@stacksjs/ts-cloud 0.16.14 → 0.16.16

package/dist/{chunk-nw5yqgtn.js → chunk-whwg2nzb.js}

@@ -1,4 +1,4 @@
-import{z,oe,T,ae,or}from"./chunk-s40cx3fh.js";import{a}from"./chunk-3bz7xz2d.js";import{A}from"./chunk-sw1p9qge.js";import{y}from"./chunk-21b8nage.js";import{h}from"./chunk-22ybphxa.js";function Ea(t){let{bucketName:s,domain:u,aliases:e,certificateArn:p,defaultRootObject:i="index.html",errorDocument:r="404.html",passthroughUrls:c=!1,singlePageApp:g=!1,dynamicApp:C=!1,computeOriginDomain:w,computeOriginPort:x=3008,computeOriginId:E="app-compute",retainOnStackDelete:M=!1}=t,S=M?{DeletionPolicy:"Retain",UpdateReplacePolicy:"Retain"}:{},N=C&&!!w,j=N?["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"]:["GET","HEAD"],v=N?["GET","HEAD"]:["GET","HEAD"],O={},B={};O.S3Bucket={Type:"AWS::S3::Bucket",...S,Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},B.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},B.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},O.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",...S,Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}};let I;if(c&&N)I="InstallRootRedirectFunction",O[I]={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-install-root-redirect"},AutoPublish:!0,FunctionConfig:{Comment:"Redirect curl pantry.dev | bash (GET /) to /install.sh on S3",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
+import{z,oe,T,ae,or}from"./chunk-v9t92ak2.js";import{a}from"./chunk-z87dekhm.js";import{A}from"./chunk-yxn6tpbg.js";import{y}from"./chunk-emx1j2yt.js";import{h}from"./chunk-g0yyw5k8.js";function Ta(t){let{bucketName:s,domain:u,aliases:e,certificateArn:p,defaultRootObject:i="index.html",errorDocument:r="404.html",passthroughUrls:c=!1,singlePageApp:g=!1,dynamicApp:C=!1,computeOriginDomain:w,computeOriginPort:x=3008,computeOriginId:E="app-compute",retainOnStackDelete:M=!1}=t,S=M?{DeletionPolicy:"Retain",UpdateReplacePolicy:"Retain"}:{},N=C&&!!w,j=N?["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"]:["GET","HEAD"],v=N?["GET","HEAD"]:["GET","HEAD"],O={},B={};O.S3Bucket={Type:"AWS::S3::Bucket",...S,Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},B.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},B.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},O.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",...S,Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}};let I;if(c&&N)I="InstallRootRedirectFunction",O[I]={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-install-root-redirect"},AutoPublish:!0,FunctionConfig:{Comment:"Redirect curl pantry.dev | bash (GET /) to /install.sh on S3",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
   var request = event.request;
   if (request.uri === '/' || request.uri === '') {
     return {
@@ -24,7 +24,7 @@ import{z,oe,T,ae,or}from"./chunk-s40cx3fh.js";import{a}from"./chunk-3bz7xz2d.js"
   }
 
