@stacksjs/ts-cloud 0.16.17 → 0.16.19

package/dist/{chunk-a9pqpqrh.js → chunk-vs0qrm09.js}

@@ -1,4 +1,4 @@
-import{kh}from"./chunk-enhddb1a.js";var wQ=kh(function(qA,nI){/*!
+import{Kh}from"./chunk-bxrzsth8.js";var wQ=Kh(function(qA,nI){/*!
  * hash-wasm (https://www.npmjs.com/package/hash-wasm)
  * (c) Dani Biro
  * @license MIT

package/dist/{chunk-x3xs6qvx.js → chunk-w9jhyy09.js}

@@ -1,4 +1,4 @@
-import{u}from"./chunk-hasa64d4.js";var ot="/etc/rpx/sites.d",nf={start:3000,end:3999};function g(t){return t.slug?.trim()||"app"}function wc(t){let r=t.lastIndexOf(":");if(r<0||r===t.length-1)return;let e=t.slice(r+1).trim();if(!/^\d+$/.test(e))return;let n=Number(e);return n>=1&&n<=65535?n:void 0}function ni(t,r={}){let e=r.ignoreSlug?.trim(),n=new Map;for(let o of t){let c=g(o);if(e&&c===e)continue;for(let a of o.proxies??[]){let f=typeof a.from==="string"?[a.from]:a.from??[];for(let i of f){let d=wc(i);if(d!==void 0&&!n.has(d))n.set(d,c)}}}return n}function ii(t=ot){return[`for __tsc_fragment in ${t}/*.json; do`,'  [ -f "$__tsc_fragment" ] || continue',`  base64 < "$__tsc_fragment" | tr -d '\\n'`,"  printf '\\n'","done"].join(`
-`)}function si(t){let r=[];for(let e of t.split(`
-`)){let n=e.trim();if(!n)continue;try{let o=JSON.parse(Buffer.from(n,"base64").toString("utf8"));if(o&&typeof o==="object"&&!Array.isArray(o))r.push(o)}catch{continue}}return r}function Ip(t,r,e=nf){let n=[],o=[],c=new Set(r.keys());for(let[a,f]of Object.entries(t.sites??{})){if(!f||u(f)!=="server-app")continue;let i=typeof f.port==="number"?f.port:void 0,d=Math.max(i??e.start,e.start),p;for(let s=d;s<=e.end;s++)if(!c.has(s)){p=s;break}if(p===void 0){let s=i!==void 0?r.get(i):void 0;o.push(`No free port for site '${a}' in ${e.start}-${e.end}${i!==void 0?` (wanted ${i}${s?`, held by '${s}'`:""})`:""}. Widen the range or free a port on the box.`);continue}c.add(p),n.push({site:a,port:p,declared:i,moved:i!==void 0&&p!==i})}return{allocations:n,errors:o}}
-export{ot,nf,wc,ni,ii,si,Ip};
+import{u}from"./chunk-3m9ghthh.js";var at="/etc/rpx/sites.d",Cf={start:3000,end:3999};function g(t){return t.slug?.trim()||"app"}function Pc(t){let r=t.lastIndexOf(":");if(r<0||r===t.length-1)return;let e=t.slice(r+1).trim();if(!/^\d+$/.test(e))return;let n=Number(e);return n>=1&&n<=65535?n:void 0}function oi(t,r={}){let e=r.ignoreSlug?.trim(),n=new Map;for(let o of t){let c=g(o);if(e&&c===e)continue;for(let a of o.proxies??[]){let f=typeof a.from==="string"?[a.from]:a.from??[];for(let i of f){let d=Pc(i);if(d!==void 0&&!n.has(d))n.set(d,c)}}}return n}function ai(t=at){return[`for __tsc_fragment in ${t}/*.json; do`,'  [ -f "$__tsc_fragment" ] || continue',`  base64 < "$__tsc_fragment" | tr -d '\\n'`,"  printf '\\n'","done"].join(`
+`)}function ci(t){let r=[];for(let e of t.split(`
+`)){let n=e.trim();if(!n)continue;try{let o=JSON.parse(Buffer.from(n,"base64").toString("utf8"));if(o&&typeof o==="object"&&!Array.isArray(o))r.push(o)}catch{continue}}return r}function Pp(t,r,e=Cf){let n=[],o=[],c=new Set(r.keys());for(let[a,f]of Object.entries(t.sites??{})){if(!f||u(f)!=="server-app")continue;let i=typeof f.port==="number"?f.port:void 0,d=Math.max(i??e.start,e.start),p;for(let s=d;s<=e.end;s++)if(!c.has(s)){p=s;break}if(p===void 0){let s=i!==void 0?r.get(i):void 0;o.push(`No free port for site '${a}' in ${e.start}-${e.end}${i!==void 0?` (wanted ${i}${s?`, held by '${s}'`:""})`:""}. Widen the range or free a port on the box.`);continue}c.add(p),n.push({site:a,port:p,declared:i,moved:i!==void 0&&p!==i})}return{allocations:n,errors:o}}
+export{at,Cf,Pc,oi,ai,ci,Pp};

