,xl as renderRedirectsValue,vm as renderSiteSnippet,Pl as renderSslValue,Nl as renderStringValue,qi as resolveDashboardAction,uc as resolveDashboardAuth,en as resolveDashboardData,$l as resolveLegacyDashboardRoute,Sr as resolveProxyUpstreams,vs as resolveSiteDeployTarget,u as resolveSiteKind,Nt as resolveUiSource,Zr as rollbackServerlessApp,NA as routesForDashboard,Je as runRemoteCommand,Gi as sanitizeCloudConfig,_l as setAttachToInCloudConfig,Jt as setMaintenance,Mi as setSitePropertyInCloudConfig,np as shipsARelease,gy as shipsToBucket,B as siteInstallBase,Ca as startLocalDashboardServer,Fi as synchronizeDashboardUsers,Pe as trackDashboardOperation,Dl as updateSiteInCloudConfig,zi as uploadStaticFiles,rp as validateDeploymentConfig,Qa as verifyAddressRecord,BA as verifyStaticApiOrigin};

package/dist/dns/cloudflare.d.ts

@@ -286,3 +286,8 @@ export declare class CloudflareProvider implements DnsProvider {
         message?: string;
     }>;
 }
+/**
+ * The hosts a rule expression is scoped to, in the two shapes `hostCondition`
+ * writes: `http.host eq "a"` and `http.host in {"a" "b"}`.
+ */
+export declare function hostsInExpression(expression: string): string[];

package/dist/dns/index.js

@@ -1 +1 @@
-import{tt,se,xe,fe,Tt,hn,rs,ns,nr,ir,fn,sr,is,ss,os,as,z,cs,ds,ls,us,oe,ps,gs,ms,T,$a,An,Ma}from"../chunk-nz7swfds.js";import"../chunk-ndm0r1vb.js";import"../chunk-4w8d2mf0.js";export{fe as CloudflareProvider,An as DnsProviderFactory,xe as GoDaddyProvider,tt as PROXIABLE_RECORD_TYPES,se as PorkbunProvider,z as Route53Provider,oe as UnifiedDnsValidator,os as applyDeclaredZoneSettings,ls as applyZoneMigration,T as createDnsProvider,gs as createGoDaddyValidator,ps as createPorkbunValidator,ms as createRoute53Validator,sr as delegateZone,is as delegateZoneFromConfig,ss as describeDelegation,as as describeZoneSettings,$a as detectDnsProvider,Ma as dnsProviders,cs as exportRoute53Zone,nr as isNameserverRegistrar,ir as isZoneHost,ds as planZoneMigration,Tt as policyTag,hn as qualifyName,ns as reconcileDeclaredRecords,rs as resolveDeclaredRecords,fn as sameNameservers,us as verifyZoneParity};
+import{tt,se,xe,fe,Tt,hn,rs,ns,nr,ir,fn,sr,is,ss,os,as,z,cs,ds,ls,us,oe,ps,gs,ms,T,$a,An,Ma}from"../chunk-6e967ybg.js";import"../chunk-ndm0r1vb.js";import"../chunk-4w8d2mf0.js";export{fe as CloudflareProvider,An as DnsProviderFactory,xe as GoDaddyProvider,tt as PROXIABLE_RECORD_TYPES,se as PorkbunProvider,z as Route53Provider,oe as UnifiedDnsValidator,os as applyDeclaredZoneSettings,ls as applyZoneMigration,T as createDnsProvider,gs as createGoDaddyValidator,ps as createPorkbunValidator,ms as createRoute53Validator,sr as delegateZone,is as delegateZoneFromConfig,ss as describeDelegation,as as describeZoneSettings,$a as detectDnsProvider,Ma as dnsProviders,cs as exportRoute53Zone,nr as isNameserverRegistrar,ir as isZoneHost,ds as planZoneMigration,Tt as policyTag,hn as qualifyName,ns as reconcileDeclaredRecords,rs as resolveDeclaredRecords,fn as sameNameservers,us as verifyZoneParity};

package/dist/dns/route53-adapter.d.ts

@@ -24,6 +24,12 @@ export declare class Route53Provider implements DnsProvider {
     private normalizeName;
     /** A record's value as Route53 stores it: TXT quoted, MX with its priority. */
     private formatValue;
+    /**
+     * Whether two stored values are the same record. TXT compares the text the
+     * strings carry, not how it was split: a DKIM key written as three strings by
+     * another tool is still the key this provider would write as two.
+     */
+    private sameValue;
     /**
      * The record set currently at `name`/`type`, or null.
      *
@@ -79,3 +85,15 @@ export declare class Route53Provider implements DnsProvider {
         region: string;
     }): Promise<CreateRecordResult>;
 }
+/**
+ * A TXT value as Route53 wants it: quoted strings of at most 255 characters,
+ * space separated. A 2048-bit DKIM key is ~400 characters, and Route53 refuses
+ * it as one string with `CharacterStringTooLong`, so the mail DNS for every
+ * Route53 zone failed at the DKIM record. Resolvers join the strings back
+ * together, so the split is invisible to anyone reading the record.
+ *
+ * Splits before escaping, so an escape sequence is never cut in half.
+ */
+export declare function toTxtStrings(value: string): string;
+/** The text a stored TXT value carries: every quoted string, unescaped and joined. */
+export declare function parseTxtStrings(stored: string): string;

package/dist/index.js

@@ -1,4 +1,4 @@
-import{Dp,x,Pp,uf,Iy,pf,Sy,Cy,by,Ey,vy,Ty,wy,Ry,Dy,Py,Np,kp,nd,id,Ws,_,d,sd,Bp,O,od,p,gf,hi,ad,cd,le,dd,Ny,r,t,ky,By,g,xy,_y,Oy,Ly,$y,Ft,ld,Js,mf,My,Fy,Ee,He,ve,L,I,o,f,Ge,m,hf,qe,M,ut,Uy,ff,F,ud,Te,Ut,Xs,Y,pd,Z,Af,Ys,U,Q,D,fi,E,Qt,pt,H,e,Zs,Qy,xp,gd,Hy,Gy,qy,Vy,md,jy,zy,Ky,Wy,Jy,Xy,Yy,Zy,eI,tI,rI,nI,yf,If,Sf,Cf,bf,Ef,vf,Ht,_p,Op,_r,Ai,iI,Lp,sI,oI,Or,aI,cI,dI,lI,uI,pI,Tf,wf,Rf,Df,Pf,eo,gI,Nf,kf,Bf,G,mI,Ve,to,Gt,xf,$p,_f,Of,Lf,Mp,ee,hI,fI,yI,II,$f,SI,q,CI,bI,EI,Fp,Up,vI,Qp,Hp,TI,wI,RI,DI,PI,Mf,hd,NI,kI,BI,xI,_I,Ff,Uf,OI,LI,$I,MI,FI,UI,QI,HI,GI,Gp,fd,qI,VI,jI,zI,qp,Vp,jp,KI,zp,WI,JI,XI,YI,Kp,ZI,eS,tS,rS,nS,iS,sS,oS,Qf,Hf,Gf,qf,Wp,aS,cS,dS,lS,uS,pS,gS,mS,hS,Vf,jf,zf,Kf,fS,AS,Jp,yS,Xp,Yp,Zp,eg,IS,SS,CS,bS,we,yi,ES,vS,TS,wS,RS,DS,PS,NS,Wf,kS,BS,tg,rg,xS,_S,Jf,OS,LS,$S,MS,FS,US,QS,HS,GS,qS,VS,jS,zS,KS,WS,JS,XS,YS,ZS,eC,tC,ng,rC,ig,nC,sg,iC,og,sC,ag,oC,Lr,aC,cg,cC,ro,dC,dg,lC,lg,uC,ug,pC,pg,gC,gg,mC,$r,hC,mg,fC,hg,AC,fg,yC,Ag,IC,yg,SC,Ig,CC,Sg,bC,Cg,EC,bg,vC,Eg,TC,vg,wC,Tg,RC,wg,DC,Rg,PC,Dg,NC,Pg,kC,Ng,BC,kg,xC,Bg,_C,xg,OC,_g,LC,Og,$C,Lg,MC,$g,FC,Mg,UC,Xf,Yf,Zf,eA,Fg,QC,Ug,HC,Qg,GC,Hg,qC,Ii,tA,rA,no,Ad,Mr,nA,io,qt,yd,Id,iA,sA,Gg,oA,Sd,qg,VC,jC,so,oo,ao,Cd,Si,bd,Ed,co,vd,Td,Vg,aA,cA,dA,zC,lA,uA,KC,pA,jg,gA,mA,hA,WC,fA,Ci,wd,AA,JC,yA,lo,uo,Rd,zg,XC,Kg,YC,Wg,ZC,Jg,eb,Xg,tb}from"./chunk-dbzveymg.js";import{Ao,Yg,_d,SA,Ti,Od,yo,Zg,em,Fr,Io,Ld,je,$d,Md,Fd,wi,Ur,tm,ze,Ud,So,Co,bo,Qd,Hd,Gd,Ri,Eo,qd,Qr,Di,vo,gt,rm,Vd,jd,nm,zd,To,Vt,Kd,Wd,Jd,Xd,Ke,im,Yd,jt,wo,Ro,Do,Pi,Ni,Hr,Zd,ki,Po,No,Gr,el,qr,sm,om,mt,Vr,ko,am,tl,rl,Bo,nl,il,sl,CA,te,ol,bA,EA,Bi,xi,vA,ue,cm,ht,Re,De,ft,al,cl,dl,ll,dm,lm,xo,um,pm,_o,ul,pl,gm,re,mm,gl,pe,Oo,We,At,yt,jr,_i,ml,TA,Lo,hm,fm,Am,ym,$o,Mo,hl,zr,Fo,fl,Oi,Al,Uo,Qo,Ho,Go,qo,Vo,jo,zo,yl,zt,Ko,Il,Kr,Sl,Wo,Jo,Cl,Kt,Xo,Yo,Im,wA,Li,RA,DA,PA,Zo,ea,bl,Sm,ta,Wr,El,$i,vl,Tl,wl,ra,Cm,na,Rl,bm,ia,Em,Jr,Xr,Dl,Mi,_l,Ml,Ui,Wt,oa,Yr,Zr,Jt,Je,km,ca,Bm,xm,Ql,da,Hi,Hl,la,St,Ne,Gl,ua,pa,ql,ga,ma,ha,fa,Vl,jl,tn,Aa,ya,Ia,Sa,zl,Gi,rn,qi,Ca}from"./chunk-s4r2tfpx.js";import{B,Sr,yc,vs,u,rp,np}from"./chunk-w41zkaey.js";import{ot,Ac,Yn,Zn,ei,tp}from"./chunk-v99q99bs.js";import{lh,uh,ph,Lu,$u,Mu,gh,Fu,Uu,mh,hh,Qu,fh,Ah,hc,Hu,yh,Ih,Gu,Sh,Ch,bh,Eh,vh,Th,wh,Xn,fc,qu,Vu,ju,zu,Ku,Wu,Ju,Xu,Yu,Zu,ep,Rh,Dh,Ph,Nh,kh,Bh,xh}from"./chunk-7rygewtr.js";import{Fe,Ic,de,Bt,Sc,w,xt,at,Cc,Ts,Lh,ip,bc,s,ti,ws,Cr,Ec,vc,br,$h,Tc,hy,fy,Rs,Ay,yy,wc,Rc,ri,Ds,X,c,Ps,Ue,Er,Mh,Fh,Dc,_t,Uh,Ns,Qh,Hh,ks,Pc,vr,Bs,Gh,Nc,sp,Ot,Tr,qh,xs,Vh,R,jh,kc,op,_s,zh,Kh,Wh,Bc,ni,Os,xc,Lt,ct,Jh,wr,Xh,_c,ap,cp,Ls,Oc,Lc,dt,dp,ii,$c,$s,Rr,lp,si,Mc,Fc,oi,up,Uc,Qc,Hc,Gc,Ms,pp,gp,Yh,mp,qc,ai,hp,fp,Fs,Dr,Us,Qs,Hs,Vc,Ap,jc,Gs,Zh,$t,ef,zc,Pr,Kc,tf,Wc,yp,ci,Nr,qs,di,Qe,rf,Ip,Sp,Mt,Jc,Xc,Yc,li,ui,pi,nf,sf,lt,Vs,of,kr,Cp,js,af,bp,Ep,vp,cf,Tp,wp,df,i,lf,gi,zs,Ks}from"./chunk-wkbk6pdg.js";import{n}from"./chunk-4w8d2mf0.js";import{a}from"./chunk-t5e5phth.js";import{ge,Xi,Yi,Jl,wa,Ra,Zi,Da,Xe,V,Ye,ne,C,me,an,Pa,ke,Na,cn,dn,ln,Ct,bt,Et,un,Yt,ka,Zt,er,Ze,pn,xa,vt,tr,gn,Oa,eu,tu,La,rr}from"./chunk-wp6pg5sx.js";import{tt,se,xe,ts,fe,Tt,hn,rs,ns,nr,ir,fn,sr,is,ss,os,as,z,cs,ds,ls,us,oe,ps,gs,ms,T,$a,An,Ma,ae,or}from"./chunk-nz7swfds.js";import{he,et,mn}from"./chunk-3nccgrzf.js";import{j}from"./chunk-1bxqrj7m.js";import{ru,Fa,Ae,Ua,yn,nu,Qa,iu,su,Vm,Sn,fs,Cn,bn,En,K,_e,N,ur,Tn,pr,ce,qa,wn,Va,gr,Ka,Oe,W,Le,$e,nt,Se,mr,Ce,Pn,Nn,kn,Bn,xn,_n,On,hr,k,Is,wu,tc,$n,Mn,Un,Qn,Hn,Gn,qn,jn,lc,Ss,uc,Nt,zn,Cs,bs,pc,Kn,gc}from"./chunk-jf7w1v9z.js";import{Dd,po,bi,Ei,go,Pd,Nd,vi,mo,ho,Bd,xd,fo}from"./chunk-jghkvdgt.js";import{ba,nn,sn,Vi,ji,zi,Ki,Ea,va}from"./chunk-7248warz.js";import{Ta}from"./chunk-fjqx22m1.js";import{A}from"./chunk-30504159.js";import{Be}from"./chunk-r5pjnw74.js";import{y}from"./chunk-ndm0r1vb.js";import{J,Wn,Es,mc,Jn,Ou}from"./chunk-9rkyxwex.js";import{Ar,be}from"./chunk-aszeyg2w.js";import{h}from"./chunk-f5mqecfk.js";import{ah,Me}from"./chunk-gdbtz492.js";import{Zc,Br,ed,td,rd,mi,Rp,xr}from"./chunk-9s5sm0wt.js";import{createHmac as ys,createSign as Ll,timingSafeEqual as Fl}from"node:crypto";function Wi(l){let S=l instanceof Date?l.getTime():l;if(!Number.isFinite(S))throw TypeError("Media access timestamp must be finite");return Math.floor(S/1000)}function As(l){return Buffer.from(l).toString("base64").replaceAll("+","-").replaceAll("=","_").replaceAll("/","~")}function Bl(l){return Buffer.from(l).toString("base64url")}function ec(l,S=!1){if(!l||/[\r\n]/.test(l))throw TypeError("Media resource is invalid");let b=S?l.replaceAll("*","wildcard"):l,P=new URL(b);if(!["http:","https:"].includes(P.protocol))throw TypeError("Media resource must use HTTP or HTTPS");if(!S&&l.includes("*"))throw TypeError("Canned policies cannot contain wildcards")}function rc(l,S){let b=Ll("RSA-SHA1");return b.update(l),b.end(),As(b.sign(S))}function nc(l){ec(l.resource,!0);let b={DateLessThan:{"AWS:EpochTime":Wi(l.expiresAt)}};if(l.activeAt!==void 0)b.DateGreaterThan={"AWS:EpochTime":Wi(l.activeAt)};if(l.ipAddress)b.IpAddress={"AWS:SourceIp":l.ipAddress};return JSON.stringify({Statement:[{Resource:l.resource,Condition:b}]})}function Nu(l,S,b){ec(l);let P=Wi(S),v=l.includes("?")?"&":"?",it=nc({resource:l,expiresAt:S}),Pe=rc(it,b.privateKey);return`${l}${v}Expires=${P}&Signature=${encodeURIComponent(Pe)}&Key-Pair-Id=${encodeURIComponent(b.keyPairId)}`}function ku(l,S){let b=nc(l);return{"CloudFront-Key-Pair-Id":S.keyPairId,"CloudFront-Policy":As(Buffer.from(b)),"CloudFront-Signature":rc(b,S.privateKey)}}function xu(l){if(!l.resource||/[\r\n]/.test(l.resource))throw TypeError("Media resource is invalid");let S=Bl(Buffer.from(JSON.stringify({resource:l.resource,expiresAt:Wi(l.expiresAt),...l.keyId?{keyId:l.keyId}:{},...l.audience?{audience:l.audience}:{}}))),b=ys("sha256",l.secret).update(S).digest("base64url");return`${S}.${b}`}function _u(l,S){let[b,P,v]=l.split(".");if(!b||!P||v)return null;let it=ys("sha256",S.secret).update(b).digest(),Pe;try{Pe=Buffer.from(P,"base64url")}catch{return null}if(it.length!==Pe.length||!Fl(it,Pe))return null;try{let Ie=JSON.parse(Buffer.from(b,"base64url").toString("utf8")),rt=Wi(S.now??Date.now());if(!Ie.resource||!Number.isSafeInteger(Ie.expiresAt)||Ie.expiresAt<=rt)return null;if(S.resource&&Ie.resource!==S.resource)return null;if(S.audience&&Ie.audience!==S.audience)return null;return Ie}catch{return null}}function Bu(l,S=!1){let b=new URL(l,"https://media.invalid").pathname.toLowerCase(),P=/\.(?:m3u8|mpd|vtt|json)$/.test(b),v=/\.(?:key|license)$/.test(b)||b.includes("/keys/")||b.includes("/licenses/");return{"Accept-Ranges":"bytes","Cache-Control":S&&(P||v)?"private, no-store":P?"public, max-age=5, s-maxage=30, stale-while-revalidate=30":"public, max-age=31536000, immutable","Cross-Origin-Resource-Policy":"cross-origin","X-Content-Type-Options":"nosniff"}}function Rm(l){if(!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(l.bucket))throw TypeError("Media bucket is invalid");if(!/^[a-z0-9-]+$/.test(l.region))throw TypeError("Media bucket region is invalid");let S=l.prefix?`/${l.prefix.replace(/^\/+|\/+$/g,"")}`:"",b=l.protected??!1,P="public, max-age=31536000, immutable",v=b?"private, no-store":"public, max-age=5, s-maxage=30, stale-while-revalidate=30";return{originDomain:`${l.bucket}.s3.${l.region}.amazonaws.com`,originPath:S,domain:l.domain,trustedKeyGroupIds:[...new Set(l.trustedKeyGroupIds??[])],behaviors:[{pathPattern:"*.m3u8",cacheControl:v,compress:!0,signed:b},{pathPattern:"*.mpd",cacheControl:v,compress:!0,signed:b},{pathPattern:"*.vtt",cacheControl:v,compress:!0,signed:b},{pathPattern:"*",cacheControl:P,compress:!1,signed:b}],responseHeaders:{"Access-Control-Allow-Headers":"Range, If-Range","Access-Control-Allow-Methods":"GET, HEAD, OPTIONS","Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":"Accept-Ranges, Content-Length, Content-Range, ETag","X-Content-Type-Options":"nosniff"}}}class Wl{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;constructor(l){this.config=l.config,this.environment=l.environment,this.builder=new dd(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let S=this.config.environments[this.environment]?.infrastructure;if(!S)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...S,compute:{...this.config.infrastructure?.compute,...S.compute},storage:{...this.config.infrastructure?.storage,...S.storage},functions:{...this.config.infrastructure?.functions,...S.functions},servers:{...this.config.infrastructure?.servers,...S.servers},databases:{...this.config.infrastructure?.databases,...S.databases},cdn:{...this.config.infrastructure?.cdn,...S.cdn},sftp:S.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...S.queues},redirects:{...this.config.infrastructure?.redirects,...S.redirects},realtime:{...this.config.infrastructure?.realtime,...S.realtime},cache:{...this.config.infrastructure?.cache,...S.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...S.fileSystem},email:{...this.config.infrastructure?.email,...S.email},search:{...this.config.infrastructure?.search,...S.search},ai:{...this.config.infrastructure?.ai,...S.ai}}}}shouldDeploy(l){if(l.environments&&!l.environments.includes(this.environment))return!1;if(l.requiresFeatures){let S=this.config.features||{};if(!l.requiresFeatures.every((P)=>S[P]===!0))return!1}if(l.regions){let S=this.config.environments[this.environment]?.region||this.config.project.region;if(!l.regions.includes(S))return!1}if(l.condition&&typeof l.condition==="function")return l.