   return request;
-}`}};let R={Id:`S3-${s}`,DomainName:{"Fn::GetAtt":["S3Bucket","RegionalDomainName"]},S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{"Fn::GetAtt":["CloudFrontOAC","Id"]}},d=N?{Id:E,DomainName:w,CustomOriginConfig:{HTTPPort:x,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}:null,k=N?E:`S3-${s}`,b={Enabled:!0,DefaultRootObject:i,HttpVersion:"http2and3",IPV6Enabled:!0,PriceClass:"PriceClass_100",Origins:d?[d,R]:[R],DefaultCacheBehavior:{TargetOriginId:k,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:j,CachedMethods:v,Compress:!0,...N?{CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac",...c&&I?{FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":[I,"FunctionARN"]}}]}:{}}:{CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6",...!c&&{FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":["UrlRewriteFunction","FunctionARN"]}}]}}},...N&&c?{CacheBehaviors:[{PathPattern:"/install.sh",TargetOriginId:`S3-${s}`,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6"}]}:{},CustomErrorResponses:g?[{ErrorCode:403,ResponseCode:200,ResponsePagePath:`/${i}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:200,ResponsePagePath:`/${i}`,ErrorCachingMinTTL:300}]:[{ErrorCode:403,ResponseCode:404,ResponsePagePath:`/${r}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:404,ResponsePagePath:`/${r}`,ErrorCachingMinTTL:300}]};if(u&&p)b.Aliases=e&&e.length>0?e:[u],b.ViewerCertificate={AcmCertificateArn:p,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"};else b.ViewerCertificate={CloudFrontDefaultCertificate:!0};return O.CloudFrontDistribution={Type:"AWS::CloudFront::Distribution",...S,DependsOn:["S3Bucket","CloudFrontOAC",...c&&N&&I?[I]:[],...!c?["UrlRewriteFunction"]:[]],Properties:{DistributionConfig:b}},B.DistributionId={Description:"CloudFront Distribution ID",Value:{Ref:"CloudFrontDistribution"}},B.DistributionDomain={Description:"CloudFront Distribution Domain",Value:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]}},O.S3BucketPolicy={Type:"AWS::S3::BucketPolicy",...S,DependsOn:["S3Bucket","CloudFrontDistribution"],Properties:{Bucket:{Ref:"S3Bucket"},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":"arn:aws:s3:::${S3Bucket}/*"},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":"arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}"}}}}]}}},B.SiteUrl={Description:"Site URL",Value:u?`https://${u}`:{"Fn::Sub":"https://${CloudFrontDistribution.DomainName}"}},{AWSTemplateFormatVersion:"2010-09-09",Description:`Static site infrastructure for ${u||s} (External DNS)`,Resources:O,Outputs:B}}async function nn(t){let s=t.region||"us-east-1",u="us-east-1",e=t.domain,p=t.bucket||e.replace(/\./g,"-"),i=t.stackName||`${t.siteName}-static-site`,r=new h("us-east-1"),c=new ae("us-east-1"),g=null;if(!t.skipDnsVerification){g=T(t.dnsProvider),console.log(`Verifying DNS provider can manage ${e}...`);let o=await g.listRecords(e);if(!o.success){let n=o.message||"unknown error — check API credentials and domain ownership";return{success:!1,stackName:i,bucket:p,message:`DNS provider '${g.name}' cannot manage domain ${e}: ${n}`}}console.log(`DNS provider '${g.name}' verified for ${e}`)}else console.log(`Skipping DNS verification for ${e}`);let C=t.certificateArn,E=e.split(".").length===2?`www.${e}`:void 0;if(!C){console.log(`Checking for existing SSL certificate for ${e}...`);let o=await c.findCertificateByDomain(e),n=!1;if(o&&o.Status==="ISSUED"){if(E&&o.SubjectAlternativeNames)n=o.SubjectAlternativeNames.includes(E)||o.SubjectAlternativeNames.some((m)=>m===`*.${e}`);else n=!0;if(n)C=o.CertificateArn,console.log(`Found existing certificate with www coverage: ${C}`);else console.log(`Existing certificate doesn't cover ${E}, requesting new one...`)}if(!C){if(!g)return{success:!1,stackName:i,bucket:p,message:`No DNS provider available to validate SSL certificate for ${e}. Provide a certificateArn or enable DNS verification.`};console.log(`Requesting new SSL certificate for ${e}${E?` (including ${E})`:""}...`);let f=await new oe(g,"us-east-1").findOrCreateCertificate({domainName:e,subjectAlternativeNames:E?[E]:void 0,waitForValidation:!0,maxWaitMinutes:10});if(f.status!=="issued")return{success:!1,stackName:i,bucket:p,message:`SSL certificate validation failed. Status: ${f.status}`};C=f.certificateArn,console.log(`Certificate issued: ${C}`)}}let M=!1,S;try{let o=await r.describeStacks({stackName:i});if(o.Stacks.length>0){let n=o.Stacks[0],m=n.StackStatus;if(m==="DELETE_IN_PROGRESS")console.log("Previous stack is still being deleted, waiting..."),await r.waitForStack(i,"stack-delete-complete"),M=!1;else if(m==="DELETE_COMPLETE")M=!1;else M=!0,S=(n.Outputs||[]).find((l)=>l.OutputKey==="BucketName")?.OutputValue}}catch(o){if(o.message?.includes("does not exist")||o.code==="ValidationError")M=!1;else throw o}let N=S||p;if(!M){let o=new a(s),n=new A,m=!1;if(e)try{console.log(`Checking for existing CloudFront distributions with alias ${e}...`);let f=await n.listDistributions();for(let l of f){let D=[];if(l.Aliases?.Items){if(Array.isArray(l.Aliases.Items))D=l.Aliases.Items;else if(typeof l.Aliases.Items==="object"){let F=l.Aliases.Items.CNAME;if(typeof F==="string")D=[F];else if(Array.isArray(F))D=F}}if(D.includes(e)){m=!0,console.log(`Found existing CloudFront distribution ${l.Id} with alias ${e}`),console.log("Reusing existing infrastructure for updates...");let P=(await n.getDistributionConfig(l.Id)).DistributionConfig?.Origins?.Items,V;if(P){let U=[];if(Array.isArray(P))U=P;else if(P.Origin)U=Array.isArray(P.Origin)?P.Origin:[P.Origin];else U=[P];for(let L of U){let W=(L.DomainName||"").match(/^([^.]+)\.s3[\.-]/);if(W){V=W[1];break}}}if(V)return console.log(`Using existing S3 bucket: ${V}`),{success:!0,stackName:`existing-${l.Id}`,bucket:V,distributionId:l.Id,distributionDomain:l.DomainName,domain:e,certificateArn:C,message:"Using existing CloudFront distribution",_existingInfrastructure:!0}}}}catch{}if(!m)try{if((await o.headBucket(p)).exists){console.log(`Found orphaned S3 bucket ${p}, cleaning up...`);try{let l=o.emptyBucket(p).then(()=>o.deleteBucket(p)),D=new Promise((F,P)=>setTimeout(()=>P(Error("Bucket cleanup timeout")),30000));await Promise.race([l,D]),console.log(`Deleted orphaned S3 bucket ${p}`)}catch(l){console.log(`Note: Could not clean up S3 bucket: ${l.message}`);let D=Date.now().toString(36);N=`${p}-${D}`,console.log(`Using alternative bucket name: ${N}`)}}}catch{}}let v=Ea({bucketName:N,domain:e,aliases:E?[e,E]:[e],certificateArn:C,defaultRootObject:t.defaultRootObject,errorDocument:t.errorDocument,passthroughUrls:t.passthroughUrls,singlePageApp:t.singlePageApp,dynamicApp:t.dynamicApp,computeOriginDomain:t.computeOriginDomain,computeOriginPort:t.computeOriginPort,computeOriginId:t.computeOriginId}),O=Object.entries(t.tags||{}).map(([o,n])=>({Key:o,Value:n}));if(O.push({Key:"ManagedBy",Value:"ts-cloud"}),O.push({Key:"Application",Value:t.siteName}),g)O.push({Key:"DnsProvider",Value:g.name});let B,I=!1;if(M){I=!0,console.log(`Updating CloudFormation stack: ${i}`);try{B=(await r.updateStack({stackName:i,templateBody:JSON.stringify(v),capabilities:["CAPABILITY_IAM"],tags:O})).StackId,console.log(`Update initiated, stack ID: ${B}`)}catch(o){if(o.message?.includes("No updates are to be performed")){let n=await r.describeStacks({stackName:i});B=n.Stacks[0].StackId;let m=n.Stacks[0]?.Outputs||[],f=(D)=>m.find((F)=>F.OutputKey===D)?.OutputValue,l=f("DistributionDomain");if(l)await H(g,e,l);return{success:!0,stackId:B,stackName:i,bucket:f("BucketName")||N,distributionId:f("DistributionId"),distributionDomain:l,domain:e,certificateArn:C,message:"Static site infrastructure is already up to date"}}else throw o}}else console.log(`Creating CloudFormation stack: ${i}`),console.log(`Bucket name: ${N}`),console.log(`Domain: ${e}`),console.log(`Certificate ARN: ${C}`),B=(await r.createStack({stackName:i,templateBody:JSON.stringify(v),capabilities:["CAPABILITY_IAM"],tags:O,onFailure:"DELETE"})).StackId,console.log(`Create initiated, stack ID: ${B}`);console.log(`Waiting for stack to reach ${I?"stack-update-complete":"stack-create-complete"}...`);try{await r.waitForStack(i,I?"stack-update-complete":"stack-create-complete"),console.log("Stack operation completed successfully!")}catch(o){if(o.message?.includes("must be verified")||o.message?.includes("Access denied for operation")){console.log("CloudFront account verification required - checking for existing infrastructure...");try{let m=new A,f=await m.listDistributions();for(let l of f){let D=[];if(l.Aliases?.Items){if(Array.isArray(l.Aliases.Items))D=l.Aliases.Items;else if(typeof l.Aliases.Items==="object"){let F=l.Aliases.Items.CNAME;if(typeof F==="string")D=[F];else if(Array.isArray(F))D=F}}if(D.includes(e)){console.log(`Found existing CloudFront distribution ${l.Id} with alias ${e}`),console.log("Using existing infrastructure despite account verification requirement...");let P=(await m.getDistributionConfig(l.Id)).DistributionConfig?.Origins?.Items,V;if(P){let U=[];if(Array.isArray(P))U=P;else if(P.Origin)U=Array.isArray(P.Origin)?P.Origin:[P.Origin];else U=[P];for(let L of U){let W=(L.DomainName||"").match(/^([^.]+)\.s3[\.-]/);if(W){V=W[1];break}}}if(V){console.log(`Using existing S3 bucket: ${V}`);let U=l.DomainName;if(U)await H(g,e,U);return{success:!0,stackName:`existing-${l.Id}`,bucket:V,distributionId:l.Id,distributionDomain:l.DomainName,domain:e,certificateArn:C,message:"Using existing CloudFront distribution (account verification pending for new distributions)"}}}}}catch{}return console.log(`
+}`}};let R={Id:`S3-${s}`,DomainName:{"Fn::GetAtt":["S3Bucket","RegionalDomainName"]},S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{"Fn::GetAtt":["CloudFrontOAC","Id"]}},d=N?{Id:E,DomainName:w,CustomOriginConfig:{HTTPPort:x,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}:null,k=N?E:`S3-${s}`,b={Enabled:!0,DefaultRootObject:i,HttpVersion:"http2and3",IPV6Enabled:!0,PriceClass:"PriceClass_100",Origins:d?[d,R]:[R],DefaultCacheBehavior:{TargetOriginId:k,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:j,CachedMethods:v,Compress:!0,...N?{CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac",...c&&I?{FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":[I,"FunctionARN"]}}]}:{}}:{CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6",...!c&&{FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":["UrlRewriteFunction","FunctionARN"]}}]}}},...N&&c?{CacheBehaviors:[{PathPattern:"/install.sh",TargetOriginId:`S3-${s}`,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6"}]}:{},CustomErrorResponses:g?[{ErrorCode:403,ResponseCode:200,ResponsePagePath:`/${i}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:200,ResponsePagePath:`/${i}`,ErrorCachingMinTTL:300}]:[{ErrorCode:403,ResponseCode:404,ResponsePagePath:`/${r}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:404,ResponsePagePath:`/${r}`,ErrorCachingMinTTL:300}]};if(u&&p)b.Aliases=e&&e.length>0?e:[u],b.ViewerCertificate={AcmCertificateArn:p,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"};else b.ViewerCertificate={CloudFrontDefaultCertificate:!0};return O.CloudFrontDistribution={Type:"AWS::CloudFront::Distribution",...S,DependsOn:["S3Bucket","CloudFrontOAC",...c&&N&&I?[I]:[],...!c?["UrlRewriteFunction"]:[]],Properties:{DistributionConfig:b}},B.DistributionId={Description:"CloudFront Distribution ID",Value:{Ref:"CloudFrontDistribution"}},B.DistributionDomain={Description:"CloudFront Distribution Domain",Value:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]}},O.S3BucketPolicy={Type:"AWS::S3::BucketPolicy",...S,DependsOn:["S3Bucket","CloudFrontDistribution"],Properties:{Bucket:{Ref:"S3Bucket"},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":"arn:aws:s3:::${S3Bucket}/*"},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":"arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}"}}}}]}}},B.SiteUrl={Description:"Site URL",Value:u?`https://${u}`:{"Fn::Sub":"https://${CloudFrontDistribution.DomainName}"}},{AWSTemplateFormatVersion:"2010-09-09",Description:`Static site infrastructure for ${u||s} (External DNS)`,Resources:O,Outputs:B}}async function sn(t){let s=t.region||"us-east-1",u="us-east-1",e=t.domain,p=t.bucket||e.replace(/\./g,"-"),i=t.stackName||`${t.siteName}-static-site`,r=new h("us-east-1"),c=new ae("us-east-1"),g=null;if(!t.skipDnsVerification){g=T(t.dnsProvider),console.log(`Verifying DNS provider can manage ${e}...`);let o=await g.listRecords(e);if(!o.success){let n=o.message||"unknown error — check API credentials and domain ownership";return{success:!1,stackName:i,bucket:p,message:`DNS provider '${g.name}' cannot manage domain ${e}: ${n}`}}console.log(`DNS provider '${g.name}' verified for ${e}`)}else console.log(`Skipping DNS verification for ${e}`);let C=t.certificateArn,E=e.split(".").length===2?`www.${e}`:void 0;if(!C){console.log(`Checking for existing SSL certificate for ${e}...`);let o=await c.findCertificateByDomain(e),n=!1;if(o&&o.Status==="ISSUED"){if(E&&o.SubjectAlternativeNames)n=o.SubjectAlternativeNames.includes(E)||o.SubjectAlternativeNames.some((m)=>m===`*.${e}`);else n=!0;if(n)C=o.CertificateArn,console.log(`Found existing certificate with www coverage: ${C}`);else console.log(`Existing certificate doesn't cover ${E}, requesting new one...`)}if(!C){if(!g)return{success:!1,stackName:i,bucket:p,message:`No DNS provider available to validate SSL certificate for ${e}. Provide a certificateArn or enable DNS verification.`};console.log(`Requesting new SSL certificate for ${e}${E?` (including ${E})`:""}...`);let f=await new oe(g,"us-east-1").findOrCreateCertificate({domainName:e,subjectAlternativeNames:E?[E]:void 0,waitForValidation:!0,maxWaitMinutes:10});if(f.status!=="issued")return{success:!1,stackName:i,bucket:p,message:`SSL certificate validation failed. Status: ${f.status}`};C=f.certificateArn,console.log(`Certificate issued: ${C}`)}}let M=!1,S;try{let o=await r.describeStacks({stackName:i});if(o.Stacks.length>0){let n=o.Stacks[0],m=n.StackStatus;if(m==="DELETE_IN_PROGRESS")console.log("Previous stack is still being deleted, waiting..."),await r.waitForStack(i,"stack-delete-complete"),M=!1;else if(m==="DELETE_COMPLETE")M=!1;else M=!0,S=(n.Outputs||[]).find((l)=>l.OutputKey==="BucketName")?.OutputValue}}catch(o){if(o.message?.includes("does not exist")||o.code==="ValidationError")M=!1;else throw o}let N=S||p;if(!M){let o=new a(s),n=new A,m=!1;if(e)try{console.log(`Checking for existing CloudFront distributions with alias ${e}...