package/dist/{chunk-r2v44ba2.js → chunk-z3wynefj.js}

@@ -1,22 +1,22 @@
-import{ot,ni,ii,si}from"./chunk-x3xs6qvx.js";function S(t){return t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function _h(t,e="/var/www"){let n=`${e}/${t}-`;return["set -u",`for TS_CLOUD_DIR in ${n}*; do`,'  [ -d "$TS_CLOUD_DIR" ] || continue','  [ -d "$TS_CLOUD_DIR/releases" ] || continue',`  TS_CLOUD_SITE="\${TS_CLOUD_DIR#${n}}"`,"  TS_CLOUD_ACTIVE=no",`  for TS_CLOUD_UNIT in $(ls /etc/systemd/system/ 2>/dev/null | grep -E "^${S(t)}-$TS_CLOUD_SITE[-@.]" || true); do`,'    systemctl is-active "$TS_CLOUD_UNIT" >/dev/null 2>&1 && TS_CLOUD_ACTIVE=yes',"  done",'  TS_CLOUD_SIZE="$(du -sh "$TS_CLOUD_DIR" 2>/dev/null | cut -f1)"','  echo "site:$TS_CLOUD_SITE:$TS_CLOUD_ACTIVE:${TS_CLOUD_SIZE:-?}"',"done","exit 0"]}function xh(t){if(!t)return[];let e=[];for(let n of t.split(`
-`)){let r=n.trim();if(!r.startsWith("site:"))continue;let[,s,o,i]=r.split(":");if(!s||o!=="no")continue;e.push({name:s,size:i||"?"})}return e}function Oh(t,e,n){let r=t.map((o)=>`  ${e}-${o.name} (${o.size})`).join(`
+import{at,oi,ai,ci}from"./chunk-w9jhyy09.js";function S(t){return t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function Jh(t,e="/var/www"){let n=`${e}/${t}-`;return["set -u",`for TS_CLOUD_DIR in ${n}*; do`,'  [ -d "$TS_CLOUD_DIR" ] || continue','  [ -d "$TS_CLOUD_DIR/releases" ] || continue',`  TS_CLOUD_SITE="\${TS_CLOUD_DIR#${n}}"`,"  TS_CLOUD_ACTIVE=no",`  for TS_CLOUD_UNIT in $(ls /etc/systemd/system/ 2>/dev/null | grep -E "^${S(t)}-$TS_CLOUD_SITE[-@.]" || true); do`,'    systemctl is-active "$TS_CLOUD_UNIT" >/dev/null 2>&1 && TS_CLOUD_ACTIVE=yes',"  done",'  TS_CLOUD_SIZE="$(du -sh "$TS_CLOUD_DIR" 2>/dev/null | cut -f1)"','  echo "site:$TS_CLOUD_SITE:$TS_CLOUD_ACTIVE:${TS_CLOUD_SIZE:-?}"',"done","exit 0"]}function Xh(t){if(!t)return[];let e=[];for(let n of t.split(`
+`)){let r=n.trim();if(!r.startsWith("site:"))continue;let[,s,o,i]=r.split(":");if(!s||o!=="no")continue;e.push({name:s,size:i||"?"})}return e}function Yh(t,e,n){let r=t.map((o)=>`  ${e}-${o.name} (${o.size})`).join(`
 `),s=t.length===1?"it":"them";return`This server still holds ${t.length} site tree${t.length===1?"":"s"} with nothing running for ${s}:
 ${r}
 `+"A site moved off this box keeps its files here on purpose — they are the rollback, and they are what makes "+`the move reversible until this server is destroyed. Destroying it now discards that.
-Verify the site is serving from its new home first, then re-run with ${n} to destroy it anyway.`}var ep="ts-cloud/project",tp="ts-cloud/environment",rp="ts-cloud/role";function d(t){return typeof t==="string"&&t.trim()?t.trim():void 0}function h(t){if(typeof t==="string")return d(t);if(t&&typeof t==="object")return d(t.name);return}function Lh(t){let e={};for(let[n,r]of Object.entries(t?.labels??{}))if(typeof r==="string")e[n]=r;return{id:String(t?.id??""),name:d(t?.name)??"(unnamed)",status:d(t?.status)??"unknown",ipv4:d(t?.public_net?.ipv4?.ip)??d(t?.ipv4),ipv6:d(t?.public_net?.ipv6?.ip)??d(t?.ipv6),type:d(t?.server_type?.name)??d(t?.type),location:h(t?.location)??h(t?.datacenter?.location)??h(t?.datacenter),labels:e,project:d(e[ep]),environment:d(e[tp]),role:d(e[rp])}}function w(t){return t.slug?.trim()||"app"}function np(t){let e=[];for(let n of t){let r=w(n);for(let s of n.proxies??[]){let o=d(s?.to);if(!o)continue;e.push({slug:r,host:o,path:d(s?.path)??"/",...x(s)})}}return e.sort((n,r)=>n.slug.localeCompare(r.slug)||n.host.localeCompare(r.host)||n.path.localeCompare(r.path))}function x(t){let e=t?.from;if(typeof e==="string"&&e.trim())return{target:e.trim(),kind:"app"};if(Array.isArray(e)&&e.length>0)return{target:e.filter((s)=>typeof s==="string").join(", "),kind:"app"};let n=t?.static;if(typeof n==="string"&&n.trim())return{target:n.trim(),kind:"static"};if(n&&typeof n==="object"&&d(n.dir))return{target:d(n.dir),kind:"static"};let r=typeof t?.redirect==="string"?d(t.redirect):d(t?.redirect?.to);if(r)return{target:r,kind:"redirect"};return{target:"(no upstream)",kind:"unknown"}}function ip(t){let e=new Map;for(let n of t){let r=e.get(n.slug);if(r)r.push(n);else e.set(n.slug,[n])}return[...e.entries()].map(([n,r])=>({slug:n,routes:r})).sort((n,r)=>r.routes.length-n.routes.length||n.slug.localeCompare(r.slug))}async function $h(t,e,n=ot){if(!t.ipv4)return{server:t.name,routes:[],unavailable:"no public IPv4 address to reach it on"};if(t.status!=="running")return{server:t.name,ip:t.ipv4,routes:[],unavailable:`server is ${t.status}`};try{let r=await e(t.ipv4,ii(n));if(r.code!==0){let s=r.stderr.trim().split(`
-`)[0]||`remote command exited ${r.code}`;return{server:t.name,ip:t.ipv4,routes:[],unavailable:s}}return{server:t.name,ip:t.ipv4,routes:np(si(r.stdout))}}catch(r){let s=r instanceof Error?r.message.split(`
-`)[0]:String(r);return{server:t.name,ip:t.ipv4,routes:[],unavailable:s}}}function u(t,e){let n=e==="/"?"/":e.replace(/\/+$/,"");return`${t.toLowerCase()}${n||"/"}`}function Mh(t,e,n){let r=new Set(e.filter((a)=>a.slug===n).map((a)=>u(a.host,a.path))),s=[],o=[],i=[];for(let a of t)if(a.loopbackOnly)i.push(a);else if(a.domain&&r.has(u(a.domain,a.path)))s.push(a);else o.push(a);return{present:s,absent:o,loopback:i,foreign:e.filter((a)=>a.slug!==n)}}function sp(t,e,n){let r=new Set;for(let s of e)for(let o of s.routes)if(o.slug===n)r.add(u(o.host,o.path));return t.filter((s)=>!s.loopbackOnly&&s.domain!==void 0&&!r.has(u(s.domain,s.path)))}function Fh(t){let{slug:e,servers:n,probes:r,declared:s}=t,o=[];if(o.push(n.length===0?"No servers found.":`${n.length} server${n.length===1?"":"s"}:`),n.length>0)o.push("");let i=new Map(r.map((a)=>[a.server,a]));for(let a of n){let p=[a.ipv4,a.type,a.location,a.status].filter(Boolean);o.push(`  ${a.name}  ${p.join("  ")}`),o.push(`    ${k(a)}`);let c=i.get(a.name);if(!c)o.push("    not probed, so co-tenants on this box are not listed");else if(c.unavailable)o.push(`    could not read ${ot}: ${c.unavailable}`);else o.push(...P(c,e));o.push("")}return o.push(...C(t)),o}function k(t){if(!t.project)return"no ts-cloud labels: provisioned outside ts-cloud, or by a version that did not label boxes";let e=[t.environment,t.role&&`role ${t.role}`].filter(Boolean).join(", ");return`owned by '${t.project}'${e?` (${e})`:""}`}function P(t,e){let n=ip(t.routes);if(n.length===0)return[`    serves nothing: ${ot} is empty or absent`];let r=[`    serves ${t.routes.length} route${t.routes.length===1?"":"s"} for ${n.length} project${n.length===1?"":"s"}:`];for(let s of n){r.push(`      ${s.slug}${s.slug===e?" (this project)":""}`);for(let o of s.routes)r.push(`        ${o.host}${o.path==="/"?"/":o.path}  ->  ${O(o)}`)}return r}function O(t){if(t.kind==="redirect")return`redirect to ${t.target}`;if(t.kind==="static")return`static ${t.target}`;return t.target}function C(t){let{slug:e,declared:n,probes:r,servers:s}=t;if(n.length===0)return[`This project ('${e}') declares no sites.`];let o=[`This project ('${e}') declares ${n.length} site${n.length===1?"":"s"}: `+n.map((c)=>c.name).join(", ")],i=n.filter((c)=>c.loopbackOnly);if(i.length>0)o.push(`  ${i.length} with no domain, so the gateway never routes ${i.length===1?"it":"them"} (reached through another site's proxy): ${i.map((c)=>c.name).join(", ")}`);let a=r.filter((c)=>!c.unavailable);if(a.length===0)return o.push("  Nothing to reconcile them against: no box reported what it serves."),o;let p=sp(n,a,e);if(o.push(`  ${n.length-i.length-p.length} routed by a box above`),p.length>0){o.push(`  ${p.length} not routed by any box above: ${p.map((b)=>b.name).join(", ")}`);let c=r.length-a.length,g=s.length-r.length;if(c>0)o.push(`    Either they were never deployed, or they are on one of the ${c} server${c===1?"":"s"} that could not be read.`);else if(g>0)o.push(`    Either they were never deployed, or they are on one of the ${g} server${g===1?"":"s"} this run did not probe.`);else o.push("    Either they were never deployed, or they are on a server this listing did not cover.")}return o}async function Uh(t){let e=[];for(let n of t.steps)try{e.push({step:n,state:await n.satisfied()?"satisfied":"pending"})}catch(r){e.push({step:n,state:"unknown",reason:r instanceof Error?r.message:String(r)})}return e}function vc(t){return t.filter((e)=>e.state!=="satisfied")}function op(t){return vc(t).some((e)=>e.step.destructive===!0)}function Qh(t,e){let n=vc(e),r=[`${t.operation} ${t.target}`];if(n.length===0)return r.push("  Nothing to do — every step is already satisfied."),r;for(let{step:o,state:i,reason:a}of e){let p=i==="satisfied"?"ok  ":i==="unknown"?"?   ":"→   ",c=[o.destructive?"DESTRUCTIVE":"",i==="satisfied"?"already done":""].filter(Boolean);if(r.push(`  ${p}${o.title}${c.length>0?` [${c.join(", ")}]`:""}`),o.change)r.push(`        ${o.change.from} → ${o.change.to}`);if(a)r.push(`        could not check: ${a}`)}let s=n.filter((o)=>o.step.destructive).length;return r.push(`  ${n.length} step(s) would run`+(s>0?`, ${s} irreversible — re-run with --confirm ${t.target}`:"")),r}async function Hh(t,e,n={}){let r={operation:t.operation,target:t.target,steps:[],success:!0};if(op(e)&&n.confirm!==t.target)throw Error(`${t.operation} includes an irreversible step. Re-run with --confirm ${t.target} to authorize it.`);for(let{step:s,state:o}of e){if(o==="satisfied"){r.steps.push({id:s.id,title:s.title,state:"skipped"}),n.log?.(`skip  ${s.title} (already done)`);continue}n.audit?.({operation:t.operation,target:t.target,step:s.id,state:"started"});try{await s.apply(),r.steps.push({id:s.id,title:s.title,state:"applied"}),n.log?.(`done  ${s.title}`),n.audit?.({operation:t.operation,target:t.target,step:s.id,state:"applied"})}catch(i){let a=i instanceof Error?i.message:String(i);return r.steps.push({id:s.id,title:s.title,state:"failed",error:a}),r.success=!1,n.log?.(`FAIL  ${s.title}: ${a}`),n.audit?.({operation:t.operation,target:t.target,step:s.id,state:"failed",error:a}),r}}return r}function ap(t){if(t.length===0)throw Error("A server name cannot be empty.");if(t.length>253)throw Error(`'${t}' is longer than the 253 characters a hostname allows.`);for(let e of t.split(".")){if(e.length===0)throw Error(`'${t}' has an empty label — a hostname cannot contain '..'.`);if(e.length>63)throw Error(`'${e}' is longer than the 63 characters a hostname label allows.`);if(!/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(e))throw Error(`'${e}' is not a valid hostname label. Use letters, digits and hyphens, not starting or ending with a hyphen.`)}}async function Gh(t,e,n){if(ap(e),t===e)throw Error(`'${t}' is already named that.`);if((await n.takenNames()).some((o)=>o===e&&o!==t))throw Error(`'${e}' is already taken. Server names have to be unique within a provider project.`);let s=[];if(n.providerName&&n.renameProvider){let{providerName:o,renameProvider:i}=n;s.push({id:"provider",title:"Rename the server at the provider",change:{from:t,to:e},satisfied:async()=>await o()===e,apply:()=>i(e)})}if(n.stateName&&n.writeStateName){let{stateName:o,writeStateName:i}=n;s.push({id:"state-pin",title:"Update the recorded name in the local driver state",change:{from:t,to:e},satisfied:async()=>{let a=await o();return a===void 0||a===e},apply:()=>i(e)})}if(n.remoteHostname&&n.setRemoteHostname){let{remoteHostname:o,setRemoteHostname:i}=n;s.push({id:"hostname",title:"Set the hostname on the box",change:{from:t,to:e},satisfied:async()=>await o()===e,apply:()=>i(e)})}return s.push({id:"inventory",title:"Rename the fleet inventory record",change:{from:t,to:e},satisfied:async()=>n.inventoryName()===e,apply:async()=>{await n.renameInventory(e)}}),{operation:"server:rename",target:t,steps:s}}function qh(t){let e=`'${t.replace(/'/g,`'"'"'`)}'`;return["set -eu",'TS_CLOUD_OLD="$(hostname)"',`hostnamectl set-hostname ${e} 2>/dev/null || { echo ${e} > /etc/hostname && hostname ${e}; }`,'if grep -q "^127.0.1.1" /etc/hosts; then',`  TS_CLOUD_HOSTS="$(sed -E "s/^127\\.0\\.1\\.1.*/127.0.1.1\\t${t}/" /etc/hosts)"`,`  printf '%s\\n' "$TS_CLOUD_HOSTS" > /etc/hosts`,"else",`  printf '127.0.1.1\\t%s\\n' ${e} >> /etc/hosts`,"fi",'printf "%s -> %s\\n" "$TS_CLOUD_OLD" "$(hostname)"'].join(`
-`)}function Vh(t,e,n){let r=e.trim();if(!r)return{problem:"No server named."};let[s,...o]=t.filter((c)=>c.name===r);if(s&&o.length===0)return{server:s};let i=t.filter((c)=>c.project===r);if(i.length>1&&n)i=i.filter((c)=>!c.environment||c.environment===n);let[a,...p]=i;if(a&&p.length===0)return{server:a};if(i.length>1)return{problem:`'${r}' owns ${i.length} servers (${i.map((c)=>c.name).join(", ")}). Name one of them, or narrow it by environment.`};return{problem:`No server matched '${r}'. Nothing is named that, and no box carries the label ts-cloud/project=${r}.`}}function jh(t,e){let n=[];if(!e.project)n.push(`'${e.name}' carries no ts-cloud/project label, so it is not a box ts-cloud provisioned. Attaching to it would deploy into a host nothing manages.`);else if(e.project===t)n.push(`This project's slug is '${t}', which is also the slug that owns '${e.name}'. A tenant deploy owns the gateway fragment named after its slug, so attaching would overwrite '${e.project}'s own fragment and take its sites down. Change this project's slug first.`);if(e.status!=="running")n.push(`'${e.name}' is ${e.status}, so what it serves could not be read.`);if(!e.ipv4)n.push(`'${e.name}' has no public IPv4 address, so it cannot be reached to check what it serves.`);return n}function f(t,e){let n=e==="/"?"/":e.replace(/\/+$/,"");return`${t.toLowerCase()}${n||"/"}`}function zh(t,e,n){let r=[],s=ni(n.filter((i)=>i.kind==="app").map((i)=>({slug:i.slug,proxies:[{from:i.target.split(",").map((a)=>a.trim())}]})),{ignoreSlug:t}),o=new Map;for(let i of n)if(i.slug!==t)o.set(f(i.host,i.path),i.slug);for(let i of e){if(i.port!==void 0){let a=s.get(i.port);if(a)r.push({kind:"port",site:i.name,detail:`port ${i.port}`,heldBy:a})}if(i.domain){let a=o.get(f(i.domain,i.path));if(a)r.push({kind:"route",site:i.name,detail:`${i.domain}${i.path==="/"?"/":i.path}`,heldBy:a})}}return r}function Kh(t){return t.registryRead&&t.conflicts.length===0}function Wh(t){let{slug:e,owner:n,server:r,declared:s,conflicts:o}=t,i=[];i.push(`Attach '${e}' to '${r.name}' (${r.ipv4??"no IPv4"}), owned by '${n}'.`,""),i.push(`  ${s.length} site${s.length===1?"":"s"} would deploy onto this box:`);for(let a of s){let p=a.loopbackOnly?`loopback only${a.port?` on :${a.port}`:""}`:`${a.domain}${a.path==="/"?"/":a.path}${a.port?` on :${a.port}`:""}`;i.push(`    ${a.name}  ${p}  ->  ${a.installBase??"(install path unresolved)"}`)}if(i.push(""),!t.registryRead)i.push(`  Could not read what '${r.name}' already serves: ${t.registryProblem??"unknown reason"}`),i.push("  So this attach is UNCHECKED: a port or hostname already taken by another"),i.push("  project would not error, it would serve that project's site from your domain.");else if(o.length>0){i.push(`  ${o.length} conflict${o.length===1?"":"s"} with what the box already serves:`);for(let a of o)i.push(`    site '${a.site}' wants ${a.detail}, held by '${a.heldBy}'`);i.push(""),i.push("  Two services on one port do not error: the kernel load-balances, and each"),i.push("  domain serves the other's site about half the time. Pick free ports and"),i.push("  hostnames, then re-run.")}else i.push(`  No conflicts with what '${r.name}' already serves.`);return i}function ri(t,e){return`/tmp/ts-cloud-move-${t}-${e}.tar.gz`}function Tc(t,e){return`${t}-${e}*.service`}function l(t){return`'${t.split("'").join("'\\''")}'`}function cp(t,e){return["set -eu",`for unit in $(ls /etc/systemd/system/ 2>/dev/null | grep -E ${l(m(t,e))} || true); do`,'  systemctl stop "$unit" 2>/dev/null || true',"done"].join(`
-`)}function m(t,e){return`^${t}-${e}-((queue|daemon)-.*|scheduler)\\.service$`}function dp(t,e){return y(m(t,e))}function y(t){return[`ls /etc/systemd/system/ 2>/dev/null | grep -E ${l(t)} | while read -r unit; do`,'  systemctl is-active "$unit" >/dev/null 2>&1 && echo "active:$unit" || true',"done"].join(`
-`)}function lp(t){return!t.split(`
-`).some((e)=>e.trim().startsWith("active:"))}function up(t,e,n){let r=ri(t,e);return["set -eu",`test -d ${l(n)} || { echo "no site tree at ${n}" >&2; exit 1; }`,`rm -f ${l(r)}`,`tar czf ${l(r)} -C "$(dirname ${l(n)})" "$(basename ${l(n)})" -C /etc/systemd/system $(cd /etc/systemd/system && ls ${Tc(t,e)} 2>/dev/null | tr '\\n' ' ')`,`sha256sum ${l(r)} | cut -d' ' -f1`].join(`
-`)}function pp(t,e,n){let r=ri(t,e);return["set -eu",`test -f ${l(r)} || { echo "archive not staged at ${r}" >&2; exit 1; }`,`mkdir -p "$(dirname ${l(n)})"`,`tar xzf ${l(r)} -C "$(dirname ${l(n)})" "$(basename ${l(n)})"`,`tar xzf ${l(r)} -C /etc/systemd/system --wildcards ${l(Tc(t,e))} 2>/dev/null || true`,"systemctl daemon-reload",`systemctl enable ${t}-${e}.service 2>/dev/null || true`,`systemctl restart ${t}-${e}.service`,`rm -f ${l(r)}`].join(`
-`)}function gp(t,e,n){return[`test -d ${l(n)} && echo tree:present || echo tree:absent`,`systemctl is-active ${t}-${e}.service >/dev/null 2>&1 && echo unit:active || echo unit:inactive`].join(`
-`)}function mp(t){return t.includes("tree:present")&&t.includes("unit:active")}function hp(t,e="/",n=10){let r=`http://127.0.0.1:${t}${e.startsWith("/")?e:`/${e}`}`;return["set -eu",`for i in $(seq 1 ${n}); do`,`  if curl -fsS -o /dev/null --max-time 5 ${l(r)}; then echo healthy; exit 0; fi`,"  sleep 3","done",`echo "no healthy response from ${r}" >&2`,"exit 1"].join(`
-`)}function fp(t,e){return["set -eu",`for unit in $(ls /etc/systemd/system/ 2>/dev/null | grep -E ${l(v(t,e))} || true); do`,'  systemctl disable --now "$unit" 2>/dev/null || true',"done",`rm -f /etc/rpx/sites.d/${t}.json 2>/dev/null || true`,"systemctl reload rpx-gateway.service 2>/dev/null || systemctl restart rpx-gateway.service 2>/dev/null || true"].join(`
-`)}function v(t,e){return`^${t}-${e}[-@.]`}function Ap(t,e){return y(v(t,e))}function yp(t){return!t.split(`
-`).some((e)=>e.trim().startsWith("active:"))}function Jh(t,e){return`/tmp/ts-cloud-move-${t}-${e}-certs.tar.gz`}function Xh(t,e){return["set -u",...e.map((n)=>`if [ -s ${l(`${t}/${n}.crt`)} ]; then echo "cert:${n}:$(sha256sum ${l(`${t}/${n}.crt`)} | cut -d' ' -f1)"; else echo "cert:${n}:absent"; fi`)].join(`
-`)}function Yh(t){let e=new Map;for(let n of t.split(`
-`)){let r=n.trim();if(!r.startsWith("cert:"))continue;let[,s,o]=r.split(":");if(s&&o)e.set(s,o)}return e}function Zh(t,e){for(let[n,r]of t){if(r==="absent")continue;if(e.get(n)!==r)return!1}return!0}function ef(t,e,n){let r=e.flatMap((s)=>[`${s}.crt`,`${s}.key`]);return["set -eu",`rm -f ${l(n)}`,`cd ${l(t)} 2>/dev/null || { echo "no certs dir at ${t}" >&2; exit 0; }`,`TS_CLOUD_CERTS="$(ls ${r.map(l).join(" ")} 2>/dev/null | tr '\\n' ' ' || true)"`,'[ -n "$TS_CLOUD_CERTS" ] || { echo "no certificates to carry"; exit 0; }',`tar czf ${l(n)} $TS_CLOUD_CERTS`].join(`
-`)}function tf(t,e){return["set -eu",`[ -s ${l(e)} ] || { echo "no certificate archive staged"; exit 0; }`,`mkdir -p ${l(t)}`,`tar xzf ${l(e)} -C ${l(t)}`,`chmod 600 ${l(t)}/*.key 2>/dev/null || true`,`rm -f ${l(e)}`].join(`
-`)}async function rf(t,e){let{slug:n,siteName:r,appBase:s,from:o,to:i,targetAddress:a}=t;if(o===i)throw Error(`'${r}' is already on ${i}.`);if(t.database&&!e.database)throw Error(`'${r}' uses the on-box database '${t.database.name}', which lives in the engine's own data directory rather than in the site tree, and this move has no way to carry it. Moving the site without it would cut traffic over to an empty database.`);if(t.database&&e.database&&await e.database.targetHasData())throw Error(`${i} already has a database named '${t.database.name}' with tables in it. Restoring this site's dump over it would destroy that data. Rename or drop it on the target first, or point this project at a different database name.`);let p=[{id:"pause-workers",title:`Stop background work on ${o} so the snapshot is consistent`,satisfied:async()=>lp(await e.runOnSource(dp(n,r))),apply:async()=>{await e.runOnSource(cp(n,r))}},...e.database?[{id:"database-dump",title:`Dump the '${t.database?.name}' database on ${o}`,satisfied:async()=>!1,apply:()=>e.database.dump()}]:[],{id:"snapshot",title:`Archive the site's tree and units on ${o}`,change:{from:`${o}:${s}`,to:ri(n,r)},satisfied:async()=>!1,apply:async()=>{await e.runOnSource(up(n,r,s))}},{id:"transfer",title:`Carry the archive to ${i}`,change:{from:o,to:i},satisfied:()=>e.archiveStaged(),apply:()=>e.transferArchive()},...e.database?[{id:"database-transfer",title:`Carry the database dump to ${i}`,change:{from:o,to:i},satisfied:()=>e.database.dumpStaged(),apply:()=>e.database.transferDump()},{id:"database-restore",title:`Create and load '${t.database?.name}' on ${i}`,satisfied:async()=>!1,apply:()=>e.database.restore()}]:[],{id:"restore",title:`Unpack the site on ${i} and start it`,change:{from:ri(n,r),to:`${i}:${s}`},satisfied:async()=>mp(await e.runOnTarget(gp(n,r,s))),apply:async()=>{await e.runOnTarget(pp(n,r,s))}}];if(t.port!=null){let{port:c}=t;p.push({id:"health",title:`Wait for the site to answer on ${i} (127.0.0.1:${c})`,satisfied:async()=>!1,apply:async()=>{await e.runOnTarget(hp(c,t.healthCheckPath??"/"))}})}return p.push(...e.certificates?[{id:"certificates",title:`Carry the site's TLS material to ${i}`,satisfied:()=>e.certificates.inPlace(),apply:()=>e.certificates.carry()}]:[],{id:"gateway",title:`Route the site on ${i}`,satisfied:()=>e.targetRoutesSite(),apply:()=>e.refreshTargetGateway()},{id:"dns",title:`Point DNS at ${i}`,change:{from:`${o}`,to:a},satisfied:async()=>await e.publishedAddress()===a,apply:async()=>{let c=await e.cutoverDns();if(c.length>0)throw Error(c.join("; "))}},{id:"drain-source",title:`Stop the site on ${o}, leaving its files in place`,satisfied:async()=>yp(await e.runOnSource(Ap(n,r))),apply:async()=>{await e.runOnSource(fp(n,r))}}),{operation:"site:move",target:r,steps:p}}export{_h,xh,Oh,ep,tp,rp,Lh,np,ip,$h,Mh,sp,Fh,Uh,vc,op,Qh,Hh,ap,Gh,qh,Vh,jh,zh,Kh,Wh,ri,Tc,cp,dp,lp,up,pp,gp,mp,hp,fp,Ap,yp,Jh,Xh,Yh,Zh,ef,tf,rf};
