@stacksjs/ts-cloud 0.16.17 → 0.16.18

package/dist/index.js

@@ -1,17 +1,17 @@
-import{jp,_,zp,xf,Gy,Of,qy,Vy,jy,zy,Ky,Wy,Jy,Xy,Yy,Zy,Kp,Wp,pd,gd,ro,x,d,md,Jp,O,hd,p,Lf,Si,fd,Ad,le,yd,eI,r,t,tI,rI,g,nI,iI,sI,oI,aI,Ft,Id,no,$f,cI,dI,ve,He,Sd,Xp,Yp,lI,Mf,Zp,Ci,Lr,Cd,ue,L,I,o,f,Ge,m,Ff,qe,M,ut,uI,Uf,F,Ed,Te,Ut,io,Y,bd,Z,Qf,so,U,Q,D,Ei,b,Qt,pt,H,e,oo,pI,eg,vd,gI,mI,hI,fI,Td,yI,II,SI,CI,EI,bI,vI,TI,wI,RI,DI,PI,Hf,Gf,qf,Vf,jf,zf,Kf,Ht,tg,rg,$r,bi,NI,ng,kI,BI,Mr,_I,xI,OI,LI,$I,MI,Wf,Jf,Xf,Yf,Zf,ao,FI,eA,tA,rA,G,UI,Ve,co,Gt,nA,ig,iA,sA,oA,sg,ee,QI,HI,GI,qI,aA,VI,q,jI,zI,KI,og,ag,WI,cg,dg,JI,XI,YI,ZI,eS,cA,wd,tS,rS,nS,iS,sS,dA,lA,oS,aS,cS,dS,lS,uS,pS,gS,mS,lg,Rd,hS,fS,AS,yS,ug,pg,gg,IS,mg,SS,CS,ES,bS,hg,vS,TS,wS,RS,DS,PS,NS,kS,uA,pA,gA,mA,fg,BS,_S,xS,OS,LS,$S,MS,FS,US,hA,fA,AA,yA,QS,HS,Ag,GS,yg,Ig,Sg,Cg,qS,VS,jS,zS,we,vi,KS,WS,JS,XS,YS,ZS,eC,tC,IA,rC,nC,Eg,bg,iC,sC,SA,oC,aC,cC,dC,lC,uC,pC,gC,mC,hC,fC,AC,yC,IC,SC,CC,EC,bC,vC,TC,wC,vg,RC,Tg,DC,wg,PC,Rg,NC,Dg,kC,Fr,BC,Pg,_C,lo,xC,Ng,OC,kg,LC,Bg,$C,_g,MC,xg,FC,Ur,UC,Og,QC,Lg,HC,$g,GC,Mg,qC,Fg,VC,Ug,jC,Qg,zC,Hg,KC,Gg,WC,qg,JC,Vg,XC,jg,YC,zg,ZC,Kg,eE,Wg,tE,Jg,rE,Xg,nE,Yg,iE,Zg,sE,em,oE,tm,aE,rm,cE,nm,dE,im,lE,sm,uE,CA,EA,bA,vA,om,pE,am,gE,cm,mE,dm,hE,Ti,TA,wA,uo,Dd,Qr,RA,po,qt,Pd,Nd,DA,PA,lm,NA,kd,um,fE,AE,go,mo,ho,Bd,wi,_d,xd,fo,Od,Ld,pm,kA,BA,_A,yE,xA,OA,IE,LA,gm,$A,MA,FA,SE,UA,Ri,$d,QA,CE,HA,Ao,yo,Md,mm,EE,hm,bE,fm,vE,Am,TE,ym,wE}from"./chunk-6m18fz5f.js";import{vo,Im,Vd,qA,ki,jd,To,Sm,Cm,Hr,wo,zd,je,Kd,Wd,Jd,Bi,Gr,Em,ze,Xd,Ro,Do,Po,Yd,Zd,el,_i,No,tl,qr,xi,ko,gt,bm,rl,nl,vm,il,Bo,Vt,sl,ol,al,cl,Ke,Tm,dl,jt,_o,xo,Oo,Oi,Li,Vr,ll,$i,Lo,$o,jr,ul,zr,wm,Rm,mt,Kr,Mo,Dm,pl,gl,Fo,ml,hl,fl,VA,te,Al,jA,zA,Mi,Fi,KA,pe,Pm,ht,Re,De,ft,yl,Il,Sl,Cl,Nm,km,Uo,Bm,_m,Qo,El,bl,xm,re,Om,vl,ge,Ho,We,At,yt,Wr,Ui,Tl,WA,Go,Lm,$m,Mm,Fm,qo,Vo,wl,Jr,jo,Rl,Qi,Dl,zo,Ko,Wo,Jo,Xo,Yo,Zo,ea,Pl,zt,ta,Nl,Xr,kl,ra,na,Bl,Kt,ia,sa,Um,JA,Hi,XA,YA,ZA,oa,aa,_l,Qm,ca,Yr,xl,Gi,Ol,Ll,$l,da,Hm,la,Ml,Gm,ua,qm,Zr,en,Fl,qi,Vl,Wl,ji,Wt,ga,tn,rn,Jt,Je,Ym,ha,Zm,eh,Yl,fa,Ki,Zl,Aa,St,Ne,eu,ya,Ia,tu,Sa,Ca,Ea,ba,ru,nu,sn,va,Ta,wa,Ra,iu,Wi,on,Ji,Da}from"./chunk-ynjfj2rt.js";import{B,Er,Rc,ks,u,Sp,Cp}from"./chunk-hasa64d4.js";import{ot,wc,ni,ii,si,Ip}from"./chunk-x3xs6qvx.js";import{_h,xh,Oh,ep,tp,rp,Lh,np,ip,$h,Mh,sp,Fh,Uh,vc,op,Qh,Hh,ap,Gh,qh,Vh,jh,zh,Kh,Wh,ri,Tc,cp,dp,lp,up,pp,gp,mp,hp,fp,Ap,yp,Jh,Xh,Yh,Zh,ef,tf,rf}from"./chunk-r2v44ba2.js";import{Fe,Dc,de,Bt,Pc,w,_t,at,Nc,Bs,of,Ep,kc,s,oi,_s,br,Bc,_c,vr,af,xc,Fy,Uy,xs,Qy,Hy,Oc,Lc,ai,Os,X,c,Ls,Ue,Tr,cf,df,$c,xt,lf,$s,uf,pf,Ms,Mc,wr,Fs,gf,Fc,bp,Ot,Rr,mf,Us,hf,R,ff,Uc,vp,Qs,Af,yf,If,Qc,ci,Hs,Hc,Lt,ct,Sf,Dr,Cf,Gc,Tp,wp,Gs,qc,Vc,dt,Rp,di,jc,qs,Pr,Dp,li,zc,Kc,ui,Pp,Wc,Jc,Xc,Yc,Vs,Np,kp,Ef,Bp,Zc,pi,_p,xp,js,Nr,zs,Ks,Ws,ed,Op,td,Js,bf,$t,vf,rd,kr,nd,Tf,id,Lp,gi,Br,Xs,mi,Qe,wf,$p,Mp,Mt,sd,od,ad,hi,fi,Ai,Rf,Df,lt,Ys,Pf,_r,Fp,Zs,Nf,Up,Qp,Hp,kf,Gp,qp,Bf,i,_f,yi,eo,to}from"./chunk-nca98yaf.js";import{n}from"./chunk-590gwv9d.js";import{a}from"./chunk-fw9hk0xt.js";import{me,ns,is,au,_a,xa,ss,Oa,Xe,V,Ye,ne,C,he,ln,La,ke,$a,un,pn,gn,Ct,Et,bt,mn,Yt,Ma,Zt,er,Ze,hn,Ua,vt,tr,fn,Ha,uu,pu,Ga,rr}from"./chunk-1ayadqry.js";import{tt,se,_e,gu,yn,qa,Va,as,Ae,Tt,In,cs,ds,nr,ir,Sn,sr,ls,us,ps,gs,z,ms,hs,fs,As,oe,ys,Is,Ss,T,ja,Cn,za,ae,or}from"./chunk-z13hksc9.js";import{fe,et,An}from"./chunk-81yetzg2.js";import{j}from"./chunk-3rh4m6ag.js";import{mu,Ka,ye,Wa,En,hu,Ja,fu,Au,ph,vn,Es,Tn,wn,Rn,K,xe,N,ur,Pn,pr,ce,Za,Nn,ec,mr,Bn,bs,_n,xn,On,Ln,hr,sc,Oe,W,Le,$e,nt,Ce,fr,Ee,Un,Qn,Hn,Gn,qn,Vn,jn,Ar,k,ws,Hu,pc,Kn,Wn,Jn,Xn,Ic,Rs,Sc,Nt,Yn,Ds,Ps,Cc,Zn,Ec}from"./chunk-4bcf62qk.js";import{Fd,Io,Di,Pi,So,Ud,Qd,Ni,Co,Eo,Gd,qd,bo}from"./chunk-2ht2ve4t.js";import{Pa,an,cn,Xi,Yi,Zi,es,Na,ka}from"./chunk-m1x32x81.js";import{Ba}from"./chunk-6jzg0gtw.js";import{A}from"./chunk-nz3ygqjb.js";import{Be}from"./chunk-mytcpvg5.js";import{y}from"./chunk-2vr8rqg8.js";import{J,ei,Ns,bc,ti,Zu}from"./chunk-pn8bczhy.js";import{Ir,be}from"./chunk-ygrxsjcz.js";import{h}from"./chunk-f3hhmec2.js";import{Nh,Me}from"./chunk-enhddb1a.js";import{cd,xr,dd,ld,ud,Ii,Vp,Or}from"./chunk-84w9n41b.js";import{createHmac as tc,createSign as Ac,timingSafeEqual as Hl}from"node:crypto";function zi(l){let S=l instanceof Date?l.getTime():l;if(!Number.isFinite(S))throw TypeError("Media access timestamp must be finite");return Math.floor(S/1000)}function rc(l){return Buffer.from(l).toString("base64").replaceAll("+","-").replaceAll("=","_").replaceAll("/","~")}function Gl(l){return Buffer.from(l).toString("base64url")}function nc(l,S=!1){if(!l||/[\r\n]/.test(l))throw TypeError("Media resource is invalid");let P=S?l.replaceAll("*","wildcard"):l,E=new URL(P);if(!["http:","https:"].includes(E.protocol))throw TypeError("Media resource must use HTTP or HTTPS");if(!S&&l.includes("*"))throw TypeError("Canned policies cannot contain wildcards")}function ic(l,S){let P=Ac("RSA-SHA1");return P.update(l),P.end(),rc(P.sign(S))}function oc(l){nc(l.resource,!0);let P={DateLessThan:{"AWS:EpochTime":zi(l.expiresAt)}};if(l.activeAt!==void 0)P.DateGreaterThan={"AWS:EpochTime":zi(l.activeAt)};if(l.ipAddress)P.IpAddress={"AWS:SourceIp":l.ipAddress};return JSON.stringify({Statement:[{Resource:l.resource,Condition:P}]})}function Nu(l,S,P){nc(l);let E=zi(S),v=l.includes("?")?"&":"?",it=oc({resource:l,expiresAt:S}),Pe=ic(it,P.privateKey);return`${l}${v}Expires=${E}&Signature=${encodeURIComponent(Pe)}&Key-Pair-Id=${encodeURIComponent(P.keyPairId)}`}function ku(l,S){let P=oc(l);return{"CloudFront-Key-Pair-Id":S.keyPairId,"CloudFront-Policy":rc(Buffer.from(P)),"CloudFront-Signature":ic(P,S.privateKey)}}function xu(l){if(!l.resource||/[\r\n]/.test(l.resource))throw TypeError("Media resource is invalid");let S=Gl(Buffer.from(JSON.stringify({resource:l.resource,expiresAt:zi(l.expiresAt),...l.keyId?{keyId:l.keyId}:{},...l.audience?{audience:l.audience}:{}}))),P=tc("sha256",l.secret).update(S).digest("base64url");return`${S}.${P}`}function Lu(l,S){let[P,E,v]=l.split(".");if(!P||!E||v)return null;let it=tc("sha256",S.secret).update(P).digest(),Pe;try{Pe=Buffer.from(E,"base64url")}catch{return null}if(it.length!==Pe.length||!Hl(it,Pe))return null;try{let Ie=JSON.parse(Buffer.from(P,"base64url").toString("utf8")),rt=zi(S.now??Date.now());if(!Ie.resource||!Number.isSafeInteger(Ie.expiresAt)||Ie.expiresAt<=rt)return null;if(S.resource&&Ie.resource!==S.resource)return null;if(S.audience&&Ie.audience!==S.audience)return null;return Ie}catch{return null}}function Fu(l,S=!1){let P=new URL(l,"https://media.invalid").pathname.toLowerCase(),E=/\.(?:m3u8|mpd|vtt|json)$/.test(P),v=/\.(?:key|license)$/.test(P)||P.includes("/keys/")||P.includes("/licenses/");return{"Accept-Ranges":"bytes","Cache-Control":S&&(E||v)?"private, no-store":E?"public, max-age=5, s-maxage=30, stale-while-revalidate=30":"public, max-age=31536000, immutable","Cross-Origin-Resource-Policy":"cross-origin","X-Content-Type-Options":"nosniff"}}function Mu(l){if(!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(l.bucket))throw TypeError("Media bucket is invalid");if(!/^[a-z0-9-]+$/.test(l.region))throw TypeError("Media bucket region is invalid");let S=l.prefix?`/${l.prefix.replace(/^\/+|\/+$/g,"")}`:"",P=l.protected??!1,E="public, max-age=31536000, immutable",v=P?"private, no-store":"public, max-age=5, s-maxage=30, stale-while-revalidate=30";return{originDomain:`${l.bucket}.s3.${l.region}.amazonaws.com`,originPath:S,domain:l.domain,trustedKeyGroupIds:[...new Set(l.trustedKeyGroupIds??[])],behaviors:[{pathPattern:"*.m3u8",cacheControl:v,compress:!0,signed:P},{pathPattern:"*.mpd",cacheControl:v,compress:!0,signed:P},{pathPattern:"*.vtt",cacheControl:v,compress:!0,signed:P},{pathPattern:"*",cacheControl:E,compress:!1,signed:P}],responseHeaders:{"Access-Control-Allow-Headers":"Range, If-Range","Access-Control-Allow-Methods":"GET, HEAD, OPTIONS","Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":"Accept-Ranges, Content-Length, Content-Range, ETag","X-Content-Type-Options":"nosniff"}}}class zl{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;constructor(l){this.config=l.config,this.environment=l.environment,this.builder=new yd(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let S=this.config.environments[this.environment]?.infrastructure;if(!S)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...S,compute:{...this.config.infrastructure?.compute,...S.compute},storage:{...this.config.infrastructure?.storage,...S.storage},functions:{...this.config.infrastructure?.functions,...S.functions},servers:{...this.config.infrastructure?.servers,...S.servers},databases:{...this.config.infrastructure?.databases,...S.databases},cdn:{...this.config.infrastructure?.cdn,...S.cdn},sftp:S.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...S.queues},redirects:{...this.config.infrastructure?.redirects,...S.redirects},realtime:{...this.config.infrastructure?.realtime,...S.realtime},cache:{...this.config.infrastructure?.cache,...S.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...S.fileSystem},email:{...this.config.infrastructure?.email,...S.email},search:{...this.config.infrastructure?.search,...S.search},ai:{...this.config.infrastructure?.ai,...S.ai}}}}shouldDeploy(l){if(l.environments&&!l.environments.includes(this.environment))return!1;if(l.requiresFeatures){let S=this.config.features||{};if(!l.requiresFeatures.every((E)=>S[E]===!0))return!1}if(l.regions){let S=this.config.environments[this.environment]?.region||this.config.project.region;if(!l.regions.includes(S))return!1}if(l.condition&&typeof l.condition==="function")return l.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let l=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,S=Number(l||3008);return Number.isFinite(S)&&S>0?S:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(l,S){return l==="public"||S.routeCompute===!0}storageBucketName(l,S,P){return this.mergedConfig.infrastructure?.storage?.[P]?.bucket??`${l}-${S}-${P}`}fileSystemLogicalId(l,S,P){return t(r({slug:`${l}-${P}`,environment:S,resourceType:"efs"}))}resolveSftpStorage(l,S,P){let E=l.storage;if(E?.type==="efs"&&E.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[E.fileSystem])throw Error(`sftp: storage.fileSystem "${E.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(S,P,E.fileSystem)},posixProfile:E.posixProfile}}if(E?.type==="s3"&&E.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[E.storageBucket])throw Error(`sftp: storage.storageBucket "${E.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(S,P,E.storageBucket)}}return}resolveComputeCachePathPatterns(l){if(l&&l.length>0)return l;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(l,S){return{PathPattern:l,TargetOriginId:S,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(l,S,P,E,v,it){let Pe=this.serverEipLogicalIds.get("app"),Ie=this.serverEipLogicalIds.get("appInstance");if(!Pe)return;let rt=`EC2-${E}-${v}-api`,Pt=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",st=Pt==="us-east-1"?".compute-1.amazonaws.com":`.${Pt}.compute.amazonaws.com`,cr={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:Pe}]}]},st]]},lr=this.resolveApiOriginPort();if(l.push({Id:rt,DomainName:cr,CustomOriginConfig:{HTTPPort:lr,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),P.push(Pe),Ie)P.push(Ie);for(let gr of it)S.push(this.createComputeCacheBehavior(gr,rt))}buildCaddyfile(l){let S=l.filter(([,v])=>typeof v.domain==="string"&&v.domain&&typeof v.port==="number");if(S.length===0)return;let P=new Map;for(let[,v]of S){let it=P.get(v.domain)??[];it.push({port:v.port,path:v.path}),P.set(v.domain,it)}let E=[];for(let[v,it]of P){let Ie=[...it].sort((rt,Pt)=>{let st=!rt.path||rt.path==="/",cr=!Pt.path||Pt.path==="/";if(st&&!cr)return 1;if(!st&&cr)return-1;return(Pt.path?.length??0)-(rt.path?.length??0)}).map((rt)=>{let Pt=!rt.path||rt.path==="/",st=`reverse_proxy localhost:${rt.port}`;return Pt?`  handle {
+import{rg,_,ng,Xf,oI,Yf,aI,cI,dI,lI,uI,pI,gI,mI,hI,fI,ig,sg,hd,fd,io,O,d,Ad,og,x,yd,p,Zf,bi,Id,Sd,le,Cd,yI,r,t,II,SI,g,CI,EI,bI,vI,TI,Ut,Ed,so,eA,wI,RI,ve,Ge,bd,ag,cg,DI,dg,lg,ug,vd,pg,Te,Fr,Qt,Td,Ht,ue,tA,wd,oo,gg,mg,hg,fg,Rd,PI,L,I,a,f,qe,m,rA,Ve,M,pt,NI,nA,F,Dd,we,Gt,ao,Y,Pd,Z,iA,co,U,Q,D,vi,b,qt,gt,H,e,lo,kI,Ag,Nd,BI,_I,OI,xI,kd,LI,$I,MI,FI,UI,QI,HI,GI,qI,VI,jI,zI,sA,oA,aA,cA,dA,lA,uA,Vt,yg,Ig,Ur,Ti,KI,Sg,WI,JI,Qr,XI,YI,ZI,eS,tS,rS,pA,gA,mA,hA,fA,uo,nS,AA,yA,IA,G,iS,je,po,jt,SA,Cg,CA,EA,bA,Eg,ee,sS,oS,aS,cS,vA,dS,q,lS,uS,pS,bg,vg,gS,Tg,wg,mS,hS,fS,AS,yS,TA,Bd,IS,SS,CS,ES,bS,wA,RA,vS,TS,wS,RS,DS,PS,NS,kS,BS,Rg,_d,_S,OS,xS,LS,Dg,Pg,Ng,$S,kg,MS,FS,US,QS,Bg,HS,GS,qS,VS,jS,zS,KS,WS,DA,PA,NA,kA,_g,JS,XS,YS,ZS,eC,tC,rC,nC,iC,BA,_A,OA,xA,sC,oC,Og,aC,xg,Lg,$g,Mg,cC,dC,lC,uC,Re,wi,pC,gC,mC,hC,fC,AC,yC,IC,LA,SC,CC,Fg,Ug,EC,bC,$A,vC,TC,wC,RC,DC,PC,NC,kC,BC,_C,OC,xC,LC,$C,MC,FC,UC,QC,HC,GC,qC,Qg,VC,Hg,jC,Gg,zC,qg,KC,Vg,WC,Hr,JC,jg,XC,go,YC,zg,ZC,Kg,eE,Wg,tE,Jg,rE,Xg,nE,Gr,iE,Yg,sE,Zg,oE,em,aE,tm,cE,rm,dE,nm,lE,im,uE,sm,pE,om,gE,am,mE,cm,hE,dm,fE,lm,AE,um,yE,pm,IE,gm,SE,mm,CE,hm,EE,fm,bE,Am,vE,ym,TE,Im,wE,Sm,RE,Cm,DE,Em,PE,MA,FA,UA,QA,bm,NE,vm,kE,Tm,BE,wm,_E,Ri,HA,GA,mo,Od,qr,qA,ho,zt,xd,Ld,VA,jA,Rm,zA,$d,Dm,OE,xE,fo,Ao,yo,Md,Di,Fd,Ud,Io,Qd,Hd,Pm,KA,WA,JA,LE,XA,YA,$E,ZA,Nm,ey,ty,ry,ME,ny,Pi,Gd,iy,FE,sy,So,Co,qd,km,UE,Bm,QE,_m,HE,Om,GE,xm,qE}from"./chunk-v2p7c7s4.js";import{Ro,Lm,Xd,ay,_i,Yd,Do,$m,Mm,Vr,Po,Zd,ze,el,tl,rl,Oi,jr,Fm,Ke,nl,No,ko,Bo,il,sl,ol,xi,_o,al,zr,Li,Oo,mt,Um,cl,dl,Qm,ll,xo,Kt,ul,pl,gl,ml,We,Hm,hl,Wt,Lo,$o,Mo,$i,Mi,Kr,fl,Fi,Fo,Uo,Wr,Al,Jr,Gm,qm,ht,Xr,Qo,Vm,yl,Il,Ho,Sl,Cl,El,cy,te,bl,dy,ly,Ui,Qi,uy,pe,jm,ft,De,Pe,At,vl,Tl,wl,Rl,zm,Km,Go,Wm,Jm,qo,Dl,Pl,Xm,re,Ym,Nl,ge,Vo,Je,yt,It,Yr,Hi,kl,py,jo,Zm,eh,th,rh,zo,Ko,Bl,Zr,Wo,_l,Gi,Ol,Jo,Xo,Yo,Zo,ea,ta,ra,na,xl,Jt,ia,Ll,en,$l,sa,oa,Ml,Xt,aa,ca,nh,gy,qi,my,hy,fy,da,la,Fl,ih,ua,tn,Ul,Vi,Ql,Hl,Gl,pa,sh,ga,ql,oh,ma,ah,rn,nn,Vl,ji,Xl,tu,ru,nu,iu,su,Ki,Yt,fa,sn,on,Zt,Xe,hh,ya,fh,Ah,cu,Ia,Ji,du,Sa,Ct,ke,lu,Ca,Ea,uu,ba,va,Ta,wa,pu,gu,cn,Ra,Da,Pa,Na,mu,Xi,dn,Yi,ka}from"./chunk-2p71e3x7.js";import{B,Tr,Nc,_s,u,Np,kp}from"./chunk-3m9ghthh.js";import{at,Pc,oi,ai,ci,Pp}from"./chunk-w9jhyy09.js";import{Jh,Xh,Yh,lp,up,pp,Zh,gp,mp,ef,tf,hp,rf,nf,Rc,fp,sf,of,Ap,af,cf,df,lf,uf,pf,gf,si,Dc,yp,Ip,Sp,Cp,Ep,bp,vp,Tp,wp,Rp,Dp,mf,hf,ff,Af,yf,If,Sf}from"./chunk-z3wynefj.js";import{Ue,kc,de,_t,Bc,w,Ot,ct,_c,Os,bf,Bp,Oc,s,di,xs,wr,xc,Lc,Rr,vf,$c,rI,nI,Ls,iI,sI,Mc,Fc,li,$s,X,c,Ms,Qe,Dr,Tf,wf,Uc,xt,Rf,Fs,Df,Pf,Us,Qc,Pr,Qs,Nf,Hc,_p,Lt,Nr,kf,Hs,Bf,R,_f,Gc,Op,Gs,Of,xf,Lf,qc,ui,qs,Vc,$t,dt,$f,kr,Mf,jc,xp,Lp,Vs,zc,Kc,lt,$p,pi,Wc,js,Br,Mp,gi,Jc,Xc,mi,Fp,Yc,Zc,ed,td,zs,Up,Qp,Ff,Hp,rd,hi,Gp,qp,Ks,_r,Ws,Js,Xs,nd,Vp,id,Ys,Uf,Mt,Qf,sd,Or,od,Hf,ad,jp,fi,xr,Zs,Ai,He,Gf,zp,Kp,Ft,cd,dd,ld,yi,Ii,Si,qf,Vf,ut,eo,jf,Lr,Wp,to,zf,Jp,Xp,Yp,Kf,Zp,eg,Wf,i,Jf,Ci,ro,no}from"./chunk-kczzc599.js";import{n}from"./chunk-zx8ecz8b.js";import{o}from"./chunk-yd40pg8g.js";import{me,ss,os,Au,La,$a,as,Ma,Ye,V,Ze,ne,C,he,gn,Fa,Be,Ua,mn,hn,fn,Et,bt,vt,An,tr,Qa,rr,nr,et,yn,Ga,Tt,ir,In,Va,Cu,Eu,ja,sr}from"./chunk-60nr1ehk.js";import{rt,se,Oe,bu,Cn,za,Ka,ds,Ae,wt,En,ls,us,or,ar,bn,cr,ps,gs,ms,hs,z,fs,As,ys,Is,oe,Ss,Cs,Es,T,Wa,vn,Ja,ae,dr}from"./chunk-e8e1h2h9.js";import{fe,tt,Sn}from"./chunk-c3f89ryr.js";import{j}from"./chunk-k53agv2m.js";import{vu,Xa,ye,Ya,Tn,Tu,Za,wu,Ru,Ph,Rn,vs,Dn,Pn,Nn,K,xe,N,mr,Bn,hr,ce,rc,_n,nc,Ar,xn,Ts,Ln,$n,Mn,Un,yr,cc,Le,W,$e,Me,it,Ce,Ir,Ee,Gn,qn,Vn,jn,zn,Kn,Wn,Sr,k,Ds,Yu,hc,Xn,Yn,Zn,ei,Ec,Ps,bc,kt,ti,Ns,ks,vc,ri,Tc}from"./chunk-s2ve9zxn.js";import{Vd,Eo,Ni,ki,bo,jd,zd,Bi,vo,To,Wd,Jd,wo}from"./chunk-e52me1c6.js";import{Ba,ln,un,Zi,es,ts,rs,_a,Oa}from"./chunk-9syc8s7r.js";import{xa}from"./chunk-7xnwa0s8.js";import{A}from"./chunk-31tvc877.js";import{_e}from"./chunk-5far81q7.js";import{y}from"./chunk-9wmer0zx.js";import{J,ni,Bs,wc,ii,dp}from"./chunk-srrscggm.js";import{Er,be}from"./chunk-qcaqc5b8.js";import{h}from"./chunk-ptq9v346.js";import{zh,Fe}from"./chunk-bxrzsth8.js";import{ud,$r,pd,gd,md,Ei,tg,Mr}from"./chunk-g6g33pt9.js";import{createHmac as lc,createSign as jl,timingSafeEqual as Zl}from"node:crypto";function Aa(l){let S=l instanceof Date?l.getTime():l;if(!Number.isFinite(S))throw TypeError("Media access timestamp must be finite");return Math.floor(S/1000)}function dc(l){return Buffer.from(l).toString("base64").replaceAll("+","-").replaceAll("=","_").replaceAll("/","~")}function Jl(l){return Buffer.from(l).toString("base64url")}function uc(l,S=!1){if(!l||/[\r\n]/.test(l))throw TypeError("Media resource is invalid");let P=S?l.replaceAll("*","wildcard"):l,v=new URL(P);if(!["http:","https:"].includes(v.protocol))throw TypeError("Media resource must use HTTP or HTTPS");if(!S&&l.includes("*"))throw TypeError("Canned policies cannot contain wildcards")}function pc(l,S){let P=jl("RSA-SHA1");return P.update(l),P.end(),dc(P.sign(S))}function mc(l){uc(l.resource,!0);let P={DateLessThan:{"AWS:EpochTime":Aa(l.expiresAt)}};if(l.activeAt!==void 0)P.DateGreaterThan={"AWS:EpochTime":Aa(l.activeAt)};if(l.ipAddress)P.IpAddress={"AWS:SourceIp":l.ipAddress};return JSON.stringify({Statement:[{Resource:l.resource,Condition:P}]})}function Ku(l,S,P){uc(l);let v=Aa(S),E=l.includes("?")?"&":"?",ot=mc({resource:l,expiresAt:S}),Ie=pc(ot,P.privateKey);return`${l}${E}Expires=${v}&Signature=${encodeURIComponent(Ie)}&Key-Pair-Id=${encodeURIComponent(P.keyPairId)}`}function ju(l,S){let P=mc(l);return{"CloudFront-Key-Pair-Id":S.keyPairId,"CloudFront-Policy":dc(Buffer.from(P)),"CloudFront-Signature":pc(P,S.privateKey)}}function Zu(l){if(!l.resource||/[\r\n]/.test(l.resource))throw TypeError("Media resource is invalid");let S=Jl(Buffer.from(JSON.stringify({resource:l.resource,expiresAt:Aa(l.expiresAt),...l.keyId?{keyId:l.keyId}:{},...l.audience?{audience:l.audience}:{}}))),P=lc("sha256",l.secret).update(S).digest("base64url");return`${S}.${P}`}function qu(l,S){let[P,v,E]=l.split(".");if(!P||!v||E)return null;let ot=lc("sha256",S.secret).update(P).digest(),Ie;try{Ie=Buffer.from(v,"base64url")}catch{return null}if(ot.length!==Ie.length||!Zl(ot,Ie))return null;try{let Ne=JSON.parse(Buffer.from(P,"base64url").toString("utf8")),nt=Aa(S.now??Date.now());if(!Ne.resource||!Number.isSafeInteger(Ne.expiresAt)||Ne.expiresAt<=nt)return null;if(S.resource&&Ne.resource!==S.resource)return null;if(S.audience&&Ne.audience!==S.audience)return null;return Ne}catch{return null}}function Ju(l,S=!1){let P=new URL(l,"https://media.invalid").pathname.toLowerCase(),v=/\.(?:m3u8|mpd|vtt|json)$/.test(P),E=/\.(?:key|license)$/.test(P)||P.includes("/keys/")||P.includes("/licenses/");return{"Accept-Ranges":"bytes","Cache-Control":S&&(v||E)?"private, no-store":v?"public, max-age=5, s-maxage=30, stale-while-revalidate=30":"public, max-age=31536000, immutable","Cross-Origin-Resource-Policy":"cross-origin","X-Content-Type-Options":"nosniff"}}function Xu(l){if(!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(l.bucket))throw TypeError("Media bucket is invalid");if(!/^[a-z0-9-]+$/.test(l.region))throw TypeError("Media bucket region is invalid");let S=l.prefix?`/${l.prefix.replace(/^\/+|\/+$/g,"")}`:"",P=l.protected??!1,v="public, max-age=31536000, immutable",E=P?"private, no-store":"public, max-age=5, s-maxage=30, stale-while-revalidate=30";return{originDomain:`${l.bucket}.s3.${l.region}.amazonaws.com`,originPath:S,domain:l.domain,trustedKeyGroupIds:[...new Set(l.trustedKeyGroupIds??[])],behaviors:[{pathPattern:"*.m3u8",cacheControl:E,compress:!0,signed:P},{pathPattern:"*.mpd",cacheControl:E,compress:!0,signed:P},{pathPattern:"*.vtt",cacheControl:E,compress:!0,signed:P},{pathPattern:"*",cacheControl:v,compress:!1,signed:P}],responseHeaders:{"Access-Control-Allow-Headers":"Range, If-Range","Access-Control-Allow-Methods":"GET, HEAD, OPTIONS","Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":"Accept-Ranges, Content-Length, Content-Range, ETag","X-Content-Type-Options":"nosniff"}}}class Yl{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;storageFailoverReplicas=[];constructor(l){this.config=l.config,this.environment=l.environment,this.builder=new Cd(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let S=this.config.environments[this.environment]?.infrastructure;if(!S)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...S,compute:{...this.config.infrastructure?.compute,...S.compute},storage:{...this.config.infrastructure?.storage,...S.storage},functions:{...this.config.infrastructure?.functions,...S.functions},servers:{...this.config.infrastructure?.servers,...S.servers},databases:{...this.config.infrastructure?.databases,...S.databases},cdn:{...this.config.infrastructure?.cdn,...S.cdn},sftp:S.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...S.queues},redirects:{...this.config.infrastructure?.redirects,...S.redirects},realtime:{...this.config.infrastructure?.realtime,...S.realtime},cache:{...this.config.infrastructure?.cache,...S.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...S.fileSystem},email:{...this.config.infrastructure?.email,...S.email},search:{...this.config.infrastructure?.search,...S.search},ai:{...this.config.infrastructure?.ai,...S.ai}}}}shouldDeploy(l){if(l.environments&&!l.environments.includes(this.environment))return!1;if(l.requiresFeatures){let S=this.config.features||{};if(!l.requiresFeatures.every((v)=>S[v]===!0))return!1}if(l.regions){let S=this.config.environments[this.environment]?.region||this.config.project.region;if(!l.regions.includes(S))return!1}if(l.condition&&typeof l.condition==="function")return l.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let l=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,S=Number(l||3008);return Number.isFinite(S)&&S>0?S:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(l,S){return l==="public"||S.routeCompute===!0}storageBucketName(l,S,P){return this.mergedConfig.infrastructure?.storage?.[P]?.bucket??`${l}-${S}-${P}`}fileSystemLogicalId(l,S,P){return t(r({slug:`${l}-${P}`,environment:S,resourceType:"efs"}))}resolveSftpStorage(l,S,P){let v=l.storage;if(v?.type==="efs"&&v.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[v.fileSystem])throw Error(`sftp: storage.fileSystem "${v.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(S,P,v.fileSystem)},posixProfile:v.posixProfile}}if(v?.type==="s3"&&v.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[v.storageBucket])throw Error(`sftp: storage.storageBucket "${v.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(S,P,v.storageBucket)}}return}resolveComputeCachePathPatterns(l){if(l&&l.length>0)return l;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(l,S){return{PathPattern:l,TargetOriginId:S,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(l,S,P,v,E,ot){let Ie=this.serverEipLogicalIds.get("app"),Ne=this.serverEipLogicalIds.get("appInstance");if(!Ie)return;let nt=`EC2-${v}-${E}-api`,Pt=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",st=Pt==="us-east-1"?".compute-1.amazonaws.com":`.${Pt}.compute.amazonaws.com`,ur={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:Ie}]}]},st]]},pr=this.resolveApiOriginPort();if(l.push({Id:nt,DomainName:ur,CustomOriginConfig:{HTTPPort:pr,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),P.push(Ie),Ne)P.push(Ne);for(let gr of ot)S.push(this.createComputeCacheBehavior(gr,nt))}buildCaddyfile(l){let S=l.filter(([,E])=>typeof E.domain==="string"&&E.domain&&typeof E.port==="number");if(S.length===0)return;let P=new Map;for(let[,E]of S){let ot=P.get(E.domain)??[];ot.push({port:E.port,path:E.path}),P.set(E.domain,ot)}let v=[];for(let[E,ot]of P){let Ne=[...ot].sort((nt,Pt)=>{let st=!nt.path||nt.path==="/",ur=!Pt.path||Pt.path==="/";if(st&&!ur)return 1;if(!st&&ur)return-1;return(Pt.path?.length??0)-(nt.path?.length??0)}).map((nt)=>{let Pt=!nt.path||nt.path==="/",st=`reverse_proxy localhost:${nt.port}`;return Pt?`  handle {
     ${st}
-  }`:`  handle ${rt.path} {
+  }`:`  handle ${nt.path} {
     ${st}
-  }`});E.push(`${v} {
-${Ie.join(`
+  }`});v.push(`${E} {
+${Ne.join(`
 `)}
-}`)}return E.join(`
+}`)}return v.join(`
 