`);let f=await n.listDistributions();for(let l of f){let D=[];if(l.Aliases?.Items){if(Array.isArray(l.Aliases.Items))D=l.Aliases.Items;else if(typeof l.Aliases.Items==="object"){let F=l.Aliases.Items.CNAME;if(typeof F==="string")D=[F];else if(Array.isArray(F))D=F}}if(D.includes(e)){m=!0,console.log(`Found existing CloudFront distribution ${l.Id} with alias ${e}`),console.log("Reusing existing infrastructure for updates...");let P=(await n.getDistributionConfig(l.Id)).DistributionConfig?.Origins?.Items,V;if(P){let U=[];if(Array.isArray(P))U=P;else if(P.Origin)U=Array.isArray(P.Origin)?P.Origin:[P.Origin];else U=[P];for(let L of U){let W=(L.DomainName||"").match(/^([^.]+)\.s3[\.-]/);if(W){V=W[1];break}}}if(V)return console.log(`Using existing S3 bucket: ${V}`),{success:!0,stackName:`existing-${l.Id}`,bucket:V,distributionId:l.Id,distributionDomain:l.DomainName,domain:e,certificateArn:C,message:"Using existing CloudFront distribution",_existingInfrastructure:!0}}}}catch{}if(!m)try{if((await o.headBucket(p)).exists){console.log(`Found orphaned S3 bucket ${p}, cleaning up...`);try{let l=o.emptyBucket(p).then(()=>o.deleteBucket(p)),D=new Promise((F,P)=>setTimeout(()=>P(Error("Bucket cleanup timeout")),30000));await Promise.race([l,D]),console.log(`Deleted orphaned S3 bucket ${p}`)}catch(l){console.log(`Note: Could not clean up S3 bucket: ${l.message}`);let D=Date.now().toString(36);N=`${p}-${D}`,console.log(`Using alternative bucket name: ${N}`)}}}catch{}}let v=Ta({bucketName:N,domain:e,aliases:E?[e,E]:[e],certificateArn:C,defaultRootObject:t.defaultRootObject,errorDocument:t.errorDocument,passthroughUrls:t.passthroughUrls,singlePageApp:t.singlePageApp,dynamicApp:t.dynamicApp,computeOriginDomain:t.computeOriginDomain,computeOriginPort:t.computeOriginPort,computeOriginId:t.computeOriginId}),O=Object.entries(t.tags||{}).map(([o,n])=>({Key:o,Value:n}));if(O.push({Key:"ManagedBy",Value:"ts-cloud"}),O.push({Key:"Application",Value:t.siteName}),g)O.push({Key:"DnsProvider",Value:g.name});let B,I=!1;if(M){I=!0,console.log(`Updating CloudFormation stack: ${i}`);try{B=(await r.updateStack({stackName:i,templateBody:JSON.stringify(v),capabilities:["CAPABILITY_IAM"],tags:O})).StackId,console.log(`Update initiated, stack ID: ${B}`)}catch(o){if(o.message?.includes("No updates are to be performed")){let n=await r.describeStacks({stackName:i});B=n.Stacks[0].StackId;let m=n.Stacks[0]?.Outputs||[],f=(D)=>m.find((F)=>F.OutputKey===D)?.OutputValue,l=f("DistributionDomain");if(l)await H(g,e,l);return{success:!0,stackId:B,stackName:i,bucket:f("BucketName")||N,distributionId:f("DistributionId"),distributionDomain:l,domain:e,certificateArn:C,message:"Static site infrastructure is already up to date"}}else throw o}}else console.log(`Creating CloudFormation stack: ${i}`),console.log(`Bucket name: ${N}`),console.log(`Domain: ${e}`),console.log(`Certificate ARN: ${C}`),B=(await r.createStack({stackName:i,templateBody:JSON.stringify(v),capabilities:["CAPABILITY_IAM"],tags:O,onFailure:"DELETE"})).StackId,console.log(`Create initiated, stack ID: ${B}`);console.log(`Waiting for stack to reach ${I?"stack-update-complete":"stack-create-complete"}...`);try{await r.waitForStack(i,I?"stack-update-complete":"stack-create-complete"),console.log("Stack operation completed successfully!")}catch(o){if(o.message?.includes("must be verified")||o.message?.includes("Access denied for operation")){console.log("CloudFront account verification required - checking for existing infrastructure...");try{let m=new A,f=await m.listDistributions();for(let l of f){let D=[];if(l.Aliases?.Items){if(Array.isArray(l.Aliases.Items))D=l.Aliases.Items;else if(typeof l.Aliases.Items==="object"){let F=l.Aliases.Items.CNAME;if(typeof F==="string")D=[F];else if(Array.isArray(F))D=F}}if(D.includes(e)){console.log(`Found existing CloudFront distribution ${l.Id} with alias ${e}`),console.log("Using existing infrastructure despite account verification requirement...");let P=(await m.getDistributionConfig(l.Id)).DistributionConfig?.Origins?.Items,V;if(P){let U=[];if(Array.isArray(P))U=P;else if(P.Origin)U=Array.isArray(P.Origin)?P.Origin:[P.Origin];else U=[P];for(let L of U){let W=(L.DomainName||"").match(/^([^.]+)\.s3[\.-]/);if(W){V=W[1];break}}}if(V){console.log(`Using existing S3 bucket: ${V}`);let U=l.DomainName;if(U)await H(g,e,U);return{success:!0,stackName:`existing-${l.Id}`,bucket:V,distributionId:l.Id,distributionDomain:l.DomainName,domain:e,certificateArn:C,message:"Using existing CloudFront distribution (account verification pending for new distributions)"}}}}}catch{}return console.log(`
 ┌─────────────────────────────────────────────────────────────────────────────┐
 │  AWS ACCOUNT VERIFICATION REQUIRED                                          │
 ├─────────────────────────────────────────────────────────────────────────────┤
@@ -42,7 +42,7 @@ import{z,oe,T,ae,or}from"./chunk-s40cx3fh.js";import{a}from"./chunk-3bz7xz2d.js"
 │                                                                             │
 │  Verification typically takes 1-2 business days.                            │
 │  After verification, re-run: bunx bunpress deploy                           │
-└─────────────────────────────────────────────────────────────────────────────┘`),{success:!1,stackId:B,stackName:i,bucket:N,message:"CloudFront account verification required. Please contact AWS Support."}}return{success:!1,stackId:B,stackName:i,bucket:N,message:`Stack deployment failed: ${o.message}`}}let d=(await r.describeStacks({stackName:i})).Stacks[0]?.Outputs||[],k=(o)=>d.find((n)=>n.OutputKey===o)?.OutputValue,b=k("DistributionDomain");if(b&&g)console.log(`Creating DNS records via ${g.name}...`),await H(g,e,b);else if(b&&!g)console.log("Skipping DNS record creation (DNS verification was skipped)");return{success:!0,stackId:B,stackName:i,bucket:k("BucketName")||N,distributionId:k("DistributionId"),distributionDomain:b,domain:e,certificateArn:C,message:"Static site infrastructure deployed successfully with external DNS"}}async function H(t,s,u){if(!t){console.log("Skipping DNS record creation (DNS verification was skipped)");return}if(s.split(".").length===2)if(t instanceof z){console.log(`Creating Route53 alias record for apex domain ${s} -> ${u}`);let i=await t.createCloudFrontAlias({domain:s,name:s,cloudFrontDomainName:u});if(!i.success)console.warn(`Warning: Could not create Route53 alias record: ${i.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${s} -> ${u}`);else console.log(`Created Route53 alias record: ${s} -> ${u}`);let r=`www.${s}`;console.log(`Creating Route53 alias record for ${r} -> ${u}`);let c=await t.createCloudFrontAlias({domain:s,name:r,cloudFrontDomainName:u});if(!c.success)console.warn(`Warning: Could not create www Route53 alias: ${c.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${r} -> ${u}`);else console.log(`Created Route53 alias record: ${r} -> ${u}`)}else{try{let g=await t.listRecords(s,"A");if(g.success)for(let C of g.records){let w=C.name.replace(/\.$/,"");if(w===s||w==="")console.log(`Removing existing root A record (${C.content}) to make room for ALIAS...`),await t.deleteRecord(s,{name:s,type:"A",content:C.content})}}catch(g){console.log(`Note: Could not check for conflicting A records: ${g instanceof Error?g.message:g}`)}console.log(`Creating ALIAS record for apex domain ${s} -> ${u}`);let i=await t.upsertRecord(s,{name:s,type:"ALIAS",content:u,ttl:600});if(!i.success)console.warn(`Warning: Could not create ALIAS record: ${i.message}`),console.warn("Please manually create an ALIAS record in your DNS provider:"),console.warn(`  ${s} -> ${u}`);else console.log(`Created ALIAS record: ${s} -> ${u}`);let r=`www.${s}`;console.log(`Creating CNAME record for ${r} -> ${u}`);let c=await t.upsertRecord(s,{name:r,type:"CNAME",content:u,ttl:600});if(!c.success)console.warn(`Warning: Could not create www DNS record: ${c.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${r} -> ${u}`);else console.log(`Created CNAME record: ${r} -> ${u}`)}else{console.log(`Creating CNAME record for ${s} -> ${u}`);let i=await t.upsertRecord(s,{name:s,type:"CNAME",content:u,ttl:600});if(!i.success)console.warn(`Warning: Could not create DNS record: ${i.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${s} -> ${u}`);else console.log(`Created CNAME record: ${s} -> ${u}`)}}async function sn(t){let{sourceDir:s,cleanBucket:u=!1,onProgress:e,...p}=t;e?.("infrastructure","Deploying CloudFormation stack...");let i=await nn(p);if(!i.success)return i;if(u){e?.("clean","Cleaning old files from S3...");try{await new a(p.region||"us-east-1").emptyBucket(i.bucket)}catch(C){console.log(`Note: Could not clean bucket: ${C.message}`)}}e?.("upload","Uploading files to S3...");let{uploadStaticFiles:r}=await import("./chunk-xdsaxgny.js"),c=await r({sourceDir:s,bucket:i.bucket,region:p.region||"us-east-1",cacheControl:p.cacheControl,onProgress:(C,w,x)=>{e?.("upload",`${C}/${w}: ${x}`)}});if(c.errors.length>0)return{...i,success:!1,message:`Upload errors: ${c.errors.join(", ")}`,filesUploaded:c.uploaded};if(i.distributionId&&c.uploaded>0){e?.("invalidate","Invalidating CloudFront cache...");let{invalidateCache:C}=await import("./chunk-xdsaxgny.js");await C(i.distributionId)}e?.("complete","Deployment complete!");let g=c.skipped>0?`Deployed ${c.uploaded} files (${c.skipped} unchanged) with external DNS`:`Deployed ${c.uploaded} files successfully with external DNS`;return{...i,filesUploaded:c.uploaded,filesSkipped:c.skipped,message:g}}function ji(t){let{bucketName:s,domain:u,certificateArn:e,hostedZoneId:p,defaultRootObject:i="index.html",errorDocument:r="404.html"}=t,c={},g={};c.S3Bucket={Type:"AWS::S3::Bucket",Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},g.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},g.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},c.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},c.UrlRewriteFunction={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-url-rewrite"},AutoPublish:!0,FunctionConfig:{Comment:"Append .html extension to URLs without extensions",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
+└─────────────────────────────────────────────────────────────────────────────┘`),{success:!1,stackId:B,stackName:i,bucket:N,message:"CloudFront account verification required. Please contact AWS Support."}}return{success:!1,stackId:B,stackName:i,bucket:N,message:`Stack deployment failed: ${o.message}`}}let d=(await r.describeStacks({stackName:i})).Stacks[0]?.Outputs||[],k=(o)=>d.find((n)=>n.OutputKey===o)?.OutputValue,b=k("DistributionDomain");if(b&&g)console.log(`Creating DNS records via ${g.name}...`),await H(g,e,b);else if(b&&!g)console.log("Skipping DNS record creation (DNS verification was skipped)");return{success:!0,stackId:B,stackName:i,bucket:k("BucketName")||N,distributionId:k("DistributionId"),distributionDomain:b,domain:e,certificateArn:C,message:"Static site infrastructure deployed successfully with external DNS"}}async function H(t,s,u){if(!t){console.log("Skipping DNS record creation (DNS verification was skipped)");return}if(s.split(".").length===2)if(t instanceof z){console.log(`Creating Route53 alias record for apex domain ${s} -> ${u}`);let i=await t.createCloudFrontAlias({domain:s,name:s,cloudFrontDomainName:u});if(!i.success)console.warn(`Warning: Could not create Route53 alias record: ${i.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${s} -> ${u}`);else console.log(`Created Route53 alias record: ${s} -> ${u}`);let r=`www.${s}`;console.log(`Creating Route53 alias record for ${r} -> ${u}`);let c=await t.createCloudFrontAlias({domain:s,name:r,cloudFrontDomainName:u});if(!c.success)console.warn(`Warning: Could not create www Route53 alias: ${c.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${r} -> ${u}`);else console.log(`Created Route53 alias record: ${r} -> ${u}`)}else{try{let g=await t.listRecords(s,"A");if(g.success)for(let C of g.records){let w=C.name.replace(/\.$/,"");if(w===s||w==="")console.log(`Removing existing root A record (${C.content}) to make room for ALIAS...`),await t.deleteRecord(s,{name:s,type:"A",content:C.content})}}catch(g){console.log(`Note: Could not check for conflicting A records: ${g instanceof Error?g.message:g}`)}console.log(`Creating ALIAS record for apex domain ${s} -> ${u}`);let i=await t.upsertRecord(s,{name:s,type:"ALIAS",content:u,ttl:600});if(!i.success)console.warn(`Warning: Could not create ALIAS record: ${i.message}`),console.warn("Please manually create an ALIAS record in your DNS provider:"),console.warn(`  ${s} -> ${u}`);else console.log(`Created ALIAS record: ${s} -> ${u}`);let r=`www.${s}`;console.log(`Creating CNAME record for ${r} -> ${u}`);let c=await t.upsertRecord(s,{name:r,type:"CNAME",content:u,ttl:600});if(!c.success)console.warn(`Warning: Could not create www DNS record: ${c.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${r} -> ${u}`);else console.log(`Created CNAME record: ${r} -> ${u}`)}else{console.log(`Creating CNAME record for ${s} -> ${u}`);let i=await t.upsertRecord(s,{name:s,type:"CNAME",content:u,ttl:600});if(!i.success)console.warn(`Warning: Could not create DNS record: ${i.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${s} -> ${u}`);else console.log(`Created CNAME record: ${s} -> ${u}`)}}async function on(t){let{sourceDir:s,cleanBucket:u=!1,onProgress:e,...p}=t;e?.("infrastructure","Deploying CloudFormation stack...");let i=await sn(p);if(!i.success)return i;if(u){e?.("clean","Cleaning old files from S3...");try{await new a(p.region||"us-east-1").emptyBucket(i.bucket)}catch(C){console.log(`Note: Could not clean bucket: ${C.message}`)}}e?.("upload","Uploading files to S3...");let{uploadStaticFiles:r}=await import("./chunk-051jwkd2.js"),c=await r({sourceDir:s,bucket:i.bucket,region:p.region||"us-east-1",cacheControl:p.cacheControl,onProgress:(C,w,x)=>{e?.("upload",`${C}/${w}: ${x}`)}});if(c.errors.length>0)return{...i,success:!1,message:`Upload errors: ${c.errors.join(", ")}`,filesUploaded:c.uploaded};if(i.distributionId&&c.uploaded>0){e?.("invalidate","Invalidating CloudFront cache...");let{invalidateCache:C}=await import("./chunk-051jwkd2.js");await C(i.distributionId)}e?.("complete","Deployment complete!");let g=c.skipped>0?`Deployed ${c.uploaded} files (${c.skipped} unchanged) with external DNS`:`Deployed ${c.uploaded} files successfully with external DNS`;return{...i,filesUploaded:c.uploaded,filesSkipped:c.skipped,message:g}}function Ki(t){let{bucketName:s,domain:u,certificateArn:e,hostedZoneId:p,defaultRootObject:i="index.html",errorDocument:r="404.html"}=t,c={},g={};c.S3Bucket={Type:"AWS::S3::Bucket",Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},g.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},g.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},c.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},c.UrlRewriteFunction={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-url-rewrite"},AutoPublish:!0,FunctionConfig:{Comment:"Append .html extension to URLs without extensions",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
   const request = event.request;
   var uri = request.uri;
 