+Verify the site is serving from its new home first, then re-run with ${n} to destroy it anyway.`}var lp="ts-cloud/project",up="ts-cloud/environment",pp="ts-cloud/role";function d(t){return typeof t==="string"&&t.trim()?t.trim():void 0}function h(t){if(typeof t==="string")return d(t);if(t&&typeof t==="object")return d(t.name);return}function Zh(t){let e={};for(let[n,r]of Object.entries(t?.labels??{}))if(typeof r==="string")e[n]=r;return{id:String(t?.id??""),name:d(t?.name)??"(unnamed)",status:d(t?.status)??"unknown",ipv4:d(t?.public_net?.ipv4?.ip)??d(t?.ipv4),ipv6:d(t?.public_net?.ipv6?.ip)??d(t?.ipv6),type:d(t?.server_type?.name)??d(t?.type),location:h(t?.location)??h(t?.datacenter?.location)??h(t?.datacenter),labels:e,project:d(e[lp]),environment:d(e[up]),role:d(e[pp])}}function w(t){return t.slug?.trim()||"app"}function gp(t){let e=[];for(let n of t){let r=w(n);for(let s of n.proxies??[]){let o=d(s?.to);if(!o)continue;e.push({slug:r,host:o,path:d(s?.path)??"/",...x(s)})}}return e.sort((n,r)=>n.slug.localeCompare(r.slug)||n.host.localeCompare(r.host)||n.path.localeCompare(r.path))}function x(t){let e=t?.from;if(typeof e==="string"&&e.trim())return{target:e.trim(),kind:"app"};if(Array.isArray(e)&&e.length>0)return{target:e.filter((s)=>typeof s==="string").join(", "),kind:"app"};let n=t?.static;if(typeof n==="string"&&n.trim())return{target:n.trim(),kind:"static"};if(n&&typeof n==="object"&&d(n.dir))return{target:d(n.dir),kind:"static"};let r=typeof t?.redirect==="string"?d(t.redirect):d(t?.redirect?.to);if(r)return{target:r,kind:"redirect"};return{target:"(no upstream)",kind:"unknown"}}function mp(t){let e=new Map;for(let n of t){let r=e.get(n.slug);if(r)r.push(n);else e.set(n.slug,[n])}return[...e.entries()].map(([n,r])=>({slug:n,routes:r})).sort((n,r)=>r.routes.length-n.routes.length||n.slug.localeCompare(r.slug))}async function ef(t,e,n=at){if(!t.ipv4)return{server:t.name,routes:[],unavailable:"no public IPv4 address to reach it on"};if(t.status!=="running")return{server:t.name,ip:t.ipv4,routes:[],unavailable:`server is ${t.status}`};try{let r=await e(t.ipv4,ai(n));if(r.code!==0){let s=r.stderr.trim().split(`
+`)[0]||`remote command exited ${r.code}`;return{server:t.name,ip:t.ipv4,routes:[],unavailable:s}}return{server:t.name,ip:t.ipv4,routes:gp(ci(r.stdout))}}catch(r){let s=r instanceof Error?r.message.split(`
+`)[0]:String(r);return{server:t.name,ip:t.ipv4,routes:[],unavailable:s}}}function u(t,e){let n=e==="/"?"/":e.replace(/\/+$/,"");return`${t.toLowerCase()}${n||"/"}`}function tf(t,e,n){let r=new Set(e.filter((a)=>a.slug===n).map((a)=>u(a.host,a.path))),s=[],o=[],i=[];for(let a of t)if(a.loopbackOnly)i.push(a);else if(a.domain&&r.has(u(a.domain,a.path)))s.push(a);else o.push(a);return{present:s,absent:o,loopback:i,foreign:e.filter((a)=>a.slug!==n)}}function hp(t,e,n){let r=new Set;for(let s of e)for(let o of s.routes)if(o.slug===n)r.add(u(o.host,o.path));return t.filter((s)=>!s.loopbackOnly&&s.domain!==void 0&&!r.has(u(s.domain,s.path)))}function rf(t){let{slug:e,servers:n,probes:r,declared:s}=t,o=[];if(o.push(n.length===0?"No servers found.":`${n.length} server${n.length===1?"":"s"}:`),n.length>0)o.push("");let i=new Map(r.map((a)=>[a.server,a]));for(let a of n){let p=[a.ipv4,a.type,a.location,a.status].filter(Boolean);o.push(`  ${a.name}  ${p.join("  ")}`),o.push(`    ${k(a)}`);let c=i.get(a.name);if(!c)o.push("    not probed, so co-tenants on this box are not listed");else if(c.unavailable)o.push(`    could not read ${at}: ${c.unavailable}`);else o.push(...P(c,e));o.push("")}return o.push(...C(t)),o}function k(t){if(!t.project)return"no ts-cloud labels: provisioned outside ts-cloud, or by a version that did not label boxes";let e=[t.environment,t.role&&`role ${t.role}`].filter(Boolean).join(", ");return`owned by '${t.project}'${e?` (${e})`:""}`}function P(t,e){let n=mp(t.routes);if(n.length===0)return[`    serves nothing: ${at} is empty or absent`];let r=[`    serves ${t.routes.length} route${t.routes.length===1?"":"s"} for ${n.length} project${n.length===1?"":"s"}:`];for(let s of n){r.push(`      ${s.slug}${s.slug===e?" (this project)":""}`);for(let o of s.routes)r.push(`        ${o.host}${o.path==="/"?"/":o.path}  ->  ${O(o)}`)}return r}function O(t){if(t.kind==="redirect")return`redirect to ${t.target}`;if(t.kind==="static")return`static ${t.target}`;return t.target}function C(t){let{slug:e,declared:n,probes:r,servers:s}=t;if(n.length===0)return[`This project ('${e}') declares no sites.`];let o=[`This project ('${e}') declares ${n.length} site${n.length===1?"":"s"}: `+n.map((c)=>c.name).join(", ")],i=n.filter((c)=>c.loopbackOnly);if(i.length>0)o.push(`  ${i.length} with no domain, so the gateway never routes ${i.length===1?"it":"them"} (reached through another site's proxy): ${i.map((c)=>c.name).join(", ")}`);let a=r.filter((c)=>!c.unavailable);if(a.length===0)return o.push("  Nothing to reconcile them against: no box reported what it serves."),o;let p=hp(n,a,e);if(o.push(`  ${n.length-i.length-p.length} routed by a box above`),p.length>0){o.push(`  ${p.length} not routed by any box above: ${p.map((b)=>b.name).join(", ")}`);let c=r.length-a.length,g=s.length-r.length;if(c>0)o.push(`    Either they were never deployed, or they are on one of the ${c} server${c===1?"":"s"} that could not be read.`);else if(g>0)o.push(`    Either they were never deployed, or they are on one of the ${g} server${g===1?"":"s"} this run did not probe.`);else o.push("    Either they were never deployed, or they are on a server this listing did not cover.")}return o}async function nf(t){let e=[];for(let n of t.steps)try{e.push({step:n,state:await n.satisfied()?"satisfied":"pending"})}catch(r){e.push({step:n,state:"unknown",reason:r instanceof Error?r.message:String(r)})}return e}function Rc(t){return t.filter((e)=>e.state!=="satisfied")}function fp(t){return Rc(t).some((e)=>e.step.destructive===!0)}function sf(t,e){let n=Rc(e),r=[`${t.operation} ${t.target}`];if(n.length===0)return r.push("  Nothing to do — every step is already satisfied."),r;for(let{step:o,state:i,reason:a}of e){let p=i==="satisfied"?"ok  ":i==="unknown"?"?   ":"→   ",c=[o.destructive?"DESTRUCTIVE":"",i==="satisfied"?"already done":""].filter(Boolean);if(r.push(`  ${p}${o.title}${c.length>0?` [${c.join(", ")}]`:""}`),o.change)r.push(`        ${o.change.from} → ${o.change.to}`);if(a)r.push(`        could not check: ${a}`)}let s=n.filter((o)=>o.step.destructive).length;return r.push(`  ${n.length} step(s) would run`+(s>0?`, ${s} irreversible — re-run with --confirm ${t.target}`:"")),r}async function of(t,e,n={}){let r={operation:t.operation,target:t.target,steps:[],success:!0};if(fp(e)&&n.confirm!==t.target)throw Error(`${t.operation} includes an irreversible step. Re-run with --confirm ${t.target} to authorize it.`);for(let{step:s,state:o}of e){if(o==="satisfied"){r.steps.push({id:s.id,title:s.title,state:"skipped"}),n.log?.(`skip  ${s.title} (already done)`);continue}n.audit?.({operation:t.operation,target:t.target,step:s.id,state:"started"});try{await s.apply(),r.steps.push({id:s.id,title:s.title,state:"applied"}),n.log?.(`done  ${s.title}`),n.audit?.({operation:t.operation,target:t.target,step:s.id,state:"applied"})}catch(i){let a=i instanceof Error?i.message:String(i);return r.steps.push({id:s.id,title:s.title,state:"failed",error:a}),r.success=!1,n.log?.(`FAIL  ${s.title}: ${a}`),n.audit?.({operation:t.operation,target:t.target,step:s.id,state:"failed",error:a}),r}}return r}function Ap(t){if(t.length===0)throw Error("A server name cannot be empty.");if(t.length>253)throw Error(`'${t}' is longer than the 253 characters a hostname allows.`);for(let e of t.split(".")){if(e.length===0)throw Error(`'${t}' has an empty label — a hostname cannot contain '..'.`);if(e.length>63)throw Error(`'${e}' is longer than the 63 characters a hostname label allows.`);if(!/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(e))throw Error(`'${e}' is not a valid hostname label. Use letters, digits and hyphens, not starting or ending with a hyphen.`)}}async function af(t,e,n){if(Ap(e),t===e)throw Error(`'${t}' is already named that.`);if((await n.takenNames()).some((o)=>o===e&&o!==t))throw Error(`'${e}' is already taken. Server names have to be unique within a provider project.`);let s=[];if(n.providerName&&n.renameProvider){let{providerName:o,renameProvider:i}=n;s.push({id:"provider",title:"Rename the server at the provider",change:{from:t,to:e},satisfied:async()=>await o()===e,apply:()=>i(e)})}if(n.stateName&&n.writeStateName){let{stateName:o,writeStateName:i}=n;s.push({id:"state-pin",title:"Update the recorded name in the local driver state",change:{from:t,to:e},satisfied:async()=>{let a=await o();return a===void 0||a===e},apply:()=>i(e)})}if(n.remoteHostname&&n.setRemoteHostname){let{remoteHostname:o,setRemoteHostname:i}=n;s.push({id:"hostname",title:"Set the hostname on the box",change:{from:t,to:e},satisfied:async()=>await o()===e,apply:()=>i(e)})}return s.push({id:"inventory",title:"Rename the fleet inventory record",change:{from:t,to:e},satisfied:async()=>n.inventoryName()===e,apply:async()=>{await n.renameInventory(e)}}),{operation:"server:rename",target:t,steps:s}}function cf(t){let e=`'${t.replace(/'/g,`'"'"'`)}'`;return["set -eu",'TS_CLOUD_OLD="$(hostname)"',`hostnamectl set-hostname ${e} 2>/dev/null || { echo ${e} > /etc/hostname && hostname ${e}; }`,'if grep -q "^127.0.1.1" /etc/hosts; then',`  TS_CLOUD_HOSTS="$(sed -E "s/^127\\.0\\.1\\.1.*/127.0.1.1\\t${t}/" /etc/hosts)"`,`  printf '%s\\n' "$TS_CLOUD_HOSTS" > /etc/hosts`,"else",`  printf '127.0.1.1\\t%s\\n' ${e} >> /etc/hosts`,"fi",'printf "%s -> %s\\n" "$TS_CLOUD_OLD" "$(hostname)"'].join(`
+`)}function df(t,e,n){let r=e.trim();if(!r)return{problem:"No server named."};let[s,...o]=t.filter((c)=>c.name===r);if(s&&o.length===0)return{server:s};let i=t.filter((c)=>c.project===r);if(i.length>1&&n)i=i.filter((c)=>!c.environment||c.environment===n);let[a,...p]=i;if(a&&p.length===0)return{server:a};if(i.length>1)return{problem:`'${r}' owns ${i.length} servers (${i.map((c)=>c.name).join(", ")}). Name one of them, or narrow it by environment.`};return{problem:`No server matched '${r}'. Nothing is named that, and no box carries the label ts-cloud/project=${r}.`}}function lf(t,e){let n=[];if(!e.project)n.push(`'${e.name}' carries no ts-cloud/project label, so it is not a box ts-cloud provisioned. Attaching to it would deploy into a host nothing manages.`);else if(e.project===t)n.push(`This project's slug is '${t}', which is also the slug that owns '${e.name}'. A tenant deploy owns the gateway fragment named after its slug, so attaching would overwrite '${e.project}'s own fragment and take its sites down. Change this project's slug first.`);if(e.status!=="running")n.push(`'${e.name}' is ${e.status}, so what it serves could not be read.`);if(!e.ipv4)n.push(`'${e.name}' has no public IPv4 address, so it cannot be reached to check what it serves.`);return n}function f(t,e){let n=e==="/"?"/":e.replace(/\/+$/,"");return`${t.toLowerCase()}${n||"/"}`}function uf(t,e,n){let r=[],s=oi(n.filter((i)=>i.kind==="app").map((i)=>({slug:i.slug,proxies:[{from:i.target.split(",").map((a)=>a.trim())}]})),{ignoreSlug:t}),o=new Map;for(let i of n)if(i.slug!==t)o.set(f(i.host,i.path),i.slug);for(let i of e){if(i.port!==void 0){let a=s.get(i.port);if(a)r.push({kind:"port",site:i.name,detail:`port ${i.port}`,heldBy:a})}if(i.domain){let a=o.get(f(i.domain,i.path));if(a)r.push({kind:"route",site:i.name,detail:`${i.domain}${i.path==="/"?"/":i.path}`,heldBy:a})}}return r}function pf(t){return t.registryRead&&t.conflicts.length===0}function gf(t){let{slug:e,owner:n,server:r,declared:s,conflicts:o}=t,i=[];i.push(`Attach '${e}' to '${r.name}' (${r.ipv4??"no IPv4"}), owned by '${n}'.`,""),i.push(`  ${s.length} site${s.length===1?"":"s"} would deploy onto this box:`);for(let a of s){let p=a.loopbackOnly?`loopback only${a.port?` on :${a.port}`:""}`:`${a.domain}${a.path==="/"?"/":a.path}${a.port?` on :${a.port}`:""}`;i.push(`    ${a.name}  ${p}  ->  ${a.installBase??"(install path unresolved)"}`)}if(i.push(""),!t.registryRead)i.push(`  Could not read what '${r.name}' already serves: ${t.registryProblem??"unknown reason"}`),i.push("  So this attach is UNCHECKED: a port or hostname already taken by another"),i.push("  project would not error, it would serve that project's site from your domain.");else if(o.length>0){i.push(`  ${o.length} conflict${o.length===1?"":"s"} with what the box already serves:`);for(let a of o)i.push(`    site '${a.site}' wants ${a.detail}, held by '${a.heldBy}'`);i.push(""),i.push("  Two services on one port do not error: the kernel load-balances, and each"),i.push("  domain serves the other's site about half the time. Pick free ports and"),i.push("  hostnames, then re-run.")}else i.push(`  No conflicts with what '${r.name}' already serves.`);return i}function si(t,e){return`/tmp/ts-cloud-move-${t}-${e}.tar.gz`}function Dc(t,e){return`${t}-${e}*.service`}function l(t){return`'${t.split("'").join("'\\''")}'`}function yp(t,e){return["set -eu",`for unit in $(ls /etc/systemd/system/ 2>/dev/null | grep -E ${l(m(t,e))} || true); do`,'  systemctl stop "$unit" 2>/dev/null || true',"done"].join(`
+`)}function m(t,e){return`^${t}-${e}-((queue|daemon)-.*|scheduler)\\.service$`}function Ip(t,e){return y(m(t,e))}function y(t){return[`ls /etc/systemd/system/ 2>/dev/null | grep -E ${l(t)} | while read -r unit; do`,'  systemctl is-active "$unit" >/dev/null 2>&1 && echo "active:$unit" || true',"done"].join(`
+`)}function Sp(t){return!t.split(`
+`).some((e)=>e.trim().startsWith("active:"))}function Cp(t,e,n){let r=si(t,e);return["set -eu",`test -d ${l(n)} || { echo "no site tree at ${n}" >&2; exit 1; }`,`rm -f ${l(r)}`,`tar czf ${l(r)} -C "$(dirname ${l(n)})" "$(basename ${l(n)})" -C /etc/systemd/system $(cd /etc/systemd/system && ls ${Dc(t,e)} 2>/dev/null | tr '\\n' ' ')`,`sha256sum ${l(r)} | cut -d' ' -f1`].join(`
+`)}function Ep(t,e,n){let r=si(t,e);return["set -eu",`test -f ${l(r)} || { echo "archive not staged at ${r}" >&2; exit 1; }`,`mkdir -p "$(dirname ${l(n)})"`,`tar xzf ${l(r)} -C "$(dirname ${l(n)})" "$(basename ${l(n)})"`,`tar xzf ${l(r)} -C /etc/systemd/system --wildcards ${l(Dc(t,e))} 2>/dev/null || true`,"systemctl daemon-reload",`systemctl enable ${t}-${e}.service 2>/dev/null || true`,`systemctl restart ${t}-${e}.service`,`rm -f ${l(r)}`].join(`
+`)}function bp(t,e,n){return[`test -d ${l(n)} && echo tree:present || echo tree:absent`,`systemctl is-active ${t}-${e}.service >/dev/null 2>&1 && echo unit:active || echo unit:inactive`].join(`
+`)}function vp(t){return t.includes("tree:present")&&t.includes("unit:active")}function Tp(t,e="/",n=10){let r=`http://127.0.0.1:${t}${e.startsWith("/")?e:`/${e}`}`;return["set -eu",`for i in $(seq 1 ${n}); do`,`  if curl -fsS -o /dev/null --max-time 5 ${l(r)}; then echo healthy; exit 0; fi`,"  sleep 3","done",`echo "no healthy response from ${r}" >&2`,"exit 1"].join(`
+`)}function wp(t,e){return["set -eu",`for unit in $(ls /etc/systemd/system/ 2>/dev/null | grep -E ${l(v(t,e))} || true); do`,'  systemctl disable --now "$unit" 2>/dev/null || true',"done",`rm -f /etc/rpx/sites.d/${t}.json 2>/dev/null || true`,"systemctl reload rpx-gateway.service 2>/dev/null || systemctl restart rpx-gateway.service 2>/dev/null || true"].join(`
+`)}function v(t,e){return`^${t}-${e}[-@.]`}function Rp(t,e){return y(v(t,e))}function Dp(t){return!t.split(`
+`).some((e)=>e.trim().startsWith("active:"))}function mf(t,e){return`/tmp/ts-cloud-move-${t}-${e}-certs.tar.gz`}function hf(t,e){return["set -u",...e.map((n)=>`if [ -s ${l(`${t}/${n}.crt`)} ]; then echo "cert:${n}:$(sha256sum ${l(`${t}/${n}.crt`)} | cut -d' ' -f1)"; else echo "cert:${n}:absent"; fi`)].join(`
+`)}function ff(t){let e=new Map;for(let n of t.split(`
+`)){let r=n.trim();if(!r.startsWith("cert:"))continue;let[,s,o]=r.split(":");if(s&&o)e.set(s,o)}return e}function Af(t,e){for(let[n,r]of t){if(r==="absent")continue;if(e.get(n)!==r)return!1}return!0}function yf(t,e,n){let r=e.flatMap((s)=>[`${s}.crt`,`${s}.key`]);return["set -eu",`rm -f ${l(n)}`,`cd ${l(t)} 2>/dev/null || { echo "no certs dir at ${t}" >&2; exit 0; }`,`TS_CLOUD_CERTS="$(ls ${r.map(l).join(" ")} 2>/dev/null | tr '\\n' ' ' || true)"`,'[ -n "$TS_CLOUD_CERTS" ] || { echo "no certificates to carry"; exit 0; }',`tar czf ${l(n)} $TS_CLOUD_CERTS`].join(`
+`)}function If(t,e){return["set -eu",`[ -s ${l(e)} ] || { echo "no certificate archive staged"; exit 0; }`,`mkdir -p ${l(t)}`,`tar xzf ${l(e)} -C ${l(t)}`,`chmod 600 ${l(t)}/*.key 2>/dev/null || true`,`rm -f ${l(e)}`].join(`
+`)}async function Sf(t,e){let{slug:n,siteName:r,appBase:s,from:o,to:i,targetAddress:a}=t;if(o===i)throw Error(`'${r}' is already on ${i}.`);if(t.database&&!e.database)throw Error(`'${r}' uses the on-box database '${t.database.name}', which lives in the engine's own data directory rather than in the site tree, and this move has no way to carry it. Moving the site without it would cut traffic over to an empty database.`);if(t.database&&e.database&&await e.database.targetHasData())throw Error(`${i} already has a database named '${t.database.name}' with tables in it. Restoring this site's dump over it would destroy that data. Rename or drop it on the target first, or point this project at a different database name.`);let p=[{id:"pause-workers",title:`Stop background work on ${o} so the snapshot is consistent`,satisfied:async()=>Sp(await e.runOnSource(Ip(n,r))),apply:async()=>{await e.runOnSource(yp(n,r))}},...e.database?[{id:"database-dump",title:`Dump the '${t.database?.name}' database on ${o}`,satisfied:async()=>!1,apply:()=>e.database.dump()}]:[],{id:"snapshot",title:`Archive the site's tree and units on ${o}`,change:{from:`${o}:${s}`,to:si(n,r)},satisfied:async()=>!1,apply:async()=>{await e.runOnSource(Cp(n,r,s))}},{id:"transfer",title:`Carry the archive to ${i}`,change:{from:o,to:i},satisfied:()=>e.archiveStaged(),apply:()=>e.transferArchive()},...e.database?[{id:"database-transfer",title:`Carry the database dump to ${i}`,change:{from:o,to:i},satisfied:()=>e.database.dumpStaged(),apply:()=>e.database.transferDump()},{id:"database-restore",title:`Create and load '${t.database?.name}' on ${i}`,satisfied:async()=>!1,apply:()=>e.database.restore()}]:[],{id:"restore",title:`Unpack the site on ${i} and start it`,change:{from:si(n,r),to:`${i}:${s}`},satisfied:async()=>vp(await e.runOnTarget(bp(n,r,s))),apply:async()=>{await e.runOnTarget(Ep(n,r,s))}}];if(t.port!=null){let{port:c}=t;p.push({id:"health",title:`Wait for the site to answer on ${i} (127.0.0.1:${c})`,satisfied:async()=>!1,apply:async()=>{await e.runOnTarget(Tp(c,t.healthCheckPath??"/"))}})}return p.push(...e.certificates?[{id:"certificates",title:`Carry the site's TLS material to ${i}`,satisfied:()=>e.certificates.inPlace(),apply:()=>e.certificates.carry()}]:[],{id:"gateway",title:`Route the site on ${i}`,satisfied:()=>e.targetRoutesSite(),apply:()=>e.refreshTargetGateway()},{id:"dns",title:`Point DNS at ${i}`,change:{from:`${o}`,to:a},satisfied:async()=>await e.publishedAddress()===a,apply:async()=>{let c=await e.cutoverDns();if(c.length>0)throw Error(c.join("; "))}},{id:"drain-source",title:`Stop the site on ${o}, leaving its files in place`,satisfied:async()=>Dp(await e.runOnSource(Rp(n,r))),apply:async()=>{await e.runOnSource(wp(n,r))}}),{operation:"site:move",target:r,steps:p}}export{Jh,Xh,Yh,lp,up,pp,Zh,gp,mp,ef,tf,hp,rf,nf,Rc,fp,sf,of,Ap,af,cf,df,lf,uf,pf,gf,si,Dc,yp,Ip,Sp,Cp,Ep,bp,vp,Tp,wp,Rp,Dp,mf,hf,ff,Af,yf,If,Sf};