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let l=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,S=Number(l||3008);return Number.isFinite(S)&&S>0?S:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(l,S){return l==="public"||S.routeCompute===!0}storageBucketName(l,S,b){return this.mergedConfig.infrastructure?.storage?.[b]?.bucket??`${l}-${S}-${b}`}fileSystemLogicalId(l,S,b){return t(r({slug:`${l}-${b}`,environment:S,resourceType:"efs"}))}resolveSftpStorage(l,S,b){let P=l.storage;if(P?.type==="efs"&&P.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[P.fileSystem])throw Error(`sftp: storage.fileSystem "${P.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(S,b,P.fileSystem)},posixProfile:P.posixProfile}}if(P?.type==="s3"&&P.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[P.storageBucket])throw Error(`sftp: storage.storageBucket "${P.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(S,b,P.storageBucket)}}return}resolveComputeCachePathPatterns(l){if(l&&l.length>0)return l;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(l,S){return{PathPattern:l,TargetOriginId:S,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(l,S,b,P,v,it){let Pe=this.serverEipLogicalIds.get("app"),Ie=this.serverEipLogicalIds.get("appInstance");if(!Pe)return;let rt=`EC2-${P}-${v}-api`,Rt=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",st=Rt==="us-east-1"?".compute-1.amazonaws.com":`.${Rt}.compute.amazonaws.com`,lr={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:Pe}]}]},st]]},Xt=this.resolveApiOriginPort();if(l.push({Id:rt,DomainName:lr,CustomOriginConfig:{HTTPPort:Xt,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),b.push(Pe),Ie)b.push(Ie);for(let fr of it)S.push(this.createComputeCacheBehavior(fr,rt))}buildCaddyfile(l){let S=l.filter(([,v])=>typeof v.domain==="string"&&v.domain&&typeof v.port==="number");if(S.length===0)return;let b=new Map;for(let[,v]of S){let it=b.get(v.domain)??[];it.push({port:v.port,path:v.path}),b.set(v.domain,it)}let P=[];for(let[v,it]of b){let Ie=[...it].sort((rt,Rt)=>{let st=!rt.path||rt.path==="/",lr=!Rt.path||Rt.path==="/";if(st&&!lr)return 1;if(!st&&lr)return-1;return(Rt.path?.length??0)-(rt.path?.length??0)}).map((rt)=>{let Rt=!rt.path||rt.path==="/",st=`reverse_proxy localhost:${rt.port}`;return Rt?`  handle {
+import{Dp,x,Pp,uf,Iy,pf,Sy,Cy,by,Ey,vy,Ty,wy,Ry,Dy,Py,Np,kp,nd,id,Ws,_,d,sd,Bp,O,od,p,gf,hi,ad,cd,le,dd,Ny,r,t,ky,By,g,xy,_y,Oy,Ly,$y,Ft,ld,Js,mf,My,Fy,Ee,He,ve,L,I,o,f,Ge,m,hf,qe,M,ut,Uy,ff,F,ud,Te,Ut,Xs,Y,pd,Z,Af,Ys,U,Q,D,fi,E,Qt,pt,H,e,Zs,Qy,xp,gd,Hy,Gy,qy,Vy,md,jy,zy,Ky,Wy,Jy,Xy,Yy,Zy,eI,tI,rI,nI,yf,If,Sf,Cf,bf,Ef,vf,Ht,_p,Op,_r,Ai,iI,Lp,sI,oI,Or,aI,cI,dI,lI,uI,pI,Tf,wf,Rf,Df,Pf,eo,gI,Nf,kf,Bf,G,mI,Ve,to,Gt,xf,$p,_f,Of,Lf,Mp,ee,hI,fI,yI,II,$f,SI,q,CI,bI,EI,Fp,Up,vI,Qp,Hp,TI,wI,RI,DI,PI,Mf,hd,NI,kI,BI,xI,_I,Ff,Uf,OI,LI,$I,MI,FI,UI,QI,HI,GI,Gp,fd,qI,VI,jI,zI,qp,Vp,jp,KI,zp,WI,JI,XI,YI,Kp,ZI,eS,tS,rS,nS,iS,sS,oS,Qf,Hf,Gf,qf,Wp,aS,cS,dS,lS,uS,pS,gS,mS,hS,Vf,jf,zf,Kf,fS,AS,Jp,yS,Xp,Yp,Zp,eg,IS,SS,CS,bS,we,yi,ES,vS,TS,wS,RS,DS,PS,NS,Wf,kS,BS,tg,rg,xS,_S,Jf,OS,LS,$S,MS,FS,US,QS,HS,GS,qS,VS,jS,zS,KS,WS,JS,XS,YS,ZS,eC,tC,ng,rC,ig,nC,sg,iC,og,sC,ag,oC,Lr,aC,cg,cC,ro,dC,dg,lC,lg,uC,ug,pC,pg,gC,gg,mC,$r,hC,mg,fC,hg,AC,fg,yC,Ag,IC,yg,SC,Ig,CC,Sg,bC,Cg,EC,bg,vC,Eg,TC,vg,wC,Tg,RC,wg,DC,Rg,PC,Dg,NC,Pg,kC,Ng,BC,kg,xC,Bg,_C,xg,OC,_g,LC,Og,$C,Lg,MC,$g,FC,Mg,UC,Xf,Yf,Zf,eA,Fg,QC,Ug,HC,Qg,GC,Hg,qC,Ii,tA,rA,no,Ad,Mr,nA,io,qt,yd,Id,iA,sA,Gg,oA,Sd,qg,VC,jC,so,oo,ao,Cd,Si,bd,Ed,co,vd,Td,Vg,aA,cA,dA,zC,lA,uA,KC,pA,jg,gA,mA,hA,WC,fA,Ci,wd,AA,JC,yA,lo,uo,Rd,zg,XC,Kg,YC,Wg,ZC,Jg,eb,Xg,tb}from"./chunk-dbzveymg.js";import{Ao,Yg,_d,SA,Ti,Od,yo,Zg,em,Fr,Io,Ld,je,$d,Md,Fd,wi,Ur,tm,ze,Ud,So,Co,bo,Qd,Hd,Gd,Ri,Eo,qd,Qr,Di,vo,gt,rm,Vd,jd,nm,zd,To,Vt,Kd,Wd,Jd,Xd,Ke,im,Yd,jt,wo,Ro,Do,Pi,Ni,Hr,Zd,ki,Po,No,Gr,el,qr,sm,om,mt,Vr,ko,am,tl,rl,Bo,nl,il,sl,CA,te,ol,bA,EA,Bi,xi,vA,ue,cm,ht,Re,De,ft,al,cl,dl,ll,dm,lm,xo,um,pm,_o,ul,pl,gm,re,mm,gl,pe,Oo,We,At,yt,jr,_i,ml,TA,Lo,hm,fm,Am,ym,$o,Mo,hl,zr,Fo,fl,Oi,Al,Uo,Qo,Ho,Go,qo,Vo,jo,zo,yl,zt,Ko,Il,Kr,Sl,Wo,Jo,Cl,Kt,Xo,Yo,Im,wA,Li,RA,DA,PA,Zo,ea,bl,Sm,ta,Wr,El,$i,vl,Tl,wl,ra,Cm,na,Rl,bm,ia,Em,Jr,Xr,Dl,Mi,_l,Ml,Ui,Wt,oa,Yr,Zr,Jt,Je,km,ca,Bm,xm,Ql,da,Hi,Hl,la,St,Ne,Gl,ua,pa,ql,ga,ma,ha,fa,Vl,jl,tn,Aa,ya,Ia,Sa,zl,Gi,rn,qi,Ca}from"./chunk-adj8jak1.js";import{B,Sr,yc,vs,u,rp,np}from"./chunk-w41zkaey.js";import{ot,Ac,Yn,Zn,ei,tp}from"./chunk-v99q99bs.js";import{lh,uh,ph,Lu,$u,Mu,gh,Fu,Uu,mh,hh,Qu,fh,Ah,hc,Hu,yh,Ih,Gu,Sh,Ch,bh,Eh,vh,Th,wh,Xn,fc,qu,Vu,ju,zu,Ku,Wu,Ju,Xu,Yu,Zu,ep,Rh,Dh,Ph,Nh,kh,Bh,xh}from"./chunk-7rygewtr.js";import{Fe,Ic,de,Bt,Sc,w,xt,at,Cc,Ts,Lh,ip,bc,s,ti,ws,Cr,Ec,vc,br,$h,Tc,hy,fy,Rs,Ay,yy,wc,Rc,ri,Ds,X,c,Ps,Ue,Er,Mh,Fh,Dc,_t,Uh,Ns,Qh,Hh,ks,Pc,vr,Bs,Gh,Nc,sp,Ot,Tr,qh,xs,Vh,R,jh,kc,op,_s,zh,Kh,Wh,Bc,ni,Os,xc,Lt,ct,Jh,wr,Xh,_c,ap,cp,Ls,Oc,Lc,dt,dp,ii,$c,$s,Rr,lp,si,Mc,Fc,oi,up,Uc,Qc,Hc,Gc,Ms,pp,gp,Yh,mp,qc,ai,hp,fp,Fs,Dr,Us,Qs,Hs,Vc,Ap,jc,Gs,Zh,$t,ef,zc,Pr,Kc,tf,Wc,yp,ci,Nr,qs,di,Qe,rf,Ip,Sp,Mt,Jc,Xc,Yc,li,ui,pi,nf,sf,lt,Vs,of,kr,Cp,js,af,bp,Ep,vp,cf,Tp,wp,df,i,lf,gi,zs,Ks}from"./chunk-wkbk6pdg.js";import{n}from"./chunk-4w8d2mf0.js";import{a}from"./chunk-t5e5phth.js";import{ge,Xi,Yi,Jl,wa,Ra,Zi,Da,Xe,V,Ye,ne,C,me,an,Pa,ke,Na,cn,dn,ln,Ct,bt,Et,un,Yt,ka,Zt,er,Ze,pn,xa,vt,tr,gn,Oa,eu,tu,La,rr}from"./chunk-wp6pg5sx.js";import{tt,se,xe,ts,fe,Tt,hn,rs,ns,nr,ir,fn,sr,is,ss,os,as,z,cs,ds,ls,us,oe,ps,gs,ms,T,$a,An,Ma,ae,or}from"./chunk-6e967ybg.js";import{he,et,mn}from"./chunk-3nccgrzf.js";import{j}from"./chunk-1bxqrj7m.js";import{ru,Fa,Ae,Ua,yn,nu,Qa,iu,su,Vm,Sn,fs,Cn,bn,En,K,_e,N,ur,Tn,pr,ce,qa,wn,Va,gr,Ka,Oe,W,Le,$e,nt,Se,mr,Ce,Pn,Nn,kn,Bn,xn,_n,On,hr,k,Is,wu,tc,$n,Mn,Un,Qn,Hn,Gn,qn,jn,lc,Ss,uc,Nt,zn,Cs,bs,pc,Kn,gc}from"./chunk-jf7w1v9z.js";import{Dd,po,bi,Ei,go,Pd,Nd,vi,mo,ho,Bd,xd,fo}from"./chunk-jghkvdgt.js";import{ba,nn,sn,Vi,ji,zi,Ki,Ea,va}from"./chunk-kksj2fy7.js";import{Ta}from"./chunk-fjqx22m1.js";import{A}from"./chunk-30504159.js";import{Be}from"./chunk-r5pjnw74.js";import{y}from"./chunk-ndm0r1vb.js";import{J,Wn,Es,mc,Jn,Ou}from"./chunk-9rkyxwex.js";import{Ar,be}from"./chunk-aszeyg2w.js";import{h}from"./chunk-f5mqecfk.js";import{ah,Me}from"./chunk-gdbtz492.js";import{Zc,Br,ed,td,rd,mi,Rp,xr}from"./chunk-9s5sm0wt.js";import{createHmac as ys,createSign as Ll,timingSafeEqual as Fl}from"node:crypto";function Wi(l){let S=l instanceof Date?l.getTime():l;if(!Number.isFinite(S))throw TypeError("Media access timestamp must be finite");return Math.floor(S/1000)}function As(l){return Buffer.from(l).toString("base64").replaceAll("+","-").replaceAll("=","_").replaceAll("/","~")}function Bl(l){return Buffer.from(l).toString("base64url")}function ec(l,S=!1){if(!l||/[\r\n]/.test(l))throw TypeError("Media resource is invalid");let b=S?l.replaceAll("*","wildcard"):l,P=new URL(b);if(!["http:","https:"].includes(P.protocol))throw TypeError("Media resource must use HTTP or HTTPS");if(!S&&l.includes("*"))throw TypeError("Canned policies cannot contain wildcards")}function rc(l,S){let b=Ll("RSA-SHA1");return b.update(l),b.end(),As(b.sign(S))}function nc(l){ec(l.resource,!0);let b={DateLessThan:{"AWS:EpochTime":Wi(l.expiresAt)}};if(l.activeAt!==void 0)b.DateGreaterThan={"AWS:EpochTime":Wi(l.activeAt)};if(l.ipAddress)b.IpAddress={"AWS:SourceIp":l.ipAddress};return JSON.stringify({Statement:[{Resource:l.resource,Condition:b}]})}function Nu(l,S,b){ec(l);let P=Wi(S),v=l.includes("?")?"&":"?",it=nc({resource:l,expiresAt:S}),Pe=rc(it,b.privateKey);return`${l}${v}Expires=${P}&Signature=${encodeURIComponent(Pe)}&Key-Pair-Id=${encodeURIComponent(b.keyPairId)}`}function ku(l,S){let b=nc(l);return{"CloudFront-Key-Pair-Id":S.keyPairId,"CloudFront-Policy":As(Buffer.from(b)),"CloudFront-Signature":rc(b,S.privateKey)}}function xu(l){if(!l.resource||/[\r\n]/.test(l.resource))throw TypeError("Media resource is invalid");let S=Bl(Buffer.from(JSON.stringify({resource:l.resource,expiresAt:Wi(l.expiresAt),...l.keyId?{keyId:l.keyId}:{},...l.audience?{audience:l.audience}:{}}))),b=ys("sha256",l.secret).update(S).digest("base64url");return`${S}.${b}`}function _u(l,S){let[b,P,v]=l.split(".");if(!b||!P||v)return null;let it=ys("sha256",S.secret).update(b).digest(),Pe;try{Pe=Buffer.from(P,"base64url")}catch{return null}if(it.length!==Pe.length||!Fl(it,Pe))return null;try{let Ie=JSON.parse(Buffer.from(b,"base64url").toString("utf8")),rt=Wi(S.now??Date.now());if(!Ie.resource||!Number.isSafeInteger(Ie.expiresAt)||Ie.expiresAt<=rt)return null;if(S.resource&&Ie.resource!==S.resource)return null;if(S.audience&&Ie.audience!==S.audience)return null;return Ie}catch{return null}}function Bu(l,S=!1){let b=new URL(l,"https://media.invalid").pathname.toLowerCase(),P=/\.(?:m3u8|mpd|vtt|json)$/.test(b),v=/\.(?:key|license)$/.test(b)||b.includes("/keys/")||b.includes("/licenses/");return{"Accept-Ranges":"bytes","Cache-Control":S&&(P||v)?"private, no-store":P?"public, max-age=5, s-maxage=30, stale-while-revalidate=30":"public, max-age=31536000, immutable","Cross-Origin-Resource-Policy":"cross-origin","X-Content-Type-Options":"nosniff"}}function Rm(l){if(!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(l.bucket))throw TypeError("Media bucket is invalid");if(!/^[a-z0-9-]+$/.test(l.region))throw TypeError("Media bucket region is invalid");let S=l.prefix?`/${l.prefix.replace(/^\/+|\/+$/g,"")}`:"",b=l.protected??!1,P="public, max-age=31536000, immutable",v=b?"private, no-store":"public, max-age=5, s-maxage=30, stale-while-revalidate=30";return{originDomain:`${l.bucket}.s3.${l.region}.amazonaws.com`,originPath:S,domain:l.domain,trustedKeyGroupIds:[...new Set(l.trustedKeyGroupIds??[])],behaviors:[{pathPattern:"*.m3u8",cacheControl:v,compress:!0,signed:b},{pathPattern:"*.mpd",cacheControl:v,compress:!0,signed:b},{pathPattern:"*.vtt",cacheControl:v,compress:!0,signed:b},{pathPattern:"*",cacheControl:P,compress:!1,signed:b}],responseHeaders:{"Access-Control-Allow-Headers":"Range, If-Range","Access-Control-Allow-Methods":"GET, HEAD, OPTIONS","Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":"Accept-Ranges, Content-Length, Content-Range, ETag","X-Content-Type-Options":"nosniff"}}}class Wl{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;constructor(l){this.config=l.config,this.environment=l.environment,this.builder=new dd(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let S=this.config.environments[this.environment]?.infrastructure;if(!S)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...S,compute:{...this.config.infrastructure?.compute,...S.compute},storage:{...this.config.infrastructure?.storage,...S.storage},functions:{...this.config.infrastructure?.functions,...S.functions},servers:{...this.config.infrastructure?.servers,...S.servers},databases:{...this.config.infrastructure?.databases,...S.databases},cdn:{...this.config.infrastructure?.cdn,...S.cdn},sftp:S.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...S.queues},redirects:{...this.config.infrastructure?.redirects,...S.redirects},realtime:{...this.config.infrastructure?.realtime,...S.realtime},cache:{...this.config.infrastructure?.cache,...S.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...S.fileSystem},email:{...this.config.infrastructure?.email,...S.email},search:{...this.config.infrastructure?.search,...S.search},ai:{...this.config.infrastructure?.ai,...S.ai}}}}shouldDeploy(l){if(l.environments&&!l.environments.includes(this.environment))return!1;if(l.requiresFeatures){let S=this.config.features||{};if(!l.requiresFeatures.every((P)=>S[P]===!0))return!1}if(l.regions){let S=this.config.environments[this.environment]?.region||this.config.project.region;if(!l.regions.includes(S))return!1}if(l.condition&&typeof l.condition==="function")return l.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let l=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,S=Number(l||3008);return Number.isFinite(S)&&S>0?S:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(l,S){return l==="public"||S.routeCompute===!0}storageBucketName(l,S,b){return this.mergedConfig.infrastructure?.storage?.[b]?.bucket??`${l}-${S}-${b}`}fileSystemLogicalId(l,S,b){return t(r({slug:`${l}-${b}`,environment:S,resourceType:"efs"}))}resolveSftpStorage(l,S,b){let P=l.storage;if(P?.type==="efs"&&P.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[P.fileSystem])throw Error(`sftp: storage.fileSystem "${P.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(S,b,P.fileSystem)},posixProfile:P.posixProfile}}if(P?.type==="s3"&&P.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[P.storageBucket])throw Error(`sftp: storage.storageBucket "${P.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(S,b,P.storageBucket)}}return}resolveComputeCachePathPatterns(l){if(l&&l.length>0)return l;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(l,S){return{PathPattern:l,TargetOriginId:S,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(l,S,b,P,v,it){let Pe=this.serverEipLogicalIds.get("app"),Ie=this.serverEipLogicalIds.get("appInstance");if(!Pe)return;let rt=`EC2-${P}-${v}-api`,Rt=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",st=Rt==="us-east-1"?".compute-1.amazonaws.com":`.${Rt}.compute.amazonaws.com`,lr={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:Pe}]}]},st]]},Xt=this.resolveApiOriginPort();if(l.push({Id:rt,DomainName:lr,CustomOriginConfig:{HTTPPort:Xt,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),b.push(Pe),Ie)b.push(Ie);for(let fr of it)S.push(this.createComputeCacheBehavior(fr,rt))}buildCaddyfile(l){let S=l.filter(([,v])=>typeof v.domain==="string"&&v.domain&&typeof v.port==="number");if(S.length===0)return;let b=new Map;for(let[,v]of S){let it=b.get(v.domain)??[];it.push({port:v.port,path:v.path}),b.set(v.domain,it)}let P=[];for(let[v,it]of b){let Ie=[...it].sort((rt,Rt)=>{let st=!rt.path||rt.path==="/",lr=!Rt.path||Rt.path==="/";if(st&&!lr)return 1;if(!st&&lr)return-1;return(Rt.path?.length??0)-(rt.path?.length??0)}).map((rt)=>{let Rt=!rt.path||rt.path==="/",st=`reverse_proxy localhost:${rt.port}`;return Rt?`  handle {
     ${st}
   }`:`  handle ${rt.path} {
     ${st}
@@ -602,4 +602,4 @@ async function handleRequest(request: Request): Promise<Response> {
   return new Response('Hello from Stacks!')