-`)}normalizeMountPath(l){let S=l?.mountPath||l?.path;if(!S||S==="/")return;let P=`/${S}`.replace(/\/+/g,"/").replace(/\/$/,"");return P==="/"?void 0:P}storageBucketLogicalId(l,S,P){return`${l}-${S}-s3-${P}`.split(/[^a-zA-Z0-9]+/).filter(Boolean).map((E)=>E.charAt(0).toUpperCase()+E.slice(1)).join("")}pathMountRewriteFunctionCode(l,S="directory"){return`function handler(event) { var request = event.request; var prefix = ${JSON.stringify(l)}; var rewriteStyle = ${JSON.stringify(S)}; var uri = request.uri; if (uri === prefix) { uri = '/'; } else if (uri.indexOf(prefix + '/') === 0) { uri = uri.substring(prefix.length); } if (uri === '' || uri === '/') { request.uri = '/index.html'; return request; } if (uri.endsWith('/')) { request.uri = uri + 'index.html'; return request; } var lastSegment = uri.substring(uri.lastIndexOf('/') + 1); if (lastSegment.indexOf('.') === -1) { request.uri = rewriteStyle === 'flat' ? uri + '.html' : uri + '/index.html'; return request; } request.uri = uri; return request; }`}generate(){let l=this.mergedConfig.project.slug,S=this.environment,P=!!(this.mergedConfig.infrastructure?.functions&&Object.keys(this.mergedConfig.infrastructure.functions).length>0||this.mergedConfig.infrastructure?.api),E=!!(this.mergedConfig.infrastructure?.servers&&Object.keys(this.mergedConfig.infrastructure.servers).length>0),v=!!this.mergedConfig.infrastructure?.compute;if(!!((this.mergedConfig.mode||"server")==="serverless"&&this.mergedConfig.infrastructure?.containers&&Object.keys(this.mergedConfig.infrastructure.containers).length>0))this.generateNetworkInfrastructure(l,S),this.generateContainerInfrastructure(l,S);if(P)this.generateServerless(l,S);if(E)this.generateServer(l,S);if(v)this.generateComputeApp(l,S);if(this.mergedConfig.infrastructure?.jumpBox)this.generateJumpBox(l,S);if(this.generateSharedInfrastructure(l,S),this.config.tags)this.applyGlobalTags(this.config.tags);return this}applyGlobalTags(l){}generateNetworkInfrastructure(l,S){if(this.builder.hasResource("VPC"))return;let E=this.mergedConfig.infrastructure?.network?.cidr||"10.0.0.0/16",{vpc:v,logicalId:it}=f.createVpc({slug:l,environment:S,cidr:E,enableDnsHostnames:!0,enableDnsSupport:!0});this.builder.addResource("VPC",v);let Pe=`${l}${S}IGW`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Pe,{Type:"AWS::EC2::InternetGateway",Properties:{Tags:[{Key:"Name",Value:`${l}-${S}-igw`},{Key:"Environment",Value:S}]}});let Ie=`${l}${S}IGWAttach`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Ie,{Type:"AWS::EC2::VPCGatewayAttachment",Properties:{VpcId:{Ref:"VPC"},InternetGatewayId:{Ref:Pe}}});let rt=`${l}${S}PublicRT`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(rt,{Type:"AWS::EC2::RouteTable",Properties:{VpcId:{Ref:"VPC"},Tags:[{Key:"Name",Value:`${l}-${S}-public-rt`},{Key:"Environment",Value:S}]}}),this.builder.addResource(`${l}${S}PublicRoute`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::EC2::Route",Properties:{RouteTableId:{Ref:rt},DestinationCidrBlock:"0.0.0.0/0",GatewayId:{Ref:Pe}},DependsOn:Ie});let Pt=this.mergedConfig.environments[S]?.region||this.mergedConfig.project.region||"us-east-1",st=["a","b"];for(let cr=0;cr<2;cr++){let lr=`PublicSubnet${cr+1}`;this.builder.addResource(lr,{Type:"AWS::EC2::Subnet",Properties:{VpcId:{Ref:"VPC"},CidrBlock:`10.0.${cr}.0/24`,AvailabilityZone:`${Pt}${st[cr]}`,MapPublicIpOnLaunch:!0,Tags:[{Key:"Name",Value:`${l}-${S}-public-${st[cr]}`},{Key:"Environment",Value:S}]}}),this.builder.addResource(`${lr}RTAssoc`,{Type:"AWS::EC2::SubnetRouteTableAssociation",Properties:{SubnetId:{Ref:lr},RouteTableId:{Ref:rt}}})}}generateContainerInfrastructure(l,S){let P=this.mergedConfig.infrastructure?.containers;if(!P)return;let E=this.mergedConfig.infrastructure?.loadBalancer,v=this.mergedConfig.infrastructure?.ssl,it=this.mergedConfig.infrastructure?.dns,Pe;if(v?.enabled&&v.domains?.length)if(v.certificateArn);else{let st=v.domains[0],cr=v.domains.slice(1).map((Dt)=>{if(Dt.includes(".")&&Dt.endsWith(st))return Dt.replace(`.${st}`,"");return Dt}),{certificate:lr,logicalId:gr}=I.createCertificate({domain:st,subdomains:cr,slug:l,environment:S,validationMethod:"DNS",hostedZoneId:it?.hostedZoneId});Pe=gr,this.builder.addResource(gr,lr)}let Ie="ECSCluster";this.builder.addResource(Ie,{Type:"AWS::ECS::Cluster",Properties:{ClusterName:`${l}-${S}`,ClusterSettings:[{Name:"containerInsights",Value:"enabled"}],Tags:[{Key:"Name",Value:`${l}-${S}`},{Key:"Environment",Value:S}]}});let rt=`${l}${S}ALBSecurityGroup`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(rt,{Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:`ALB security group for ${l}-${S}`,VpcId:{Ref:"VPC"},SecurityGroupIngress:[{IpProtocol:"tcp",FromPort:80,ToPort:80,CidrIp:"0.0.0.0/0",Description:"HTTP"},{IpProtocol:"tcp",FromPort:443,ToPort:443,CidrIp:"0.0.0.0/0",Description:"HTTPS"}],SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:`${l}-${S}-alb-sg`},{Key:"Environment",Value:S}]}});let Pt=`${l}${S}ECSSecurityGroup`.replace(/[^a-zA-Z0-9]/g,"");for(let[st,cr]of Object.entries(P)){let lr=cr.port||3000;this.builder.addResource(Pt,{Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:`ECS tasks security group for ${l}-${S}`,VpcId:{Ref:"VPC"},SecurityGroupIngress:[{IpProtocol:"tcp",FromPort:lr,ToPort:lr,SourceSecurityGroupId:{Ref:rt},Description:"Allow traffic from ALB"}],SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:`${l}-${S}-ecs-sg`},{Key:"Environment",Value:S}]}});let gr=`${l}${S}TaskExecRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(gr,{Type:"AWS::IAM::Role",Properties:{RoleName:`${l}-${S}-ecs-exec-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"],Policies:[{PolicyName:"ECRPullPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["ecr:GetAuthorizationToken","ecr:BatchCheckLayerAvailability","ecr:GetDownloadUrlForLayer","ecr:BatchGetImage","logs:CreateLogStream","logs:PutLogEvents"],Resource:"*"}]}}]}});let Dt=`${l}${S}TaskRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Dt,{Type:"AWS::IAM::Role",Properties:{RoleName:`${l}-${S}-ecs-task-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"TaskPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:"*"},{Effect:"Allow",Action:["s3:GetObject","s3:PutObject","s3:ListBucket"],Resource:"*"}]}}]}});let Rt=`${l}${S}${st}LogGroup`.replace(/[^a-zA-Z0-9]/g,""),Se=`/ecs/${l}-${S}-${st}`;this.builder.addResource(Rt,{Type:"AWS::Logs::LogGroup",Properties:{LogGroupName:Se,RetentionInDays:30}});let kt=`${l}${S}${st}TaskDef`.replace(/[^a-zA-Z0-9]/g,""),ie=String(cr.cpu||512),It=String(cr.memory||1024);this.builder.addResource(kt,{Type:"AWS::ECS::TaskDefinition",Properties:{Family:`${l}-${S}-${st}`,NetworkMode:"awsvpc",RequiresCompatibilities:["FARGATE"],Cpu:ie,Memory:It,ExecutionRoleArn:{"Fn::GetAtt":[gr,"Arn"]},TaskRoleArn:{"Fn::GetAtt":[Dt,"Arn"]},ContainerDefinitions:[{Name:st,Image:{"Fn::Sub":`\${AWS::AccountId}.dkr.ecr.\${AWS::Region}.amazonaws.com/${l}:latest`},Essential:!0,PortMappings:[{ContainerPort:lr,Protocol:"tcp"}],LogConfiguration:{LogDriver:"awslogs",Options:{"awslogs-group":Se,"awslogs-region":{Ref:"AWS::Region"},"awslogs-stream-prefix":st}},HealthCheck:{Command:["CMD-SHELL",`curl -f http://localhost:${lr}${cr.healthCheck||"/health"} || exit 1`],Interval:30,Timeout:5,Retries:3,StartPeriod:60}}],Tags:[{Key:"Name",Value:`${l}-${S}-${st}`},{Key:"Environment",Value:S}]},DependsOn:[gr,Dt,Rt]});let wt=`${l}${S}ALB`.replace(/[^a-zA-Z0-9]/g,"");if(E?.enabled!==!1){this.builder.addResource(wt,{Type:"AWS::ElasticLoadBalancingV2::LoadBalancer",Properties:{Name:`${l}-${S}-alb`,Scheme:"internet-facing",Type:"application",Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}],SecurityGroups:[{Ref:rt}],Tags:[{Key:"Name",Value:`${l}-${S}-alb`},{Key:"Environment",Value:S}]}});let Xt=`${l}${S}TargetGroup`.replace(/[^a-zA-Z0-9]/g,""),ar=E?.healthCheck?.path||cr.healthCheck||"/health";this.builder.addResource(Xt,{Type:"AWS::ElasticLoadBalancingV2::TargetGroup",Properties:{Name:`${l}-${S}-tg`,Port:lr,Protocol:"HTTP",VpcId:{Ref:"VPC"},TargetType:"ip",HealthCheckPath:ar,HealthCheckIntervalSeconds:E?.healthCheck?.interval||30,HealthyThresholdCount:E?.healthCheck?.healthyThreshold||2,UnhealthyThresholdCount:E?.healthCheck?.unhealthyThreshold||5,HealthCheckTimeoutSeconds:10,Tags:[{Key:"Name",Value:`${l}-${S}-tg`},{Key:"Environment",Value:S}]}});let dr=`${l}${S}HTTPListener`.replace(/[^a-zA-Z0-9]/g,"");if(v?.enabled&&v?.redirectHttp)this.builder.addResource(dr,{Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:{Ref:wt},Port:80,Protocol:"HTTP",DefaultActions:[{Type:"redirect",RedirectConfig:{Protocol:"HTTPS",Port:"443",StatusCode:"HTTP_301"}}]}});else this.builder.addResource(dr,{Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:{Ref:wt},Port:80,Protocol:"HTTP",DefaultActions:[{Type:"forward",TargetGroupArn:{Ref:Xt}}]}});if(v?.enabled){let dn=v.certificateArn||(Pe?{Ref:Pe}:void 0);if(dn){let bn=`${l}${S}HTTPSListener`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(bn,{Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:{Ref:wt},Port:443,Protocol:"HTTPS",Certificates:[{CertificateArn:dn}],DefaultActions:[{Type:"forward",TargetGroupArn:{Ref:Xt}}],SslPolicy:"ELBSecurityPolicy-TLS13-1-2-2021-06"}})}}let Cr=`${l}${S}${st}Service`.replace(/[^a-zA-Z0-9]/g,""),Sr=cr.desiredCount||1;this.builder.addResource(Cr,{Type:"AWS::ECS::Service",Properties:{ServiceName:`${l}-${S}-${st}`,Cluster:{Ref:Ie},TaskDefinition:{Ref:kt},DesiredCount:Sr,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{AssignPublicIp:"ENABLED",SecurityGroups:[{Ref:Pt}],Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]}},LoadBalancers:[{ContainerName:st,ContainerPort:lr,TargetGroupArn:{Ref:Xt}}],HealthCheckGracePeriodSeconds:120,Tags:[{Key:"Name",Value:`${l}-${S}-${st}`},{Key:"Environment",Value:S}]},DependsOn:[kt,dr,Xt]});let yr=cr.autoScaling;if(yr){let dn=`${l}${S}${st}ScalableTarget`.replace(/[^a-zA-Z0-9]/g,"");if(this.builder.addResource(dn,{Type:"AWS::ApplicationAutoScaling::ScalableTarget",Properties:{MaxCapacity:yr.max||10,MinCapacity:yr.min||1,ResourceId:{"Fn::Sub":`service/\${${Ie}}/${l}-${S}-${st}`},ScalableDimension:"ecs:service:DesiredCount",ServiceNamespace:"ecs",RoleARN:{"Fn::Sub":"arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService"}},DependsOn:Cr}),yr.targetCpuUtilization)this.builder.addResource(`${l}${S}${st}CPUScaling`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::ApplicationAutoScaling::ScalingPolicy",Properties:{PolicyName:`${l}-${S}-${st}-cpu-scaling`,PolicyType:"TargetTrackingScaling",ScalingTargetId:{Ref:dn},TargetTrackingScalingPolicyConfiguration:{PredefinedMetricSpecification:{PredefinedMetricType:"ECSServiceAverageCPUUtilization"},TargetValue:yr.targetCpuUtilization,ScaleInCooldown:300,ScaleOutCooldown:60}}});if(yr.targetMemoryUtilization)this.builder.addResource(`${l}${S}${st}MemoryScaling`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::ApplicationAutoScaling::ScalingPolicy",Properties:{PolicyName:`${l}-${S}-${st}-memory-scaling`,PolicyType:"TargetTrackingScaling",ScalingTargetId:{Ref:dn},TargetTrackingScalingPolicyConfiguration:{PredefinedMetricSpecification:{PredefinedMetricType:"ECSServiceAverageMemoryUtilization"},TargetValue:yr.targetMemoryUtilization,ScaleInCooldown:300,ScaleOutCooldown:60}}})}if(it?.domain&&it?.hostedZoneId)this.builder.addResource(`${l}${S}ApiDnsRecord`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:it.hostedZoneId,Name:`api.${it.domain}`,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":[wt,"DNSName"]},HostedZoneId:{"Fn::GetAtt":[wt,"CanonicalHostedZoneID"]}}}});this.builder.addOutput("ECSClusterArn",{Description:"ECS Cluster ARN",Value:{"Fn::GetAtt":[Ie,"Arn"]},Export:{Name:{"Fn::Sub":"${AWS::StackName}-ecs-cluster-arn"}}}),this.builder.addOutput("ECSServiceName",{Description:"ECS Service Name",Value:`${l}-${S}-${st}`,Export:{Name:{"Fn::Sub":"${AWS::StackName}-ecs-service-name"}}}),this.builder.addOutput("LoadBalancerDNS",{Description:"Application Load Balancer DNS Name",Value:{"Fn::GetAtt":[wt,"DNSName"]},Export:{Name:{"Fn::Sub":"${AWS::StackName}-alb-dns"}}})}else{let Xt=`${l}${S}${st}Service`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Xt,{Type:"AWS::ECS::Service",Properties:{ServiceName:`${l}-${S}-${st}`,Cluster:{Ref:Ie},TaskDefinition:{Ref:kt},DesiredCount:cr.desiredCount||1,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{AssignPublicIp:"ENABLED",SecurityGroups:[{Ref:Pt}],Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]}},Tags:[{Key:"Name",Value:`${l}-${S}-${st}`},{Key:"Environment",Value:S}]},DependsOn:[kt]})}break}}generateServerless(l,S){if(this.mergedConfig.infrastructure?.functions)for(let[P,E]of Object.entries(this.mergedConfig.infrastructure.functions)){if(!this.shouldDeploy(E))continue;let{role:v,logicalId:it}=Y.createRole({slug:l,environment:S,roleName:`${l}-${S}-${P}-role`,servicePrincipal:"lambda.amazonaws.com",managedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"]});this.builder.addResource(it,v);let{lambdaFunction:Pe,logicalId:Ie}=o.createLambdaFunction({slug:l,environment:S,functionName:`${l}-${S}-${P}`,handler:E.handler||"index.handler",runtime:E.runtime||"nodejs20.x",code:{zipFile:E.code||"export const handler = async () => ({ statusCode: 200 });"},role:it,timeout:E.timeout,memorySize:E.memorySize});this.builder.addResource(Ie,Pe)}if(this.mergedConfig.infrastructure?.api){let{restApi:P,logicalId:E}=bd.createRestApi({slug:l,environment:S,apiName:`${l}-${S}-api`});this.builder.addResource(E,P)}}generateServer(l,S){if(!this.mergedConfig.infrastructure?.servers)return;let P=this.mergedConfig.infrastructure.servers,E=this.mergedConfig.infrastructure?.compute,v=this.mergedConfig.infrastructure?.ssl;if(Object.values(P).some((Pe)=>!Pe.privateNetwork||Pe.privateNetwork==="create"))this.generateNetworkInfrastructure(l,S);for(let[Pe,Ie]of Object.entries(P)){let rt=Ie.instanceType||Ie.size||E?.size,st=(rt?o.InstanceSize.specs[rt]:void 0)?.instanceType||rt||"t3.micro",cr=Ie.type||"app",lr=Ie.userData||Ie.startupScript;if(!lr)lr=o.UserData.generateAppServerScript({runtime:"bun",runtimeVersion:Ie.bunVersion||"latest",webServer:"none",domain:Ie.domain,enableSsl:!!v?.enabled,sslEmail:v?.letsEncrypt?.email,installRedis:cr==="cache",installDatabaseClients:!!Ie.database});let gr=Ie.privateNetwork&&Ie.privateNetwork!=="create"?Ie.privateNetwork:{Ref:"VPC"},Dt=Ie.subnet||{Ref:"PublicSubnet1"},Se=!!this.mergedConfig.infrastructure?.email?.server?.enabled,kt=[22,80,443,this.resolveApiOriginPort()];if(Se)kt.push(25,465,587,143,993);let ie=o.createServerModeStack({slug:`${l}-${Pe}`,environment:S,vpcId:gr,subnetId:Dt,instanceType:st,keyName:Ie.keyName||`${l}-${S}`,domain:Ie.domain,userData:lr,volumeSize:Ie.diskSize||20,imageId:Ie.image,allowedPorts:kt});for(let[It,wt]of Object.entries(ie.resources))this.builder.addResource(It,wt);this.serverEipLogicalIds.set(Pe,ie.outputs.eipLogicalId),this.serverEipLogicalIds.set(`${Pe}Instance`,ie.outputs.instanceLogicalId),this.builder.addOutput(`${Pe}InstanceId`,{Value:{Ref:ie.outputs.instanceLogicalId},Description:`Instance ID for ${Pe} server`}),this.builder.addOutput(`${Pe}PublicIp`,{Value:{Ref:ie.outputs.eipLogicalId},Description:`Public IP for ${Pe} server`})}}generateComputeApp(l,S){let P=this.mergedConfig.infrastructure?.compute;if(!P)return;let E=this.mergedConfig.sites||{},v=Object.entries(E),Pe=this.mergedConfig.infrastructure?.dns?.domain,Ie=this.mergedConfig.infrastructure?.database,rt=P.size,st=(rt?o.InstanceSize.specs[rt]:void 0)?.instanceType||rt||"t3.micro";if(!this.builder.hasResource("VPC"))this.generateNetworkInfrastructure(l,S);let cr=this.buildCaddyfile(v),lr=o.UserData.generateBunAppScript({runtime:P.runtime||"bun",runtimeVersion:P.runtimeVersion||"latest",systemPackages:P.systemPackages,database:Ie,caddyfile:cr}),gr=Es(P.appUpdates),Dt=gr.length>0?`${lr}
+`)}normalizeMountPath(l){let S=l?.mountPath||l?.path;if(!S||S==="/")return;let P=`/${S}`.replace(/\/+/g,"/").replace(/\/$/,"");return P==="/"?void 0:P}storageBucketLogicalId(l,S,P){return`${l}-${S}-s3-${P}`.split(/[^a-zA-Z0-9]+/).filter(Boolean).map((v)=>v.charAt(0).toUpperCase()+v.slice(1)).join("")}pathMountRewriteFunctionCode(l,S="directory"){return`function handler(event) { var request = event.request; var prefix = ${JSON.stringify(l)}; var rewriteStyle = ${JSON.stringify(S)}; var uri = request.uri; if (uri === prefix) { uri = '/'; } else if (uri.indexOf(prefix + '/') === 0) { uri = uri.substring(prefix.length); } if (uri === '' || uri === '/') { request.uri = '/index.html'; return request; } if (uri.endsWith('/')) { request.uri = uri + 'index.html'; return request; } var lastSegment = uri.substring(uri.lastIndexOf('/') + 1); if (lastSegment.indexOf('.') === -1) { request.uri = rewriteStyle === 'flat' ? uri + '.html' : uri + '/index.html'; return request; } request.uri = uri; return request; }`}generate(){let l=this.mergedConfig.project.slug,S=this.environment,P=!!(this.mergedConfig.infrastructure?.functions&&Object.keys(this.mergedConfig.infrastructure.functions).length>0||this.mergedConfig.infrastructure?.api),v=!!(this.mergedConfig.infrastructure?.servers&&Object.keys(this.mergedConfig.infrastructure.servers).length>0),E=!!this.mergedConfig.infrastructure?.compute;if(!!((this.mergedConfig.mode||"server")==="serverless"&&this.mergedConfig.infrastructure?.containers&&Object.keys(this.mergedConfig.infrastructure.containers).length>0))this.generateNetworkInfrastructure(l,S),this.generateContainerInfrastructure(l,S);if(P)this.generateServerless(l,S);if(v)this.generateServer(l,S);if(E)this.generateComputeApp(l,S);if(this.mergedConfig.infrastructure?.jumpBox)this.generateJumpBox(l,S);if(this.storageFailoverReplicas=[],this.generateSharedInfrastructure(l,S),this.storageFailoverReplicas.length>0)this.builder.addMetadata(wd,this.storageFailoverReplicas);if(this.config.tags)this.applyGlobalTags(this.config.tags);return this}getStorageFailoverReplicas(){return[...this.storageFailoverReplicas]}applyGlobalTags(l){}generateNetworkInfrastructure(l,S){if(this.builder.hasResource("VPC"))return;let v=this.mergedConfig.infrastructure?.network?.cidr||"10.0.0.0/16",{vpc:E,logicalId:ot}=f.createVpc({slug:l,environment:S,cidr:v,enableDnsHostnames:!0,enableDnsSupport:!0});this.builder.addResource("VPC",E);let Ie=`${l}${S}IGW`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Ie,{Type:"AWS::EC2::InternetGateway",Properties:{Tags:[{Key:"Name",Value:`${l}-${S}-igw`},{Key:"Environment",Value:S}]}});let Ne=`${l}${S}IGWAttach`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Ne,{Type:"AWS::EC2::VPCGatewayAttachment",Properties:{VpcId:{Ref:"VPC"},InternetGatewayId:{Ref:Ie}}});let nt=`${l}${S}PublicRT`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(nt,{Type:"AWS::EC2::RouteTable",Properties:{VpcId:{Ref:"VPC"},Tags:[{Key:"Name",Value:`${l}-${S}-public-rt`},{Key:"Environment",Value:S}]}}),this.builder.addResource(`${l}${S}PublicRoute`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::EC2::Route",Properties:{RouteTableId:{Ref:nt},DestinationCidrBlock:"0.0.0.0/0",GatewayId:{Ref:Ie}},DependsOn:Ne});let Pt=this.mergedConfig.environments[S]?.region||this.mergedConfig.project.region||"us-east-1",st=["a","b"];for(let ur=0;ur<2;ur++){let pr=`PublicSubnet${ur+1}`;this.builder.addResource(pr,{Type:"AWS::EC2::Subnet",Properties:{VpcId:{Ref:"VPC"},CidrBlock:`10.0.${ur}.0/24`,AvailabilityZone:`${Pt}${st[ur]}`,MapPublicIpOnLaunch:!0,Tags:[{Key:"Name",Value:`${l}-${S}-public-${st[ur]}`},{Key:"Environment",Value:S}]}}),this.builder.addResource(`${pr}RTAssoc`,{Type:"AWS::EC2::SubnetRouteTableAssociation",Properties:{SubnetId:{Ref:pr},RouteTableId:{Ref:nt}}})}}generateContainerInfrastructure(l,S){let P=this.mergedConfig.infrastructure?.containers;if(!P)return;let v=this.mergedConfig.infrastructure?.loadBalancer,E=this.mergedConfig.infrastructure?.ssl,ot=this.mergedConfig.infrastructure?.dns,Ie;if(E?.enabled&&E.domains?.length)if(E.certificateArn);else{let st=E.domains[0],ur=E.domains.slice(1).map((Dt)=>{if(Dt.includes(".")&&Dt.endsWith(st))return Dt.replace(`.${st}`,"");return Dt}),{certificate:pr,logicalId:gr}=I.createCertificate({domain:st,subdomains:ur,slug:l,environment:S,validationMethod:"DNS",hostedZoneId:ot?.hostedZoneId});Ie=gr,this.builder.addResource(gr,pr)}let Ne="ECSCluster";this.builder.addResource(Ne,{Type:"AWS::ECS::Cluster",Properties:{ClusterName:`${l}-${S}`,ClusterSettings:[{Name:"containerInsights",Value:"enabled"}],Tags:[{Key:"Name",Value:`${l}-${S}`},{Key:"Environment",Value:S}]}});let nt=`${l}${S}ALBSecurityGroup`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(nt,{Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:`ALB security group for ${l}-${S}`,VpcId:{Ref:"VPC"},SecurityGroupIngress:[{IpProtocol:"tcp",FromPort:80,ToPort:80,CidrIp:"0.0.0.0/0",Description:"HTTP"},{IpProtocol:"tcp",FromPort:443,ToPort:443,CidrIp:"0.0.0.0/0",Description:"HTTPS"}],SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:`${l}-${S}-alb-sg`},{Key:"Environment",Value:S}]}});let Pt=`${l}${S}ECSSecurityGroup`.replace(/[^a-zA-Z0-9]/g,"");for(let[st,ur]of Object.entries(P)){let pr=ur.port||3000;this.builder.addResource(Pt,{Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:`ECS tasks security group for ${l}-${S}`,VpcId:{Ref:"VPC"},SecurityGroupIngress:[{IpProtocol:"tcp",FromPort:pr,ToPort:pr,SourceSecurityGroupId:{Ref:nt},Description:"Allow traffic from ALB"}],SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:`${l}-${S}-ecs-sg`},{Key:"Environment",Value:S}]}});let gr=`${l}${S}TaskExecRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(gr,{Type:"AWS::IAM::Role",Properties:{RoleName:`${l}-${S}-ecs-exec-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"],Policies:[{PolicyName:"ECRPullPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["ecr:GetAuthorizationToken","ecr:BatchCheckLayerAvailability","ecr:GetDownloadUrlForLayer","ecr:BatchGetImage","logs:CreateLogStream","logs:PutLogEvents"],Resource:"*"}]}}]}});let Dt=`${l}${S}TaskRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Dt,{Type:"AWS::IAM::Role",Properties:{RoleName:`${l}-${S}-ecs-task-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"TaskPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:"*"},{Effect:"Allow",Action:["s3:GetObject","s3:PutObject","s3:ListBucket"],Resource:"*"}]}}]}});let St=`${l}${S}${st}LogGroup`.replace(/[^a-zA-Z0-9]/g,""),Se=`/ecs/${l}-${S}-${st}`;this.builder.addResource(St,{Type:"AWS::Logs::LogGroup",Properties:{LogGroupName:Se,RetentionInDays:30}});let Bt=`${l}${S}${st}TaskDef`.replace(/[^a-zA-Z0-9]/g,""),ie=String(ur.cpu||512),Rt=String(ur.memory||1024);this.builder.addResource(Bt,{Type:"AWS::ECS::TaskDefinition",Properties:{Family:`${l}-${S}-${st}`,NetworkMode:"awsvpc",RequiresCompatibilities:["FARGATE"],Cpu:ie,Memory:Rt,ExecutionRoleArn:{"Fn::GetAtt":[gr,"Arn"]},TaskRoleArn:{"Fn::GetAtt":[Dt,"Arn"]},ContainerDefinitions:[{Name:st,Image:{"Fn::Sub":`\${AWS::AccountId}.dkr.ecr.\${AWS::Region}.amazonaws.com/${l}:latest`},Essential:!0,PortMappings:[{ContainerPort:pr,Protocol:"tcp"}],LogConfiguration:{LogDriver:"awslogs",Options:{"awslogs-group":Se,"awslogs-region":{Ref:"AWS::Region"},"awslogs-stream-prefix":st}},HealthCheck:{Command:["CMD-SHELL",`curl -f http://localhost:${pr}${ur.healthCheck||"/health"} || exit 1`],Interval:30,Timeout:5,Retries:3,StartPeriod:60}}],Tags:[{Key:"Name",Value:`${l}-${S}-${st}`},{Key:"Environment",Value:S}]},DependsOn:[gr,Dt,St]});let Nt=`${l}${S}ALB`.replace(/[^a-zA-Z0-9]/g,"");if(v?.enabled!==!1){this.builder.addResource(Nt,{Type:"AWS::ElasticLoadBalancingV2::LoadBalancer",Properties:{Name:`${l}-${S}-alb`,Scheme:"internet-facing",Type:"application",Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}],SecurityGroups:[{Ref:nt}],Tags:[{Key:"Name",Value:`${l}-${S}-alb`},{Key:"Environment",Value:S}]}});let er=`${l}${S}TargetGroup`.replace(/[^a-zA-Z0-9]/g,""),lr=v?.healthCheck?.path||ur.healthCheck||"/health";this.builder.addResource(er,{Type:"AWS::ElasticLoadBalancingV2::TargetGroup",Properties:{Name:`${l}-${S}-tg`,Port:pr,Protocol:"HTTP",VpcId:{Ref:"VPC"},TargetType:"ip",HealthCheckPath:lr,HealthCheckIntervalSeconds:v?.healthCheck?.interval||30,HealthyThresholdCount:v?.healthCheck?.healthyThreshold||2,UnhealthyThresholdCount:v?.healthCheck?.unhealthyThreshold||5,HealthCheckTimeoutSeconds:10,Tags:[{Key:"Name",Value:`${l}-${S}-tg`},{Key:"Environment",Value:S}]}});let fr=`${l}${S}HTTPListener`.replace(/[^a-zA-Z0-9]/g,"");if(E?.enabled&&E?.redirectHttp)this.builder.addResource(fr,{Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:{Ref:Nt},Port:80,Protocol:"HTTP",DefaultActions:[{Type:"redirect",RedirectConfig:{Protocol:"HTTPS",Port:"443",StatusCode:"HTTP_301"}}]}});else this.builder.addResource(fr,{Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:{Ref:Nt},Port:80,Protocol:"HTTP",DefaultActions:[{Type:"forward",TargetGroupArn:{Ref:er}}]}});if(E?.enabled){let br=E.certificateArn||(Ie?{Ref:Ie}:void 0);if(br){let Wi=`${l}${S}HTTPSListener`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Wi,{Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:{Ref:Nt},Port:443,Protocol:"HTTPS",Certificates:[{CertificateArn:br}],DefaultActions:[{Type:"forward",TargetGroupArn:{Ref:er}}],SslPolicy:"ELBSecurityPolicy-TLS13-1-2-2021-06"}})}}let Cr=`${l}${S}${st}Service`.replace(/[^a-zA-Z0-9]/g,""),vr=ur.desiredCount||1;this.builder.addResource(Cr,{Type:"AWS::ECS::Service",Properties:{ServiceName:`${l}-${S}-${st}`,Cluster:{Ref:Ne},TaskDefinition:{Ref:Bt},DesiredCount:vr,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{AssignPublicIp:"ENABLED",SecurityGroups:[{Ref:Pt}],Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]}},LoadBalancers:[{ContainerName:st,ContainerPort:pr,TargetGroupArn:{Ref:er}}],HealthCheckGracePeriodSeconds:120,Tags:[{Key:"Name",Value:`${l}-${S}-${st}`},{Key:"Environment",Value:S}]},DependsOn:[Bt,fr,er]});let an=ur.autoScaling;if(an){let br=`${l}${S}${st}ScalableTarget`.replace(/[^a-zA-Z0-9]/g,"");if(this.builder.addResource(br,{Type:"AWS::ApplicationAutoScaling::ScalableTarget",Properties:{MaxCapacity:an.max||10,MinCapacity:an.min||1,ResourceId:{"Fn::Sub":`service/\${${Ne}}/${l}-${S}-${st}`},ScalableDimension:"ecs:service:DesiredCount",ServiceNamespace:"ecs",RoleARN:{"Fn::Sub":"arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService"}},DependsOn:Cr}),an.targetCpuUtilization)this.builder.addResource(`${l}${S}${st}CPUScaling`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::ApplicationAutoScaling::ScalingPolicy",Properties:{PolicyName:`${l}-${S}-${st}-cpu-scaling`,PolicyType:"TargetTrackingScaling",ScalingTargetId:{Ref:br},TargetTrackingScalingPolicyConfiguration:{PredefinedMetricSpecification:{PredefinedMetricType:"ECSServiceAverageCPUUtilization"},TargetValue:an.targetCpuUtilization,ScaleInCooldown:300,ScaleOutCooldown:60}}});if(an.targetMemoryUtilization)this.builder.addResource(`${l}${S}${st}MemoryScaling`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::ApplicationAutoScaling::ScalingPolicy",Properties:{PolicyName:`${l}-${S}-${st}-memory-scaling`,PolicyType:"TargetTrackingScaling",ScalingTargetId:{Ref:br},TargetTrackingScalingPolicyConfiguration:{PredefinedMetricSpecification:{PredefinedMetricType:"ECSServiceAverageMemoryUtilization"},TargetValue:an.targetMemoryUtilization,ScaleInCooldown:300,ScaleOutCooldown:60}}})}if(ot?.domain&&ot?.hostedZoneId)this.builder.addResource(`${l}${S}ApiDnsRecord`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:ot.hostedZoneId,Name:`api.${ot.domain}`,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":[Nt,"DNSName"]},HostedZoneId:{"Fn::GetAtt":[Nt,"CanonicalHostedZoneID"]}}}});this.builder.addOutput("ECSClusterArn",{Description:"ECS Cluster ARN",Value:{"Fn::GetAtt":[Ne,"Arn"]},Export:{Name:{"Fn::Sub":"${AWS::StackName}-ecs-cluster-arn"}}}),this.builder.addOutput("ECSServiceName",{Description:"ECS Service Name",Value:`${l}-${S}-${st}`,Export:{Name:{"Fn::Sub":"${AWS::StackName}-ecs-service-name"}}}),this.builder.addOutput("LoadBalancerDNS",{Description:"Application Load Balancer DNS Name",Value:{"Fn::GetAtt":[Nt,"DNSName"]},Export:{Name:{"Fn::Sub":"${AWS::StackName}-alb-dns"}}})}else{let er=`${l}${S}${st}Service`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(er,{Type:"AWS::ECS::Service",Properties:{ServiceName:`${l}-${S}-${st}`,Cluster:{Ref:Ne},TaskDefinition:{Ref:Bt},DesiredCount:ur.desiredCount||1,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{AssignPublicIp:"ENABLED",SecurityGroups:[{Ref:Pt}],Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]}},Tags:[{Key:"Name",Value:`${l}-${S}-${st}`},{Key:"Environment",Value:S}]},DependsOn:[Bt]})}break}}generateServerless(l,S){if(this.mergedConfig.infrastructure?.functions)for(let[P,v]of Object.entries(this.mergedConfig.infrastructure.functions)){if(!this.shouldDeploy(v))continue;let{role:E,logicalId:ot}=Y.createRole({slug:l,environment:S,roleName:`${l}-${S}-${P}-role`,servicePrincipal:"lambda.amazonaws.com",managedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"]});this.builder.addResource(ot,E);let{lambdaFunction:Ie,logicalId:Ne}=a.createLambdaFunction({slug:l,environment:S,functionName:`${l}-${S}-${P}`,handler:v.handler||"index.handler",runtime:v.runtime||"nodejs20.x",code:{zipFile:v.code||"export const handler = async () => ({ statusCode: 200 });"},role:ot,timeout:v.timeout,memorySize:v.memorySize});this.builder.addResource(Ne,Ie)}if(this.mergedConfig.infrastructure?.api){let{restApi:P,logicalId:v}=Pd.createRestApi({slug:l,environment:S,apiName:`${l}-${S}-api`});this.builder.addResource(v,P)}}generateServer(l,S){if(!this.mergedConfig.infrastructure?.servers)return;let P=this.mergedConfig.infrastructure.servers,v=this.mergedConfig.infrastructure?.compute,E=this.mergedConfig.infrastructure?.ssl;if(Object.values(P).some((Ie)=>!Ie.privateNetwork||Ie.privateNetwork==="create"))this.generateNetworkInfrastructure(l,S);for(let[Ie,Ne]of Object.entries(P)){let nt=Ne.instanceType||Ne.size||v?.size,st=(nt?a.InstanceSize.specs[nt]:void 0)?.instanceType||nt||"t3.micro",ur=Ne.type||"app",pr=Ne.userData||Ne.startupScript;if(!pr)pr=a.UserData.generateAppServerScript({runtime:"bun",runtimeVersion:Ne.bunVersion||"latest",webServer:"none",domain:Ne.domain,enableSsl:!!E?.enabled,sslEmail:E?.letsEncrypt?.email,installRedis:ur==="cache",installDatabaseClients:!!Ne.database});let gr=Ne.privateNetwork&&Ne.privateNetwork!=="create"?Ne.privateNetwork:{Ref:"VPC"},Dt=Ne.subnet||{Ref:"PublicSubnet1"},Se=!!this.mergedConfig.infrastructure?.email?.server?.enabled,Bt=[22,80,443,this.resolveApiOriginPort()];if(Se)Bt.push(25,465,587,143,993);let ie=a.createServerModeStack({slug:`${l}-${Ie}`,environment:S,vpcId:gr,subnetId:Dt,instanceType:st,keyName:Ne.keyName||`${l}-${S}`,domain:Ne.domain,userData:pr,volumeSize:Ne.diskSize||20,imageId:Ne.image,allowedPorts:Bt});for(let[Rt,Nt]of Object.entries(ie.resources))this.builder.addResource(Rt,Nt);this.serverEipLogicalIds.set(Ie,ie.outputs.eipLogicalId),this.serverEipLogicalIds.set(`${Ie}Instance`,ie.outputs.instanceLogicalId),this.builder.addOutput(`${Ie}InstanceId`,{Value:{Ref:ie.outputs.instanceLogicalId},Description:`Instance ID for ${Ie} server`}),this.builder.addOutput(`${Ie}PublicIp`,{Value:{Ref:ie.outputs.eipLogicalId},Description:`Public IP for ${Ie} server`})}}generateComputeApp(l,S){let P=this.mergedConfig.infrastructure?.compute;if(!P)return;let v=this.mergedConfig.sites||{},E=Object.entries(v),Ie=this.mergedConfig.infrastructure?.dns?.domain,Ne=this.mergedConfig.infrastructure?.database,nt=P.size,st=(nt?a.InstanceSize.specs[nt]:void 0)?.instanceType||nt||"t3.micro";if(!this.builder.hasResource("VPC"))this.generateNetworkInfrastructure(l,S);let ur=this.buildCaddyfile(E),pr=a.UserData.generateBunAppScript({runtime:P.runtime||"bun",runtimeVersion:P.runtimeVersion||"latest",systemPackages:P.systemPackages,database:Ne,caddyfile:ur}),gr=vs(P.appUpdates),Dt=gr.length>0?`${pr}
 ${gr.join(`
 `)}
-`:lr,Rt=v.map(([,ar])=>ar.port).filter((ar)=>typeof ar==="number"&&![80,443].includes(ar)),Se=this.resolveApiOriginPort(),kt=`${l}${S}DeployBucket`.replace(/[^a-zA-Z0-9]/g,""),ie=`${l}-${S}-deploy`;this.builder.addResource(kt,{Type:"AWS::S3::Bucket",Properties:{BucketName:ie,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0},LifecycleConfiguration:{Rules:[{Id:"expire-old-releases",Status:"Enabled",ExpirationInDays:7,Prefix:"releases/"}]},Tags:[{Key:"Project",Value:l},{Key:"Environment",Value:S},{Key:"ManagedBy",Value:"ts-cloud"}]}});let It=o.createServerModeStack({slug:`${l}-app`,environment:S,vpcId:{Ref:"VPC"},subnetId:{Ref:"PublicSubnet1"},instanceType:st,keyName:P.allowSsh?`${l}-${S}`:void 0,domain:Pe,userData:Dt,volumeSize:P.disk?.size||20,imageId:P.image,allowedPorts:[...P.allowSsh?[22]:[],80,443,Se,...Rt]}),wt=It.resources[It.outputs.instanceLogicalId];if(wt?.Properties){let ar=wt.Properties.Tags||[];wt.Properties.Tags=[...ar,{Key:"Project",Value:l},{Key:"Environment",Value:S},{Key:"Role",Value:"app"},{Key:"ManagedBy",Value:"ts-cloud"}]}let Xt=It.resources[It.outputs.roleLogicalId];if(Xt?.Properties)Xt.Properties.Policies=Xt.Properties.Policies||[],Xt.Properties.Policies.push({PolicyName:"DeployBucketRead",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["s3:GetObject","s3:ListBucket"],Resource:[`arn:aws:s3:::${ie}`,`arn:aws:s3:::${ie}/*`]}]}});for(let[ar,dr]of Object.entries(It.resources))this.builder.addResource(ar,dr);this.builder.addOutput("deployBucketName",{Value:{Ref:kt},Description:"S3 bucket where release tarballs are uploaded"}),this.builder.addOutput("appInstanceId",{Value:{Ref:It.outputs.instanceLogicalId},Description:"EC2 instance ID for the app server"}),this.builder.addOutput("appPublicIp",{Value:{Ref:It.outputs.eipLogicalId},Description:"Public IP for the app server"}),this.serverEipLogicalIds.set("app",It.outputs.eipLogicalId),this.serverEipLogicalIds.set("appInstance",It.outputs.instanceLogicalId)}generateJumpBox(l,S){let P=this.mergedConfig.infrastructure?.jumpBox;if(!P)return;let E=P===!0?{}:P;if(E.enabled===!1)return;this.generateNetworkInfrastructure(l,S);let v=E.size||"micro",Pe=o.InstanceSize.specs[v]?.instanceType||v||"t3.micro",Ie;if(E.mountEfs)Ie={fileSystemId:typeof E.mountEfs==="string"?E.mountEfs:{Ref:"FileSystem"},mountPath:E.mountPath||"/mnt/efs"};let rt;if(E.databaseTools)rt=o.JumpBox.withDatabaseTools({slug:l,environment:S,vpcId:{Ref:"VPC"},subnetId:{Ref:"PublicSubnet1"},keyName:E.keyName||`${l}-${S}`,allowedCidrs:E.allowedCidrs});else if(Ie)rt=o.JumpBox.withEfsMount({slug:l,environment:S,vpcId:{Ref:"VPC"},subnetId:{Ref:"PublicSubnet1"},keyName:E.keyName||`${l}-${S}`,fileSystemId:Ie.fileSystemId,mountPath:Ie.mountPath,allowedCidrs:E.allowedCidrs});else rt=o.createJumpBox({slug:l,environment:S,vpcId:{Ref:"VPC"},subnetId:{Ref:"PublicSubnet1"},keyName:E.keyName||`${l}-${S}`,instanceType:Pe,allowedCidrs:E.allowedCidrs,mountEfs:Ie});for(let[Pt,st]of Object.entries(rt.resources))this.builder.addResource(Pt,st);this.builder.addOutput("JumpBoxInstanceId",{Value:{Ref:rt.instanceLogicalId},Description:"The ID of the JumpBox EC2 instance (use with SSM Session Manager or SSH)"})}generateSharedInfrastructure(l,S){let P=this.mergedConfig.infrastructure?.ssl,E=this.mergedConfig.infrastructure?.dns,v=E?.domain,it=E?.hostedZoneId,Pe=[],Ie,rt;if(P?.certificateArn)rt=P.certificateArn;else if(P?.enabled&&v&&it){let Rt=P.domains||[v],Se=Rt[0],kt=Rt.slice(1).map((wt)=>{if(wt.includes(".")&&wt.endsWith(Se))return wt.replace(`.${Se}`,"");return wt}),{certificate:ie,logicalId:It}=I.createCertificate({domain:Se,subdomains:kt,slug:l,environment:S,validationMethod:"DNS",hostedZoneId:it});Ie=It,this.builder.addResource(It,ie)}if(this.mergedConfig.infrastructure?.storage){let Rt=Object.entries(this.mergedConfig.infrastructure.storage).some(([,ie])=>ie.website),Se;if(Rt&&(Ie||rt))Se=`${l}${S}CloudFrontOAC`.replace(/[^a-zA-Z0-9]/g,""),this.builder.addResource(Se,{Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`${l}-${S}-s3-oac`,Description:`OAC for ${l} ${S} S3 website buckets`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}});let kt=Object.entries(this.mergedConfig.infrastructure.storage).map(([ie,It])=>({name:ie,config:It,mountPath:this.normalizeMountPath(It),rewriteStyle:It.pathRewriteStyle||"directory",logicalId:this.storageBucketLogicalId(l,S,ie)})).filter((ie)=>ie.name!=="public"&&ie.config.website&&ie.mountPath);for(let[ie,It]of Object.entries(this.mergedConfig.infrastructure.storage)){let wt=!!(It.website&&Se),Xt=this.storageBucketName(l,S,ie),{bucket:ar,logicalId:dr}=ve.createBucket({slug:l,name:ie,environment:S,bucketName:Xt,versioning:It.versioning,encryption:It.encryption,public:wt?!1:It.public});if(wt&&ar.Properties)ar.Properties.PublicAccessBlockConfiguration={BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!1,RestrictPublicBuckets:!1};if(this.builder.addResource(dr,ar),It.website){let Sr=typeof It.website==="object"?It.website:{},yr=ve.enableWebsiteHosting(ar,Sr.indexDocument||"index.html",Sr.errorDocument);this.builder.addResource(dr,yr)}let Cr=this.normalizeMountPath(It);if(wt&&Se&&v&&!(Cr&&ie!=="public")){let Sr=`${l}${S}${ie}CDN`.replace(/[^a-zA-Z0-9]/g,""),yr=[];if(It.aliases&&It.aliases.length>0)yr.push(...It.aliases);else if(ie==="public"){if(yr.push(v),P?.domains?.includes(`www.${v}`))yr.push(`www.${v}`)}else if(ie==="docs")yr.push(`docs.${v}`);else if(ie==="blog")yr.push(`blog.${v}`);let dn=typeof It.website==="object"?It.website:{},bn=It.spa===!0,Dn=dn.errorDocument||(bn?"index.html":"404.html"),zn=[];if(bn)zn.push({ErrorCode:403,ResponseCode:200,ResponsePagePath:"/index.html",ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:200,ResponsePagePath:"/index.html",ErrorCachingMinTTL:300});else zn.push({ErrorCode:403,ResponseCode:404,ResponsePagePath:`/${Dn}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:404,ResponsePagePath:`/${Dn}`,ErrorCachingMinTTL:300});let kn=rt&&yr.length>0?{AcmCertificateArn:rt,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:Ie&&yr.length>0?{AcmCertificateArn:{Ref:Ie},SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:{CloudFrontDefaultCertificate:!0},Vi=`S3-${l}-${S}-${ie}`,Fn=this.mergedConfig.project.region||"us-east-1",Mn;if(!bn)Mn=`${l}${S}${ie}UrlRewrite`.replace(/[^a-zA-Z0-9]/g,""),this.builder.addResource(Mn,{Type:"AWS::CloudFront::Function",Properties:{Name:`${l}-${S}-${ie}-url-rewrite`,AutoPublish:!0,FunctionConfig:{Comment:`URL rewrite for ${l} ${S} ${ie} - appends .html to extensionless paths`,Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) { var request = event.request; var uri = request.uri; if (uri.endsWith('/')) { request.uri += 'index.html'; }
-else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`}});let Xa=[{Id:Vi,DomainName:{"Fn::Sub":`\${${dr}}.s3.${Fn}.amazonaws.com`},OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:Se}}],ma=[],Qa=[];if(this.shouldRouteStorageBucketToCompute(ie,It)){this.appendComputeAppOrigin(Xa,ma,Qa,l,S,this.resolveComputeCachePathPatterns(It.computeRoutes));for(let nn of kt){let Fa=`S3-${l}-${S}-${nn.name}`,ts=`${l}${S}${nn.name}PathMountRewrite`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(ts,{Type:"AWS::CloudFront::Function",Properties:{Name:`${l}-${S}-${nn.name}-path-mount-rewrite`,AutoPublish:!0,FunctionConfig:{Comment:`Path mount rewrite for ${l} ${S} ${nn.name} at ${nn.mountPath}`,Runtime:"cloudfront-js-2.0"},FunctionCode:this.pathMountRewriteFunctionCode(nn.mountPath,nn.rewriteStyle)}}),Xa.push({Id:Fa,DomainName:{"Fn::Sub":`\${${nn.logicalId}}.s3.${Fn}.amazonaws.com`},OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:Se}}),Qa.push(nn.logicalId,ts);for(let yc of[nn.mountPath,`${nn.mountPath}/*`])ma.push({PathPattern:yc,TargetOriginId:Fa,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":[ts,"FunctionARN"]}}]})}}let vs={Type:"AWS::CloudFront::Distribution",DependsOn:[dr,Se,...Mn?[Mn]:[],...Qa],Properties:{DistributionConfig:{Enabled:!0,Comment:`${l} ${S} ${ie} site`,DefaultRootObject:"index.html",Origins:Xa,DefaultCacheBehavior:{TargetOriginId:Vi,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6",...Mn?{FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":[Mn,"FunctionARN"]}}]}:{}},...ma.length>0?{CacheBehaviors:ma}:{},...yr.length>0?{Aliases:yr}:{},ViewerCertificate:kn,PriceClass:"PriceClass_100",HttpVersion:"http2and3",IPV6Enabled:!0,CustomErrorResponses:zn}}};if(Ie)vs.DependsOn.push(Ie);this.builder.addResource(Sr,vs);let hc=`${dr}CloudFrontPolicy`;if(this.builder.addResource(hc,{Type:"AWS::S3::BucketPolicy",DependsOn:[dr,Sr],Properties:{Bucket:{Ref:dr},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":`arn:aws:s3:::\${${dr}}/*`},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":`arn:aws:cloudfront::\${AWS::AccountId}:distribution/\${${Sr}}`}}}}]}}}),this.shouldRouteStorageBucketToCompute(ie,It))for(let nn of kt){let Fa=`${nn.logicalId}CloudFrontPolicy`;this.builder.addResource(Fa,{Type:"AWS::S3::BucketPolicy",DependsOn:[nn.logicalId,Sr],Properties:{Bucket:{Ref:nn.logicalId},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":`arn:aws:s3:::\${${nn.logicalId}}/*`},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":`arn:aws:cloudfront::\${AWS::AccountId}:distribution/\${${Sr}}`}}}}]}}})}if(yr.length>0)Pe.push({name:ie,bucketLogicalId:dr,distLogicalId:Sr,oacLogicalId:Se,aliases:yr});this.builder.addOutput(`${ie}CloudFrontDomain`,{Value:{"Fn::GetAtt":[Sr,"DomainName"]},Description:`CloudFront domain for ${ie}`}),this.builder.addOutput(`${ie}CloudFrontDistributionId`,{Value:{Ref:Sr},Description:`CloudFront distribution ID for ${ie}`})}if(this.builder.addOutput(`${ie}BucketName`,{Value:{Ref:dr},Description:`S3 bucket name for ${ie}`}),ie==="public")this.builder.addOutput("FrontendBucketName",{Value:{Ref:dr},Description:"Frontend S3 bucket name"});if(ie==="docs")this.builder.addOutput("DocsBucketName",{Value:{Ref:dr},Description:"Documentation S3 bucket name"});if(ie==="blog")this.builder.addOutput("BlogBucketName",{Value:{Ref:dr},Description:"Blog S3 bucket name"})}}if(this.mergedConfig.infrastructure?.sftp){let Rt=this.mergedConfig.infrastructure.sftp,Se=Ed.create({...Rt,storage:this.resolveSftpStorage(Rt,l,S)??Rt.storage,slug:l,environment:S});for(let[kt,ie]of Object.entries(Se.resources))this.builder.addResource(kt,ie);this.builder.addOutput("SftpServerId",{Value:{Ref:Se.serverLogicalId},Description:"AWS Transfer Family SFTP server ID"}),this.builder.addOutput("SftpEndpoint",{Value:{"Fn::Sub":`\${${Se.serverLogicalId}}.server.transfer.\${AWS::Region}.amazonaws.com`},Description:"AWS Transfer Family SFTP endpoint"}),this.builder.addOutput("SftpStorageDomain",{Value:Se.domain,Description:"Storage backing the SFTP server (EFS or S3)"})}if(it&&Pe.length>0)for(let{name:Rt,distLogicalId:Se,aliases:kt}of Pe)for(let ie of kt){let It=ie.replace(/\./g,"").replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${It}ARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[Se],Properties:{HostedZoneId:it,Name:ie,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":[Se,"DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}}),this.builder.addResource(`${It}AAAARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[Se],Properties:{HostedZoneId:it,Name:ie,Type:"AAAA",AliasTarget:{DNSName:{"Fn::GetAtt":[Se,"DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}})}if(this.mergedConfig.infrastructure?.databases){for(let[Rt,Se]of Object.entries(this.mergedConfig.infrastructure.databases))if(Se.engine==="dynamodb"){let{table:kt,logicalId:ie}=Ut.createTable({slug:l,environment:S,tableName:`${l}-${S}-${Rt}`,partitionKey:Se.partitionKey||{name:"id",type:"S"},sortKey:Se.sortKey});this.builder.addResource(ie,kt)}else if(Se.engine==="postgres"){let{dbInstance:kt,logicalId:ie}=Ut.createPostgres({slug:l,environment:S,dbInstanceIdentifier:`${l}-${S}-${Rt}`,masterUsername:Se.username||"admin",masterUserPassword:Se.password||"changeme123",allocatedStorage:Se.storage||20,dbInstanceClass:Se.instanceClass||"db.t3.micro"});this.builder.addResource(ie,kt)}else if(Se.engine==="mysql"){let{dbInstance:kt,logicalId:ie}=Ut.createMysql({slug:l,environment:S,dbInstanceIdentifier:`${l}-${S}-${Rt}`,masterUsername:Se.username||"admin",masterUserPassword:Se.password||"changeme123",allocatedStorage:Se.storage||20,dbInstanceClass:Se.instanceClass||"db.t3.micro"});this.builder.addResource(ie,kt)}}if(this.mergedConfig.infrastructure?.cdn)for(let[Rt,Se]of Object.entries(this.mergedConfig.infrastructure.cdn)){if(!Se.origin)continue;let kt=typeof Se.customDomain==="string"?Se.customDomain:Se.customDomain?.domain||Se.domain,ie=typeof Se.customDomain==="object"?Se.customDomain?.certificateArn:Se.certificateArn,It=ie||rt,wt=`${l}${S}${Rt}CDN`.replace(/[^a-zA-Z0-9]/g,""),Xt=`S3-${l}-${S}-${Rt}-cdn`,ar=[{Id:Xt,DomainName:Se.origin,OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginShield:Se.originShield?{Enabled:!0,OriginShieldRegion:Se.originShieldRegion||this.mergedConfig.environments[S]?.region||this.mergedConfig.project.region||"us-east-1"}:{Enabled:!1}}],dr=[],Cr=[],Sr=["GET","HEAD","OPTIONS"],yr=Xt,dn;if(Se.failoverOrigin){Lr(Sr,`the default cache behavior of infrastructure.cdn.${Rt}`);let kn=`${Xt}-failover`;ar.push({Id:kn,DomainName:Se.failoverOrigin,OriginPath:"",...Cd(Se.failoverOrigin)?{S3OriginConfig:{OriginAccessIdentity:""}}:{CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:"https-only"}},OriginShield:{Enabled:!1}}),dn=Ci({primaryOriginId:Xt,secondaryOriginId:kn,statusCodes:Se.failoverStatusCodes}),yr=dn.Items[0].Id}else if(Se.failoverStatusCodes)throw Error(`infrastructure.cdn.${Rt}: failoverStatusCodes needs failoverOrigin to fail over to`);if(Se.routeCompute)this.appendComputeAppOrigin(ar,dr,Cr,l,S,this.resolveComputeCachePathPatterns(Se.computeRoutes));let bn=It&&kt?{AcmCertificateArn:Ie&&!ie?{Ref:Ie}:It,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:{CloudFrontDefaultCertificate:!0},Dn=[...Cr];if(Ie&&!ie&&kt)Dn.push(Ie);let zn={Type:"AWS::CloudFront::Distribution",...Dn.length>0?{DependsOn:Dn}:{},Properties:{DistributionConfig:{Enabled:!0,Comment:`${l} ${S} ${Rt} CDN`,DefaultRootObject:"index.html",Origins:ar,...dn?{OriginGroups:dn}:{},DefaultCacheBehavior:{TargetOriginId:yr,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:Sr,CachedMethods:["GET","HEAD","OPTIONS"],Compress:Se.compress!==!1,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6"},...dr.length>0?{CacheBehaviors:dr}:{},...kt&&It?{Aliases:[kt]}:{},ViewerCertificate:bn,PriceClass:"PriceClass_100",HttpVersion:Se.http3?"http2and3":"http2"}}};if(this.builder.addResource(wt,zn),it&&kt&&It){let kn=kt.replace(/\./g,"").replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${kn}CdnARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[wt,...Ie&&!ie?[Ie]:[]],Properties:{HostedZoneId:it,Name:kt,Type:"A",AliasTarget:{HostedZoneId:"Z2FDTNDATAQYW2",DNSName:{"Fn::GetAtt":[wt,"DomainName"]}}}})}}if(this.mergedConfig.infrastructure?.queues)for(let[Rt,Se]of Object.entries(this.mergedConfig.infrastructure.queues)){if(!this.shouldDeploy(Se))continue;let{queue:kt,logicalId:ie}=M.createQueue({slug:l,environment:S,name:`${l}-${S}-${Rt}`,fifo:Se.fifo,visibilityTimeout:Se.visibilityTimeout,messageRetentionPeriod:Se.messageRetentionPeriod,delaySeconds:Se.delaySeconds,maxMessageSize:Se.maxMessageSize,receiveMessageWaitTime:Se.receiveMessageWaitTime,contentBasedDeduplication:Se.contentBasedDeduplication,encrypted:Se.encrypted,kmsKeyId:Se.kmsKeyId});this.builder.addResource(ie,kt);let It;if(Se.deadLetterQueue){let{deadLetterQueue:wt,updatedSourceQueue:Xt,deadLetterLogicalId:ar}=M.createDeadLetterQueue(ie,{slug:l,environment:S,maxReceiveCount:Se.maxReceiveCount});It=ar,this.builder.addResource(ar,wt);let Cr=this.builder.getResources()[ie];if(Cr?.Properties)Cr.Properties.RedrivePolicy=Xt.Properties?.RedrivePolicy}if(Se.trigger){let wt=Se.trigger,Xt=`${l}${S}${wt.functionName}`.replace(/[^a-zA-Z0-9]/g,""),ar={Type:"AWS::Lambda::EventSourceMapping",Properties:{EventSourceArn:{"Fn::GetAtt":[ie,"Arn"]},FunctionName:{Ref:Xt},BatchSize:wt.batchSize||10,MaximumBatchingWindowInSeconds:wt.batchWindow||0,Enabled:!0,...wt.reportBatchItemFailures!==!1&&{FunctionResponseTypes:["ReportBatchItemFailures"]},...wt.maxConcurrency&&{ScalingConfig:{MaximumConcurrency:wt.maxConcurrency}},...wt.filterPattern&&{FilterCriteria:{Filters:[{Pattern:JSON.stringify(wt.filterPattern)}]}}},DependsOn:[ie,Xt]};this.builder.addResource(`${ie}Trigger`,ar)}if(Se.alarms?.enabled){let wt=Se.alarms,Xt=wt.notificationTopicArn;if(!Xt&&wt.notificationEmails?.length){let Cr=`${ie}AlarmTopic`;this.builder.addResource(Cr,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${l}-${S}-${Rt}-alarms`,DisplayName:`${Rt} Queue Alarms`}}),wt.notificationEmails.forEach((Sr,yr)=>{this.builder.addResource(`${Cr}Sub${yr}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:Cr},Protocol:"email",Endpoint:Sr}})}),Xt={Ref:Cr}}let ar=wt.queueDepthThreshold||1000;this.builder.addResource(`${ie}DepthAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${S}-${Rt}-queue-depth`,AlarmDescription:`Queue ${Rt} depth exceeds ${ar} messages`,MetricName:"ApproximateNumberOfMessagesVisible",Namespace:"AWS/SQS",Statistic:"Average",Period:300,EvaluationPeriods:2,Threshold:ar,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[ie,"QueueName"]}}],...Xt&&{AlarmActions:[Xt],OKActions:[Xt]}}});let dr=wt.messageAgeThreshold||3600;if(this.builder.addResource(`${ie}AgeAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${S}-${Rt}-message-age`,AlarmDescription:`Queue ${Rt} oldest message exceeds ${dr} seconds`,MetricName:"ApproximateAgeOfOldestMessage",Namespace:"AWS/SQS",Statistic:"Maximum",Period:300,EvaluationPeriods:2,Threshold:dr,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[ie,"QueueName"]}}],...Xt&&{AlarmActions:[Xt],OKActions:[Xt]}}}),It&&wt.dlqAlarm!==!1)this.builder.addResource(`${It}Alarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${S}-${Rt}-dlq-messages`,AlarmDescription:`Dead letter queue for ${Rt} has messages`,MetricName:"ApproximateNumberOfMessagesVisible",Namespace:"AWS/SQS",Statistic:"Sum",Period:300,EvaluationPeriods:1,Threshold:0,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[It,"QueueName"]}}],...Xt&&{AlarmActions:[Xt]}}})}if(Se.subscribe){let wt=Se.subscribe,Xt=wt.topicArn;if(!Xt&&wt.topicName)Xt={Ref:wt.topicName};if(Xt){this.builder.addResource(`${ie}SnsPolicy`,{Type:"AWS::SQS::QueuePolicy",Properties:{Queues:[{Ref:ie}],PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"sns.amazonaws.com"},Action:"sqs:SendMessage",Resource:{"Fn::GetAtt":[ie,"Arn"]},Condition:{ArnEquals:{"aws:SourceArn":Xt}}}]}}});let ar={TopicArn:Xt,Protocol:"sqs",Endpoint:{"Fn::GetAtt":[ie,"Arn"]},RawMessageDelivery:wt.rawMessageDelivery||!1};if(wt.filterPolicy)ar.FilterPolicy=wt.filterPolicy,ar.FilterPolicyScope=wt.filterPolicyScope||"MessageAttributes";this.builder.addResource(`${ie}SnsSub`,{Type:"AWS::SNS::Subscription",Properties:ar,DependsOn:`${ie}SnsPolicy`})}}}if(this.mergedConfig.infrastructure?.realtime?.enabled)if((this.mergedConfig.infrastructure.realtime.mode||"serverless")==="server")this.generateRealtimeServerResources(l,S);else this.generateRealtimeResources(l,S);let Pt=this.mergedConfig.infrastructure?.redirects;if(Pt){let Rt=Pt.target||this.mergedConfig.infrastructure?.dns?.domain||"",Se=Pt.protocol||"https";if(Pt.domains?.length&&Rt)for(let kt of Pt.domains){let{bucket:ie,bucketPolicy:It,logicalId:wt,policyLogicalId:Xt}=pt.createDomainRedirectBucket({slug:l,environment:S,sourceDomain:kt,targetDomain:Rt,protocol:Se});this.builder.addResource(wt,ie),this.builder.addResource(Xt,It)}if(Pt.paths&&Object.keys(Pt.paths).length>0){let kt=pt.fromMapping(Pt.paths,{statusCode:Pt.statusCode||301}),{function:ie,logicalId:It}=pt.createPathRedirectFunction({slug:l,environment:S,rules:kt});this.builder.addResource(It,ie)}}if(this.mergedConfig.infrastructure?.monitoring?.alarms)for(let[Rt,Se]of Object.entries(this.mergedConfig.infrastructure.monitoring.alarms)){let{alarm:kt,logicalId:ie}=so.createAlarm({slug:l,environment:S,alarmName:`${l}-${S}-${Rt}`,metricName:Se.metricName||"Errors",namespace:Se.namespace||"AWS/Lambda",threshold:Se.threshold||1,comparisonOperator:Se.comparisonOperator||"GreaterThanThreshold"});this.builder.addResource(ie,kt)}let st=this.mergedConfig.infrastructure?.cache;if(st){let Rt=st.type||"redis";if(Rt==="redis"){this.generateNetworkInfrastructure(l,S);let Se=st.redis||{},{replicationGroup:kt,subnetGroup:ie,logicalId:It,subnetGroupId:wt}=io.createRedis({slug:l,environment:S,nodeType:Se.nodeType||st.nodeType||"cache.t3.micro",engineVersion:Se.engineVersion||"7.1",port:Se.port||6379,numCacheClusters:Se.numCacheNodes||2,automaticFailover:Se.automaticFailoverEnabled!