package/dist/chunk-z4xzd43p.js

@@ -0,0 +1 @@
+import{xa}from"./chunk-7xnwa0s8.js";import"./chunk-5far81q7.js";import"./chunk-zx8ecz8b.js";import"./chunk-v2p7c7s4.js";export{xa as buildAndPushServerlessImage};

package/dist/{chunk-590gwv9d.js → chunk-zx8ecz8b.js}

@@ -1,6 +1,6 @@
-import*as T from"node:crypto";import{existsSync as W,readFileSync as J}from"node:fs";import{homedir as B}from"node:os";import{join as K}from"node:path";var z={amp:"&",lt:"<",gt:">",quot:'"',apos:"'"},H={nbsp:" ",copy:"©",reg:"®",trade:"™",euro:"€",pound:"£",yen:"¥",cent:"¢",deg:"°",micro:"µ",middot:"·",bull:"•",hellip:"…",prime:"′",Prime:"″",laquo:"«",raquo:"»",lsquo:"‘",rsquo:"’",ldquo:"“",rdquo:"”",ndash:"–",mdash:"—",iexcl:"¡",iquest:"¿",sect:"§",para:"¶",dagger:"†",Dagger:"‡",lsaquo:"‹",rsaquo:"›",oline:"‾",frasl:"⁄",ensp:" ",emsp:" ",thinsp:" ",zwnj:"‌",zwj:"‍",lrm:"‎",rlm:"‏",times:"×",divide:"÷",plusmn:"±",ne:"≠",le:"≤",ge:"≥",infin:"∞",fnof:"ƒ",Alpha:"Α",Beta:"Β",Gamma:"Γ",Delta:"Δ",Epsilon:"Ε",Zeta:"Ζ",Eta:"Η",Theta:"Θ",Iota:"Ι",Kappa:"Κ",Lambda:"Λ",Mu:"Μ",Nu:"Ν",Xi:"Ξ",Omicron:"Ο",Pi:"Π",Rho:"Ρ",Sigma:"Σ",Tau:"Τ",Upsilon:"Υ",Phi:"Φ",Chi:"Χ",Psi:"Ψ",Omega:"Ω",alpha:"α",beta:"β",gamma:"γ",delta:"δ",epsilon:"ε",zeta:"ζ",eta:"η",theta:"θ",iota:"ι",kappa:"κ",lambda:"λ",mu:"μ",nu:"ν",xi:"ξ",omicron:"ο",pi:"π",rho:"ρ",sigmaf:"ς",sigma:"σ",tau:"τ",upsilon:"υ",phi:"φ",chi:"χ",psi:"ψ",omega:"ω",thetasym:"ϑ",upsih:"ϒ",piv:"ϖ",larr:"←",uarr:"↑",rarr:"→",darr:"↓",harr:"↔",crarr:"↵",lArr:"⇐",uArr:"⇑",rArr:"⇒",dArr:"⇓",hArr:"⇔",forall:"∀",part:"∂",exist:"∃",empty:"∅",nabla:"∇",isin:"∈",notin:"∉",ni:"∋",prod:"∏",sum:"∑",minus:"−",lowast:"∗",radic:"√",prop:"∝",ang:"∠",and:"∧",or:"∨",cap:"∩",cup:"∪",int:"∫",there4:"∴",sim:"∼",cong:"≅",asymp:"≈",equiv:"≡",sub:"⊂",sup:"⊃",nsub:"⊄",sube:"⊆",supe:"⊇",oplus:"⊕",otimes:"⊗",perp:"⊥",sdot:"⋅",lceil:"⌈",rceil:"⌉",lfloor:"⌊",rfloor:"⌋",lang:"〈",rang:"〉",loz:"◊",spades:"♠",clubs:"♣",hearts:"♥",diams:"♦",Agrave:"À",Aacute:"Á",Acirc:"Â",Atilde:"Ã",Auml:"Ä",Aring:"Å",AElig:"Æ",Ccedil:"Ç",Egrave:"È",Eacute:"É",Ecirc:"Ê",Euml:"Ë",Igrave:"Ì",Iacute:"Í",Icirc:"Î",Iuml:"Ï",ETH:"Ð",Ntilde:"Ñ",Ograve:"Ò",Oacute:"Ó",Ocirc:"Ô",Otilde:"Õ",Ouml:"Ö",Oslash:"Ø",Ugrave:"Ù",Uacute:"Ú",Ucirc:"Û",Uuml:"Ü",Yacute:"Ý",THORN:"Þ",szlig:"ß",agrave:"à",aacute:"á",acirc:"â",atilde:"ã",auml:"ä",aring:"å",aelig:"æ",ccedil:"ç",egrave:"è",eacute:"é",ecirc:"ê",euml:"ë",igrave:"ì",iacute:"í",icirc:"î",iuml:"ï",eth:"ð",ntilde:"ñ",ograve:"ò",oacute:"ó",ocirc:"ô",otilde:"õ",ouml:"ö",oslash:"ø",ugrave:"ù",uacute:"ú",ucirc:"û",uuml:"ü",yacute:"ý",thorn:"þ",yuml:"ÿ",OElig:"Œ",oelig:"œ",Scaron:"Š",scaron:"š",Yuml:"Ÿ",circ:"ˆ",tilde:"˜"};class R{customEntities={};useHtmlEntities;constructor(t=!1){this.useHtmlEntities=t}addEntity(t,e){this.customEntities[t]=e}decodeEntities(t){let e=t.indexOf("&");if(e===-1)return t;let r=t.length,i="",s=0;while(e!==-1&&e<r){if(e>s)i+=t.substring(s,e);let a=t.indexOf(";",e+1);if(a===-1||a-e>32){i+="&",s=e+1,e=t.indexOf("&",s);continue}let o=t.substring(e+1,a);if(o.charCodeAt(0)===35){let c=o.length,h=0,A=!1;if(c>2&&(o.charCodeAt(1)===120||o.charCodeAt(1)===88)){A=!0;for(let m=2;m<c;m++){let f=o.charCodeAt(m);if(f>=48&&f<=57)h=h<<4|f-48;else if(f>=65&&f<=70)h=h<<4|f-55;else if(f>=97&&f<=102)h=h<<4|f-87;else{A=!1;break}}}else if(c>1){A=!0;for(let m=1;m<c;m++){let f=o.charCodeAt(m);if(f>=48&&f<=57)h=h*10+(f-48);else{A=!1;break}}}if(A)i+=String.fromCodePoint(h);else i+=t.substring(e,a+1)}else{let c=this.customEntities[o];if(c===void 0){let h=o.length;if(h>=2&&h<=4){let A=o.charCodeAt(0);if(A===108&&h===2&&o.charCodeAt(1)===116)c="<";else if(A===103&&h===2&&o.charCodeAt(1)===116)c=">";else if(A===97&&h===3&&o.charCodeAt(1)===109&&o.charCodeAt(2)===112)c="&";else if(A===113&&h===4)c=o==="quot"?'"':void 0;else if(A===97&&h===4)c=o==="apos"?"'":void 0}if(c===void 0)c=z[o]??(this.useHtmlEntities?H[o]:void 0)}if(c!==void 0)i+=c;else i+=t.substring(e,a+1)}s=a+1,e=t.indexOf("&",s)}if(s<r)i+=t.substring(s);return i}}var P=[];P[38]="&amp;";P[60]="&lt;";P[62]="&gt;";P[34]="&quot;";P[39]="&apos;";var L={attributeNamePrefix:"@_",attributesGroupName:!1,textNodeName:"#text",ignoreAttributes:!0,removeNSPrefix:!1,allowBooleanAttributes:!1,alwaysCreateTextNode:!1,trimValues:!0,parseTagValue:!0,parseAttributeValue:!1,processEntities:!0,htmlEntities:!1,commentPropName:!1,cdataPropName:!1,piPropName:!1,preserveOrder:!1,stopNodes:[],unpairedTags:[],isArray:void 0,tagValueProcessor:void 0,attributeValueProcessor:void 0,updateTag:void 0,numberParseOptions:{hex:!0,leadingZeros:!0,scientific:!0},ignorePiTags:!1,transformAttributeName:void 0,transformTagName:void 0,ignoreDeclaration:!1};function _(t){return t===32||t===9||t===10||t===13}function x(t){return t>=65&&t<=90||t>=97&&t<=122||t===95||t===58||t>=192&&t<=214||t>=216&&t<=246||t>=248&&t<=767||t>=880&&t<=893||t>=895&&t<=8191||t>=8204&&t<=8205||t>=8304&&t<=8591||t>=11264&&t<=12271||t>=12289&&t<=55295||t>=63744&&t<=64975||t>=65008&&t<=65533}function V(t){return x(t)||t===45||t===46||t>=48&&t<=57||t===183||t>=768&&t<=879||t>=8255&&t<=8256}var X=/^0x[\da-fA-F]+$/,M=/^[+-]?\d+(\.\d+)?[eE][+-]?\d+$/,G=/^[+-]?(\d+\.?\d*|\.\d+)$/;function D(t,e){return t.charCodeAt(e)===91&&t.charCodeAt(e+1)===67&&t.charCodeAt(e+2)===68&&t.charCodeAt(e+3)===65&&t.charCodeAt(e+4)===84&&t.charCodeAt(e+5)===65&&t.charCodeAt(e+6)===91}function k(t,e){let r=t.charCodeAt(e),i=t.charCodeAt(e+1),s=t.charCodeAt(e+2),a=t.charCodeAt(e+3),o=t.charCodeAt(e+4),c=t.charCodeAt(e+5),h=t.charCodeAt(e+6);return(r===68||r===100)&&(i===79||i===111)&&(s===67||s===99)&&(a===84||a===116)&&(o===89||o===121)&&(c===80||c===112)&&(h===69||h===101)}function Y(t,e,r){if(e>=r||!x(t.charCodeAt(e)))return e;e++;while(e<r&&V(t.charCodeAt(e)))e++;return e}class v{options;entityDecoder;unpairedSet;exactStopNodes;wildcardStopSuffixes;needsJPath;_ignoreAttributes=!0;_textNodeName="#text";_commentPropName=!1;_cdataPropName=!1;_piPropName=!1;_alwaysCreateTextNode=!1;_trimValues=!0;_processEntities=!0;_parseTagValue=!0;_parseAttributeValue=!1;_removeNSPrefix=!1;_attrPrefix="@_";_attrsGroupName=!1;_ignorePiTags=!1;_ignoreDeclaration=!1;constructor(t){this.options={...L,...t},this.entityDecoder=new R(this.options.htmlEntities),this.unpairedSet=new Set(this.options.unpairedTags),this.exactStopNodes=new Set,this.wildcardStopSuffixes=[];for(let e of this.options.stopNodes)if(e.startsWith("*."))this.wildcardStopSuffixes.push(e.substring(2));else this.exactStopNodes.add(e);this._ignoreAttributes=this.options.ignoreAttributes,this._textNodeName=this.options.textNodeName,this._commentPropName=this.options.commentPropName,this._cdataPropName=this.options.cdataPropName,this._piPropName=this.options.piPropName,this._alwaysCreateTextNode=this.options.alwaysCreateTextNode,this._trimValues=this.options.trimValues,this._processEntities=this.options.processEntities,this._parseTagValue=this.options.parseTagValue,this._parseAttributeValue=this.options.parseAttributeValue,this._removeNSPrefix=this.options.removeNSPrefix,this._attrPrefix=this.options.attributeNamePrefix,this._attrsGroupName=this.options.attributesGroupName,this._ignorePiTags=this.options.ignorePiTags,this._ignoreDeclaration=this.options.ignoreDeclaration,this.needsJPath=this.options.stopNodes.length>0||this.options.isArray!==void 0||this.options.updateTag!==void 0||this.options.tagValueProcessor!==void 0||this.options.attributeValueProcessor!==void 0}addEntity(t,e){this.entityDecoder.addEntity(t,e)}parse(t){if(t instanceof Uint8Array)t=new TextDecoder().decode(t);let e=t;if(this.options.preserveOrder)return this.parseOrdered(e);return this.parseUnordered(e)}parseUnordered(t){let e={},r=t.length,i=0;if(r>0&&t.charCodeAt(0)===65279)i=1;return i=this.parseChildren(t,i,r,e,"",[]),e}parseOrdered(t){let e=t.length,r=0;if(e>0&&t.charCodeAt(0)===65279)r=1;let i=[];return this.parseChildrenOrdered(t,r,e,i,""),i}readTagName(t,e,r){return Y(t,e,r)}extractTagName(t,e,r){let i=t.substring(e,r);if(this._removeNSPrefix){let s=i.indexOf(":");if(s!==-1)i=i.substring(s+1)}if(this.options.transformTagName)i=this.options.transformTagName(i);return i}parseAttributes(t,e,r,i,s){let a=0,o=this._removeNSPrefix,c=this.options.transformAttributeName,h=this._trimValues,A=this._processEntities,m=this.options.attributeValueProcessor;while(e<r){let f=t.charCodeAt(e);while(f===32||f===9||f===10||f===13){if(e++,e>=r)break;f=t.charCodeAt(e)}if(e>=r)break;if(f===62||f===47)break;let b=e;if(!x(f))break;e++;while(e<r&&V(t.charCodeAt(e)))e++;let p=t.substring(b,e);if(o){let C=p.indexOf(":");if(C!==-1)p=p.substring(C+1)}if(c)p=c(p);while(e<r&&_(t.charCodeAt(e)))e++;if(e<r&&t.charCodeAt(e)===61){e++;while(e<r&&_(t.charCodeAt(e)))e++;if(e>=r)break;let C=t.charCodeAt(e);if(C===34||C===39){e++;let E=e;while(e<r&&t.charCodeAt(e)!==C)e++;let d=t.substring(E,e);if(h&&d.length>0){let u=d.charCodeAt(0),g=d.charCodeAt(d.length-1);if(u<=32||g<=32)d=d.trim()}if(A)d=this.entityDecoder.decodeEntities(d);if(m)d=m(p,d,i)??d;if(s[p]=d,a++,e<r)e++}}else s[p]="true",a++}return a>0?-e-1:e}processTagValue(t,e,r,i,s){if(this._trimValues){let a=t.length;if(a>0){let o=t.charCodeAt(0),c=t.charCodeAt(a-1);if(o<=32||c<=32)t=t.trim()}}if(this._processEntities)t=this.entityDecoder.decodeEntities(t);if(this.options.tagValueProcessor){let a=this.options.tagValueProcessor(e,t,r,i,s);if(a!==void 0)t=a}if(!t)return t;if(this._parseTagValue)return this.parseValue(t);return t}parseValue(t){if(t==="true")return!0;if(t==="false")return!1;if(!t)return t;let e=t.charCodeAt(0);if(!(e>=48&&e<=57||e===43||e===45||e===46))return t;let i=this.options.numberParseOptions;if(i.skipLike?.test(t))return t;if(i.hex&&e===48&&X.test(t))return Number.parseInt(t,16);if(t.length>1&&e===48&&t.charCodeAt(1)!==46){if(i.leadingZeros)return t}if(i.scientific&&M.test(t)){let s=Number(t);if(!Number.isNaN(s))return s}if(G.test(t)){let s=Number(t);if(!Number.isNaN(s))return s}return t}parseAttributeValue(t){if(!this._parseAttributeValue)return t;return this.parseValue(t)}isStopNode(t){if(this.exactStopNodes.has(t))return!0;for(let e of this.wildcardStopSuffixes)if(t.endsWith(`.${e}`)||t===e)return!0;return!1}readStopNodeContent(t,e,r,i){let s=`</${i}`,a=t.indexOf(s,e);if(a===-1)return{content:t.substring(e),pos:r};let o=t.substring(e,a),c=a+s.length;while(c<r&&t.charCodeAt(c)!==62)c++;if(c<r)c++;return{content:o,pos:c}}addToObj(t,e,r,i,s,a){let o=t[e];if(o!==void 0)if(!Array.isArray(o))t[e]=[o,r];else o.push(r);else if(this.options.isArray?.(e,i,s,a))t[e]=[r];else t[e]=r}flushText(t,e,r,i){if(!t&&!e)return;let s=this._textNodeName;if(e){let a=t;if(a&&this._processEntities)a=this.entityDecoder.decodeEntities(a);let o=e+a;if(this._trimValues&&o.length>0){let c=o.charCodeAt(0),h=o.charCodeAt(o.length-1);if(c<=32||h<=32)o=o.trim()}if(this.options.tagValueProcessor){let c=this.options.tagValueProcessor(s,o,r,!1,!0);if(c!==void 0)o=c}if(o){let c=this._parseTagValue?this.parseValue(o):o;if(c!==void 0&&c!=="")this.addToObj(i,s,c,r,!0,!1)}}else{let a=this.processTagValue(t,s,r,!1,!0);if(a!==void 0&&a!=="")this.addToObj(i,s,a,r,!0,!1)}}parseChildren(t,e,r,i,s,a){let o="",c="",h=this.needsJPath;while(e<r){if(t.charCodeAt(e)!==60){let u=e;e++;while(e<r&&t.charCodeAt(e)!==60)e++;if(!o)o=t.substring(u,e);else o+=t.substring(u,e);continue}if(e+1>=r)break;let m=t.charCodeAt(e+1);if(m===33&&e+3<r&&t.charCodeAt(e+2)===45&&t.charCodeAt(e+3)===45){if(o||c)this.flushText(o,c,s,i),o="",c="";e+=4;let u=t.indexOf("-->",e);if(u===-1){e=r;break}if(this._commentPropName){let g=t.substring(e,u);this.addToObj(i,this._commentPropName,g,s,!0,!1)}e=u+3;continue}if(m===33&&e+8<r&&D(t,e+2)){e+=9;let u=t.indexOf("]]>",e);if(u===-1){e=r;break}let g=t.substring(e,u);if(this._cdataPropName)this.flushText(o,c,s,i),o="",c="",this.addToObj(i,this._cdataPropName,g,s,!0,!1);else{if(o){let y=o;if(this._processEntities)y=this.entityDecoder.decodeEntities(y);c+=y,o=""}c+=g}e=u+3;continue}if(m===33&&e+9<r&&k(t,e+2)){e+=9;let u=1;while(e<r&&u>0){let g=t.charCodeAt(e);if(g===60)u++;else if(g===62)u--;e++}continue}if(m===63){e+=2;let u=e;while(e<r&&!_(t.charCodeAt(e))&&t.charCodeAt(e)!==63)e++;let g=t.substring(u,e),y=t.indexOf("?>",e);if(y===-1){e=r;break}let N=t.substring(e,y).trim();if(g==="xml"){if(!this._ignoreDeclaration&&this._piPropName){let w=this.parsePiAttributes(N);this.addToObj(i,this._piPropName,{[g]:w},s,!0,!1)}}else if(!this._ignorePiTags&&this._piPropName)this.addToObj(i,this._piPropName,{[g]:N},s,!0,!1);e=y+2;continue}if(m===47){if(o||c)this.flushText(o,c,s,i),o="",c="";e+=2;let u=e,g=this.readTagName(t,e,r),y=this.extractTagName(t,u,g);e=g;while(e<r&&_(t.charCodeAt(e)))e++;if(e<r&&t.charCodeAt(e)===62)e++;if(a.length>0&&a[a.length-1]===y){a.pop();continue}return e}if(o||c)this.flushText(o,c,s,i),o="",c="";e++;let f=e,b=this.readTagName(t,e,r),p=this.extractTagName(t,f,b);if(!p){e=b+1;continue}e=b;let C=h?s?`${s}.${p}`:p:"",E={},d=!1;if(!this._ignoreAttributes){let u=this.parseAttributes(t,e,r,C,E);if(u<0)e=-u-1,d=!0;else e=u}else while(e<r){let u=t.charCodeAt(e);if(u===62||u===47)break;if(u===34||u===39){e++;while(e<r&&t.charCodeAt(e)!==u)e++}e++}if(this.options.updateTag){if(this.options.updateTag(p,C,E)===!1){while(e<r&&_(t.charCodeAt(e)))e++;if(e<r&&t.charCodeAt(e)===47)e+=2;else if(e<r&&t.charCodeAt(e)===62){e++;let g=`</${p}>`,y=t.indexOf(g,e);if(y!==-1)e=y+g.length}continue}}while(e<r&&_(t.charCodeAt(e)))e++;if(e<r&&t.charCodeAt(e)===47){if(e+=2,d||this._alwaysCreateTextNode){let u={};if(d)this.applyAttributes(u,E,C);if(this._alwaysCreateTextNode)u[this._textNodeName]="";this.addToObj(i,p,u,C,!0,!1)}else this.addToObj(i,p,"",C,!0,!1);continue}if(e<r&&t.charCodeAt(e)===62){if(e++,this.unpairedSet.has(p)){if(d){let N={};this.applyAttributes(N,E,C),this.addToObj(i,p,N,C,!0,!1)}else this.addToObj(i,p,"",C,!0,!1);a.push(p);continue}if(this.exactStopNodes.size>0||this.wildcardStopSuffixes.length>0){if(this.isStopNode(C)){let N=this.readStopNodeContent(t,e,r,p),w={};if(d)this.applyAttributes(w,E,C);if(N.content)w[this._textNodeName]=N.content;this.addToObj(i,p,w,C,!0,!1),e=N.pos;continue}}let u={};if(d)this.applyAttributes(u,E,C);e=this.parseChildren(t,e,r,u,C,a);let g=this._textNodeName,y=u[g];if(!d&&!this._alwaysCreateTextNode){let N=!0;for(let w in u)if(w!==g){N=!1;break}if(N){this.addToObj(i,p,y!==void 0?y:"",C,!0,!1);continue}}this.addToObj(i,p,u,C,!1,!1)}}if(o||c)this.flushText(o,c,s,i);return e}parseChildrenOrdered(t,e,r,i,s){let a="",o=this.needsJPath;while(e<r){if(t.charCodeAt(e)!==60){let d=e;e++;while(e<r&&t.charCodeAt(e)!==60)e++;if(!a)a=t.substring(d,e);else a+=t.substring(d,e);continue}if(e+1>=r)break;let h=t.charCodeAt(e+1);if(h===33&&e+3<r&&t.charCodeAt(e+2)===45&&t.charCodeAt(e+3)===45){if(a){let u=this.processTagValue(a,this._textNodeName,s,!1,!0);if(u!==void 0&&u!=="")i.push({[this._textNodeName]:u});a=""}e+=4;let d=t.indexOf("-->",e);if(d===-1){e=r;break}if(this._commentPropName)i.push({[this._commentPropName]:[{[this._textNodeName]:t.substring(e,d)}]});e=d+3;continue}if(h===33&&e+8<r&&D(t,e+2)){e+=9;let d=t.indexOf("]]>",e);if(d===-1){e=r;break}let u=t.substring(e,d);if(this._cdataPropName){if(a){let g=this.processTagValue(a,this._textNodeName,s,!1,!0);if(g!==void 0&&g!=="")i.push({[this._textNodeName]:g});a=""}i.push({[this._cdataPropName]:[{[this._textNodeName]:u}]})}else a+=u;e=d+3;continue}if(h===33&&e+9<r&&k(t,e+2)){e+=9;let d=1;while(e<r&&d>0){let u=t.charCodeAt(e);if(u===60)d++;else if(u===62)d--;e++}continue}if(h===63){e+=2;let d=t.indexOf("?>",e);if(d===-1){e=r;break}e=d+2;continue}if(h===47){if(a){let u=this.processTagValue(a,this._textNodeName,s,!1,!0);if(u!==void 0&&u!=="")i.push({[this._textNodeName]:u});a=""}e+=2,e=this.readTagName(t,e,r);while(e<r&&_(t.charCodeAt(e)))e++;if(e<r&&t.charCodeAt(e)===62)e++;return e}if(a){let d=this.processTagValue(a,this._textNodeName,s,!1,!0);if(d!==void 0&&d!=="")i.push({[this._textNodeName]:d});a=""}e++;let A=e,m=this.readTagName(t,e,r),f=this.extractTagName(t,A,m);if(!f){e=m+1;continue}e=m;let b=o?s?`${s}.${f}`:f:"",p={},C=!1;if(!this._ignoreAttributes){let d=this.parseAttributes(t,e,r,b,p);if(d<0)e=-d-1,C=!0;else e=d}else while(e<r){let d=t.charCodeAt(e);if(d===62||d===47)break;if(d===34||d===39){e++;while(e<r&&t.charCodeAt(e)!==d)e++}e++}while(e<r&&_(t.charCodeAt(e)))e++;let E={[f]:[]};if(C){E[":@"]={};for(let u in p)E[":@"][this._attrPrefix+u]=this.parseAttributeValue(p[u])}if(e<r&&t.charCodeAt(e)===47){e+=2,i.push(E);continue}if(e<r&&t.charCodeAt(e)===62)e++,e=this.parseChildrenOrdered(t,e,r,E[f],b),i.push(E)}if(a){let c=this.processTagValue(a,this._textNodeName,s,!1,!0);if(c!==void 0&&c!=="")i.push({[this._textNodeName]:c})}return e}applyAttributes(t,e,r){let i=this._attrPrefix;if(this._attrsGroupName){let s={};for(let a in e)s[i+a]=this.parseAttributeValue(e[a]);t[this._attrsGroupName]=s}else for(let s in e)t[i+s]=this.parseAttributeValue(e[s])}parsePiAttributes(t){let e={},r=0,i=t.length;while(r<i){while(r<i&&_(t.charCodeAt(r)))r++;if(r>=i)break;let s=r;while(r<i&&!_(t.charCodeAt(r))&&t.charCodeAt(r)!==61)r++;let a=t.substring(s,r);if(!a)break;while(r<i&&_(t.charCodeAt(r)))r++;if(r<i&&t.charCodeAt(r)===61){r++;while(r<i&&_(t.charCodeAt(r)))r++;if(r<i){let o=t.charCodeAt(r);if(o===34||o===39){r++;let c=r;while(r<i&&t.charCodeAt(r)!==o)r++;if(e[a]=t.substring(c,r),r<i)r++}}}}return e}}function Sr(t){let e=t.endpoint||`s3.${t.region}.amazonaws.com`,r=new URL(/^https?:\/\//i.test(e)?e:`https://${e}`);if(r.protocol!=="http:"&&r.protocol!=="https:"||r.pathname!=="/"&&r.pathname!==""||r.search||r.hash||r.username||r.password)throw Error("S3 endpoint must be an HTTP(S) origin without a path");let i=r.protocol.slice(0,-1),s=r.host;if(!t.bucket)return{protocol:i,host:s,path:t.path};if(t.forcePathStyle){let a=t.path==="/"?`/${t.bucket}`:`/${t.bucket}${t.path}`;return{protocol:i,host:s,path:a}}return{protocol:i,host:`${t.bucket}.${s}`,path:t.path}}class n{credentials;config;cache;xmlParser;constructor(t,e){this.config={maxRetries:3,retryDelay:1000,cacheEnabled:!0,defaultCacheTTL:60000,...e},this.credentials=t||this.loadCredentials(),this.cache=new Map,this.xmlParser=new v({ignoreAttributes:!1,attributeNamePrefix:"@_",textNodeName:"#text",parseAttributeValue:!0,trimValues:!0})}loadCredentials(){let t=process.env.AWS_ACCESS_KEY_ID,e=process.env.AWS_SECRET_ACCESS_KEY,r=process.env.AWS_SESSION_TOKEN;if(t&&e)return{accessKeyId:t,secretAccessKey:e,sessionToken:r};let i=this.loadCredentialsFromFile();if(i)return i;return{accessKeyId:"",secretAccessKey:""}}loadCredentialsFromFile(){let t=this.config?.profile||process.env.AWS_PROFILE||"default",e=process.env.AWS_SHARED_CREDENTIALS_FILE||K(B(),".aws","credentials");if(!W(e))return null;try{let r=J(e,"utf-8"),i=this.parseCredentialsFile(r,t);if(i.accessKeyId&&i.secretAccessKey)return i}catch{}return null}parseCredentialsFile(t,e){let r=t.split(`