@@ -56,5 +56,5 @@ import{z,oe,T,ae,or}from"./chunk-s40cx3fh.js";import{a}from"./chunk-3bz7xz2d.js"
   }
 
   return request;
-}`}};let C={Enabled:!0,DefaultRootObject:i,HttpVersion:"http2and3",IPV6Enabled:!0,PriceClass:"PriceClass_100",Origins:[{Id:`S3-${s}`,DomainName:{"Fn::GetAtt":["S3Bucket","RegionalDomainName"]},S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{"Fn::GetAtt":["CloudFrontOAC","Id"]}}],DefaultCacheBehavior:{TargetOriginId:`S3-${s}`,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6",FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":["UrlRewriteFunction","FunctionARN"]}}]},CustomErrorResponses:[{ErrorCode:403,ResponseCode:200,ResponsePagePath:`/${i}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:404,ResponsePagePath:`/${r}`,ErrorCachingMinTTL:300}]};if(u&&e)C.Aliases=[u],C.ViewerCertificate={AcmCertificateArn:e,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"};else C.ViewerCertificate={CloudFrontDefaultCertificate:!0};if(c.CloudFrontDistribution={Type:"AWS::CloudFront::Distribution",DependsOn:["S3Bucket","CloudFrontOAC","UrlRewriteFunction"],Properties:{DistributionConfig:C}},g.DistributionId={Description:"CloudFront Distribution ID",Value:{Ref:"CloudFrontDistribution"}},g.DistributionDomain={Description:"CloudFront Distribution Domain",Value:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]}},c.S3BucketPolicy={Type:"AWS::S3::BucketPolicy",DependsOn:["S3Bucket","CloudFrontDistribution"],Properties:{Bucket:{Ref:"S3Bucket"},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":"arn:aws:s3:::${S3Bucket}/*"},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":"arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}"}}}}]}}},u&&p)c.DNSRecord={Type:"AWS::Route53::RecordSet",DependsOn:"CloudFrontDistribution",Properties:{HostedZoneId:p,Name:u,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}},c.DNSRecordIPv6={Type:"AWS::Route53::RecordSet",DependsOn:"CloudFrontDistribution",Properties:{HostedZoneId:p,Name:u,Type:"AAAA",AliasTarget:{DNSName:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}},g.SiteUrl={Description:"Site URL",Value:{"Fn::Sub":"https://${DNSRecord}"}};return{AWSTemplateFormatVersion:"2010-09-09",Description:`Static site infrastructure for ${u||s}`,Resources:c,Outputs:g}}async function zi(t){if(t.dnsProvider&&t.dnsProvider.provider!=="route53"){let d=t.domain||(t.subdomain&&t.baseDomain?`${t.subdomain}.${t.baseDomain}`:void 0);if(!d)return{success:!1,stackName:t.stackName||`${t.siteName}-static-site`,bucket:t.bucket||`${t.siteName}-${Date.now()}`,message:"Domain is required when using external DNS provider"};return nn({siteName:t.siteName,region:t.region,domain:d,bucket:t.bucket,certificateArn:t.certificateArn,stackName:t.stackName,defaultRootObject:t.defaultRootObject,errorDocument:t.errorDocument,cacheControl:t.cacheControl,tags:t.tags,dnsProvider:t.dnsProvider})}let s=t.region||"us-east-1",u="us-east-1",e;if(t.domain)e=t.domain;else if(t.subdomain&&t.baseDomain)e=`${t.subdomain}.${t.baseDomain}`;let p=t.bucket||(e?e.replace(/\./g,"-"):`${t.siteName}-${Date.now()}`),i=t.stackName||`${t.siteName}-static-site`,r=new h(u),c=new y,g=new ae("us-east-1"),C=new or("us-east-1"),{hostedZoneId:w,certificateArn:x}=t;if(e&&!w){let d=await c.findHostedZoneForDomain(e);if(d)w=d.Id.replace("/hostedzone/","");else return{success:!1,stackName:i,bucket:p,message:`No Route53 hosted zone found for ${t.baseDomain||e}. Please create one first.`}}if(e&&!x&&w){let d=await g.findCertificateByDomain(e);if(d&&d.Status==="ISSUED")x=d.CertificateArn;else x=(await C.requestAndValidate({domainName:e,hostedZoneId:w,waitForValidation:!0,maxWaitMinutes:10})).certificateArn}let E=!1,M;try{let d=await r.describeStacks({stackName:i});if(d.Stacks.length>0){let k=d.Stacks[0],b=k.StackStatus;if(b==="DELETE_IN_PROGRESS")console.log("Previous stack is still being deleted, waiting..."),await r.waitForStack(i,"stack-delete-complete"),E=!1;else if(b==="DELETE_COMPLETE")E=!1;else E=!0,M=(k.Outputs||[]).find((n)=>n.OutputKey==="BucketName")?.OutputValue}}catch(d){if(d.message?.includes("does not exist")||d.code==="ValidationError")E=!1;else throw d}let S=M||p;if(!E){let d=new a(s),k=new A,b=!1;if(e){try{console.log(`Checking for existing CloudFront distribution for ${e}...`);let o=await k.listDistributions();for(let n of o){let m=[];if(n.Aliases?.Items){if(Array.isArray(n.Aliases.Items))m=n.Aliases.Items;else if(typeof n.Aliases.Items==="object"){let f=n.Aliases.Items.CNAME;if(typeof f==="string")m=[f];else if(Array.isArray(f))m=f}}if(m.includes(e)){b=!0,console.log(`Found existing CloudFront distribution ${n.Id} for ${e}`);let l=(await k.getDistributionConfig(n.Id)).DistributionConfig?.Origins?.Items,D;if(l){let F=[];if(Array.isArray(l))F=l;else if(l.Origin)F=Array.isArray(l.Origin)?l.Origin:[l.Origin];else F=[l];for(let P of F){let U=(P.DomainName||"").match(/^([^.]+)\.s3[\.-]/);if(U){D=U[1];break}}}if(D){let F=e.replace(/\./g,"-");if(!D.startsWith(F)&&!D.includes(t.siteName)){console.log(`Warning: Found distribution with mismatched bucket ${D}, skipping...`);continue}if(console.log(`Using existing S3 bucket: ${D}`),w&&n.DomainName)try{console.log(`Ensuring Route53 records exist for ${e}...`),await c.createAliasRecord({HostedZoneId:w,Name:e,Type:"A",TargetHostedZoneId:y.CloudFrontHostedZoneId,TargetDNSName:n.DomainName,EvaluateTargetHealth:!1}),await c.createAliasRecord({HostedZoneId:w,Name:e,Type:"AAAA",TargetHostedZoneId:y.CloudFrontHostedZoneId,TargetDNSName:n.DomainName,EvaluateTargetHealth:!1}),console.log(`Route53 records ensured for ${e}`)}catch(P){console.log(`Note: Could not update Route53 records: ${P.message}`)}return{success:!0,stackName:`existing-${n.Id}`,bucket:D,distributionId:n.Id,distributionDomain:n.DomainName,domain:e,certificateArn:x,message:"Using existing CloudFront distribution"}}}}}catch{}if(w)try{let n=(await c.listResourceRecordSets({HostedZoneId:w})).ResourceRecordSets||[];for(let m of n)if(m.Name===`${e}.`&&(m.Type==="A"||m.Type==="AAAA")){if(m.AliasTarget){console.log(`Found orphaned Route53 ${m.Type} record for ${e}, cleaning up...`);try{await c.deleteRecord({HostedZoneId:w,RecordSet:m}),console.log(`Deleted orphaned Route53 ${m.Type} record for ${e}`)}catch(f){console.log(`Note: Could not delete Route53 record: ${f.message}`)}}}}catch{}}if(!b)try{if((await d.headBucket(p)).exists){console.log(`Found orphaned S3 bucket ${p}, cleaning up...`);try{let n=d.emptyBucket(p).then(()=>d.deleteBucket(p)),m=new Promise((f,l)=>setTimeout(()=>l(Error("Bucket cleanup timeout")),30000));await Promise.race([n,m]),console.log(`Deleted orphaned S3 bucket ${p}`)}catch(n){console.log(`Note: Could not clean up S3 bucket: ${n.message}`);let m=Date.now().toString(36);S=`${p}-${m}`,console.log(`Using alternative bucket name: ${S}`)}}}catch{}}let N=ji({bucketName:S,domain:e,certificateArn:x,hostedZoneId:w,defaultRootObject:t.defaultRootObject,errorDocument:t.errorDocument}),j=Object.entries(t.tags||{}).map(([d,k])=>({Key:d,Value:k}));j.push({Key:"ManagedBy",Value:"ts-cloud"}),j.push({Key:"Application",Value:t.siteName});let v,O=!1;if(E){O=!0,console.log(`Updating CloudFormation stack: ${i}`),console.log(`Using existing bucket: ${S}`),console.log(`Domain: ${e||"not specified"}`),console.log(`Certificate ARN: ${x||"not specified"}`);try{v=(await r.updateStack({stackName:i,templateBody:JSON.stringify(N),capabilities:["CAPABILITY_IAM"],tags:j})).StackId,console.log(`Update initiated, stack ID: ${v}`)}catch(d){if(d.message?.includes("No updates are to be performed")){let k=await r.describeStacks({stackName:i});v=k.Stacks[0].StackId;let b=k.Stacks[0]?.Outputs||[],o=(n)=>b.find((m)=>m.OutputKey===n)?.OutputValue;return{success:!0,stackId:v,stackName:i,bucket:o("BucketName")||S,distributionId:o("DistributionId"),distributionDomain:o("DistributionDomain"),domain:e,certificateArn:x,message:"Static site infrastructure is already up to date"}}else throw d}}else console.log(`Creating CloudFormation stack: ${i}`),console.log(`Bucket name: ${S}`),console.log(`Domain: ${e||"not specified"}`),console.log(`Certificate ARN: ${x||"not specified"}`),console.log("Stack does not exist, creating..."),v=(await r.createStack({stackName:i,templateBody:JSON.stringify(N),capabilities:["CAPABILITY_IAM"],tags:j,onFailure:"DELETE"})).StackId,console.log(`Create initiated, stack ID: ${v}`);console.log(`Waiting for stack to reach ${O?"stack-update-complete":"stack-create-complete"}...`);try{await r.waitForStack(i,O?"stack-update-complete":"stack-create-complete"),console.log("Stack operation completed successfully!")}catch(d){if(d.message?.includes("must be verified")||d.message?.includes("Access denied for operation")||d.message?.includes("failed")){console.log("CloudFormation deployment failed, trying direct API creation...");let k=new A;if(e)try{let b=await k.listDistributions();for(let o of b){let n=[];if(o.Aliases?.Items){if(Array.isArray(o.Aliases.Items))n=o.Aliases.Items;else if(typeof o.Aliases.Items==="object"){let m=o.Aliases.Items.CNAME;if(typeof m==="string")n=[m];else if(Array.isArray(m))n=m}}if(n.includes(e)){console.log(`Found existing CloudFront distribution ${o.Id} with alias ${e}`);let f=(await k.getDistributionConfig(o.Id)).DistributionConfig?.Origins?.Items,l;if(f){let D=[];if(Array.isArray(f))D=f;else if(f.Origin)D=Array.isArray(f.Origin)?f.Origin:[f.Origin];else D=[f];for(let F of D){let V=(F.DomainName||"").match(/^([^.]+)\.s3[\.-]/);if(V){l=V[1];break}}}if(l)return console.log(`Using existing S3 bucket: ${l}`),{success:!0,stackName:`existing-${o.Id}`,bucket:l,distributionId:o.Id,distributionDomain:o.DomainName,domain:e,certificateArn:x,message:"Using existing CloudFront distribution (account verification pending for new distributions)"}}}}catch{}console.log("No existing infrastructure found, creating via direct API calls...");try{let b=new a(s);if((await b.headBucket(S)).exists)console.log(`Using existing S3 bucket: ${S}`);else console.log(`Creating S3 bucket: ${S}...`),await b.createBucket(S);await b.putBucketWebsite(S,{IndexDocument:t.defaultRootObject||"index.html",ErrorDocument:t.errorDocument||"404.html"}),await b.putPublicAccessBlock(S,{BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!1,RestrictPublicBuckets:!1}),console.log(`S3 bucket ${S} configured`);let n=`OAC-${S}`;console.log(`Creating Origin Access Control: ${n}...`);let m=await k.findOrCreateOriginAccessControl(n);console.log(`Origin Access Control ${m.Id} ready`),console.log("Creating CloudFront distribution...");let f=await k.createDistributionForS3({bucketName:S,bucketRegion:s,originAccessControlId:m.Id,aliases:e?[e]:[],certificateArn:x,defaultRootObject:t.defaultRootObject||"index.html",comment:`Distribution for ${e||S}`});console.log(`CloudFront distribution ${f.Id} created`),console.log("Updating S3 bucket policy...");let l=A.getS3BucketPolicyForCloudFront(S,f.ARN);if(await b.putBucketPolicy(S,l),console.log("S3 bucket policy updated"),e&&w){console.log(`Creating Route53 records for ${e}...`);try{await c.createAliasRecord({HostedZoneId:w,Name:e,Type:"A",TargetHostedZoneId:y.CloudFrontHostedZoneId,TargetDNSName:f.DomainName,EvaluateTargetHealth:!1}),await c.createAliasRecord({HostedZoneId:w,Name:e,Type:"AAAA",TargetHostedZoneId:y.CloudFrontHostedZoneId,TargetDNSName:f.DomainName,EvaluateTargetHealth:!1}),console.log(`Route53 records created for ${e}`)}catch(D){console.log(`Note: Could not create Route53 records: ${D.message}`)}}return{success:!0,stackName:`direct-${f.Id}`,bucket:S,distributionId:f.Id,distributionDomain:f.DomainName,domain:e,certificateArn:x,message:"Static site infrastructure created via direct API calls"}}catch(b){return console.log(`Direct API creation failed: ${b.message}`),{success:!1,stackId:v,stackName:i,bucket:S,message:`Deployment failed: ${b.message}`}}}return{success:!1,stackId:v,stackName:i,bucket:S,message:`Stack deployment failed: ${d.message}`}}let I=(await r.describeStacks({stackName:i})).Stacks[0]?.Outputs||[],R=(d)=>I.find((k)=>k.OutputKey===d)?.OutputValue;return{success:!0,stackId:v,stackName:i,bucket:R("BucketName")||S,distributionId:R("DistributionId"),distributionDomain:R("DistributionDomain"),domain:e,certificateArn:x,message:"Static site infrastructure deployed successfully"}}async function Ki(t){let{sourceDir:s,bucket:u,region:e,cacheControl:p="max-age=31536000, public",onProgress:i}=t,r=new a(e),{readdir:c}=await import("node:fs/promises"),{join:g,relative:C}=await import("node:path"),{createHash:w}=await import("node:crypto");async function x(I){let R=[],d=await c(I,{withFileTypes:!0});for(let k of d){let b=g(I,k.name);if(k.isDirectory())R.push(...await x(b));else R.push(b)}return R}function E(I){let R=I.split(".").pop()?.toLowerCase();return{html:"text/html; charset=utf-8",css:"text/css; charset=utf-8",js:"application/javascript; charset=utf-8",json:"application/json; charset=utf-8",png:"image/png",jpg:"image/jpeg",jpeg:"image/jpeg",gif:"image/gif",svg:"image/svg+xml",ico:"image/x-icon",webp:"image/webp",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",xml:"application/xml",txt:"text/plain; charset=utf-8",sh:"text/plain; charset=utf-8",bash:"text/plain; charset=utf-8",ps1:"text/plain; charset=utf-8"}[R||""]||"application/octet-stream"}function M(I){return w("md5").update(I).digest("hex")}async function S(){let I=new Map,R;do{let d=await r.listObjects({bucket:u,maxKeys:1000,continuationToken:R});for(let k of d.objects){let b=k.ETag?.replace(/"/g,"")||"";I.set(k.Key,b)}R=d.nextContinuationToken}while(R);return I}let N=await x(s),j=[],v=0,O=0,B=await S();for(let I of N){let R=C(s,I),d=E(I),k=I.endsWith(".html")?"max-age=3600, public":p;try{let b=Buffer.from(await Bun.file(I).arrayBuffer()),o=M(b),n=B.get(R);if(n&&n===o){O++,i?.(v+O,N.length,R);continue}await r.putObject({bucket:u,key:R,body:b,contentType:d,cacheControl:k}),v++,i?.(v+O,N.length,R)}catch(b){j.push(`Failed to upload ${R}: ${b.message}`)}}return{uploaded:v,skipped:O,errors:j}}async function Wi(t){return{invalidationId:(await new A().invalidateAll(t)).Id}}async function va(t,s="us-east-1"){let u=new h(s);try{let r=((await u.describeStacks({stackName:t})).Stacks[0]?.Outputs||[]).find((c)=>c.OutputKey==="BucketName")?.OutputValue;if(r)await new a(s).emptyBucket(r)}catch{}await u.deleteStack(t);let e=await u.waitForStackComplete(t,60,1e4);return{success:e.success||e.status==="DELETE_COMPLETE",message:e.success?"Static site deleted successfully":`Deletion failed: ${e.status}`}}async function Ta(t){let{sourceDir:s,cleanBucket:u=!1,onProgress:e,...p}=t;e?.("infrastructure","Deploying CloudFormation stack...");let i=await zi(p);if(!i.success)return i;if(u){e?.("clean","Cleaning old files from S3...");try{await new a(p.region||"us-east-1").emptyBucket(i.bucket)}catch(g){console.log(`Note: Could not clean bucket: ${g.message}`)}}e?.("upload","Uploading files to S3...");let r=await Ki({sourceDir:s,bucket:i.bucket,region:p.region||"us-east-1",cacheControl:p.cacheControl,onProgress:(g,C,w)=>{e?.("upload",`${g}/${C}: ${w}`)}});if(r.errors.length>0)return{...i,success:!1,message:`Upload errors: ${r.errors.join(", ")}`,filesUploaded:r.uploaded};if(i.distributionId&&r.uploaded>0)e?.("invalidate","Invalidating CloudFront cache..."),await Wi(i.distributionId);e?.("complete","Deployment complete!");let c=r.skipped>0?`Deployed ${r.uploaded} files (${r.skipped} unchanged)`:`Deployed ${r.uploaded} files successfully`;return{...i,filesUploaded:r.uploaded,filesSkipped:r.skipped,message:c}}