 }
 `}async function pu(l,S,b){let P=`_acme-challenge.${S}`;if(await fu(l,S,P,b))return;let v=await l.createRecord(S,{name:P,type:"TXT",content:b,ttl:60});if(!v.success)throw Error(`Failed to create DNS challenge record: ${v.message}`)}async function mu(l,S,b){let P=await l.deleteRecord(S,{name:`_acme-challenge.${S}`,type:"TXT",content:b});if(!P.success)console.warn(`Failed to delete DNS challenge record: ${P.message}`)}async function fu(l,S,b,P){try{let v=await l.listRecords(S,"TXT"),it=b.replace(/\.$/,"").toLowerCase();return(v.records??[]).some((Pe)=>Pe.name.replace(/\.$/,"").toLowerCase()===it&&Pe.content.replace(/^"|"$/g,"")===P)}catch{return!1}}function ic(l){let{hostedZoneId:S,dnsProvider:b,region:P="us-east-1"}=l;if(b)return T(b);if(S)return new z(P,S);throw Error("Either dnsProvider or hostedZoneId must be provided")}async function Gm(l){await pu(ic(l),l.domain,l.challengeValue)}async function Um(l){await mu(ic(l),l.domain,l.challengeValue)}function jm(l){try{let{execSync:S}=Me("node:child_process"),b=S(`openssl x509 -checkend 2592000 -noout -in ${l}/cert.pem`,{encoding:"utf-8",stdio:["pipe","pipe","pipe"]});return!1}catch{return!0}}import{createHash as oc,createSign as gu,generateKeyPairSync as ac}from"node:crypto";var sc={production:"https://acme-v02.api.letsencrypt.org/directory",staging:"https://acme-staging-v02.api.letsencrypt.org/directory"};class hu{directoryUrl;email;accountKey;accountUrl=null;directory=null;nonce=null;constructor(l){this.directoryUrl=l.staging?sc.staging:sc.production,this.email=l.email,this.accountKey=l.accountKey||this.generateAccountKey()}generateAccountKey(){let{privateKey:l}=ac("ec",{namedCurve:"P-256"});return l.export({type:"pkcs8",format:"pem"})}async getDirectory(){if(this.directory)return this.directory;let l=await fetch(this.directoryUrl);if(!l.ok)throw Error(`Failed to fetch ACME directory: ${l.status}`);return this.directory=await l.json(),this.directory}async getNonce(){if(this.nonce){let P=this.nonce;return this.nonce=null,P}let l=await this.getDirectory(),b=(await fetch(l.newNonce,{method:"HEAD"})).headers.get("replay-nonce");if(!b)throw Error("Failed to get nonce from ACME server");return b}getJwk(){let l=this.accountKey.split(`
-`).filter((it)=>!it.startsWith("-----")).join(""),S=Buffer.from(l,"base64"),b=S.length-65,P=S.subarray(b+1,b+33),v=S.subarray(b+33,b+65);return{kty:"EC",crv:"P-256",x:this.base64UrlEncode(P),y:this.base64UrlEncode(v)}}getJwkThumbprint(){let l=this.getJwk(),S=JSON.stringify({crv:l.crv,kty:l.kty,x:l.x,y:l.y}),b=oc("sha256").update(S).digest();return this.base64UrlEncode(b)}base64UrlEncode(l){return(typeof l==="string"?Buffer.from(l):l).toString("base64").replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async signPayload(l,S){let b=await this.getNonce(),P=this.getJwk(),v={alg:"ES256",nonce:b,url:l};if(this.accountUrl)v.kid=this.accountUrl;else v.jwk=P;let it=this.base64UrlEncode(JSON.stringify(v)),Pe=S===""?"":this.base64UrlEncode(JSON.stringify(S)),Ie=`${it}.${Pe}`,rt=gu("SHA256");rt.update(Ie);let Rt=rt.sign(this.accountKey),st=Rt.subarray(4,4+Rt[3]),lr=4+Rt[3]+2,Xt=Rt.subarray(lr,lr+Rt[lr-1]),fr=Buffer.alloc(32),It=Buffer.alloc(32);st.copy(fr,32-st.length),Xt.copy(It,32-Xt.length);let Pt=Buffer.concat([fr,It]);return JSON.stringify({protected:it,payload:Pe,signature:this.base64UrlEncode(Pt)})}async acmeRequest(l,S){let b=await this.signPayload(l,S),P=await fetch(l,{method:"POST",headers:{"Content-Type":"application/jose+json"},body:b}),v=P.headers.get("replay-nonce");if(v)this.nonce=v;let it,Pe=P.headers.get("content-type");if(Pe?.includes("application/json")||Pe?.includes("application/problem+json"))it=await P.json();else it=await P.text();if(!P.ok)throw Error(`ACME request failed: ${JSON.stringify(it)}`);return{body:it,headers:P.headers}}async registerAccount(){let l=await this.getDirectory(),{body:S,headers:b}=await this.acmeRequest(l.newAccount,{termsOfServiceAgreed:!0,contact:[`mailto:${this.email}`]}),P=b.get("location");if(!P)throw Error("No account URL returned");return this.accountUrl=P,P}async createOrder(l){if(!this.accountUrl)await this.registerAccount();let S=await this.getDirectory(),{body:b,headers:P}=await this.acmeRequest(S.newOrder,{identifiers:l.map((it)=>({type:"dns",value:it}))}),v=P.get("location");if(!v)throw Error("No order URL returned");return{orderUrl:v,authorizations:b.authorizations,finalize:b.finalize}}async getAuthorization(l){let{body:S}=await this.acmeRequest(l,""),b=S.identifier.value,P=this.getJwkThumbprint(),v=S.challenges.filter((it)=>it.type==="http-01"||it.type==="dns-01").map((it)=>{let Pe=`${it.token}.${P}`;if(it.type==="http-01")return{type:"http-01",token:it.token,keyAuthorization:Pe,identifier:`/.well-known/acme-challenge/${it.token}`};else{let Ie=this.base64UrlEncode(oc("sha256").update(Pe).digest());return{type:"dns-01",token:it.token,keyAuthorization:Pe,identifier:`_acme-challenge.${b}`,dnsValue:Ie}}});return{domain:b,challenges:v}}async respondToChallenge(l){await this.acmeRequest(l,{})}async waitForAuthorization(l,S=30){for(let b=0;b<S;b++){let{body:P}=await this.acmeRequest(l,"");if(P.status==="valid")return;if(P.status==="invalid")throw Error(`Authorization failed: ${JSON.stringify(P)}`);await new Promise((v)=>setTimeout(v,2000))}throw Error("Authorization timed out")}generateCsr(l){let{privateKey:S}=ac("rsa",{modulusLength:2048}),b=S.export({type:"pkcs8",format:"pem"});return{csr:this.createSimpleCsr(l,S),privateKey:b}}createSimpleCsr(l,S){throw Error("CSR generation requires additional implementation. Consider using the shell-based certbot approach instead.")}async finalizeOrder(l,S){let{csr:b,privateKey:P}=this.generateCsr(S),{body:v}=await this.acmeRequest(l,{csr:this.base64UrlEncode(Buffer.from(b,"base64"))}),it=v.certificate;if(!it)throw Error("Certificate not immediately available - polling not implemented");let Ie=await(await fetch(it)).text(),rt=Ie.split(/(?=-----BEGIN CERTIFICATE-----)/g),Rt=rt[0],st=rt.slice(1).join("");return{certificate:Rt,privateKey:P,chain:st,fullchain:Ie,expiresAt:new Date(Date.now()+7776000000)}}getAccountKey(){return this.accountKey}}var cc=["js","mjs","cjs","css","map","woff","woff2","ttf","otf","eot","png","jpg","jpeg","gif","webp","avif","svg","ico","mp4","webm","ogg","mp3","wav","pdf","wasm"],yu=[{name:"x-stx-router",value:"true"}];function Ji(l){return`"${l.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`}function dc(l){return`{${l.map(Ji).join(" ")}}`}function Cu(l){let S=`http.request.headers[${Ji(l.name.toLowerCase())}]`;return l.value===void 0?`len(${S}) > 0`:`any(${S}[*] == ${Ji(l.value)})`}function Za(l){if(l.length===1)return`http.host eq ${Ji(l[0])}`;return`http.host in ${dc(l)}`}function Ja(l,S={}){if(S.enabled===!1||l.length===0)return[];let b=Za(l),P=[],it=(S.bypassPaths??[]).map((fr)=>`starts_with(http.request.uri.path, ${Ji(fr)})`),Ie=(S.negotiatedRequestHeaders??yu).map(Cu),rt=[...it,...Ie],Rt=rt.length>0?`(${rt.join(" or ")})`:void 0;if(Rt)P.push({action:"set_cache_settings",description:"bypass cache",expression:`(${b} and ${Rt})`,enabled:!0,action_parameters:{cache:!1}});let st=Rt?`${b} and not ${Rt}`:b,lr=S.assetExtensions??cc,Xt=lr.length>0?`lower(http.request.uri.path.extension) in ${dc([...lr])}`:void 0;if(Xt)P.push({action:"set_cache_settings",description:"cache fingerprinted assets",expression:`(${st} and ${Xt})`,enabled:!0,action_parameters:{cache:!0,edge_ttl:{mode:"override_origin",default:S.assetEdgeTtl??2592000},browser_ttl:{mode:"override_origin",default:S.assetBrowserTtl??31536000}}});return P.push({action:"set_cache_settings",description:"cache documents",expression:Xt?`(${st} and not ${Xt})`:`(${st})`,enabled:!0,action_parameters:{cache:!0,edge_ttl:{mode:"override_origin",default:S.documentEdgeTtl??3600},browser_ttl:{mode:"override_origin",default:S.documentBrowserTtl??0}}}),P}function Ya(l,S,b){if(l.length===0||!S||!b)return[];return[{action:"rewrite",description:"origin guard header",expression:`(${Za(l)})`,enabled:!0,action_parameters:{headers:{[S]:{operation:"set",value:b}}}}]}var In=(l)=>l===void 0?void 0:l?"on":"off";function Xa(l){let S={ssl:l.ssl,always_use_https:In(l.alwaysUseHttps),automatic_https_rewrites:In(l.automaticHttpsRewrites),min_tls_version:l.minTlsVersion,tls_1_3:In(l.tls13),brotli:In(l.brotli),http3:In(l.http3),"0rtt":In(l.zeroRtt),early_hints:In(l.earlyHints),browser_cache_ttl:l.browserCacheTtl,always_online:In(l.alwaysOnline),websockets:In(l.websockets),email_obfuscation:In(l.emailObfuscation)};if(l.hsts)S.security_header={strict_transport_security:{enabled:l.hsts.enabled,max_age:l.hsts.maxAge??31536000,include_subdomains:l.hsts.includeSubdomains??!1,preload:l.hsts.preload??!1,nosniff:l.hsts.noSniff??!0}};for(let b of Object.keys(S))if(S[b]===void 0)delete S[b];return{...S,...l.raw??{}}}var Qi={ssl:"strict",alwaysUseHttps:!0,automaticHttpsRewrites:!0,minTlsVersion:"1.2",tls13:!0,brotli:!0,http3:!0,earlyHints:!0,alwaysOnline:!0,emailObfuscation:!1,browserCacheTtl:0};import{connect as Su}from"node:tls";async function es(l){let{address:S,serverName:b,port:P=443,timeoutMs:v=5000}=l;return new Promise((it)=>{let Pe=!1,Ie=(Rt)=>{if(Pe)return;Pe=!0;try{rt.destroy()}catch{}it(Rt)},rt=Su({host:S,port:P,servername:b,rejectUnauthorized:!1,timeout:v});rt.once("secureConnect",()=>{if(rt.authorized){Ie({reachable:!0,trusted:!0});return}Ie({reachable:!0,trusted:!1,reason:rt.authorizationError?String(rt.authorizationError):"origin certificate is not trusted for this hostname"})}),rt.once("timeout",()=>{Ie({reachable:!1,trusted:!1,reason:`no TLS handshake within ${v}ms`})}),rt.once("error",(Rt)=>{Ie({reachable:!1,trusted:!1,reason:Rt.message})})})}function Au(l,S){let b=S.replace(/\.$/,"").toLowerCase();return l.some((P)=>{let v=P.replace(/\.$/,"").toLowerCase();if(v===b)return!0;if(!v.startsWith("*."))return!1;let it=v.slice(2);if(!b.endsWith(`.${it}`))return!1;return!b.slice(0,b.length-it.length-1).includes(".")})}async function bu(l){let{provider:S,zone:b,hosts:P,ipv4:v,ipv6:it,proxied:Pe=!0,settings:Ie=Qi,cache:rt,originGuard:Rt,purge:st=!0,ttl:lr=300,skipOriginProbe:Xt=!1,skipEdgeCertificateCheck:fr=!1}=l,It={records:[],settingsChanged:[],cacheRules:0,originGuard:!1,purged:!1,deferredProxy:[],warnings:[]};if(P.length===0)return It;let Pt=[],ye=Pe&&!fr?await S.listEdgeCertificateHosts(b):null;for(let ie of P){let Dt=Pe;if(Dt&&ye&&!Au(ye,ie)){Dt=!1;let ar=ye.length===0?"the zone has no active edge certificate yet":`no active edge certificate covers it (${ye.join(", ")})`;It.deferredProxy.push({host:ie,reason:ar}),It.warnings.push(`${ie}: publishing DNS-only — ${ar}. Proxying it would make Cloudflare terminate TLS with no certificate for the name, which fails the handshake outright rather than degrading. Universal SSL covers the apex and ONE level of subdomain, so a deeper name needs its own certificate; otherwise re-run the deploy once the certificate is active.`)}if(Dt&&!Xt){let ar=await es({address:v,serverName:ie});if(!ar.trusted){Dt=!1;let cr=ar.reason||"origin is not serving a trusted certificate";It.deferredProxy.push({host:ie,reason:cr}),It.warnings.push(`${ie}: publishing DNS-only for now — the origin does not yet serve a certificate this proxy can verify (${cr}). The origin issues certificates over HTTP-01, which needs the name to reach it directly; re-run the deploy once it has one and the record will be proxied.`)}}if(Dt)Pt.push(ie);let wt=[{type:"A",content:v}];if(it&&yn(ie))wt.push({type:"AAAA",content:it});for(let{type:ar,content:cr}of wt){let dr=await S.upsertRecord(b,{name:ie,type:ar,content:cr,ttl:lr,proxied:Dt});if(dr.success)It.records.push({host:ie,type:ar,content:cr,proxied:Dt});else It.warnings.push(`${ie} ${ar} → ${cr} failed: ${dr.message||"unknown provider error"}`)}}if(Pt.length===0){if(Pe)It.warnings.push("No host is proxied yet, so zone settings, cache rules and purge were skipped — they only take effect through the proxy.");return It}try{let ie=Xa(Ie),Dt=await S.applyZoneSettings(b,ie);It.settingsChanged=Dt.changed;for(let wt of Dt.failed)It.warnings.push(`zone setting '${wt.id}' could not be applied: ${wt.error}`)}catch(ie){It.warnings.push(`zone settings could not be read: ${ie instanceof Error?ie.message:String(ie)}`)}let kt=Ja(Pt,rt);if(kt.length>0){let ie=await S.putManagedPhaseRules(b,"http_request_cache_settings",kt);if(ie.success)It.cacheRules=kt.length;else It.warnings.push(`cache rules could not be written: ${ie.message}`)}if(Rt){let ie=Ya(Pt,Rt.header,Rt.value);if(ie.length>0){let Dt=await S.putManagedPhaseRules(b,"http_request_late_transform",ie);if(Dt.success)It.originGuard=!0;else It.warnings.push(`origin guard header could not be written: ${Dt.message}. `+"The gateway will reject requests that lack it — disable the guard or grant the token Transform Rules: Edit.")}}if(st){if(It.purged=await S.purgeCache(b,{hosts:Pt}),!It.purged)It.warnings.push("edge cache purge failed — new content may take until TTL expiry to appear.")}return It}var Ru=(l)=>process.env[l];function Pl(l,S){let b=l.replace(/\.$/,"").toLowerCase();if(S){let P=S.replace(/\.$/,"").toLowerCase();if(b===P||b.endsWith(`.${P}`))return P}return b.split(".").slice(-2).join(".")}function Pu(l,S={}){let b=S.env??Ru,P=l.infrastructure?.compute?.proxy?.cdn,v=[];if(!P||P.provider!=="cloudflare")return{plan:null,errors:v};if(P.originDomain)v.push(`compute.proxy.cdn.originDomain (${P.originDomain}) is ignored for Cloudflare: the proxy forwards to the address in the record it fronts, `+"so no separate origin hostname is needed — and publishing one gives clients a documented way around the edge.");let it=b("CLOUDFLARE_API_TOKEN");if(!it)return v.push("CLOUDFLARE_API_TOKEN is not set — the Cloudflare CDN cannot be reconciled."),{plan:null,errors:v};let Pe=l.sites??{},Ie=P.frontedHosts?.length?[...new Set(P.frontedHosts.map((Xt)=>Xt.toLowerCase()))]:En(Pe,{autoWww:l.infrastructure?.compute?.proxy?.autoWww!==!1});if(Ie.length===0)return v.push("No hostnames to front — set compute.proxy.cdn.frontedHosts, or give a site a domain."),{plan:null,errors:v};let rt=l.infrastructure?.dns?.domain,Rt=new Set(Ie.map((Xt)=>Pl(Xt,rt)));if(Rt.size>1)return v.push(`Fronted hosts span more than one zone (${[...Rt].join(", ")}). A Cloudflare zone is configured as a unit, so run one CDN config per zone.`),{plan:null,errors:v};let st=P.cloudflare??{},lr=P.secret?{header:P.secretHeader??"X-Origin-Verify",value:P.secret}:void 0;return{plan:{zone:[...Rt][0],hosts:Ie,apiToken:it,zoneId:st.zoneId??b("CLOUDFLARE_ZONE_ID"),accountId:st.accountId??b("CLOUDFLARE_ACCOUNT_ID"),proxied:st.proxied!==!1,settings:st.settings??Qi,cache:st.cache,originGuard:lr,purge:st.purgeOnDeploy!