-`),i="",s="",a="",o;for(let c of r){let h=c.trim();if(!h||h.startsWith("#"))continue;let A=h.match(/^\[([^\]]+)\]$/);if(A){i=A[1];continue}if(i===e){let[m,...f]=h.split("="),b=f.join("=").trim();if(m.trim()==="aws_access_key_id")s=b;else if(m.trim()==="aws_secret_access_key")a=b;else if(m.trim()==="aws_session_token")o=b}}return{accessKeyId:s,secretAccessKey:a,sessionToken:o}}ec2CredentialsCache;async getCredentials(){let t=process.env.AWS_ACCESS_KEY_ID,e=process.env.AWS_SECRET_ACCESS_KEY;if(t&&e)return{accessKeyId:t,secretAccessKey:e,sessionToken:process.env.AWS_SESSION_TOKEN};let r=this.loadCredentialsFromFile();if(r)return r;if(this.ec2CredentialsCache){let i=Date.now();if(this.ec2CredentialsCache.expiration>i+300000)return this.ec2CredentialsCache.credentials}try{let s=await(await fetch("http://169.254.169.254/latest/api/token",{method:"PUT",headers:{"X-aws-ec2-metadata-token-ttl-seconds":"21600"}})).text(),o=await(await fetch("http://169.254.169.254/latest/meta-data/iam/security-credentials/",{headers:{"X-aws-ec2-metadata-token":s}})).text(),h=await(await fetch(`http://169.254.169.254/latest/meta-data/iam/security-credentials/${o}`,{headers:{"X-aws-ec2-metadata-token":s}})).json(),A={accessKeyId:h.AccessKeyId,secretAccessKey:h.SecretAccessKey,sessionToken:h.Token};return this.ec2CredentialsCache={credentials:A,expiration:new Date(h.Expiration).getTime()},A}catch(i){throw Error("AWS credentials not found. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables, or run on an EC2 instance with an IAM role.")}}async request(t){if(t.method==="GET"&&this.config.cacheEnabled&&t.cacheKey){let i=this.getFromCache(t.cacheKey);if(i!==null)return i}let e=t.retries??this.config.maxRetries??3,r=null;for(let i=0;i<=e;i++)try{let s=await this.makeRequest(t);if(t.method==="GET"&&this.config.cacheEnabled&&t.cacheKey)this.setInCache(t.cacheKey,s,t.cacheTTL??this.config.defaultCacheTTL??60000);return s}catch(s){if(r=s,!this.shouldRetry(s))throw s;if(i===e)throw s;let o=this.calculateRetryDelay(i);await this.sleep(o)}throw r||Error("Request failed after retries")}async makeRequest(t){let e=t.credentials||(this.credentials?.accessKeyId?this.credentials:await this.getCredentials());if(!e||!e.accessKeyId||!e.secretAccessKey)throw Error("AWS credentials not provided");let r=this.buildUrl(t),i=this.signRequest(t,e),s=await fetch(r,{method:t.method,headers:i,body:t.body}),a=await s.text();if(!s.ok)throw this.parseError(a,s.status,s.headers);if(!a||a.trim()===""){if(t.returnHeaders)return{body:null,headers:this.headersToObject(s.headers)};return null}if(t.rawResponse){if(t.returnHeaders)return{body:a,headers:this.headersToObject(s.headers)};return a}let o;if(a.startsWith("<"))o=this.parseXmlResponse(a);else try{o=JSON.parse(a)}catch{o=a}if(t.returnHeaders)return{body:o,headers:this.headersToObject(s.headers)};return o}headersToObject(t){let e={};return t.forEach((r,i)=>{e[i]=r}),e}buildUrl(t){let{service:e,region:r,queryParams:i}=t,{path:s}=t,a,o="https";if(e==="s3"){let h=Sr({region:r,path:s,bucket:t.bucket,endpoint:this.config.endpoint,forcePathStyle:this.config.forcePathStyle});o=h.protocol,a=h.host,s=h.path}else if(e==="cloudfront")a="cloudfront.amazonaws.com";else if(e==="iam")a="iam.amazonaws.com";else if(e==="route53")a="route53.amazonaws.com";else if(e==="route53domains")a="route53domains.us-east-1.amazonaws.com";else if(e==="ecr")a=`api.ecr.${r}.amazonaws.com`;else if(e==="ses")a=`email.${r}.amazonaws.com`;else a=`${e}.${r}.amazonaws.com`;let c=`${o}://${a}${s}`;if(i&&Object.keys(i).length>0){let h=Object.keys(i).map((A)=>`${this.uriEncode(A)}=${this.uriEncode(i[A])}`).join("&");c+=`?${h}`}return c}signRequest(t,e){let{service:r,region:i,method:s,queryParams:a,body:o}=t,{path:c}=t,h=new Date,A=this.getAmzDate(h),m=this.getDateStamp(h),f;if(r==="s3"){let S=Sr({region:i,path:c,bucket:t.bucket,endpoint:this.config.endpoint,forcePathStyle:this.config.forcePathStyle});f=S.host,c=S.path}else if(r==="cloudfront")f="cloudfront.amazonaws.com";else if(r==="iam")f="iam.amazonaws.com";else if(r==="route53")f="route53.amazonaws.com";else if(r==="route53domains")f="route53domains.us-east-1.amazonaws.com";else if(r==="ecr")f=`api.ecr.${i}.amazonaws.com`;else if(r==="ses")f=`email.${i}.amazonaws.com`;else f=`${r}.${i}.amazonaws.com`;let b={host:f,"x-amz-date":A,...t.headers||{}};if(e.sessionToken)b["x-amz-security-token"]=e.sessionToken;if(o){if(!Object.keys(b).some((O)=>O.toLowerCase()==="content-type"))b["content-type"]="application/x-www-form-urlencoded";b["content-length"]=Buffer.byteLength(o).toString()}let p=this.sha256(o||"");b["x-amz-content-sha256"]=p;let C=c,E=a?Object.keys(a).sort().map((S)=>`${this.uriEncode(S)}=${this.uriEncode(a[S])}`).join("&"):"",d=Object.keys(b).sort((S,O)=>S.toLowerCase().localeCompare(O.toLowerCase())),u=d.map((S)=>`${S.toLowerCase()}:${b[S].trim()}
+import*as T from"node:crypto";import{existsSync as W,readFileSync as J}from"node:fs";import{homedir as B}from"node:os";import{join as K}from"node:path";var z={amp:"&",lt:"<",gt:">",quot:'"',apos:"'"},H={nbsp:" ",copy:"©",reg:"®",trade:"™",euro:"€",pound:"£",yen:"¥",cent:"¢",deg:"°",micro:"µ",middot:"·",bull:"•",hellip:"…",prime:"′",Prime:"″",laquo:"«",raquo:"»",lsquo:"‘",rsquo:"’",ldquo:"“",rdquo:"”",ndash:"–",mdash:"—",iexcl:"¡",iquest:"¿",sect:"§",para:"¶",dagger:"†",Dagger:"‡",lsaquo:"‹",rsaquo:"›",oline:"‾",frasl:"⁄",ensp:" ",emsp:" ",thinsp:" ",zwnj:"‌",zwj:"‍",lrm:"‎",rlm:"‏",times:"×",divide:"÷",plusmn:"±",ne:"≠",le:"≤",ge:"≥",infin:"∞",fnof:"ƒ",Alpha:"Α",Beta:"Β",Gamma:"Γ",Delta:"Δ",Epsilon:"Ε",Zeta:"Ζ",Eta:"Η",Theta:"Θ",Iota:"Ι",Kappa:"Κ",Lambda:"Λ",Mu:"Μ",Nu:"Ν",Xi:"Ξ",Omicron:"Ο",Pi:"Π",Rho:"Ρ",Sigma:"Σ",Tau:"Τ",Upsilon:"Υ",Phi:"Φ",Chi:"Χ",Psi:"Ψ",Omega:"Ω",alpha:"α",beta:"β",gamma:"γ",delta:"δ",epsilon:"ε",zeta:"ζ",eta:"η",theta:"θ",iota:"ι",kappa:"κ",lambda:"λ",mu:"μ",nu:"ν",xi:"ξ",omicron:"ο",pi:"π",rho:"ρ",sigmaf:"ς",sigma:"σ",tau:"τ",upsilon:"υ",phi:"φ",chi:"χ",psi:"ψ",omega:"ω",thetasym:"ϑ",upsih:"ϒ",piv:"ϖ",larr:"←",uarr:"↑",rarr:"→",darr:"↓",harr:"↔",crarr:"↵",lArr:"⇐",uArr:"⇑",rArr:"⇒",dArr:"⇓",hArr:"⇔",forall:"∀",part:"∂",exist:"∃",empty:"∅",nabla:"∇",isin:"∈",notin:"∉",ni:"∋",prod:"∏",sum:"∑",minus:"−",lowast:"∗",radic:"√",prop:"∝",ang:"∠",and:"∧",or:"∨",cap:"∩",cup:"∪",int:"∫",there4:"∴",sim:"∼",cong:"≅",asymp:"≈",equiv:"≡",sub:"⊂",sup:"⊃",nsub:"⊄",sube:"⊆",supe:"⊇",oplus:"⊕",otimes:"⊗",perp:"⊥",sdot:"⋅",lceil:"⌈",rceil:"⌉",lfloor:"⌊",rfloor:"⌋",lang:"〈",rang:"〉",loz:"◊",spades:"♠",clubs:"♣",hearts:"♥",diams:"♦",Agrave:"À",Aacute:"Á",Acirc:"Â",Atilde:"Ã",Auml:"Ä",Aring:"Å",AElig:"Æ",Ccedil:"Ç",Egrave:"È",Eacute:"É",Ecirc:"Ê",Euml:"Ë",Igrave:"Ì",Iacute:"Í",Icirc:"Î",Iuml:"Ï",ETH:"Ð",Ntilde:"Ñ",Ograve:"Ò",Oacute:"Ó",Ocirc:"Ô",Otilde:"Õ",Ouml:"Ö",Oslash:"Ø",Ugrave:"Ù",Uacute:"Ú",Ucirc:"Û",Uuml:"Ü",Yacute:"Ý",THORN:"Þ",szlig:"ß",agrave:"à",aacute:"á",acirc:"â",atilde:"ã",auml:"ä",aring:"å",aelig:"æ",ccedil:"ç",egrave:"è",eacute:"é",ecirc:"ê",euml:"ë",igrave:"ì",iacute:"í",icirc:"î",iuml:"ï",eth:"ð",ntilde:"ñ",ograve:"ò",oacute:"ó",ocirc:"ô",otilde:"õ",ouml:"ö",oslash:"ø",ugrave:"ù",uacute:"ú",ucirc:"û",uuml:"ü",yacute:"ý",thorn:"þ",yuml:"ÿ",OElig:"Œ",oelig:"œ",Scaron:"Š",scaron:"š",Yuml:"Ÿ",circ:"ˆ",tilde:"˜"};class R{customEntities={};useHtmlEntities;constructor(t=!1){this.useHtmlEntities=t}addEntity(t,e){this.customEntities[t]=e}decodeEntities(t){let e=t.indexOf("&");if(e===-1)return t;let r=t.length,i="",s=0;while(e!==-1&&e<r){if(e>s)i+=t.substring(s,e);let a=t.indexOf(";",e+1);if(a===-1||a-e>32){i+="&",s=e+1,e=t.indexOf("&",s);continue}let o=t.substring(e+1,a);if(o.charCodeAt(0)===35){let c=o.length,h=0,A=!1;if(c>2&&(o.charCodeAt(1)===120||o.charCodeAt(1)===88)){A=!0;for(let m=2;m<c;m++){let f=o.charCodeAt(m);if(f>=48&&f<=57)h=h<<4|f-48;else if(f>=65&&f<=70)h=h<<4|f-55;else if(f>=97&&f<=102)h=h<<4|f-87;else{A=!1;break}}}else if(c>1){A=!0;for(let m=1;m<c;m++){let f=o.charCodeAt(m);if(f>=48&&f<=57)h=h*10+(f-48);else{A=!1;break}}}if(A)i+=String.fromCodePoint(h);else i+=t.substring(e,a+1)}else{let c=this.customEntities[o];if(c===void 0){let h=o.length;if(h>=2&&h<=4){let A=o.charCodeAt(0);if(A===108&&h===2&&o.charCodeAt(1)===116)c="<";else if(A===103&&h===2&&o.charCodeAt(1)===116)c=">";else if(A===97&&h===3&&o.charCodeAt(1)===109&&o.charCodeAt(2)===112)c="&";else if(A===113&&h===4)c=o==="quot"?'"':void 0;else if(A===97&&h===4)c=o==="apos"?"'":void 0}if(c===void 0)c=z[o]??(this.useHtmlEntities?H[o]:void 0)}if(c!==void 0)i+=c;else i+=t.substring(e,a+1)}s=a+1,e=t.indexOf("&",s)}if(s<r)i+=t.substring(s);return i}}var P=[];P[38]="&amp;";P[60]="&lt;";P[62]="&gt;";P[34]="&quot;";P[39]="&apos;";var L={attributeNamePrefix:"@_",attributesGroupName:!1,textNodeName:"#text",ignoreAttributes:!0,removeNSPrefix:!1,allowBooleanAttributes:!1,alwaysCreateTextNode:!1,trimValues:!0,parseTagValue:!0,parseAttributeValue:!1,processEntities:!0,htmlEntities:!1,commentPropName:!1,cdataPropName:!1,piPropName:!1,preserveOrder:!1,stopNodes:[],unpairedTags:[],isArray:void 0,tagValueProcessor:void 0,attributeValueProcessor:void 0,updateTag:void 0,numberParseOptions:{hex:!0,leadingZeros:!0,scientific:!0},ignorePiTags:!1,transformAttributeName:void 0,transformTagName:void 0,ignoreDeclaration:!1};function _(t){return t===32||t===9||t===10||t===13}function x(t){return t>=65&&t<=90||t>=97&&t<=122||t===95||t===58||t>=192&&t<=214||t>=216&&t<=246||t>=248&&t<=767||t>=880&&t<=893||t>=895&&t<=8191||t>=8204&&t<=8205||t>=8304&&t<=8591||t>=11264&&t<=12271||t>=12289&&t<=55295||t>=63744&&t<=64975||t>=65008&&t<=65533}function V(t){return x(t)||t===45||t===46||t>=48&&t<=57||t===183||t>=768&&t<=879||t>=8255&&t<=8256}var X=/^0x[\da-fA-F]+$/,M=/^[+-]?\d+(\.\d+)?[eE][+-]?\d+$/,G=/^[+-]?(\d+\.?\d*|\.\d+)$/;function D(t,e){return t.charCodeAt(e)===91&&t.charCodeAt(e+1)===67&&t.charCodeAt(e+2)===68&&t.charCodeAt(e+3)===65&&t.charCodeAt(e+4)===84&&t.charCodeAt(e+5)===65&&t.charCodeAt(e+6)===91}function k(t,e){let r=t.charCodeAt(e),i=t.charCodeAt(e+1),s=t.charCodeAt(e+2),a=t.charCodeAt(e+3),o=t.charCodeAt(e+4),c=t.charCodeAt(e+5),h=t.charCodeAt(e+6);return(r===68||r===100)&&(i===79||i===111)&&(s===67||s===99)&&(a===84||a===116)&&(o===89||o===121)&&(c===80||c===112)&&(h===69||h===101)}function Y(t,e,r){if(e>=r||!x(t.charCodeAt(e)))return e;e++;while(e<r&&V(t.charCodeAt(e)))e++;return e}class v{options;entityDecoder;unpairedSet;exactStopNodes;wildcardStopSuffixes;needsJPath;_ignoreAttributes=!0;_textNodeName="#text";_commentPropName=!1;_cdataPropName=!1;_piPropName=!1;_alwaysCreateTextNode=!1;_trimValues=!0;_processEntities=!0;_parseTagValue=!0;_parseAttributeValue=!1;_removeNSPrefix=!1;_attrPrefix="@_";_attrsGroupName=!1;_ignorePiTags=!1;_ignoreDeclaration=!1;constructor(t){this.options={...L,...t},this.entityDecoder=new R(this.options.htmlEntities),this.unpairedSet=new Set(this.options.unpairedTags),this.exactStopNodes=new Set,this.wildcardStopSuffixes=[];for(let e of this.options.stopNodes)if(e.startsWith("*."))this.wildcardStopSuffixes.push(e.substring(2));else this.exactStopNodes.add(e);this._ignoreAttributes=this.options.ignoreAttributes,this._textNodeName=this.options.textNodeName,this._commentPropName=this.options.commentPropName,this._cdataPropName=this.options.cdataPropName,this._piPropName=this.options.piPropName,this._alwaysCreateTextNode=this.options.alwaysCreateTextNode,this._trimValues=this.options.trimValues,this._processEntities=this.options.processEntities,this._parseTagValue=this.options.parseTagValue,this._parseAttributeValue=this.options.parseAttributeValue,this._removeNSPrefix=this.options.removeNSPrefix,this._attrPrefix=this.options.attributeNamePrefix,this._attrsGroupName=this.options.attributesGroupName,this._ignorePiTags=this.options.ignorePiTags,this._ignoreDeclaration=this.options.ignoreDeclaration,this.needsJPath=this.options.stopNodes.length>0||this.options.isArray!==void 0||this.options.updateTag!==void 0||this.options.tagValueProcessor!==void 0||this.options.attributeValueProcessor!==void 0}addEntity(t,e){this.entityDecoder.addEntity(t,e)}parse(t){if(t instanceof Uint8Array)t=new TextDecoder().decode(t);let e=t;if(this.options.preserveOrder)return this.parseOrdered(e);return this.parseUnordered(e)}parseUnordered(t){let e={},r=t.length,i=0;if(r>0&&t.charCodeAt(0)===65279)i=1;return i=this.parseChildren(t,i,r,e,"",[]),e}parseOrdered(t){let e=t.length,r=0;if(e>0&&t.charCodeAt(0)===65279)r=1;let i=[];return this.parseChildrenOrdered(t,r,e,i,""),i}readTagName(t,e,r){return Y(t,e,r)}extractTagName(t,e,r){let i=t.substring(e,r);if(this._removeNSPrefix){let s=i.indexOf(":");if(s!==-1)i=i.substring(s+1)}if(this.options.transformTagName)i=this.options.transformTagName(i);return i}parseAttributes(t,e,r,i,s){let a=0,o=this._removeNSPrefix,c=this.options.transformAttributeName,h=this._trimValues,A=this._processEntities,m=this.options.attributeValueProcessor;while(e<r){let f=t.charCodeAt(e);while(f===32||f===9||f===10||f===13){if(e++,e>=r)break;f=t.charCodeAt(e)}if(e>=r)break;if(f===62||f===47)break;let b=e;if(!x(f))break;e++;while(e<r&&V(t.charCodeAt(e)))e++;let p=t.substring(b,e);if(o){let C=p.indexOf(":");if(C!==-1)p=p.substring(C+1)}if(c)p=c(p);while(e<r&&_(t.charCodeAt(e)))e++;if(e<r&&t.charCodeAt(e)===61){e++;while(e<r&&_(t.charCodeAt(e)))e++;if(e>=r)break;let C=t.charCodeAt(e);if(C===34||C===39){e++;let E=e;while(e<r&&t.charCodeAt(e)!==C)e++;let d=t.substring(E,e);if(h&&d.length>0){let u=d.charCodeAt(0),g=d.charCodeAt(d.length-1);if(u<=32||g<=32)d=d.trim()}if(A)d=this.entityDecoder.decodeEntities(d);if(m)d=m(p,d,i)??d;if(s[p]=d,a++,e<r)e++}}else s[p]="true",a++}return a>0?-e-1:e}processTagValue(t,e,r,i,s){if(this._trimValues){let a=t.length;if(a>0){let o=t.charCodeAt(0),c=t.charCodeAt(a-1);if(o<=32||c<=32)t=t.trim()}}if(this._processEntities)t=this.entityDecoder.decodeEntities(t);if(this.options.tagValueProcessor){let a=this.options.tagValueProcessor(e,t,r,i,s);if(a!==void 0)t=a}if(!t)return t;if(this._parseTagValue)return this.parseValue(t);return t}parseValue(t){if(t==="true")return!0;if(t==="false")return!1;if(!t)return t;let e=t.charCodeAt(0);if(!(e>=48&&e<=57||e===43||e===45||e===46))return t;let i=this.options.numberParseOptions;if(i.skipLike?.test(t))return t;if(i.hex&&e===48&&X.test(t))return Number.parseInt(t,16);if(t.length>1&&e===48&&t.charCodeAt(1)!==46){if(i.leadingZeros)return t}if(i.scientific&&M.test(t)){let s=Number(t);if(!Number.isNaN(s))return s}if(G.test(t)){let s=Number(t);if(!Number.isNaN(s))return s}return t}parseAttributeValue(t){if(!this._parseAttributeValue)return t;return this.parseValue(t)}isStopNode(t){if(this.exactStopNodes.has(t))return!0;for(let e of this.wildcardStopSuffixes)if(t.endsWith(`.${e}`)||t===e)return!0;return!1}readStopNodeContent(t,e,r,i){let s=`</${i}`,a=t.indexOf(s,e);if(a===-1)return{content:t.substring(e),pos:r};let o=t.substring(e,a),c=a+s.length;while(c<r&&t.charCodeAt(c)!==62)c++;if(c<r)c++;return{content:o,pos:c}}addToObj(t,e,r,i,s,a){let o=t[e];if(o!==void 0)if(!Array.isArray(o))t[e]=[o,r];else o.push(r);else if(this.options.isArray?.(e,i,s,a))t[e]=[r];else t[e]=r}flushText(t,e,r,i){if(!t&&!e)return;let s=this._textNodeName;if(e){let a=t;if(a&&this._processEntities)a=this.entityDecoder.decodeEntities(a);let o=e+a;if(this._trimValues&&o.length>0){let c=o.charCodeAt(0),h=o.charCodeAt(o.length-1);if(c<=32||h<=32)o=o.trim()}if(this.options.tagValueProcessor){let c=this.options.tagValueProcessor(s,o,r,!1,!0);if(c!==void 0)o=c}if(o){let c=this._parseTagValue?this.parseValue(o):o;if(c!==void 0&&c!=="")this.addToObj(i,s,c,r,!0,!1)}}else{let a=this.processTagValue(t,s,r,!1,!0);if(a!==void 0&&a!=="")this.addToObj(i,s,a,r,!0,!1)}}parseChildren(t,e,r,i,s,a){let o="",c="",h=this.needsJPath;while(e<r){if(t.charCodeAt(e)!==60){let u=e;e++;while(e<r&&t.charCodeAt(e)!==60)e++;if(!o)o=t.substring(u,e);else o+=t.substring(u,e);continue}if(e+1>=r)break;let m=t.charCodeAt(e+1);if(m===33&&e+3<r&&t.charCodeAt(e+2)===45&&t.charCodeAt(e+3)===45){if(o||c)this.flushText(o,c,s,i),o="",c="";e+=4;let u=t.indexOf("-->",e);if(u===-1){e=r;break}if(this._commentPropName){let g=t.substring(e,u);this.addToObj(i,this._commentPropName,g,s,!0,!1)}e=u+3;continue}if(m===33&&e+8<r&&D(t,e+2)){e+=9;let u=t.indexOf("]]>",e);if(u===-1){e=r;break}let g=t.substring(e,u);if(this._cdataPropName)this.flushText(o,c,s,i),o="",c="",this.addToObj(i,this._cdataPropName,g,s,!0,!1);else{if(o){let y=o;if(this._processEntities)y=this.entityDecoder.decodeEntities(y);c+=y,o=""}c+=g}e=u+3;continue}if(m===33&&e+9<r&&k(t,e+2)){e+=9;let u=1;while(e<r&&u>0){let g=t.charCodeAt(e);if(g===60)u++;else if(g===62)u--;e++}continue}if(m===63){e+=2;let u=e;while(e<r&&!_(t.charCodeAt(e))&&t.charCodeAt(e)!==63)e++;let g=t.substring(u,e),y=t.indexOf("?>",e);if(y===-1){e=r;break}let N=t.substring(e,y).trim();if(g==="xml"){if(!this._ignoreDeclaration&&this._piPropName){let w=this.parsePiAttributes(N);this.addToObj(i,this._piPropName,{[g]:w},s,!0,!1)}}else if(!this._ignorePiTags&&this._piPropName)this.addToObj(i,this._piPropName,{[g]:N},s,!0,!1);e=y+2;continue}if(m===47){if(o||c)this.flushText(o,c,s,i),o="",c="";e+=2;let u=e,g=this.readTagName(t,e,r),y=this.extractTagName(t,u,g);e=g;while(e<r&&_(t.charCodeAt(e)))e++;if(e<r&&t.charCodeAt(e)===62)e++;if(a.length>0&&a[a.length-1]===y){a.pop();continue}return e}if(o||c)this.flushText(o,c,s,i),o="",c="";e++;let f=e,b=this.readTagName(t,e,r),p=this.extractTagName(t,f,b);if(!p){e=b+1;continue}e=b;let C=h?s?`${s}.${p}`:p:"",E={},d=!1;if(!this._ignoreAttributes){let u=this.parseAttributes(t,e,r,C,E);if(u<0)e=-u-1,d=!0;else e=u}else while(e<r){let u=t.charCodeAt(e);if(u===62||u===47)break;if(u===34||u===39){e++;while(e<r&&t.charCodeAt(e)!==u)e++}e++}if(this.options.updateTag){if(this.options.updateTag(p,C,E)===!1){while(e<r&&_(t.charCodeAt(e)))e++;if(e<r&&t.charCodeAt(e)===47)e+=2;else if(e<r&&t.charCodeAt(e)===62){e++;let g=`</${p}>`,y=t.indexOf(g,e);if(y!