-export{Ea,nn,sn,ji,zi,Ki,Wi,va,Ta};
+}`}};let C={Enabled:!0,DefaultRootObject:i,HttpVersion:"http2and3",IPV6Enabled:!0,PriceClass:"PriceClass_100",Origins:[{Id:`S3-${s}`,DomainName:{"Fn::GetAtt":["S3Bucket","RegionalDomainName"]},S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{"Fn::GetAtt":["CloudFrontOAC","Id"]}}],DefaultCacheBehavior:{TargetOriginId:`S3-${s}`,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6",FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":["UrlRewriteFunction","FunctionARN"]}}]},CustomErrorResponses:[{ErrorCode:403,ResponseCode:200,ResponsePagePath:`/${i}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:404,ResponsePagePath:`/${r}`,ErrorCachingMinTTL:300}]};if(u&&e)C.Aliases=[u],C.ViewerCertificate={AcmCertificateArn:e,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"};else C.ViewerCertificate={CloudFrontDefaultCertificate:!0};if(c.CloudFrontDistribution={Type:"AWS::CloudFront::Distribution",DependsOn:["S3Bucket","CloudFrontOAC","UrlRewriteFunction"],Properties:{DistributionConfig:C}},g.DistributionId={Description:"CloudFront Distribution ID",Value:{Ref:"CloudFrontDistribution"}},g.DistributionDomain={Description:"CloudFront Distribution Domain",Value:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]}},c.S3BucketPolicy={Type:"AWS::S3::BucketPolicy",DependsOn:["S3Bucket","CloudFrontDistribution"],Properties:{Bucket:{Ref:"S3Bucket"},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":"arn:aws:s3:::${S3Bucket}/*"},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":"arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}"}}}}]}}},u&&p)c.DNSRecord={Type:"AWS::Route53::RecordSet",DependsOn:"CloudFrontDistribution",Properties:{HostedZoneId:p,Name:u,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}},c.DNSRecordIPv6={Type:"AWS::Route53::RecordSet",DependsOn:"CloudFrontDistribution",Properties:{HostedZoneId:p,Name:u,Type:"AAAA",AliasTarget:{DNSName:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}},g.SiteUrl={Description:"Site URL",Value:{"Fn::Sub":"https://${DNSRecord}"}};return{AWSTemplateFormatVersion:"2010-09-09",Description:`Static site infrastructure for ${u||s}`,Resources:c,Outputs:g}}async function Wi(t){if(t.dnsProvider&&t.dnsProvider.provider!=="route53"){let d=t.domain||(t.subdomain&&t.baseDomain?`${t.subdomain}.${t.baseDomain}`:void 0);if(!d)return{success:!1,stackName:t.stackName||`${t.siteName}-static-site`,bucket:t.bucket||`${t.siteName}-${Date.now()}`,message:"Domain is required when using external DNS provider"};return sn({siteName:t.siteName,region:t.region,domain:d,bucket:t.bucket,certificateArn:t.certificateArn,stackName:t.stackName,defaultRootObject:t.defaultRootObject,errorDocument:t.errorDocument,cacheControl:t.cacheControl,tags:t.tags,dnsProvider:t.dnsProvider})}let s=t.region||"us-east-1",u="us-east-1",e;if(t.domain)e=t.domain;else if(t.subdomain&&t.baseDomain)e=`${t.subdomain}.${t.baseDomain}`;let p=t.bucket||(e?e.replace(/\./g,"-"):`${t.siteName}-${Date.now()}`),i=t.stackName||`${t.siteName}-static-site`,r=new h(u),c=new y,g=new ae("us-east-1"),C=new or("us-east-1"),{hostedZoneId:w,certificateArn:x}=t;if(e&&!w){let d=await c.findHostedZoneForDomain(e);if(d)w=d.Id.replace("/hostedzone/","");else return{success:!1,stackName:i,bucket:p,message:`No Route53 hosted zone found for ${t.baseDomain||e}. Please create one first.`}}if(e&&!x&&w){let d=await g.findCertificateByDomain(e);if(d&&d.Status==="ISSUED")x=d.CertificateArn;else x=(await C.requestAndValidate({domainName:e,hostedZoneId:w,waitForValidation:!0,maxWaitMinutes:10})).certificateArn}let E=!1,M;try{let d=await r.describeStacks({stackName:i});if(d.Stacks.length>0){let k=d.Stacks[0],b=k.StackStatus;if(b==="DELETE_IN_PROGRESS")console.log("Previous stack is still being deleted, waiting..."),await r.waitForStack(i,"stack-delete-complete"),E=!1;else if(b==="DELETE_COMPLETE")E=!1;else E=!0,M=(k.Outputs||[]).find((n)=>n.OutputKey==="BucketName")?.OutputValue}}catch(d){if(d.message?.includes("does not exist")||d.code==="ValidationError")E=!1;else throw d}let S=M||p;if(!E){let d=new a(s),k=new A,b=!1;if(e){try{console.log(`Checking for existing CloudFront distribution for ${e}...`);let o=await k.listDistributions();for(let n of o){let m=[];if(n.Aliases?.Items){if(Array.isArray(n.Aliases.Items))m=n.Aliases.Items;else if(typeof n.Aliases.Items==="object"){let f=n.Aliases.Items.CNAME;if(typeof f==="string")m=[f];else if(Array.isArray(f))m=f}}if(m.includes(e)){b=!0,console.log(`Found existing CloudFront distribution ${n.Id} for ${e}`);let l=(await k.getDistributionConfig(n.Id)).DistributionConfig?.Origins?.Items,D;if(l){let F=[];if(Array.isArray(l))F=l;else if(l.Origin)F=Array.isArray(l.Origin)?l.Origin:[l.Origin];else F=[l];for(let P of F){let U=(P.DomainName||"").match(/^([^.]+)\.s3[\.-]/);if(U){D=U[1];break}}}if(D){let F=e.replace(/\./g,"-");if(!D.startsWith(F)&&!D.includes(t.siteName)){console.log(`Warning: Found distribution with mismatched bucket ${D}, skipping...`);continue}if(console.log(`Using existing S3 bucket: ${D}`),w&&n.DomainName)try{console.log(`Ensuring Route53 records exist for ${e}...`),await c.createAliasRecord({HostedZoneId:w,Name:e,Type:"A",TargetHostedZoneId:y.CloudFrontHostedZoneId,TargetDNSName:n.DomainName,EvaluateTargetHealth:!1}),await c.createAliasRecord({HostedZoneId:w,Name:e,Type:"AAAA",TargetHostedZoneId:y.CloudFrontHostedZoneId,TargetDNSName:n.DomainName,EvaluateTargetHealth:!1}),console.log(`Route53 records ensured for ${e}`)}catch(P){console.log(`Note: Could not update Route53 records: ${P.message}`)}return{success:!0,stackName:`existing-${n.Id}`,bucket:D,distributionId:n.Id,distributionDomain:n.DomainName,domain:e,certificateArn:x,message:"Using existing CloudFront distribution"}}}}}catch{}if(w)try{let n=(await c.listResourceRecordSets({HostedZoneId:w})).ResourceRecordSets||[];for(let m of n)if(m.Name===`${e}.`&&(m.Type==="A"||m.Type==="AAAA")){if(m.AliasTarget){console.log(`Found orphaned Route53 ${m.Type} record for ${e}, cleaning up...`);try{await c.deleteRecord({HostedZoneId:w,RecordSet:m}),console.log(`Deleted orphaned Route53 ${m.Type} record for ${e}`)}catch(f){console.log(`Note: Could not delete Route53 record: ${f.message}`)}}}}catch{}}if(!b)try{if((await d.headBucket(p)).exists){console.log(`Found orphaned S3 bucket ${p}, cleaning up...`);try{let n=d.emptyBucket(p).then(()=>d.deleteBucket(p)),m=new Promise((f,l)=>setTimeout(()=>l(Error("Bucket cleanup timeout")),30000));await Promise.race([n,m]),console.log(`Deleted orphaned S3 bucket ${p}`)}catch(n){console.log(`Note: Could not clean up S3 bucket: ${n.message}`);let m=Date.now().toString(36);S=`${p}-${m}`,console.log(`Using alternative bucket name: ${S}`)}}}catch{}}let N=Ki({bucketName:S,domain:e,certificateArn:x,hostedZoneId:w,defaultRootObject:t.defaultRootObject,errorDocument:t.errorDocument}),j=Object.entries(t.tags||{}).map(([d,k])=>({Key:d,Value:k}));j.push({Key:"ManagedBy",Value:"ts-cloud"}),j.push({Key:"Application",Value:t.siteName});let v,O=!1;if(E){O=!0,console.log(`Updating CloudFormation stack: ${i}`),console.log(`Using existing bucket: ${S}`),console.log(`Domain: ${e||"not specified"}`),console.log(`Certificate ARN: ${x||"not specified"}`);try{v=(await r.updateStack({stackName:i,templateBody:JSON.stringify(N),capabilities:["CAPABILITY_IAM"],tags:j})).StackId,console.log(`Update initiated, stack ID: ${v}`)}catch(d){if(d.message?.includes("No updates are to be performed")){let k=await r.describeStacks({stackName:i});v=k.Stacks[0].StackId;let b=k.Stacks[0]?.Outputs||[],o=(n)=>b.find((m)=>m.OutputKey===n)?.OutputValue;return{success:!0,stackId:v,stackName:i,bucket:o("BucketName")||S,distributionId:o("DistributionId"),distributionDomain:o("DistributionDomain"),domain:e,certificateArn:x,message:"Static site infrastructure is already up to date"}}else throw d}}else console.log(`Creating CloudFormation stack: ${i}`),console.log(`Bucket name: ${S}`),console.log(`Domain: ${e||"not specified"}`),console.log(`Certificate ARN: ${x||"not specified"}`),console.log("Stack does not exist, creating..."),v=(await r.createStack({stackName:i,templateBody:JSON.stringify(N),capabilities:["CAPABILITY_IAM"],tags:j,onFailure:"DELETE"})).StackId,console.log(`Create initiated, stack ID: ${v}`);console.log(`Waiting for stack to reach ${O?"stack-update-complete":"stack-create-complete"}...`);try{await r.waitForStack(i,O?"stack-update-complete":"stack-create-complete"),console.log("Stack operation completed successfully!")}catch(d){if(d.message?.includes("must be verified")||d.message?.includes("Access denied for operation")||d.message?.includes("failed")){console.log("CloudFormation deployment failed, trying direct API creation...");let k=new A;if(e)try{let b=await k.listDistributions();for(let o of b){let n=[];if(o.Aliases?.Items){if(Array.isArray(o.Aliases.Items))n=o.Aliases.Items;else if(typeof o.Aliases.Items==="object"){let m=o.Aliases.Items.CNAME;if(typeof m==="string")n=[m];else if(Array.isArray(m))n=m}}if(n.includes(e)){console.log(`Found existing CloudFront distribution ${o.Id} with alias ${e}`);let f=(await k.getDistributionConfig(o.Id)).DistributionConfig?.Origins?.Items,l;if(f){let D=[];if(Array.isArray(f))D=f;else if(f.Origin)D=Array.isArray(f.Origin)?f.Origin:[f.Origin];else D=[f];for(let F of D){let V=(F.DomainName||"").match(/^([^.]+)\.s3[\.-]/);if(V){l=V[1];break}}}if(l)return console.log(`Using existing S3 bucket: ${l}`),{success:!0,stackName:`existing-${o.Id}`,bucket:l,distributionId:o.Id,distributionDomain:o.DomainName,domain:e,certificateArn:x,message:"Using existing CloudFront distribution (account verification pending for new distributions)"}}}}catch{}console.log("No existing infrastructure found, creating via direct API calls...");try{let b=new a(s);if((await b.headBucket(S)).exists)console.log(`Using existing S3 bucket: ${S}`);else console.log(`Creating S3 bucket: ${S}...`),await b.createBucket(S);await b.putBucketWebsite(S,{IndexDocument:t.defaultRootObject||"index.html",ErrorDocument:t.errorDocument||"404.html"}),await b.putPublicAccessBlock(S,{BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!1,RestrictPublicBuckets:!1}),console.log(`S3 bucket ${S} configured`);let n=`OAC-${S}`;console.log(`Creating Origin Access Control: ${n}...`);let m=await k.findOrCreateOriginAccessControl(n);console.log(`Origin Access Control ${m.Id} ready`),console.log("Creating CloudFront distribution...");let f=await k.createDistributionForS3({bucketName:S,bucketRegion:s,originAccessControlId:m.Id,aliases:e?[e]:[],certificateArn:x,defaultRootObject:t.defaultRootObject||"index.html",comment:`Distribution for ${e||S}`});console.log(`CloudFront distribution ${f.Id} created`),console.log("Updating S3 bucket policy...");let l=A.getS3BucketPolicyForCloudFront(S,f.ARN);if(await b.putBucketPolicy(S,l),console.log("S3 bucket policy updated"),e&&w){console.log(`Creating Route53 records for ${e}...`);try{await c.createAliasRecord({HostedZoneId:w,Name:e,Type:"A",TargetHostedZoneId:y.CloudFrontHostedZoneId,TargetDNSName:f.DomainName,EvaluateTargetHealth:!1}),await c.createAliasRecord({HostedZoneId:w,Name:e,Type:"AAAA",TargetHostedZoneId:y.CloudFrontHostedZoneId,TargetDNSName:f.DomainName,EvaluateTargetHealth:!1}),console.log(`Route53 records created for ${e}`)}catch(D){console.log(`Note: Could not create Route53 records: ${D.message}`)}}return{success:!0,stackName:`direct-${f.Id}`,bucket:S,distributionId:f.Id,distributionDomain:f.DomainName,domain:e,certificateArn:x,message:"Static site infrastructure created via direct API calls"}}catch(b){return console.log(`Direct API creation failed: ${b.message}`),{success:!1,stackId:v,stackName:i,bucket:S,message:`Deployment failed: ${b.message}`}}}return{success:!1,stackId:v,stackName:i,bucket:S,message:`Stack deployment failed: ${d.message}`}}let I=(await r.describeStacks({stackName:i})).Stacks[0]?.Outputs||[],R=(d)=>I.find((k)=>k.OutputKey===d)?.OutputValue;return{success:!0,stackId:v,stackName:i,bucket:R("BucketName")||S,distributionId:R("DistributionId"),distributionDomain:R("DistributionDomain"),domain:e,certificateArn:x,message:"Static site infrastructure deployed successfully"}}async function Ji(t){let{sourceDir:s,bucket:u,region:e,cacheControl:p="max-age=31536000, public",onProgress:i}=t,r=new a(e),{readdir:c}=await import("node:fs/promises"),{join:g,relative:C}=await import("node:path"),{createHash:w}=await import("node:crypto");async function x(I){let R=[],d=await c(I,{withFileTypes:!0});for(let k of d){let b=g(I,k.name);if(k.isDirectory())R.push(...await x(b));else R.push(b)}return R}function E(I){let R=I.split(".").pop()?.toLowerCase();return{html:"text/html; charset=utf-8",css:"text/css; charset=utf-8",js:"application/javascript; charset=utf-8",json:"application/json; charset=utf-8",png:"image/png",jpg:"image/jpeg",jpeg:"image/jpeg",gif:"image/gif",svg:"image/svg+xml",ico:"image/x-icon",webp:"image/webp",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",xml:"application/xml",txt:"text/plain; charset=utf-8",sh:"text/plain; charset=utf-8",bash:"text/plain; charset=utf-8",ps1:"text/plain; charset=utf-8"}[R||""]||"application/octet-stream"}function M(I){return w("md5").update(I).digest("hex")}async function S(){let I=new Map,R;do{let d=await r.listObjects({bucket:u,maxKeys:1000,continuationToken:R});for(let k of d.objects){let b=k.ETag?.replace(/"/g,"")||"";I.set(k.Key,b)}R=d.nextContinuationToken}while(R);return I}let N=await x(s),j=[],v=0,O=0,B=await S();for(let I of N){let R=C(s,I),d=E(I),k=I.endsWith(".html")?"max-age=3600, public":p;try{let b=Buffer.from(await Bun.file(I).arrayBuffer()),o=M(b),n=B.get(R);if(n&&n===o){O++,i?.(v+O,N.length,R);continue}await r.putObject({bucket:u,key:R,body:b,contentType:d,cacheControl:k}),v++,i?.(v+O,N.length,R)}catch(b){j.push(`Failed to upload ${R}: ${b.message}`)}}return{uploaded:v,skipped:O,errors:j}}async function Xi(t){return{invalidationId:(await new A().invalidateAll(t)).Id}}async function wa(t,s="us-east-1"){let u=new h(s);try{let r=((await u.describeStacks({stackName:t})).Stacks[0]?.Outputs||[]).find((c)=>c.OutputKey==="BucketName")?.OutputValue;if(r)await new a(s).emptyBucket(r)}catch{}await u.deleteStack(t);let e=await u.waitForStackComplete(t,60,1e4);return{success:e.success||e.status==="DELETE_COMPLETE",message:e.success?"Static site deleted successfully":`Deletion failed: ${e.status}`}}async function Ra(t){let{sourceDir:s,cleanBucket:u=!1,onProgress:e,...p}=t;e?.("infrastructure","Deploying CloudFormation stack...");let i=await Wi(p);if(!i.success)return i;if(u){e?.("clean","Cleaning old files from S3...");try{await new a(p.region||"us-east-1").emptyBucket(i.bucket)}catch(g){console.log(`Note: Could not clean bucket: ${g.message}`)}}e?.("upload","Uploading files to S3...");let r=await Ji({sourceDir:s,bucket:i.bucket,region:p.region||"us-east-1",cacheControl:p.cacheControl,onProgress:(g,C,w)=>{e?.("upload",`${g}/${C}: ${w}`)}});if(r.errors.length>0)return{...i,success:!1,message:`Upload errors: ${r.errors.join(", ")}`,filesUploaded:r.uploaded};if(i.distributionId&&r.uploaded>0)e?.("invalidate","Invalidating CloudFront cache..."),await Xi(i.distributionId);e?.("complete","Deployment complete!");let c=r.skipped>0?`Deployed ${r.uploaded} files (${r.skipped} unchanged)`:`Deployed ${r.uploaded} files successfully`;return{...i,filesUploaded:r.uploaded,filesSkipped:r.skipped,message:c}}
+export{Ta,sn,on,Ki,Wi,Ji,Xi,wa,Ra};