==!1,skipOriginProbe:st.skipOriginProbe===!0},errors:v}}var Tu=26214400;var Du=new Set(["/_headers","/_redirects","/_routes.json","/_worker.js"]);class $l{name="cloudflare-pages";apiToken;accountId;constructor(l){if(!l.apiToken)throw Error("Cloudflare Pages needs an API token");if(!l.accountId)throw Error("Cloudflare Pages needs an account id");this.apiToken=l.apiToken,this.accountId=l.accountId}async request(l,S,b){return Ba(l,`/accounts/${this.accountId}${S}`,`Bearer ${this.apiToken}`,b)}async getProject(l){try{return await this.request("GET",`/pages/projects/${l}`)}catch(S){if(S instanceof Error&&/\b8000007\b|not found/i.test(S.message))return null;throw S}}async ensureProject(l,S="main"){let b=await this.getProject(l);if(b)return b;return this.request("POST","/pages/projects",{name:l,production_branch:S})}async uploadToken(l){return(await this.request("GET",`/pages/projects/${l}/upload-token`)).jwt}async missingHashes(l,S){let b=await Ba("POST","/pages/assets/check-missing",`Bearer ${l}`,{hashes:S});return new Set(b)}async upsertHashes(l,S){await Ba("POST","/pages/assets/upsert-hashes",`Bearer ${l}`,{hashes:S})}async uploadBatch(l,S){let b=S.map((P)=>({key:P.hash,value:P.base64,metadata:{contentType:Eu(P.extension)},base64:!0}));await Ba("POST","/pages/assets/upload",`Bearer ${l}`,b)}async createDeployment(l,S,b){let P={};for(let it of S)P[it.path]=it.hash;let v=new FormData;if(v.append("manifest",JSON.stringify(P)),b)v.append("branch",b);return this.request("POST",`/pages/projects/${l}/deployments`,v)}async deployDirectory(l){let S=await Nl(l.directory);if(S.length===0)throw Error(`No files to deploy in ${l.directory}`);let b=await this.uploadToken(l.project),P=await this.missingHashes(b,S.map((rt)=>rt.hash)),v=S.filter((rt)=>P.has(rt.hash)),it=[];for(let rt=0;rt<v.length;rt+=100)it.push(v.slice(rt,rt+100));let Pe=0;for(let rt=0;rt<it.length;rt+=4){let Rt=it.slice(rt,rt+4);await Promise.all(Rt.map((st)=>this.uploadBatch(b,st))),Pe+=Rt.reduce((st,lr)=>st+lr.length,0),l.onProgress?.(Pe,v.length)}return await this.upsertHashes(b,S.map((rt)=>rt.hash)),{deployment:await this.createDeployment(l.project,S,l.branch),total:S.length,uploaded:v.length,uploadedBytes:v.reduce((rt,Rt)=>rt+Rt.size,0)}}async listCustomDomains(l){return(await this.request("GET",`/pages/projects/${l}/domains`)).map((b)=>b.name)}async attachCustomDomain(l,S){if((await this.listCustomDomains(l)).includes(S))return!1;return await this.request("POST",`/pages/projects/${l}/domains`,{name:S}),!0}}function Iu(l,S){return{type:"CNAME",name:l,value:S.endsWith(".pages.dev")?S:`${S}.pages.dev`,ttl:1,proxied:!0}}async function Ol(l,S){let{blake3:b}=await import("./chunk-xv3w9q1a.js").then((m)=>ah(m.default,1));return(await b(l+S)).slice(0,32)}async function Nl(l){let{readdir:S}=await import("node:fs/promises"),{join:b,relative:P,sep:v}=await import("node:path"),it=[];async function Pe(Ie){let rt=await S(Ie,{withFileTypes:!0});for(let Rt of rt){let st=b(Ie,Rt.name);if(Rt.isDirectory()){await Pe(st);continue}if(!Rt.isFile())continue;let lr=`/${P(l,st).split(v).join("/")}`;if(Du.has(lr))continue;let Xt=await Bun.file(st).bytes();if(Xt.byteLength>26214400)throw Error(`${lr} is ${Xt.byteLength} bytes, over the Cloudflare Pages limit of 26214400`);let fr=Buffer.from(Xt).toString("base64"),It=Rt.name.lastIndexOf("."),Pt=It>0?Rt.name.slice(It+1):"";it.push({path:lr,hash:await Ol(fr,Pt),base64:fr,extension:Pt,size:Xt.byteLength})}}return await Pe(l),it.sort((Ie,rt)=>Ie.path.localeCompare(rt.path)),it}function Eu(l){return{html:"text/html; charset=utf-8",css:"text/css; charset=utf-8",js:"application/javascript; charset=utf-8",mjs:"application/javascript; charset=utf-8",json:"application/json; charset=utf-8",map:"application/json; charset=utf-8",xml:"application/xml; charset=utf-8",txt:"text/plain; charset=utf-8",svg:"image/svg+xml",png:"image/png",jpg:"image/jpeg",jpeg:"image/jpeg",gif:"image/gif",webp:"image/webp",avif:"image/avif",ico:"image/x-icon",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",otf:"font/otf",pdf:"application/pdf",webmanifest:"application/manifest+json"}[l.toLowerCase()]||"application/octet-stream"}async function Ba(l,S,b,P){let v={Authorization:b},it;if(P instanceof FormData)it=P;else if(P!==void 0)v["Content-Type"]="application/json",it=JSON.stringify(P);let Pe=await fetch(`https://api.cloudflare.com/client/v4${S}`,{method:l,headers:v,body:it}),Ie=await Pe.text(),rt;try{rt=JSON.parse(Ie)}catch{throw Error(`Cloudflare Pages API returned ${Pe.status} with a non-JSON body: ${Ie.slice(0,200)}`)}if(!rt.success){let Rt=(rt.errors??[]).map((st)=>`${st.code}: ${st.message}`).join(", ");throw Error(`Cloudflare Pages API error (${Pe.status}): ${Rt||Ie.slice(0,200)}`)}return rt.result}export{dg as ABTestManager,ae as ACMClient,or as ACMDnsValidator,sc as ACME_DIRECTORIES,Te as AI,Gd as API_IDEMPOTENCY_TTL_MS,Qd as API_TOKEN_DEFAULT_TTL_MS,Hd as API_TOKEN_MAX_TTL_MS,ki as API_VERSION,de as AUTHORIZATION_CAPABILITIES,$d as AUTH_ACTION_TOKEN_TTL_MS,Md as AUTH_MFA_CHALLENGE_TTL_MS,Fd as AUTH_OIDC_TRANSACTION_TTL_MS,je as AUTH_SESSION_ABSOLUTE_TTL_MS,Ld as AUTH_SESSION_IDLE_TTL_MS,_f as AWSAPIError,n as AWSClient,h as AWSCloudFormationClient,A as AWSCloudFrontClient,sg as AWSConfigManager,Qy as AWS_PSEUDO_PARAMETERS,we as AWS_REGIONS,hu as AcmeClient,Nr as AlertEvaluator,ci as AlertStore,Fs as AnomalyConfigStore,pd as ApiGateway,i as ApiServiceError,xa as ApplicationAutoScalingClient,Zs as Arn,D as AssetHasher,U as Auth,wi as AuthenticationStore,gi as AutomationApiService,Ri as AutomationIdentityStore,Qo as AwsAuroraDataAdapter,jo as AwsAuroraTransport,la as AwsDatabaseBackupSource,ur as AwsDriver,Ho as AwsElastiCacheDataAdapter,zo as AwsElastiCacheTransport,am as AwsIamCapabilityScanner,ha as AwsInfrastructureBackupSource,Uo as AwsRdsDataAdapter,Vo as AwsRdsTransport,Sm as AwsRegionalDriver,Aa as AwsSecretsManagerConfigurationBackend,Tp as AwsSpendTransport,ya as AwsSsmConfigurationBackend,Hi as BackupCoordinator,ng as BackupManager,ca as BackupStore,Qg as BatchProcessingManager,ln as BedrockClient,dn as BedrockRuntimeClient,Jd as BitbucketSourceAdapter,cg as BlueGreenManager,Og as BounceComplaintHandler,Eg as BuildOptimizationManager,yl as BunDockerRuntime,ql as BunDockerVolumeRuntime,Gl as BunFilesystemArchiveRuntime,ve as CDN,oo as CHAIN_HEADER,ts as CLOUDFLARE_MANAGED_RULE_PREFIX,LS as COMMON_CROSS_ACCOUNT_ROLES,Fe as CONTROL_PLANE_SCHEMA_VERSION,Xs as Cache,ro as CanaryManager,Sg as CertificateManager,Gh as CloudBlockVolumeDriver,Is as CloudDriverFactory,Ve as CloudError,xp as CloudFormationBuilder,h as CloudFormationClient,A as CloudFrontClient,og as CloudTrailManager,me as CloudWatchLogsClient,$l as CloudflarePagesProvider,fe as CloudflareProvider,Kf as CommandHistory,H as Communication,Tr as ComposeApplicationService,Ot as ComposeApplicationStore,Ct as ComprehendClient,o as Compute,wp as ComputeSpendTransport,to as ConfigurationError,Sa as ConfigurationService,fa as ConfigurationStore,an as ConnectClient,qo as ContainerDataAdapter,vg as ContainerRegistryManager,ma as ControlPlaneBackupSource,ia as ControlPlaneCleanupDriver,ti as ControlPlaneStore,Ls as CounterTracker,Gt as CredentialError,Xp as CrossRegionReferenceManager,If as DASHBOARD_ENTRY,Sf as DASHBOARD_PORT_BASE,Cf as DASHBOARD_PORT_SPAN,yf as DASHBOARD_STATE_DIR,mo as DEFAULT_ATTACK_MODE_HOURS,Zc as DEFAULT_DDOS_THRESHOLDS,_c as DEFAULT_METER_MAPPINGS,Bc as DEFAULT_PRICE_BOOK,Si as DEFAULT_RECURSION_LIMITS,Cn as DEFAULT_RPX_CERTS_DIR,q as DEFAULT_SERVICE_LIMITS,Np as DEFAULT_STATE_DIR,cc as DEFAULT_STATIC_ASSET_EXTENSIONS,rf as DEFAULT_TELEMETRY_POLICY,dp as DEFAULT_THRESHOLDS,Mh as DEPLOYMENT_QUEUE_KINDS,so as DEPTH_HEADER,Dr as DETECTABLE_SIGNALS,gl as DIAGNOSTIC_PRESETS,Ug as DLQMonitoringManager,L as DNS,xg as DNSSECManager,Oi as DataServiceLifecycle,Fo as DataServiceStore,Ut as Database,Ag as DatabaseUserManager,ee as DebugLogger,mf as DependencyGraph,Q as Deployment,xf as DeploymentError,ig as DisasterRecoveryManager,An as DnsProviderFactory,zt as DockerDataTransport,xo as DockerDiscoveryAdapter,vr as DockerNamedVolumeDriver,ga as DockerVolumeBackupSource,c as DurableOperationQueue,Ps as DurableQueueWorker,ke as DynamoDBClient,Ar as EC2Client,Be as ECRClient,Xe as ECSClient,rr as EFSClient,Pa as ELBv2Client,Vh as ENFORCEMENT_ACTIONS,oi as ENFORCEMENT_DESCRIPTIONS,R as ENFORCEMENT_SEVERITY,$u as ENVIRONMENT_LABEL,ul as EcsRuntimeAdapter,go as EdgeRateLimiter,Ze as ElastiCacheClient,m as Email,Xf as EmailAdvanced,Lg as EmailAnalyticsManager,mn as EmailClient,Yf as EmailHandlers,Mg as EmailTemplateManager,Ko as EncryptedDataSecretStore,Of as ErrorCodes,er as EventBridgeClient,Am as EventBridgeJobAdapter,Ia as ExternalConfigurationBackend,Fg as FIFOQueueManager,Ap as FOCUS_VERSION,Fp as FileCache,Ge as FileSystem,ua as FilesystemBackupSource,Jo as FleetService,Wo as FleetStore,e as Fn,Xd as GiteaSourceAdapter,Kd as GithubSourceAdapter,Wd as GitlabSourceAdapter,Yp as GlobalResourceManager,xe as GoDaddyProvider,ag as GuardDutyManager,ot as HOST_SITES_DIR,Mf as HashCache,Wg as HealthCheckManager,Qe as HealthCheckRunner,gr as HetznerClient,Se as HetznerDriver,he as IAMClient,Ua as IPV6_EXCLUDED_HOST_LABELS,bg as ImageScanningManager,Wl as InfrastructureGenerator,Cc as InvalidOperationTransitionError,ut as JobLoader,ym as JobProviderReconciler,Mo as JobService,Lo as JobStore,Zt as KendraClient,AA as LARAVEL_SERVERLESS_BUILD_STEPS,C as LambdaClient,Dg as LambdaConcurrencyManager,kg as LambdaDLQManager,Pg as LambdaDestinationsManager,wg as LambdaLayersManager,pl as LambdaRuntimeAdapter,Ng as LambdaVPCManager,Rg as LambdaVersionsManager,tn as LocalEncryptedConfigurationBackend,pa as LogicalDatabaseBackupSource,gg as LogsManager,nA as MANAGED_NODE_VERSIONS,lc as MANAGEMENT_DASHBOARD_SITE,_p as MANAGEMENT_DASHBOARD_SITE_PREFIX,vi as MAX_CONTROL_HOURS,bc as MAX_CONTROL_PLANE_ERROR_BYTES,ip as MAX_CONTROL_PLANE_JSON_BYTES,xs as METERS,qh as METER_KEYS,jh as MICRO_CENTS,lp as MIN_PROJECTION_CONFIDENCE,su as MTA_STS_PORT,na as MaintenanceService,ra as MaintenanceStore,Z as Messaging,pg as MetricsManager,mg as MigrationManager,qp as MockCloudFormation,jp as MockDynamoDB,Vp as MockS3,Ys as Monitoring,tg as MultiAccountManager,Jp as MultiRegionManager,Hf as MultiStepProgress,f as Network,Jg as NetworkSecurityManager,di as NotificationRouter,Na as OpenSearchClient,at as OptimisticConcurrencyError,rg as OrganizationManager,Tu as PAGES_MAX_FILE_BYTES,yA as PHP_DEFAULT_EXCLUDES,iA as PHP_LAYER_EXTENSIONS,Lu as PROJECT_LABEL,tt as PROXIABLE_RECORD_TYPES,E as ParameterStore,fg as PerformanceManager,Y as Permissions,ka as PersonalizeClient,qe as Phone,Zf as PhoneAdvanced,hf as PhoneHandlers,Yo as PlacementService,Xo as PlacementStore,un as PollyClient,se as PorkbunProvider,qr as PreDeployScanner,zp as PreviewEnvironmentManager,Er as PreviewEnvironmentService,Ue as PreviewEnvironmentStore,Kp as PreviewNotificationService,Qf as ProgressBar,lg as ProgressiveDeploymentManager,ho as ProtectionControlStore,Ny as Pseudo,M as Queue,ri as QueueCancellationError,Hg as QueueManagementManager,Dy as QueuePresets,Ds as QueueTimeoutError,Dd as RATE_LIMIT_KEY_SEPARATOR,j as RDSClient,Jf as RECOMMENDED_ACCOUNT_STRUCTURES,OS as RECOMMENDED_SCPS,nm as RELEASE_QUEUE_KINDS,Vf as REPL,zf as REPLCommandBuilder,jf as REPLContext,Mu as ROLE_LABEL,Ff as RateLimiter,Py as RealtimePresets,yp as RecordingSpendTransport,co as RecursionGuard,pt as Redirects,Zp as RegionPairManager,ea as RegionService,Zo as RegionStore,He as Registry,bt as RekognitionClient,gt as ReleaseService,vo as ReleaseStore,Im as RemoteBuildService,hg as ReplicaManager,Xg as ResourceManagementManager,X as RetryableOperationError,y as Route53Client,Da as Route53DomainsClient,z as Route53Provider,_g as Route53ResolverManager,Bg as Route53RoutingManager,pe as RuntimeOperationService,Oo as RuntimeStreamRegistry,da as S3BackupDestinationAdapter,a as S3Client,G as S3Error,el as SECRET_PATTERNS,hp as SENSITIVITY_THRESHOLDS,et as SESClient,F as SMS,Ye as SNSClient,vp as SPEND_CYCLE_SECONDS,zc as SPEND_GATE_SETTING,af as SPEND_LEASE_SETTING,ne as SQSClient,Ce as SSH_BOOTSTRAP_VERSION,kn as SSH_PREFLIGHT_SCRIPT,be as SSMClient,kp as STATE_DIR_ENV_VAR,Qi as STATIC_SITE_ZONE_SETTINGS,ge as STSClient,pn as SchedulerClient,Qt as Search,Vr as SecretFindingScanner,fi as Secrets,Ig as SecretsManager,V as SecretsManagerClient,yg as SecretsRotationManager,I as Security,Lr as SecurityHubManager,Gr as SecurityPostureStore,mt as SecurityScannerRunner,Cg as SecurityScanningManager,$g as SenderReputationManager,fm as ServerCronJobAdapter,Go as ServerDataAdapter,Bs as ServerPathVolumeDriver,Tg as ServiceMeshManager,ud as Sftp,Qs as SignalSource,eA as SmsAdvanced,vt as SmsClient,ff as SmsHandlers,La as SmsVoiceClient,To as SourceConnectionStore,Vt as SourceProviderError,Kc as SpendCapError,Pr as SpendGate,bp as SpendLoopLease,js as SpendNotificationRouter,Ep as SpendRunner,$t as SpendService,ii as SpendStore,Gf as Spinner,hr as SshDriver,Kr as SshFleetDriver,eg as StackDependencyManager,Uy as StacksIntegration,zg as StaticSiteManager,Ee as Storage,Kg as StorageAdvancedManager,gn as SupportClient,$r as SyntheticsManager,Il as SystemFleetSshTransport,mr as SystemSshTransport,_o as SystemdDiscoveryAdapter,ao as TRACE_HEADER,qf as TaskList,lt as TelemetryStore,dd as TemplateBuilder,Up as TemplateCache,Et as TextractClient,cn as TranscribeClient,Yt as TranslateClient,Em as TransportDisasterRecoveryDriver,bm as TransportPlatformMaintenanceDriver,Li as TransportRemoteBuildDriver,ko as TrivyImageScanner,Eo as TsCloudApiError,qd as TsCloudClient,of as URGENT_SPEND_EVENTS,up as USER_VISIBLE_ACTIONS,ta as UnavailableRegionalDriver,oe as UnifiedDnsValidator,Ts as UnsupportedSchemaVersionError,$p as ValidationError,tr as VoiceClient,ks as VolumeService,_t as VolumeStore,Af as Workflow,ug as XRayManager,lC as abTestManager,Vd as activateImmutableRelease,pu as addDns01ChallengeRecord,Jr as addSiteToCloudConfig,ft as ageSeconds,Lc as aggregateDeltas,tp as allocateSitePorts,My as analyzeStackDiff,ai as anomalyOptionsForSignal,fo as applyControlsToDdos,xd as applyControlsToRateLimits,os as applyDeclaredZoneSettings,xr as applyMitigationFactor,Ih as applyPlan,ls as applyZoneMigration,Ad as artifactKey,Di as assertReleaseStrategy,tf as assertSpendAllows,vh as attachConflicts,Th as attachIsViable,Eh as attachPreconditions,sl as attachProvenanceToRelease,Bo as attachSbomToRelease,nl as attachVulnerabilitySummary,tm as authEncryptionKeyFile,w as authorizeOrganization,mm as authorizeRuntimePath,uS as autocomplete,iC as awsConfigManager,Ql as backupCredentialStatus,rC as backupManager,NI as batch,GC as batchProcessingManager,Co as beginOidcAuthorization,cC as blueGreenManager,$C as bounceComplaintHandler,ct as budgetWindow,Ta as buildAndPushServerlessImage,jC as buildBunRuntimeLayerZip,kh as buildCertificatePackScript,Dh as buildCertificateStateScript,Bh as buildCertificateUnpackScript,gd as buildCloudFormationTemplate,tc as buildCloudInitFirstBoot,wc as buildComposeLogsCommand,Ay as buildComposeRuntimeCommand,yy as buildComposeScaleCommand,Rc as buildComposeShellCommand,Yu as buildDrainSourceScript,lh as buildDrainedSiteScanScript,Wt as buildFunctionEnv,Xu as buildHealthGateScript,jn as buildHostCleanupScript,Zn as buildHostSitePortsScript,cd as buildMailEnv,Cs as buildManagementDashboardArtifact,Rm as buildMediaCdnPlan,iu as buildMtaStsPolicy,Vm as buildMtaStsServer,VC as buildNodeRuntimeLayerZip,TC as buildOptimizationManager,Ya as buildOriginGuardRule,qu as buildPauseWorkersScript,JC as buildPhpRuntimeLayerZip,Ku as buildRestoreScript,K as buildRpxConfig,_e as buildRpxFragmentRefreshScript,Ch