==-1)e=y+g.length}continue}}while(e<r&&_(t.charCodeAt(e)))e++;if(e<r&&t.charCodeAt(e)===47){if(e+=2,d||this._alwaysCreateTextNode){let u={};if(d)this.applyAttributes(u,E,C);if(this._alwaysCreateTextNode)u[this._textNodeName]="";this.addToObj(i,p,u,C,!0,!1)}else this.addToObj(i,p,"",C,!0,!1);continue}if(e<r&&t.charCodeAt(e)===62){if(e++,this.unpairedSet.has(p)){if(d){let N={};this.applyAttributes(N,E,C),this.addToObj(i,p,N,C,!0,!1)}else this.addToObj(i,p,"",C,!0,!1);a.push(p);continue}if(this.exactStopNodes.size>0||this.wildcardStopSuffixes.length>0){if(this.isStopNode(C)){let N=this.readStopNodeContent(t,e,r,p),w={};if(d)this.applyAttributes(w,E,C);if(N.content)w[this._textNodeName]=N.content;this.addToObj(i,p,w,C,!0,!1),e=N.pos;continue}}let u={};if(d)this.applyAttributes(u,E,C);e=this.parseChildren(t,e,r,u,C,a);let g=this._textNodeName,y=u[g];if(!d&&!this._alwaysCreateTextNode){let N=!0;for(let w in u)if(w!==g){N=!1;break}if(N){this.addToObj(i,p,y!==void 0?y:"",C,!0,!1);continue}}this.addToObj(i,p,u,C,!1,!1)}}if(o||c)this.flushText(o,c,s,i);return e}parseChildrenOrdered(t,e,r,i,s){let a="",o=this.needsJPath;while(e<r){if(t.charCodeAt(e)!==60){let d=e;e++;while(e<r&&t.charCodeAt(e)!==60)e++;if(!a)a=t.substring(d,e);else a+=t.substring(d,e);continue}if(e+1>=r)break;let h=t.charCodeAt(e+1);if(h===33&&e+3<r&&t.charCodeAt(e+2)===45&&t.charCodeAt(e+3)===45){if(a){let u=this.processTagValue(a,this._textNodeName,s,!1,!0);if(u!==void 0&&u!=="")i.push({[this._textNodeName]:u});a=""}e+=4;let d=t.indexOf("-->",e);if(d===-1){e=r;break}if(this._commentPropName)i.push({[this._commentPropName]:[{[this._textNodeName]:t.substring(e,d)}]});e=d+3;continue}if(h===33&&e+8<r&&D(t,e+2)){e+=9;let d=t.indexOf("]]>",e);if(d===-1){e=r;break}let u=t.substring(e,d);if(this._cdataPropName){if(a){let g=this.processTagValue(a,this._textNodeName,s,!1,!0);if(g!==void 0&&g!=="")i.push({[this._textNodeName]:g});a=""}i.push({[this._cdataPropName]:[{[this._textNodeName]:u}]})}else a+=u;e=d+3;continue}if(h===33&&e+9<r&&k(t,e+2)){e+=9;let d=1;while(e<r&&d>0){let u=t.charCodeAt(e);if(u===60)d++;else if(u===62)d--;e++}continue}if(h===63){e+=2;let d=t.indexOf("?>",e);if(d===-1){e=r;break}e=d+2;continue}if(h===47){if(a){let u=this.processTagValue(a,this._textNodeName,s,!1,!0);if(u!==void 0&&u!=="")i.push({[this._textNodeName]:u});a=""}e+=2,e=this.readTagName(t,e,r);while(e<r&&_(t.charCodeAt(e)))e++;if(e<r&&t.charCodeAt(e)===62)e++;return e}if(a){let d=this.processTagValue(a,this._textNodeName,s,!1,!0);if(d!==void 0&&d!=="")i.push({[this._textNodeName]:d});a=""}e++;let A=e,m=this.readTagName(t,e,r),f=this.extractTagName(t,A,m);if(!f){e=m+1;continue}e=m;let b=o?s?`${s}.${f}`:f:"",p={},C=!1;if(!this._ignoreAttributes){let d=this.parseAttributes(t,e,r,b,p);if(d<0)e=-d-1,C=!0;else e=d}else while(e<r){let d=t.charCodeAt(e);if(d===62||d===47)break;if(d===34||d===39){e++;while(e<r&&t.charCodeAt(e)!==d)e++}e++}while(e<r&&_(t.charCodeAt(e)))e++;let E={[f]:[]};if(C){E[":@"]={};for(let u in p)E[":@"][this._attrPrefix+u]=this.parseAttributeValue(p[u])}if(e<r&&t.charCodeAt(e)===47){e+=2,i.push(E);continue}if(e<r&&t.charCodeAt(e)===62)e++,e=this.parseChildrenOrdered(t,e,r,E[f],b),i.push(E)}if(a){let c=this.processTagValue(a,this._textNodeName,s,!1,!0);if(c!==void 0&&c!=="")i.push({[this._textNodeName]:c})}return e}applyAttributes(t,e,r){let i=this._attrPrefix;if(this._attrsGroupName){let s={};for(let a in e)s[i+a]=this.parseAttributeValue(e[a]);t[this._attrsGroupName]=s}else for(let s in e)t[i+s]=this.parseAttributeValue(e[s])}parsePiAttributes(t){let e={},r=0,i=t.length;while(r<i){while(r<i&&_(t.charCodeAt(r)))r++;if(r>=i)break;let s=r;while(r<i&&!_(t.charCodeAt(r))&&t.charCodeAt(r)!==61)r++;let a=t.substring(s,r);if(!a)break;while(r<i&&_(t.charCodeAt(r)))r++;if(r<i&&t.charCodeAt(r)===61){r++;while(r<i&&_(t.charCodeAt(r)))r++;if(r<i){let o=t.charCodeAt(r);if(o===34||o===39){r++;let c=r;while(r<i&&t.charCodeAt(r)!==o)r++;if(e[a]=t.substring(c,r),r<i)r++}}}}return e}}function br(t){let e=t.endpoint||`s3.${t.region}.amazonaws.com`,r=new URL(/^https?:\/\//i.test(e)?e:`https://${e}`);if(r.protocol!=="http:"&&r.protocol!=="https:"||r.pathname!=="/"&&r.pathname!==""||r.search||r.hash||r.username||r.password)throw Error("S3 endpoint must be an HTTP(S) origin without a path");let i=r.protocol.slice(0,-1),s=r.host;if(!t.bucket)return{protocol:i,host:s,path:t.path};if(t.forcePathStyle){let a=t.path==="/"?`/${t.bucket}`:`/${t.bucket}${t.path}`;return{protocol:i,host:s,path:a}}return{protocol:i,host:`${t.bucket}.${s}`,path:t.path}}class n{credentials;config;cache;xmlParser;constructor(t,e){this.config={maxRetries:3,retryDelay:1000,cacheEnabled:!0,defaultCacheTTL:60000,...e},this.credentials=t||this.loadCredentials(),this.cache=new Map,this.xmlParser=new v({ignoreAttributes:!1,attributeNamePrefix:"@_",textNodeName:"#text",parseAttributeValue:!0,trimValues:!0})}loadCredentials(){let t=process.env.AWS_ACCESS_KEY_ID,e=process.env.AWS_SECRET_ACCESS_KEY,r=process.env.AWS_SESSION_TOKEN;if(t&&e)return{accessKeyId:t,secretAccessKey:e,sessionToken:r};let i=this.loadCredentialsFromFile();if(i)return i;return{accessKeyId:"",secretAccessKey:""}}loadCredentialsFromFile(){let t=this.config?.profile||process.env.AWS_PROFILE||"default",e=process.env.AWS_SHARED_CREDENTIALS_FILE||K(B(),".aws","credentials");if(!W(e))return null;try{let r=J(e,"utf-8"),i=this.parseCredentialsFile(r,t);if(i.accessKeyId&&i.secretAccessKey)return i}catch{}return null}parseCredentialsFile(t,e){let r=t.split(`
+`),i="",s="",a="",o;for(let c of r){let h=c.trim();if(!h||h.startsWith("#"))continue;let A=h.match(/^\[([^\]]+)\]$/);if(A){i=A[1];continue}if(i===e){let[m,...f]=h.split("="),b=f.join("=").trim();if(m.trim()==="aws_access_key_id")s=b;else if(m.trim()==="aws_secret_access_key")a=b;else if(m.trim()==="aws_session_token")o=b}}return{accessKeyId:s,secretAccessKey:a,sessionToken:o}}ec2CredentialsCache;async getCredentials(){let t=process.env.AWS_ACCESS_KEY_ID,e=process.env.AWS_SECRET_ACCESS_KEY;if(t&&e)return{accessKeyId:t,secretAccessKey:e,sessionToken:process.env.AWS_SESSION_TOKEN};let r=this.loadCredentialsFromFile();if(r)return r;if(this.ec2CredentialsCache){let i=Date.now();if(this.ec2CredentialsCache.expiration>i+300000)return this.ec2CredentialsCache.credentials}try{let s=await(await fetch("http://169.254.169.254/latest/api/token",{method:"PUT",headers:{"X-aws-ec2-metadata-token-ttl-seconds":"21600"}})).text(),o=await(await fetch("http://169.254.169.254/latest/meta-data/iam/security-credentials/",{headers:{"X-aws-ec2-metadata-token":s}})).text(),h=await(await fetch(`http://169.254.169.254/latest/meta-data/iam/security-credentials/${o}`,{headers:{"X-aws-ec2-metadata-token":s}})).json(),A={accessKeyId:h.AccessKeyId,secretAccessKey:h.SecretAccessKey,sessionToken:h.Token};return this.ec2CredentialsCache={credentials:A,expiration:new Date(h.Expiration).getTime()},A}catch(i){throw Error("AWS credentials not found. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables, or run on an EC2 instance with an IAM role.")}}async request(t){if(t.method==="GET"&&this.config.cacheEnabled&&t.cacheKey){let i=this.getFromCache(t.cacheKey);if(i!==null)return i}let e=t.retries??this.config.maxRetries??3,r=null;for(let i=0;i<=e;i++)try{let s=await this.makeRequest(t);if(t.method==="GET"&&this.config.cacheEnabled&&t.cacheKey)this.setInCache(t.cacheKey,s,t.cacheTTL??this.config.defaultCacheTTL??60000);return s}catch(s){if(r=s,!this.shouldRetry(s))throw s;if(i===e)throw s;let o=this.calculateRetryDelay(i);await this.sleep(o)}throw r||Error("Request failed after retries")}async makeRequest(t){let e=t.credentials||(this.credentials?.accessKeyId?this.credentials:await this.getCredentials());if(!e||!e.accessKeyId||!e.secretAccessKey)throw Error("AWS credentials not provided");let r=this.buildUrl(t),i=this.signRequest(t,e),s=await fetch(r,{method:t.method,headers:i,body:t.body}),a=await s.text();if(!s.ok)throw this.parseError(a,s.status,s.headers);if(!a||a.trim()===""){if(t.returnHeaders)return{body:null,headers:this.headersToObject(s.headers)};return null}if(t.rawResponse){if(t.returnHeaders)return{body:a,headers:this.headersToObject(s.headers)};return a}let o;if(a.startsWith("<"))o=this.parseXmlResponse(a);else try{o=JSON.parse(a)}catch{o=a}if(t.returnHeaders)return{body:o,headers:this.headersToObject(s.headers)};return o}headersToObject(t){let e={};return t.forEach((r,i)=>{e[i]=r}),e}buildUrl(t){let{service:e,region:r,queryParams:i}=t,{path:s}=t,a,o="https";if(e==="s3"){let h=br({region:r,path:s,bucket:t.bucket,endpoint:this.config.endpoint,forcePathStyle:this.config.forcePathStyle});o=h.protocol,a=h.host,s=h.path}else if(e==="cloudfront")a="cloudfront.amazonaws.com";else if(e==="iam")a="iam.amazonaws.com";else if(e==="route53")a="route53.amazonaws.com";else if(e==="route53domains")a="route53domains.us-east-1.amazonaws.com";else if(e==="ecr")a=`api.ecr.${r}.amazonaws.com`;else if(e==="ses")a=`email.${r}.amazonaws.com`;else a=`${e}.${r}.amazonaws.com`;let c=`${o}://${a}${s}`;if(i&&Object.keys(i).length>0){let h=Object.keys(i).map((A)=>`${this.uriEncode(A)}=${this.uriEncode(i[A])}`).join("&");c+=`?${h}`}return c}signRequest(t,e){let{service:r,region:i,method:s,queryParams:a,body:o}=t,{path:c}=t,h=new Date,A=this.getAmzDate(h),m=this.getDateStamp(h),f;if(r==="s3"){let S=br({region:i,path:c,bucket:t.bucket,endpoint:this.config.endpoint,forcePathStyle:this.config.forcePathStyle});f=S.host,c=S.path}else if(r==="cloudfront")f="cloudfront.amazonaws.com";else if(r==="iam")f="iam.amazonaws.com";else if(r==="route53")f="route53.amazonaws.com";else if(r==="route53domains")f="route53domains.us-east-1.amazonaws.com";else if(r==="ecr")f=`api.ecr.${i}.amazonaws.com`;else if(r==="ses")f=`email.${i}.amazonaws.com`;else f=`${r}.${i}.amazonaws.com`;let b={host:f,"x-amz-date":A,...t.headers||{}};if(e.sessionToken)b["x-amz-security-token"]=e.sessionToken;if(o){if(!Object.keys(b).some((O)=>O.toLowerCase()==="content-type"))b["content-type"]="application/x-www-form-urlencoded";b["content-length"]=Buffer.byteLength(o).toString()}let p=this.sha256(o||"");b["x-amz-content-sha256"]=p;let C=c,E=a?Object.keys(a).sort().map((S)=>`${this.uriEncode(S)}=${this.uriEncode(a[S])}`).join("&"):"",d=Object.keys(b).sort((S,O)=>S.toLowerCase().localeCompare(O.toLowerCase())),u=d.map((S)=>`${S.toLowerCase()}:${b[S].trim()}
 `).join(""),g=d.map((S)=>S.toLowerCase()).join(";"),y=[s,C,E,u,g,p].join(`
 `),N="AWS4-HMAC-SHA256",w=r;if(r==="email")w="ses";let I=`${m}/${i}/${w}/aws4_request`,F=[N,A,I,this.sha256(y)].join(`
-`),q=this.getSignatureKey(e.secretAccessKey,m,i,w),U=this.hmac(q,F),j=`${N} Credential=${e.accessKeyId}/${I}, SignedHeaders=${g}, Signature=${U}`;return{...b,Authorization:j}}getAmzDate(t){return t.toISOString().replace(/[:-]|\.\d{3}/g,"")}getDateStamp(t){return t.toISOString().slice(0,10).replace(/-/g,"")}uriEncode(t){return encodeURIComponent(t).replace(/[!'()*]/g,(e)=>`%${e.charCodeAt(0).toString(16).toUpperCase()}`)}sha256(t){return T.createHash("sha256").update(t,"utf8").digest("hex")}hmac(t,e){return T.createHmac("sha256",t).update(e,"utf8").digest("hex")}getSignatureKey(t,e,r,i){let s=T.createHmac("sha256",`AWS4${t}`).update(e).digest(),a=T.createHmac("sha256",s).update(r).digest(),o=T.createHmac("sha256",a).update(i).digest();return T.createHmac("sha256",o).update("aws4_request").digest()}parseXmlResponse(t){try{let e=this.xmlParser.parse(t);if(e.ErrorResponse)throw this.createErrorFromXml(e.ErrorResponse.Error);let r=Object.keys(e);if(r.length===1)return e[r[0]];return e}catch(e){if(e.code||e.statusCode)throw e;return{}}}parseError(t,e,r){let i=Error();if(i.statusCode=e,i.requestId=r.get("x-amzn-requestid")||r.get("x-amz-request-id")||void 0,t.startsWith("<"))try{let s=this.xmlParser.parse(t);if(s.ErrorResponse?.Error){let a=s.ErrorResponse.Error;return i.code=a.Code,i.message=`AWS Error [${a.Code}]: ${a.Message||"Unknown error"}`,i.type=a.Type,i}if(s.Error)return i.code=s.Error.Code,i.message=`AWS Error [${s.Error.Code}]: ${s.Error.Message||"Unknown error"}`,i}catch{}try{let s=JSON.parse(t);if(s.__type||s.code)return i.code=s.__type||s.code,i.message=`AWS Error [${i.code}]: ${s.message||s.Message||"Unknown error"}`,i}catch{}return i.message=`AWS API Error (${e}): ${t}`,i}createErrorFromXml(t){let e=Error();return e.code=t.Code,e.message=`AWS Error [${t.Code}]: ${t.Message||"Unknown error"}`,e.type=t.Type,e}isRetryableError(t){return["RequestTimeout","RequestTimeoutException","PriorRequestNotComplete","ConnectionError","ThrottlingException","Throttling","TooManyRequestsException","ProvisionedThroughputExceededException","RequestLimitExceeded","BandwidthLimitExceeded","SlowDown","ServiceUnavailable","ServiceUnavailableException","InternalError","InternalFailure","InternalServerError","InternalServiceException","TransientError","TransientFailure","IDPCommunicationErrorException","NetworkError","ConnectionRefusedException","EC2ThrottledException","503 Slow Down","500 InternalError"].includes(t)}isRetryableStatusCode(t){return t>=500||t===429}shouldRetry(t){if(t.name==="FetchError"||t.name==="TypeError"||t.code==="ECONNRESET")return!0;if(t.code&&this.isRetryableError(t.code))return!0;if(t.statusCode&&this.isRetryableStatusCode(t.statusCode))return!0;if(t.statusCode&&t.statusCode>=400&&t.statusCode<500&&t.statusCode!==429)return!1;if(t.statusCode)return!1;return!0}calculateRetryDelay(t){let e=this.config.retryDelay??1000,r=30000,i=Math.min(e*2**t,30000),s=Math.random()*0.3*i;return i+s}sleep(t){return new Promise((e)=>setTimeout(e,t))}getFromCache(t){let e=this.cache.get(t);if(!e)return null;if(Date.now()>e.expires)return this.cache.delete(t),null;return e.data}setInCache(t,e,r){this.cache.set(t,{data:e,expires:Date.now()+r})}clearCache(){this.cache.clear()}clearExpiredCache(){let t=Date.now();for(let[e,r]of this.cache.entries())if(t>r.expires)this.cache.delete(e)}}function l(t){let e={};for(let[r,i]of Object.entries(t)){if(i===void 0||i===null)continue;if(Array.isArray(i))i.forEach((s,a)=>{e[`${r}.${a+1}`]=String(s)});else if(typeof i==="object")for(let[s,a]of Object.entries(i))e[`${r}.${s}`]=String(a);else e[r]=String(i)}return e}function Bh(){let t=process.env.AWS_ACCESS_KEY_ID,e=process.env.AWS_SECRET_ACCESS_KEY,r=t==="",i=e==="";if(t&&e)return{source:"env",emptyEnvKey:r,emptyEnvSecret:i,description:"environment variables (AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY)"};let s=process.env.AWS_PROFILE||"default",a=process.env.AWS_SHARED_CREDENTIALS_FILE||K(B(),".aws","credentials");if(W(a))return{source:"file",profile:s,emptyEnvKey:r,emptyEnvSecret:i,description:`~/.aws/credentials (profile: ${s})`};return{source:"ec2",emptyEnvKey:r,emptyEnvSecret:i,description:"EC2 instance metadata service (IMDSv2)"}}
-export{Sr,n,l,Bh};
+`),q=this.getSignatureKey(e.secretAccessKey,m,i,w),U=this.hmac(q,F),j=`${N} Credential=${e.accessKeyId}/${I}, SignedHeaders=${g}, Signature=${U}`;return{...b,Authorization:j}}getAmzDate(t){return t.toISOString().replace(/[:-]|\.\d{3}/g,"")}getDateStamp(t){return t.toISOString().slice(0,10).replace(/-/g,"")}uriEncode(t){return encodeURIComponent(t).replace(/[!'()*]/g,(e)=>`%${e.charCodeAt(0).toString(16).toUpperCase()}`)}sha256(t){return T.createHash("sha256").update(t,"utf8").digest("hex")}hmac(t,e){return T.createHmac("sha256",t).update(e,"utf8").digest("hex")}getSignatureKey(t,e,r,i){let s=T.createHmac("sha256",`AWS4${t}`).update(e).digest(),a=T.createHmac("sha256",s).update(r).digest(),o=T.createHmac("sha256",a).update(i).digest();return T.createHmac("sha256",o).update("aws4_request").digest()}parseXmlResponse(t){try{let e=this.xmlParser.parse(t);if(e.ErrorResponse)throw this.createErrorFromXml(e.ErrorResponse.Error);let r=Object.keys(e);if(r.length===1)return e[r[0]];return e}catch(e){if(e.code||e.statusCode)throw e;return{}}}parseError(t,e,r){let i=Error();if(i.statusCode=e,i.requestId=r.get("x-amzn-requestid")||r.get("x-amz-request-id")||void 0,t.startsWith("<"))try{let s=this.xmlParser.parse(t);if(s.ErrorResponse?.Error){let a=s.ErrorResponse.Error;return i.code=a.Code,i.message=`AWS Error [${a.Code}]: ${a.Message||"Unknown error"}`,i.type=a.Type,i}if(s.Error)return i.code=s.Error.Code,i.message=`AWS Error [${s.Error.Code}]: ${s.Error.Message||"Unknown error"}`,i}catch{}try{let s=JSON.parse(t);if(s.__type||s.code)return i.code=s.__type||s.code,i.message=`AWS Error [${i.code}]: ${s.message||s.Message||"Unknown error"}`,i}catch{}return i.message=`AWS API Error (${e}): ${t}`,i}createErrorFromXml(t){let e=Error();return e.code=t.Code,e.message=`AWS Error [${t.Code}]: ${t.Message||"Unknown error"}`,e.type=t.Type,e}isRetryableError(t){return["RequestTimeout","RequestTimeoutException","PriorRequestNotComplete","ConnectionError","ThrottlingException","Throttling","TooManyRequestsException","ProvisionedThroughputExceededException","RequestLimitExceeded","BandwidthLimitExceeded","SlowDown","ServiceUnavailable","ServiceUnavailableException","InternalError","InternalFailure","InternalServerError","InternalServiceException","TransientError","TransientFailure","IDPCommunicationErrorException","NetworkError","ConnectionRefusedException","EC2ThrottledException","503 Slow Down","500 InternalError"].includes(t)}isRetryableStatusCode(t){return t>=500||t===429}shouldRetry(t){if(t.name==="FetchError"||t.name==="TypeError"||t.code==="ECONNRESET")return!0;if(t.code&&this.isRetryableError(t.code))return!0;if(t.statusCode&&this.isRetryableStatusCode(t.statusCode))return!0;if(t.statusCode&&t.statusCode>=400&&t.statusCode<500&&t.statusCode!==429)return!1;if(t.statusCode)return!1;return!0}calculateRetryDelay(t){let e=this.config.retryDelay??1000,r=30000,i=Math.min(e*2**t,30000),s=Math.random()*0.3*i;return i+s}sleep(t){return new Promise((e)=>setTimeout(e,t))}getFromCache(t){let e=this.cache.get(t);if(!e)return null;if(Date.now()>e.expires)return this.cache.delete(t),null;return e.data}setInCache(t,e,r){this.cache.set(t,{data:e,expires:Date.now()+r})}clearCache(){this.cache.clear()}clearExpiredCache(){let t=Date.now();for(let[e,r]of this.cache.entries())if(t>r.expires)this.cache.delete(e)}}function l(t){let e={};for(let[r,i]of Object.entries(t)){if(i===void 0||i===null)continue;if(Array.isArray(i))i.forEach((s,a)=>{e[`${r}.${a+1}`]=String(s)});else if(typeof i==="object")for(let[s,a]of Object.entries(i))e[`${r}.${s}`]=String(a);else e[r]=String(i)}return e}function Wh(){let t=process.env.AWS_ACCESS_KEY_ID,e=process.env.AWS_SECRET_ACCESS_KEY,r=t==="",i=e==="";if(t&&e)return{source:"env",emptyEnvKey:r,emptyEnvSecret:i,description:"environment variables (AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY)"};let s=process.env.AWS_PROFILE||"default",a=process.env.AWS_SHARED_CREDENTIALS_FILE||K(B(),".aws","credentials");if(W(a))return{source:"file",profile:s,emptyEnvKey:r,emptyEnvSecret:i,description:`~/.aws/credentials (profile: ${s})`};return{source:"ec2",emptyEnvKey:r,emptyEnvSecret:i,description:"EC2 instance metadata service (IMDSv2)"}}
+export{br,n,l,Wh};