package/dist/{chunk-sw1p9qge.js → chunk-yxn6tpbg.js}

@@ -1,4 +1,4 @@
-import{n}from"./chunk-8a02v9gs.js";class A{client;constructor(e,i){this.client=i??new n(void 0,{profile:e})}collectionItems(e,i){let t=e?.Items??e?.[i];if(!t)return[];if(Array.isArray(t))return t;let r=t[i]??t.Item;if(r===void 0)return typeof t==="object"&&(t.Id||t.PathPattern)?[t]:[];return Array.isArray(r)?r:[r]}validateExistingOriginInput(e,i){if(!/^[A-Z0-9]{8,32}$/.test(e))throw Error("CloudFront distribution ID is invalid");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(i.id))throw Error("CloudFront origin ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/.test(i.domainName))throw Error("CloudFront origin must be a hostname without a scheme or path");let t=i.pathPattern.startsWith("/")?i.pathPattern:`/${i.pathPattern}`;if(t==="/"||t==="/*"||!/^\/[A-Za-z0-9_.*?~!$&'()+,;=:@%/-]{1,255}$/.test(t))throw Error("CloudFront path pattern must be a non-default absolute pattern");if(i.originPath&&(!i.originPath.startsWith("/")||i.originPath.includes("..")))throw Error("CloudFront origin path must be absolute and traversal-free");if(Object.entries(i.customHeaders??{}).some(([r,o])=>!/^[A-Za-z0-9-]{1,64}$/.test(r)||!o||o.length>1024))throw Error("CloudFront custom origin headers are invalid");return{...i,pathPattern:t}}async upsertExistingDistributionOrigin(e,i){let t=this.validateExistingOriginInput(e,i),r=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),o=r.headers?.etag||r.headers?.ETag||r.ETag||"",s=r.body?.DistributionConfig||r.DistributionConfig||r.body;if(!s||s.Enabled===void 0||!o)throw Error("Failed to read an ETag-protected CloudFront distribution config");let a=this.collectionItems(s.Origins,"Origin"),c=this.collectionItems(s.CacheBehaviors,"CacheBehavior"),g=a.find((y)=>String(y.Id)===t.id),u=c.find((y)=>String(y.PathPattern)===t.pathPattern);if(g&&String(g.DomainName)!==t.domainName&&!t.replaceExisting)throw Error(`Origin ${t.id} already targets ${g.DomainName}; pass replaceExisting only after reviewing the live config`);if(u&&String(u.TargetOriginId)!==t.id&&!t.replaceExisting)throw Error(`Path ${t.pathPattern} already targets ${u.TargetOriginId}; pass replaceExisting only after reviewing the live config`);let d={Id:t.id,DomainName:t.domainName,OriginPath:t.originPath??"",CustomHeaders:{Quantity:Object.keys(t.customHeaders??{}).length,...Object.keys(t.customHeaders??{}).length?{Items:{OriginCustomHeader:Object.entries(t.customHeaders).map(([y,E])=>({HeaderName:y,HeaderValue:E}))}}:{}},CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:t.protocolPolicy??"https-only",OriginSslProtocols:{Quantity:1,Items:{SslProtocol:["TLSv1.2"]}},OriginReadTimeout:30,OriginKeepaliveTimeout:5},ConnectionAttempts:3,ConnectionTimeout:10,...t.originAccessControlId?{OriginAccessControlId:t.originAccessControlId}:{}},h=["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],l={PathPattern:t.pathPattern,TargetOriginId:t.id,ViewerProtocolPolicy:"redirect-to-https",Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac",AllowedMethods:{Quantity:h.length,Items:{Method:h},CachedMethods:{Quantity:2,Items:{Method:["GET","HEAD"]}}},SmoothStreaming:!1,FieldLevelEncryptionId:"",TrustedSigners:{Enabled:!1,Quantity:0},TrustedKeyGroups:{Enabled:!1,Quantity:0},LambdaFunctionAssociations:{Quantity:0},FunctionAssociations:{Quantity:0}},f=g?a.map((y)=>String(y.Id)===t.id?d:y):[...a,d],m=u?c.map((y)=>String(y.PathPattern)===t.pathPattern?l:y):[...c,l],p=JSON.stringify(a)!==JSON.stringify(f)||JSON.stringify(c)!==JSON.stringify(m);if(!p||t.dryRun)return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:p,applied:!1,etag:o};s.Origins={Quantity:f.length,Items:{Origin:f}},s.CacheBehaviors={Quantity:m.length,...m.length?{Items:{CacheBehavior:m}}:{}};let b=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:this.buildDistributionConfigXml(s),headers:{"Content-Type":"application/xml","If-Match":o}});return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!0,applied:!0,etag:b.ETag||b.headers?.etag||""}}async removeExistingDistributionOrigin(e,i){let t=this.validateExistingOriginInput(e,i),r=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),o=r.headers?.etag||r.headers?.ETag||r.ETag||"",s=r.body?.DistributionConfig||r.DistributionConfig||r.body;if(!s||s.Enabled===void 0||!o)throw Error("Failed to read an ETag-protected CloudFront distribution config");let a=this.collectionItems(s.Origins,"Origin"),c=this.collectionItems(s.CacheBehaviors,"CacheBehavior"),g=a.find((m)=>String(m.Id)===t.id),u=c.find((m)=>String(m.PathPattern)===t.pathPattern);if(g&&String(g.DomainName)!==t.domainName)throw Error(`Origin ${t.id} no longer targets ${t.domainName}; refusing ambiguous removal`);if(u&&String(u.TargetOriginId)!==t.id)throw Error(`Path ${t.pathPattern} no longer targets ${t.id}; refusing ambiguous removal`);if(!u)return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!1,applied:!1,originRemoved:!1,etag:o};let d=c.filter((m)=>String(m.PathPattern)!==t.pathPattern),h=String(s.DefaultCacheBehavior?.TargetOriginId)===t.id||d.some((m)=>String(m.TargetOriginId)===t.id),l=h?a:a.filter((m)=>String(m.Id)!==t.id);if(t.dryRun)return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!0,applied:!1,originRemoved:!h&&!!g,etag:o};s.Origins={Quantity:l.length,Items:{Origin:l}},s.CacheBehaviors={Quantity:d.length,...d.length?{Items:{CacheBehavior:d}}:{}};let f=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:this.buildDistributionConfigXml(s),headers:{"Content-Type":"application/xml","If-Match":o}});return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!0,applied:!0,originRemoved:!h&&!!g,etag:f.ETag||f.headers?.etag||""}}async createInvalidation(e){let i=e.callerReference||Date.now().toString(),t=`<?xml version="1.0" encoding="UTF-8"?>
+import{n}from"./chunk-ss4q8kge.js";class A{client;constructor(e,i){this.client=i??new n(void 0,{profile:e})}collectionItems(e,i){let t=e?.Items??e?.[i];if(!t)return[];if(Array.isArray(t))return t;let r=t[i]??t.Item;if(r===void 0)return typeof t==="object"&&(t.Id||t.PathPattern)?[t]:[];return Array.isArray(r)?r:[r]}validateExistingOriginInput(e,i){if(!/^[A-Z0-9]{8,32}$/.test(e))throw Error("CloudFront distribution ID is invalid");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(i.id))throw Error("CloudFront origin ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/.test(i.domainName))throw Error("CloudFront origin must be a hostname without a scheme or path");let t=i.pathPattern.startsWith("/")?i.pathPattern:`/${i.pathPattern}`;if(t==="/"||t==="/*"||!/^\/[A-Za-z0-9_.*?~!$&'()+,;=:@%/-]{1,255}$/.test(t))throw Error("CloudFront path pattern must be a non-default absolute pattern");if(i.originPath&&(!i.originPath.startsWith("/")||i.originPath.includes("..")))throw Error("CloudFront origin path must be absolute and traversal-free");if(Object.entries(i.customHeaders??{}).some(([r,o])=>!/^[A-Za-z0-9-]{1,64}$/.test(r)||!o||o.length>1024))throw Error("CloudFront custom origin headers are invalid");return{...i,pathPattern:t}}async upsertExistingDistributionOrigin(e,i){let t=this.validateExistingOriginInput(e,i),r=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),o=r.headers?.etag||r.headers?.ETag||r.ETag||"",s=r.body?.DistributionConfig||r.DistributionConfig||r.body;if(!s||s.Enabled===void 0||!o)throw Error("Failed to read an ETag-protected CloudFront distribution config");let a=this.collectionItems(s.Origins,"Origin"),c=this.collectionItems(s.CacheBehaviors,"CacheBehavior"),g=a.find((y)=>String(y.Id)===t.id),u=c.find((y)=>String(y.PathPattern)===t.pathPattern);if(g&&String(g.DomainName)!==t.domainName&&!t.replaceExisting)throw Error(`Origin ${t.id} already targets ${g.DomainName}; pass replaceExisting only after reviewing the live config`);if(u&&String(u.TargetOriginId)!==t.id&&!t.replaceExisting)throw Error(`Path ${t.pathPattern} already targets ${u.TargetOriginId}; pass replaceExisting only after reviewing the live config`);let d={Id:t.id,DomainName:t.domainName,OriginPath:t.originPath??"",CustomHeaders:{Quantity:Object.keys(t.customHeaders??{}).length,...Object.keys(t.customHeaders??{}).length?{Items:{OriginCustomHeader:Object.entries(t.customHeaders).map(([y,E])=>({HeaderName:y,HeaderValue:E}))}}:{}},CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:t.protocolPolicy??"https-only",OriginSslProtocols:{Quantity:1,Items:{SslProtocol:["TLSv1.2"]}},OriginReadTimeout:30,OriginKeepaliveTimeout:5},ConnectionAttempts:3,ConnectionTimeout:10,...t.originAccessControlId?{OriginAccessControlId:t.originAccessControlId}:{}},h=["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],l={PathPattern:t.pathPattern,TargetOriginId:t.id,ViewerProtocolPolicy:"redirect-to-https",Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac",AllowedMethods:{Quantity:h.length,Items:{Method:h},CachedMethods:{Quantity:2,Items:{Method:["GET","HEAD"]}}},SmoothStreaming:!1,FieldLevelEncryptionId:"",TrustedSigners:{Enabled:!1,Quantity:0},TrustedKeyGroups:{Enabled:!1,Quantity:0},LambdaFunctionAssociations:{Quantity:0},FunctionAssociations:{Quantity:0}},f=g?a.map((y)=>String(y.Id)===t.id?d:y):[...a,d],m=u?c.map((y)=>String(y.PathPattern)===t.pathPattern?l:y):[...c,l],p=JSON.stringify(a)!==JSON.stringify(f)||JSON.stringify(c)!==JSON.stringify(m);if(!p||t.dryRun)return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:p,applied:!1,etag:o};s.Origins={Quantity:f.length,Items:{Origin:f}},s.CacheBehaviors={Quantity:m.length,...m.length?{Items:{CacheBehavior:m}}:{}};let b=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:this.buildDistributionConfigXml(s),headers:{"Content-Type":"application/xml","If-Match":o}});return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!0,applied:!0,etag:b.ETag||b.headers?.etag||""}}async removeExistingDistributionOrigin(e,i){let t=this.validateExistingOriginInput(e,i),r=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),o=r.headers?.etag||r.headers?.ETag||r.ETag||"",s=r.body?.DistributionConfig||r.DistributionConfig||r.body;if(!s||s.Enabled===void 0||!o)throw Error("Failed to read an ETag-protected CloudFront distribution config");let a=this.collectionItems(s.Origins,"Origin"),c=this.collectionItems(s.CacheBehaviors,"CacheBehavior"),g=a.find((m)=>String(m.Id)===t.id),u=c.find((m)=>String(m.PathPattern)===t.pathPattern);if(g&&String(g.DomainName)!==t.domainName)throw Error(`Origin ${t.id} no longer targets ${t.domainName}; refusing ambiguous removal`);if(u&&String(u.TargetOriginId)!==t.id)throw Error(`Path ${t.pathPattern} no longer targets ${t.id}; refusing ambiguous removal`);if(!u)return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!1,applied:!1,originRemoved:!1,etag:o};let d=c.filter((m)=>String(m.PathPattern)!==t.pathPattern),h=String(s.DefaultCacheBehavior?.TargetOriginId)===t.id||d.some((m)=>String(m.TargetOriginId)===t.id),l=h?a:a.filter((m)=>String(m.Id)!==t.id);if(t.dryRun)return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!0,applied:!1,originRemoved:!h&&!!g,etag:o};s.Origins={Quantity:l.length,Items:{Origin:l}},s.CacheBehaviors={Quantity:d.length,...d.length?{Items:{CacheBehavior:d}}:{}};let f=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:this.buildDistributionConfigXml(s),headers:{"Content-Type":"application/xml","If-Match":o}});return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!0,applied:!0,originRemoved:!h&&!!g,etag:f.ETag||f.headers?.etag||""}}async createInvalidation(e){let i=e.callerReference||Date.now().toString(),t=`<?xml version="1.0" encoding="UTF-8"?>
 <InvalidationBatch>
   <Paths>
     <Quantity>${e.paths.length}</Quantity>

package/dist/{chunk-3bz7xz2d.js → chunk-z87dekhm.js}

@@ -1,4 +1,4 @@
-import{yr,n}from"./chunk-8a02v9gs.js";import{Me}from"./chunk-80vxhxt5.js";import*as l from"node:crypto";import{readFileSync as D}from"node:fs";import{readdir as U}from"node:fs/promises";import{join as L}from"node:path";function kt(e){if(e){let i=R(e);if(!i)throw Error(`AWS profile '${e}' not found in ~/.aws/credentials`);return i}let t=process.env.AWS_ACCESS_KEY_ID,s=process.env.AWS_SECRET_ACCESS_KEY;if(t&&s)return{accessKeyId:t,secretAccessKey:s,sessionToken:process.env.AWS_SESSION_TOKEN};return R(process.env.AWS_PROFILE||"default")??{accessKeyId:"",secretAccessKey:""}}function R(e){let{existsSync:t,readFileSync:s}=Me("node:fs"),{homedir:i}=Me("node:os"),{join:r}=Me("node:path"),o=process.env.AWS_SHARED_CREDENTIALS_FILE||r(i(),".aws","credentials");if(!t(o))return null;let c=s(o,"utf-8"),g=null,d,u,y;for(let h of c.split(`
+import{yr,n}from"./chunk-ss4q8kge.js";import{Me}from"./chunk-4twnkjyq.js";import*as l from"node:crypto";import{readFileSync as D}from"node:fs";import{readdir as U}from"node:fs/promises";import{join as L}from"node:path";function kt(e){if(e){let i=R(e);if(!i)throw Error(`AWS profile '${e}' not found in ~/.aws/credentials`);return i}let t=process.env.AWS_ACCESS_KEY_ID,s=process.env.AWS_SECRET_ACCESS_KEY;if(t&&s)return{accessKeyId:t,secretAccessKey:s,sessionToken:process.env.AWS_SESSION_TOKEN};return R(process.env.AWS_PROFILE||"default")??{accessKeyId:"",secretAccessKey:""}}function R(e){let{existsSync:t,readFileSync:s}=Me("node:fs"),{homedir:i}=Me("node:os"),{join:r}=Me("node:path"),o=process.env.AWS_SHARED_CREDENTIALS_FILE||r(i(),".aws","credentials");if(!t(o))return null;let c=s(o,"utf-8"),g=null,d,u,y;for(let h of c.split(`
 `)){let m=h.trim();if(!m||m.startsWith("#")||m.startsWith(";"))continue;let p=m.match(/^\[([^\]]+)\]$/);if(p){if(g===e&&d&&u)return{accessKeyId:d,secretAccessKey:u,sessionToken:y};g=p[1],d=void 0,u=void 0,y=void 0;continue}if(g===e){let[b,...S]=m.split("="),f=S.join("=").trim();switch(b.trim().toLowerCase()){case"aws_access_key_id":d=f;break;case"aws_secret_access_key":u=f;break;case"aws_session_token":y=f;break}}}if(g===e&&d&&u)return{accessKeyId:d,secretAccessKey:u,sessionToken:y};return null}function B(e){let{buffer:t,byteOffset:s,byteLength:i}=e;if(t instanceof ArrayBuffer)return t.slice(s,s+i);let r=new ArrayBuffer(i);return new Uint8Array(r).set(new Uint8Array(e)),r}class a{client;region;explicitProfile;endpoint;endpointProtocol="https";forcePathStyle;explicitCredentials;constructor(e="us-east-1",t,s){let i=typeof e==="string"?s:e,r=typeof e==="string"?e:e.region??"us-east-1",o=typeof e==="string"?t:e.profile,c=i?.endpoint?yr({region:r,path:"/",endpoint:i.endpoint}):void 0;this.region=r,this.explicitProfile=o,this.endpoint=c?.host,this.endpointProtocol=c?.protocol??"https",this.forcePathStyle=i?.forcePathStyle,this.explicitCredentials=i?.credentials,this.client=new n(i?.credentials,{profile:o,endpoint:i?.endpoint,forcePathStyle:i?.forcePathStyle})}getCredentials(){if(this.explicitCredentials?.accessKeyId&&this.explicitCredentials.secretAccessKey)return this.explicitCredentials;let e=kt(this.explicitProfile);if(e.accessKeyId&&e.secretAccessKey)return e;throw Error("S3 credentials not found. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (or pass explicit credentials/profile), or configure ~/.aws/credentials.")}s3BaseHost(){return this.endpoint||`s3.${this.region}.amazonaws.com`}s3VirtualHost(e){return this.forcePathStyle?this.s3BaseHost():`${e}.${this.s3BaseHost()}`}objectPath(e,t){return this.forcePathStyle?`/${e}/${t}`:`/${t}`}objectUrl(e,t){return`${this.endpointProtocol}://${this.s3VirtualHost(e)}${this.objectPath(e,t)}`}async listBuckets(){let e=await this.client.request({service:"s3",region:this.region,method:"GET",path:"/"}),t=[],i=(e?.ListAllMyBucketsResult??e)?.Buckets?.Bucket;if(i){let r=Array.isArray(i)?i:[i];for(let o of r)t.push({Name:o.Name,CreationDate:o.CreationDate})}return{Buckets:t}}async createBucket(e,t){let s={};if(t?.acl)s["x-amz-acl"]=t.acl;let i;if(this.region!=="us-east-1"&&!this.endpoint)i=`<?xml version="1.0" encoding="UTF-8"?>
 <CreateBucketConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
   <LocationConstraint>${this.region}</LocationConstraint>