as buildSetHostnameScript,Gn as buildSiteDeployScript,zu as buildSnapshotScript,Zu as buildSourceStateScript,Tn as buildSshArgs,Pn as buildSshBootstrapScript,Ja as buildStaticSiteCacheRules,qn as buildStaticSiteDeployScript,Wu as buildTargetStateScript,Vu as buildWorkersStateScript,al as bytes,dC as canaryManager,Wr as canonicalJson,ht as capabilities,Kt as capacity,FI as categorizeChanges,bC as certificateManager,Nh as certificatesMatch,II as checkIAMPermissions,lA as checkInvocation,CI as checkServiceQuotas,Uf as chunk,Um as cleanupDns01Challenge,vy as clearSigningKeyCache,Ro as cloneSourceBinding,HI as cloudConfigSchema,wu as cloudDrivers,sC as cloudTrailManager,Nl as collectAssets,uo as collectPhpAppEntries,ru as collectServerDnsDomains,sp as completeComposeVolumeDeletion,bo as completeOidcAuthorization,sI as composePresets,Rs as composeProjectName,Id as composeServerlessAppTemplate,df as compositeSpendTransport,St as compressBackup,SA as config,fl as connectionGuidance,wC as containerRegistryManager,Lh as controlPlaneDatabaseFile,Ic as controlPlaneMigrations,zy as createApiBackendPreset,No as createApiV1Handler,PA as createAsgBuildDriver,Hl as createBackupQueueHandlers,hA as createCliHandler,k as createCloudDriver,nc as createCloudFrontPolicy,gI as createCredentialProvider,nI as createDashboardSite,Yy as createDataPipelinePreset,Al as createDataServiceQueueHandlers,Dc as createDeploymentQueueHandlers,T as createDnsProvider,DA as createEcsBuildDriver,Wc as createEnforcementHandlers,Mp as createError,md as createExistingStaticFullStackPreset,Sl as createFleetQueueHandlers,jy as createFullStackAppPreset,gs as createGoDaddyValidator,WC as createHandlers,gA as createHttpHandler,Wy as createJamstackPreset,hl as createJobQueueHandlers,tI as createLaravelPreset,Zy as createMLApiPreset,Rl as createMaintenanceQueueHandlers,xu as createMediaAccessToken,Jy as createMicroservicesPreset,KI as createMockAWS,Gy as createNodeJsServerPreset,qy as createNodeJsServerlessPreset,Zi as createObjectStorageClient,ps as createPorkbunValidator,oI as createPreset,uf as createPresignedUrl,Iy as createPresignedUrlAsync,mA as createQueueHandler,Xy as createRealtimeAppPreset,bl as createRegionQueueHandlers,il as createReleaseProvenance,zd as createReleaseQueueHandlers,wA as createRemoteBuildQueueHandlers,ms as createRoute53Validator,gm as createRuntimeAdapters,mI as createS3Client,RA as createServerBuildDriver,rI as createServerlessLaravelPreset,Vy as createServerlessNodePreset,tu as createSmsInfrastructure,Ke as createSourceAdapter,Hy as createStaticSitePreset,eI as createTraditionalWebAppPreset,Pc as createVolumeQueueHandlers,Ky as createWordPressPreset,Ii as createZip,IS as crossRegionReferenceManager,rn as dashboardActions,Ss as dashboardCredentialsFile,zr as dataServiceCapabilities,IC as databaseUserManager,Od as decodeBase32,Ne as decompressBackup,xm as decryptBackup,Ao as defaultConfig,Gp as defaultLocalConfig,Nd as defaultRateLimitRules,sr as delegateZone,is as delegateZoneFromConfig,Ea as deleteStaticSite,pc as deployAllComputeSites,oa as deployServerlessApp,Ml as deploySite,bs as deploySiteRelease,ji as deployStaticSite,va as deployStaticSiteFull,nn as deployStaticSiteWithExternalDns,sn as deployStaticSiteWithExternalDnsFull,od as deploymentCoexistenceError,bf as deriveManagementDashboardPort,ss as describeDelegation,Bd as describePosture,as as describeZoneSettings,hm as desiredJobProviderState,mp as detectAnomalies,Bp as detectDeploymentTargets,$a as detectDnsProvider,qc as detectLatestAnomaly,fI as detectMisconfigurations,Dp as detectServiceRegion,vc as diffCompose,LI as diffTemplates,wo as discoverGitRefs,So as discoverOidcProvider,cl as discoverRuntimeInventory,HC as dlqMonitoringManager,Ma as dnsProviders,OC as dnssecManager,lm as dockerWorkloads,$i as documentDigest,nC as drManager,Le as driverStatePath,dl as ecsWorkloads,xt as effectiveCapabilities,MC as emailAnalyticsManager,UC as emailTemplateManager,Ti as encodeBase32,Bm as encryptBackup,ol as ensureDefaultSecurityPolicies,Mn as ensureFirewall,zn as ensureManagementDashboard,Un as ensureServer,$n as ensureSshKey,J as escapeSecLang,Mc as evaluateBudget,xn as evaluatePreflight,Vs as evaluateTelemetryAlertRules,ml as eventBridgeScheduleInput,pA as eventToRequest,Yh as ewma,Ec as exportCompose,cs as exportRoute53Zone,Lp as extendPreset,QC as fifoQueueManager,PI as findChangedFiles,ap as findMapping,op as findPriceEntry,US as formatAccountStructure,wh as formatAttachPlan,nS as formatBytes,kr as formatCents,Fy as formatDiff,ph as formatDrainedSiteRefusal,iS as formatDuration,gS as formatFlagSuggestions,fS as formatHistory,AS as formatHistoryStats,fh as formatInventory,oS as formatKeyValue,sS as formatList,yh as formatPlan,On as formatPreflightFindings,rS as formatProgressBar,Wf as formatRegion,kS as formatRegionList,om as formatScanResults,aS as formatSuggestion,eS as formatTable,Rr as formatTimeToExhaustion,tS as formatTree,Rf as fromEC2Metadata,Df as fromECSMetadata,Tf as fromEnvironment,wf as fromSharedCredentials,Pf as fromWebIdentity,Cd as functionFingerprint,En as gatewayHostnames,Sd as generateAppImageDockerfile,eC as generateApprovalConfig,tA as generateBootstrap,XI as generateCleanupWorkflow,YI as generateCostReportWorkflow,MS as generateCrossAccountRoleCF,tl as generateCycloneDxSbom,XS as generateDeploymentConfig,jS as generateDeploymentPipeline,QS as generateDeploymentWorkflow,ba as generateExternalDnsStaticSiteTemplate,zm as generateHttpsServerCode,rl as generateImageSbom,Hm as generateLetsEncryptUserData,t as generateLogicalId,JS as generateManualPipeline,VS as generateMatrixWorkflow,YS as generateMultiEnvConfig,zS as generateMultiEnvPipeline,HS as generateMultiEnvWorkflow,GS as generatePRPreviewWorkflow,tC as generateParallelConfig,fA as generatePhpFpmConfig,oA as generatePhpLayerDockerfile,KS as generatePreviewPipeline,JI as generatePreviewWorkflow,r as generateResourceName,ZS as generateScheduledConfig,WS as generateScheduledPipeline,qS as generateScheduledWorkflow,Vi as generateStaticSiteTemplate,N as generateUbuntuAppCloudInit,Bf as getAccountId,ES as getAllRegions,DS as getClosestRegion,mS as getCommandUsage,$h as getComposeTemplate,Yg as getConfig,dS as getContextualHelp,eo as getCredentials,UI as getDeploymentStrategy,QI as getDiffStats,$I as getDiffSummary,Lf as getErrorDetails,fd as getLocalConfig,jI as getLocalCredentials,VI as getLocalEndpoint,zI as getLocalEnvVars,bI as getQuotaUsageSummary,$S as getRecommendedStructure,yi as getRegion,BS as getRegionStats,TS as getRegionsByCompliance,vS as getRegionsByLocation,wS as getRegionsByPricingTier,$f as getRequiredPermissions,Ty as getSigningKeyCacheSize,eu as getSmsInfrastructureStatus,ky as getTimestamp,po as globMatches,Es as globToRegex,SS as globalResourceManager,si as governingLimitCents,oC as guardDutyManager,zs as handleSpendRequest,bn as hasAutoWwwVariant,Ht as hasManagementDashboardSite,yc as hasProxyUpstream,TI as hashBuffer,wI as hashDirectory,Qp as hashFile,RI as hashManifest,Hp as hashString,ZC as healthCheckManager,yn as hostAcceptsIpv6,Za as hostCondition,yo as hotp,wr as hourBucket,Xh as hourBucketsBetween,vC as imageScanningManager,Ui as infraEnvFromOutputs,Ed as inspectInvocation,cA as installRecursionFetch,Ki as invalidateCache,Vg as invocationContext,cS as isLikelyTypo,Sn as isLocalDatabase,qI as isLocalDevelopment,_r as isManagementDashboardSiteName,nr as isNameserverRegistrar,wy as isNodeCryptoAvailable,Gc as isOperationAllowed,qs as isQuietHours,Wn as isSafePattern,id as isStateDirConfigured,sd as isStatePath,Br as isValidCidr,RS as isValidRegion,ni as isValidTimeZone,Ry as isWebCryptoAvailable,ir as isZoneHost,jr as jobProviderCapability,Yi as keyMatchesFilters,NC as lambdaConcurrencyManager,xC as lambdaDLQManager,kC as lambdaDestinationsManager,DC as lambdaLayersManager,BC as lambdaVPCManager,PC as lambdaVersionsManager,ll as lambdaWorkloads,wd as laravelServerlessEnvDefaults,br as listComposeTemplates,Ni as listSourceReferences,_d as loadCloudConfig,Mt as loadTelemetryPolicy,mC as logsManager,Vc as lookbackHoursForSignal,gf as mailEnabled,ad as mailFirewallPorts,Cm as maintenanceWindowOpen,pf as makeAWSRequest,Cy as makeAWSRequestAsync,Sy as makeAWSRequestOnce,Op as managementDashboardSiteName,El as manifestDigest,Fr as matchTotpCounter,Bu as mediaObjectHeaders,Ms as median,pp as medianAbsoluteDeviation,Fc as mergeDecisions,Or as mergeInfrastructure,Wh as mergePriceBooks,Oc as meterTelemetry,gC as metricsManager,Jl as migrateObjectStorage,fC as migrationManager,xS as multiAccountManager,yS as multiRegionManager,jm as needsRenewal,eb as networkSecurityManager,At as nextScheduleRuns,Ae as normalizePublicIpv6,Re as normalizeRuntimeStatus,We as normalizeScheduleExpression,im as normalizeSourceEvent,Oe as normalizeSshPublicKey,Ip as normalizeTelemetryPolicy,Yn as occupiedHostPorts,Po as openApiDocument,Hs as optionsForSignal,_S as organizationManager,Rd as packagePhpApp,Mr as packageServerlessApp,Ol as pagesAssetHash,Iu as pagesDnsRecord,hd as parallel,kI as parallelMap,BI as parallelWithRetry,Ph as parseCertificateState,bd as parseChain,Cr as parseCompose,hy as parseComposeCatalog,dm as parseDockerInspect,Vl as parseDotenv,uh as parseDrainedSites,ei as parseHostSiteFragments,Ey as parseJSONResponse,Bn as parsePreflightFacts,ep as parseSourceDrained,um as parseSystemdRecords,Ju as parseTargetReady,Ac as parseUpstreamPort,ju as parseWorkersPaused,by as parseXMLResponse,ui as pathTemplate,hc as pendingSteps,$s as percentOfLimit,yC as performanceManager,Gg as phpLayerBuildStage,sA as phpLayerPackages,Ci as phpRuntimeLayerAssets,fy as planComposeTemplateUpgrade,Uc as planEnforcement,Hu as planIsDestructive,Rp as planMitigation,Sh as planServerRename,xh as planSiteMove,ds as planZoneMigration,Tt as policyTag,_n as preflightFailed,WI as previewManager,ZI as previewNotifications,yt as previewSchedule,Jh as previousBudgetWindow,_s as priceUsage,zh as priceUsageLines,mh as probeHostRoutes,es as probeOriginTls,OI as processInChunks,Yd as processSourceWebhook,xi as productionChangeReview,uC as progressiveDeploymentManager,$c as projectSpend,vd as propagationHeaders,wa as providerEndpoint,vl as publicKeyFingerprint,hn as qualifyName,qC as queueManagementManager,DI as quickHash,Pd as rateLimitHeaders,Ei as rateLimitKey,$e as readDriverState,hh as reconcile,nu as reconcileAddressRecords,bu as reconcileCloudflareCdn,ns as reconcileDeclaredRecords,TA as reconcileJobObservation,Hr as reconcileSourceWebhook,Bi as recordDashboardHostPosture,bA as recordPreDeploySecretScan,EA as recordSkippedSecretScan,Td as recursionBlockedResponse,De as redactRuntimeConfig,Yc as redactTelemetryText,li as redactTelemetryValue,Yr as redeployServerlessApp,CS as regionPairManager,Qr as releaseStrategyCapabilities,rm as releaseTrafficPlan,Kn as reloadRpxGateway,Xi as remapKey,mu as removeDns01ChallengeRecord,Xr as removeSiteFromCloudConfig,Zd as removeSourceWebhook,Fa as removeStaleServerAddressRecords,Tc as renderComposeTemplate,mi as renderDdosInstallScript,rd as renderNftablesRuleset,_i as renderServerCron,td as renderSysctlFile,mc as renderWafConfig,Jn as renderWafInstallScript,gc as renewRpxCertificates,AC as replicaManager,lf as requestHash,MI as requiresReplacement,zC as resetRecursionRuntime,KC as resolveApp,p as resolveAppDatabase,bh as resolveAttachTarget,ze as resolveAuthEncryptionKey,le as resolveCloudProvider,Pu as resolveCloudflareCdnPlan,Nf as resolveCredentials,qi as resolveDashboardAction,uc as resolveDashboardAuth,Ef as resolveDashboardDomain,vf as resolveDashboardDomains,rs as resolveDeclaredRecords,$y as resolveDeployBucketName,O as resolveDeploymentMode,Hn as resolveExecStart,Ka as resolveHetznerApiToken,hi as resolveMailService,iI as resolveManagementDashboardSite,Ai as resolveManagementDashboardSites,Ra as resolveObjectStorage,Ah as resolvePlan,g as resolveProjectStackName,Sr as resolveProxyUpstreams,yd as resolveQueueNames,Fh as resolveQueuedDeploymentCommand,qt as resolveQueues,aA as resolveRecursionConfig,kf as resolveRegion,re as resolveRuntimeInventory,Ft as resolveServerlessAppStackName,ld as resolveServerlessArtifactBucketName,Js as resolveServerlessAssetBucketName,io as resolveServerlessRuntime,Oy as resolveSiteBucketName,vs as resolveSiteDeployTarget,u as resolveSiteKind,_y as resolveSiteResourceName,xy as resolveSiteStackName,Nn as resolveSshSettings,d as resolveStatePath,Ly as resolveStorageBucketName,Nt as resolveUiSource,Pl as resolveZoneApex,tb as resourceManagementManager,jg as responseToResult,gp as robustZScore,Bt as roleCapabilities,jd as rollbackImmutableRelease,Zr as rollbackServerlessApp,Kh as roundCents,LC as route53ResolverManager,_C as route53RoutingManager,fp as routeMatches,Fu as routesFromFragments,bi as ruleMatches,rA as runBuildHooks,Qc as runEnforcement,lo as runPhpBuildHooks,Je as runRemoteCommand,ue as runtimeId,fn as sameNameservers,Gi as sanitizeCloudConfig,s as sanitizeControlPlaneValue,By as sanitizeName,Ud as sanitizeOidcReturnPath,Jc as saveTelemetryPolicy,sm as scanForSecrets,Sc as scopeContains,dt as scopeKey,qa as scpUpload,lS as searchCommands,ws as searchControlPlane,CC as secretsManager,SC as secretsRotationManager,vA as secureContainerRelease,aC as securityHubManager,EC as securityScanningManager,te as securityScope,Ur as sendAuthenticationEmail,FC as senderReputationManager,xI as sequence,jl as serializeDotenv,Qn as serverPublicIpv4,RC as serviceMeshManager,_l as setAttachToInCloudConfig,Jt as setMaintenance,Mi as setSitePropertyInCloudConfig,nd as setStateDir,Gm as setupDns01Challenge,Oa as setupSmsInfrastructure,no as sha256,dA as sharedRecursionGuard,qg as sharedRuntimeLoop,np as shipsARelease,ku as signCloudFrontCookies,Nu as signCloudFrontUrl,x as signRequest,Pp as signRequestAsync,Us as signalDefinition,B as siteInstallBase,Xn as siteMoveArchivePath,Rh as siteMoveCertArchivePath,fc as siteUnitGlob,Cp as spendNotificationText,Ks as spendOpenApiPaths,pr as sshExec,ce as sshExecOrThrow,bS as stackDependencyManager,Ca as startLocalDashboardServer,cf as startSpendLoop,Ws as stateDir,_ as statePath,XC as staticSiteManager,YC as storageAdvancedManager,Zh as streamFocusJsonl,Hc as strongestActiveAction,Wp as suggestCommand,pS as suggestFlags,SI as suggestIAMPolicy,EI as suggestQuotaIncrease,NS as suggestRegionPairs,PS as suggestRegions,Pi as syncSourceRepositories,Nc as synchronizeComposeVolumes,zl as synchronizeConfiguredConfiguration,$o as synchronizeConfiguredJobs,hC as syntheticsManager,ed as sysctlHardening,pm as systemdWorkloads,sf as telemetryBucketLabel,pi as telemetryCursor,Xc as telemetryEstimatedMonthlyCost,nf as telemetryPercentile,Sp as telemetryPolicyKey,vI as templateCache,Uu as tenantsOf,Do as testSourceConnection,kc as tieredMicroCents,Xa as toCloudflareZoneSettings,Gs as toFocusJsonl,jc as toFocusRecords,gh as toInventoryServer,Zg as totp,Io as totpUri,Qu as unaccountedSites,cm as unsupportedCapabilities,Uh as unsupportedVolumeCapabilities,wl as updateCompatibility,Dl as updateSiteInCloudConfig,zi as uploadStaticFiles,cp as usageDeltaKey,Lt as utcInstantOfLocal,FS as validateAccountStructure,GI as validateAgainstSchema,Hh as validateAttachment,km as validateBackupDestination,hS as validateCommand,hI as validateConfiguration,yI as validateCredentials,rp as validateDeploymentConfig,Qh as validateMountPath,ou as validateResourceLimits,Gu as validateServerName,Ul as validateTemplate,kd as validateTemplateSize,Qa as verifyAddressRecord,CA as verifyArtifactSignature,_u as verifyMediaAccessToken,em as verifyTotp,Tl as verifyUpdateSignature,us as verifyZoneParity,Ns as volumeCapabilities,Ou as wafEventTelemetry,Va as waitForCloudInit,wn as waitForSsh,jt as webhookEndpoint,uI as withCDN,lI as withCache,dI as withDatabase,uA as withInvocation,aI as withMonitoring,pI as withQueue,cI as withSecurity,_I as withTimeout,W as wrapCloudInitUserData,nt as writeDriverState,pC as xrayManager,Cl as zeroCapacity,ef as zeroFill,xc as zoneOffsetMs,Os as zonedParts};