package/dist/deploy/index.d.ts

@@ -9,6 +9,7 @@ export * from './server-dns';
 export * from './dashboard-control-plane';
 export * from './dashboard-route-manifest';
 export * from './static-site';
+export * from './storage-failover';
 export * from './static-site-external-dns';
 export * from './static-site-helper';
 export * from './static-api-origin';

package/dist/deploy/index.js

@@ -1 +1 @@
-import{Zr,en,Fl,qi,Ul,Ql,Hl,pa,Gl,ql,Vm,Vl,S,jl,Vi,Pe,zl,Kl,ey,Wl,jm,ty,ry,ny,zm,Km,iy,sy,Wm,Jm,oy,ji,Wt,ga,tn,rn,Jt,Je,It,zi,Xm,nn,Jl,Xl,ma,Wi,on,Ji,Da}from"../chunk-ynjfj2rt.js";import{Pa,an,cn,Xi,Yi,Zi,es,Na,ka}from"../chunk-m1x32x81.js";import{Ba}from"../chunk-6jzg0gtw.js";import"../chunk-1ayadqry.js";import"../chunk-81yetzg2.js";import"../chunk-nz3ygqjb.js";import"../chunk-mytcpvg5.js";import"../chunk-3rh4m6ag.js";import"../chunk-z13hksc9.js";import"../chunk-2vr8rqg8.js";import{mu,Ka,ye,Wa,En,hu,Ja,Ic,Rs,Sc,Nt,Yn,Ds}from"../chunk-4bcf62qk.js";import"../chunk-ygrxsjcz.js";import"../chunk-f3hhmec2.js";import"../chunk-fw9hk0xt.js";import"../chunk-590gwv9d.js";import{ot,nf,wc,ni,ii,si,Ip}from"../chunk-x3xs6qvx.js";import{B,Cr,Er,Rc,ks,u,sf,Sp,Cp,$y,My}from"../chunk-hasa64d4.js";import"../chunk-nca98yaf.js";import"../chunk-6m18fz5f.js";export{nf as DEFAULT_SITE_PORT_RANGE,ot as HOST_SITES_DIR,Wa as IPV6_EXCLUDED_HOST_LABELS,Ic as MANAGEMENT_DASHBOARD_SITE,Zr as addSiteToCloudConfig,Ip as allocateSitePorts,oy as buildAndPushContainerImage,Ba as buildAndPushServerlessImage,Wt as buildFunctionEnv,ii as buildHostSitePortsScript,Ds as buildManagementDashboardArtifact,It as buildServerTopology,zi as buildServerlessTopology,Xm as buildTopology,ma as collectEgressMetrics,mu as collectServerDnsDomains,Jm as createContainerImageDependencies,zm as createExistingStaticFullStackDependencies,jm as createStaticApiOriginDependencies,on as dashboardActions,Rs as dashboardCredentialsFile,zl as dashboardPageRoutes,Na as deleteStaticSite,iy as deployExistingStaticFullStack,ga as deployServerlessApp,My as deployShipsFiles,Wl as deploySite,ty as deployStaticApiOrigin,Yi as deployStaticSite,ka as deployStaticSiteFull,an as deployStaticSiteWithExternalDns,cn as deployStaticSiteWithExternalDnsFull,Jl as egressReportMetrics,S as ensureDashboardActor,Yn as ensureManagementDashboard,sy as estimateExistingStaticFullStackMonthlyCost,ny as estimateStaticApiOriginMonthlyCost,Xl as fetchEgressReport,Km as generateExistingStaticFullStackTemplate,Pa as generateExternalDnsStaticSiteTemplate,Xi as generateStaticSiteTemplate,sf as hasComputeConfigured,Rc as hasProxyUpstream,Wm as hashContainerContext,En as hostAcceptsIpv6,ji as infraEnvFromOutputs,jl as initializeDashboardControlPlane,es as invalidateCache,Cr as isPhpSite,pa as isValidHostname,ye as normalizePublicIpv6,ni as occupiedHostPorts,si as parseHostSiteFragments,wc as parseUpstreamPort,hu as reconcileAddressRecords,tn as redeployServerlessApp,en as removeSiteFromCloudConfig,Ka as removeStaleServerAddressRecords,Gl as renderAliasesValue,Hl as renderEnvValue,ql as renderRedirectsValue,Vm as renderSiteSnippet,Ul as renderSslValue,Ql as renderStringValue,Ji as resolveDashboardAction,Sc as resolveDashboardAuth,nn as resolveDashboardData,Kl as resolveLegacyDashboardRoute,Er as resolveProxyUpstreams,ks as resolveSiteDeployTarget,u as resolveSiteKind,Nt as resolveUiSource,rn as rollbackServerlessApp,ey as routesForDashboard,Je as runRemoteCommand,Wi as sanitizeCloudConfig,Vl as setAttachToInCloudConfig,Jt as setMaintenance,qi as setSitePropertyInCloudConfig,Cp as shipsARelease,$y as shipsToBucket,B as siteInstallBase,Da as startLocalDashboardServer,Vi as synchronizeDashboardUsers,Pe as trackDashboardOperation,Fl as updateSiteInCloudConfig,Zi as uploadStaticFiles,Sp as validateDeploymentConfig,Ja as verifyAddressRecord,ry as verifyStaticApiOrigin};
+import{rn,nn,Vl,ji,jl,zl,Kl,ha,Wl,Jl,ch,Xl,S,Yl,zi,Ne,Zl,eu,Ay,tu,ru,nu,iu,su,dh,yy,Iy,Sy,lh,uh,Cy,Ey,ph,gh,by,Ki,Yt,fa,sn,on,Zt,Xe,St,Wi,mh,an,ou,au,Aa,Xi,dn,Yi,ka}from"../chunk-bcy9z4ks.js";import{Ba,ln,un,Zi,es,ts,rs,_a,Oa}from"../chunk-hyeeqga9.js";import{xa}from"../chunk-7xnwa0s8.js";import"../chunk-2m262b2n.js";import"../chunk-r1wpwfff.js";import"../chunk-31tvc877.js";import"../chunk-5far81q7.js";import"../chunk-k53agv2m.js";import"../chunk-e8e1h2h9.js";import"../chunk-9wmer0zx.js";import{vu,Xa,ye,Ya,Tn,Tu,Za,Ec,Ps,bc,kt,ti,Ns}from"../chunk-5255nr93.js";import"../chunk-qcaqc5b8.js";import"../chunk-ptq9v346.js";import"../chunk-9asn5fpt.js";import"../chunk-zx8ecz8b.js";import{at,Cf,Pc,oi,ai,ci,Pp}from"../chunk-w9jhyy09.js";import{B,vr,Tr,Nc,_s,u,Ef,Np,kp,eI,tI}from"../chunk-3m9ghthh.js";import"../chunk-kczzc599.js";import"../chunk-v2p7c7s4.js";export{Cf as DEFAULT_SITE_PORT_RANGE,at as HOST_SITES_DIR,Ya as IPV6_EXCLUDED_HOST_LABELS,Ec as MANAGEMENT_DASHBOARD_SITE,rn as addSiteToCloudConfig,Pp as allocateSitePorts,by as buildAndPushContainerImage,xa as buildAndPushServerlessImage,Yt as buildFunctionEnv,ai as buildHostSitePortsScript,Ns as buildManagementDashboardArtifact,St as buildServerTopology,Wi as buildServerlessTopology,mh as buildTopology,Aa as collectEgressMetrics,vu as collectServerDnsDomains,gh as createContainerImageDependencies,lh as createExistingStaticFullStackDependencies,dh as createStaticApiOriginDependencies,dn as dashboardActions,Ps as dashboardCredentialsFile,Zl as dashboardPageRoutes,iu as deleteFailoverReplicaBuckets,_a as deleteStaticSite,Cy as deployExistingStaticFullStack,fa as deployServerlessApp,tI as deployShipsFiles,su as deploySite,yy as deployStaticApiOrigin,es as deployStaticSite,Oa as deployStaticSiteFull,ln as deployStaticSiteWithExternalDns,un as deployStaticSiteWithExternalDnsFull,ou as egressReportMetrics,S as ensureDashboardActor,tu as ensureFailoverReplicaBuckets,ti as ensureManagementDashboard,Ey as estimateExistingStaticFullStackMonthlyCost,Sy as estimateStaticApiOriginMonthlyCost,au as fetchEgressReport,uh as generateExistingStaticFullStackTemplate,Ba as generateExternalDnsStaticSiteTemplate,Zi as generateStaticSiteTemplate,ru as grantFailoverReplicaAccess,Ef as hasComputeConfigured,Nc as hasProxyUpstream,ph as hashContainerContext,Tn as hostAcceptsIpv6,Ki as infraEnvFromOutputs,Yl as initializeDashboardControlPlane,rs as invalidateCache,vr as isPhpSite,ha as isValidHostname,ye as normalizePublicIpv6,oi as occupiedHostPorts,ci as parseHostSiteFragments,Pc as parseUpstreamPort,Tu as reconcileAddressRecords,sn as redeployServerlessApp,nn as removeSiteFromCloudConfig,Xa as removeStaleServerAddressRecords,Wl as renderAliasesValue,Kl as renderEnvValue,Jl as renderRedirectsValue,ch as renderSiteSnippet,jl as renderSslValue,zl as renderStringValue,Yi as resolveDashboardAction,bc as resolveDashboardAuth,an as resolveDashboardData,eu as resolveLegacyDashboardRoute,Tr as resolveProxyUpstreams,_s as resolveSiteDeployTarget,u as resolveSiteKind,kt as resolveUiSource,on as rollbackServerlessApp,Ay as routesForDashboard,Xe as runRemoteCommand,Xi as sanitizeCloudConfig,nu as seedFailoverReplicas,Xl as setAttachToInCloudConfig,Zt as setMaintenance,ji as setSitePropertyInCloudConfig,kp as shipsARelease,eI as shipsToBucket,B as siteInstallBase,ka as startLocalDashboardServer,zi as synchronizeDashboardUsers,Ne as trackDashboardOperation,Vl as updateSiteInCloudConfig,ts as uploadStaticFiles,Np as validateDeploymentConfig,Za as verifyAddressRecord,Iy as verifyStaticApiOrigin};

package/dist/deploy/storage-failover.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Deploy-time half of cross-region bucket failover (stacksjs/stacks#1159).
+ *
+ * The generated stack replicates a website bucket into a replica in another
+ * region and puts both behind one CloudFront origin group, but it cannot
+ * create the replica: a CloudFormation stack only makes buckets in its own
+ * region. The template lists the replicas it needs under
+ * `Metadata['TsCloud::StorageFailover']` (read it with
+ * `storageFailoverReplicasFromTemplate`), and a deployer runs:
+ *
+ * 1. {@link ensureFailoverReplicaBuckets} before creating or updating the
+ *    stack, because S3 rejects a replication rule whose destination bucket is
+ *    missing or unversioned;
+ * 2. {@link grantFailoverReplicaAccess} after the stack, once the
+ *    distribution exists, so origin access control can read the replica;
+ * 3. {@link seedFailoverReplicas} after uploading content, to copy across
+ *    objects written before replication was turned on (S3 replication only
+ *    copies new writes).
+ *
+ * {@link deleteFailoverReplicaBuckets} removes them again; nothing calls it
+ * automatically, since the replica is the copy that survives losing the stack.
+ */
+import type { StorageFailoverReplica } from '@ts-cloud/core';
+export type FailoverLogger = (message: string) => void;
+/**
+ * Create each replica bucket if it is missing, and make sure it is private,
+ * encrypted, and (when the primary replicates into it) versioned. Idempotent.
+ *
+ * @throws when the bucket name is taken in another region or by another account.
+ */
+export declare function ensureFailoverReplicaBuckets(replicas: readonly StorageFailoverReplica[], log?: FailoverLogger): Promise<void>;
+/**
+ * Let each stack's distribution read its replica through origin access
+ * control, by adding (or replacing) one statement in the replica's bucket
+ * policy. Other statements in that policy are kept.
+ *
+ * @param outputs The stack outputs; each replica names the output holding its distribution ARN.
+ * @throws when an output is missing, which means the stack did not deploy the distribution.
+ */
+export declare function grantFailoverReplicaAccess(replicas: readonly StorageFailoverReplica[], outputs: Record<string, string>, log?: FailoverLogger): Promise<void>;
+/**
+ * Copy objects the replica is missing (or holds at a different size) from the
+ * primary. S3 replication only copies writes made after it was configured, so
+ * a site that turns failover on later would otherwise fail over to an empty
+ * bucket. Objects are copied server side.
+ *
+ * @returns how many objects were copied per replica.
+ */
+export declare function seedFailoverReplicas(replicas: readonly StorageFailoverReplica[], log?: FailoverLogger): Promise<Record<string, number>>;
+/**
+ * Empty (every version and delete marker) and delete each replica bucket.
+ * Never called by a deploy: use it to tear down a site you are removing.
+ */
+export declare function deleteFailoverReplicaBuckets(replicas: readonly StorageFailoverReplica[], log?: FailoverLogger): Promise<void>;