package/dist/deploy/index.js

@@ -1 +1 @@
-import{Jr,Xr,kl,Fi,Bl,xl,_l,oa,Ol,Ll,Dm,$l,S,Ml,Ui,Pe,Fl,Ul,_A,Ql,Pm,OA,LA,$A,Nm,km,MA,FA,Bm,xm,UA,Qi,Wt,aa,Yr,Zr,Jt,Je,It,Hi,_m,en,Hl,Gl,ca,qi,rn,Vi,ba}from"../chunk-ffjc6gev.js";import{Ea,nn,sn,ji,zi,Ki,Wi,va,Ta}from"../chunk-nw5yqgtn.js";import{wa}from"../chunk-tgzp1h6j.js";import"../chunk-55cmjg49.js";import"../chunk-g8tp1zj4.js";import"../chunk-sw1p9qge.js";import"../chunk-dns94gs7.js";import"../chunk-dxcwfj3h.js";import"../chunk-s40cx3fh.js";import"../chunk-21b8nage.js";import{ou,Ha,Ae,Ga,In,au,qa,gc,Cs,mc,Nt,Kn,bs}from"../chunk-bpvpq6w6.js";import"../chunk-aesvajfc.js";import"../chunk-22ybphxa.js";import"../chunk-3bz7xz2d.js";import"../chunk-8a02v9gs.js";import{ot,Mh,Sc,Zn,ei,ti,sp}from"../chunk-kt6qnc6f.js";import{B,Ir,Sr,Cc,Ts,u,Fh,op,ap,Ay,yy}from"../chunk-0hf0rdze.js";import"../chunk-7pk6cctr.js";import"../chunk-d72ddm5x.js";export{Mh as DEFAULT_SITE_PORT_RANGE,ot as HOST_SITES_DIR,Ga as IPV6_EXCLUDED_HOST_LABELS,gc as MANAGEMENT_DASHBOARD_SITE,Jr as addSiteToCloudConfig,sp as allocateSitePorts,UA as buildAndPushContainerImage,wa as buildAndPushServerlessImage,Wt as buildFunctionEnv,ei as buildHostSitePortsScript,bs as buildManagementDashboardArtifact,It as buildServerTopology,Hi as buildServerlessTopology,_m as buildTopology,ca as collectEgressMetrics,ou as collectServerDnsDomains,xm as createContainerImageDependencies,Nm as createExistingStaticFullStackDependencies,Pm as createStaticApiOriginDependencies,rn as dashboardActions,Cs as dashboardCredentialsFile,Fl as dashboardPageRoutes,va as deleteStaticSite,MA as deployExistingStaticFullStack,aa as deployServerlessApp,yy as deployShipsFiles,Ql as deploySite,OA as deployStaticApiOrigin,zi as deployStaticSite,Ta as deployStaticSiteFull,nn as deployStaticSiteWithExternalDns,sn as deployStaticSiteWithExternalDnsFull,Hl as egressReportMetrics,S as ensureDashboardActor,Kn as ensureManagementDashboard,FA as estimateExistingStaticFullStackMonthlyCost,$A as estimateStaticApiOriginMonthlyCost,Gl as fetchEgressReport,km as generateExistingStaticFullStackTemplate,Ea as generateExternalDnsStaticSiteTemplate,ji as generateStaticSiteTemplate,Fh as hasComputeConfigured,Cc as hasProxyUpstream,Bm as hashContainerContext,In as hostAcceptsIpv6,Qi as infraEnvFromOutputs,Ml as initializeDashboardControlPlane,Wi as invalidateCache,Ir as isPhpSite,oa as isValidHostname,Ae as normalizePublicIpv6,Zn as occupiedHostPorts,ti as parseHostSiteFragments,Sc as parseUpstreamPort,au as reconcileAddressRecords,Yr as redeployServerlessApp,Xr as removeSiteFromCloudConfig,Ha as removeStaleServerAddressRecords,Ol as renderAliasesValue,_l as renderEnvValue,Ll as renderRedirectsValue,Dm as renderSiteSnippet,Bl as renderSslValue,xl as renderStringValue,Vi as resolveDashboardAction,mc as resolveDashboardAuth,en as resolveDashboardData,Ul as resolveLegacyDashboardRoute,Sr as resolveProxyUpstreams,Ts as resolveSiteDeployTarget,u as resolveSiteKind,Nt as resolveUiSource,Zr as rollbackServerlessApp,_A as routesForDashboard,Je as runRemoteCommand,qi as sanitizeCloudConfig,$l as setAttachToInCloudConfig,Jt as setMaintenance,Fi as setSitePropertyInCloudConfig,ap as shipsARelease,Ay as shipsToBucket,B as siteInstallBase,ba as startLocalDashboardServer,Ui as synchronizeDashboardUsers,Pe as trackDashboardOperation,kl as updateSiteInCloudConfig,Ki as uploadStaticFiles,op as validateDeploymentConfig,qa as verifyAddressRecord,LA as verifyStaticApiOrigin};
+import{Xr,Yr,Ol,Qi,Ll,$l,Ml,ca,Fl,Ul,Mm,Ql,S,Hl,Hi,Pe,Gl,ql,HA,Vl,Fm,GA,qA,VA,Um,Qm,jA,zA,Hm,Gm,KA,Gi,Wt,da,Zr,en,Jt,Je,It,qi,qm,tn,jl,zl,la,ji,nn,zi,va}from"../chunk-wdrqt329.js";import{Ta,sn,on,Ki,Wi,Ji,Xi,wa,Ra}from"../chunk-whwg2nzb.js";import{Da}from"../chunk-0bbrbzf9.js";import"../chunk-a6aw2jtz.js";import"../chunk-a21phhyj.js";import"../chunk-yxn6tpbg.js";import"../chunk-4xta1s4z.js";import"../chunk-6eq5xfcx.js";import"../chunk-v9t92ak2.js";import"../chunk-emx1j2yt.js";import{lu,qa,ye,Va,Sn,uu,ja,hc,bs,fc,Nt,Wn,vs}from"../chunk-acpxtkfy.js";import"../chunk-fz70vxrk.js";import"../chunk-g0yyw5k8.js";import"../chunk-z87dekhm.js";import"../chunk-ss4q8kge.js";import{ot,Vh,Ec,ei,ti,ri,pp}from"../chunk-rgw06xbk.js";import{B,Ir,Sr,bc,Rs,u,jh,gp,mp,Ty,wy}from"../chunk-gstz8w2d.js";import"../chunk-rmn71xjb.js";import"../chunk-jncbm332.js";export{Vh as DEFAULT_SITE_PORT_RANGE,ot as HOST_SITES_DIR,Va as IPV6_EXCLUDED_HOST_LABELS,hc as MANAGEMENT_DASHBOARD_SITE,Xr as addSiteToCloudConfig,pp as allocateSitePorts,KA as buildAndPushContainerImage,Da as buildAndPushServerlessImage,Wt as buildFunctionEnv,ti as buildHostSitePortsScript,vs as buildManagementDashboardArtifact,It as buildServerTopology,qi as buildServerlessTopology,qm as buildTopology,la as collectEgressMetrics,lu as collectServerDnsDomains,Gm as createContainerImageDependencies,Um as createExistingStaticFullStackDependencies,Fm as createStaticApiOriginDependencies,nn as dashboardActions,bs as dashboardCredentialsFile,Gl as dashboardPageRoutes,wa as deleteStaticSite,jA as deployExistingStaticFullStack,da as deployServerlessApp,wy as deployShipsFiles,Vl as deploySite,GA as deployStaticApiOrigin,Wi as deployStaticSite,Ra as deployStaticSiteFull,sn as deployStaticSiteWithExternalDns,on as deployStaticSiteWithExternalDnsFull,jl as egressReportMetrics,S as ensureDashboardActor,Wn as ensureManagementDashboard,zA as estimateExistingStaticFullStackMonthlyCost,VA as estimateStaticApiOriginMonthlyCost,zl as fetchEgressReport,Qm as generateExistingStaticFullStackTemplate,Ta as generateExternalDnsStaticSiteTemplate,Ki as generateStaticSiteTemplate,jh as hasComputeConfigured,bc as hasProxyUpstream,Hm as hashContainerContext,Sn as hostAcceptsIpv6,Gi as infraEnvFromOutputs,Hl as initializeDashboardControlPlane,Xi as invalidateCache,Ir as isPhpSite,ca as isValidHostname,ye as normalizePublicIpv6,ei as occupiedHostPorts,ri as parseHostSiteFragments,Ec as parseUpstreamPort,uu as reconcileAddressRecords,Zr as redeployServerlessApp,Yr as removeSiteFromCloudConfig,qa as removeStaleServerAddressRecords,Fl as renderAliasesValue,Ml as renderEnvValue,Ul as renderRedirectsValue,Mm as renderSiteSnippet,Ll as renderSslValue,$l as renderStringValue,zi as resolveDashboardAction,fc as resolveDashboardAuth,tn as resolveDashboardData,ql as resolveLegacyDashboardRoute,Sr as resolveProxyUpstreams,Rs as resolveSiteDeployTarget,u as resolveSiteKind,Nt as resolveUiSource,en as rollbackServerlessApp,HA as routesForDashboard,Je as runRemoteCommand,ji as sanitizeCloudConfig,Ql as setAttachToInCloudConfig,Jt as setMaintenance,Qi as setSitePropertyInCloudConfig,mp as shipsARelease,Ty as shipsToBucket,B as siteInstallBase,va as startLocalDashboardServer,Hi as synchronizeDashboardUsers,Pe as trackDashboardOperation,Ol as updateSiteInCloudConfig,Ji as uploadStaticFiles,gp as validateDeploymentConfig,ja as verifyAddressRecord,qA as verifyStaticApiOrigin};

package/dist/dns/index.js

@@ -1 +1 @@
-import{tt,se,xe,fe,Tt,fn,ns,is,nr,ir,An,sr,ss,os,as,cs,z,ds,ls,us,ps,oe,gs,ms,hs,T,Ua,yn,Qa}from"../chunk-s40cx3fh.js";import"../chunk-21b8nage.js";import"../chunk-8a02v9gs.js";export{fe as CloudflareProvider,yn as DnsProviderFactory,xe as GoDaddyProvider,tt as PROXIABLE_RECORD_TYPES,se as PorkbunProvider,z as Route53Provider,oe as UnifiedDnsValidator,as as applyDeclaredZoneSettings,us as applyZoneMigration,T as createDnsProvider,ms as createGoDaddyValidator,gs as createPorkbunValidator,hs as createRoute53Validator,sr as delegateZone,ss as delegateZoneFromConfig,os as describeDelegation,cs as describeZoneSettings,Ua as detectDnsProvider,Qa as dnsProviders,ds as exportRoute53Zone,nr as isNameserverRegistrar,ir as isZoneHost,ls as planZoneMigration,Tt as policyTag,fn as qualifyName,is as reconcileDeclaredRecords,ns as resolveDeclaredRecords,An as sameNameservers,ps as verifyZoneParity};
+import{tt,se,_e,Ae,Tt,An,ss,os,nr,ir,yn,sr,as,cs,ds,ls,z,us,ps,gs,ms,oe,hs,fs,As,T,Ha,In,Ga}from"../chunk-v9t92ak2.js";import"../chunk-emx1j2yt.js";import"../chunk-ss4q8kge.js";export{Ae as CloudflareProvider,In as DnsProviderFactory,_e as GoDaddyProvider,tt as PROXIABLE_RECORD_TYPES,se as PorkbunProvider,z as Route53Provider,oe as UnifiedDnsValidator,ds as applyDeclaredZoneSettings,gs as applyZoneMigration,T as createDnsProvider,fs as createGoDaddyValidator,hs as createPorkbunValidator,As as createRoute53Validator,sr as delegateZone,as as delegateZoneFromConfig,cs as describeDelegation,ls as describeZoneSettings,Ha as detectDnsProvider,Ga as dnsProviders,us as exportRoute53Zone,nr as isNameserverRegistrar,ir as isZoneHost,ps as planZoneMigration,Tt as policyTag,An as qualifyName,os as reconcileDeclaredRecords,ss as resolveDeclaredRecords,yn as sameNameservers,ms as verifyZoneParity};