+`).filter((it)=>!it.startsWith("-----")).join(""),S=Buffer.from(l,"base64"),b=S.length-65,P=S.subarray(b+1,b+33),v=S.subarray(b+33,b+65);return{kty:"EC",crv:"P-256",x:this.base64UrlEncode(P),y:this.base64UrlEncode(v)}}getJwkThumbprint(){let l=this.getJwk(),S=JSON.stringify({crv:l.crv,kty:l.kty,x:l.x,y:l.y}),b=oc("sha256").update(S).digest();return this.base64UrlEncode(b)}base64UrlEncode(l){return(typeof l==="string"?Buffer.from(l):l).toString("base64").replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async signPayload(l,S){let b=await this.getNonce(),P=this.getJwk(),v={alg:"ES256",nonce:b,url:l};if(this.accountUrl)v.kid=this.accountUrl;else v.jwk=P;let it=this.base64UrlEncode(JSON.stringify(v)),Pe=S===""?"":this.base64UrlEncode(JSON.stringify(S)),Ie=`${it}.${Pe}`,rt=gu("SHA256");rt.update(Ie);let Rt=rt.sign(this.accountKey),st=Rt.subarray(4,4+Rt[3]),lr=4+Rt[3]+2,Xt=Rt.subarray(lr,lr+Rt[lr-1]),fr=Buffer.alloc(32),It=Buffer.alloc(32);st.copy(fr,32-st.length),Xt.copy(It,32-Xt.length);let Pt=Buffer.concat([fr,It]);return JSON.stringify({protected:it,payload:Pe,signature:this.base64UrlEncode(Pt)})}async acmeRequest(l,S){let b=await this.signPayload(l,S),P=await fetch(l,{method:"POST",headers:{"Content-Type":"application/jose+json"},body:b}),v=P.headers.get("replay-nonce");if(v)this.nonce=v;let it,Pe=P.headers.get("content-type");if(Pe?.includes("application/json")||Pe?.includes("application/problem+json"))it=await P.json();else it=await P.text();if(!P.ok)throw Error(`ACME request failed: ${JSON.stringify(it)}`);return{body:it,headers:P.headers}}async registerAccount(){let l=await this.getDirectory(),{body:S,headers:b}=await this.acmeRequest(l.newAccount,{termsOfServiceAgreed:!0,contact:[`mailto:${this.email}`]}),P=b.get("location");if(!P)throw Error("No account URL returned");return this.accountUrl=P,P}async createOrder(l){if(!this.accountUrl)await this.registerAccount();let S=await this.getDirectory(),{body:b,headers:P}=await this.acmeRequest(S.newOrder,{identifiers:l.map((it)=>({type:"dns",value:it}))}),v=P.get("location");if(!v)throw Error("No order URL returned");return{orderUrl:v,authorizations:b.authorizations,finalize:b.finalize}}async getAuthorization(l){let{body:S}=await this.acmeRequest(l,""),b=S.identifier.value,P=this.getJwkThumbprint(),v=S.challenges.filter((it)=>it.type==="http-01"||it.type==="dns-01").map((it)=>{let Pe=`${it.token}.${P}`;if(it.type==="http-01")return{type:"http-01",token:it.token,keyAuthorization:Pe,identifier:`/.well-known/acme-challenge/${it.token}`};else{let Ie=this.base64UrlEncode(oc("sha256").update(Pe).digest());return{type:"dns-01",token:it.token,keyAuthorization:Pe,identifier:`_acme-challenge.${b}`,dnsValue:Ie}}});return{domain:b,challenges:v}}async respondToChallenge(l){await this.acmeRequest(l,{})}async waitForAuthorization(l,S=30){for(let b=0;b<S;b++){let{body:P}=await this.acmeRequest(l,"");if(P.status==="valid")return;if(P.status==="invalid")throw Error(`Authorization failed: ${JSON.stringify(P)}`);await new Promise((v)=>setTimeout(v,2000))}throw Error("Authorization timed out")}generateCsr(l){let{privateKey:S}=ac("rsa",{modulusLength:2048}),b=S.export({type:"pkcs8",format:"pem"});return{csr:this.createSimpleCsr(l,S),privateKey:b}}createSimpleCsr(l,S){throw Error("CSR generation requires additional implementation. Consider using the shell-based certbot approach instead.")}async finalizeOrder(l,S){let{csr:b,privateKey:P}=this.generateCsr(S),{body:v}=await this.acmeRequest(l,{csr:this.base64UrlEncode(Buffer.from(b,"base64"))}),it=v.certificate;if(!it)throw Error("Certificate not immediately available - polling not implemented");let Ie=await(await fetch(it)).text(),rt=Ie.split(/(?=-----BEGIN CERTIFICATE-----)/g),Rt=rt[0],st=rt.slice(1).join("");return{certificate:Rt,privateKey:P,chain:st,fullchain:Ie,expiresAt:new Date(Date.now()+7776000000)}}getAccountKey(){return this.accountKey}}var cc=["js","mjs","cjs","css","map","woff","woff2","ttf","otf","eot","png","jpg","jpeg","gif","webp","avif","svg","ico","mp4","webm","ogg","mp3","wav","pdf","wasm"],yu=[{name:"x-stx-router",value:"true"}];function Ji(l){return`"${l.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`}function dc(l){return`{${l.map(Ji).join(" ")}}`}function Cu(l){let S=`http.request.headers[${Ji(l.name.toLowerCase())}]`;return l.value===void 0?`len(${S}) > 0`:`any(${S}[*] == ${Ji(l.value)})`}function Za(l){if(l.length===1)return`http.host eq ${Ji(l[0])}`;return`http.host in ${dc(l)}`}function Ja(l,S={}){if(S.enabled===!1||l.length===0)return[];let b=Za(l),P=[],it=(S.bypassPaths??[]).map((It)=>`starts_with(http.request.uri.path, ${Ji(It)})`),Ie=(S.negotiatedRequestHeaders??yu).map(Cu),rt=[...it,...Ie],Rt=rt.length>0?`(${rt.join(" or ")})`:void 0;if(Rt)P.push({action:"set_cache_settings",description:"bypass cache",expression:`(${b} and ${Rt})`,enabled:!0,action_parameters:{cache:!1}});let st=Rt?`${b} and not ${Rt}`:b,lr=S.assetExtensions??cc,Xt=lr.length>0?`lower(http.request.uri.path.extension) in ${dc([...lr])}`:void 0;if(Xt)P.push({action:"set_cache_settings",description:"cache fingerprinted assets",expression:`(${st} and ${Xt})`,enabled:!0,action_parameters:{cache:!0,edge_ttl:{mode:"override_origin",default:S.assetEdgeTtl??2592000},browser_ttl:{mode:"override_origin",default:S.assetBrowserTtl??31536000}}});let fr=Xt?`(${st} and not ${Xt})`:`(${st})`;if(S.documentEdgeTtl===0)return P.push({action:"set_cache_settings",description:"bypass documents",expression:fr,enabled:!0,action_parameters:{cache:!1}}),P;return P.push({action:"set_cache_settings",description:"cache documents",expression:fr,enabled:!0,action_parameters:{cache:!0,edge_ttl:{mode:"override_origin",default:S.documentEdgeTtl??3600},browser_ttl:{mode:"override_origin",default:S.documentBrowserTtl??0}}}),P}function Ya(l,S,b){if(l.length===0||!S||!b)return[];return[{action:"rewrite",description:"origin guard header",expression:`(${Za(l)})`,enabled:!0,action_parameters:{headers:{[S]:{operation:"set",value:b}}}}]}var In=(l)=>l===void 0?void 0:l?"on":"off";function Xa(l){let S={ssl:l.ssl,always_use_https:In(l.alwaysUseHttps),automatic_https_rewrites:In(l.automaticHttpsRewrites),min_tls_version:l.minTlsVersion,tls_1_3:In(l.tls13),brotli:In(l.brotli),http3:In(l.http3),"0rtt":In(l.zeroRtt),early_hints:In(l.earlyHints),browser_cache_ttl:l.browserCacheTtl,always_online:In(l.alwaysOnline),websockets:In(l.websockets),email_obfuscation:In(l.emailObfuscation)};if(l.hsts)S.security_header={strict_transport_security:{enabled:l.hsts.enabled,max_age:l.hsts.maxAge??31536000,include_subdomains:l.hsts.includeSubdomains??!1,preload:l.hsts.preload??!1,nosniff:l.hsts.noSniff??!0}};for(let b of Object.keys(S))if(S[b]===void 0)delete S[b];return{...S,...l.raw??{}}}var Qi={ssl:"strict",alwaysUseHttps:!0,automaticHttpsRewrites:!0,minTlsVersion:"1.2",tls13:!0,brotli:!0,http3:!0,earlyHints:!0,alwaysOnline:!0,emailObfuscation:!1,browserCacheTtl:0};import{connect as Su}from"node:tls";async function es(l){let{address:S,serverName:b,port:P=443,timeoutMs:v=5000}=l;return new Promise((it)=>{let Pe=!1,Ie=(Rt)=>{if(Pe)return;Pe=!0;try{rt.destroy()}catch{}it(Rt)},rt=Su({host:S,port:P,servername:b,rejectUnauthorized:!1,timeout:v});rt.once("secureConnect",()=>{if(rt.authorized){Ie({reachable:!0,trusted:!0});return}Ie({reachable:!0,trusted:!1,reason:rt.authorizationError?String(rt.authorizationError):"origin certificate is not trusted for this hostname"})}),rt.once("timeout",()=>{Ie({reachable:!1,trusted:!1,reason:`no TLS handshake within ${v}ms`})}),rt.once("error",(Rt)=>{Ie({reachable:!1,trusted:!1,reason:Rt.message})})})}function Au(l,S){let b=S.replace(/\.$/,"").toLowerCase();return l.some((P)=>{let v=P.replace(/\.$/,"").toLowerCase();if(v===b)return!0;if(!v.startsWith("*."))return!1;let it=v.slice(2);if(!b.endsWith(`.${it}`))return!1;return!b.slice(0,b.length-it.length-1).includes(".")})}async function bu(l){let{provider:S,zone:b,hosts:P,ipv4:v,ipv6:it,proxied:Pe=!0,settings:Ie=Qi,cache:rt,originGuard:Rt,purge:st=!0,ttl:lr=300,skipOriginProbe:Xt=!1,skipEdgeCertificateCheck:fr=!1}=l,It={records:[],settingsChanged:[],cacheRules:0,originGuard:!1,purged:!1,deferredProxy:[],warnings:[]};if(P.length===0)return It;let Pt=[],ye=Pe&&!fr?await S.listEdgeCertificateHosts(b):null;for(let ie of P){let Dt=Pe;if(Dt&&ye&&!Au(ye,ie)){Dt=!1;let ar=ye.length===0?"the zone has no active edge certificate yet":`no active edge certificate covers it (${ye.join(", ")})`;It.deferredProxy.push({host:ie,reason:ar}),It.warnings.push(`${ie}: publishing DNS-only — ${ar}. Proxying it would make Cloudflare terminate TLS with no certificate for the name, which fails the handshake outright rather than degrading. Universal SSL covers the apex and ONE level of subdomain, so a deeper name needs its own certificate; otherwise re-run the deploy once the certificate is active.`)}if(Dt&&!Xt){let ar=await es({address:v,serverName:ie});if(!ar.trusted){Dt=!1;let cr=ar.reason||"origin is not serving a trusted certificate";It.deferredProxy.push({host:ie,reason:cr}),It.warnings.push(`${ie}: publishing DNS-only for now — the origin does not yet serve a certificate this proxy can verify (${cr}). The origin issues certificates over HTTP-01, which needs the name to reach it directly; re-run the deploy once it has one and the record will be proxied.`)}}if(Dt)Pt.push(ie);let wt=[{type:"A",content:v}];if(it&&yn(ie))wt.push({type:"AAAA",content:it});for(let{type:ar,content:cr}of wt){let dr=await S.upsertRecord(b,{name:ie,type:ar,content:cr,ttl:lr,proxied:Dt});if(dr.success)It.records.push({host:ie,type:ar,content:cr,proxied:Dt});else It.warnings.push(`${ie} ${ar} → ${cr} failed: ${dr.message||"unknown provider error"}`)}}if(Pt.length===0){if(Pe)It.warnings.push("No host is proxied yet, so zone settings, cache rules and purge were skipped — they only take effect through the proxy.");return It}try{let ie=Xa(Ie),Dt=await S.applyZoneSettings(b,ie);It.settingsChanged=Dt.changed;for(let wt of Dt.failed)It.warnings.push(`zone setting '${wt.id}' could not be applied: ${wt.error}`)}catch(ie){It.warnings.push(`zone settings could not be read: ${ie instanceof Error?ie.message:String(ie)}`)}let kt=Ja(Pt,rt);if(kt.length>0){let ie=await S.putManagedPhaseRules(b,"http_request_cache_settings",kt);if(ie.success)It.cacheRules=kt.length;else It.warnings.push(`cache rules could not be written: ${ie.message}`)}if(Rt){let ie=Ya(Pt,Rt.header,Rt.value);if(ie.length>0){let Dt=await S.putManagedPhaseRules(b,"http_request_late_transform",ie);if(Dt.success)It.originGuard=!0;else It.warnings.push(`origin guard header could not be written: ${Dt.message}. `+"The gateway will reject requests that lack it — disable the guard or grant the token Transform Rules: Edit.")}}if(st){if(It.purged=await S.purgeCache(b,{hosts:Pt}),!It.purged)It.warnings.push("edge cache purge failed — new content may take until TTL expiry to appear.")}return It}var Ru=(l)=>process.env[l];function Pl(l,S){let b=l.replace(/\.$/,"").toLowerCase();if(S){let P=S.replace(/\.$/,"").toLowerCase();if(b===P||b.endsWith(`.${P}`))return P}return b.split(".").slice(-2).join(".")}function Pu(l,S={}){let b=S.env??Ru,P=l.infrastructure?.compute?.proxy?.cdn,v=[];if(!P||P.provider!=="cloudflare")return{plan:null,errors:v};if(P.originDomain)v.push(`compute.proxy.cdn.originDomain (${P.originDomain}) is ignored for Cloudflare: the proxy forwards to the address in the record it fronts, `+"so no separate origin hostname is needed — and publishing one gives clients a documented way around the edge.");let it=b("CLOUDFLARE_API_TOKEN");if(!it)return v.push("CLOUDFLARE_API_TOKEN is not set — the Cloudflare CDN cannot be reconciled."),{plan:null,errors:v};let Pe=l.sites??{},Ie=P.frontedHosts?.length?[...new Set(P.frontedHosts.map((Xt)=>Xt.toLowerCase()))]:En(Pe,{autoWww:l.infrastructure?.compute?.proxy?.autoWww!==!1});if(Ie.length===0)return v.push("No hostnames to front — set compute.proxy.cdn.frontedHosts, or give a site a domain."),{plan:null,errors:v};let rt=l.infrastructure?.dns?.domain,Rt=new Set(Ie.map((Xt)=>Pl(Xt,rt)));if(Rt.size>1)return v.push(`Fronted hosts span more than one zone (${[...Rt].join(", ")}). A Cloudflare zone is configured as a unit, so run one CDN config per zone.`),{plan:null,errors:v};let st=P.cloudflare??{},lr=P.secret?{header:P.secretHeader??"X-Origin-Verify",value:P.secret}:void 0;return{plan:{zone:[...Rt][0],hosts:Ie,apiToken:it,zoneId:st.zoneId??b("CLOUDFLARE_ZONE_ID"),accountId:st.accountId??b("CLOUDFLARE_ACCOUNT_ID"),proxied:st.proxied!==!1,settings:st.settings??Qi,cache:st.cache,originGuard:lr,purge:st.purgeOnDeploy!==!1,skipOriginProbe:st.skipOriginProbe===!0},errors:v}}var Tu=26214400;var Du=new Set(["/_headers","/_redirects","/_routes.json","/_worker.js"]);class $l{name="cloudflare-pages";apiToken;accountId;constructor(l){if(!l.apiToken)throw Error("Cloudflare Pages needs an API token");if(!l.accountId)throw Error("Cloudflare Pages needs an account id");this.apiToken=l.apiToken,this.accountId=l.accountId}async request(l,S,b){return Ba(l,`/accounts/${this.accountId}${S}`,`Bearer ${this.apiToken}`,b)}async getProject(l){try{return await this.request("GET",`/pages/projects/${l}`)}catch(S){if(S instanceof Error&&/\b8000007\b|not found/i.test(S.message))return null;throw S}}async ensureProject(l,S="main"){let b=await this.getProject(l);if(b)return b;return this.request("POST","/pages/projects",{name:l,production_branch:S})}async uploadToken(l){return(await this.request("GET",`/pages/projects/${l}/upload-token`)).jwt}async missingHashes(l,S){let b=await Ba("POST","/pages/assets/check-missing",`Bearer ${l}`,{hashes:S});return new Set(b)}async upsertHashes(l,S){await Ba("POST","/pages/assets/upsert-hashes",`Bearer ${l}`,{hashes:S})}async uploadBatch(l,S){let b=S.map((P)=>({key:P.hash,value:P.base64,metadata:{contentType:Eu(P.extension)},base64:!0}));await Ba("POST","/pages/assets/upload",`Bearer ${l}`,b)}async createDeployment(l,S,b){let P={};for(let it of S)P[it.path]=it.hash;let v=new FormData;if(v.append("manifest",JSON.stringify(P)),b)v.append("branch",b);return this.request("POST",`/pages/projects/${l}/deployments`,v)}async deployDirectory(l){let S=await Nl(l.directory);if(S.length===0)throw Error(`No files to deploy in ${l.directory}`);let b=await this.uploadToken(l.project),P=await this.missingHashes(b,S.map((rt)=>rt.hash)),v=S.filter((rt)=>P.has(rt.hash)),it=[];for(let rt=0;rt<v.length;rt+=100)it.push(v.slice(rt,rt+100));let Pe=0;for(let rt=0;rt<it.length;rt+=4){let Rt=it.slice(rt,rt+4);await Promise.all(Rt.map((st)=>this.uploadBatch(b,st))),Pe+=Rt.reduce((st,lr)=>st+lr.length,0),l.onProgress?.