==!1,atRestEncryption:!0,transitEncryption:!0,snapshotRetentionDays:Se.snapshotRetentionLimit||7,snapshotWindow:Se.snapshotWindow,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]});if(this.builder.addResource(It,kt),ie&&wt)this.builder.addResource(wt,ie);this.builder.addOutput("CacheEndpoint",{Value:{"Fn::GetAtt":[It,"PrimaryEndPoint.Address"]},Description:"Redis primary endpoint address"}),this.builder.addOutput("CachePort",{Value:{"Fn::GetAtt":[It,"PrimaryEndPoint.Port"]},Description:"Redis primary endpoint port"})}else if(Rt==="memcached"){this.generateNetworkInfrastructure(l,S);let Se=st.elasticache||{},{cluster:kt,subnetGroup:ie,logicalId:It,subnetGroupId:wt}=io.createMemcached({slug:l,environment:S,nodeType:Se.nodeType||st.nodeType||"cache.t3.micro",engineVersion:Se.engineVersion||"1.6.22",numCacheNodes:Se.numCacheNodes||2,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]});if(this.builder.addResource(It,kt),ie&&wt)this.builder.addResource(wt,ie);this.builder.addOutput("CacheEndpoint",{Value:{"Fn::GetAtt":[It,"ConfigurationEndpoint.Address"]},Description:"Memcached configuration endpoint address"})}}let cr=this.mergedConfig.infrastructure?.email;if(cr){let Rt=cr.domain||this.mergedConfig.infrastructure?.dns?.domain;if(Rt){let{emailIdentity:Se,logicalId:kt}=m.verifyDomain({domain:Rt,slug:l,environment:S,enableDkim:cr.enableDkim!==!1,dkimKeyLength:cr.dkimKeyLength||"RSA_2048_BIT"});if(this.builder.addResource(kt,Se),cr.configurationSet!==!1){let{configurationSet:wt,logicalId:Xt}=m.createConfigurationSet({slug:l,environment:S});this.builder.addResource(Xt,wt)}let ie=cr.hostedZoneId||this.mergedConfig.infrastructure?.dns?.hostedZoneId;if(ie){if(cr.enableDkim!==!1)for(let Cr=1;Cr<=3;Cr++){let Sr=`DkimRecord${Cr}${Rt.replace(/\./g,"")}`;this.builder.addResource(Sr,{Type:"AWS::Route53::RecordSet",DependsOn:[kt],Properties:{HostedZoneId:ie,Name:{"Fn::GetAtt":[kt,`DkimDNSTokenName${Cr}`]},Type:"CNAME",TTL:1800,ResourceRecords:[{"Fn::GetAtt":[kt,`DkimDNSTokenValue${Cr}`]}]}})}let{record:wt,logicalId:Xt}=m.createSpfRecord(Rt,ie);this.builder.addResource(Xt,wt);let{record:ar,logicalId:dr}=m.createDmarcRecord(Rt,ie,{policy:"none",reportingEmail:cr.dmarcReportingEmail||`dmarc-reports@${Rt}`});this.builder.addResource(dr,ar)}this.builder.addOutput("EmailDomain",{Value:Rt,Description:"SES verified email domain"});let It=cr.server;if(It?.enabled&&ie){let wt=this.mergedConfig.environments[S]?.region||this.mergedConfig.project.region||"us-east-1",Xt=`${l}-${S}-email`,{role:ar,policy:dr,roleLogicalId:Cr,policyLogicalId:Sr}=m.createEmailLambdaRole({slug:l,environment:S,s3BucketArn:`arn:aws:s3:::${Xt}`,sesIdentityArn:`arn:aws:ses:${wt}:*:identity/${Rt}`});this.builder.addResource(Cr,ar),this.builder.addResource(Sr,dr);let{function:yr,permission:dn,logicalId:bn,permissionLogicalId:Dn}=m.createInboundEmailLambda({slug:l,environment:S,roleArn:{"Fn::GetAtt":[Cr,"Arn"]},s3BucketName:Xt,organizedPrefix:"mailboxes/"});this.builder.addResource(bn,yr),this.builder.addResource(Dn,dn);let zn=m.createInboundEmailSetup({slug:l,environment:S,domain:Rt,s3BucketName:Xt,s3KeyPrefix:"inbox/",region:wt,hostedZoneId:ie,lambdaFunctionArn:{"Fn::GetAtt":[bn,"Arn"]}});for(let[Vi,Fn]of Object.entries(zn.resources)){if(Fn.Type==="AWS::SES::ReceiptRule")Fn.DependsOn=[Dn,bn];this.builder.addResource(Vi,Fn)}this.builder.addOutput("InboundEmailLambda",{Value:{Ref:bn},Description:"Inbound email processing Lambda function"}),this.builder.addOutput("EmailBucket",{Value:Xt,Description:"S3 bucket for email storage"});let kn=this.serverEipLogicalIds.get("app");if(kn&&ie){let Fn=`${It?.subdomain||"mail"}.${Rt}`,Mn=Fn.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${Mn}ARecord`,{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:ie,Name:Fn,Type:"A",TTL:"300",ResourceRecords:[{Ref:kn}]}})}this.builder.addOutput("MailHost",{Value:`mail.${Rt}`,Description:"Mail server hostname for SMTP/IMAP clients"})}}}let lr=this.mergedConfig.infrastructure?.search;if(lr){let Rt=lr.vpc?{subnetIds:[{Ref:"PublicSubnet1"}],securityGroupIds:[]}:void 0;if(Rt)this.generateNetworkInfrastructure(l,S);let{domain:Se,logicalId:kt}=Qt.createDomain({slug:l,environment:S,engineVersion:lr.engineVersion||"OpenSearch_2.11",instanceType:lr.instanceType||"t3.small.search",instanceCount:lr.instanceCount||1,volumeSize:lr.volumeSize||10,volumeType:lr.volumeType||"gp3",dedicatedMaster:lr.dedicatedMaster||!1,dedicatedMasterType:lr.dedicatedMasterType,dedicatedMasterCount:lr.dedicatedMasterCount||3,multiAz:lr.multiAz||!1,encryption:lr.encryption||{atRest:!0,nodeToNode:!0},advancedSecurity:lr.advancedSecurity,autoTune:lr.autoTune!==!1,vpc:Rt});this.builder.addResource(kt,Se),this.builder.addOutput("SearchDomainEndpoint",{Value:{"Fn::GetAtt":[kt,"DomainEndpoint"]},Description:"OpenSearch domain endpoint"}),this.builder.addOutput("SearchDomainArn",{Value:{"Fn::GetAtt":[kt,"Arn"]},Description:"OpenSearch domain ARN"})}let gr=this.mergedConfig.infrastructure?.fileSystem;if(gr&&Object.keys(gr).length>0){this.generateNetworkInfrastructure(l,S);for(let[Rt,Se]of Object.entries(gr)){let{fileSystem:kt,logicalId:ie}=Ge.createFileSystem({slug:`${l}-${Rt}`,environment:S,encrypted:Se.encrypted!==!1,performanceMode:Se.performanceMode||"generalPurpose",throughputMode:Se.throughputMode||"bursting",enableBackup:!0});this.builder.addResource(ie,kt);let{securityGroup:It,logicalId:wt}=Ge.createEfsSecurityGroup({slug:`${l}-${Rt}`,environment:S,vpcId:{Ref:"VPC"},sourceCidrBlocks:["10.0.0.0/16"]});this.builder.addResource(wt,It);let{mountTargets:Xt,logicalIds:ar}=Ge.createMultiAzMountTargets(ie,{slug:`${l}-${Rt}`,environment:S,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}],securityGroupId:{Ref:wt}});for(let dr=0;dr<Xt.length;dr++)this.builder.addResource(ar[dr],Xt[dr]);this.builder.addOutput(`${Rt}FileSystemId`,{Value:{Ref:ie},Description:`EFS file system ID for ${Rt}`})}}let Dt=this.mergedConfig.infrastructure?.ai;if(Dt){let Rt=Dt.service||"ecs",Se=Dt.models||["*"],kt=Dt.allowStreaming!==!1,ie;if(Rt==="ecs")ie=Te.enableBedrockForEcs({slug:l,environment:S,models:Se,allowStreaming:kt});else if(Rt==="ec2")ie=Te.enableBedrockForEc2({slug:l,environment:S,models:Se,allowStreaming:kt});else if(Rt==="lambda")ie=Te.enableBedrockForLambda({slug:l,environment:S,models:Se,allowStreaming:kt});else ie=Te.createBedrockRole(Rt,{slug:l,environment:S,models:Se,allowStreaming:kt});if(this.builder.addResource(ie.logicalId,ie.role),Dt.allowAsync){let{policy:It,logicalId:wt}=Te.createBedrockPolicy({slug:l,environment:S,models:Se,allowStreaming:kt,allowAsync:!0});this.builder.addResource(wt,It)}this.builder.addOutput("BedrockRoleArn",{Value:{"Fn::GetAtt":[ie.logicalId,"Arn"]},Description:"IAM role ARN with Bedrock permissions"})}}generateRealtimeResources(l,S){let P=this.mergedConfig.infrastructure?.realtime;if(!P)return;let E=P.name||`${l}-${S}-realtime`,v=P.scaling||{},it=P.storage||{type:"dynamodb"},Pe=v.handlerMemory||256,Ie=v.handlerTimeout||30,rt=`${l}${S}RealtimeConnections`.replace(/[^a-zA-Z0-9]/g,""),Pt=`${l}${S}RealtimeChannels`.replace(/[^a-zA-Z0-9]/g,"");if(it.type==="dynamodb"){let ar=it.dynamodb||{},dr=ar.billingMode||"PAY_PER_REQUEST";this.builder.addResource(rt,{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${l}-${S}-realtime-connections`,BillingMode:dr,AttributeDefinitions:[{AttributeName:"connectionId",AttributeType:"S"},{AttributeName:"userId",AttributeType:"S"}],KeySchema:[{AttributeName:"connectionId",KeyType:"HASH"}],GlobalSecondaryIndexes:[{IndexName:"userId-index",KeySchema:[{AttributeName:"userId",KeyType:"HASH"}],Projection:{ProjectionType:"ALL"},...dr==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:ar.readCapacity||5,WriteCapacityUnits:ar.writeCapacity||5}}}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0},...dr==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:ar.readCapacity||5,WriteCapacityUnits:ar.writeCapacity||5}},...ar.pointInTimeRecovery&&{PointInTimeRecoverySpecification:{PointInTimeRecoveryEnabled:!0}},Tags:[{Key:"Name",Value:`${l}-${S}-realtime-connections`},{Key:"Environment",Value:S}]}}),this.builder.addResource(Pt,{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${l}-${S}-realtime-channels`,BillingMode:dr,AttributeDefinitions:[{AttributeName:"channel",AttributeType:"S"},{AttributeName:"connectionId",AttributeType:"S"}],KeySchema:[{AttributeName:"channel",KeyType:"HASH"},{AttributeName:"connectionId",KeyType:"RANGE"}],GlobalSecondaryIndexes:[{IndexName:"connectionId-index",KeySchema:[{AttributeName:"connectionId",KeyType:"HASH"}],Projection:{ProjectionType:"ALL"},...dr==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:ar.readCapacity||5,WriteCapacityUnits:ar.writeCapacity||5}}}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0},...dr==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:ar.readCapacity||5,WriteCapacityUnits:ar.writeCapacity||5}},Tags:[{Key:"Name",Value:`${l}-${S}-realtime-channels`},{Key:"Environment",Value:S}]}})}let st=`${l}${S}RealtimeRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(st,{Type:"AWS::IAM::Role",Properties:{RoleName:`${l}-${S}-realtime-handler-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"],Policies:[{PolicyName:"RealtimeHandlerPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["dynamodb:GetItem","dynamodb:PutItem","dynamodb:DeleteItem","dynamodb:Query","dynamodb:Scan","dynamodb:UpdateItem"],Resource:[{"Fn::GetAtt":[rt,"Arn"]},{"Fn::Sub":`\${${rt}.Arn}/index/*`},{"Fn::GetAtt":[Pt,"Arn"]},{"Fn::Sub":`\${${Pt}.Arn}/index/*`}]},{Effect:"Allow",Action:"execute-api:ManageConnections",Resource:{"Fn::Sub":"arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*/*"}}]}}]}});let cr=`${l}${S}RealtimeConnect`.replace(/[^a-zA-Z0-9]/g,""),lr=`${l}${S}RealtimeDisconnect`.replace(/[^a-zA-Z0-9]/g,""),gr=`${l}${S}RealtimeMessage`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(cr,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${l}-${S}-realtime-connect`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[st,"Arn"]},MemorySize:Pe,Timeout:Ie,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:rt},CHANNELS_TABLE:{Ref:Pt},ENVIRONMENT:S}},Code:{ZipFile:this.generateConnectHandlerCode()}},DependsOn:[st,rt]}),this.builder.addResource(lr,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${l}-${S}-realtime-disconnect`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[st,"Arn"]},MemorySize:Pe,Timeout:Ie,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:rt},CHANNELS_TABLE:{Ref:Pt},ENVIRONMENT:S}},Code:{ZipFile:this.generateDisconnectHandlerCode()}},DependsOn:[st,rt,Pt]}),this.builder.addResource(gr,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${l}-${S}-realtime-message`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[st,"Arn"]},MemorySize:Pe,Timeout:Ie,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:rt},CHANNELS_TABLE:{Ref:Pt},ENVIRONMENT:S}},Code:{ZipFile:this.generateMessageHandlerCode()}},DependsOn:[st,rt,Pt]});let Dt=`${l}${S}RealtimeApi`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Dt,{Type:"AWS::ApiGatewayV2::Api",Properties:{Name:E,ProtocolType:"WEBSOCKET",RouteSelectionExpression:"$request.body.action",Tags:{Name:E,Environment:S}}});let Rt=`${cr}Permission`,Se=`${lr}Permission`,kt=`${gr}Permission`;this.builder.addResource(Rt,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:cr},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${Dt}}/*/$connect`}}}),this.builder.addResource(Se,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:lr},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${Dt}}/*/$disconnect`}}}),this.builder.addResource(kt,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:gr},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${Dt}}/*/$default`}}});let ie=`${Dt}ConnectInteg`,It=`${Dt}DisconnectInteg`,wt=`${Dt}MessageInteg`;this.builder.addResource(ie,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:Dt},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${cr}.Arn}/invocations`}}}),this.builder.addResource(It,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:Dt},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${lr}.Arn}/invocations`}}}),this.builder.addResource(wt,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:Dt},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${gr}.Arn}/invocations`}}}),this.builder.addResource(`${Dt}ConnectRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:Dt},RouteKey:"$connect",AuthorizationType:"NONE",Target:{"Fn::Sub":`integrations/\${${ie}}`}}}),this.builder.addResource(`${Dt}DisconnectRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:Dt},RouteKey:"$disconnect",Target:{"Fn::Sub":`integrations/\${${It}}`}}}),this.builder.addResource(`${Dt}DefaultRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:Dt},RouteKey:"$default",Target:{"Fn::Sub":`integrations/\${${wt}}`}}});let Xt=`${Dt}Stage`;if(this.builder.addResource(Xt,{Type:"AWS::ApiGatewayV2::Stage",Properties:{ApiId:{Ref:Dt},StageName:S,AutoDeploy:!0,DefaultRouteSettings:{ThrottlingBurstLimit:v.messagesPerSecond||1000,ThrottlingRateLimit:v.messagesPerSecond||1000}}}),P.monitoring?.enabled){let ar=P.monitoring,dr=ar.notificationTopicArn;if(!dr&&ar.notificationEmails?.length){let Cr=`${Dt}AlarmTopic`;this.builder.addResource(Cr,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${l}-${S}-realtime-alarms`,DisplayName:"Realtime WebSocket Alarms"}}),ar.notificationEmails.forEach((Sr,yr)=>{this.builder.addResource(`${Cr}Sub${yr}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:Cr},Protocol:"email",Endpoint:Sr}})}),dr={Ref:Cr}}if(ar.connectionThreshold)this.builder.addResource(`${Dt}ConnectionAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${S}-realtime-connections`,AlarmDescription:`WebSocket connections exceed ${ar.connectionThreshold}`,MetricName:"ConnectCount",Namespace:"AWS/ApiGateway",Statistic:"Sum",Period:300,EvaluationPeriods:2,Threshold:ar.connectionThreshold,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ApiId",Value:{Ref:Dt}}],...dr&&{AlarmActions:[dr]}}});if(ar.errorThreshold)this.builder.addResource(`${Dt}ErrorAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${S}-realtime-errors`,AlarmDescription:`WebSocket errors exceed ${ar.errorThreshold}/min`,MetricName:"ExecutionError",Namespace:"AWS/ApiGateway",Statistic:"Sum",Period:60,EvaluationPeriods:3,Threshold:ar.errorThreshold,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ApiId",Value:{Ref:Dt}}],...dr&&{AlarmActions:[dr]}}})}this.builder.addOutput(`${Dt}Endpoint`,{Description:"WebSocket API endpoint URL",Value:{"Fn::Sub":`wss://\${${Dt}}.execute-api.\${AWS::Region}.amazonaws.com/${S}`},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-endpoint"}}}),this.builder.addOutput(`${Dt}Id`,{Description:"WebSocket API ID",Value:{Ref:Dt},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-api-id"}}})}generateConnectHandlerCode(){return`
+`:pr,St=E.map(([,lr])=>lr.port).filter((lr)=>typeof lr==="number"&&![80,443].includes(lr)),Se=this.resolveApiOriginPort(),Bt=`${l}${S}DeployBucket`.replace(/[^a-zA-Z0-9]/g,""),ie=`${l}-${S}-deploy`;this.builder.addResource(Bt,{Type:"AWS::S3::Bucket",Properties:{BucketName:ie,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0},LifecycleConfiguration:{Rules:[{Id:"expire-old-releases",Status:"Enabled",ExpirationInDays:7,Prefix:"releases/"}]},Tags:[{Key:"Project",Value:l},{Key:"Environment",Value:S},{Key:"ManagedBy",Value:"ts-cloud"}]}});let Rt=a.createServerModeStack({slug:`${l}-app`,environment:S,vpcId:{Ref:"VPC"},subnetId:{Ref:"PublicSubnet1"},instanceType:st,keyName:P.allowSsh?`${l}-${S}`:void 0,domain:Ie,userData:Dt,volumeSize:P.disk?.size||20,imageId:P.image,allowedPorts:[...P.allowSsh?[22]:[],80,443,Se,...St]}),Nt=Rt.resources[Rt.outputs.instanceLogicalId];if(Nt?.Properties){let lr=Nt.Properties.Tags||[];Nt.Properties.Tags=[...lr,{Key:"Project",Value:l},{Key:"Environment",Value:S},{Key:"Role",Value:"app"},{Key:"ManagedBy",Value:"ts-cloud"}]}let er=Rt.resources[Rt.outputs.roleLogicalId];if(er?.Properties)er.Properties.Policies=er.Properties.Policies||[],er.Properties.Policies.push({PolicyName:"DeployBucketRead",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["s3:GetObject","s3:ListBucket"],Resource:[`arn:aws:s3:::${ie}`,`arn:aws:s3:::${ie}/*`]}]}});for(let[lr,fr]of Object.entries(Rt.resources))this.builder.addResource(lr,fr);this.builder.addOutput("deployBucketName",{Value:{Ref:Bt},Description:"S3 bucket where release tarballs are uploaded"}),this.builder.addOutput("appInstanceId",{Value:{Ref:Rt.outputs.instanceLogicalId},Description:"EC2 instance ID for the app server"}),this.builder.addOutput("appPublicIp",{Value:{Ref:Rt.outputs.eipLogicalId},Description:"Public IP for the app server"}),this.serverEipLogicalIds.set("app",Rt.outputs.eipLogicalId),this.serverEipLogicalIds.set("appInstance",Rt.outputs.instanceLogicalId)}generateJumpBox(l,S){let P=this.mergedConfig.infrastructure?.jumpBox;if(!P)return;let v=P===!0?{}:P;if(v.enabled===!1)return;this.generateNetworkInfrastructure(l,S);let E=v.size||"micro",Ie=a.InstanceSize.specs[E]?.instanceType||E||"t3.micro",Ne;if(v.mountEfs)Ne={fileSystemId:typeof v.mountEfs==="string"?v.mountEfs:{Ref:"FileSystem"},mountPath:v.mountPath||"/mnt/efs"};let nt;if(v.databaseTools)nt=a.JumpBox.withDatabaseTools({slug:l,environment:S,vpcId:{Ref:"VPC"},subnetId:{Ref:"PublicSubnet1"},keyName:v.keyName||`${l}-${S}`,allowedCidrs:v.allowedCidrs});else if(Ne)nt=a.JumpBox.withEfsMount({slug:l,environment:S,vpcId:{Ref:"VPC"},subnetId:{Ref:"PublicSubnet1"},keyName:v.keyName||`${l}-${S}`,fileSystemId:Ne.fileSystemId,mountPath:Ne.mountPath,allowedCidrs:v.allowedCidrs});else nt=a.createJumpBox({slug:l,environment:S,vpcId:{Ref:"VPC"},subnetId:{Ref:"PublicSubnet1"},keyName:v.keyName||`${l}-${S}`,instanceType:Ie,allowedCidrs:v.allowedCidrs,mountEfs:Ne});for(let[Pt,st]of Object.entries(nt.resources))this.builder.addResource(Pt,st);this.builder.addOutput("JumpBoxInstanceId",{Value:{Ref:nt.instanceLogicalId},Description:"The ID of the JumpBox EC2 instance (use with SSM Session Manager or SSH)"})}generateSharedInfrastructure(l,S){let P=this.mergedConfig.infrastructure?.ssl,v=this.mergedConfig.infrastructure?.dns,E=v?.domain,ot=v?.hostedZoneId,Ie=[],Ne,nt;if(P?.certificateArn)nt=P.certificateArn;else if(P?.enabled&&E&&ot){let St=P.domains||[E],Se=St[0],Bt=St.slice(1).map((Nt)=>{if(Nt.includes(".")&&Nt.endsWith(Se))return Nt.replace(`.${Se}`,"");return Nt}),{certificate:ie,logicalId:Rt}=I.createCertificate({domain:Se,subdomains:Bt,slug:l,environment:S,validationMethod:"DNS",hostedZoneId:ot});Ne=Rt,this.builder.addResource(Rt,ie)}if(this.mergedConfig.infrastructure?.storage){let St=Object.entries(this.mergedConfig.infrastructure.storage).some(([,ie])=>ie.website),Se;if(St&&(Ne||nt))Se=`${l}${S}CloudFrontOAC`.replace(/[^a-zA-Z0-9]/g,""),this.builder.addResource(Se,{Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`${l}-${S}-s3-oac`,Description:`OAC for ${l} ${S} S3 website buckets`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}});let Bt=Object.entries(this.mergedConfig.infrastructure.storage).map(([ie,Rt])=>({name:ie,config:Rt,mountPath:this.normalizeMountPath(Rt),rewriteStyle:Rt.pathRewriteStyle||"directory",logicalId:this.storageBucketLogicalId(l,S,ie)})).filter((ie)=>ie.name!=="public"&&ie.config.website&&ie.mountPath);for(let[ie,Rt]of Object.entries(this.mergedConfig.infrastructure.storage)){let Nt=!!(Rt.website&&Se),er=this.storageBucketName(l,S,ie),{bucket:lr,logicalId:fr}=ve.createBucket({slug:l,name:ie,environment:S,bucketName:er,versioning:Rt.versioning,encryption:Rt.encryption,public:Nt?!1:Rt.public}),Cr=this.normalizeMountPath(Rt),vr;if(Rt.failover){let br=`infrastructure.storage.${ie}`;if(!Nt||!E||Cr&&ie!=="public")throw Error(`${br}.failover needs this bucket to be served by its own CloudFront distribution: a website bucket (website: true), not mounted under the path of another site, with infrastructure.dns.domain set and SSL configured (infrastructure.ssl.certificateArn, or ssl.enabled with dns.hostedZoneId).`);if(vr=gg({failover:Rt.failover,primaryBucket:er,primaryRegion:this.mergedConfig.project.region||"us-east-1",where:br}),vr.replicate&&lr.Properties){let Wi=`${fr}FailoverReplicationRole`;this.builder.addResource(Wi,hg({primaryBucket:er,replicaBucket:vr.replicaBucket}));let wn=lr.Properties;wn.VersioningConfiguration={Status:"Enabled"},wn.ReplicationConfiguration=fg({replicaBucket:vr.replicaBucket,roleArn:{"Fn::GetAtt":[Wi,"Arn"]}})}}if(Nt&&lr.Properties)lr.Properties.PublicAccessBlockConfiguration={BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!1,RestrictPublicBuckets:!1};if(this.builder.addResource(fr,lr),Rt.website){let br=typeof Rt.website==="object"?Rt.website:{},Wi=ve.enableWebsiteHosting(lr,br.indexDocument||"index.html",br.errorDocument);this.builder.addResource(fr,Wi)}let an=this.normalizeMountPath(Rt);if(Nt&&Se&&E&&!(an&&ie!=="public")){let br=`${l}${S}${ie}CDN`.replace(/[^a-zA-Z0-9]/g,""),Wi=[];if(Rt.aliases&&Rt.aliases.length>0)Wi.push(...Rt.aliases);else if(ie==="public"){if(Wi.push(E),P?.domains?.includes(`www.${E}`))Wi.push(`www.${E}`)}else if(ie==="docs")Wi.push(`docs.${E}`);else if(ie==="blog")Wi.push(`blog.${E}`);let wn=typeof Rt.website==="object"?Rt.website:{},Fn=Rt.spa===!0,On=wn.errorDocument||(Fn?"index.html":"404.html"),pn=[];if(Fn)pn.push({ErrorCode:403,ResponseCode:200,ResponsePagePath:"/index.html",ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:200,ResponsePagePath:"/index.html",ErrorCachingMinTTL:300});else pn.push({ErrorCode:403,ResponseCode:404,ResponsePagePath:`/${On}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:404,ResponsePagePath:`/${On}`,ErrorCachingMinTTL:300});let Hn=nt&&Wi.length>0?{AcmCertificateArn:nt,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:Ne&&Wi.length>0?{AcmCertificateArn:{Ref:Ne},SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:{CloudFrontDefaultCertificate:!0},Jn=`S3-${l}-${S}-${ie}`,bs=this.mergedConfig.project.region||"us-east-1",Qn;if(!Fn)Qn=`${l}${S}${ie}UrlRewrite`.replace(/[^a-zA-Z0-9]/g,""),this.builder.addResource(Qn,{Type:"AWS::CloudFront::Function",Properties:{Name:`${l}-${S}-${ie}-url-rewrite`,AutoPublish:!0,FunctionConfig:{Comment:`URL rewrite for ${l} ${S} ${ie} - appends .html to extensionless paths`,Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) { var request = event.request; var uri = request.uri; if (uri.endsWith('/')) { request.uri += 'index.html'; }
+else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`}});let ha=[{Id:Jn,DomainName:{"Fn::Sub":`\${${fr}}.s3.${bs}.amazonaws.com`},OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:Se}}],qa=[],Rs=[];if(this.shouldRouteStorageBucketToCompute(ie,Rt)){this.appendComputeAppOrigin(ha,qa,Rs,l,S,this.resolveComputeCachePathPatterns(Rt.computeRoutes));for(let zi of Bt){let ns=`S3-${l}-${S}-${zi.name}`,ec=`${l}${S}${zi.name}PathMountRewrite`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(ec,{Type:"AWS::CloudFront::Function",Properties:{Name:`${l}-${S}-${zi.name}-path-mount-rewrite`,AutoPublish:!0,FunctionConfig:{Comment:`Path mount rewrite for ${l} ${S} ${zi.name} at ${zi.mountPath}`,Runtime:"cloudfront-js-2.0"},FunctionCode:this.pathMountRewriteFunctionCode(zi.mountPath,zi.rewriteStyle)}}),ha.push({Id:ns,DomainName:{"Fn::Sub":`\${${zi.logicalId}}.s3.${bs}.amazonaws.com`},OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:Se}}),Rs.push(zi.logicalId,ec);for(let Kl of[zi.mountPath,`${zi.mountPath}/*`])qa.push({PathPattern:Kl,TargetOriginId:ns,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":[ec,"FunctionARN"]}}]})}}let is,sc=Jn;if(vr){let zi=`${Jn}-failover`;Object.assign(ha[0],vr.primaryConnection),ha.push({Id:zi,DomainName:mg(vr.replicaBucket,vr.replicaRegion),OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:Se}}),is=Fr({primaryOriginId:Jn,secondaryOriginId:zi,statusCodes:vr.statusCodes}),sc=is.Items[0].Id}let ws={Type:"AWS::CloudFront::Distribution",DependsOn:[fr,Se,...Qn?[Qn]:[],...Rs],Properties:{DistributionConfig:{Enabled:!0,Comment:`${l} ${S} ${ie} site`,DefaultRootObject:"index.html",Origins:ha,...is?{OriginGroups:is}:{},DefaultCacheBehavior:{TargetOriginId:sc,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6",...Qn?{FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":[Qn,"FunctionARN"]}}]}:{}},...qa.length>0?{CacheBehaviors:qa}:{},...Wi.length>0?{Aliases:Wi}:{},ViewerCertificate:Hn,PriceClass:"PriceClass_100",HttpVersion:"http2and3",IPV6Enabled:!0,CustomErrorResponses:pn}}};if(Ne)ws.DependsOn.push(Ne);if(vr)Ht(ws.Properties.DistributionConfig,`infrastructure.storage.${ie}`),this.storageFailoverReplicas.push({name:ie,primaryBucket:er,primaryRegion:bs,replicaBucket:vr.replicaBucket,replicaRegion:vr.replicaRegion,replicate:vr.replicate,distributionArnOutput:`${ie}CloudFrontDistributionArn`}),this.builder.addOutput(`${ie}CloudFrontDistributionArn`,{Value:{"Fn::Sub":`arn:\${AWS::Partition}:cloudfront::\${AWS::AccountId}:distribution/\${${br}}`},Description:`CloudFront distribution ARN for ${ie} (scopes the bucket policy of the failover replica)`}),this.builder.addOutput(`${ie}FailoverBucketName`,{Value:vr.replicaBucket,Description:`Failover replica bucket for ${ie} (${vr.replicaRegion}), outside this stack`});this.builder.addResource(br,ws);let zl=`${fr}CloudFrontPolicy`;if(this.builder.addResource(zl,{Type:"AWS::S3::BucketPolicy",DependsOn:[fr,br],Properties:{Bucket:{Ref:fr},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":`arn:aws:s3:::\${${fr}}/*`},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":`arn:aws:cloudfront::\${AWS::AccountId}:distribution/\${${br}}`}}}}]}}}),this.shouldRouteStorageBucketToCompute(ie,Rt))for(let zi of Bt){let ns=`${zi.logicalId}CloudFrontPolicy`;this.builder.addResource(ns,{Type:"AWS::S3::BucketPolicy",DependsOn:[zi.logicalId,br],Properties:{Bucket:{Ref:zi.logicalId},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":`arn:aws:s3:::\${${zi.logicalId}}/*`},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":`arn:aws:cloudfront::\${AWS::AccountId}:distribution/\${${br}}`}}}}]}}})}if(Wi.length>0)Ie.push({name:ie,bucketLogicalId:fr,distLogicalId:br,oacLogicalId:Se,aliases:Wi});this.builder.addOutput(`${ie}CloudFrontDomain`,{Value:{"Fn::GetAtt":[br,"DomainName"]},Description:`CloudFront domain for ${ie}`}),this.builder.addOutput(`${ie}CloudFrontDistributionId`,{Value:{Ref:br},Description:`CloudFront distribution ID for ${ie}`})}if(this.builder.addOutput(`${ie}BucketName`,{Value:{Ref:fr},Description:`S3 bucket name for ${ie}`}),ie==="public")this.builder.addOutput("FrontendBucketName",{Value:{Ref:fr},Description:"Frontend S3 bucket name"});if(ie==="docs")this.builder.addOutput("DocsBucketName",{Value:{Ref:fr},Description:"Documentation S3 bucket name"});if(ie==="blog")this.builder.addOutput("BlogBucketName",{Value:{Ref:fr},Description:"Blog S3 bucket name"})}}if(this.mergedConfig.infrastructure?.sftp){let St=this.mergedConfig.infrastructure.sftp,Se=Dd.create({...St,storage:this.resolveSftpStorage(St,l,S)??St.storage,slug:l,environment:S});for(let[Bt,ie]of Object.entries(Se.resources))this.builder.addResource(Bt,ie);this.builder.addOutput("SftpServerId",{Value:{Ref:Se.serverLogicalId},Description:"AWS Transfer Family SFTP server ID"}),this.builder.addOutput("SftpEndpoint",{Value:{"Fn::Sub":`\${${Se.serverLogicalId}}.server.transfer.\${AWS::Region}.amazonaws.com`},Description:"AWS Transfer Family SFTP endpoint"}),this.builder.addOutput("SftpStorageDomain",{Value:Se.domain,Description:"Storage backing the SFTP server (EFS or S3)"})}if(ot&&Ie.length>0)for(let{name:St,distLogicalId:Se,aliases:Bt}of Ie)for(let ie of Bt){let Rt=ie.replace(/\./g,"").replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${Rt}ARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[Se],Properties:{HostedZoneId:ot,Name:ie,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":[Se,"DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}}),this.builder.addResource(`${Rt}AAAARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[Se],Properties:{HostedZoneId:ot,Name:ie,Type:"AAAA",AliasTarget:{DNSName:{"Fn::GetAtt":[Se,"DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}})}if(this.mergedConfig.infrastructure?.databases){for(let[St,Se]of Object.entries(this.mergedConfig.infrastructure.databases))if(Se.engine==="dynamodb"){let{table:Bt,logicalId:ie}=Gt.createTable({slug:l,environment:S,tableName:`${l}-${S}-${St}`,partitionKey:Se.partitionKey||{name:"id",type:"S"},sortKey:Se.sortKey});this.builder.addResource(ie,Bt)}else if(Se.engine==="postgres"){let{dbInstance:Bt,logicalId:ie}=Gt.createPostgres({slug:l,environment:S,dbInstanceIdentifier:`${l}-${S}-${St}`,masterUsername:Se.username||"admin",masterUserPassword:Se.password||"changeme123",allocatedStorage:Se.storage||20,dbInstanceClass:Se.instanceClass||"db.t3.micro"});this.builder.addResource(ie,Bt)}else if(Se.engine==="mysql"){let{dbInstance:Bt,logicalId:ie}=Gt.createMysql({slug:l,environment:S,dbInstanceIdentifier:`${l}-${S}-${St}`,masterUsername:Se.username||"admin",masterUserPassword:Se.password||"changeme123",allocatedStorage:Se.storage||20,dbInstanceClass:Se.instanceClass||"db.t3.micro"});this.builder.addResource(ie,Bt)}}if(this.mergedConfig.infrastructure?.cdn)for(let[St,Se]of Object.entries(this.mergedConfig.infrastructure.cdn)){if(!Se.origin)continue;let Bt=typeof Se.customDomain==="string"?Se.customDomain:Se.customDomain?.domain||Se.domain,ie=typeof Se.customDomain==="object"?Se.customDomain?.certificateArn:Se.certificateArn,Rt=ie||nt,Nt=`${l}${S}${St}CDN`.replace(/[^a-zA-Z0-9]/g,""),er=`S3-${l}-${S}-${St}-cdn`,lr=[{Id:er,DomainName:Se.origin,OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginShield:Se.originShield?{Enabled:!0,OriginShieldRegion:Se.originShieldRegion||this.mergedConfig.environments[S]?.region||this.mergedConfig.project.region||"us-east-1"}:{Enabled:!1},...Te(Se,`infrastructure.cdn.${St}`)}],fr=[],Cr=[],vr=["GET","HEAD","OPTIONS"],an=er,br;if(Se.failoverOrigin){Qt(vr,`the default cache behavior of infrastructure.cdn.${St}`);let On=`${er}-failover`,pn=typeof Se.failoverOrigin==="string"?{domain:Se.failoverOrigin}:Se.failoverOrigin;if(!pn.domain)throw Error(`infrastructure.cdn.${St}.failoverOrigin.domain is required`);if(pn.domain===Se.origin)throw Error(`infrastructure.cdn.${St}: failoverOrigin must differ from origin (both are ${Se.origin})`);lr.push({Id:On,DomainName:pn.domain,OriginPath:pn.originPath||"",...Td(pn.domain)?{S3OriginConfig:{OriginAccessIdentity:""}}:{CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:"https-only"}},OriginShield:{Enabled:!1},...Te(pn,`infrastructure.cdn.${St}.failoverOrigin`)}),br=Fr({primaryOriginId:er,secondaryOriginId:On,statusCodes:Se.failoverStatusCodes}),an=br.Items[0].Id}else if(Se.failoverStatusCodes)throw Error(`infrastructure.cdn.${St}: failoverStatusCodes needs failoverOrigin to fail over to`);if(Se.routeCompute)this.appendComputeAppOrigin(lr,fr,Cr,l,S,this.resolveComputeCachePathPatterns(Se.computeRoutes));let Wi=Rt&&Bt?{AcmCertificateArn:Ne&&!ie?{Ref:Ne}:Rt,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:{CloudFrontDefaultCertificate:!0},wn=[...Cr];if(Ne&&!ie&&Bt)wn.push(Ne);let Fn={Type:"AWS::CloudFront::Distribution",...wn.length>0?{DependsOn:wn}:{},Properties:{DistributionConfig:{Enabled:!0,Comment:`${l} ${S} ${St} CDN`,DefaultRootObject:"index.html",Origins:lr,...br?{OriginGroups:br}:{},DefaultCacheBehavior:{TargetOriginId:an,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:vr,CachedMethods:["GET","HEAD","OPTIONS"],Compress:Se.compress!==!1,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6"},...fr.length>0?{CacheBehaviors:fr}:{},...Bt&&Rt?{Aliases:[Bt]}:{},ViewerCertificate:Wi,PriceClass:"PriceClass_100",HttpVersion:Se.http3?"http2and3":"http2"}}};if(Ht(Fn.Properties.DistributionConfig,`infrastructure.cdn.${St}`),this.builder.addResource(Nt,Fn),ot&&Bt&&Rt){let On=Bt.replace(/\./g,"").replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${On}CdnARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[Nt,...Ne&&!ie?[Ne]:[]],Properties:{HostedZoneId:ot,Name:Bt,Type:"A",AliasTarget:{HostedZoneId:"Z2FDTNDATAQYW2",DNSName:{"Fn::GetAtt":[Nt,"DomainName"]}}}})}}if(this.mergedConfig.infrastructure?.queues)for(let[St,Se]of Object.entries(this.mergedConfig.infrastructure.queues)){if(!this.shouldDeploy(Se))continue;let{queue:Bt,logicalId:ie}=M.createQueue({slug:l,environment:S,name:`${l}-${S}-${St}`,fifo:Se.fifo,visibilityTimeout:Se.visibilityTimeout,messageRetentionPeriod:Se.messageRetentionPeriod,delaySeconds:Se.delaySeconds,maxMessageSize:Se.maxMessageSize,receiveMessageWaitTime:Se.receiveMessageWaitTime,contentBasedDeduplication:Se.contentBasedDeduplication,encrypted:Se.encrypted,kmsKeyId:Se.kmsKeyId});this.builder.addResource(ie,Bt);let Rt;if(Se.deadLetterQueue){let{deadLetterQueue:Nt,updatedSourceQueue:er,deadLetterLogicalId:lr}=M.createDeadLetterQueue(ie,{slug:l,environment:S,maxReceiveCount:Se.maxReceiveCount});Rt=lr,this.builder.addResource(lr,Nt);let Cr=this.builder.getResources()[ie];if(Cr?.Properties)Cr.Properties.RedrivePolicy=er.Properties?.RedrivePolicy}if(Se.trigger){let Nt=Se.trigger,er=`${l}${S}${Nt.functionName}`.replace(/[^a-zA-Z0-9]/g,""),lr={Type:"AWS::Lambda::EventSourceMapping",Properties:{EventSourceArn:{"Fn::GetAtt":[ie,"Arn"]},FunctionName:{Ref:er},BatchSize:Nt.batchSize||10,MaximumBatchingWindowInSeconds:Nt.batchWindow||0,Enabled:!0,...Nt.reportBatchItemFailures!==!1&&{FunctionResponseTypes:["ReportBatchItemFailures"]},...Nt.maxConcurrency&&{ScalingConfig:{MaximumConcurrency:Nt.maxConcurrency}},...Nt.filterPattern&&{FilterCriteria:{Filters:[{Pattern:JSON.stringify(Nt.filterPattern)}]}}},DependsOn:[ie,er]};this.builder.addResource(`${ie}Trigger`,lr)}if(Se.alarms?.enabled){let Nt=Se.alarms,er=Nt.notificationTopicArn;if(!er&&Nt.notificationEmails?.length){let Cr=`${ie}AlarmTopic`;this.builder.addResource(Cr,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${l}-${S}-${St}-alarms`,DisplayName:`${St} Queue Alarms`}}),Nt.notificationEmails.forEach((vr,an)=>{this.builder.addResource(`${Cr}Sub${an}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:Cr},Protocol:"email",Endpoint:vr}})}),er={Ref:Cr}}let lr=Nt.queueDepthThreshold||1000;this.builder.addResource(`${ie}DepthAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${S}-${St}-queue-depth`,AlarmDescription:`Queue ${St} depth exceeds ${lr} messages`,MetricName:"ApproximateNumberOfMessagesVisible",Namespace:"AWS/SQS",Statistic:"Average",Period:300,EvaluationPeriods:2,Threshold:lr,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[ie,"QueueName"]}}],...er&&{AlarmActions:[er],OKActions:[er]}}});let fr=Nt.messageAgeThreshold||3600;if(this.builder.addResource(`${ie}AgeAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${S}-${St}-message-age`,AlarmDescription:`Queue ${St} oldest message exceeds ${fr} seconds`,MetricName:"ApproximateAgeOfOldestMessage",Namespace:"AWS/SQS",Statistic:"Maximum",Period:300,EvaluationPeriods:2,Threshold:fr,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[ie,"QueueName"]}}],...er&&{AlarmActions:[er],OKActions:[er]}}}),Rt&&Nt.dlqAlarm!==!1)this.builder.addResource(`${Rt}Alarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${S}-${St}-dlq-messages`,AlarmDescription:`Dead letter queue for ${St} has messages`,MetricName:"ApproximateNumberOfMessagesVisible",Namespace:"AWS/SQS",Statistic:"Sum",Period:300,EvaluationPeriods:1,Threshold:0,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[Rt,"QueueName"]}}],...er&&{AlarmActions:[er]}}})}if(Se.subscribe){let Nt=Se.subscribe,er=Nt.topicArn;if(!er&&Nt.topicName)er={Ref:Nt.topicName};if(er){this.builder.addResource(`${ie}SnsPolicy`,{Type:"AWS::SQS::QueuePolicy",Properties:{Queues:[{Ref:ie}],PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"sns.amazonaws.com"},Action:"sqs:SendMessage",Resource:{"Fn::GetAtt":[ie,"Arn"]},Condition:{ArnEquals:{"aws:SourceArn":er}}}]}}});let lr={TopicArn:er,Protocol:"sqs",Endpoint:{"Fn::GetAtt":[ie,"Arn"]},RawMessageDelivery:Nt.rawMessageDelivery||!1};if(Nt.filterPolicy)lr.FilterPolicy=Nt.filterPolicy,lr.FilterPolicyScope=Nt.filterPolicyScope||"MessageAttributes";this.builder.addResource(`${ie}SnsSub`,{Type:"AWS::SNS::Subscription",Properties:lr,DependsOn:`${ie}SnsPolicy`})}}}if(this.mergedConfig.infrastructure?.realtime?.enabled)if((this.mergedConfig.infrastructure.realtime.mode||"serverless")==="server")this.generateRealtimeServerResources(l,S);else this.generateRealtimeResources(l,S);let Pt=this.mergedConfig.infrastructure?.redirects;if(Pt){let St=Pt.target||this.mergedConfig.infrastructure?.dns?.domain||"",Se=Pt.protocol||"https";if(Pt.domains?.length&&St)for(let Bt of Pt.domains){let{bucket:ie,bucketPolicy:Rt,logicalId:Nt,policyLogicalId:er}=gt.createDomainRedirectBucket({slug:l,environment:S,sourceDomain:Bt,targetDomain:St,protocol:Se});this.builder.addResource(Nt,ie),this.builder.addResource(er,Rt)}if(Pt.paths&&Object.keys(Pt.paths).length>0){let Bt=gt.fromMapping(Pt.paths,{statusCode:Pt.statusCode||301}),{function:ie,logicalId:Rt}=gt.createPathRedirectFunction({slug:l,environment:S,rules:Bt});this.builder.addResource(Rt,ie)}}if(this.mergedConfig.infrastructure?.monitoring?.alarms)for(let[St,Se]of Object.entries(this.mergedConfig.infrastructure.monitoring.alarms)){let{alarm:Bt,logicalId:ie}=co.createAlarm({slug:l,environment:S,alarmName:`${l}-${S}-${St}`,metricName:Se.metricName||"Errors",namespace:Se.namespace||"AWS/Lambda",threshold:Se.threshold||1,comparisonOperator:Se.comparisonOperator||"GreaterThanThreshold"});this.builder.addResource(ie,Bt)}let st=this.mergedConfig.infrastructure?.cache;if(st){let St=st.type||"redis";if(St==="redis"){this.generateNetworkInfrastructure(l,S);let Se=st.redis||{},{replicationGroup:Bt,subnetGroup:ie,logicalId:Rt,subnetGroupId:Nt}=ao.createRedis({slug:l,environment:S,nodeType:Se.nodeType||st.nodeType||"cache.t3.micro",engineVersion:Se.engineVersion||"7.1",port:Se.port||6379,numCacheClusters:Se.numCacheNodes||2,automaticFailover:Se.automaticFailoverEnabled!==!1,atRestEncryption:!0,transitEncryption:!0,snapshotRetentionDays:Se.snapshotRetentionLimit||7,snapshotWindow:Se.snapshotWindow,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]});if(this.builder.addResource(Rt,Bt),ie&&Nt)this.builder.addResource(Nt,ie);this.builder.addOutput("CacheEndpoint",{Value:{"Fn::GetAtt":[Rt,"PrimaryEndPoint.Address"]},Description:"Redis primary endpoint address"}),this.builder.addOutput("CachePort",{Value:{"Fn::GetAtt":[Rt,"PrimaryEndPoint.Port"]},Description:"Redis primary endpoint port"})}else if(St==="memcached"){this.generateNetworkInfrastructure(l,S);let Se=st.elasticache||{},{cluster:Bt,subnetGroup:ie,logicalId:Rt,subnetGroupId:Nt}=ao.createMemcached({slug:l,environment:S,nodeType:Se.nodeType||st.nodeType||"cache.t3.micro",engineVersion:Se.engineVersion||"1.6.22",numCacheNodes:Se.numCacheNodes||2,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]});if(this.builder.addResource(Rt,Bt),ie&&Nt)this.builder.addResource(Nt,ie);this.builder.addOutput("CacheEndpoint",{Value:{"Fn::GetAtt":[Rt,"ConfigurationEndpoint.Address"]},Description:"Memcached configuration endpoint address"})}}let ur=this.mergedConfig.infrastructure?.email;if(ur){let St=ur.domain||this.mergedConfig.infrastructure?.dns?.domain;if(St){let{emailIdentity:Se,logicalId:Bt}=m.verifyDomain({domain:St,slug:l,environment:S,enableDkim:ur.enableDkim!==!1,dkimKeyLength:ur.dkimKeyLength||"RSA_2048_BIT"});if(this.builder.addResource(Bt,Se),ur.configurationSet!==!1){let{configurationSet:Nt,logicalId:er}=m.createConfigurationSet({slug:l,environment:S});this.builder.addResource(er,Nt)}let ie=ur.hostedZoneId||this.mergedConfig.infrastructure?.dns?.hostedZoneId;if(ie){if(ur.enableDkim!==!1)for(let Cr=1;Cr<=3;Cr++){let vr=`DkimRecord${Cr}${St.replace(/\./g,"")}`;this.builder.addResource(vr,{Type:"AWS::Route53::RecordSet",DependsOn:[Bt],Properties:{HostedZoneId:ie,Name:{"Fn::GetAtt":[Bt,`DkimDNSTokenName${Cr}`]},Type:"CNAME",TTL:1800,ResourceRecords:[{"Fn::GetAtt":[Bt,`DkimDNSTokenValue${Cr}`]}]}})}let{record:Nt,logicalId:er}=m.createSpfRecord(St,ie);this.builder.addResource(er,Nt);let{record:lr,logicalId:fr}=m.createDmarcRecord(St,ie,{policy:"none",reportingEmail:ur.dmarcReportingEmail||`dmarc-reports@${St}`});this.builder.addResource(fr,lr)}this.builder.addOutput("EmailDomain",{Value:St,Description:"SES verified email domain"});let Rt=ur.server;if(Rt?.enabled&&ie){let Nt=this.mergedConfig.environments[S]?.region||this.mergedConfig.project.region||"us-east-1",er=`${l}-${S}-email`,{role:lr,policy:fr,roleLogicalId:Cr,policyLogicalId:vr}=m.createEmailLambdaRole({slug:l,environment:S,s3BucketArn:`arn:aws:s3:::${er}`,sesIdentityArn:`arn:aws:ses:${Nt}:*:identity/${St}`});this.builder.addResource(Cr,lr),this.builder.addResource(vr,fr);let{function:an,permission:br,logicalId:Wi,permissionLogicalId:wn}=m.createInboundEmailLambda({slug:l,environment:S,roleArn:{"Fn::GetAtt":[Cr,"Arn"]},s3BucketName:er,organizedPrefix:"mailboxes/"});this.builder.addResource(Wi,an),this.builder.addResource(wn,br);let Fn=m.createInboundEmailSetup({slug:l,environment:S,domain:St,s3BucketName:er,s3KeyPrefix:"inbox/",region:Nt,hostedZoneId:ie,lambdaFunctionArn:{"Fn::GetAtt":[Wi,"Arn"]}});for(let[pn,Hn]of Object.entries(Fn.resources)){if(Hn.Type==="AWS::SES::ReceiptRule")Hn.DependsOn=[wn,Wi];this.builder.addResource(pn,Hn)}this.builder.addOutput("InboundEmailLambda",{Value:{Ref:Wi},Description:"Inbound email processing Lambda function"}),this.builder.addOutput("EmailBucket",{Value:er,Description:"S3 bucket for email storage"});let On=this.serverEipLogicalIds.get("app");if(On&&ie){let Hn=`${Rt?.subdomain||"mail"}.${St}`,Jn=Hn.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${Jn}ARecord`,{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:ie,Name:Hn,Type:"A",TTL:"300",ResourceRecords:[{Ref:On}]}})}this.builder.addOutput("MailHost",{Value:`mail.${St}`,Description:"Mail server hostname for SMTP/IMAP clients"})}}}let pr=this.mergedConfig.infrastructure?.search;if(pr){let St=pr.vpc?{subnetIds:[{Ref:"PublicSubnet1"}],securityGroupIds:[]}:void 0;if(St)this.generateNetworkInfrastructure(l,S);let{domain:Se,logicalId:Bt}=qt.createDomain({slug:l,environment:S,engineVersion:pr.engineVersion||"OpenSearch_2.11",instanceType:pr.instanceType||"t3.small.search",instanceCount:pr.instanceCount||1,volumeSize:pr.volumeSize||10,volumeType:pr.volumeType||"gp3",dedicatedMaster:pr.dedicatedMaster||!1,dedicatedMasterType:pr.dedicatedMasterType,dedicatedMasterCount:pr.dedicatedMasterCount||3,multiAz:pr.multiAz||!1,encryption:pr.encryption||{atRest:!0,nodeToNode:!0},advancedSecurity:pr.advancedSecurity,autoTune:pr.autoTune!==!1,vpc:St});this.builder.addResource(Bt,Se),this.builder.addOutput("SearchDomainEndpoint",{Value:{"Fn::GetAtt":[Bt,"DomainEndpoint"]},Description:"OpenSearch domain endpoint"}),this.builder.addOutput("SearchDomainArn",{Value:{"Fn::GetAtt":[Bt,"Arn"]},Description:"OpenSearch domain ARN"})}let gr=this.mergedConfig.infrastructure?.fileSystem;if(gr&&Object.keys(gr).length>0){this.generateNetworkInfrastructure(l,S);for(let[St,Se]of Object.entries(gr)){let{fileSystem:Bt,logicalId:ie}=qe.createFileSystem({slug:`${l}-${St}`,environment:S,encrypted:Se.encrypted!==!1,performanceMode:Se.performanceMode||"generalPurpose",throughputMode:Se.throughputMode||"bursting",enableBackup:!0});this.builder.addResource(ie,Bt);let{securityGroup:Rt,logicalId:Nt}=qe.createEfsSecurityGroup({slug:`${l}-${St}`,environment:S,vpcId:{Ref:"VPC"},sourceCidrBlocks:["10.0.0.0/16"]});this.builder.addResource(Nt,Rt);let{mountTargets:er,logicalIds:lr}=qe.createMultiAzMountTargets(ie,{slug:`${l}-${St}`,environment:S,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}],securityGroupId:{Ref:Nt}});for(let fr=0;fr<er.length;fr++)this.builder.addResource(lr[fr],er[fr]);this.builder.addOutput(`${St}FileSystemId`,{Value:{Ref:ie},Description:`EFS file system ID for ${St}`})}}let Dt=this.mergedConfig.infrastructure?.ai;if(Dt){let St=Dt.service||"ecs",Se=Dt.models||["*"],Bt=Dt.allowStreaming!==!1,ie;if(St==="ecs")ie=we.enableBedrockForEcs({slug:l,environment:S,models:Se,allowStreaming:Bt});else if(St==="ec2")ie=we.enableBedrockForEc2({slug:l,environment:S,models:Se,allowStreaming:Bt});else if(St==="lambda")ie=we.enableBedrockForLambda({slug:l,environment:S,models:Se,allowStreaming:Bt});else ie=we.createBedrockRole(St,{slug:l,environment:S,models:Se,allowStreaming:Bt});if(this.builder.addResource(ie.logicalId,ie.role),Dt.allowAsync){let{policy:Rt,logicalId:Nt}=we.createBedrockPolicy({slug:l,environment:S,models:Se,allowStreaming:Bt,allowAsync:!0});this.builder.addResource(Nt,Rt)}this.builder.addOutput("BedrockRoleArn",{Value:{"Fn::GetAtt":[ie.logicalId,"Arn"]},Description:"IAM role ARN with Bedrock permissions"})}}generateRealtimeResources(l,S){let P=this.mergedConfig.infrastructure?.realtime;if(!P)return;let v=P.name||`${l}-${S}-realtime`,E=P.scaling||{},ot=P.storage||{type:"dynamodb"},Ie=E.handlerMemory||256,Ne=E.handlerTimeout||30,nt=`${l}${S}RealtimeConnections`.replace(/[^a-zA-Z0-9]/g,""),Pt=`${l}${S}RealtimeChannels`.replace(/[^a-zA-Z0-9]/g,"");if(ot.type==="dynamodb"){let lr=ot.dynamodb||{},fr=lr.billingMode||"PAY_PER_REQUEST";this.builder.addResource(nt,{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${l}-${S}-realtime-connections`,BillingMode:fr,AttributeDefinitions:[{AttributeName:"connectionId",AttributeType:"S"},{AttributeName:"userId",AttributeType:"S"}],KeySchema:[{AttributeName:"connectionId",KeyType:"HASH"}],GlobalSecondaryIndexes:[{IndexName:"userId-index",KeySchema:[{AttributeName:"userId",KeyType:"HASH"}],Projection:{ProjectionType:"ALL"},...fr==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:lr.readCapacity||5,WriteCapacityUnits:lr.writeCapacity||5}}}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0},...fr==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:lr.readCapacity||5,WriteCapacityUnits:lr.writeCapacity||5}},...lr.pointInTimeRecovery&&{PointInTimeRecoverySpecification:{PointInTimeRecoveryEnabled:!0}},Tags:[{Key:"Name",Value:`${l}-${S}-realtime-connections`},{Key:"Environment",Value:S}]}}),this.builder.addResource(Pt,{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${l}-${S}-realtime-channels`,BillingMode:fr,AttributeDefinitions:[{AttributeName:"channel",AttributeType:"S"},{AttributeName:"connectionId",AttributeType:"S"}],KeySchema:[{AttributeName:"channel",KeyType:"HASH"},{AttributeName:"connectionId",KeyType:"RANGE"}],GlobalSecondaryIndexes:[{IndexName:"connectionId-index",KeySchema:[{AttributeName:"connectionId",KeyType:"HASH"}],Projection:{ProjectionType:"ALL"},...fr==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:lr.readCapacity||5,WriteCapacityUnits:lr.writeCapacity||5}}}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0},...fr==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:lr.readCapacity||5,WriteCapacityUnits:lr.writeCapacity||5}},Tags:[{Key:"Name",Value:`${l}-${S}-realtime-channels`},{Key:"Environment",Value:S}]}})}let st=`${l}${S}RealtimeRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(st,{Type:"AWS::IAM::Role",Properties:{RoleName:`${l}-${S}-realtime-handler-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"],Policies:[{PolicyName:"RealtimeHandlerPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["dynamodb:GetItem","dynamodb:PutItem","dynamodb:DeleteItem","dynamodb:Query","dynamodb:Scan","dynamodb:UpdateItem"],Resource:[{"Fn::GetAtt":[nt,"Arn"]},{"Fn::Sub":`\${${nt}.Arn}/index/*`},{"Fn::GetAtt":[Pt,"Arn"]},{"Fn::Sub":`\${${Pt}.Arn}/index/*`}]},{Effect:"Allow",Action:"execute-api:ManageConnections",Resource:{"Fn::Sub":"arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*/*"}}]}}]}});let ur=`${l}${S}RealtimeConnect`.replace(/[^a-zA-Z0-9]/g,""),pr=`${l}${S}RealtimeDisconnect`.replace(/[^a-zA-Z0-9]/g,""),gr=`${l}${S}RealtimeMessage`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(ur,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${l}-${S}-realtime-connect`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[st,"Arn"]},MemorySize:Ie,Timeout:Ne,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:nt},CHANNELS_TABLE:{Ref:Pt},ENVIRONMENT:S}},Code:{ZipFile:this.generateConnectHandlerCode()}},DependsOn:[st,nt]}),this.builder.addResource(pr,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${l}-${S}-realtime-disconnect`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[st,"Arn"]},MemorySize:Ie,Timeout:Ne,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:nt},CHANNELS_TABLE:{Ref:Pt},ENVIRONMENT:S}},Code:{ZipFile:this.generateDisconnectHandlerCode()}},DependsOn:[st,nt,Pt]}),this.builder.addResource(gr,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${l}-${S}-realtime-message`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[st,"Arn"]},MemorySize:Ie,Timeout:Ne,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:nt},CHANNELS_TABLE:{Ref:Pt},ENVIRONMENT:S}},Code:{ZipFile:this.generateMessageHandlerCode()}},DependsOn:[st,nt,Pt]});let Dt=`${l}${S}RealtimeApi`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Dt,{Type:"AWS::ApiGatewayV2::Api",Properties:{Name:v,ProtocolType:"WEBSOCKET",RouteSelectionExpression:"$request.body.action",Tags:{Name:v,Environment:S}}});let St=`${ur}Permission`,Se=`${pr}Permission`,Bt=`${gr}Permission`;this.builder.addResource(St,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:ur},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${Dt}}/*/$connect`}}}),this.builder.addResource(Se,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:pr},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${Dt}}/*/$disconnect`}}}),this.builder.addResource(Bt,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:gr},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${Dt}}/*/$default`}}});let ie=`${Dt}ConnectInteg`,Rt=`${Dt}DisconnectInteg`,Nt=`${Dt}MessageInteg`;this.builder.addResource(ie,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:Dt},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${ur}.Arn}/invocations`}}}),this.builder.addResource(Rt,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:Dt},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${pr}.Arn}/invocations`}}}),this.builder.addResource(Nt,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:Dt},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${gr}.Arn}/invocations`}}}),this.builder.addResource(`${Dt}ConnectRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:Dt},RouteKey:"$connect",AuthorizationType:"NONE",Target:{"Fn::Sub":`integrations/\${${ie}}`}}}),this.builder.addResource(`${Dt}DisconnectRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:Dt},RouteKey:"$disconnect",Target:{"Fn::Sub":`integrations/\${${Rt}}`}}}),this.builder.addResource(`${Dt}DefaultRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:Dt},RouteKey:"$default",Target:{"Fn::Sub":`integrations/\${${Nt}}`}}});let er=`${Dt}Stage`;if(this.builder.addResource(er,{Type:"AWS::ApiGatewayV2::Stage",Properties:{ApiId:{Ref:Dt},StageName:S,AutoDeploy:!0,DefaultRouteSettings:{ThrottlingBurstLimit:E.messagesPerSecond||1000,ThrottlingRateLimit:E.messagesPerSecond||1000}}}),P.monitoring?.enabled){let lr=P.monitoring,fr=lr.notificationTopicArn;if(!fr&&lr.notificationEmails?.length){let Cr=`${Dt}AlarmTopic`;this.builder.addResource(Cr,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${l}-${S}-realtime-alarms`,DisplayName:"Realtime WebSocket Alarms"}}),lr.notificationEmails.forEach((vr,an)=>{this.builder.addResource(`${Cr}Sub${an}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:Cr},Protocol:"email",Endpoint:vr}})}),fr={Ref:Cr}}if(lr.connectionThreshold)this.builder.addResource(`${Dt}ConnectionAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${S}-realtime-connections`,AlarmDescription:`WebSocket connections exceed ${lr.connectionThreshold}`,MetricName:"ConnectCount",Namespace:"AWS/ApiGateway",Statistic:"Sum",Period:300,EvaluationPeriods:2,Threshold:lr.connectionThreshold,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ApiId",Value:{Ref:Dt}}],...fr&&{AlarmActions:[fr]}}});if(lr.errorThreshold)this.builder.addResource(`${Dt}ErrorAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${S}-realtime-errors`,AlarmDescription:`WebSocket errors exceed ${lr.errorThreshold}/min`,MetricName:"ExecutionError",Namespace:"AWS/ApiGateway",Statistic:"Sum",Period:60,EvaluationPeriods:3,Threshold:lr.errorThreshold,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ApiId",Value:{Ref:Dt}}],...fr&&{AlarmActions:[fr]}}})}this.builder.addOutput(`${Dt}Endpoint`,{Description:"WebSocket API endpoint URL",Value:{"Fn::Sub":`wss://\${${Dt}}.execute-api.\${AWS::Region}.amazonaws.com/${S}`},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-endpoint"}}}),this.builder.addOutput(`${Dt}Id`,{Description:"WebSocket API ID",Value:{Ref:Dt},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-api-id"}}})}generateConnectHandlerCode(){return`
 const { DynamoDBClient } = require('@aws-sdk/client-dynamodb');
 const { DynamoDBDocumentClient, PutCommand } = require('@aws-sdk/lib-dynamodb');
 