package/dist/drivers/index.js

@@ -1 +1 @@
-import{Sn,wt,ar,Rt,Cn,bn,En,vn,uu,Va,K,lr,Jm,Tn,ja,ye,Ie,_e,N,ur,wn,pr,ce,za,Rn,Ka,Dn,Wa,gr,Xa,Oe,W,Ya,rt,Le,$e,nt,Se,ys,Za,pu,gu,ec,mu,it,Pn,tc,hu,fu,rc,mr,Ce,nc,Au,yu,Is,Nn,st,Iu,Su,Cu,bu,Eu,vu,Tu,wu,Ru,kn,Bn,xn,_n,On,Ln,$n,Du,Pu,hr,k,Ss,Nu,ku,Bu,ic,xu,_u,Xm,sc,Ym,Zm,Ou,Lu,eh,th,rh,oc,$u,nh,ih,sh,Mn,Un,Qn,Hn,ac,cc,dc,lc,oh,Gn,qn,Vn,jn,uc,pc,zn,Es,hc,Wn,fc,ah,ch,dh,lh}from"../chunk-bpvpq6w6.js";import"../chunk-aesvajfc.js";import"../chunk-22ybphxa.js";import"../chunk-3bz7xz2d.js";import"../chunk-8a02v9gs.js";import"../chunk-0hf0rdze.js";import"../chunk-d72ddm5x.js";export{lc as AwsBoxProvisioner,ur as AwsDriver,Bu as BOOT_PARTITION_LABEL,Ss as CloudDriverFactory,bn as DEFAULT_RPX_CERTS_DIR,ku as FIRST_BOOT_SCRIPT_PATH,dc as HetznerBoxProvisioner,gr as HetznerClient,Se as HetznerDriver,Ya as LEGACY_DRIVER_STATE_DIR,ys as LocalBoxDriver,ch as MANAGED_CACHE_POLICY_DISABLED,ah as MANAGED_CACHE_POLICY_OPTIMIZED,dh as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,yu as RASPBERRY_PI_DEFAULT_SWAP_GB,Wa as REMOTE_SCRIPT_RUNNER,Tn as RPX_DIR,ja as RPX_LAUNCHER_PATH,ye as RPX_SERVICE_NAME,nc as SSH_BOOTSTRAP_MARKER_DIR,Ce as SSH_BOOTSTRAP_VERSION,st as SSH_DEFAULTS,$n as SSH_DEPLOY_STORAGE_PATH,pu as SSH_INSECURE_HOST_KEY_OPTS,gu as SSH_KEEPALIVE_OPTS,Bn as SSH_PREFLIGHT_SCRIPT,Du as SSH_SKIP_BOOTSTRAP_ENV,hr as SshDriver,mr as SystemSshTransport,ac as UBUNTU_2404_AMI_PARAM,sh as acquireResizeLock,eh as applyHetznerHostOptimization,Is as assertArchSupported,Pu as assertSshComputeConfig,uc as buildAwsArtifactFetch,cc as buildBoxUserData,lh as buildCloudFrontOriginConfig,ic as buildCloudInitFirstBoot,Lu as buildHetznerHostOptimizationScript,zn as buildHostCleanupScript,pc as buildLocalArtifactFetch,K as buildRpxConfig,_e as buildRpxFragmentRefreshScript,lr as buildRpxLbConfig,Ie as buildRpxProvisionScript,mu as buildScpArgsFor,qn as buildSiteDeployScript,wn as buildSshArgs,ec as buildSshArgsFor,Nn as buildSshBootstrapScript,Vn as buildStaticSiteDeployScript,Nu as cloudDrivers,th as collectHetznerHostOptimizationReport,sc as collectHetznerResizeManifest,oh as createBoxProvisioner,k as createCloudDriver,hc as deployAllComputeSites,Es as deploySiteRelease,Va as deriveRouteId,Sn as describeScriptSyntaxError,rt as driverStateDir,Le as driverStatePath,Un as ensureFirewall,Qn as ensureServer,Mn as ensureSshKey,_n as evaluatePreflight,Xm as executeHetznerServerResize,fu as findKnownHostKey,Ln as formatPreflightFindings,wt as formatSshFailure,vn as gatewayHostnames,N as generateUbuntuAppCloudInit,En as hasAutoWwwVariant,Za as isBoxMode,_u as isHetznerCapacityError,Cn as isLocalDatabase,hu as knownHostsLine,tc as knownHostsToken,uu as normalizeRoutePath,Oe as normalizeSshPublicKey,xn as parsePreflightFacts,xu as planHetznerServerResize,On as preflightFailed,Ym as prepareHetznerResize,$e as readDriverState,nh as readResizeCheckpoint,jn as releaseTarballTmpPath,Wn as reloadRpxGateway,Dn as remoteScriptRunner,Jm as renderRpxLauncher,fc as renewRpxCertificates,oc as resizeCheckpointPath,$u as resizeLockPath,Gn as resolveExecStart,Xa as resolveHetznerApiToken,Ou as resolveHetznerHostOptimizationPlan,Eu as resolveSshHostKeyPolicy,Iu as resolveSshHosts,Ru as resolveSshLan,Cu as resolveSshPort,bu as resolveSshPrivateKeyPath,Tu as resolveSshProfile,wu as resolveSshPublicIp,kn as resolveSshSettings,vu as resolveSshSudo,Su as resolveSshUser,Pn as scanHostKey,za as scpUpload,Hn as serverPublicIpv4,Au as sshBootstrapMarkerPath,pr as sshExec,ce as sshExecOrThrow,it as sshHostKeyFingerprint,rc as sshKnownHostsPath,Rt as summarizeRemoteFailures,ar as surfaceRemoteNotices,rh as verifyHetznerHostOptimization,Zm as verifyHetznerResize,Ka as waitForCloudInit,Rn as waitForSsh,W as wrapCloudInitUserData,nt as writeDriverState,ih as writeResizeCheckpoint};
+import{Cn,wt,ar,Rt,En,bn,vn,Tn,hu,za,K,lr,oh,wn,Ka,Ie,Se,xe,N,ur,Rn,pr,ce,Wa,Dn,Ja,Pn,Xa,gr,Za,Oe,W,ec,rt,Le,$e,nt,Ce,Ss,tc,fu,Au,rc,yu,it,Nn,nc,Iu,Su,ic,mr,Ee,sc,Cu,Eu,Cs,kn,st,bu,vu,Tu,wu,Ru,Du,Pu,Nu,ku,Bn,_n,xn,On,Ln,$n,Mn,Bu,_u,hr,k,Es,xu,Ou,Lu,oc,$u,Mu,ah,ac,ch,dh,Fu,Uu,lh,uh,ph,cc,Qu,gh,mh,hh,Un,Qn,Hn,Gn,dc,lc,uc,pc,fh,qn,Vn,jn,zn,gc,mc,Kn,Ts,Ac,Jn,yc,Gu,qu,Vu,Ah}from"../chunk-acpxtkfy.js";import"../chunk-fz70vxrk.js";import"../chunk-g0yyw5k8.js";import"../chunk-z87dekhm.js";import"../chunk-ss4q8kge.js";import"../chunk-gstz8w2d.js";import"../chunk-jncbm332.js";export{pc as AwsBoxProvisioner,ur as AwsDriver,Lu as BOOT_PARTITION_LABEL,Es as CloudDriverFactory,bn as DEFAULT_RPX_CERTS_DIR,Ou as FIRST_BOOT_SCRIPT_PATH,uc as HetznerBoxProvisioner,gr as HetznerClient,Ce as HetznerDriver,ec as LEGACY_DRIVER_STATE_DIR,Ss as LocalBoxDriver,qu as MANAGED_CACHE_POLICY_DISABLED,Gu as MANAGED_CACHE_POLICY_OPTIMIZED,Vu as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,Eu as RASPBERRY_PI_DEFAULT_SWAP_GB,Xa as REMOTE_SCRIPT_RUNNER,wn as RPX_DIR,Ka as RPX_LAUNCHER_PATH,Ie as RPX_SERVICE_NAME,sc as SSH_BOOTSTRAP_MARKER_DIR,Ee as SSH_BOOTSTRAP_VERSION,st as SSH_DEFAULTS,Mn as SSH_DEPLOY_STORAGE_PATH,fu as SSH_INSECURE_HOST_KEY_OPTS,Au as SSH_KEEPALIVE_OPTS,_n as SSH_PREFLIGHT_SCRIPT,Bu as SSH_SKIP_BOOTSTRAP_ENV,hr as SshDriver,mr as SystemSshTransport,dc as UBUNTU_2404_AMI_PARAM,hh as acquireResizeLock,lh as applyHetznerHostOptimization,Cs as assertArchSupported,_u as assertSshComputeConfig,gc as buildAwsArtifactFetch,lc as buildBoxUserData,Ah as buildCloudFrontOriginConfig,oc as buildCloudInitFirstBoot,Uu as buildHetznerHostOptimizationScript,Kn as buildHostCleanupScript,mc as buildLocalArtifactFetch,K as buildRpxConfig,xe as buildRpxFragmentRefreshScript,lr as buildRpxLbConfig,Se as buildRpxProvisionScript,yu as buildScpArgsFor,Vn as buildSiteDeployScript,Rn as buildSshArgs,rc as buildSshArgsFor,kn as buildSshBootstrapScript,jn as buildStaticSiteDeployScript,xu as cloudDrivers,uh as collectHetznerHostOptimizationReport,ac as collectHetznerResizeManifest,fh as createBoxProvisioner,k as createCloudDriver,Ac as deployAllComputeSites,Ts as deploySiteRelease,za as deriveRouteId,Cn as describeScriptSyntaxError,rt as driverStateDir,Le as driverStatePath,Qn as ensureFirewall,Hn as ensureServer,Un as ensureSshKey,On as evaluatePreflight,ah as executeHetznerServerResize,Su as findKnownHostKey,$n as formatPreflightFindings,wt as formatSshFailure,Tn as gatewayHostnames,N as generateUbuntuAppCloudInit,vn as hasAutoWwwVariant,tc as isBoxMode,Mu as isHetznerCapacityError,En as isLocalDatabase,Iu as knownHostsLine,nc as knownHostsToken,hu as normalizeRoutePath,Oe as normalizeSshPublicKey,xn as parsePreflightFacts,$u as planHetznerServerResize,Ln as preflightFailed,ch as prepareHetznerResize,$e as readDriverState,gh as readResizeCheckpoint,zn as releaseTarballTmpPath,Jn as reloadRpxGateway,Pn as remoteScriptRunner,oh as renderRpxLauncher,yc as renewRpxCertificates,cc as resizeCheckpointPath,Qu as resizeLockPath,qn as resolveExecStart,Za as resolveHetznerApiToken,Fu as resolveHetznerHostOptimizationPlan,Ru as resolveSshHostKeyPolicy,bu as resolveSshHosts,ku as resolveSshLan,Tu as resolveSshPort,wu as resolveSshPrivateKeyPath,Pu as resolveSshProfile,Nu as resolveSshPublicIp,Bn as resolveSshSettings,Du as resolveSshSudo,vu as resolveSshUser,Nn as scanHostKey,Wa as scpUpload,Gn as serverPublicIpv4,Cu as sshBootstrapMarkerPath,pr as sshExec,ce as sshExecOrThrow,it as sshHostKeyFingerprint,ic as sshKnownHostsPath,Rt as summarizeRemoteFailures,ar as surfaceRemoteNotices,ph as verifyHetznerHostOptimization,dh as verifyHetznerResize,Ja as waitForCloudInit,Dn as waitForSsh,W as wrapCloudInitUserData,nt as writeDriverState,mh as writeResizeCheckpoint};

package/dist/drivers/shared/cloudfront-origin.d.ts

@@ -1,29 +1,3 @@
-/**
- * CloudFront-in-front-of-a-custom-origin distribution config.
- *
- * When a self-hosted gateway (rpx on a Hetzner box) is the origin behind
- * CloudFront, the distribution needs a very specific shape — and several
- * non-obvious settings will silently break it if wrong. This builder encodes
- * the working configuration so it can't regress:
- *
- *  - **One custom origin**, the dedicated origin host (e.g. `origin.example.com`),
- *    HTTPS-only. It must NOT be a public alias (that loops) and can't be a bare IP.
- *  - **Host forwarding** via the AWS-managed `AllViewer` origin-request policy, so
- *    the box receives `Host: <alias>` and routes by it (not by the origin host).
- *  - **No `DefaultRootObject`.** Setting it to `index.html` makes CloudFront fetch
- *    `/index.html`, which a gateway with clean-URLs 301-redirects back to `/` — an
- *    infinite loop. Leave it empty and let the origin serve `/`.
- *  - **No CloudFront Functions / Lambda@Edge.** S3-era URL-rewrite functions fight
- *    a gateway that already does its own path-mounting + clean URLs (→ 301 loops).
- *  - **Dynamic paths** (e.g. `/api/*`) use the managed `CachingDisabled` policy and
- *    allow all HTTP methods; **static paths** use `CachingOptimized`.
- *  - **Origin lockdown header** (optional): a secret injected on the origin hop,
- *    paired with rpx `createOriginGuard`, so the publicly-resolvable origin can't
- *    be used to bypass the CDN.
- *
- * The result is a complete `DistributionConfig` suitable for CloudFront
- * `CreateDistribution` or `UpdateDistribution`.
- */
 /** AWS-managed cache/origin-request policy IDs (identical across all accounts). */
 export declare const MANAGED_CACHE_POLICY_OPTIMIZED = "658327ea-f89d-4fab-a63d-7e88639e58f6";
 export declare const MANAGED_CACHE_POLICY_DISABLED = "4135ea2d-6df8-44a3-9df3-4b5a84be39ad";
@@ -57,6 +31,21 @@ export interface BuildCloudFrontOriginOptions {
     originShield?: boolean;
     /** AWS region used by Origin Shield. Required when {@link originShield} is enabled. */
     originShieldRegion?: string;
+    /**
+     * Hostname of a second box CloudFront fails over to when {@link originDomain}
+     * errors. Same rules as {@link originDomain}: it must not be an alias. It
+     * receives the same origin secret header, so lock it down the same way.
+     * The default cache behavior targets the origin group; path behaviors stay
+     * on the primary.
+     * @experimental Built against the AWS documentation; not yet exercised against a live distribution.
+     */
+    failoverOriginDomain?: string;
+    /**
+     * Primary-origin status codes that trigger failover. Allowed: 400, 403, 404,
+     * 416, 429, 500, 502, 503, 504. @default [500, 502, 503, 504]
+     * @experimental
+     */
+    failoverStatusCodes?: number[];
 }
 /**
  * Build a complete CloudFront `DistributionConfig` for a self-hosted origin.

package/dist/drivers/shared/deploy-script.d.ts

@@ -10,7 +10,7 @@
  * release (no window where the code is half-replaced). Old releases are kept for
  * instant rollback. See {@link import('./releases')}.
  */
-import type { SharedPathEntry } from '@ts-cloud/core';
+import type { SharedPathEntry, SiteLivenessConfig } from '@ts-cloud/core';
 /**
  * Translate a `start` command into an absolute systemd ExecStart.
  *
@@ -38,21 +38,6 @@ import type { SharedPathEntry } from '@ts-cloud/core';
  * rather than emitting a unit that fails to start.
  */
 export declare function resolveExecStart(start: string, runtime: 'bun' | 'node' | 'deno', workingDirectory?: string): string;
-/**
- * Shell that installs a recurring liveness check for one ported service.
- *
- * Three files: a check script, a oneshot service that runs it, and a timer.
- * The script resolves the unit to probe at run time rather than baking in a
- * release id, so it keeps working after the next deploy replaces the instance.
- *
- * `curl` without `-f`: any HTTP response means the process is answering, and a
- * 404 on `/` is a routing opinion, not a wedged event loop. Only a connection
- * failure or a timeout counts against it.
- *
- * A restart needs N consecutive failures, counted in a file under /run, so a
- * single slow moment cannot bounce a healthy service; the counter resets on the
- * first good response. flock keeps two ticks from overlapping.
- */
 /**
  * Stop the implicit per-template slice from silently capping the service.
  *
@@ -138,15 +123,65 @@ export declare function buildAutoMemoryHigh(unitFile: string): string[];
  */
 export declare function buildCommitmentReport(): string[];
 export declare function buildSliceReconcile(instance: string): string[];
+/**
+ * Liveness probe settings for a ported site - the same shape as
+ * `SiteConfig.liveness`. See {@link LIVENESS_DEFAULTS} for unset fields.
+ */
+export type LivenessOptions = SiteLivenessConfig;
+export declare const LIVENESS_DEFAULTS: {
+    readonly path: '/';
+    readonly intervalSeconds: 60;
+    readonly failuresBeforeRestart: 3;
+    readonly timeoutSeconds: 10;
+    readonly startupGraceSeconds: 600;
+    readonly maxBackoffSeconds: 3600;
+    /** The wait before the second consecutive restart; it doubles from there. */
+    readonly backoffBaseSeconds: 300;
+};
+/**
+ * Shell that installs a recurring liveness check for one ported service.
+ *
+ * Three files: a check script, a oneshot service that runs it, and a timer.
+ * The script resolves the unit to probe at run time rather than baking in a
+ * release id, so it keeps working after the next deploy replaces the instance.
+ *
+ * `curl` without `-f`: any HTTP response means the process is answering, and a
+ * 404 on `/` is a routing opinion, not a wedged event loop. Only a refused
+ * connection or no response within `timeoutSeconds` counts against it. A
+ * timeout has to count - a wedged process still has its port bound and the
+ * kernel still accepts into its backlog, so "connects but never answers" is
+ * exactly the failure this exists for - which is why the budget is generous
+ * rather than why timeouts are forgiven.
+ *
+ * A restart needs N consecutive failures, counted in a file under /run, so a
+ * single slow moment cannot bounce a healthy service; the counter resets on the
+ * first good response. flock keeps two ticks from overlapping.
+ *
+ * **Startup grace.** A check against a unit younger than `startupGraceSeconds`
+ * is not counted. Without it the probe turned a slow boot into an outage loop:
+ * a release whose image warm-up kept its main thread busy for minutes after
+ * binding was restarted three minutes into each boot, three times running.
+ * Every restart threw the warm-up away and began it again, so visitors saw
+ * nine minutes of 502s from a release that would have been healthy in five.
+ * The age is the unit's own `ActiveEnterTimestampMonotonic` against
+ * `/proc/uptime`, which a restart resets, with the main PID's elapsed time as
+ * the fallback.
+ *
+ * **Back-off.** Restarts the probe itself issued are remembered with the time
+ * of the last one. The second in a row waits at least five minutes after the
+ * first and each later one doubles, capped at `maxBackoffSeconds`, so a
+ * release that can never come up is restarted a handful of times and then
+ * about hourly, not every few minutes forever. The streak is forgotten once
+ * the service answers with no probe restart in the last `maxBackoffSeconds`,
+ * and a deploy starts it afresh. Every held-off restart says so in the
+ * journal under the `<unit>-liveness` tag.
+ */
 export declare function buildLivenessUnits(options: {
     unitBase: string;
     /** systemd unit to restart. A `<base>@*.service` glob resolves at run time. */
     unitPattern: string;
     port: number;
-    path?: string;
-    intervalSeconds?: number;
-    failuresBeforeRestart?: number;
-}): string[];
+} & LivenessOptions): string[];
 export interface BuildSiteDeployScriptOptions {
     siteName: string;
     slug: string;
@@ -218,18 +253,16 @@ export interface BuildSiteDeployScriptOptions {
      * The probe is an HTTP request rather than a listener check for that exact
      * reason — `ss` would have called the wedged process healthy.
      *
+     * A unit younger than `startupGraceSeconds` is never restarted, and
+     * consecutive restarts back off, so a slow boot cannot become a restart
+     * loop. See {@link buildLivenessUnits}.
+     *
      * Set `false` to opt out (a service that legitimately answers nothing on its
      * port, or one where a restart is more dangerous than an outage).
-     * @default enabled, `/` every 60s, restart after 3 consecutive failures
+     * @default enabled, `/` every 60s with a 10s timeout, restart after 3
+     * consecutive failures once the unit is 10 minutes old
      */
-    liveness?: false | {
-        /** Path to request. @default '/' */
-        path?: string;
-        /** Seconds between checks. @default 60 */
-        intervalSeconds?: number;
-        /** Consecutive failures before a restart. @default 3 */
-        failuresBeforeRestart?: number;
-    };
+    liveness?: false | LivenessOptions;
     /**
      * systemd `MemoryHigh` for the app unit. See {@link SiteConfig.memoryHigh}.
      * @default '2G'