(Pe,v.length)}return await this.upsertHashes(b,S.map((rt)=>rt.hash)),{deployment:await this.createDeployment(l.project,S,l.branch),total:S.length,uploaded:v.length,uploadedBytes:v.reduce((rt,Rt)=>rt+Rt.size,0)}}async listCustomDomains(l){return(await this.request("GET",`/pages/projects/${l}/domains`)).map((b)=>b.name)}async attachCustomDomain(l,S){if((await this.listCustomDomains(l)).includes(S))return!1;return await this.request("POST",`/pages/projects/${l}/domains`,{name:S}),!0}}function Iu(l,S){return{type:"CNAME",name:l,value:S.endsWith(".pages.dev")?S:`${S}.pages.dev`,ttl:1,proxied:!0}}async function Ol(l,S){let{blake3:b}=await import("./chunk-xv3w9q1a.js").then((m)=>ah(m.default,1));return(await b(l+S)).slice(0,32)}async function Nl(l){let{readdir:S}=await import("node:fs/promises"),{join:b,relative:P,sep:v}=await import("node:path"),it=[];async function Pe(Ie){let rt=await S(Ie,{withFileTypes:!0});for(let Rt of rt){let st=b(Ie,Rt.name);if(Rt.isDirectory()){await Pe(st);continue}if(!Rt.isFile())continue;let lr=`/${P(l,st).split(v).join("/")}`;if(Du.has(lr))continue;let Xt=await Bun.file(st).bytes();if(Xt.byteLength>26214400)throw Error(`${lr} is ${Xt.byteLength} bytes, over the Cloudflare Pages limit of 26214400`);let fr=Buffer.from(Xt).toString("base64"),It=Rt.name.lastIndexOf("."),Pt=It>0?Rt.name.slice(It+1):"";it.push({path:lr,hash:await Ol(fr,Pt),base64:fr,extension:Pt,size:Xt.byteLength})}}return await Pe(l),it.sort((Ie,rt)=>Ie.path.localeCompare(rt.path)),it}function Eu(l){return{html:"text/html; charset=utf-8",css:"text/css; charset=utf-8",js:"application/javascript; charset=utf-8",mjs:"application/javascript; charset=utf-8",json:"application/json; charset=utf-8",map:"application/json; charset=utf-8",xml:"application/xml; charset=utf-8",txt:"text/plain; charset=utf-8",svg:"image/svg+xml",png:"image/png",jpg:"image/jpeg",jpeg:"image/jpeg",gif:"image/gif",webp:"image/webp",avif:"image/avif",ico:"image/x-icon",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",otf:"font/otf",pdf:"application/pdf",webmanifest:"application/manifest+json"}[l.toLowerCase()]||"application/octet-stream"}async function Ba(l,S,b,P){let v={Authorization:b},it;if(P instanceof FormData)it=P;else if(P!==void 0)v["Content-Type"]="application/json",it=JSON.stringify(P);let Pe=await fetch(`https://api.cloudflare.com/client/v4${S}`,{method:l,headers:v,body:it}),Ie=await Pe.text(),rt;try{rt=JSON.parse(Ie)}catch{throw Error(`Cloudflare Pages API returned ${Pe.status} with a non-JSON body: ${Ie.slice(0,200)}`)}if(!rt.success){let Rt=(rt.errors??[]).map((st)=>`${st.code}: ${st.message}`).join(", ");throw Error(`Cloudflare Pages API error (${Pe.status}): ${Rt||Ie.slice(0,200)}`)}return rt.result}export{dg as ABTestManager,ae as ACMClient,or as ACMDnsValidator,sc as ACME_DIRECTORIES,Te as AI,Gd as API_IDEMPOTENCY_TTL_MS,Qd as API_TOKEN_DEFAULT_TTL_MS,Hd as API_TOKEN_MAX_TTL_MS,ki as API_VERSION,de as AUTHORIZATION_CAPABILITIES,$d as AUTH_ACTION_TOKEN_TTL_MS,Md as AUTH_MFA_CHALLENGE_TTL_MS,Fd as AUTH_OIDC_TRANSACTION_TTL_MS,je as AUTH_SESSION_ABSOLUTE_TTL_MS,Ld as AUTH_SESSION_IDLE_TTL_MS,_f as AWSAPIError,n as AWSClient,h as AWSCloudFormationClient,A as AWSCloudFrontClient,sg as AWSConfigManager,Qy as AWS_PSEUDO_PARAMETERS,we as AWS_REGIONS,hu as AcmeClient,Nr as AlertEvaluator,ci as AlertStore,Fs as AnomalyConfigStore,pd as ApiGateway,i as ApiServiceError,xa as ApplicationAutoScalingClient,Zs as Arn,D as AssetHasher,U as Auth,wi as AuthenticationStore,gi as AutomationApiService,Ri as AutomationIdentityStore,Qo as AwsAuroraDataAdapter,jo as AwsAuroraTransport,la as AwsDatabaseBackupSource,ur as AwsDriver,Ho as AwsElastiCacheDataAdapter,zo as AwsElastiCacheTransport,am as AwsIamCapabilityScanner,ha as AwsInfrastructureBackupSource,Uo as AwsRdsDataAdapter,Vo as AwsRdsTransport,Sm as AwsRegionalDriver,Aa as AwsSecretsManagerConfigurationBackend,Tp as AwsSpendTransport,ya as AwsSsmConfigurationBackend,Hi as BackupCoordinator,ng as BackupManager,ca as BackupStore,Qg as BatchProcessingManager,ln as BedrockClient,dn as BedrockRuntimeClient,Jd as BitbucketSourceAdapter,cg as BlueGreenManager,Og as BounceComplaintHandler,Eg as BuildOptimizationManager,yl as BunDockerRuntime,ql as BunDockerVolumeRuntime,Gl as BunFilesystemArchiveRuntime,ve as CDN,oo as CHAIN_HEADER,ts as CLOUDFLARE_MANAGED_RULE_PREFIX,LS as COMMON_CROSS_ACCOUNT_ROLES,Fe as CONTROL_PLANE_SCHEMA_VERSION,Xs as Cache,ro as CanaryManager,Sg as CertificateManager,Gh as CloudBlockVolumeDriver,Is as CloudDriverFactory,Ve as CloudError,xp as CloudFormationBuilder,h as CloudFormationClient,A as CloudFrontClient,og as CloudTrailManager,me as CloudWatchLogsClient,$l as CloudflarePagesProvider,fe as CloudflareProvider,Kf as CommandHistory,H as Communication,Tr as ComposeApplicationService,Ot as ComposeApplicationStore,Ct as ComprehendClient,o as Compute,wp as ComputeSpendTransport,to as ConfigurationError,Sa as ConfigurationService,fa as ConfigurationStore,an as ConnectClient,qo as ContainerDataAdapter,vg as ContainerRegistryManager,ma as ControlPlaneBackupSource,ia as ControlPlaneCleanupDriver,ti as ControlPlaneStore,Ls as CounterTracker,Gt as CredentialError,Xp as CrossRegionReferenceManager,If as DASHBOARD_ENTRY,Sf as DASHBOARD_PORT_BASE,Cf as DASHBOARD_PORT_SPAN,yf as DASHBOARD_STATE_DIR,mo as DEFAULT_ATTACK_MODE_HOURS,Zc as DEFAULT_DDOS_THRESHOLDS,_c as DEFAULT_METER_MAPPINGS,Bc as DEFAULT_PRICE_BOOK,Si as DEFAULT_RECURSION_LIMITS,Cn as DEFAULT_RPX_CERTS_DIR,q as DEFAULT_SERVICE_LIMITS,Np as DEFAULT_STATE_DIR,cc as DEFAULT_STATIC_ASSET_EXTENSIONS,rf as DEFAULT_TELEMETRY_POLICY,dp as DEFAULT_THRESHOLDS,Mh as DEPLOYMENT_QUEUE_KINDS,so as DEPTH_HEADER,Dr as DETECTABLE_SIGNALS,gl as DIAGNOSTIC_PRESETS,Ug as DLQMonitoringManager,L as DNS,xg as DNSSECManager,Oi as DataServiceLifecycle,Fo as DataServiceStore,Ut as Database,Ag as DatabaseUserManager,ee as DebugLogger,mf as DependencyGraph,Q as Deployment,xf as DeploymentError,ig as DisasterRecoveryManager,An as DnsProviderFactory,zt as DockerDataTransport,xo as DockerDiscoveryAdapter,vr as DockerNamedVolumeDriver,ga as DockerVolumeBackupSource,c as DurableOperationQueue,Ps as DurableQueueWorker,ke as DynamoDBClient,Ar as EC2Client,Be as ECRClient,Xe as ECSClient,rr as EFSClient,Pa as ELBv2Client,Vh as ENFORCEMENT_ACTIONS,oi as ENFORCEMENT_DESCRIPTIONS,R as ENFORCEMENT_SEVERITY,$u as ENVIRONMENT_LABEL,ul as EcsRuntimeAdapter,go as EdgeRateLimiter,Ze as ElastiCacheClient,m as Email,Xf as EmailAdvanced,Lg as EmailAnalyticsManager,mn as EmailClient,Yf as EmailHandlers,Mg as EmailTemplateManager,Ko as EncryptedDataSecretStore,Of as ErrorCodes,er as EventBridgeClient,Am as EventBridgeJobAdapter,Ia as ExternalConfigurationBackend,Fg as FIFOQueueManager,Ap as FOCUS_VERSION,Fp as FileCache,Ge as FileSystem,ua as FilesystemBackupSource,Jo as FleetService,Wo as FleetStore,e as Fn,Xd as GiteaSourceAdapter,Kd as GithubSourceAdapter,Wd as GitlabSourceAdapter,Yp as GlobalResourceManager,xe as GoDaddyProvider,ag as GuardDutyManager,ot as HOST_SITES_DIR,Mf as HashCache,Wg as HealthCheckManager,Qe as HealthCheckRunner,gr as HetznerClient,Se as HetznerDriver,he as IAMClient,Ua as IPV6_EXCLUDED_HOST_LABELS,bg as ImageScanningManager,Wl as InfrastructureGenerator,Cc as InvalidOperationTransitionError,ut as JobLoader,ym as JobProviderReconciler,Mo as JobService,Lo as JobStore,Zt as KendraClient,AA as LARAVEL_SERVERLESS_BUILD_STEPS,C as LambdaClient,Dg as LambdaConcurrencyManager,kg as LambdaDLQManager,Pg as LambdaDestinationsManager,wg as LambdaLayersManager,pl as LambdaRuntimeAdapter,Ng as LambdaVPCManager,Rg as LambdaVersionsManager,tn as LocalEncryptedConfigurationBackend,pa as LogicalDatabaseBackupSource,gg as LogsManager,nA as MANAGED_NODE_VERSIONS,lc as MANAGEMENT_DASHBOARD_SITE,_p as MANAGEMENT_DASHBOARD_SITE_PREFIX,vi as MAX_CONTROL_HOURS,bc as MAX_CONTROL_PLANE_ERROR_BYTES,ip as MAX_CONTROL_PLANE_JSON_BYTES,xs as METERS,qh as METER_KEYS,jh as MICRO_CENTS,lp as MIN_PROJECTION_CONFIDENCE,su as MTA_STS_PORT,na as MaintenanceService,ra as MaintenanceStore,Z as Messaging,pg as MetricsManager,mg as MigrationManager,qp as MockCloudFormation,jp as MockDynamoDB,Vp as MockS3,Ys as Monitoring,tg as MultiAccountManager,Jp as MultiRegionManager,Hf as MultiStepProgress,f as Network,Jg as NetworkSecurityManager,di as NotificationRouter,Na as OpenSearchClient,at as OptimisticConcurrencyError,rg as OrganizationManager,Tu as PAGES_MAX_FILE_BYTES,yA as PHP_DEFAULT_EXCLUDES,iA as PHP_LAYER_EXTENSIONS,Lu as PROJECT_LABEL,tt as PROXIABLE_RECORD_TYPES,E as ParameterStore,fg as PerformanceManager,Y as Permissions,ka as PersonalizeClient,qe as Phone,Zf as PhoneAdvanced,hf as PhoneHandlers,Yo as PlacementService,Xo as PlacementStore,un as PollyClient,se as PorkbunProvider,qr as PreDeployScanner,zp as PreviewEnvironmentManager,Er as PreviewEnvironmentService,Ue as PreviewEnvironmentStore,Kp as PreviewNotificationService,Qf as ProgressBar,lg as ProgressiveDeploymentManager,ho as ProtectionControlStore,Ny as Pseudo,M as Queue,ri as QueueCancellationError,Hg as QueueManagementManager,Dy as QueuePresets,Ds as QueueTimeoutError,Dd as RATE_LIMIT_KEY_SEPARATOR,j as RDSClient,Jf as RECOMMENDED_ACCOUNT_STRUCTURES,OS as RECOMMENDED_SCPS,nm as RELEASE_QUEUE_KINDS,Vf as REPL,zf as REPLCommandBuilder,jf as REPLContext,Mu as ROLE_LABEL,Ff as RateLimiter,Py as RealtimePresets,yp as RecordingSpendTransport,co as RecursionGuard,pt as Redirects,Zp as RegionPairManager,ea as RegionService,Zo as RegionStore,He as Registry,bt as RekognitionClient,gt as ReleaseService,vo as ReleaseStore,Im as RemoteBuildService,hg as ReplicaManager,Xg as ResourceManagementManager,X as RetryableOperationError,y as Route53Client,Da as Route53DomainsClient,z as Route53Provider,_g as Route53ResolverManager,Bg as Route53RoutingManager,pe as RuntimeOperationService,Oo as RuntimeStreamRegistry,da as S3BackupDestinationAdapter,a as S3Client,G as S3Error,el as SECRET_PATTERNS,hp as SENSITIVITY_THRESHOLDS,et as SESClient,F as SMS,Ye as SNSClient,vp as SPEND_CYCLE_SECONDS,zc as SPEND_GATE_SETTING,af as SPEND_LEASE_SETTING,ne as SQSClient,Ce as SSH_BOOTSTRAP_VERSION,kn as SSH_PREFLIGHT_SCRIPT,be as SSMClient,kp as STATE_DIR_ENV_VAR,Qi as STATIC_SITE_ZONE_SETTINGS,ge as STSClient,pn as SchedulerClient,Qt as Search,Vr as SecretFindingScanner,fi as Secrets,Ig as SecretsManager,V as SecretsManagerClient,yg as SecretsRotationManager,I as Security,Lr as SecurityHubManager,Gr as SecurityPostureStore,mt as SecurityScannerRunner,Cg as SecurityScanningManager,$g as SenderReputationManager,fm as ServerCronJobAdapter,Go as ServerDataAdapter,Bs as ServerPathVolumeDriver,Tg as ServiceMeshManager,ud as Sftp,Qs as SignalSource,eA as SmsAdvanced,vt as SmsClient,ff as SmsHandlers,La as SmsVoiceClient,To as SourceConnectionStore,Vt as SourceProviderError,Kc as SpendCapError,Pr as SpendGate,bp as SpendLoopLease,js as SpendNotificationRouter,Ep as SpendRunner,$t as SpendService,ii as SpendStore,Gf as Spinner,hr as SshDriver,Kr as SshFleetDriver,eg as StackDependencyManager,Uy as StacksIntegration,zg as StaticSiteManager,Ee as Storage,Kg as StorageAdvancedManager,gn as SupportClient,$r as SyntheticsManager,Il as SystemFleetSshTransport,mr as SystemSshTransport,_o as SystemdDiscoveryAdapter,ao as TRACE_HEADER,qf as TaskList,lt as TelemetryStore,dd as TemplateBuilder,Up as TemplateCache,Et as TextractClient,cn as TranscribeClient,Yt as TranslateClient,Em as TransportDisasterRecoveryDriver,bm as TransportPlatformMaintenanceDriver,Li as TransportRemoteBuildDriver,ko as TrivyImageScanner,Eo as TsCloudApiError,qd as TsCloudClient,of as URGENT_SPEND_EVENTS,up as USER_VISIBLE_ACTIONS,ta as UnavailableRegionalDriver,oe as UnifiedDnsValidator,Ts as UnsupportedSchemaVersionError,$p as ValidationError,tr as VoiceClient,ks as VolumeService,_t as VolumeStore,Af as Workflow,ug as XRayManager,lC as abTestManager,Vd as activateImmutableRelease,pu as addDns01ChallengeRecord,Jr as addSiteToCloudConfig,ft as ageSeconds,Lc as aggregateDeltas,tp as allocateSitePorts,My as analyzeStackDiff,ai as anomalyOptionsForSignal,fo as applyControlsToDdos,xd as applyControlsToRateLimits,os as applyDeclaredZoneSettings,xr as applyMitigationFactor,Ih as applyPlan,ls as applyZoneMigration,Ad as artifactKey,Di as assertReleaseStrategy,tf as assertSpendAllows,vh as attachConflicts,Th as attachIsViable,Eh as attachPreconditions,sl as attachProvenanceToRelease,Bo as attachSbomToRelease,nl as attachVulnerabilitySummary,tm as authEncryptionKeyFile,w as authorizeOrganization,mm as authorizeRuntimePath,uS as autocomplete,iC as awsConfigManager,Ql as backupCredentialStatus,rC as backupManager,NI as batch,GC as batchProcessingManager,Co as beginOidcAuthorization,cC as blueGreenManager,$C as bounceComplaintHandler,ct as budgetWindow,Ta as buildAndPushServerlessImage,jC as buildBunRuntimeLayerZip,kh as buildCertificatePackScript,Dh as buildCertificateStateScript,Bh as buildCertificateUnpackScript,gd as buildCloudFormationTemplate,tc as buildCloudInitFirstBoot,wc as buildComposeLogsCommand,Ay as buildComposeRuntimeCommand,yy as buildComposeScaleCommand,Rc as buildComposeShellCommand,Yu as buildDrainSourceScript,lh as buildDrainedSiteScanScript,Wt as buildFunctionEnv,Xu as buildHealthGateScript,jn as buildHostCleanupScript,Zn as buildHostSitePortsScript,cd as buildMailEnv,Cs as buildManagementDashboardArtifact,Rm as buildMediaCdnPlan,iu as buildMtaStsPolicy,Vm as buildMtaStsServer,VC as buildNodeRuntimeLayerZip,TC as buildOptimizationManager,Ya as buildOriginGuardRule,qu as buildPauseWorkersScript,JC as buildPhpRuntimeLayerZip,Ku as buildRestoreScript,K as buildRpxConfig,_e as buildRpxFragmentRefreshScript,Ch as buildSetHostnameScript,Gn as buildSiteDeployScript,zu as buildSnapshotScript,Zu as buildSourceStateScript,Tn as buildSshArgs,Pn as buildSshBootstrapScript,Ja as buildStaticSiteCacheRules,qn as buildStaticSiteDeployScript,Wu as buildTargetStateScript,Vu as buildWorkersStateScript,al as bytes,dC as canaryManager,Wr as canonicalJson,ht as capabilities,Kt as capacity,FI as categorizeChanges,bC as certificateManager,Nh as certificatesMatch,II as checkIAMPermissions,lA as checkInvocation,CI as checkServiceQuotas,Uf as chunk,Um as cleanupDns01Challenge,vy as clearSigningKeyCache,Ro as cloneSourceBinding,HI as cloudConfigSchema,wu as cloudDrivers,sC as cloudTrailManager,Nl as collectAssets,uo as collectPhpAppEntries,ru as collectServerDnsDomains,sp as completeComposeVolumeDeletion,bo as completeOidcAuthorization,sI as composePresets,Rs as composeProjectName,Id as composeServerlessAppTemplate,df as compositeSpendTransport,St as compressBackup,SA as config,fl as connectionGuidance,wC as containerRegistryManager,Lh as controlPlaneDatabaseFile,Ic as controlPlaneMigrations,zy as createApiBackendPreset,No as createApiV1Handler,PA as createAsgBuildDriver,Hl