@@ -170,7 +170,7 @@ catch (error) {
     return { statusCode: 500, body: JSON.stringify({ error: 'Internal error' }) };
   }
 };
-`.trim()}generateRealtimeServerResources(l,S){let P=this.mergedConfig.infrastructure?.realtime;if(!P)return;let E=P.server||{},v=E.port||6001,it=E.instances||1,Pe=`${l}${S}RealtimeSG`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Pe,{Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:`Security group for ${l} realtime WebSocket server`,GroupName:`${l}-${S}-realtime-sg`,VpcId:{Ref:"VPC"},SecurityGroupIngress:[{IpProtocol:"tcp",FromPort:v,ToPort:v,CidrIp:"0.0.0.0/0",Description:"WebSocket connections"},{IpProtocol:"tcp",FromPort:443,ToPort:443,CidrIp:"0.0.0.0/0",Description:"HTTPS/WSS connections"}],SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:`${l}-${S}-realtime-sg`},{Key:"Environment",Value:S}]}});let Ie=`${l}${S}RealtimeTaskDef`.replace(/[^a-zA-Z0-9]/g,""),rt=`${l}${S}RealtimeTaskRole`.replace(/[^a-zA-Z0-9]/g,""),Pt=`${l}${S}RealtimeExecRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Pt,{Type:"AWS::IAM::Role",Properties:{RoleName:`${l}-${S}-realtime-exec-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]}}),this.builder.addResource(rt,{Type:"AWS::IAM::Role",Properties:{RoleName:`${l}-${S}-realtime-task-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"RealtimeTaskPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:"*"},...E.redis?.enabled?[{Effect:"Allow",Action:["elasticache:DescribeCacheClusters","elasticache:DescribeReplicationGroups"],Resource:"*"}]:[]]}}]}});let st=[{Name:"BROADCAST_HOST",Value:E.host||"0.0.0.0"},{Name:"BROADCAST_PORT",Value:String(v)},{Name:"NODE_ENV",Value:S==="production"?"production":"development"}];if(E.redis?.enabled){if(E.redis.useElastiCache)st.push({Name:"REDIS_HOST",Value:{"Fn::GetAtt":["CacheCluster","RedisEndpoint.Address"]}}),st.push({Name:"REDIS_PORT",Value:{"Fn::GetAtt":["CacheCluster","RedisEndpoint.Port"]}});else st.push({Name:"REDIS_HOST",Value:E.redis.host||"localhost"}),st.push({Name:"REDIS_PORT",Value:String(E.redis.port||6379)});if(E.redis.keyPrefix)st.push({Name:"REDIS_KEY_PREFIX",Value:E.redis.keyPrefix})}this.builder.addResource(Ie,{Type:"AWS::ECS::TaskDefinition",Properties:{Family:`${l}-${S}-realtime`,NetworkMode:"awsvpc",RequiresCompatibilities:["FARGATE"],Cpu:"512",Memory:"1024",ExecutionRoleArn:{"Fn::GetAtt":[Pt,"Arn"]},TaskRoleArn:{"Fn::GetAtt":[rt,"Arn"]},ContainerDefinitions:[{Name:"realtime",Image:{"Fn::Sub":`\${AWS::AccountId}.dkr.ecr.\${AWS::Region}.amazonaws.com/${l}-realtime:latest`},Essential:!0,PortMappings:[{ContainerPort:v,Protocol:"tcp"}],Environment:st,LogConfiguration:{LogDriver:"awslogs",Options:{"awslogs-group":`/ecs/${l}-${S}-realtime`,"awslogs-region":{Ref:"AWS::Region"},"awslogs-stream-prefix":"realtime"}},HealthCheck:{Command:["CMD-SHELL",`curl -f http://localhost:${v}${E.healthCheckPath||"/health"} || exit 1`],Interval:30,Timeout:5,Retries:3,StartPeriod:60}}],Tags:[{Key:"Name",Value:`${l}-${S}-realtime`},{Key:"Environment",Value:S}]},DependsOn:[Pt,rt]});let cr=`${l}${S}RealtimeLogs`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(cr,{Type:"AWS::Logs::LogGroup",Properties:{LogGroupName:`/ecs/${l}-${S}-realtime`,RetentionInDays:30}});let lr=`${l}${S}RealtimeService`.replace(/[^a-zA-Z0-9]/g,"");if(this.builder.addResource(lr,{Type:"AWS::ECS::Service",Properties:{ServiceName:`${l}-${S}-realtime`,Cluster:{Ref:"ECSCluster"},TaskDefinition:{Ref:Ie},DesiredCount:it,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{AssignPublicIp:"ENABLED",SecurityGroups:[{Ref:Pe}],Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]}},HealthCheckGracePeriodSeconds:60,Tags:[{Key:"Name",Value:`${l}-${S}-realtime`},{Key:"Environment",Value:S}]},DependsOn:[Ie,Pe,cr]}),E.autoScaling){let gr=E.autoScaling,Dt=`${l}${S}RealtimeScalableTarget`.replace(/[^a-zA-Z0-9]/g,"");if(this.builder.addResource(Dt,{Type:"AWS::ApplicationAutoScaling::ScalableTarget",Properties:{MaxCapacity:gr.max||10,MinCapacity:gr.min||1,ResourceId:{"Fn::Sub":`service/\${ECSCluster}/${l}-${S}-realtime`},RoleARN:{"Fn::Sub":"arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService"},ScalableDimension:"ecs:service:DesiredCount",ServiceNamespace:"ecs"},DependsOn:lr}),gr.targetCPU)this.builder.addResource(`${l}${S}RealtimeCPUPolicy`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::ApplicationAutoScaling::ScalingPolicy",Properties:{PolicyName:`${l}-${S}-realtime-cpu-scaling`,PolicyType:"TargetTrackingScaling",ScalingTargetId:{Ref:Dt},TargetTrackingScalingPolicyConfiguration:{PredefinedMetricSpecification:{PredefinedMetricType:"ECSServiceAverageCPUUtilization"},TargetValue:gr.targetCPU,ScaleInCooldown:300,ScaleOutCooldown:60}}})}if(P.monitoring?.enabled){let gr=P.monitoring,Dt=gr.notificationTopicArn;if(!Dt&&gr.notificationEmails?.length){let Rt=`${l}${S}RealtimeAlarmTopic`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Rt,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${l}-${S}-realtime-alarms`,DisplayName:"Realtime Server Alarms"}}),gr.notificationEmails.forEach((Se,kt)=>{this.builder.addResource(`${Rt}Sub${kt}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:Rt},Protocol:"email",Endpoint:Se}})}),Dt={Ref:Rt}}this.builder.addResource(`${l}${S}RealtimeCPUAlarm`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${S}-realtime-high-cpu`,AlarmDescription:"Realtime server CPU utilization is high",MetricName:"CPUUtilization",Namespace:"AWS/ECS",Statistic:"Average",Period:300,EvaluationPeriods:2,Threshold:80,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ClusterName",Value:{Ref:"ECSCluster"}},{Name:"ServiceName",Value:`${l}-${S}-realtime`}],...Dt&&{AlarmActions:[Dt]}},DependsOn:lr}),this.builder.addResource(`${l}${S}RealtimeMemoryAlarm`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${S}-realtime-high-memory`,AlarmDescription:"Realtime server memory utilization is high",MetricName:"MemoryUtilization",Namespace:"AWS/ECS",Statistic:"Average",Period:300,EvaluationPeriods:2,Threshold:80,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ClusterName",Value:{Ref:"ECSCluster"}},{Name:"ServiceName",Value:`${l}-${S}-realtime`}],...Dt&&{AlarmActions:[Dt]}},DependsOn:lr})}this.builder.addOutput(`${l}${S}RealtimeEndpoint`.replace(/[^a-zA-Z0-9]/g,""),{Description:"Realtime WebSocket server endpoint",Value:{"Fn::Sub":`wss://${l}-${S}-realtime.\${AWS::Region}.elb.amazonaws.com:${v}`},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-endpoint"}}})}generateBroadcastConfig(){let l=this.mergedConfig.infrastructure?.realtime;if(!l||l.mode!=="server")return"";let S=l.server||{};return`import type { BroadcastConfig } from 'ts-broadcasting'
+`.trim()}generateRealtimeServerResources(l,S){let P=this.mergedConfig.infrastructure?.realtime;if(!P)return;let v=P.server||{},E=v.port||6001,ot=v.instances||1,Ie=`${l}${S}RealtimeSG`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Ie,{Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:`Security group for ${l} realtime WebSocket server`,GroupName:`${l}-${S}-realtime-sg`,VpcId:{Ref:"VPC"},SecurityGroupIngress:[{IpProtocol:"tcp",FromPort:E,ToPort:E,CidrIp:"0.0.0.0/0",Description:"WebSocket connections"},{IpProtocol:"tcp",FromPort:443,ToPort:443,CidrIp:"0.0.0.0/0",Description:"HTTPS/WSS connections"}],SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:`${l}-${S}-realtime-sg`},{Key:"Environment",Value:S}]}});let Ne=`${l}${S}RealtimeTaskDef`.replace(/[^a-zA-Z0-9]/g,""),nt=`${l}${S}RealtimeTaskRole`.replace(/[^a-zA-Z0-9]/g,""),Pt=`${l}${S}RealtimeExecRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Pt,{Type:"AWS::IAM::Role",Properties:{RoleName:`${l}-${S}-realtime-exec-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]}}),this.builder.addResource(nt,{Type:"AWS::IAM::Role",Properties:{RoleName:`${l}-${S}-realtime-task-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"RealtimeTaskPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:"*"},...v.redis?.enabled?[{Effect:"Allow",Action:["elasticache:DescribeCacheClusters","elasticache:DescribeReplicationGroups"],Resource:"*"}]:[]]}}]}});let st=[{Name:"BROADCAST_HOST",Value:v.host||"0.0.0.0"},{Name:"BROADCAST_PORT",Value:String(E)},{Name:"NODE_ENV",Value:S==="production"?"production":"development"}];if(v.redis?.enabled){if(v.redis.useElastiCache)st.push({Name:"REDIS_HOST",Value:{"Fn::GetAtt":["CacheCluster","RedisEndpoint.Address"]}}),st.push({Name:"REDIS_PORT",Value:{"Fn::GetAtt":["CacheCluster","RedisEndpoint.Port"]}});else st.push({Name:"REDIS_HOST",Value:v.redis.host||"localhost"}),st.push({Name:"REDIS_PORT",Value:String(v.redis.port||6379)});if(v.redis.keyPrefix)st.push({Name:"REDIS_KEY_PREFIX",Value:v.redis.keyPrefix})}this.builder.addResource(Ne,{Type:"AWS::ECS::TaskDefinition",Properties:{Family:`${l}-${S}-realtime`,NetworkMode:"awsvpc",RequiresCompatibilities:["FARGATE"],Cpu:"512",Memory:"1024",ExecutionRoleArn:{"Fn::GetAtt":[Pt,"Arn"]},TaskRoleArn:{"Fn::GetAtt":[nt,"Arn"]},ContainerDefinitions:[{Name:"realtime",Image:{"Fn::Sub":`\${AWS::AccountId}.dkr.ecr.\${AWS::Region}.amazonaws.com/${l}-realtime:latest`},Essential:!0,PortMappings:[{ContainerPort:E,Protocol:"tcp"}],Environment:st,LogConfiguration:{LogDriver:"awslogs",Options:{"awslogs-group":`/ecs/${l}-${S}-realtime`,"awslogs-region":{Ref:"AWS::Region"},"awslogs-stream-prefix":"realtime"}},HealthCheck:{Command:["CMD-SHELL",`curl -f http://localhost:${E}${v.healthCheckPath||"/health"} || exit 1`],Interval:30,Timeout:5,Retries:3,StartPeriod:60}}],Tags:[{Key:"Name",Value:`${l}-${S}-realtime`},{Key:"Environment",Value:S}]},DependsOn:[Pt,nt]});let ur=`${l}${S}RealtimeLogs`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(ur,{Type:"AWS::Logs::LogGroup",Properties:{LogGroupName:`/ecs/${l}-${S}-realtime`,RetentionInDays:30}});let pr=`${l}${S}RealtimeService`.replace(/[^a-zA-Z0-9]/g,"");if(this.builder.addResource(pr,{Type:"AWS::ECS::Service",Properties:{ServiceName:`${l}-${S}-realtime`,Cluster:{Ref:"ECSCluster"},TaskDefinition:{Ref:Ne},DesiredCount:ot,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{AssignPublicIp:"ENABLED",SecurityGroups:[{Ref:Ie}],Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]}},HealthCheckGracePeriodSeconds:60,Tags:[{Key:"Name",Value:`${l}-${S}-realtime`},{Key:"Environment",Value:S}]},DependsOn:[Ne,Ie,ur]}),v.autoScaling){let gr=v.autoScaling,Dt=`${l}${S}RealtimeScalableTarget`.replace(/[^a-zA-Z0-9]/g,"");if(this.builder.addResource(Dt,{Type:"AWS::ApplicationAutoScaling::ScalableTarget",Properties:{MaxCapacity:gr.max||10,MinCapacity:gr.min||1,ResourceId:{"Fn::Sub":`service/\${ECSCluster}/${l}-${S}-realtime`},RoleARN:{"Fn::Sub":"arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService"},ScalableDimension:"ecs:service:DesiredCount",ServiceNamespace:"ecs"},DependsOn:pr}),gr.targetCPU)this.builder.addResource(`${l}${S}RealtimeCPUPolicy`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::ApplicationAutoScaling::ScalingPolicy",Properties:{PolicyName:`${l}-${S}-realtime-cpu-scaling`,PolicyType:"TargetTrackingScaling",ScalingTargetId:{Ref:Dt},TargetTrackingScalingPolicyConfiguration:{PredefinedMetricSpecification:{PredefinedMetricType:"ECSServiceAverageCPUUtilization"},TargetValue:gr.targetCPU,ScaleInCooldown:300,ScaleOutCooldown:60}}})}if(P.monitoring?.enabled){let gr=P.monitoring,Dt=gr.notificationTopicArn;if(!Dt&&gr.notificationEmails?.length){let St=`${l}${S}RealtimeAlarmTopic`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(St,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${l}-${S}-realtime-alarms`,DisplayName:"Realtime Server Alarms"}}),gr.notificationEmails.forEach((Se,Bt)=>{this.builder.addResource(`${St}Sub${Bt}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:St},Protocol:"email",Endpoint:Se}})}),Dt={Ref:St}}this.builder.addResource(`${l}${S}RealtimeCPUAlarm`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${S}-realtime-high-cpu`,AlarmDescription:"Realtime server CPU utilization is high",MetricName:"CPUUtilization",Namespace:"AWS/ECS",Statistic:"Average",Period:300,EvaluationPeriods:2,Threshold:80,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ClusterName",Value:{Ref:"ECSCluster"}},{Name:"ServiceName",Value:`${l}-${S}-realtime`}],...Dt&&{AlarmActions:[Dt]}},DependsOn:pr}),this.builder.addResource(`${l}${S}RealtimeMemoryAlarm`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${S}-realtime-high-memory`,AlarmDescription:"Realtime server memory utilization is high",MetricName:"MemoryUtilization",Namespace:"AWS/ECS",Statistic:"Average",Period:300,EvaluationPeriods:2,Threshold:80,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ClusterName",Value:{Ref:"ECSCluster"}},{Name:"ServiceName",Value:`${l}-${S}-realtime`}],...Dt&&{AlarmActions:[Dt]}},DependsOn:pr})}this.builder.addOutput(`${l}${S}RealtimeEndpoint`.replace(/[^a-zA-Z0-9]/g,""),{Description:"Realtime WebSocket server endpoint",Value:{"Fn::Sub":`wss://${l}-${S}-realtime.\${AWS::Region}.elb.amazonaws.com:${E}`},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-endpoint"}}})}generateBroadcastConfig(){let l=this.mergedConfig.infrastructure?.realtime;if(!l||l.mode!=="server")return"";let S=l.server||{};return`import type { BroadcastConfig } from 'ts-broadcasting'
 