package/dist/dns/index.js

@@ -1 +1 @@
-import{tt,se,_e,Ae,Tt,In,cs,ds,nr,ir,Sn,sr,ls,us,ps,gs,z,ms,hs,fs,As,oe,ys,Is,Ss,T,ja,Cn,za}from"../chunk-z13hksc9.js";import"../chunk-2vr8rqg8.js";import"../chunk-590gwv9d.js";export{Ae as CloudflareProvider,Cn as DnsProviderFactory,_e as GoDaddyProvider,tt as PROXIABLE_RECORD_TYPES,se as PorkbunProvider,z as Route53Provider,oe as UnifiedDnsValidator,ps as applyDeclaredZoneSettings,fs as applyZoneMigration,T as createDnsProvider,Is as createGoDaddyValidator,ys as createPorkbunValidator,Ss as createRoute53Validator,sr as delegateZone,ls as delegateZoneFromConfig,us as describeDelegation,gs as describeZoneSettings,ja as detectDnsProvider,za as dnsProviders,ms as exportRoute53Zone,nr as isNameserverRegistrar,ir as isZoneHost,hs as planZoneMigration,Tt as policyTag,In as qualifyName,ds as reconcileDeclaredRecords,cs as resolveDeclaredRecords,Sn as sameNameservers,As as verifyZoneParity};
+import{rt,se,Oe,Ae,wt,En,ls,us,or,ar,bn,cr,ps,gs,ms,hs,z,fs,As,ys,Is,oe,Ss,Cs,Es,T,Wa,vn,Ja}from"../chunk-e8e1h2h9.js";import"../chunk-9wmer0zx.js";import"../chunk-zx8ecz8b.js";export{Ae as CloudflareProvider,vn as DnsProviderFactory,Oe as GoDaddyProvider,rt as PROXIABLE_RECORD_TYPES,se as PorkbunProvider,z as Route53Provider,oe as UnifiedDnsValidator,ms as applyDeclaredZoneSettings,ys as applyZoneMigration,T as createDnsProvider,Cs as createGoDaddyValidator,Ss as createPorkbunValidator,Es as createRoute53Validator,cr as delegateZone,ps as delegateZoneFromConfig,gs as describeDelegation,hs as describeZoneSettings,Wa as detectDnsProvider,Ja as dnsProviders,fs as exportRoute53Zone,or as isNameserverRegistrar,ar as isZoneHost,As as planZoneMigration,wt as policyTag,En as qualifyName,us as reconcileDeclaredRecords,ls as resolveDeclaredRecords,bn as sameNameservers,Is as verifyZoneParity};

package/dist/drivers/index.js

@@ -1 +1 @@
-import{bn,wt,ar,Rt,vn,Tn,wn,Rn,Iu,Xa,K,lr,gh,Dn,Ya,Ie,Se,xe,N,ur,Pn,pr,ce,Za,Nn,ec,kn,tc,gr,mh,hh,Cu,Eu,fh,Ah,yh,mr,Bn,bu,bs,_n,xn,On,Ln,$n,rc,nc,hr,sc,Oe,W,oc,rt,Le,$e,nt,Ce,vs,ac,vu,Tu,cc,wu,it,Mn,dc,Ru,Du,lc,fr,Ee,uc,Pu,Nu,Ts,Un,st,ku,Bu,_u,xu,Ou,Lu,$u,Mu,Fu,Qn,Hn,Gn,qn,Vn,jn,zn,Uu,Qu,Ar,k,ws,Hu,Gu,qu,pc,Vu,ju,Ih,gc,Sh,Ch,zu,Ku,Eh,bh,vh,mc,Wu,Th,wh,Rh,Kn,Wn,Jn,Xn,hc,fc,Ac,yc,Dh,Ps,Cc,Zn,Ec,Ju,Xu,Yu,Ph}from"../chunk-4bcf62qk.js";import"../chunk-ygrxsjcz.js";import"../chunk-f3hhmec2.js";import"../chunk-fw9hk0xt.js";import"../chunk-590gwv9d.js";import"../chunk-hasa64d4.js";import"../chunk-6m18fz5f.js";export{yc as AwsBoxProvisioner,ur as AwsDriver,qu as BOOT_PARTITION_LABEL,ws as CloudDriverFactory,Eu as DEFAULT_HOST_CLEANUP_ESCALATED,Ah as DEFAULT_HOST_CLEANUP_HIGH_WATER_PERCENT,fh as DEFAULT_HOST_CLEANUP_LOW_WATER_PERCENT,Cu as DEFAULT_HOST_CLEANUP_RETENTION,yh as DEFAULT_HOST_CLEANUP_SCHEDULE,Tn as DEFAULT_RPX_CERTS_DIR,Gu as FIRST_BOOT_SCRIPT_PATH,gr as HOST_ARTIFACT_CACHE_DIR,mh as HOST_CLEANUP_SCRIPT_PATH,hh as HOST_CLEANUP_UNIT,Ac as HetznerBoxProvisioner,hr as HetznerClient,Ce as HetznerDriver,oc as LEGACY_DRIVER_STATE_DIR,vs as LocalBoxDriver,Xu as MANAGED_CACHE_POLICY_DISABLED,Ju as MANAGED_CACHE_POLICY_OPTIMIZED,Yu as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,Nu as RASPBERRY_PI_DEFAULT_SWAP_GB,tc as REMOTE_SCRIPT_RUNNER,Dn as RPX_DIR,Ya as RPX_LAUNCHER_PATH,Ie as RPX_SERVICE_NAME,uc as SSH_BOOTSTRAP_MARKER_DIR,Ee as SSH_BOOTSTRAP_VERSION,st as SSH_DEFAULTS,zn as SSH_DEPLOY_STORAGE_PATH,vu as SSH_INSECURE_HOST_KEY_OPTS,Tu as SSH_KEEPALIVE_OPTS,Hn as SSH_PREFLIGHT_SCRIPT,Uu as SSH_SKIP_BOOTSTRAP_ENV,Ar as SshDriver,fr as SystemSshTransport,hc as UBUNTU_2404_AMI_PARAM,Rh as acquireResizeLock,Eh as applyHetznerHostOptimization,Ts as assertArchSupported,Qu as assertSshComputeConfig,rc as buildAwsArtifactFetch,fc as buildBoxUserData,Ph as buildCloudFrontOriginConfig,pc as buildCloudInitFirstBoot,Ku as buildHetznerHostOptimizationScript,_n as buildHostCleanupDeployScript,bu as buildHostCleanupExecutable,bs as buildHostCleanupInstallScript,Bn as buildHostCleanupScript,nc as buildLocalArtifactFetch,K as buildRpxConfig,xe as buildRpxFragmentRefreshScript,lr as buildRpxLbConfig,Se as buildRpxProvisionScript,wu as buildScpArgsFor,On as buildSiteDeployScript,Pn as buildSshArgs,cc as buildSshArgsFor,Un as buildSshBootstrapScript,Ln as buildStaticSiteDeployScript,Hu as cloudDrivers,bh as collectHetznerHostOptimizationReport,gc as collectHetznerResizeManifest,Dh as createBoxProvisioner,k as createCloudDriver,Cc as deployAllComputeSites,Ps as deploySiteRelease,Xa as deriveRouteId,bn as describeScriptSyntaxError,rt as driverStateDir,Le as driverStatePath,Wn as ensureFirewall,Jn as ensureServer,Kn as ensureSshKey,qn as evaluatePreflight,Ih as executeHetznerServerResize,Du as findKnownHostKey,jn as formatPreflightFindings,wt as formatSshFailure,Rn as gatewayHostnames,N as generateUbuntuAppCloudInit,wn as hasAutoWwwVariant,ac as isBoxMode,ju as isHetznerCapacityError,vn as isLocalDatabase,Ru as knownHostsLine,dc as knownHostsToken,Iu as normalizeRoutePath,Oe as normalizeSshPublicKey,Gn as parsePreflightFacts,Vu as planHetznerServerResize,Vn as preflightFailed,Sh as prepareHetznerResize,$e as readDriverState,Th as readResizeCheckpoint,$n as releaseTarballTmpPath,Zn as reloadRpxGateway,kn as remoteScriptRunner,gh as renderRpxLauncher,Ec as renewRpxCertificates,mc as resizeCheckpointPath,Wu as resizeLockPath,xn as resolveExecStart,sc as resolveHetznerApiToken,zu as resolveHetznerHostOptimizationPlan,mr as resolveHostCleanupConfig,Ou as resolveSshHostKeyPolicy,ku as resolveSshHosts,Fu as resolveSshLan,_u as resolveSshPort,xu as resolveSshPrivateKeyPath,$u as resolveSshProfile,Mu as resolveSshPublicIp,Qn as resolveSshSettings,Lu as resolveSshSudo,Bu as resolveSshUser,Mn as scanHostKey,Za as scpUpload,Xn as serverPublicIpv4,Pu as sshBootstrapMarkerPath,pr as sshExec,ce as sshExecOrThrow,it as sshHostKeyFingerprint,lc as sshKnownHostsPath,Rt as summarizeRemoteFailures,ar as surfaceRemoteNotices,vh as verifyHetznerHostOptimization,Ch as verifyHetznerResize,ec as waitForCloudInit,Nn as waitForSsh,W as wrapCloudInitUserData,nt as writeDriverState,wh as writeResizeCheckpoint};
+import{wn,Rt,lr,Dt,Rn,Dn,Pn,Nn,Pu,ec,K,gr,Nh,kn,tc,Ie,Se,xe,N,mr,Bn,hr,ce,rc,_n,nc,On,ic,fr,kh,Bh,ku,Bu,_h,Oh,xh,Ar,xn,_u,Ts,Ln,$n,Mn,Un,Qn,sc,oc,yr,cc,Le,W,dc,nt,$e,Me,it,Ce,ws,lc,Ou,xu,uc,Lu,st,Hn,pc,$u,Mu,gc,Ir,Ee,mc,Fu,Uu,Rs,Gn,ot,Qu,Hu,Gu,qu,Vu,ju,zu,Ku,Wu,qn,Vn,jn,zn,Kn,Wn,Jn,Ju,Xu,Sr,k,Ds,Yu,Zu,ep,hc,tp,rp,Lh,fc,$h,Mh,np,ip,Fh,Uh,Qh,Ac,sp,Hh,Gh,qh,Xn,Yn,Zn,ei,yc,Ic,Sc,Cc,Vh,ks,vc,ri,Tc,op,ap,cp,jh}from"../chunk-5255nr93.js";import"../chunk-qcaqc5b8.js";import"../chunk-ptq9v346.js";import"../chunk-9asn5fpt.js";import"../chunk-zx8ecz8b.js";import"../chunk-3m9ghthh.js";import"../chunk-v2p7c7s4.js";export{Cc as AwsBoxProvisioner,mr as AwsDriver,ep as BOOT_PARTITION_LABEL,Ds as CloudDriverFactory,Bu as DEFAULT_HOST_CLEANUP_ESCALATED,Oh as DEFAULT_HOST_CLEANUP_HIGH_WATER_PERCENT,_h as DEFAULT_HOST_CLEANUP_LOW_WATER_PERCENT,ku as DEFAULT_HOST_CLEANUP_RETENTION,xh as DEFAULT_HOST_CLEANUP_SCHEDULE,Dn as DEFAULT_RPX_CERTS_DIR,Zu as FIRST_BOOT_SCRIPT_PATH,fr as HOST_ARTIFACT_CACHE_DIR,kh as HOST_CLEANUP_SCRIPT_PATH,Bh as HOST_CLEANUP_UNIT,Sc as HetznerBoxProvisioner,yr as HetznerClient,Ce as HetznerDriver,dc as LEGACY_DRIVER_STATE_DIR,ws as LocalBoxDriver,ap as MANAGED_CACHE_POLICY_DISABLED,op as MANAGED_CACHE_POLICY_OPTIMIZED,cp as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,Uu as RASPBERRY_PI_DEFAULT_SWAP_GB,ic as REMOTE_SCRIPT_RUNNER,kn as RPX_DIR,tc as RPX_LAUNCHER_PATH,Ie as RPX_SERVICE_NAME,mc as SSH_BOOTSTRAP_MARKER_DIR,Ee as SSH_BOOTSTRAP_VERSION,ot as SSH_DEFAULTS,Jn as SSH_DEPLOY_STORAGE_PATH,Ou as SSH_INSECURE_HOST_KEY_OPTS,xu as SSH_KEEPALIVE_OPTS,Vn as SSH_PREFLIGHT_SCRIPT,Ju as SSH_SKIP_BOOTSTRAP_ENV,Sr as SshDriver,Ir as SystemSshTransport,yc as UBUNTU_2404_AMI_PARAM,qh as acquireResizeLock,Fh as applyHetznerHostOptimization,Rs as assertArchSupported,Xu as assertSshComputeConfig,sc as buildAwsArtifactFetch,Ic as buildBoxUserData,jh as buildCloudFrontOriginConfig,hc as buildCloudInitFirstBoot,ip as buildHetznerHostOptimizationScript,Ln as buildHostCleanupDeployScript,_u as buildHostCleanupExecutable,Ts as buildHostCleanupInstallScript,xn as buildHostCleanupScript,oc as buildLocalArtifactFetch,K as buildRpxConfig,xe as buildRpxFragmentRefreshScript,gr as buildRpxLbConfig,Se as buildRpxProvisionScript,Lu as buildScpArgsFor,Mn as buildSiteDeployScript,Bn as buildSshArgs,uc as buildSshArgsFor,Gn as buildSshBootstrapScript,Un as buildStaticSiteDeployScript,Yu as cloudDrivers,Uh as collectHetznerHostOptimizationReport,fc as collectHetznerResizeManifest,Vh as createBoxProvisioner,k as createCloudDriver,vc as deployAllComputeSites,ks as deploySiteRelease,ec as deriveRouteId,wn as describeScriptSyntaxError,nt as driverStateDir,$e as driverStatePath,Yn as ensureFirewall,Zn as ensureServer,Xn as ensureSshKey,zn as evaluatePreflight,Lh as executeHetznerServerResize,Mu as findKnownHostKey,Wn as formatPreflightFindings,Rt as formatSshFailure,Nn as gatewayHostnames,N as generateUbuntuAppCloudInit,Pn as hasAutoWwwVariant,lc as isBoxMode,rp as isHetznerCapacityError,Rn as isLocalDatabase,$u as knownHostsLine,pc as knownHostsToken,Pu as normalizeRoutePath,Le as normalizeSshPublicKey,jn as parsePreflightFacts,tp as planHetznerServerResize,Kn as preflightFailed,$h as prepareHetznerResize,Me as readDriverState,Hh as readResizeCheckpoint,Qn as releaseTarballTmpPath,ri as reloadRpxGateway,On as remoteScriptRunner,Nh as renderRpxLauncher,Tc as renewRpxCertificates,Ac as resizeCheckpointPath,sp as resizeLockPath,$n as resolveExecStart,cc as resolveHetznerApiToken,np as resolveHetznerHostOptimizationPlan,Ar as resolveHostCleanupConfig,Vu as resolveSshHostKeyPolicy,Qu as resolveSshHosts,Wu as resolveSshLan,Gu as resolveSshPort,qu as resolveSshPrivateKeyPath,zu as resolveSshProfile,Ku as resolveSshPublicIp,qn as resolveSshSettings,ju as resolveSshSudo,Hu as resolveSshUser,Hn as scanHostKey,rc as scpUpload,ei as serverPublicIpv4,Fu as sshBootstrapMarkerPath,hr as sshExec,ce as sshExecOrThrow,st as sshHostKeyFingerprint,gc as sshKnownHostsPath,Dt as summarizeRemoteFailures,lr as surfaceRemoteNotices,Qh as verifyHetznerHostOptimization,Mh as verifyHetznerResize,nc as waitForCloudInit,_n as waitForSsh,W as wrapCloudInitUserData,it as writeDriverState,Gh as writeResizeCheckpoint};

package/dist/drivers/shared/cloudfront-origin.d.ts

@@ -37,15 +37,22 @@ export interface BuildCloudFrontOriginOptions {
      * receives the same origin secret header, so lock it down the same way.
      * The default cache behavior targets the origin group; path behaviors stay
      * on the primary.
-     * @experimental Built against the AWS documentation; not yet exercised against a live distribution.
      */
     failoverOriginDomain?: string;
     /**
      * Primary-origin status codes that trigger failover. Allowed: 400, 403, 404,
      * 416, 429, 500, 502, 503, 504. @default [500, 502, 503, 504]
-     * @experimental
      */
     failoverStatusCodes?: number[];
+    /**
+     * Times CloudFront tries to connect to {@link originDomain}, 1-3. @default 3
+     *
+     * With {@link connectionTimeout} this bounds how long an unreachable primary
+     * holds a request before CloudFront fails over (3 x 10 seconds by default).
+     */
+    connectionAttempts?: number;
+    /** Seconds CloudFront waits to connect to {@link originDomain}, 1-10. @default 10 */
+    connectionTimeout?: number;
 }
 /**
  * Build a complete CloudFront `DistributionConfig` for a self-hosted origin.

package/dist/generators/infrastructure.d.ts

@@ -2,7 +2,7 @@
  * Infrastructure Generator
  * Generates CloudFormation templates from cloud.config.ts using all Phase 2 modules
  */
-import type { CloudConfig } from '@ts-cloud/core';
+import type { CloudConfig, StorageFailoverReplica } from '@ts-cloud/core';
 import { TemplateBuilder } from '@ts-cloud/core';
 export interface GenerationOptions {
     config: CloudConfig;
@@ -15,6 +15,8 @@ export declare class InfrastructureGenerator {
     private environment;
     private mergedConfig;
     private serverEipLogicalIds;
+    /** Failover replicas the generated stack depends on, recorded in the template metadata. */
+    private storageFailoverReplicas;
     constructor(options: GenerationOptions);
     /**
      * Merge base config with environment-specific overrides
@@ -60,6 +62,12 @@ export declare class InfrastructureGenerator {
      * Auto-detects what to generate based on configuration
      */
     generate(): this;
+    /**
+     * Failover replicas of the last {@link generate}, empty when no bucket sets
+     * failover. The template metadata holds the same list under the
+     * TsCloud::StorageFailover key.
+     */
+    getStorageFailoverReplicas(): StorageFailoverReplica[];
     /**
      * Apply global tags to all resources
      */

package/dist/index.d.ts

@@ -34,7 +34,7 @@ export type { ObjectStorageConfig, ObjectStorageCredentials, ObjectStorageProvid
 export { keyMatchesFilters, migrateObjectStorage, remapKey } from './object-storage/migrate';
 export type { MigrateEndpoint, MigrateError, MigrateOptions, MigratePlanItem, MigrateProgress, MigrateResult, MigrateVerification, } from './object-storage/migrate';
 export * from './ssl';
-export { deployStaticSite, deployStaticSiteFull, uploadStaticFiles, invalidateCache, deleteStaticSite, generateStaticSiteTemplate, deployStaticSiteWithExternalDns, deployStaticSiteWithExternalDnsFull, generateExternalDnsStaticSiteTemplate, deploySite, hasProxyUpstream, resolveProxyUpstreams, resolveSiteDeployTarget, resolveSiteKind, shipsARelease, siteInstallBase, validateDeploymentConfig, addSiteToCloudConfig, allocateSitePorts, buildHostSitePortsScript, HOST_SITES_DIR, occupiedHostPorts, parseHostSiteFragments, parseUpstreamPort, removeSiteFromCloudConfig, setAttachToInCloudConfig, setSitePropertyInCloudConfig, updateSiteInCloudConfig, buildAndPushServerlessImage, buildFunctionEnv, deployServerlessApp, infraEnvFromOutputs, redeployServerlessApp, rollbackServerlessApp, runRemoteCommand, setMaintenance, buildManagementDashboardArtifact, dashboardCredentialsFile, ensureManagementDashboard, MANAGEMENT_DASHBOARD_SITE, resolveDashboardAuth, resolveUiSource, } from './deploy';
+export { deployStaticSite, deployStaticSiteFull, uploadStaticFiles, invalidateCache, deleteStaticSite, generateStaticSiteTemplate, deleteFailoverReplicaBuckets, ensureFailoverReplicaBuckets, grantFailoverReplicaAccess, seedFailoverReplicas, deployStaticSiteWithExternalDns, deployStaticSiteWithExternalDnsFull, generateExternalDnsStaticSiteTemplate, deploySite, hasProxyUpstream, resolveProxyUpstreams, resolveSiteDeployTarget, resolveSiteKind, shipsARelease, siteInstallBase, validateDeploymentConfig, addSiteToCloudConfig, allocateSitePorts, buildHostSitePortsScript, HOST_SITES_DIR, occupiedHostPorts, parseHostSiteFragments, parseUpstreamPort, removeSiteFromCloudConfig, setAttachToInCloudConfig, setSitePropertyInCloudConfig, updateSiteInCloudConfig, buildAndPushServerlessImage, buildFunctionEnv, deployServerlessApp, infraEnvFromOutputs, redeployServerlessApp, rollbackServerlessApp, runRemoteCommand, setMaintenance, buildManagementDashboardArtifact, dashboardCredentialsFile, ensureManagementDashboard, MANAGEMENT_DASHBOARD_SITE, resolveDashboardAuth, resolveUiSource, } from './deploy';
 export { collectServerDnsDomains, hostAcceptsIpv6, IPV6_EXCLUDED_HOST_LABELS, normalizePublicIpv6, reconcileAddressRecords, removeStaleServerAddressRecords, verifyAddressRecord, } from './deploy/server-dns';
 export type { AddressRecordReport } from './deploy/server-dns';
 export * from './cdn';