as createBackupQueueHandlers,hA as createCliHandler,k as createCloudDriver,nc as createCloudFrontPolicy,gI as createCredentialProvider,nI as createDashboardSite,Yy as createDataPipelinePreset,Al as createDataServiceQueueHandlers,Dc as createDeploymentQueueHandlers,T as createDnsProvider,DA as createEcsBuildDriver,Wc as createEnforcementHandlers,Mp as createError,md as createExistingStaticFullStackPreset,Sl as createFleetQueueHandlers,jy as createFullStackAppPreset,gs as createGoDaddyValidator,WC as createHandlers,gA as createHttpHandler,Wy as createJamstackPreset,hl as createJobQueueHandlers,tI as createLaravelPreset,Zy as createMLApiPreset,Rl as createMaintenanceQueueHandlers,xu as createMediaAccessToken,Jy as createMicroservicesPreset,KI as createMockAWS,Gy as createNodeJsServerPreset,qy as createNodeJsServerlessPreset,Zi as createObjectStorageClient,ps as createPorkbunValidator,oI as createPreset,uf as createPresignedUrl,Iy as createPresignedUrlAsync,mA as createQueueHandler,Xy as createRealtimeAppPreset,bl as createRegionQueueHandlers,il as createReleaseProvenance,zd as createReleaseQueueHandlers,wA as createRemoteBuildQueueHandlers,ms as createRoute53Validator,gm as createRuntimeAdapters,mI as createS3Client,RA as createServerBuildDriver,rI as createServerlessLaravelPreset,Vy as createServerlessNodePreset,tu as createSmsInfrastructure,Ke as createSourceAdapter,Hy as createStaticSitePreset,eI as createTraditionalWebAppPreset,Pc as createVolumeQueueHandlers,Ky as createWordPressPreset,Ii as createZip,IS as crossRegionReferenceManager,rn as dashboardActions,Ss as dashboardCredentialsFile,zr as dataServiceCapabilities,IC as databaseUserManager,Od as decodeBase32,Ne as decompressBackup,xm as decryptBackup,Ao as defaultConfig,Gp as defaultLocalConfig,Nd as defaultRateLimitRules,sr as delegateZone,is as delegateZoneFromConfig,Ea as deleteStaticSite,pc as deployAllComputeSites,oa as deployServerlessApp,Ml as deploySite,bs as deploySiteRelease,ji as deployStaticSite,va as deployStaticSiteFull,nn as deployStaticSiteWithExternalDns,sn as deployStaticSiteWithExternalDnsFull,od as deploymentCoexistenceError,bf as deriveManagementDashboardPort,ss as describeDelegation,Bd as describePosture,as as describeZoneSettings,hm as desiredJobProviderState,mp as detectAnomalies,Bp as detectDeploymentTargets,$a as detectDnsProvider,qc as detectLatestAnomaly,fI as detectMisconfigurations,Dp as detectServiceRegion,vc as diffCompose,LI as diffTemplates,wo as discoverGitRefs,So as discoverOidcProvider,cl as discoverRuntimeInventory,HC as dlqMonitoringManager,Ma as dnsProviders,OC as dnssecManager,lm as dockerWorkloads,$i as documentDigest,nC as drManager,Le as driverStatePath,dl as ecsWorkloads,xt as effectiveCapabilities,MC as emailAnalyticsManager,UC as emailTemplateManager,Ti as encodeBase32,Bm as encryptBackup,ol as ensureDefaultSecurityPolicies,Mn as ensureFirewall,zn as ensureManagementDashboard,Un as ensureServer,$n as ensureSshKey,J as escapeSecLang,Mc as evaluateBudget,xn as evaluatePreflight,Vs as evaluateTelemetryAlertRules,ml as eventBridgeScheduleInput,pA as eventToRequest,Yh as ewma,Ec as exportCompose,cs as exportRoute53Zone,Lp as extendPreset,QC as fifoQueueManager,PI as findChangedFiles,ap as findMapping,op as findPriceEntry,US as formatAccountStructure,wh as formatAttachPlan,nS as formatBytes,kr as formatCents,Fy as formatDiff,ph as formatDrainedSiteRefusal,iS as formatDuration,gS as formatFlagSuggestions,fS as formatHistory,AS as formatHistoryStats,fh as formatInventory,oS as formatKeyValue,sS as formatList,yh as formatPlan,On as formatPreflightFindings,rS as formatProgressBar,Wf as formatRegion,kS as formatRegionList,om as formatScanResults,aS as formatSuggestion,eS as formatTable,Rr as formatTimeToExhaustion,tS as formatTree,Rf as fromEC2Metadata,Df as fromECSMetadata,Tf as fromEnvironment,wf as fromSharedCredentials,Pf as fromWebIdentity,Cd as functionFingerprint,En as gatewayHostnames,Sd as generateAppImageDockerfile,eC as generateApprovalConfig,tA as generateBootstrap,XI as generateCleanupWorkflow,YI as generateCostReportWorkflow,MS as generateCrossAccountRoleCF,tl as generateCycloneDxSbom,XS as generateDeploymentConfig,jS as generateDeploymentPipeline,QS as generateDeploymentWorkflow,ba as generateExternalDnsStaticSiteTemplate,zm as generateHttpsServerCode,rl as generateImageSbom,Hm as generateLetsEncryptUserData,t as generateLogicalId,JS as generateManualPipeline,VS as generateMatrixWorkflow,YS as generateMultiEnvConfig,zS as generateMultiEnvPipeline,HS as generateMultiEnvWorkflow,GS as generatePRPreviewWorkflow,tC as generateParallelConfig,fA as generatePhpFpmConfig,oA as generatePhpLayerDockerfile,KS as generatePreviewPipeline,JI as generatePreviewWorkflow,r as generateResourceName,ZS as generateScheduledConfig,WS as generateScheduledPipeline,qS as generateScheduledWorkflow,Vi as generateStaticSiteTemplate,N as generateUbuntuAppCloudInit,Bf as getAccountId,ES as getAllRegions,DS as getClosestRegion,mS as getCommandUsage,$h as getComposeTemplate,Yg as getConfig,dS as getContextualHelp,eo as getCredentials,UI as getDeploymentStrategy,QI as getDiffStats,$I as getDiffSummary,Lf as getErrorDetails,fd as getLocalConfig,jI as getLocalCredentials,VI as getLocalEndpoint,zI as getLocalEnvVars,bI as getQuotaUsageSummary,$S as getRecommendedStructure,yi as getRegion,BS as getRegionStats,TS as getRegionsByCompliance,vS as getRegionsByLocation,wS as getRegionsByPricingTier,$f as getRequiredPermissions,Ty as getSigningKeyCacheSize,eu as getSmsInfrastructureStatus,ky as getTimestamp,po as globMatches,Es as globToRegex,SS as globalResourceManager,si as governingLimitCents,oC as guardDutyManager,zs as handleSpendRequest,bn as hasAutoWwwVariant,Ht as hasManagementDashboardSite,yc as hasProxyUpstream,TI as hashBuffer,wI as hashDirectory,Qp as hashFile,RI as hashManifest,Hp as hashString,ZC as healthCheckManager,yn as hostAcceptsIpv6,Za as hostCondition,yo as hotp,wr as hourBucket,Xh as hourBucketsBetween,vC as imageScanningManager,Ui as infraEnvFromOutputs,Ed as inspectInvocation,cA as installRecursionFetch,Ki as invalidateCache,Vg as invocationContext,cS as isLikelyTypo,Sn as isLocalDatabase,qI as isLocalDevelopment,_r as isManagementDashboardSiteName,nr as isNameserverRegistrar,wy as isNodeCryptoAvailable,Gc as isOperationAllowed,qs as isQuietHours,Wn as isSafePattern,id as isStateDirConfigured,sd as isStatePath,Br as isValidCidr,RS as isValidRegion,ni as isValidTimeZone,Ry as isWebCryptoAvailable,ir as isZoneHost,jr as jobProviderCapability,Yi as keyMatchesFilters,NC as lambdaConcurrencyManager,xC as lambdaDLQManager,kC as lambdaDestinationsManager,DC as lambdaLayersManager,BC as lambdaVPCManager,PC as lambdaVersionsManager,ll as lambdaWorkloads,wd as laravelServerlessEnvDefaults,br as listComposeTemplates,Ni as listSourceReferences,_d as loadCloudConfig,Mt as loadTelemetryPolicy,mC as logsManager,Vc as lookbackHoursForSignal,gf as mailEnabled,ad as mailFirewallPorts,Cm as maintenanceWindowOpen,pf as makeAWSRequest,Cy as makeAWSRequestAsync,Sy as makeAWSRequestOnce,Op as managementDashboardSiteName,El as manifestDigest,Fr as matchTotpCounter,Bu as mediaObjectHeaders,Ms as median,pp as medianAbsoluteDeviation,Fc as mergeDecisions,Or as mergeInfrastructure,Wh as mergePriceBooks,Oc as meterTelemetry,gC as metricsManager,Jl as migrateObjectStorage,fC as migrationManager,xS as multiAccountManager,yS as multiRegionManager,jm as needsRenewal,eb as networkSecurityManager,At as nextScheduleRuns,Ae as normalizePublicIpv6,Re as normalizeRuntimeStatus,We as normalizeScheduleExpression,im as normalizeSourceEvent,Oe as normalizeSshPublicKey,Ip as normalizeTelemetryPolicy,Yn as occupiedHostPorts,Po as openApiDocument,Hs as optionsForSignal,_S as organizationManager,Rd as packagePhpApp,Mr as packageServerlessApp,Ol as pagesAssetHash,Iu as pagesDnsRecord,hd as parallel,kI as parallelMap,BI as parallelWithRetry,Ph as parseCertificateState,bd as parseChain,Cr as parseCompose,hy as parseComposeCatalog,dm as parseDockerInspect,Vl as parseDotenv,uh as parseDrainedSites,ei as parseHostSiteFragments,Ey as parseJSONResponse,Bn as parsePreflightFacts,ep as parseSourceDrained,um as parseSystemdRecords,Ju as parseTargetReady,Ac as parseUpstreamPort,ju as parseWorkersPaused,by as parseXMLResponse,ui as pathTemplate,hc as pendingSteps,$s as percentOfLimit,yC as performanceManager,Gg as phpLayerBuildStage,sA as phpLayerPackages,Ci as phpRuntimeLayerAssets,fy as planComposeTemplateUpgrade,Uc as planEnforcement,Hu as planIsDestructive,Rp as planMitigation,Sh as planServerRename,xh as planSiteMove,ds as planZoneMigration,Tt as policyTag,_n as preflightFailed,WI as previewManager,ZI as previewNotifications,yt as previewSchedule,Jh as previousBudgetWindow,_s as priceUsage,zh as priceUsageLines,mh as probeHostRoutes,es as probeOriginTls,OI as processInChunks,Yd as processSourceWebhook,xi as productionChangeReview,uC as progressiveDeploymentManager,$c as projectSpend,vd as propagationHeaders,wa as providerEndpoint,vl as publicKeyFingerprint,hn as qualifyName,qC as queueManagementManager,DI as quickHash,Pd as rateLimitHeaders,Ei as rateLimitKey,$e as readDriverState,hh as reconcile,nu as reconcileAddressRecords,bu as reconcileCloudflareCdn,ns as reconcileDeclaredRecords,TA as reconcileJobObservation,Hr as reconcileSourceWebhook,Bi as recordDashboardHostPosture,bA as recordPreDeploySecretScan,EA as recordSkippedSecretScan,Td as recursionBlockedResponse,De as redactRuntimeConfig,Yc as redactTelemetryText,li as redactTelemetryValue,Yr as redeployServerlessApp,CS as regionPairManager,Qr as releaseStrategyCapabilities,rm as releaseTrafficPlan,Kn as reloadRpxGateway,Xi as remapKey,mu as removeDns01ChallengeRecord,Xr as removeSiteFromCloudConfig,Zd as removeSourceWebhook,Fa as removeStaleServerAddressRecords,Tc as renderComposeTemplate,mi as renderDdosInstallScript,rd as renderNftablesRuleset,_i as renderServerCron,td as renderSysctlFile,mc as renderWafConfig,Jn as renderWafInstallScript,gc as renewRpxCertificates,AC as replicaManager,lf as requestHash,MI as requiresReplacement,zC as resetRecursionRuntime,KC as resolveApp,p as resolveAppDatabase,bh as resolveAttachTarget,ze as resolveAuthEncryptionKey,le as resolveCloudProvider,Pu as resolveCloudflareCdnPlan,Nf as resolveCredentials,qi as resolveDashboardAction,uc as resolveDashboardAuth,Ef as resolveDashboardDomain,vf as resolveDashboardDomains,rs as resolveDeclaredRecords,$y as resolveDeployBucketName,O as resolveDeploymentMode,Hn as resolveExecStart,Ka as resolveHetznerApiToken,hi as resolveMailService,iI as resolveManagementDashboardSite,Ai as resolveManagementDashboardSites,Ra as resolveObjectStorage,Ah as resolvePlan,g as resolveProjectStackName,Sr as resolveProxyUpstreams,yd as resolveQueueNames,Fh as resolveQueuedDeploymentCommand,qt as resolveQueues,aA as resolveRecursionConfig,kf as resolveRegion,re as resolveRuntimeInventory,Ft as resolveServerlessAppStackName,ld as resolveServerlessArtifactBucketName,Js as resolveServerlessAssetBucketName,io as resolveServerlessRuntime,Oy as resolveSiteBucketName,vs as resolveSiteDeployTarget,u as resolveSiteKind,_y as resolveSiteResourceName,xy as resolveSiteStackName,Nn as resolveSshSettings,d as resolveStatePath,Ly as resolveStorageBucketName,Nt as resolveUiSource,Pl as resolveZoneApex,tb as resourceManagementManager,jg as responseToResult,gp as robustZScore,Bt as roleCapabilities,jd as rollbackImmutableRelease,Zr as rollbackServerlessApp,Kh as roundCents,LC as route53ResolverManager,_C as route53RoutingManager,fp as routeMatches,Fu as routesFromFragments,bi as ruleMatches,rA as runBuildHooks,Qc as runEnforcement,lo as runPhpBuildHooks,Je as runRemoteCommand,ue as runtimeId,fn as sameNameservers,Gi as sanitizeCloudConfig,s as sanitizeControlPlaneValue,By as sanitizeName,Ud as sanitizeOidcReturnPath,Jc as saveTelemetryPolicy,sm as scanForSecrets,Sc as scopeContains,dt as scopeKey,qa as scpUpload,lS as searchCommands,ws as searchControlPlane,CC as secretsManager,SC as secretsRotationManager,vA as secureContainerRelease,aC as securityHubManager,EC as securityScanningManager,te as securityScope,Ur as sendAuthenticationEmail,FC as senderReputationManager,xI as sequence,jl as serializeDotenv,Qn as serverPublicIpv4,RC as serviceMeshManager,_l as setAttachToInCloudConfig,Jt as setMaintenance,Mi as setSitePropertyInCloudConfig,nd as setStateDir,Gm as setupDns01Challenge,Oa as setupSmsInfrastructure,no as sha256,dA as sharedRecursionGuard,qg as sharedRuntimeLoop,np as shipsARelease,ku as signCloudFrontCookies,Nu as signCloudFrontUrl,x as signRequest,Pp as signRequestAsync,Us as signalDefinition,B as siteInstallBase,Xn as siteMoveArchivePath,Rh as siteMoveCertArchivePath,fc as siteUnitGlob,Cp as spendNotificationText,Ks as spendOpenApiPaths,pr as sshExec,ce as sshExecOrThrow,bS as stackDependencyManager,Ca as startLocalDashboardServer,cf as startSpendLoop,Ws as stateDir,_ as statePath,XC as staticSiteManager,YC as storageAdvancedManager,Zh as streamFocusJsonl,Hc as strongestActiveAction,Wp as suggestCommand,pS as suggestFlags,SI as suggestIAMPolicy,EI as suggestQuotaIncrease,NS as suggestRegionPairs,PS as suggestRegions,Pi as syncSourceRepositories,Nc as synchronizeComposeVolumes,zl as synchronizeConfiguredConfiguration,$o as synchronizeConfiguredJobs,hC as syntheticsManager,ed as sysctlHardening,pm as systemdWorkloads,sf as telemetryBucketLabel,pi as telemetryCursor,Xc as telemetryEstimatedMonthlyCost,nf as telemetryPercentile,Sp as telemetryPolicyKey,vI as templateCache,Uu as tenantsOf,Do as testSourceConnection,kc as tieredMicroCents,Xa as toCloudflareZoneSettings,Gs as toFocusJsonl,jc as toFocusRecords,gh as toInventoryServer,Zg as totp,Io as totpUri,Qu as unaccountedSites,cm as unsupportedCapabilities,Uh as unsupportedVolumeCapabilities,wl as updateCompatibility,Dl as updateSiteInCloudConfig,zi as uploadStaticFiles,cp as usageDeltaKey,Lt as utcInstantOfLocal,FS as validateAccountStructure,GI as validateAgainstSchema,Hh as validateAttachment,km as validateBackupDestination,hS as validateCommand,hI as validateConfiguration,yI as validateCredentials,rp as validateDeploymentConfig,Qh as validateMountPath,ou as validateResourceLimits,Gu as validateServerName,Ul as validateTemplate,kd as validateTemplateSize,Qa as verifyAddressRecord,CA as verifyArtifactSignature,_u as verifyMediaAccessToken,em as verifyTotp,Tl as verifyUpdateSignature,us as verifyZoneParity,Ns as volumeCapabilities,Ou as wafEventTelemetry,Va as waitForCloudInit,wn as waitForSsh,jt as webhookEndpoint,uI as withCDN,lI as withCache,dI as withDatabase,uA as withInvocation,aI as withMonitoring,pI as withQueue,cI as withSecurity,_I as withTimeout,W as wrapCloudInitUserData,nt as writeDriverState,pC as xrayManager,Cl as zeroCapacity,ef as zeroFill,xc as zoneOffsetMs,Os as zonedParts};

package/dist/ui/404.html

@@ -2,7 +2,7 @@
 <html lang="en" data-theme="dark">
 <head>
   <meta charset="UTF-8">
-  <meta name="stx-build" content="muft0tf1wgfgnt">
+  <meta name="stx-build" content="mug946zhn1xys6">
 
 <!-- stx SEO Tags -->
 <meta name="title" content="Page not found · ts-cloud">