 export default {
   verbose: ${this.environment!=="production"},
@@ -219,7 +219,7 @@ ${S.loadManagement?.enabled?`
   },
 `:""}
 } satisfies BroadcastConfig
-`}toYAML(){return this.builder.toYAML()}toJSON(){return this.builder.toJSON()}getBuilder(){return this.builder}}function Ul(l){let S=[],P=[];if(!l.AWSTemplateFormatVersion)S.push({path:"AWSTemplateFormatVersion",message:"AWSTemplateFormatVersion is required",severity:"error"});else if(l.AWSTemplateFormatVersion!=="2010-09-09")P.push({path:"AWSTemplateFormatVersion",message:'AWSTemplateFormatVersion should be "2010-09-09"',severity:"warning"});if(!l.Resources||Object.keys(l.Resources).length===0)S.push({path:"Resources",message:"At least one resource is required",severity:"error"});else for(let[E,v]of Object.entries(l.Resources))Kl(E,v,S,P);if(l.Resources){let E=Jl(l.Resources);if(E.length>0)S.push({path:"Resources",message:`Circular dependencies detected: ${E.join(" -> ")}`,severity:"error"})}if(l.Parameters)for(let[E,v]of Object.entries(l.Parameters))jl(E,v,S,P);if(l.Outputs)for(let[E,v]of Object.entries(l.Outputs))ql(E,v,S,P);return{valid:S.length===0,errors:S,warnings:P}}function Kl(l,S,P,E){if(!S.Type)P.push({path:`Resources.${l}.Type`,message:"Resource Type is required",severity:"error"});if(!/^[a-zA-Z0-9]+$/.test(l))E.push({path:`Resources.${l}`,message:"Logical ID should only contain alphanumeric characters",severity:"warning"});if(S.Type&&!S.Type.startsWith("AWS::")&&!S.Type.startsWith("Custom::"))P.push({path:`Resources.${l}.Type`,message:'Resource Type must start with "AWS::" or "Custom::"',severity:"error"});if(S.Properties){for(let[v,it]of Object.entries(S.Properties))if(it===void 0||it===null)E.push({path:`Resources.${l}.Properties.${v}`,message:"Property has undefined or null value",severity:"warning"})}if(S.DependsOn){if(typeof S.DependsOn==="string"){if(S.DependsOn===l)P.push({path:`Resources.${l}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}else if(Array.isArray(S.DependsOn)){if(S.DependsOn.includes(l))P.push({path:`Resources.${l}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}}}function jl(l,S,P,E){if(!S.Type)P.push({path:`Parameters.${l}.Type`,message:"Parameter Type is required",severity:"error"});let v=["String","Number","List<Number>","CommaDelimitedList","AWS::SSM::Parameter::Value<String>"];if(S.Type&&!v.includes(S.Type)&&!S.Type.startsWith("AWS::"))E.push({path:`Parameters.${l}.Type`,message:`Uncommon parameter type: ${S.Type}`,severity:"warning"});if(S.NoEcho&&S.Default)E.push({path:`Parameters.${l}`,message:"NoEcho parameters should not have default values",severity:"warning"})}function ql(l,S,P,E){if(!S.Value)P.push({path:`Outputs.${l}.Value`,message:"Output Value is required",severity:"error"})}function Jl(l){let S={};for(let[Pe,Ie]of Object.entries(l)){if(S[Pe]=[],Ie.DependsOn){if(typeof Ie.DependsOn==="string")S[Pe].push(Ie.DependsOn);else if(Array.isArray(Ie.DependsOn))S[Pe].push(...Ie.DependsOn)}let rt=rs(Ie);S[Pe].push(...rt)}let P=new Set,E=new Set,v=[];function it(Pe,Ie){P.add(Pe),E.add(Pe),Ie.push(Pe);let rt=S[Pe]||[];for(let Pt of rt)if(!P.has(Pt)){if(it(Pt,Ie))return!0}else if(E.has(Pt)){let st=Ie.indexOf(Pt);return v.push(...Ie.slice(st),Pt),!0}return Ie.pop(),E.delete(Pe),!1}for(let Pe of Object.keys(S))if(!P.has(Pe)){if(it(Pe,[]))return v}return[]}function rs(l,S=[]){if(typeof l!=="object"||l===null)return S;if(Array.isArray(l)){for(let P of l)rs(P,S);return S}if(l.Ref&&typeof l.Ref==="string"&&!l.Ref.startsWith("AWS::"))S.push(l.Ref);if(l["Fn::GetAtt"]){let P=l["Fn::GetAtt"];if(Array.isArray(P)&&P.length>0)S.push(P[0])}for(let P of Object.values(l))rs(P,S);return S}function Xl(l){let S=[],P=[],E=new TextEncoder().encode(l).length,v=51200,it=460800;if(E>51200)if(E>460800)S.push({path:"template",message:`Template size (${E} bytes) exceeds maximum allowed size of 460800 bytes`,severity:"error"});else P.push({path:"template",message:`Template size (${E} bytes) exceeds direct upload limit (51200 bytes). You must upload to S3 first.`,severity:"warning"});return{valid:S.length===0,errors:S,warnings:P}}function Ql(l){let S=[],P=[],E=l.Resources?Object.keys(l.Resources).length:0,v=l.Parameters?Object.keys(l.Parameters).length:0,it=l.Outputs?Object.keys(l.Outputs).length:0;if(E>500)S.push({path:"Resources",message:`Template has ${E} resources, exceeding the limit of 500`,severity:"error"});else if(E>200)P.push({path:"Resources",message:`Template has ${E} resources. Consider using nested stacks for better organization.`,severity:"warning"});if(v>200)S.push({path:"Parameters",message:`Template has ${v} parameters, exceeding the limit of 200`,severity:"error"});if(it>200)S.push({path:"Outputs",message:`Template has ${it} outputs, exceeding the limit of 200`,severity:"error"});return{valid:S.length===0,errors:S,warnings:P}}function Qu(l){let{domains:S,email:P,staging:E=!1,challengeType:v="http-01",certPath:it="/etc/letsencrypt/live",autoRenew:Pe=!0}=l,Ie=S[0],rt=S.map((st)=>`-d ${st}`).join(" "),Pt=E?"--staging":"";if(v==="http-01")return Hd({domains:S,email:P,staging:E,certPath:it,autoRenew:Pe,domainFlags:rt,stagingFlag:Pt,primaryDomain:Ie});else{let st=l.dnsProvider?.provider||(l.hostedZoneId?"route53":void 0);return ou({domains:S,email:P,staging:E,certPath:it,autoRenew:Pe,domainFlags:rt,stagingFlag:Pt,primaryDomain:Ie,hostedZoneId:l.hostedZoneId,dnsProvider:l.dnsProvider,dnsProviderType:st})}}function Hd(l){let{email:S,certPath:P,autoRenew:E,domainFlags:v,stagingFlag:it,primaryDomain:Pe}=l;return`
+`}toYAML(){return this.builder.toYAML()}toJSON(){return this.builder.toJSON()}getBuilder(){return this.builder}}function Kd(l){let S=[],P=[];if(!l.AWSTemplateFormatVersion)S.push({path:"AWSTemplateFormatVersion",message:"AWSTemplateFormatVersion is required",severity:"error"});else if(l.AWSTemplateFormatVersion!=="2010-09-09")P.push({path:"AWSTemplateFormatVersion",message:'AWSTemplateFormatVersion should be "2010-09-09"',severity:"warning"});if(!l.Resources||Object.keys(l.Resources).length===0)S.push({path:"Resources",message:"At least one resource is required",severity:"error"});else for(let[v,E]of Object.entries(l.Resources))eu(v,E,S,P);if(l.Resources){let v=fu(l.Resources);if(v.length>0)S.push({path:"Resources",message:`Circular dependencies detected: ${v.join(" -> ")}`,severity:"error"})}if(l.Parameters)for(let[v,E]of Object.entries(l.Parameters))ou(v,E,S,P);if(l.Outputs)for(let[v,E]of Object.entries(l.Outputs))au(v,E,S,P);return{valid:S.length===0,errors:S,warnings:P}}function eu(l,S,P,v){if(!S.Type)P.push({path:`Resources.${l}.Type`,message:"Resource Type is required",severity:"error"});if(!/^[a-zA-Z0-9]+$/.test(l))v.push({path:`Resources.${l}`,message:"Logical ID should only contain alphanumeric characters",severity:"warning"});if(S.Type&&!S.Type.startsWith("AWS::")&&!S.Type.startsWith("Custom::"))P.push({path:`Resources.${l}.Type`,message:'Resource Type must start with "AWS::" or "Custom::"',severity:"error"});if(S.Properties){for(let[E,ot]of Object.entries(S.Properties))if(ot===void 0||ot===null)v.push({path:`Resources.${l}.Properties.${E}`,message:"Property has undefined or null value",severity:"warning"})}if(S.DependsOn){if(typeof S.DependsOn==="string"){if(S.DependsOn===l)P.push({path:`Resources.${l}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}else if(Array.isArray(S.DependsOn)){if(S.DependsOn.includes(l))P.push({path:`Resources.${l}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}}}function ou(l,S,P,v){if(!S.Type)P.push({path:`Parameters.${l}.Type`,message:"Parameter Type is required",severity:"error"});let E=["String","Number","List<Number>","CommaDelimitedList","AWS::SSM::Parameter::Value<String>"];if(S.Type&&!E.includes(S.Type)&&!S.Type.startsWith("AWS::"))v.push({path:`Parameters.${l}.Type`,message:`Uncommon parameter type: ${S.Type}`,severity:"warning"});if(S.NoEcho&&S.Default)v.push({path:`Parameters.${l}`,message:"NoEcho parameters should not have default values",severity:"warning"})}function au(l,S,P,v){if(!S.Value)P.push({path:`Outputs.${l}.Value`,message:"Output Value is required",severity:"error"})}function fu(l){let S={};for(let[Ie,Ne]of Object.entries(l)){if(S[Ie]=[],Ne.DependsOn){if(typeof Ne.DependsOn==="string")S[Ie].push(Ne.DependsOn);else if(Array.isArray(Ne.DependsOn))S[Ie].push(...Ne.DependsOn)}let nt=tc(Ne);S[Ie].push(...nt)}let P=new Set,v=new Set,E=[];function ot(Ie,Ne){P.add(Ie),v.add(Ie),Ne.push(Ie);let nt=S[Ie]||[];for(let Pt of nt)if(!P.has(Pt)){if(ot(Pt,Ne))return!0}else if(v.has(Pt)){let st=Ne.indexOf(Pt);return E.push(...Ne.slice(st),Pt),!0}return Ne.pop(),v.delete(Ie),!1}for(let Ie of Object.keys(S))if(!P.has(Ie)){if(ot(Ie,[]))return E}return[]}function tc(l,S=[]){if(typeof l!=="object"||l===null)return S;if(Array.isArray(l)){for(let P of l)tc(P,S);return S}if(l.Ref&&typeof l.Ref==="string"&&!l.Ref.startsWith("AWS::"))S.push(l.Ref);if(l["Fn::GetAtt"]){let P=l["Fn::GetAtt"];if(Array.isArray(P)&&P.length>0)S.push(P[0])}for(let P of Object.values(l))tc(P,S);return S}function hu(l){let S=[],P=[],v=new TextEncoder().encode(l).length,E=51200,ot=460800;if(v>51200)if(v>460800)S.push({path:"template",message:`Template size (${v} bytes) exceeds maximum allowed size of 460800 bytes`,severity:"error"});else P.push({path:"template",message:`Template size (${v} bytes) exceeds direct upload limit (51200 bytes). You must upload to S3 first.`,severity:"warning"});return{valid:S.length===0,errors:S,warnings:P}}function yu(l){let S=[],P=[],v=l.Resources?Object.keys(l.Resources).length:0,E=l.Parameters?Object.keys(l.Parameters).length:0,ot=l.Outputs?Object.keys(l.Outputs).length:0;if(v>500)S.push({path:"Resources",message:`Template has ${v} resources, exceeding the limit of 500`,severity:"error"});else if(v>200)P.push({path:"Resources",message:`Template has ${v} resources. Consider using nested stacks for better organization.`,severity:"warning"});if(E>200)S.push({path:"Parameters",message:`Template has ${E} parameters, exceeding the limit of 200`,severity:"error"});if(ot>200)S.push({path:"Outputs",message:`Template has ${ot} outputs, exceeding the limit of 200`,severity:"error"});return{valid:S.length===0,errors:S,warnings:P}}function lh(l){let{domains:S,email:P,staging:v=!1,challengeType:E="http-01",certPath:ot="/etc/letsencrypt/live",autoRenew:Ie=!0}=l,Ne=S[0],nt=S.map((st)=>`-d ${st}`).join(" "),Pt=v?"--staging":"";if(E==="http-01")return Su({domains:S,email:P,staging:v,certPath:ot,autoRenew:Ie,domainFlags:nt,stagingFlag:Pt,primaryDomain:Ne});else{let st=l.dnsProvider?.provider||(l.hostedZoneId?"route53":void 0);return Pu({domains:S,email:P,staging:v,certPath:ot,autoRenew:Ie,domainFlags:nt,stagingFlag:Pt,primaryDomain:Ne,hostedZoneId:l.hostedZoneId,dnsProvider:l.dnsProvider,dnsProviderType:st})}}function Su(l){let{email:S,certPath:P,autoRenew:v,domainFlags:E,stagingFlag:ot,primaryDomain:Ie}=l;return`
 # ==========================================
 # Let's Encrypt Certificate Setup (HTTP-01)
 # ==========================================
@@ -236,28 +236,28 @@ certbot certonly \\
   --non-interactive \\
   --agree-tos \\
   --email ${S} \\
-  ${it} \\
-  ${v}
+  ${ot} \\
+  ${E}
 
 # Check if certificate was obtained
-if [ -f "${P}/${Pe}/fullchain.pem" ]; then
+if [ -f "${P}/${Ie}/fullchain.pem" ]; then
   echo "Certificate obtained successfully!"
 
   # Create symlinks for easier access
   mkdir -p /etc/ssl/stacks
-  ln -sf ${P}/${Pe}/fullchain.pem /etc/ssl/stacks/fullchain.pem
-  ln -sf ${P}/${Pe}/privkey.pem /etc/ssl/stacks/privkey.pem
-  ln -sf ${P}/${Pe}/cert.pem /etc/ssl/stacks/cert.pem
-  ln -sf ${P}/${Pe}/chain.pem /etc/ssl/stacks/chain.pem
+  ln -sf ${P}/${Ie}/fullchain.pem /etc/ssl/stacks/fullchain.pem
+  ln -sf ${P}/${Ie}/privkey.pem /etc/ssl/stacks/privkey.pem
+  ln -sf ${P}/${Ie}/cert.pem /etc/ssl/stacks/cert.pem
+  ln -sf ${P}/${Ie}/chain.pem /etc/ssl/stacks/chain.pem
 else
   echo "Failed to obtain certificate!"
 fi
 
-${E?os(Pe):"# Auto-renewal disabled"}
+${v?ic(Ie):"# Auto-renewal disabled"}
 
 # Restart the application
 systemctl start stacks
-`}function ou(l){let{email:S,certPath:P,autoRenew:E,domainFlags:v,stagingFlag:it,primaryDomain:Pe,hostedZoneId:Ie,dnsProvider:rt,dnsProviderType:Pt}=l;if(Pt==="route53"||Ie){if(!Ie)throw Error("hostedZoneId is required for DNS-01 challenge with Route53");return`
+`}function Pu(l){let{email:S,certPath:P,autoRenew:v,domainFlags:E,stagingFlag:ot,primaryDomain:Ie,hostedZoneId:Ne,dnsProvider:nt,dnsProviderType:Pt}=l;if(Pt==="route53"||Ne){if(!Ne)throw Error("hostedZoneId is required for DNS-01 challenge with Route53");return`
 # ==========================================
 # Let's Encrypt Certificate Setup (DNS-01 via Route53)
 # ==========================================
@@ -271,25 +271,25 @@ certbot certonly \\
   --non-interactive \\
   --agree-tos \\
   --email ${S} \\
-  ${it} \\
-  ${v}
+  ${ot} \\
+  ${E}
 
 # Check if certificate was obtained
-if [ -f "${P}/${Pe}/fullchain.pem" ]; then
+if [ -f "${P}/${Ie}/fullchain.pem" ]; then
   echo "Certificate obtained successfully!"
 
   # Create symlinks for easier access
   mkdir -p /etc/ssl/stacks
-  ln -sf ${P}/${Pe}/fullchain.pem /etc/ssl/stacks/fullchain.pem
-  ln -sf ${P}/${Pe}/privkey.pem /etc/ssl/stacks/privkey.pem
-  ln -sf ${P}/${Pe}/cert.pem /etc/ssl/stacks/cert.pem
-  ln -sf ${P}/${Pe}/chain.pem /etc/ssl/stacks/chain.pem
+  ln -sf ${P}/${Ie}/fullchain.pem /etc/ssl/stacks/fullchain.pem
+  ln -sf ${P}/${Ie}/privkey.pem /etc/ssl/stacks/privkey.pem
+  ln -sf ${P}/${Ie}/cert.pem /etc/ssl/stacks/cert.pem
+  ln -sf ${P}/${Ie}/chain.pem /etc/ssl/stacks/chain.pem
 else
   echo "Failed to obtain certificate!"
 fi
 
-${E?os(Pe):"# Auto-renewal disabled"}
-`}if(!rt)throw Error("dnsProvider configuration is required for DNS-01 challenge with external DNS providers");let st=rt.provider.toUpperCase(),cr=su(rt);return`
+${v?ic(Ie):"# Auto-renewal disabled"}
+`}if(!nt)throw Error("dnsProvider configuration is required for DNS-01 challenge with external DNS providers");let st=nt.provider.toUpperCase(),ur=$u(nt);return`
 # ==========================================
 # Let's Encrypt Certificate Setup (DNS-01 via ${st})
 # ==========================================
@@ -297,7 +297,7 @@ ${E?os(Pe):"# Auto-renewal disabled"}
 # Install certbot
 dnf install -y certbot jq curl
 
-${cr}
+${ur}
 
 # Create DNS challenge hook scripts directory
 mkdir -p /etc/letsencrypt/hooks
@@ -312,7 +312,7 @@ DOMAIN="$CERTBOT_DOMAIN"
 VALIDATION="$CERTBOT_VALIDATION"
 RECORD_NAME="_acme-challenge.$DOMAIN"
 
-${cu(rt)}
+${Iu(nt)}
 
 # Wait for DNS propagation
 echo "Waiting 60 seconds for DNS propagation..."
@@ -331,7 +331,7 @@ DOMAIN="$CERTBOT_DOMAIN"
 VALIDATION="$CERTBOT_VALIDATION"
 RECORD_NAME="_acme-challenge.$DOMAIN"
 
-${lu(rt)}
+${Du(nt)}
 CLEANUPHOOK
 
 chmod +x /etc/letsencrypt/hooks/cleanup-hook.sh
@@ -345,25 +345,25 @@ certbot certonly \\
   --non-interactive \\
   --agree-tos \\
   --email ${S} \\
-  ${it} \\
-  ${v}
+  ${ot} \\
+  ${E}
 
 # Check if certificate was obtained
-if [ -f "${P}/${Pe}/fullchain.pem" ]; then
+if [ -f "${P}/${Ie}/fullchain.pem" ]; then
   echo "Certificate obtained successfully!"
 
   # Create symlinks for easier access
   mkdir -p /etc/ssl/stacks
-  ln -sf ${P}/${Pe}/fullchain.pem /etc/ssl/stacks/fullchain.pem
-  ln -sf ${P}/${Pe}/privkey.pem /etc/ssl/stacks/privkey.pem
-  ln -sf ${P}/${Pe}/cert.pem /etc/ssl/stacks/cert.pem
-  ln -sf ${P}/${Pe}/chain.pem /etc/ssl/stacks/chain.pem
+  ln -sf ${P}/${Ie}/fullchain.pem /etc/ssl/stacks/fullchain.pem
+  ln -sf ${P}/${Ie}/privkey.pem /etc/ssl/stacks/privkey.pem
+  ln -sf ${P}/${Ie}/cert.pem /etc/ssl/stacks/cert.pem
+  ln -sf ${P}/${Ie}/chain.pem /etc/ssl/stacks/chain.pem
 else
   echo "Failed to obtain certificate!"
 fi
 
-${E?os(Pe):"# Auto-renewal disabled"}
-`}function su(l){switch(l.provider){case"porkbun":return`
+${v?ic(Ie):"# Auto-renewal disabled"}
+`}function $u(l){switch(l.provider){case"porkbun":return`
 # Porkbun API credentials
 export PORKBUN_API_KEY="${l.apiKey}"
 export PORKBUN_SECRET_KEY="${l.secretKey}"
@@ -374,7 +374,7 @@ export GODADDY_API_SECRET="${l.apiSecret}"
 export GODADDY_ENV="${l.environment||"production"}"
 `;case"route53":return`
 # Route53 uses IAM role credentials
-`;default:return""}}function cu(l){switch(l.provider){case"porkbun":return`
+`;default:return""}}function Iu(l){switch(l.provider){case"porkbun":return`
 # Extract root domain (last two parts)
 ROOT_DOMAIN=$(echo "$DOMAIN" | awk -F. '{print $(NF-1)"."$NF}')
 SUBDOMAIN="_acme-challenge"
@@ -418,7 +418,7 @@ curl -s -X PATCH "$API_URL/v1/domains/$ROOT_DOMAIN/records" \\
     "data": "'"$VALIDATION"'",
     "ttl": 600
   }]'
-`;default:return'echo "Unsupported DNS provider"'}}function lu(l){switch(l.provider){case"porkbun":return`
+`;default:return'echo "Unsupported DNS provider"'}}function Du(l){switch(l.provider){case"porkbun":return`
 # Extract root domain, and the challenge's subdomain the way the auth hook did
 ROOT_DOMAIN=$(echo "$DOMAIN" | awk -F. '{print $(NF-1)"."$NF}')
 SUBDOMAIN="_acme-challenge"
@@ -470,7 +470,7 @@ fi
 
 curl -s -X DELETE "$API_URL/v1/domains/$ROOT_DOMAIN/records/TXT/$RECORD_NAME" \\
   -H "Authorization: sso-key $GODADDY_API_KEY:$GODADDY_API_SECRET"
-`;default:return'echo "Unsupported DNS provider"'}}function os(l){return`
+`;default:return'echo "Unsupported DNS provider"'}}function ic(l){return`
 # ==========================================
 # Certificate Auto-Renewal Setup
 # ==========================================
@@ -515,11 +515,11 @@ systemctl enable certbot-renewal.timer
 systemctl start certbot-renewal.timer
 
 echo "Certificate auto-renewal configured"
-`}function Vm(l){let{httpPort:S=80,httpsPort:P=443,certPath:E="/etc/ssl/stacks",redirectHttp:v=!0}=l;return`
+`}function dh(l){let{httpPort:S=80,httpsPort:P=443,certPath:v="/etc/ssl/stacks",redirectHttp:E=!0}=l;return`
 // HTTPS Server with Let's Encrypt certificates
 import { readFileSync, existsSync } from 'node:fs'
 
-const CERT_PATH = '${E}'
+const CERT_PATH = '${v}'
 const HTTP_PORT = ${S}
 const HTTPS_PORT = ${P}
 
@@ -541,7 +541,7 @@ if (hasCerts) {
   })
   console.log(\`HTTPS server running on port \${HTTPS_PORT}\`)
 
-  ${v?`
+  ${E?`
   // Start HTTP server for redirect
   const httpServer = Bun.serve({
     port: HTTP_PORT,
@@ -601,5 +601,5 @@ async function handleRequest(request: Request): Promise<Response> {
   // Implement your request handling here
   return new Response('Hello from Stacks!')
 }
-`}async function du(l,S,P){let E=`_acme-challenge.${S}`;if(await Cu(l,S,E,P))return;let v=await l.createRecord(S,{name:E,type:"TXT",content:P,ttl:60});if(!v.success)throw Error(`Failed to create DNS challenge record: ${v.message}`)}async function yu(l,S,P){let E=await l.deleteRecord(S,{name:`_acme-challenge.${S}`,type:"TXT",content:P});if(!E.success)console.warn(`Failed to delete DNS challenge record: ${E.message}`)}async function Cu(l,S,P,E){try{let v=await l.listRecords(S,"TXT"),it=P.replace(/\.$/,"").toLowerCase();return(v.records??[]).some((Pe)=>Pe.name.replace(/\.$/,"").toLowerCase()===it&&Pe.content.replace(/^"|"$/g,"")===E)}catch{return!1}}function ac(l){let{hostedZoneId:S,dnsProvider:P,region:E="us-east-1"}=l;if(P)return T(P);if(S)return new z(E,S);throw Error("Either dnsProvider or hostedZoneId must be provided")}async function Wm(l){await du(ac(l),l.domain,l.challengeValue)}async function zm(l){await yu(ac(l),l.domain,l.challengeValue)}function Km(l){try{let{execSync:S}=Me("node:child_process"),P=S(`openssl x509 -checkend 2592000 -noout -in ${l}/cert.pem`,{encoding:"utf-8",stdio:["pipe","pipe","pipe"]});return!1}catch{return!0}}import{createHash as cc,createSign as Su,generateKeyPairSync as lc}from"node:crypto";var dc={production:"https://acme-v02.api.letsencrypt.org/directory",staging:"https://acme-staging-v02.api.letsencrypt.org/directory"};class bu{directoryUrl;email;accountKey;accountUrl=null;directory=null;nonce=null;constructor(l){this.directoryUrl=l.staging?dc.staging:dc.production,this.email=l.email,this.accountKey=l.accountKey||this.generateAccountKey()}generateAccountKey(){let{privateKey:l}=lc("ec",{namedCurve:"P-256"});return l.export({type:"pkcs8",format:"pem"})}async getDirectory(){if(this.directory)return this.directory;let l=await fetch(this.directoryUrl);if(!l.ok)throw Error(`Failed to fetch ACME directory: ${l.status}`);return this.directory=await l.json(),this.directory}async getNonce(){if(this.nonce){let E=this.nonce;return this.nonce=null,E}let l=await this.getDirectory(),P=(await fetch(l.newNonce,{method:"HEAD"})).headers.get("replay-nonce");if(!P)throw Error("Failed to get nonce from ACME server");return P}getJwk(){let l=this.accountKey.split(`
-`).filter((it)=>!it.startsWith("-----")).join(""),S=Buffer.from(l,"base64"),P=S.length-65,E=S.subarray(P+1,P+33),v=S.subarray(P+33,P+65);return{kty:"EC",crv:"P-256",x:this.base64UrlEncode(E),y:this.base64UrlEncode(v)}}getJwkThumbprint(){let l=this.getJwk(),S=JSON.stringify({crv:l.crv,kty:l.kty,x:l.x,y:l.y}),P=cc("sha256").update(S).digest();return this.base64UrlEncode(P)}base64UrlEncode(l){return(typeof l==="string"?Buffer.from(l):l).toString("base64").replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async signPayload(l,S){let P=await this.getNonce(),E=this.getJwk(),v={alg:"ES256",nonce:P,url:l};if(this.accountUrl)v.kid=this.accountUrl;else v.jwk=E;let it=this.base64UrlEncode(JSON.stringify(v)),Pe=S===""?"":this.base64UrlEncode(JSON.stringify(S)),Ie=`${it}.${Pe}`,rt=Su("SHA256");rt.update(Ie);let Pt=rt.sign(this.accountKey),st=Pt.subarray(4,4+Pt[3]),cr=4+Pt[3]+2,lr=Pt.subarray(cr,cr+Pt[cr-1]),gr=Buffer.alloc(32),Dt=Buffer.alloc(32);st.copy(gr,32-st.length),lr.copy(Dt,32-lr.length);let Rt=Buffer.concat([gr,Dt]);return JSON.stringify({protected:it,payload:Pe,signature:this.base64UrlEncode(Rt)})}async acmeRequest(l,S){let P=await this.signPayload(l,S),E=await fetch(l,{method:"POST",headers:{"Content-Type":"application/jose+json"},body:P}),v=E.headers.get("replay-nonce");if(v)this.nonce=v;let it,Pe=E.headers.get("content-type");if(Pe?.includes("application/json")||Pe?.includes("application/problem+json"))it=await E.json();else it=await E.text();if(!E.ok)throw Error(`ACME request failed: ${JSON.stringify(it)}`);return{body:it,headers:E.headers}}async registerAccount(){let l=await this.getDirectory(),{body:S,headers:P}=await this.acmeRequest(l.newAccount,{termsOfServiceAgreed:!0,contact:[`mailto:${this.email}`]}),E=P.get("location");if(!E)throw Error("No account URL returned");return this.accountUrl=E,E}async createOrder(l){if(!this.accountUrl)await this.registerAccount();let S=await this.getDirectory(),{body:P,headers:E}=await this.acmeRequest(S.newOrder,{identifiers:l.map((it)=>({type:"dns",value:it}))}),v=E.get("location");if(!v)throw Error("No order URL returned");return{orderUrl:v,authorizations:P.authorizations,finalize:P.finalize}}async getAuthorization(l){let{body:S}=await this.acmeRequest(l,""),P=S.identifier.value,E=this.getJwkThumbprint(),v=S.challenges.filter((it)=>it.type==="http-01"||it.type==="dns-01").map((it)=>{let Pe=`${it.token}.${E}`;if(it.type==="http-01")return{type:"http-01",token:it.token,keyAuthorization:Pe,identifier:`/.well-known/acme-challenge/${it.token}`};else{let Ie=this.base64UrlEncode(cc("sha256").update(Pe).digest());return{type:"dns-01",token:it.token,keyAuthorization:Pe,identifier:`_acme-challenge.${P}`,dnsValue:Ie}}});return{domain:P,challenges:v}}async respondToChallenge(l){await this.acmeRequest(l,{})}async waitForAuthorization(l,S=30){for(let P=0;P<S;P++){let{body:E}=await this.acmeRequest(l,"");if(E.status==="valid")return;if(E.status==="invalid")throw Error(`Authorization failed: ${JSON.stringify(E)}`);await new Promise((v)=>setTimeout(v,2000))}throw Error("Authorization timed out")}generateCsr(l){let{privateKey:S}=lc("rsa",{modulusLength:2048}),P=S.export({type:"pkcs8",format:"pem"});return{csr:this.createSimpleCsr(l,S),privateKey:P}}createSimpleCsr(l,S){throw Error("CSR generation requires additional implementation. Consider using the shell-based certbot approach instead.")}async finalizeOrder(l,S){let{csr:P,privateKey:E}=this.generateCsr(S),{body:v}=await this.acmeRequest(l,{csr:this.base64UrlEncode(Buffer.from(P,"base64"))}),it=v.certificate;if(!it)throw Error("Certificate not immediately available - polling not implemented");let Ie=await(await fetch(it)).text(),rt=Ie.split(/(?=-----BEGIN CERTIFICATE-----)/g),Pt=rt[0],st=rt.slice(1).join("");return{certificate:Pt,privateKey:E,chain:st,fullchain:Ie,expiresAt:new Date(Date.now()+7776000000)}}getAccountKey(){return this.accountKey}}var $n=(l)=>l===void 0?void 0:l?"on":"off";function Cs(l){let S={ssl:l.ssl,always_use_https:$n(l.alwaysUseHttps),automatic_https_rewrites:$n(l.automaticHttpsRewrites),min_tls_version:l.minTlsVersion,tls_1_3:$n(l.tls13),brotli:$n(l.brotli),http3:$n(l.http3),"0rtt":$n(l.zeroRtt),early_hints:$n(l.earlyHints),browser_cache_ttl:l.browserCacheTtl,always_online:$n(l.alwaysOnline),websockets:$n(l.websockets),email_obfuscation:$n(l.emailObfuscation)};if(l.hsts)S.security_header={strict_transport_security:{enabled:l.hsts.enabled,max_age:l.hsts.maxAge??31536000,include_subdomains:l.hsts.includeSubdomains??!1,preload:l.hsts.preload??!1,nosniff:l.hsts.noSniff??!0}};for(let P of Object.keys(S))if(S[P]===void 0)delete S[P];return{...S,...l.raw??{}}}var pa={ssl:"strict",alwaysUseHttps:!0,automaticHttpsRewrites:!0,minTlsVersion:"1.2",tls13:!0,brotli:!0,http3:!0,earlyHints:!0,alwaysOnline:!0,emailObfuscation:!1,browserCacheTtl:0};import{connect as Ru}from"node:tls";async function Ts(l){let{address:S,serverName:P,port:E=443,timeoutMs:v=5000}=l;return new Promise((it)=>{let Pe=!1,Ie=(Pt)=>{if(Pe)return;Pe=!0;try{rt.destroy()}catch{}it(Pt)},rt=Ru({host:S,port:E,servername:P,rejectUnauthorized:!1,timeout:v});rt.once("secureConnect",()=>{if(rt.authorized){Ie({reachable:!0,trusted:!0});return}Ie({reachable:!0,trusted:!1,reason:rt.authorizationError?String(rt.authorizationError):"origin certificate is not trusted for this hostname"})}),rt.once("timeout",()=>{Ie({reachable:!1,trusted:!1,reason:`no TLS handshake within ${v}ms`})}),rt.once("error",(Pt)=>{Ie({reachable:!1,trusted:!1,reason:Pt.message})})})}function Pu(l,S){let P=S.replace(/\.$/,"").toLowerCase();return l.some((E)=>{let v=E.replace(/\.$/,"").toLowerCase();if(v===P)return!0;if(!v.startsWith("*."))return!1;let it=v.slice(2);if(!P.endsWith(`.${it}`))return!1;return!P.slice(0,P.length-it.length-1).includes(".")})}async function Tu(l){let{provider:S,zone:P,hosts:E,ipv4:v,ipv6:it,proxied:Pe=!0,settings:Ie=pa,cache:rt,originGuard:Pt,purge:st=!0,ttl:cr=300,skipOriginProbe:lr=!1,skipEdgeCertificateCheck:gr=!1}=l,Dt={records:[],settingsChanged:[],cacheRules:0,originGuard:!1,purged:!1,deferredProxy:[],warnings:[]};if(E.length===0)return Dt;let Rt=[],Se=Pe&&!gr?await S.listEdgeCertificateHosts(P):null;for(let ie of E){let It=Pe;if(It&&Se&&!Pu(Se,ie)){It=!1;let Xt=Se.length===0?"the zone has no active edge certificate yet":`no active edge certificate covers it (${Se.join(", ")})`;Dt.deferredProxy.push({host:ie,reason:Xt}),Dt.warnings.push(`${ie}: publishing DNS-only — ${Xt}. Proxying it would make Cloudflare terminate TLS with no certificate for the name, which fails the handshake outright rather than degrading. Universal SSL covers the apex and ONE level of subdomain, so a deeper name needs its own certificate; otherwise re-run the deploy once the certificate is active.`)}if(It&&!lr){let Xt=await Ts({address:v,serverName:ie});if(!Xt.trusted){It=!1;let ar=Xt.reason||"origin is not serving a trusted certificate";Dt.deferredProxy.push({host:ie,reason:ar}),Dt.warnings.push(`${ie}: publishing DNS-only for now — the origin does not yet serve a certificate this proxy can verify (${ar}). The origin issues certificates over HTTP-01, which needs the name to reach it directly; re-run the deploy once it has one and the record will be proxied.`)}}if(It)Rt.push(ie);let wt=[{type:"A",content:v}];if(it&&En(ie))wt.push({type:"AAAA",content:it});for(let{type:Xt,content:ar}of wt){let dr=await S.upsertRecord(P,{name:ie,type:Xt,content:ar,ttl:cr,proxied:It});if(dr.success)Dt.records.push({host:ie,type:Xt,content:ar,proxied:It});else Dt.warnings.push(`${ie} ${Xt} → ${ar} failed: ${dr.message||"unknown provider error"}`)}}if(Rt.length===0){if(Pe)Dt.warnings.push("No host is proxied yet, so zone settings, cache rules and purge were skipped — they only take effect through the proxy.");return Dt}try{let ie=Cs(Ie),It=await S.applyZoneSettings(P,ie);Dt.settingsChanged=It.changed;for(let wt of It.failed)Dt.warnings.push(`zone setting '${wt.id}' could not be applied: ${wt.error}`)}catch(ie){Dt.warnings.push(`zone settings could not be read: ${ie instanceof Error?ie.message:String(ie)}`)}let kt=qa(Rt,rt);if(kt.length>0){let ie=await S.putManagedPhaseRules(P,"http_request_cache_settings",kt);if(ie.success)Dt.cacheRules=kt.length;else Dt.warnings.push(`cache rules could not be written: ${ie.message}`)}if(Pt){let ie=Va(Rt,Pt.header,Pt.value);if(ie.length>0){let It=await S.putManagedPhaseRules(P,"http_request_late_transform",ie);if(It.success)Dt.originGuard=!0;else Dt.warnings.push(`origin guard header could not be written: ${It.message}. `+"The gateway will reject requests that lack it — disable the guard or grant the token Transform Rules: Edit.")}}if(st){if(Dt.purged=await S.purgeCache(P,{hosts:Rt}),!Dt.purged)Dt.warnings.push("edge cache purge failed — new content may take until TTL expiry to appear.")}return Dt}var $u=(l)=>process.env[l];function uc(l,S){let P=l.replace(/\.$/,"").toLowerCase();if(S){let E=S.replace(/\.$/,"").toLowerCase();if(P===E||P.endsWith(`.${E}`))return E}return P.split(".").slice(-2).join(".")}function Iu(l,S={}){let P=S.env??$u,E=l.infrastructure?.compute?.proxy?.cdn,v=[];if(!E||E.provider!=="cloudflare")return{plan:null,errors:v};if(E.originDomain)v.push(`compute.proxy.cdn.originDomain (${E.originDomain}) is ignored for Cloudflare: the proxy forwards to the address in the record it fronts, `+"so no separate origin hostname is needed — and publishing one gives clients a documented way around the edge.");let it=P("CLOUDFLARE_API_TOKEN");if(!it)return v.push("CLOUDFLARE_API_TOKEN is not set — the Cloudflare CDN cannot be reconciled."),{plan:null,errors:v};let Pe=l.sites??{},Ie=E.frontedHosts?.length?[...new Set(E.frontedHosts.map((lr)=>lr.toLowerCase()))]:Rn(Pe,{autoWww:l.infrastructure?.compute?.proxy?.autoWww!==!1});if(Ie.length===0)return v.push("No hostnames to front — set compute.proxy.cdn.frontedHosts, or give a site a domain."),{plan:null,errors:v};let rt=l.infrastructure?.dns?.domain,Pt=new Set(Ie.map((lr)=>uc(lr,rt)));if(Pt.size>1)return v.push(`Fronted hosts span more than one zone (${[...Pt].join(", ")}). A Cloudflare zone is configured as a unit, so run one CDN config per zone.`),{plan:null,errors:v};let st=E.cloudflare??{},cr=E.secret?{header:E.secretHeader??"X-Origin-Verify",value:E.secret}:void 0;return{plan:{zone:[...Pt][0],hosts:Ie,apiToken:it,zoneId:st.zoneId??P("CLOUDFLARE_ZONE_ID"),accountId:st.accountId??P("CLOUDFLARE_ACCOUNT_ID"),proxied:st.proxied!==!1,settings:st.settings??pa,cache:st.cache,originGuard:cr,purge:st.purgeOnDeploy!==!1,skipOriginProbe:st.skipOriginProbe===!0},errors:v}}var Du=26214400;var wu=new Set(["/_headers","/_redirects","/_routes.json","/_worker.js"]);class mc{name="cloudflare-pages";apiToken;accountId;constructor(l){if(!l.apiToken)throw Error("Cloudflare Pages needs an API token");if(!l.accountId)throw Error("Cloudflare Pages needs an account id");this.apiToken=l.apiToken,this.accountId=l.accountId}async request(l,S,P){return Ya(l,`/accounts/${this.accountId}${S}`,`Bearer ${this.apiToken}`,P)}async getProject(l){try{return await this.request("GET",`/pages/projects/${l}`)}catch(S){if(S instanceof Error&&/\b8000007\b|not found/i.test(S.message))return null;throw S}}async ensureProject(l,S="main"){let P=await this.getProject(l);if(P)return P;return this.request("POST","/pages/projects",{name:l,production_branch:S})}async uploadToken(l){return(await this.request("GET",`/pages/projects/${l}/upload-token`)).jwt}async missingHashes(l,S){let P=await Ya("POST","/pages/assets/check-missing",`Bearer ${l}`,{hashes:S});return new Set(P)}async upsertHashes(l,S){await Ya("POST","/pages/assets/upsert-hashes",`Bearer ${l}`,{hashes:S})}async uploadBatch(l,S){let P=S.map((E)=>({key:E.hash,value:E.base64,metadata:{contentType:Ou(E.extension)},base64:!0}));await Ya("POST","/pages/assets/upload",`Bearer ${l}`,P)}async createDeployment(l,S,P){let E={};for(let it of S)E[it.path]=it.hash;let v=new FormData;if(v.append("manifest",JSON.stringify(E)),P)v.append("branch",P);return this.request("POST",`/pages/projects/${l}/deployments`,v)}async deployDirectory(l){let S=await gc(l.directory);if(S.length===0)throw Error(`No files to deploy in ${l.directory}`);let P=await this.uploadToken(l.project),E=await this.missingHashes(P,S.map((rt)=>rt.hash)),v=S.filter((rt)=>E.has(rt.hash)),it=[];for(let rt=0;rt<v.length;rt+=100)it.push(v.slice(rt,rt+100));let Pe=0;for(let rt=0;rt<it.length;rt+=4){let Pt=it.slice(rt,rt+4);await Promise.all(Pt.map((st)=>this.uploadBatch(P,st))),Pe+=Pt.reduce((st,cr)=>st+cr.length,0),l.onProgress?.(Pe,v.length)}return await this.upsertHashes(P,S.map((rt)=>rt.hash)),{deployment:await this.createDeployment(l.project,S,l.branch),total:S.length,uploaded:v.length,uploadedBytes:v.reduce((rt,Pt)=>rt+Pt.size,0)}}async listCustomDomains(l){return(await this.request("GET",`/pages/projects/${l}/domains`)).map((P)=>P.name)}async attachCustomDomain(l,S){if((await this.listCustomDomains(l)).includes(S))return!1;return await this.request("POST",`/pages/projects/${l}/domains`,{name:S}),!0}}function Eu(l,S){return{type:"CNAME",name:l,value:S.endsWith(".pages.dev")?S:`${S}.pages.dev`,ttl:1,proxied:!0}}async function fc(l,S){let{blake3:P}=await import("./chunk-a9pqpqrh.js").then((m)=>Nh(m.default,1));return(await P(l+S)).slice(0,32)}async function gc(l){let{readdir:S}=await import("node:fs/promises"),{join:P,relative:E,sep:v}=await import("node:path"),it=[];async function Pe(Ie){let rt=await S(Ie,{withFileTypes:!0});for(let Pt of rt){let st=P(Ie,Pt.name);if(Pt.isDirectory()){await Pe(st);continue}if(!Pt.isFile())continue;let cr=`/${E(l,st).split(v).join("/")}`;if(wu.has(cr))continue;let lr=await Bun.file(st).bytes();if(lr.byteLength>26214400)throw Error(`${cr} is ${lr.byteLength} bytes, over the Cloudflare Pages limit of 26214400`);let gr=Buffer.from(lr).toString("base64"),Dt=Pt.name.lastIndexOf("."),Rt=Dt>0?Pt.name.slice(Dt+1):"";it.push({path:cr,hash:await fc(gr,Rt),base64:gr,extension:Rt,size:lr.byteLength})}}return await Pe(l),it.sort((Ie,rt)=>Ie.path.localeCompare(rt.path)),it}function Ou(l){return{html:"text/html; charset=utf-8",css:"text/css; charset=utf-8",js:"application/javascript; charset=utf-8",mjs:"application/javascript; charset=utf-8",json:"application/json; charset=utf-8",map:"application/json; charset=utf-8",xml:"application/xml; charset=utf-8",txt:"text/plain; charset=utf-8",svg:"image/svg+xml",png:"image/png",jpg:"image/jpeg",jpeg:"image/jpeg",gif:"image/gif",webp:"image/webp",avif:"image/avif",ico:"image/x-icon",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",otf:"font/otf",pdf:"application/pdf",webmanifest:"application/manifest+json"}[l.toLowerCase()]||"application/octet-stream"}async function Ya(l,S,P,E){let v={Authorization:P},it;if(E instanceof FormData)it=E;else if(E!==void 0)v["Content-Type"]="application/json",it=JSON.stringify(E);let Pe=await fetch(`https://api.cloudflare.com/client/v4${S}`,{method:l,headers:v,body:it}),Ie=await Pe.text(),rt;try{rt=JSON.parse(Ie)}catch{throw Error(`Cloudflare Pages API returned ${Pe.status} with a non-JSON body: ${Ie.slice(0,200)}`)}if(!rt.success){let Pt=(rt.errors??[]).map((st)=>`${st.code}: ${st.message}`).join(", ");throw Error(`Cloudflare Pages API error (${Pe.status}): ${Pt||Ie.slice(0,200)}`)}return rt.result}export{Ng as ABTestManager,ae as ACMClient,or as ACMDnsValidator,dc as ACME_DIRECTORIES,Te as AI,el as API_IDEMPOTENCY_TTL_MS,Yd as API_TOKEN_DEFAULT_TTL_MS,Zd as API_TOKEN_MAX_TTL_MS,$i as API_VERSION,de as AUTHORIZATION_CAPABILITIES,Kd as AUTH_ACTION_TOKEN_TTL_MS,Wd as AUTH_MFA_CHALLENGE_TTL_MS,Jd as AUTH_OIDC_TRANSACTION_TTL_MS,je as AUTH_SESSION_ABSOLUTE_TTL_MS,zd as AUTH_SESSION_IDLE_TTL_MS,iA as AWSAPIError,n as AWSClient,h as AWSCloudFormationClient,A as AWSCloudFrontClient,wg as AWSConfigManager,pI as AWS_PSEUDO_PARAMETERS,we as AWS_REGIONS,bu as AcmeClient,Br as AlertEvaluator,gi as AlertStore,js as AnomalyConfigStore,bd as ApiGateway,i as ApiServiceError,Ua as ApplicationAutoScalingClient,oo as Arn,D as AssetHasher,U as Auth,Bi as AuthenticationStore,yi as AutomationApiService,_i as AutomationIdentityStore,Ko as AwsAuroraDataAdapter,Zo as AwsAuroraTransport,Aa as AwsDatabaseBackupSource,ur as AwsDriver,Wo as AwsElastiCacheDataAdapter,ea as AwsElastiCacheTransport,Dm as AwsIamCapabilityScanner,Ea as AwsInfrastructureBackupSource,zo as AwsRdsDataAdapter,Yo as AwsRdsTransport,Qm as AwsRegionalDriver,va as AwsSecretsManagerConfigurationBackend,Gp as AwsSpendTransport,Ta as AwsSsmConfigurationBackend,Ki as BackupCoordinator,vg as BackupManager,ha as BackupStore,cm as BatchProcessingManager,gn as BedrockClient,pn as BedrockRuntimeClient,al as BitbucketSourceAdapter,Pg as BlueGreenManager,rm as BounceComplaintHandler,qg as BuildOptimizationManager,Pl as BunDockerRuntime,tu as BunDockerVolumeRuntime,eu as BunFilesystemArchiveRuntime,ue as CDN,mo as CHAIN_HEADER,as as CLOUDFLARE_MANAGED_RULE_PREFIX,Sd as CLOUDFRONT_FAILOVER_STATUS_CODES,aC as COMMON_CROSS_ACCOUNT_ROLES,Fe as CONTROL_PLANE_SCHEMA_VERSION,io as Cache,lo as CanaryManager,Qg as CertificateManager,gf as CloudBlockVolumeDriver,ws as CloudDriverFactory,Ve as CloudError,eg as CloudFormationBuilder,h as CloudFormationClient,A as CloudFrontClient,Rg as CloudTrailManager,he as CloudWatchLogsClient,mc as CloudflarePagesProvider,Ae as CloudflareProvider,yA as CommandHistory,H as Communication,Rr as ComposeApplicationService,Ot as ComposeApplicationStore,Ct as ComprehendClient,o as Compute,qp as ComputeSpendTransport,co as ConfigurationError,Ra as ConfigurationService,ba as ConfigurationStore,ln as ConnectClient,Xo as ContainerDataAdapter,Vg as ContainerRegistryManager,Ca as ControlPlaneBackupSource,ua as ControlPlaneCleanupDriver,oi as ControlPlaneStore,Gs as CounterTracker,Gt as CredentialError,yg as CrossRegionReferenceManager,Gf as DASHBOARD_ENTRY,qf as DASHBOARD_PORT_BASE,Vf as DASHBOARD_PORT_SPAN,Hf as DASHBOARD_STATE_DIR,Co as DEFAULT_ATTACK_MODE_HOURS,cd as DEFAULT_DDOS_THRESHOLDS,Xp as DEFAULT_FAILOVER_STATUS_CODES,Gc as DEFAULT_METER_MAPPINGS,Qc as DEFAULT_PRICE_BOOK,wi as DEFAULT_RECURSION_LIMITS,Tn as DEFAULT_RPX_CERTS_DIR,q as DEFAULT_SERVICE_LIMITS,Kp as DEFAULT_STATE_DIR,gu as DEFAULT_STATIC_ASSET_EXTENSIONS,wf as DEFAULT_TELEMETRY_POLICY,Rp as DEFAULT_THRESHOLDS,cf as DEPLOYMENT_QUEUE_KINDS,go as DEPTH_HEADER,Nr as DETECTABLE_SIGNALS,vl as DIAGNOSTIC_PRESETS,am as DLQMonitoringManager,L as DNS,em as DNSSECManager,Qi as DataServiceLifecycle,jo as DataServiceStore,Ut as Database,Mg as DatabaseUserManager,ee as DebugLogger,$f as DependencyGraph,Q as Deployment,nA as DeploymentError,Tg as DisasterRecoveryManager,Cn as DnsProviderFactory,zt as DockerDataTransport,Uo as DockerDiscoveryAdapter,wr as DockerNamedVolumeDriver,Sa as DockerVolumeBackupSource,c as DurableOperationQueue,Ls as DurableQueueWorker,ke as DynamoDBClient,Ir as EC2Client,Be as ECRClient,Xe as ECSClient,rr as EFSClient,La as ELBv2Client,hf as ENFORCEMENT_ACTIONS,ui as ENFORCEMENT_DESCRIPTIONS,R as ENFORCEMENT_SEVERITY,tp as ENVIRONMENT_LABEL,El as EcsRuntimeAdapter,So as EdgeRateLimiter,Ze as ElastiCacheClient,m as Email,CA as EmailAdvanced,nm as EmailAnalyticsManager,An as EmailClient,EA as EmailHandlers,sm as EmailTemplateManager,ta as EncryptedDataSecretStore,sA as ErrorCodes,er as EventBridgeClient,Mm as EventBridgeJobAdapter,wa as ExternalConfigurationBackend,om as FIFOQueueManager,Op as FOCUS_VERSION,og as FileCache,Ge as FileSystem,ya as FilesystemBackupSource,na as FleetService,ra as FleetStore,e as Fn,cl as GiteaSourceAdapter,sl as GithubSourceAdapter,ol as GitlabSourceAdapter,Ig as GlobalResourceManager,_e as GoDaddyProvider,Dg as GuardDutyManager,ot as HOST_SITES_DIR,cA as HashCache,fm as HealthCheckManager,Qe as HealthCheckRunner,hr as HetznerClient,Ce as HetznerDriver,fe as IAMClient,Wa as IPV6_EXCLUDED_HOST_LABELS,Gg as ImageScanningManager,zl as InfrastructureGenerator,Nc as InvalidOperationTransitionError,ut as JobLoader,Fm as JobProviderReconciler,Vo as JobService,Go as JobStore,Zt as KendraClient,QA as LARAVEL_SERVERLESS_BUILD_STEPS,C as LambdaClient,Wg as LambdaConcurrencyManager,Yg as LambdaDLQManager,Jg as LambdaDestinationsManager,zg as LambdaLayersManager,bl as LambdaRuntimeAdapter,Xg as LambdaVPCManager,Kg as LambdaVersionsManager,sn as LocalEncryptedConfigurationBackend,Ia as LogicalDatabaseBackupSource,xg as LogsManager,RA as MANAGED_NODE_VERSIONS,Ic as MANAGEMENT_DASHBOARD_SITE,tg as MANAGEMENT_DASHBOARD_SITE_PREFIX,Ni as MAX_CONTROL_HOURS,kc as MAX_CONTROL_PLANE_ERROR_BYTES,Ep as MAX_CONTROL_PLANE_JSON_BYTES,Us as METERS,mf as METER_KEYS,ff as MICRO_CENTS,Dp as MIN_PROJECTION_CONFIDENCE,Au as MTA_STS_PORT,la as MaintenanceService,da as MaintenanceStore,Z as Messaging,_g as MetricsManager,Og as MigrationManager,ug as MockCloudFormation,gg as MockDynamoDB,pg as MockS3,so as Monitoring,Eg as MultiAccountManager,Ag as MultiRegionManager,pA as MultiStepProgress,f as Network,Am as NetworkSecurityManager,mi as NotificationRouter,Yp as ORIGIN_GROUP_ALLOWED_METHODS,lI as ORIGIN_GROUP_ID_SUFFIX,$a as OpenSearchClient,at as OptimisticConcurrencyError,bg as OrganizationManager,Du as PAGES_MAX_FILE_BYTES,HA as PHP_DEFAULT_EXCLUDES,DA as PHP_LAYER_EXTENSIONS,ep as PROJECT_LABEL,tt as PROXIABLE_RECORD_TYPES,b as ParameterStore,$g as PerformanceManager,Y as Permissions,Ma as PersonalizeClient,qe as Phone,bA as PhoneAdvanced,Ff as PhoneHandlers,sa as PlacementService,ia as PlacementStore,mn as PollyClient,se as PorkbunProvider,zr as PreDeployScanner,mg as PreviewEnvironmentManager,Tr as PreviewEnvironmentService,Ue as PreviewEnvironmentStore,hg as PreviewNotificationService,uA as ProgressBar,kg as ProgressiveDeploymentManager,Eo as ProtectionControlStore,eI as Pseudo,M as Queue,ai as QueueCancellationError,dm as QueueManagementManager,Yy as QueuePresets,Os as QueueTimeoutError,Fd as RATE_LIMIT_KEY_SEPARATOR,j as RDSClient,SA as RECOMMENDED_ACCOUNT_STRUCTURES,oC as RECOMMENDED_SCPS,vm as RELEASE_QUEUE_KINDS,hA as REPL,AA as REPLCommandBuilder,fA as REPLContext,rp as ROLE_LABEL,dA as RateLimiter,Zy as RealtimePresets,Lp as RecordingSpendTransport,fo as RecursionGuard,pt as Redirects,Sg as RegionPairManager,aa as RegionService,oa as RegionStore,He as Registry,Et as RekognitionClient,gt as ReleaseService,ko as ReleaseStore,Um as RemoteBuildService,Lg as ReplicaManager,ym as ResourceManagementManager,X as RetryableOperationError,y as Route53Client,Oa as Route53DomainsClient,z as Route53Provider,tm as Route53ResolverManager,Zg as Route53RoutingManager,ge as RuntimeOperationService,Ho as RuntimeStreamRegistry,fa as S3BackupDestinationAdapter,a as S3Client,G as S3Error,ul as SECRET_PATTERNS,_p as SENSITIVITY_THRESHOLDS,et as SESClient,F as SMS,Ye as SNSClient,Hp as SPEND_CYCLE_SECONDS,rd as SPEND_GATE_SETTING,Nf as SPEND_LEASE_SETTING,ne as SQSClient,Ee as SSH_BOOTSTRAP_VERSION,Hn as SSH_PREFLIGHT_SCRIPT,be as SSMClient,Wp as STATE_DIR_ENV_VAR,pa as STATIC_SITE_ZONE_SETTINGS,me as STSClient,hn as SchedulerClient,Qt as Search,Kr as SecretFindingScanner,Ei as Secrets,Ug as SecretsManager,V as SecretsManagerClient,Fg as SecretsRotationManager,I as Security,Fr as SecurityHubManager,jr as SecurityPostureStore,mt as SecurityScannerRunner,Hg as SecurityScanningManager,im as SenderReputationManager,$m as ServerCronJobAdapter,Jo as ServerDataAdapter,Fs as ServerPathVolumeDriver,jg as ServiceMeshManager,Ed as Sftp,Ks as SignalSource,vA as SmsAdvanced,vt as SmsClient,Uf as SmsHandlers,Ga as SmsVoiceClient,Bo as SourceConnectionStore,Vt as SourceProviderError,nd as SpendCapError,kr as SpendGate,Up as SpendLoopLease,Zs as SpendNotificationRouter,Qp as SpendRunner,$t as SpendService,di as SpendStore,gA as Spinner,Ar as SshDriver,Xr as SshFleetDriver,Cg as StackDependencyManager,uI as StacksIntegration,mm as StaticSiteManager,ve as Storage,hm as StorageAdvancedManager,fn as SupportClient,Ur as SyntheticsManager,Nl as SystemFleetSshTransport,fr as SystemSshTransport,Qo as SystemdDiscoveryAdapter,ho as TRACE_HEADER,mA as TaskList,lt as TelemetryStore,yd as TemplateBuilder,ag as TemplateCache,bt as TextractClient,un as TranscribeClient,Yt as TranslateClient,qm as TransportDisasterRecoveryDriver,Gm as TransportPlatformMaintenanceDriver,Hi as TransportRemoteBuildDriver,Mo as TrivyImageScanner,No as TsCloudApiError,tl as TsCloudClient,Pf as URGENT_SPEND_EVENTS,Pp as USER_VISIBLE_ACTIONS,ca as UnavailableRegionalDriver,oe as UnifiedDnsValidator,Bs as UnsupportedSchemaVersionError,ig as ValidationError,tr as VoiceClient,Ms as VolumeService,xt as VolumeStore,Qf as Workflow,Bg as XRayManager,OC as abTestManager,rl as activateImmutableRelease,du as addDns01ChallengeRecord,Zr as addSiteToCloudConfig,ft as ageSeconds,Vc as aggregateDeltas,Ip as allocateSitePorts,cI as analyzeStackDiff,pi as anomalyOptionsForSignal,bo as applyControlsToDdos,qd as applyControlsToRateLimits,ps as applyDeclaredZoneSettings,Or as applyMitigationFactor,Hh as applyPlan,fs as applyZoneMigration,Dd as artifactKey,Lr as assertOriginGroupMethods,xi as assertReleaseStrategy,Tf as assertSpendAllows,zh as attachConflicts,Kh as attachIsViable,jh as attachPreconditions,fl as attachProvenanceToRelease,Fo as attachSbomToRelease,ml as attachVulnerabilitySummary,Em as authEncryptionKeyFile,w as authorizeOrganization,Om as authorizeRuntimePath,LS as autocomplete,PC as awsConfigManager,Yl as backupCredentialStatus,RC as backupManager,tS as batch,mE as batchProcessingManager,Do as beginOidcAuthorization,_C as blueGreenManager,cE as bounceComplaintHandler,ct as budgetWindow,Ba as buildAndPushServerlessImage,AE as buildBunRuntimeLayerZip,ef as buildCertificatePackScript,Xh as buildCertificateStateScript,tf as buildCertificateUnpackScript,vd as buildCloudFormationTemplate,pc as buildCloudInitFirstBoot,Oc as buildComposeLogsCommand,Qy as buildComposeRuntimeCommand,Hy as buildComposeScaleCommand,Lc as buildComposeShellCommand,fp as buildDrainSourceScript,_h as buildDrainedSiteScanScript,Wt as buildFunctionEnv,hp as buildHealthGateScript,_n as buildHostCleanupDeployScript,bs as buildHostCleanupInstallScript,Bn as buildHostCleanupScript,ii as buildHostSitePortsScript,Ad as buildMailEnv,Ds as buildManagementDashboardArtifact,Mu as buildMediaCdnPlan,fu as buildMtaStsPolicy,ph as buildMtaStsServer,fE as buildNodeRuntimeLayerZip,JC as buildOptimizationManager,Zp as buildOriginGroup,Ci as buildOriginGroups,Va as buildOriginGuardRule,cp as buildPauseWorkersScript,CE as buildPhpRuntimeLayerZip,pp as buildRestoreScript,K as buildRpxConfig,xe as buildRpxFragmentRefreshScript,qh as buildSetHostnameScript,On as buildSiteDeployScript,up as buildSnapshotScript,Ap as buildSourceStateScript,Pn as buildSshArgs,Un as buildSshBootstrapScript,qa as buildStaticSiteCacheRules,Ln as buildStaticSiteDeployScript,gp as buildTargetStateScript,dp as buildWorkersStateScript,yl as bytes,xC as canaryManager,Yr as canonicalJson,ht as capabilities,Kt as capacity,lS as categorizeChanges,zC as certificateManager,Zh as certificatesMatch,qI as checkIAMPermissions,xA as checkInvocation,jI as checkServiceQuotas,lA as chunk,zm as cleanupDns01Challenge,Ky as clearSigningKeyCache,xo as cloneSourceBinding,gS as cloudConfigSchema,Hu as cloudDrivers,NC as cloudTrailManager,gc as collectAssets,yo as collectPhpAppEntries,mu as collectServerDnsDomains,bp as completeComposeVolumeDeletion,Po as completeOidcAuthorization,kI as composePresets,xs as composeProjectName,Nd as composeServerlessAppTemplate,Bf as compositeSpendTransport,St as compressBackup,qA as config,Rl as connectionGuidance,XC as containerRegistryManager,of as controlPlaneDatabaseFile,Dc as controlPlaneMigrations,II as createApiBackendPreset,$o as createApiV1Handler,ZA as createAsgBuildDriver,Zl as createBackupQueueHandlers,FA as createCliHandler,k as createCloudDriver,oc as createCloudFrontPolicy,FI as createCredentialProvider,PI as createDashboardSite,vI as createDataPipelinePreset,Dl as createDataServiceQueueHandlers,$c as createDeploymentQueueHandlers,T as createDnsProvider,YA as createEcsBuildDriver,id as createEnforcementHandlers,sg as createError,Td as createExistingStaticFullStackPreset,kl as createFleetQueueHandlers,yI as createFullStackAppPreset,Is as createGoDaddyValidator,SE as createHandlers,$A as createHttpHandler,CI as createJamstackPreset,wl as createJobQueueHandlers,RI as createLaravelPreset,TI as createMLApiPreset,Ml as createMaintenanceQueueHandlers,xu as createMediaAccessToken,EI as createMicroservicesPreset,IS as createMockAWS,mI as createNodeJsServerPreset,hI as createNodeJsServerlessPreset,ss as createObjectStorageClient,ys as createPorkbunValidator,BI as createPreset,xf as createPresignedUrl,Gy as createPresignedUrlAsync,MA as createQueueHandler,bI as createRealtimeAppPreset,_l as createRegionQueueHandlers,hl as createReleaseProvenance,il as createReleaseQueueHandlers,JA as createRemoteBuildQueueHandlers,Ss as createRoute53Validator,xm as createRuntimeAdapters,UI as createS3Client,XA as createServerBuildDriver,DI as createServerlessLaravelPreset,fI as createServerlessNodePreset,pu as createSmsInfrastructure,Ke as createSourceAdapter,gI as createStaticSitePreset,wI as createTraditionalWebAppPreset,Mc as createVolumeQueueHandlers,SI as createWordPressPreset,Ti as createZip,qS as crossRegionReferenceManager,on as dashboardActions,Rs as dashboardCredentialsFile,Jr as dataServiceCapabilities,qC as databaseUserManager,jd as decodeBase32,Ne as decompressBackup,eh as decryptBackup,vo as defaultConfig,lg as defaultLocalConfig,Qd as defaultRateLimitRules,sr as delegateZone,ls as delegateZoneFromConfig,Na as deleteStaticSite,Cc as deployAllComputeSites,ga as deployServerlessApp,Wl as deploySite,Ps as deploySiteRelease,Yi as deployStaticSite,ka as deployStaticSiteFull,an as deployStaticSiteWithExternalDns,cn as deployStaticSiteWithExternalDnsFull,hd as deploymentCoexistenceError,jf as deriveManagementDashboardPort,us as describeDelegation,Gd as describePosture,gs as describeZoneSettings,Lm as desiredJobProviderState,Bp as detectAnomalies,Jp as detectDeploymentTargets,ja as detectDnsProvider,Zc as detectLatestAnomaly,HI as detectMisconfigurations,jp as detectServiceRegion,_c as diffCompose,aS as diffTemplates,_o as discoverGitRefs,Ro as discoverOidcProvider,Il as discoverRuntimeInventory,gE as dlqMonitoringManager,za as dnsProviders,oE as dnssecManager,km as dockerWorkloads,Gi as documentDigest,DC as drManager,Le as driverStatePath,Sl as ecsWorkloads,_t as effectiveCapabilities,dE as emailAnalyticsManager,uE as emailTemplateManager,ki as encodeBase32,Zm as encryptBackup,Al as ensureDefaultSecurityPolicies,Wn as ensureFirewall,Yn as ensureManagementDashboard,Jn as ensureServer,Kn as ensureSshKey,J as escapeSecLang,zc as evaluateBudget,qn as evaluatePreflight,Ys as evaluateTelemetryAlertRules,Tl as eventBridgeScheduleInput,LA as eventToRequest,Ef as ewma,Bc as exportCompose,ms as exportRoute53Zone,ng as extendPreset,pE as fifoQueueManager,eS as findChangedFiles,Tp as findMapping,vp as findPriceEntry,uC as formatAccountStructure,Wh as formatAttachPlan,DS as formatBytes,_r as formatCents,dI as formatDiff,Oh as formatDrainedSiteRefusal,PS as formatDuration,MS as formatFlagSuggestions,QS as formatHistory,HS as formatHistoryStats,Fh as formatInventory,kS as formatKeyValue,NS as formatList,Qh as formatPlan,jn as formatPreflightFindings,RS as formatProgressBar,IA as formatRegion,rC as formatRegionList,Rm as formatScanResults,BS as formatSuggestion,TS as formatTable,Pr as formatTimeToExhaustion,wS as formatTree,Xf as fromEC2Metadata,Yf as fromECSMetadata,Wf as fromEnvironment,Jf as fromSharedCredentials,Zf as fromWebIdentity,Bd as functionFingerprint,Rn as gatewayHostnames,kd as generateAppImageDockerfile,TC as generateApprovalConfig,TA as generateBootstrap,ES as generateCleanupWorkflow,bS as generateCostReportWorkflow,dC as generateCrossAccountRoleCF,pl as generateCycloneDxSbom,EC as generateDeploymentConfig,AC as generateDeploymentPipeline,pC as generateDeploymentWorkflow,Pa as generateExternalDnsStaticSiteTemplate,Vm as generateHttpsServerCode,gl as generateImageSbom,Qu as generateLetsEncryptUserData,t as generateLogicalId,CC as generateManualPipeline,fC as generateMatrixWorkflow,bC as generateMultiEnvConfig,yC as generateMultiEnvPipeline,gC as generateMultiEnvWorkflow,mC as generatePRPreviewWorkflow,wC as generateParallelConfig,UA as generatePhpFpmConfig,NA as generatePhpLayerDockerfile,IC as generatePreviewPipeline,CS as generatePreviewWorkflow,r as generateResourceName,vC as generateScheduledConfig,SC as generateScheduledPipeline,hC as generateScheduledWorkflow,Xi as generateStaticSiteTemplate,N as generateUbuntuAppCloudInit,rA as getAccountId,KS as getAllRegions,ZS as getClosestRegion,FS as getCommandUsage,af as getComposeTemplate,Im as getConfig,xS as getContextualHelp,ao as getCredentials,uS as getDeploymentStrategy,pS as getDiffStats,cS as getDiffSummary,oA as getErrorDetails,Rd as getLocalConfig,AS as getLocalCredentials,fS as getLocalEndpoint,yS as getLocalEnvVars,zI as getQuotaUsageSummary,cC as getRecommendedStructure,vi as getRegion,nC as getRegionStats,JS as getRegionsByCompliance,WS as getRegionsByLocation,XS as getRegionsByPricingTier,aA as getRequiredPermissions,Wy as getSigningKeyCacheSize,uu as getSmsInfrastructureStatus,tI as getTimestamp,Io as globMatches,Ns as globToRegex,VS as globalResourceManager,li as governingLimitCents,kC as guardDutyManager,eo as handleSpendRequest,wn as hasAutoWwwVariant,Ht as hasManagementDashboardSite,Rc as hasProxyUpstream,JI as hashBuffer,XI as hashDirectory,cg as hashFile,YI as hashManifest,dg as hashString,vE as healthCheckManager,En as hostAcceptsIpv6,yn as hostCondition,To as hotp,Dr as hourBucket,Cf as hourBucketsBetween,WC as imageScanningManager,ji as infraEnvFromOutputs,xd as inspectInvocation,BA as installRecursionFetch,es as invalidateCache,pm as invocationContext,_S as isLikelyTypo,vn as isLocalDatabase,hS as isLocalDevelopment,$r as isManagementDashboardSiteName,nr as isNameserverRegistrar,Jy as isNodeCryptoAvailable,Yc as isOperationAllowed,Xs as isQuietHours,Cd as isS3RestEndpoint,ei as isSafePattern,gd as isStateDirConfigured,md as isStatePath,xr as isValidCidr,YS as isValidRegion,ci as isValidTimeZone,Xy as isWebCryptoAvailable,ir as isZoneHost,Wr as jobProviderCapability,is as keyMatchesFilters,tE as lambdaConcurrencyManager,iE as lambdaDLQManager,rE as lambdaDestinationsManager,ZC as lambdaLayersManager,nE as lambdaVPCManager,eE as lambdaVersionsManager,Cl as lambdaWorkloads,$d as laravelServerlessEnvDefaults,vr as listComposeTemplates,Li as listSourceReferences,Vd as loadCloudConfig,Mt as loadTelemetryPolicy,FC as logsManager,ed as lookbackHoursForSignal,Lf as mailEnabled,fd as mailFirewallPorts,Hm as maintenanceWindowOpen,Of as makeAWSRequest,Vy as makeAWSRequestAsync,qy as makeAWSRequestOnce,rg as managementDashboardSiteName,xl as manifestDigest,Hr as matchTotpCounter,Fu as mediaObjectHeaders,Vs as median,Np as medianAbsoluteDeviation,Kc as mergeDecisions,Mr as mergeInfrastructure,If as mergePriceBooks,qc as meterTelemetry,MC as metricsManager,au as migrateObjectStorage,QC as migrationManager,iC as multiAccountManager,GS as multiRegionManager,Km as needsRenewal,TE as networkSecurityManager,At as nextScheduleRuns,ye as normalizePublicIpv6,Re as normalizeRuntimeStatus,We as normalizeScheduleExpression,Tm as normalizeSourceEvent,Oe as normalizeSshPublicKey,$p as normalizeTelemetryPolicy,ni as occupiedHostPorts,Lo as openApiDocument,Ws as optionsForSignal,sC as organizationManager,Md as packagePhpApp,Qr as packageServerlessApp,fc as pagesAssetHash,Eu as pagesDnsRecord,wd as parallel,rS as parallelMap,nS as parallelWithRetry,Yh as parseCertificateState,_d as parseChain,br as parseCompose,Fy as parseComposeCatalog,Nm as parseDockerInspect,ru as parseDotenv,xh as parseDrainedSites,si as parseHostSiteFragments,zy as parseJSONResponse,Gn as parsePreflightFacts,yp as parseSourceDrained,Bm as parseSystemdRecords,mp as parseTargetReady,wc as parseUpstreamPort,lp as parseWorkersPaused,jy as parseXMLResponse,fi as pathTemplate,vc as pendingSteps,qs as percentOfLimit,GC as performanceManager,lm as phpLayerBuildStage,PA as phpLayerPackages,Ri as phpRuntimeLayerAssets,Uy as planComposeTemplateUpgrade,Wc as planEnforcement,op as planIsDestructive,Vp as planMitigation,Gh as planServerRename,rf as planSiteMove,hs as planZoneMigration,Tt as policyTag,Vn as preflightFailed,SS as previewManager,vS as previewNotifications,yt as previewSchedule,Sf as previousBudgetWindow,Qs as priceUsage,Af as priceUsageLines,$h as probeHostRoutes,Ts as probeOriginTls,oS as processInChunks,dl as processSourceWebhook,Fi as productionChangeReview,LC as progressiveDeploymentManager,jc as projectSpend,Od as propagationHeaders,_a as providerEndpoint,Ol as publicKeyFingerprint,In as qualifyName,hE as queueManagementManager,ZI as quickHash,Ud as rateLimitHeaders,Pi as rateLimitKey,$e as readDriverState,Mh as reconcile,hu as reconcileAddressRecords,Tu as reconcileCloudflareCdn,ds as reconcileDeclaredRecords,WA as reconcileJobObservation,Vr as reconcileSourceWebhook,Mi as recordDashboardHostPosture,jA as recordPreDeploySecretScan,zA as recordSkippedSecretScan,Ld as recursionBlockedResponse,De as redactRuntimeConfig,ad as redactTelemetryText,hi as redactTelemetryValue,tn as redeployServerlessApp,jS as regionPairManager,qr as releaseStrategyCapabilities,bm as releaseTrafficPlan,Zn as reloadRpxGateway,ns as remapKey,yu as removeDns01ChallengeRecord,en as removeSiteFromCloudConfig,ll as removeSourceWebhook,Ka as removeStaleServerAddressRecords,xc as renderComposeTemplate,Ii as renderDdosInstallScript,ud as renderNftablesRuleset,Ui as renderServerCron,ld as renderSysctlFile,bc as renderWafConfig,ti as renderWafInstallScript,Ec as renewRpxCertificates,HC as replicaManager,_f as requestHash,dS as requiresReplacement,yE as resetRecursionRuntime,IE as resolveApp,p as resolveAppDatabase,Vh as resolveAttachTarget,ze as resolveAuthEncryptionKey,le as resolveCloudProvider,Iu as resolveCloudflareCdnPlan,eA as resolveCredentials,Ji as resolveDashboardAction,Sc as resolveDashboardAuth,zf as resolveDashboardDomain,Kf as resolveDashboardDomains,cs as resolveDeclaredRecords,aI as resolveDeployBucketName,O as resolveDeploymentMode,xn as resolveExecStart,Mf as resolveFailoverStatusCodes,sc as resolveHetznerApiToken,mr as resolveHostCleanupConfig,Si as resolveMailService,NI as resolveManagementDashboardSite,bi as resolveManagementDashboardSites,xa as resolveObjectStorage,Uh as resolvePlan,g as resolveProjectStackName,Er as resolveProxyUpstreams,Pd as resolveQueueNames,df as resolveQueuedDeploymentCommand,qt as resolveQueues,kA as resolveRecursionConfig,tA as resolveRegion,re as resolveRuntimeInventory,Ft as resolveServerlessAppStackName,Id as resolveServerlessArtifactBucketName,no as resolveServerlessAssetBucketName,po as resolveServerlessRuntime,sI as resolveSiteBucketName,ks as resolveSiteDeployTarget,u as resolveSiteKind,iI as resolveSiteResourceName,nI as resolveSiteStackName,Qn as resolveSshSettings,d as resolveStatePath,oI as resolveStorageBucketName,Nt as resolveUiSource,uc as resolveZoneApex,wE as resourceManagementManager,gm as responseToResult,kp as robustZScore,Bt as roleCapabilities,nl as rollbackImmutableRelease,rn as rollbackServerlessApp,yf as roundCents,aE as route53ResolverManager,sE as route53RoutingManager,xp as routeMatches,np as routesFromFragments,Di as ruleMatches,wA as runBuildHooks,Jc as runEnforcement,Ao as runPhpBuildHooks,Je as runRemoteCommand,pe as runtimeId,Sn as sameNameservers,Wi as sanitizeCloudConfig,s as sanitizeControlPlaneValue,rI as sanitizeName,Xd as sanitizeOidcReturnPath,sd as saveTelemetryPolicy,wm as scanForSecrets,Pc as scopeContains,dt as scopeKey,Za as scpUpload,OS as searchCommands,_s as searchControlPlane,jC as secretsManager,VC as secretsRotationManager,KA as secureContainerRelease,BC as securityHubManager,KC as securityScanningManager,te as securityScope,Gr as sendAuthenticationEmail,lE as senderReputationManager,iS as sequence,nu as serializeDotenv,Xn as serverPublicIpv4,YC as serviceMeshManager,Vl as setAttachToInCloudConfig,Jt as setMaintenance,qi as setSitePropertyInCloudConfig,pd as setStateDir,Wm as setupDns01Challenge,Ha as setupSmsInfrastructure,uo as sha256,_A as sharedRecursionGuard,um as sharedRuntimeLoop,Cp as shipsARelease,ku as signCloudFrontCookies,Nu as signCloudFrontUrl,_ as signRequest,zp as signRequestAsync,zs as signalDefinition,B as siteInstallBase,ri as siteMoveArchivePath,Jh as siteMoveCertArchivePath,Tc as siteUnitGlob,Fp as spendNotificationText,to as spendOpenApiPaths,pr as sshExec,ce as sshExecOrThrow,zS as stackDependencyManager,Da as startLocalDashboardServer,kf as startSpendLoop,ro as stateDir,x as statePath,EE as staticSiteManager,bE as storageAdvancedManager,bf as streamFocusJsonl,Xc as strongestActiveAction,fg as suggestCommand,$S as suggestFlags,VI as suggestIAMPolicy,KI as suggestQuotaIncrease,tC as suggestRegionPairs,eC as suggestRegions,Oi as syncSourceRepositories,Fc as synchronizeComposeVolumes,iu as synchronizeConfiguredConfiguration,qo as synchronizeConfiguredJobs,UC as syntheticsManager,dd as sysctlHardening,_m as systemdWorkloads,Df as telemetryBucketLabel,Ai as telemetryCursor,od as telemetryEstimatedMonthlyCost,Rf as telemetryPercentile,Mp as telemetryPolicyKey,WI as templateCache,ip as tenantsOf,Oo as testSourceConnection,Uc as tieredMicroCents,Cs as toCloudflareZoneSettings,Js as toFocusJsonl,td as toFocusRecords,Lh as toInventoryServer,Sm as totp,wo as totpUri,sp as unaccountedSites,Pm as unsupportedCapabilities,lf as unsupportedVolumeCapabilities,$l as updateCompatibility,Fl as updateSiteInCloudConfig,Zi as uploadStaticFiles,wp as usageDeltaKey,Lt as utcInstantOfLocal,lC as validateAccountStructure,mS as validateAgainstSchema,pf as validateAttachment,Ym as validateBackupDestination,US as validateCommand,QI as validateConfiguration,GI as validateCredentials,Sp as validateDeploymentConfig,uf as validateMountPath,Ql as validateResourceLimits,ap as validateServerName,Ul as validateTemplate,Xl as validateTemplateSize,Ja as verifyAddressRecord,VA as verifyArtifactSignature,Lu as verifyMediaAccessToken,Cm as verifyTotp,Ll as verifyUpdateSignature,As as verifyZoneParity,$s as volumeCapabilities,Zu as wafEventTelemetry,ec as waitForCloudInit,Nn as waitForSsh,jt as webhookEndpoint,$I as withCDN,LI as withCache,OI as withDatabase,OA as withInvocation,_I as withMonitoring,MI as withQueue,xI as withSecurity,sS as withTimeout,W as wrapCloudInitUserData,nt as writeDriverState,$C as xrayManager,Bl as zeroCapacity,vf as zeroFill,Hc as zoneOffsetMs,Hs as zonedParts};
+`}async function Ou(l,S,P){let v=`_acme-challenge.${S}`;if(await ku(l,S,v,P))return;let E=await l.createRecord(S,{name:v,type:"TXT",content:P,ttl:60});if(!E.success)throw Error(`Failed to create DNS challenge record: ${E.message}`)}async function Nu(l,S,P){let v=await l.deleteRecord(S,{name:`_acme-challenge.${S}`,type:"TXT",content:P});if(!v.success)console.warn(`Failed to delete DNS challenge record: ${v.message}`)}async function ku(l,S,P,v){try{let E=await l.listRecords(S,"TXT"),ot=P.replace(/\.$/,"").toLowerCase();return(E.records??[]).some((Ie)=>Ie.name.replace(/\.$/,"").toLowerCase()===ot&&Ie.content.replace(/^"|"$/g,"")===v)}catch{return!1}}function fc(l){let{hostedZoneId:S,dnsProvider:P,region:v="us-east-1"}=l;if(P)return T(P);if(S)return new z(v,S);throw Error("Either dnsProvider or hostedZoneId must be provided")}async function uh(l){await Ou(fc(l),l.domain,l.challengeValue)}async function ph(l){await Nu(fc(l),l.domain,l.challengeValue)}function mh(l){try{let{execSync:S}=Fe("node:child_process"),P=S(`openssl x509 -checkend 2592000 -noout -in ${l}/cert.pem`,{encoding:"utf-8",stdio:["pipe","pipe","pipe"]});return!1}catch{return!0}}import{createHash as gc,createSign as xu,generateKeyPairSync as yc}from"node:crypto";var Cc={production:"https://acme-v02.api.letsencrypt.org/directory",staging:"https://acme-staging-v02.api.letsencrypt.org/directory"};class Lu{directoryUrl;email;accountKey;accountUrl=null;directory=null;nonce=null;constructor(l){this.directoryUrl=l.staging?Cc.staging:Cc.production,this.email=l.email,this.accountKey=l.accountKey||this.generateAccountKey()}generateAccountKey(){let{privateKey:l}=yc("ec",{namedCurve:"P-256"});return l.export({type:"pkcs8",format:"pem"})}async getDirectory(){if(this.directory)return this.directory;let l=await fetch(this.directoryUrl);if(!l.ok)throw Error(`Failed to fetch ACME directory: ${l.status}`);return this.directory=await l.json(),this.directory}async getNonce(){if(this.nonce){let v=this.nonce;return this.nonce=null,v}let l=await this.getDirectory(),P=(await fetch(l.newNonce,{method:"HEAD"})).headers.get("replay-nonce");if(!P)throw Error("Failed to get nonce from ACME server");return P}getJwk(){let l=this.accountKey.split(`
+`).filter((ot)=>!ot.startsWith("-----")).join(""),S=Buffer.from(l,"base64"),P=S.length-65,v=S.subarray(P+1,P+33),E=S.subarray(P+33,P+65);return{kty:"EC",crv:"P-256",x:this.base64UrlEncode(v),y:this.base64UrlEncode(E)}}getJwkThumbprint(){let l=this.getJwk(),S=JSON.stringify({crv:l.crv,kty:l.kty,x:l.x,y:l.y}),P=gc("sha256").update(S).digest();return this.base64UrlEncode(P)}base64UrlEncode(l){return(typeof l==="string"?Buffer.from(l):l).toString("base64").replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async signPayload(l,S){let P=await this.getNonce(),v=this.getJwk(),E={alg:"ES256",nonce:P,url:l};if(this.accountUrl)E.kid=this.accountUrl;else E.jwk=v;let ot=this.base64UrlEncode(JSON.stringify(E)),Ie=S===""?"":this.base64UrlEncode(JSON.stringify(S)),Ne=`${ot}.${Ie}`,nt=xu("SHA256");nt.update(Ne);let Pt=nt.sign(this.accountKey),st=Pt.subarray(4,4+Pt[3]),ur=4+Pt[3]+2,pr=Pt.subarray(ur,ur+Pt[ur-1]),gr=Buffer.alloc(32),Dt=Buffer.alloc(32);st.copy(gr,32-st.length),pr.copy(Dt,32-pr.length);let St=Buffer.concat([gr,Dt]);return JSON.stringify({protected:ot,payload:Ie,signature:this.base64UrlEncode(St)})}async acmeRequest(l,S){let P=await this.signPayload(l,S),v=await fetch(l,{method:"POST",headers:{"Content-Type":"application/jose+json"},body:P}),E=v.headers.get("replay-nonce");if(E)this.nonce=E;let ot,Ie=v.headers.get("content-type");if(Ie?.includes("application/json")||Ie?.includes("application/problem+json"))ot=await v.json();else ot=await v.text();if(!v.ok)throw Error(`ACME request failed: ${JSON.stringify(ot)}`);return{body:ot,headers:v.headers}}async registerAccount(){let l=await this.getDirectory(),{body:S,headers:P}=await this.acmeRequest(l.newAccount,{termsOfServiceAgreed:!0,contact:[`mailto:${this.email}`]}),v=P.get("location");if(!v)throw Error("No account URL returned");return this.accountUrl=v,v}async createOrder(l){if(!this.accountUrl)await this.registerAccount();let S=await this.getDirectory(),{body:P,headers:v}=await this.acmeRequest(S.newOrder,{identifiers:l.map((ot)=>({type:"dns",value:ot}))}),E=v.get("location");if(!E)throw Error("No order URL returned");return{orderUrl:E,authorizations:P.authorizations,finalize:P.finalize}}async getAuthorization(l){let{body:S}=await this.acmeRequest(l,""),P=S.identifier.value,v=this.getJwkThumbprint(),E=S.challenges.filter((ot)=>ot.type==="http-01"||ot.type==="dns-01").map((ot)=>{let Ie=`${ot.token}.${v}`;if(ot.type==="http-01")return{type:"http-01",token:ot.token,keyAuthorization:Ie,identifier:`/.well-known/acme-challenge/${ot.token}`};else{let Ne=this.base64UrlEncode(gc("sha256").update(Ie).digest());return{type:"dns-01",token:ot.token,keyAuthorization:Ie,identifier:`_acme-challenge.${P}`,dnsValue:Ne}}});return{domain:P,challenges:E}}async respondToChallenge(l){await this.acmeRequest(l,{})}async waitForAuthorization(l,S=30){for(let P=0;P<S;P++){let{body:v}=await this.acmeRequest(l,"");if(v.status==="valid")return;if(v.status==="invalid")throw Error(`Authorization failed: ${JSON.stringify(v)}`);await new Promise((E)=>setTimeout(E,2000))}throw Error("Authorization timed out")}generateCsr(l){let{privateKey:S}=yc("rsa",{modulusLength:2048}),P=S.export({type:"pkcs8",format:"pem"});return{csr:this.createSimpleCsr(l,S),privateKey:P}}createSimpleCsr(l,S){throw Error("CSR generation requires additional implementation. Consider using the shell-based certbot approach instead.")}async finalizeOrder(l,S){let{csr:P,privateKey:v}=this.generateCsr(S),{body:E}=await this.acmeRequest(l,{csr:this.base64UrlEncode(Buffer.from(P,"base64"))}),ot=E.certificate;if(!ot)throw Error("Certificate not immediately available - polling not implemented");let Ne=await(await fetch(ot)).text(),nt=Ne.split(/(?=-----BEGIN CERTIFICATE-----)/g),Pt=nt[0],st=nt.slice(1).join("");return{certificate:Pt,privateKey:v,chain:st,fullchain:Ne,expiresAt:new Date(Date.now()+7776000000)}}getAccountKey(){return this.accountKey}}var kn=(l)=>l===void 0?void 0:l?"on":"off";function oc(l){let S={ssl:l.ssl,always_use_https:kn(l.alwaysUseHttps),automatic_https_rewrites:kn(l.automaticHttpsRewrites),min_tls_version:l.minTlsVersion,tls_1_3:kn(l.tls13),brotli:kn(l.brotli),http3:kn(l.http3),"0rtt":kn(l.zeroRtt),early_hints:kn(l.earlyHints),browser_cache_ttl:l.browserCacheTtl,always_online:kn(l.alwaysOnline),websockets:kn(l.websockets),email_obfuscation:kn(l.emailObfuscation)};if(l.hsts)S.security_header={strict_transport_security:{enabled:l.hsts.enabled,max_age:l.hsts.maxAge??31536000,include_subdomains:l.hsts.includeSubdomains??!1,preload:l.hsts.preload??!1,nosniff:l.hsts.noSniff??!0}};for(let P of Object.keys(S))if(S[P]===void 0)delete S[P];return{...S,...l.raw??{}}}var Ha={ssl:"strict",alwaysUseHttps:!0,automaticHttpsRewrites:!0,minTlsVersion:"1.2",tls13:!0,brotli:!0,http3:!0,earlyHints:!0,alwaysOnline:!0,emailObfuscation:!1,browserCacheTtl:0};import{connect as Fu}from"node:tls";async function ac(l){let{address:S,serverName:P,port:v=443,timeoutMs:E=5000}=l;return new Promise((ot)=>{let Ie=!1,Ne=(Pt)=>{if(Ie)return;Ie=!0;try{nt.destroy()}catch{}ot(Pt)},nt=Fu({host:S,port:v,servername:P,rejectUnauthorized:!1,timeout:E});nt.once("secureConnect",()=>{if(nt.authorized){Ne({reachable:!0,trusted:!0});return}Ne({reachable:!0,trusted:!1,reason:nt.authorizationError?String(nt.authorizationError):"origin certificate is not trusted for this hostname"})}),nt.once("timeout",()=>{Ne({reachable:!1,trusted:!1,reason:`no TLS handshake within ${E}ms`})}),nt.once("error",(Pt)=>{Ne({reachable:!1,trusted:!1,reason:Pt.message})})})}function Mu(l,S){let P=S.replace(/\.$/,"").toLowerCase();return l.some((v)=>{let E=v.replace(/\.$/,"").toLowerCase();if(E===P)return!0;if(!E.startsWith("*."))return!1;let ot=E.slice(2);if(!P.endsWith(`.${ot}`))return!1;return!P.slice(0,P.length-ot.length-1).includes(".")})}async function Bu(l){let{provider:S,zone:P,hosts:v,ipv4:E,ipv6:ot,proxied:Ie=!0,settings:Ne=Ha,cache:nt,originGuard:Pt,purge:st=!0,ttl:ur=300,skipOriginProbe:pr=!1,skipEdgeCertificateCheck:gr=!1}=l,Dt={records:[],settingsChanged:[],cacheRules:0,originGuard:!1,purged:!1,deferredProxy:[],warnings:[]};if(v.length===0)return Dt;let St=[],Se=Ie&&!gr?await S.listEdgeCertificateHosts(P):null;for(let ie of v){let Rt=Ie;if(Rt&&Se&&!Mu(Se,ie)){Rt=!1;let er=Se.length===0?"the zone has no active edge certificate yet":`no active edge certificate covers it (${Se.join(", ")})`;Dt.deferredProxy.push({host:ie,reason:er}),Dt.warnings.push(`${ie}: publishing DNS-only — ${er}. Proxying it would make Cloudflare terminate TLS with no certificate for the name, which fails the handshake outright rather than degrading. Universal SSL covers the apex and ONE level of subdomain, so a deeper name needs its own certificate; otherwise re-run the deploy once the certificate is active.`)}if(Rt&&!pr){let er=await ac({address:E,serverName:ie});if(!er.trusted){Rt=!1;let lr=er.reason||"origin is not serving a trusted certificate";Dt.deferredProxy.push({host:ie,reason:lr}),Dt.warnings.push(`${ie}: publishing DNS-only for now — the origin does not yet serve a certificate this proxy can verify (${lr}). The origin issues certificates over HTTP-01, which needs the name to reach it directly; re-run the deploy once it has one and the record will be proxied.`)}}if(Rt)St.push(ie);let Nt=[{type:"A",content:E}];if(ot&&Tn(ie))Nt.push({type:"AAAA",content:ot});for(let{type:er,content:lr}of Nt){let fr=await S.upsertRecord(P,{name:ie,type:er,content:lr,ttl:ur,proxied:Rt});if(fr.success)Dt.records.push({host:ie,type:er,content:lr,proxied:Rt});else Dt.warnings.push(`${ie} ${er} → ${lr} failed: ${fr.message||"unknown provider error"}`)}}if(St.length===0){if(Ie)Dt.warnings.push("No host is proxied yet, so zone settings, cache rules and purge were skipped — they only take effect through the proxy.");return Dt}try{let ie=oc(Ne),Rt=await S.applyZoneSettings(P,ie);Dt.settingsChanged=Rt.changed;for(let Nt of Rt.failed)Dt.warnings.push(`zone setting '${Nt.id}' could not be applied: ${Nt.error}`)}catch(ie){Dt.warnings.push(`zone settings could not be read: ${ie instanceof Error?ie.message:String(ie)}`)}let Bt=za(St,nt);if(Bt.length>0){let ie=await S.putManagedPhaseRules(P,"http_request_cache_settings",Bt);if(ie.success)Dt.cacheRules=Bt.length;else Dt.warnings.push(`cache rules could not be written: ${ie.message}`)}if(Pt){let ie=Ka(St,Pt.header,Pt.value);if(ie.length>0){let Rt=await S.putManagedPhaseRules(P,"http_request_late_transform",ie);if(Rt.success)Dt.originGuard=!0;else Dt.warnings.push(`origin guard header could not be written: ${Rt.message}. `+"The gateway will reject requests that lack it — disable the guard or grant the token Transform Rules: Edit.")}}if(st){if(Dt.purged=await S.purgeCache(P,{hosts:St}),!Dt.purged)Dt.warnings.push("edge cache purge failed — new content may take until TTL expiry to appear.")}return Dt}var _u=(l)=>process.env[l];function Sc(l,S){let P=l.replace(/\.$/,"").toLowerCase();if(S){let v=S.replace(/\.$/,"").toLowerCase();if(P===v||P.endsWith(`.${v}`))return v}return P.split(".").slice(-2).join(".")}function Vu(l,S={}){let P=S.env??_u,v=l.infrastructure?.compute?.proxy?.cdn,E=[];if(!v||v.provider!=="cloudflare")return{plan:null,errors:E};if(v.originDomain)E.push(`compute.proxy.cdn.originDomain (${v.originDomain}) is ignored for Cloudflare: the proxy forwards to the address in the record it fronts, `+"so no separate origin hostname is needed — and publishing one gives clients a documented way around the edge.");let ot=P("CLOUDFLARE_API_TOKEN");if(!ot)return E.push("CLOUDFLARE_API_TOKEN is not set — the Cloudflare CDN cannot be reconciled."),{plan:null,errors:E};let Ie=l.sites??{},Ne=v.frontedHosts?.length?[...new Set(v.frontedHosts.map((pr)=>pr.toLowerCase()))]:Nn(Ie,{autoWww:l.infrastructure?.compute?.proxy?.autoWww!==!1});if(Ne.length===0)return E.push("No hostnames to front — set compute.proxy.cdn.frontedHosts, or give a site a domain."),{plan:null,errors:E};let nt=l.infrastructure?.dns?.domain,Pt=new Set(Ne.map((pr)=>Sc(pr,nt)));if(Pt.size>1)return E.push(`Fronted hosts span more than one zone (${[...Pt].join(", ")}). A Cloudflare zone is configured as a unit, so run one CDN config per zone.`),{plan:null,errors:E};let st=v.cloudflare??{},ur=v.secret?{header:v.secretHeader??"X-Origin-Verify",value:v.secret}:void 0;return{plan:{zone:[...Pt][0],hosts:Ne,apiToken:ot,zoneId:st.zoneId??P("CLOUDFLARE_ZONE_ID"),accountId:st.accountId??P("CLOUDFLARE_ACCOUNT_ID"),proxied:st.proxied!==!1,settings:st.settings??Ha,cache:st.cache,originGuard:ur,purge:st.purgeOnDeploy!==!1,skipOriginProbe:st.skipOriginProbe===!0},errors:E}}var Wu=26214400;var Hu=new Set(["/_headers","/_redirects","/_routes.json","/_worker.js"]);class Ac{name="cloudflare-pages";apiToken;accountId;constructor(l){if(!l.apiToken)throw Error("Cloudflare Pages needs an API token");if(!l.accountId)throw Error("Cloudflare Pages needs an account id");this.apiToken=l.apiToken,this.accountId=l.accountId}async request(l,S,P){return cs(l,`/accounts/${this.accountId}${S}`,`Bearer ${this.apiToken}`,P)}async getProject(l){try{return await this.request("GET",`/pages/projects/${l}`)}catch(S){if(S instanceof Error&&/\b8000007\b|not found/i.test(S.message))return null;throw S}}async ensureProject(l,S="main"){let P=await this.getProject(l);if(P)return P;return this.request("POST","/pages/projects",{name:l,production_branch:S})}async uploadToken(l){return(await this.request("GET",`/pages/projects/${l}/upload-token`)).jwt}async missingHashes(l,S){let P=await cs("POST","/pages/assets/check-missing",`Bearer ${l}`,{hashes:S});return new Set(P)}async upsertHashes(l,S){await cs("POST","/pages/assets/upsert-hashes",`Bearer ${l}`,{hashes:S})}async uploadBatch(l,S){let P=S.map((v)=>({key:v.hash,value:v.base64,metadata:{contentType:zu(v.extension)},base64:!0}));await cs("POST","/pages/assets/upload",`Bearer ${l}`,P)}async createDeployment(l,S,P){let v={};for(let ot of S)v[ot.path]=ot.hash;let E=new FormData;if(E.append("manifest",JSON.stringify(v)),P)E.append("branch",P);return this.request("POST",`/pages/projects/${l}/deployments`,E)}async deployDirectory(l){let S=await Wl(l.directory);if(S.length===0)throw Error(`No files to deploy in ${l.directory}`);let P=await this.uploadToken(l.project),v=await this.missingHashes(P,S.map((nt)=>nt.hash)),E=S.filter((nt)=>v.has(nt.hash)),ot=[];for(let nt=0;nt<E.length;nt+=100)ot.push(E.slice(nt,nt+100));let Ie=0;for(let nt=0;nt<ot.length;nt+=4){let Pt=ot.slice(nt,nt+4);await Promise.all(Pt.map((st)=>this.uploadBatch(P,st))),Ie+=Pt.reduce((st,ur)=>st+ur.length,0),l.onProgress?.(Ie,E.length)}return await this.upsertHashes(P,S.map((nt)=>nt.hash)),{deployment:await this.createDeployment(l.project,S,l.branch),total:S.length,uploaded:E.length,uploadedBytes:E.reduce((nt,Pt)=>nt+Pt.size,0)}}async listCustomDomains(l){return(await this.request("GET",`/pages/projects/${l}/domains`)).map((P)=>P.name)}async attachCustomDomain(l,S){if((await this.listCustomDomains(l)).includes(S))return!1;return await this.request("POST",`/pages/projects/${l}/domains`,{name:S}),!0}}function Gu(l,S){return{type:"CNAME",name:l,value:S.endsWith(".pages.dev")?S:`${S}.pages.dev`,ttl:1,proxied:!0}}async function Ic(l,S){let{blake3:P}=await import("./chunk-vs0qrm09.js").then((m)=>zh(m.default,1));return(await P(l+S)).slice(0,32)}async function Wl(l){let{readdir:S}=await import("node:fs/promises"),{join:P,relative:v,sep:E}=await import("node:path"),ot=[];async function Ie(Ne){let nt=await S(Ne,{withFileTypes:!0});for(let Pt of nt){let st=P(Ne,Pt.name);if(Pt.isDirectory()){await Ie(st);continue}if(!Pt.isFile())continue;let ur=`/${v(l,st).split(E).join("/")}`;if(Hu.has(ur))continue;let pr=await Bun.file(st).bytes();if(pr.byteLength>26214400)throw Error(`${ur} is ${pr.byteLength} bytes, over the Cloudflare Pages limit of 26214400`);let gr=Buffer.from(pr).toString("base64"),Dt=Pt.name.lastIndexOf("."),St=Dt>0?Pt.name.slice(Dt+1):"";ot.push({path:ur,hash:await Ic(gr,St),base64:gr,extension:St,size:pr.byteLength})}}return await Ie(l),ot.sort((Ne,nt)=>Ne.path.localeCompare(nt.path)),ot}function zu(l){return{html:"text/html; charset=utf-8",css:"text/css; charset=utf-8",js:"application/javascript; charset=utf-8",mjs:"application/javascript; charset=utf-8",json:"application/json; charset=utf-8",map:"application/json; charset=utf-8",xml:"application/xml; charset=utf-8",txt:"text/plain; charset=utf-8",svg:"image/svg+xml",png:"image/png",jpg:"image/jpeg",jpeg:"image/jpeg",gif:"image/gif",webp:"image/webp",avif:"image/avif",ico:"image/x-icon",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",otf:"font/otf",pdf:"application/pdf",webmanifest:"application/manifest+json"}[l.toLowerCase()]||"application/octet-stream"}async function cs(l,S,P,v){let E={Authorization:P},ot;if(v instanceof FormData)ot=v;else if(v!==void 0)E["Content-Type"]="application/json",ot=JSON.stringify(v);let Ie=await fetch(`https://api.cloudflare.com/client/v4${S}`,{method:l,headers:E,body:ot}),Ne=await Ie.text(),nt;try{nt=JSON.parse(Ne)}catch{throw Error(`Cloudflare Pages API returned ${Ie.status} with a non-JSON body: ${Ne.slice(0,200)}`)}if(!nt.success){let Pt=(nt.errors??[]).map((st)=>`${st.code}: ${st.message}`).join(", ");throw Error(`Cloudflare Pages API error (${Ie.status}): ${Pt||Ne.slice(0,200)}`)}return nt.result}export{zg as ABTestManager,ae as ACMClient,dr as ACMDnsValidator,Cc as ACME_DIRECTORIES,we as AI,ol as API_IDEMPOTENCY_TTL_MS,il as API_TOKEN_DEFAULT_TTL_MS,sl as API_TOKEN_MAX_TTL_MS,Fi as API_VERSION,de as AUTHORIZATION_CAPABILITIES,el as AUTH_ACTION_TOKEN_TTL_MS,tl as AUTH_MFA_CHALLENGE_TTL_MS,rl as AUTH_OIDC_TRANSACTION_TTL_MS,ze as AUTH_SESSION_ABSOLUTE_TTL_MS,Zd as AUTH_SESSION_IDLE_TTL_MS,CA as AWSAPIError,n as AWSClient,h as AWSCloudFormationClient,A as AWSCloudFrontClient,Gg as AWSConfigManager,kI as AWS_PSEUDO_PARAMETERS,Re as AWS_REGIONS,Lu as AcmeClient,xr as AlertEvaluator,fi as AlertStore,Ks as AnomalyConfigStore,Pd as ApiGateway,i as ApiServiceError,Ga as ApplicationAutoScalingClient,lo as Arn,D as AssetHasher,U as Auth,Oi as AuthenticationStore,Ci as AutomationApiService,xi as AutomationIdentityStore,Xo as AwsAuroraDataAdapter,ra as AwsAuroraTransport,Sa as AwsDatabaseBackupSource,mr as AwsDriver,Yo as AwsElastiCacheDataAdapter,na as AwsElastiCacheTransport,Vm as AwsIamCapabilityScanner,Ta as AwsInfrastructureBackupSource,Jo as AwsRdsDataAdapter,ta as AwsRdsTransport,ih as AwsRegionalDriver,Ra as AwsSecretsManagerConfigurationBackend,Zp as AwsSpendTransport,Da as AwsSsmConfigurationBackend,Ji as BackupCoordinator,Qg as BackupManager,ya as BackupStore,Tm as BatchProcessingManager,fn as BedrockClient,hn as BedrockRuntimeClient,gl as BitbucketSourceAdapter,jg as BlueGreenManager,Im as BounceComplaintHandler,am as BuildOptimizationManager,xl as BunDockerRuntime,uu as BunDockerVolumeRuntime,lu as BunFilesystemArchiveRuntime,ue as CDN,Ao as CHAIN_HEADER,ds as CLOUDFLARE_MANAGED_RULE_PREFIX,bd as CLOUDFRONT_FAILOVER_STATUS_CODES,TC as COMMON_CROSS_ACCOUNT_ROLES,Ue as CONTROL_PLANE_SCHEMA_VERSION,ao as Cache,go as CanaryManager,im as CertificateManager,Nf as CloudBlockVolumeDriver,Ds as CloudDriverFactory,je as CloudError,Ag as CloudFormationBuilder,h as CloudFormationClient,A as CloudFrontClient,qg as CloudTrailManager,he as CloudWatchLogsClient,Ac as CloudflarePagesProvider,Ae as CloudflareProvider,xA as CommandHistory,H as Communication,Nr as ComposeApplicationService,Lt as ComposeApplicationStore,Et as ComprehendClient,a as Compute,eg as ComputeSpendTransport,po as ConfigurationError,Na as ConfigurationService,wa as ConfigurationStore,gn as ConnectClient,ea as ContainerDataAdapter,cm as ContainerRegistryManager,va as ControlPlaneBackupSource,ma as ControlPlaneCleanupDriver,di as ControlPlaneStore,Vs as CounterTracker,jt as CredentialError,xg as CrossRegionReferenceManager,oA as DASHBOARD_ENTRY,aA as DASHBOARD_PORT_BASE,cA as DASHBOARD_PORT_SPAN,sA as DASHBOARD_STATE_DIR,vo as DEFAULT_ATTACK_MODE_HOURS,ud as DEFAULT_DDOS_THRESHOLDS,ag as DEFAULT_FAILOVER_STATUS_CODES,jc as DEFAULT_METER_MAPPINGS,qc as DEFAULT_PRICE_BOOK,Di as DEFAULT_RECURSION_LIMITS,Dn as DEFAULT_RPX_CERTS_DIR,q as DEFAULT_SERVICE_LIMITS,ig as DEFAULT_STATE_DIR,bu as DEFAULT_STATIC_ASSET_EXTENSIONS,tA as DEFAULT_STORAGE_FAILOVER_STATUS_CODES,Gf as DEFAULT_TELEMETRY_POLICY,$p as DEFAULT_THRESHOLDS,Tf as DEPLOYMENT_QUEUE_KINDS,fo as DEPTH_HEADER,_r as DETECTABLE_SIGNALS,Nl as DIAGNOSTIC_PRESETS,vm as DLQMonitoringManager,L as DNS,Am as DNSSECManager,Gi as DataServiceLifecycle,Wo as DataServiceStore,Gt as Database,tm as DatabaseUserManager,ee as DebugLogger,eA as DependencyGraph,Q as Deployment,SA as DeploymentError,Hg as DisasterRecoveryManager,vn as DnsProviderFactory,Jt as DockerDataTransport,Go as DockerDiscoveryAdapter,Pr as DockerNamedVolumeDriver,ba as DockerVolumeBackupSource,c as DurableOperationQueue,Ms as DurableQueueWorker,Be as DynamoDBClient,Er as EC2Client,_e as ECRClient,Ye as ECSClient,sr as EFSClient,Fa as ELBv2Client,Bf as ENFORCEMENT_ACTIONS,mi as ENFORCEMENT_DESCRIPTIONS,R as ENFORCEMENT_SEVERITY,up as ENVIRONMENT_LABEL,Dl as EcsRuntimeAdapter,bo as EdgeRateLimiter,et as ElastiCacheClient,m as Email,MA as EmailAdvanced,Sm as EmailAnalyticsManager,Sn as EmailClient,FA as EmailHandlers,Em as EmailTemplateManager,ia as EncryptedDataSecretStore,EA as ErrorCodes,nr as EventBridgeClient,th as EventBridgeJobAdapter,Pa as ExternalConfigurationBackend,oo as FAILOVER_REPLICA_POLICY_SID,bm as FIFOQueueManager,Vp as FOCUS_VERSION,bg as FileCache,qe as FileSystem,Ca as FilesystemBackupSource,oa as FleetService,sa as FleetStore,e as Fn,ml as GiteaSourceAdapter,ul as GithubSourceAdapter,pl as GitlabSourceAdapter,Lg as GlobalResourceManager,Oe as GoDaddyProvider,Vg as GuardDutyManager,at as HOST_SITES_DIR,TA as HashCache,_m as HealthCheckManager,He as HealthCheckRunner,yr as HetznerClient,Ce as HetznerDriver,fe as IAMClient,Ya as IPV6_EXCLUDED_HOST_LABELS,om as ImageScanningManager,Yl as InfrastructureGenerator,_c as InvalidOperationTransitionError,pt as JobLoader,rh as JobProviderReconciler,Ko as JobService,jo as JobStore,rr as KendraClient,iy as LARAVEL_SERVERLESS_BUILD_STEPS,C as LambdaClient,pm as LambdaConcurrencyManager,hm as LambdaDLQManager,gm as LambdaDestinationsManager,lm as LambdaLayersManager,Pl as LambdaRuntimeAdapter,mm as LambdaVPCManager,um as LambdaVersionsManager,cn as LocalEncryptedConfigurationBackend,Ea as LogicalDatabaseBackupSource,Xg as LogsManager,qA as MANAGED_NODE_VERSIONS,Ec as MANAGEMENT_DASHBOARD_SITE,yg as MANAGEMENT_DASHBOARD_SITE_PREFIX,Bi as MAX_CONTROL_HOURS,Oc as MAX_CONTROL_PLANE_ERROR_BYTES,Bp as MAX_CONTROL_PLANE_JSON_BYTES,Hs as METERS,kf as METER_KEYS,_f as MICRO_CENTS,Mp as MIN_PROJECTION_CONFIDENCE,Ru as MTA_STS_PORT,ga as MaintenanceService,pa as MaintenanceStore,Z as Messaging,Jg as MetricsManager,Yg as MigrationManager,Dg as MockCloudFormation,Ng as MockDynamoDB,Pg as MockS3,co as Monitoring,Fg as MultiAccountManager,Og as MultiRegionManager,PA as MultiStepProgress,f as Network,Om as NetworkSecurityManager,Ai as NotificationRouter,lg as ORIGIN_CONNECTION_ATTEMPTS,ug as ORIGIN_CONNECTION_TIMEOUT,cg as ORIGIN_GROUP_ALLOWED_METHODS,DI as ORIGIN_GROUP_ID_SUFFIX,dg as ORIGIN_GROUP_SELECTION_CRITERIA,Ua as OpenSearchClient,ct as OptimisticConcurrencyError,Ug as OrganizationManager,Wu as PAGES_MAX_FILE_BYTES,sy as PHP_DEFAULT_EXCLUDES,VA as PHP_LAYER_EXTENSIONS,lp as PROJECT_LABEL,rt as PROXIABLE_RECORD_TYPES,b as ParameterStore,em as PerformanceManager,Y as Permissions,Qa as PersonalizeClient,Ve as Phone,UA as PhoneAdvanced,rA as PhoneHandlers,ca as PlacementService,aa as PlacementStore,An as PollyClient,se as PorkbunProvider,Jr as PreDeployScanner,kg as PreviewEnvironmentManager,Dr as PreviewEnvironmentService,Qe as PreviewEnvironmentStore,Bg as PreviewNotificationService,DA as ProgressBar,Kg as ProgressiveDeploymentManager,To as ProtectionControlStore,yI as Pseudo,M as Queue,li as QueueCancellationError,wm as QueueManagementManager,hI as QueuePresets,$s as QueueTimeoutError,Vd as RATE_LIMIT_KEY_SEPARATOR,j as RDSClient,$A as RECOMMENDED_ACCOUNT_STRUCTURES,vC as RECOMMENDED_SCPS,Qm as RELEASE_QUEUE_KINDS,BA as REPL,OA as REPLCommandBuilder,_A as REPLContext,pp as ROLE_LABEL,wA as RateLimiter,fI as RealtimePresets,jp as RecordingSpendTransport,Io as RecursionGuard,gt as Redirects,$g as RegionPairManager,la as RegionService,da as RegionStore,Ge as Registry,bt as RekognitionClient,mt as ReleaseService,Oo as ReleaseStore,nh as RemoteBuildService,Zg as ReplicaManager,xm as ResourceManagementManager,X as RetryableOperationError,y as Route53Client,Ma as Route53DomainsClient,z as Route53Provider,ym as Route53ResolverManager,fm as Route53RoutingManager,ge as RuntimeOperationService,Vo as RuntimeStreamRegistry,Ia as S3BackupDestinationAdapter,o as S3Client,G as S3Error,Al as SECRET_PATTERNS,Gp as SENSITIVITY_THRESHOLDS,tt as SESClient,F as SMS,Ze as SNSClient,Yp as SPEND_CYCLE_SECONDS,sd as SPEND_GATE_SETTING,zf as SPEND_LEASE_SETTING,ne as SQSClient,Ee as SSH_BOOTSTRAP_VERSION,Vn as SSH_PREFLIGHT_SCRIPT,be as SSMClient,sg as STATE_DIR_ENV_VAR,Ha as STATIC_SITE_ZONE_SETTINGS,wd as STORAGE_FAILOVER_METADATA_KEY,me as STSClient,yn as SchedulerClient,qt as Search,Xr as SecretFindingScanner,vi as Secrets,nm as SecretsManager,V as SecretsManagerClient,rm as SecretsRotationManager,I as Security,Hr as SecurityHubManager,Wr as SecurityPostureStore,ht as SecurityScannerRunner,sm as SecurityScanningManager,Cm as SenderReputationManager,eh as ServerCronJobAdapter,Zo as ServerDataAdapter,Qs as ServerPathVolumeDriver,dm as ServiceMeshManager,Dd as Sftp,Js as SignalSource,QA as SmsAdvanced,Tt as SmsClient,nA as SmsHandlers,ja as SmsVoiceClient,xo as SourceConnectionStore,Kt as SourceProviderError,od as SpendCapError,Or as SpendGate,Jp as SpendLoopLease,to as SpendNotificationRouter,Xp as SpendRunner,Mt as SpendService,pi as SpendStore,NA as Spinner,Sr as SshDriver,en as SshFleetDriver,Mg as StackDependencyManager,NI as StacksIntegration,km as StaticSiteManager,ve as Storage,Bm as StorageAdvancedManager,In as SupportClient,Gr as SyntheticsManager,Ll as SystemFleetSshTransport,Ir as SystemSshTransport,qo as SystemdDiscoveryAdapter,yo as TRACE_HEADER,kA as TaskList,ut as TelemetryStore,Cd as TemplateBuilder,vg as TemplateCache,vt as TextractClient,mn as TranscribeClient,tr as TranslateClient,ah as TransportDisasterRecoveryDriver,oh as TransportPlatformMaintenanceDriver,qi as TransportRemoteBuildDriver,Qo as TrivyImageScanner,_o as TsCloudApiError,al as TsCloudClient,jf as URGENT_SPEND_EVENTS,Fp as USER_VISIBLE_ACTIONS,ua as UnavailableRegionalDriver,oe as UnifiedDnsValidator,Os as UnsupportedSchemaVersionError,Cg as ValidationError,ir as VoiceClient,Us as VolumeService,xt as VolumeStore,iA as Workflow,Wg as XRayManager,ZC as abTestManager,cl as activateImmutableRelease,Ou as addDns01ChallengeRecord,rn as addSiteToCloudConfig,At as ageSeconds,Kc as aggregateDeltas,Pp as allocateSitePorts,wI as analyzeStackDiff,hi as anomalyOptionsForSignal,wo as applyControlsToDdos,Jd as applyControlsToRateLimits,ms as applyDeclaredZoneSettings,Mr as applyMitigationFactor,of as applyPlan,ys as applyZoneMigration,Od as artifactKey,Qt as assertOriginGroupMethods,Li as assertReleaseStrategy,Hf as assertSpendAllows,uf as attachConflicts,pf as attachIsViable,lf as attachPreconditions,El as attachProvenanceToRelease,Ho as attachSbomToRelease,Sl as attachVulnerabilitySummary,Fm as authEncryptionKeyFile,w as authorizeOrganization,Ym as authorizeRuntimePath,eC as autocomplete,zC as awsConfigManager,cu as backupCredentialStatus,VC as backupManager,IS as batch,BE as batchProcessingManager,ko as beginOidcAuthorization,XC as blueGreenManager,wE as bounceComplaintHandler,dt as budgetWindow,xa as buildAndPushServerlessImage,xE as buildBunRuntimeLayerZip,yf as buildCertificatePackScript,hf as buildCertificateStateScript,If as buildCertificateUnpackScript,Nd as buildCloudFormationTemplate,hc as buildCloudInitFirstBoot,Mc as buildComposeLogsCommand,iI as buildComposeRuntimeCommand,sI as buildComposeScaleCommand,Fc as buildComposeShellCommand,wp as buildDrainSourceScript,Jh as buildDrainedSiteScanScript,Rd as buildFailoverReplicaPolicyStatement,Yt as buildFunctionEnv,Tp as buildHealthGateScript,Ln as buildHostCleanupDeployScript,Ts as buildHostCleanupInstallScript,xn as buildHostCleanupScript,ai as buildHostSitePortsScript,Sd as buildMailEnv,Ns as buildManagementDashboardArtifact,Xu as buildMediaCdnPlan,wu as buildMtaStsPolicy,Ph as buildMtaStsServer,OE as buildNodeRuntimeLayerZip,mE as buildOptimizationManager,pg as buildOriginGroup,Fr as buildOriginGroups,Ka as buildOriginGuardRule,yp as buildPauseWorkersScript,FE as buildPhpRuntimeLayerZip,fg as buildReplicationConfiguration,hg as buildReplicationRole,Ep as buildRestoreScript,K as buildRpxConfig,xe as buildRpxFragmentRefreshScript,cf as buildSetHostnameScript,Mn as buildSiteDeployScript,Cp as buildSnapshotScript,Rp as buildSourceStateScript,Bn as buildSshArgs,Gn as buildSshBootstrapScript,za as buildStaticSiteCacheRules,Un as buildStaticSiteDeployScript,bp as buildTargetStateScript,Ip as buildWorkersStateScript,vl as bytes,YC as canaryManager,tn as canonicalJson,ft as capabilities,Xt as capacity,DS as categorizeChanges,uE as certificateManager,Af as certificatesMatch,cS as checkIAMPermissions,XA as checkInvocation,lS as checkServiceQuotas,RA as chunk,ph as cleanupDns01Challenge,uI as clearSigningKeyCache,$o as cloneSourceBinding,kS as cloudConfigSchema,Yu as cloudDrivers,KC as cloudTrailManager,Wl as collectAssets,Co as collectPhpAppEntries,vu as collectServerDnsDomains,_p as completeComposeVolumeDeletion,Bo as completeOidcAuthorization,WI as composePresets,Ls as composeProjectName,Ld as composeServerlessAppTemplate,Wf as compositeSpendTransport,Ct as compressBackup,ay as config,_l as connectionGuidance,hE as containerRegistryManager,bf as controlPlaneDatabaseFile,kc as controlPlaneMigrations,$I as createApiBackendPreset,Uo as createApiV1Handler,fy as createAsgBuildDriver,du as createBackupQueueHandlers,ry as createCliHandler,k as createCloudDriver,mc as createCloudFrontPolicy,nS as createCredentialProvider,zI as createDashboardSite,HI as createDataPipelinePreset,Ol as createDataServiceQueueHandlers,Uc as createDeploymentQueueHandlers,T as createDnsProvider,hy as createEcsBuildDriver,ad as createEnforcementHandlers,Eg as createError,kd as createExistingStaticFullStackPreset,$l as createFleetQueueHandlers,LI as createFullStackAppPreset,Cs as createGoDaddyValidator,ME as createHandlers,ey as createHttpHandler,FI as createJamstackPreset,Bl as createJobQueueHandlers,VI as createLaravelPreset,GI as createMLApiPreset,ql as createMaintenanceQueueHandlers,Zu as createMediaAccessToken,UI as createMicroservicesPreset,$S as createMockAWS,_I as createNodeJsServerPreset,OI as createNodeJsServerlessPreset,as as createObjectStorageClient,Ss as createPorkbunValidator,JI as createPreset,Xf as createPresignedUrl,oI as createPresignedUrlAsync,ty as createQueueHandler,QI as createRealtimeAppPreset,Fl as createRegionQueueHandlers,Cl as createReleaseProvenance,ll as createReleaseQueueHandlers,gy as createRemoteBuildQueueHandlers,Es as createRoute53Validator,Xm as createRuntimeAdapters,iS as createS3Client,my as createServerBuildDriver,jI as createServerlessLaravelPreset,xI as createServerlessNodePreset,Eu as createSmsInfrastructure,We as createSourceAdapter,BI as createStaticSitePreset,qI as createTraditionalWebAppPreset,Qc as createVolumeQueueHandlers,MI as createWordPressPreset,Ri as createZip,cC as crossRegionReferenceManager,dn as dashboardActions,Ps as dashboardCredentialsFile,Zr as dataServiceCapabilities,cE as databaseUserManager,Yd as decodeBase32,ke as decompressBackup,Ah as decryptBackup,Ro as defaultConfig,Rg as defaultLocalConfig,zd as defaultRateLimitRules,cr as delegateZone,ps as delegateZoneFromConfig,iu as deleteFailoverReplicaBuckets,_a as deleteStaticSite,vc as deployAllComputeSites,fa as deployServerlessApp,su as deploySite,ks as deploySiteRelease,es as deployStaticSite,Oa as deployStaticSiteFull,ln as deployStaticSiteWithExternalDns,un as deployStaticSiteWithExternalDnsFull,yd as deploymentCoexistenceError,dA as deriveManagementDashboardPort,gs as describeDelegation,Wd as describePosture,hs as describeZoneSettings,Zm as desiredJobProviderState,Hp as detectAnomalies,og as detectDeploymentTargets,Wa as detectDnsProvider,rd as detectLatestAnomaly,oS as detectMisconfigurations,rg as detectServiceRegion,Lc as diffCompose,TS as diffTemplates,Lo as discoverGitRefs,No as discoverOidcProvider,Tl as discoverRuntimeInventory,kE as dlqMonitoringManager,Ja as dnsProviders,vE as dnssecManager,Km as dockerWorkloads,Vi as documentDigest,jC as drManager,$e as driverStatePath,wl as ecsWorkloads,Ot as effectiveCapabilities,RE as emailAnalyticsManager,PE as emailTemplateManager,_i as encodeBase32,fh as encryptBackup,bl as ensureDefaultSecurityPolicies,tu as ensureFailoverReplicaBuckets,Yn as ensureFirewall,ti as ensureManagementDashboard,Zn as ensureServer,Xn as ensureSshKey,J as escapeSecLang,Jc as evaluateBudget,zn as evaluatePreflight,eo as evaluateTelemetryAlertRules,kl as eventBridgeScheduleInput,ZA as eventToRequest,Ff as ewma,xc as exportCompose,fs as exportRoute53Zone,Sg as extendPreset,NE as fifoQueueManager,yS as findChangedFiles,xp as findMapping,Op as findPriceEntry,PC as formatAccountStructure,gf as formatAttachPlan,jS as formatBytes,Lr as formatCents,RI as formatDiff,Yh as formatDrainedSiteRefusal,zS as formatDuration,rC as formatFlagSuggestions,sC as formatHistory,oC as formatHistoryStats,rf as formatInventory,WS as formatKeyValue,KS as formatList,sf as formatPlan,Wn as formatPreflightFindings,VS as formatProgressBar,LA as formatRegion,SC as formatRegionList,qm as formatScanResults,JS as formatSuggestion,GS as formatTable,Br as formatTimeToExhaustion,qS as formatTree,mA as fromEC2Metadata,hA as fromECSMetadata,pA as fromEnvironment,gA as fromSharedCredentials,fA as fromWebIdentity,Md as functionFingerprint,Nn as gatewayHostnames,$d as generateAppImageDockerfile,GC as generateApprovalConfig,HA as generateBootstrap,US as generateCleanupWorkflow,QS as generateCostReportWorkflow,RC as generateCrossAccountRoleCF,yl as generateCycloneDxSbom,UC as generateDeploymentConfig,xC as generateDeploymentPipeline,NC as generateDeploymentWorkflow,Ba as generateExternalDnsStaticSiteTemplate,dh as generateHttpsServerCode,Il as generateImageSbom,lh as generateLetsEncryptUserData,t as generateLogicalId,FC as generateManualPipeline,OC as generateMatrixWorkflow,QC as generateMultiEnvConfig,LC as generateMultiEnvPipeline,kC as generateMultiEnvWorkflow,BC as generatePRPreviewWorkflow,qC as generateParallelConfig,ny as generatePhpFpmConfig,zA as generatePhpLayerDockerfile,$C as generatePreviewPipeline,FS as generatePreviewWorkflow,r as generateResourceName,HC as generateScheduledConfig,MC as generateScheduledPipeline,_C as generateScheduledWorkflow,Zi as generateStaticSiteTemplate,N as generateUbuntuAppCloudInit,IA as getAccountId,pC as getAllRegions,AC as getClosestRegion,nC as getCommandUsage,vf as getComposeTemplate,Lm as getConfig,YS as getContextualHelp,uo as getCredentials,PS as getDeploymentStrategy,NS as getDiffStats,wS as getDiffSummary,bA as getErrorDetails,_d as getLocalConfig,xS as getLocalCredentials,OS as getLocalEndpoint,LS as getLocalEnvVars,uS as getQuotaUsageSummary,wC as getRecommendedStructure,wi as getRegion,CC as getRegionStats,mC as getRegionsByCompliance,gC as getRegionsByLocation,hC as getRegionsByPricingTier,vA as getRequiredPermissions,pI as getSigningKeyCacheSize,Cu as getSmsInfrastructureStatus,II as getTimestamp,Eo as globMatches,Bs as globToRegex,dC as globalResourceManager,gi as governingLimitCents,ru as grantFailoverReplicaAccess,WC as guardDutyManager,ro as handleSpendRequest,Pn as hasAutoWwwVariant,Vt as hasManagementDashboardSite,Nc as hasProxyUpstream,mS as hashBuffer,hS as hashDirectory,Tg as hashFile,fS as hashManifest,wg as hashString,HE as healthCheckManager,Tn as hostAcceptsIpv6,Cn as hostCondition,Do as hotp,kr as hourBucket,Mf as hourBucketsBetween,gE as imageScanningManager,Ki as infraEnvFromOutputs,Ud as inspectInvocation,WA as installRecursionFetch,rs as invalidateCache,Pm as invocationContext,XS as isLikelyTypo,Rn as isLocalDatabase,_S as isLocalDevelopment,Ur as isManagementDashboardSiteName,or as isNameserverRegistrar,gI as isNodeCryptoAvailable,td as isOperationAllowed,Zs as isQuietHours,Td as isS3RestEndpoint,ni as isSafePattern,fd as isStateDirConfigured,Ad as isStatePath,$r as isValidCidr,fC as isValidRegion,ui as isValidTimeZone,mI as isWebCryptoAvailable,ar as isZoneHost,Yr as jobProviderCapability,os as keyMatchesFilters,IE as lambdaConcurrencyManager,EE as lambdaDLQManager,SE as lambdaDestinationsManager,AE as lambdaLayersManager,CE as lambdaVPCManager,yE as lambdaVersionsManager,Rl as lambdaWorkloads,Gd as laravelServerlessEnvDefaults,Rr as listComposeTemplates,Mi as listSourceReferences,Xd as loadCloudConfig,Ft as loadTelemetryPolicy,nE as logsManager,nd as lookbackHoursForSignal,Zf as mailEnabled,Id as mailFirewallPorts,sh as maintenanceWindowOpen,Yf as makeAWSRequest,cI as makeAWSRequestAsync,aI as makeAWSRequestOnce,Ig as managementDashboardSiteName,Ul as manifestDigest,Vr as matchTotpCounter,Ju as mediaObjectHeaders,zs as median,Up as medianAbsoluteDeviation,Xc as mergeDecisions,Qr as mergeInfrastructure,Lf as mergePriceBooks,zc as meterTelemetry,rE as metricsManager,Au as migrateObjectStorage,sE as migrationManager,EC as multiAccountManager,aC as multiRegionManager,mh as needsRenewal,GE as networkSecurityManager,yt as nextScheduleRuns,ye as normalizePublicIpv6,De as normalizeRuntimeStatus,Je as normalizeScheduleExpression,Hm as normalizeSourceEvent,Le as normalizeSshPublicKey,zp as normalizeTelemetryPolicy,oi as occupiedHostPorts,Fo as openApiDocument,Xs as optionsForSignal,bC as organizationManager,qd as packagePhpApp,qr as packageServerlessApp,Ic as pagesAssetHash,Gu as pagesDnsRecord,Bd as parallel,SS as parallelMap,CS as parallelWithRetry,ff as parseCertificateState,Fd as parseChain,wr as parseCompose,rI as parseComposeCatalog,zm as parseDockerInspect,pu as parseDotenv,Xh as parseDrainedSites,ci as parseHostSiteFragments,lI as parseJSONResponse,jn as parsePreflightFacts,Dp as parseSourceDrained,Wm as parseSystemdRecords,vp as parseTargetReady,Pc as parseUpstreamPort,Sp as parseWorkersPaused,dI as parseXMLResponse,Ii as pathTemplate,Rc as pendingSteps,js as percentOfLimit,aE as performanceManager,Rm as phpLayerBuildStage,jA as phpLayerPackages,Pi as phpRuntimeLayerAssets,nI as planComposeTemplateUpgrade,Yc as planEnforcement,fp as planIsDestructive,tg as planMitigation,af as planServerRename,Sf as planSiteMove,As as planZoneMigration,wt as policyTag,Kn as preflightFailed,MS as previewManager,HS as previewNotifications,It as previewSchedule,$f as previousBudgetWindow,Gs as priceUsage,Of as priceUsageLines,ef as probeHostRoutes,ac as probeOriginTls,vS as processInChunks,hl as processSourceWebhook,Qi as productionChangeReview,eE as progressiveDeploymentManager,Wc as projectSpend,Qd as propagationHeaders,La as providerEndpoint,Ql as publicKeyFingerprint,En as qualifyName,_E as queueManagementManager,AS as quickHash,jd as rateLimitHeaders,ki as rateLimitKey,Me as readDriverState,tf as reconcile,Tu as reconcileAddressRecords,Bu as reconcileCloudflareCdn,us as reconcileDeclaredRecords,py as reconcileJobObservation,Kr as reconcileSourceWebhook,Ui as recordDashboardHostPosture,dy as recordPreDeploySecretScan,ly as recordSkippedSecretScan,Hd as recursionBlockedResponse,Pe as redactRuntimeConfig,ld as redactTelemetryText,yi as redactTelemetryValue,sn as redeployServerlessApp,lC as regionPairManager,zr as releaseStrategyCapabilities,Um as releaseTrafficPlan,ri as reloadRpxGateway,ss as remapKey,Nu as removeDns01ChallengeRecord,nn as removeSiteFromCloudConfig,fl as removeSourceWebhook,Xa as removeStaleServerAddressRecords,$c as renderComposeTemplate,Ei as renderDdosInstallScript,md as renderNftablesRuleset,Hi as renderServerCron,gd as renderSysctlFile,wc as renderWafConfig,ii as renderWafInstallScript,Tc as renewRpxCertificates,oE as replicaManager,Jf as requestHash,RS as requiresReplacement,LE as resetRecursionRuntime,$E as resolveApp,p as resolveAppDatabase,df as resolveAttachTarget,Ke as resolveAuthEncryptionKey,le as resolveCloudProvider,Vu as resolveCloudflareCdnPlan,AA as resolveCredentials,Yi as resolveDashboardAction,bc as resolveDashboardAuth,lA as resolveDashboardDomain,uA as resolveDashboardDomains,ls as resolveDeclaredRecords,TI as resolveDeployBucketName,x as resolveDeploymentMode,$n as resolveExecStart,vd as resolveFailoverStatusCodes,cc as resolveHetznerApiToken,Ar as resolveHostCleanupConfig,bi as resolveMailService,KI as resolveManagementDashboardSite,Ti as resolveManagementDashboardSites,$a as resolveObjectStorage,Te as resolveOriginConnection,nf as resolvePlan,g as resolveProjectStackName,Tr as resolveProxyUpstreams,xd as resolveQueueNames,wf as resolveQueuedDeploymentCommand,zt as resolveQueues,KA as resolveRecursionConfig,yA as resolveRegion,re as resolveRuntimeInventory,Ut as resolveServerlessAppStackName,Ed as resolveServerlessArtifactBucketName,so as resolveServerlessAssetBucketName,ho as resolveServerlessRuntime,bI as resolveSiteBucketName,_s as resolveSiteDeployTarget,u as resolveSiteKind,EI as resolveSiteResourceName,CI as resolveSiteStackName,qn as resolveSshSettings,d as resolveStatePath,vI as resolveStorageBucketName,gg as resolveStorageFailover,kt as resolveUiSource,Sc as resolveZoneApex,qE as resourceManagementManager,Nm as responseToResult,Qp as robustZScore,_t as roleCapabilities,dl as rollbackImmutableRelease,on as rollbackServerlessApp,xf as roundCents,TE as route53ResolverManager,bE as route53RoutingManager,qp as routeMatches,gp as routesFromFragments,Ni as ruleMatches,GA as runBuildHooks,Zc as runEnforcement,So as runPhpBuildHooks,Xe as runRemoteCommand,pe as runtimeId,mg as s3RegionalDomain,bn as sameNameservers,Xi as sanitizeCloudConfig,s as sanitizeControlPlaneValue,SI as sanitizeName,nl as sanitizeOidcReturnPath,cd as saveTelemetryPolicy,Gm as scanForSecrets,Bc as scopeContains,lt as scopeKey,rc as scpUpload,ZS as searchCommands,xs as searchControlPlane,lE as secretsManager,dE as secretsRotationManager,uy as secureContainerRelease,JC as securityHubManager,pE as securityScanningManager,te as securityScope,nu as seedFailoverReplicas,jr as sendAuthenticationEmail,DE as senderReputationManager,ES as sequence,gu as serializeDotenv,ei as serverPublicIpv4,fE as serviceMeshManager,Xl as setAttachToInCloudConfig,Zt as setMaintenance,ji as setSitePropertyInCloudConfig,hd as setStateDir,uh as setupDns01Challenge,Va as setupSmsInfrastructure,mo as sha256,JA as sharedRecursionGuard,Dm as sharedRuntimeLoop,kp as shipsARelease,ju as signCloudFrontCookies,Ku as signCloudFrontUrl,_ as signRequest,ng as signRequestAsync,Ws as signalDefinition,B as siteInstallBase,si as siteMoveArchivePath,mf as siteMoveCertArchivePath,Dc as siteUnitGlob,Wp as spendNotificationText,no as spendOpenApiPaths,hr as sshExec,ce as sshExecOrThrow,uC as stackDependencyManager,ka as startLocalDashboardServer,Kf as startSpendLoop,io as stateDir,O as statePath,UE as staticSiteManager,QE as storageAdvancedManager,PI as storageFailoverReplicasFromTemplate,Uf as streamFocusJsonl,ed as strongestActiveAction,_g as suggestCommand,tC as suggestFlags,dS as suggestIAMPolicy,pS as suggestQuotaIncrease,IC as suggestRegionPairs,yC as suggestRegions,$i as syncSourceRepositories,Hc as synchronizeComposeVolumes,mu as synchronizeConfiguredConfiguration,zo as synchronizeConfiguredJobs,iE as syntheticsManager,pd as sysctlHardening,Jm as systemdWorkloads,Vf as telemetryBucketLabel,Si as telemetryCursor,dd as telemetryEstimatedMonthlyCost,qf as telemetryPercentile,Kp as telemetryPolicyKey,gS as templateCache,mp as tenantsOf,Mo as testSourceConnection,Gc as tieredMicroCents,oc as toCloudflareZoneSettings,Ys as toFocusJsonl,id as toFocusRecords,Zh as toInventoryServer,$m as totp,Po as totpUri,hp as unaccountedSites,jm as unsupportedCapabilities,Rf as unsupportedVolumeCapabilities,Gl as updateCompatibility,Vl as updateSiteInCloudConfig,ts as uploadStaticFiles,Lp as usageDeltaKey,$t as utcInstantOfLocal,DC as validateAccountStructure,BS as validateAgainstSchema,Pf as validateAttachment,hh as validateBackupDestination,iC as validateCommand,sS as validateConfiguration,aS as validateCredentials,Np as validateDeploymentConfig,Df as validateMountPath,Ht as validateOriginGroups,yu as validateResourceLimits,Ap as validateServerName,Kd as validateTemplate,hu as validateTemplateSize,Za as verifyAddressRecord,cy as verifyArtifactSignature,qu as verifyMediaAccessToken,Mm as verifyTotp,Hl as verifyUpdateSignature,Is as verifyZoneParity,Fs as volumeCapabilities,dp as wafEventTelemetry,nc as waitForCloudInit,_n as waitForSsh,Wt as webhookEndpoint,tS as withCDN,eS as withCache,ZI as withDatabase,YA as withInvocation,XI as withMonitoring,rS as withQueue,YI as withSecurity,bS as withTimeout,W as wrapCloudInitUserData,it as writeDriverState,tE as xrayManager,Ml as zeroCapacity,Qf as zeroFill,Vc as zoneOffsetMs,qs as zonedParts};