@stacksjs/ts-cloud 0.16.18 → 0.16.19

package/dist/{chunk-2p71e3x7.js → chunk-bcy9z4ks.js}

@@ -1,4 +1,4 @@
-import{hd,O,d,Ad,x,p,le,g,Ut,Ed,so,oo,Rd,Nd,kd,Od,qr,ho,zt,xd,Ld,Gd,qd}from"./chunk-v2p7c7s4.js";import{B,u}from"./chunk-3m9ghthh.js";import{de,_t,w,Ot,s,di,xs,Rr,Mc,Fc,X,c,Ms,Qe,Dr,Uc,xt,Us,Qc,Pr,Qs,Nr,pi,Mt,fi,Ai,He,Ft,cd,dd,Ii,Si,ut,eo,i,Ci,ro,no}from"./chunk-kczzc599.js";import{n,l}from"./chunk-zx8ecz8b.js";import{Bt,o}from"./chunk-yd40pg8g.js";import{un}from"./chunk-9syc8s7r.js";import{pn,hu,ns,P,v,is,fu}from"./chunk-7xnwa0s8.js";import{me,er,cs,Ye,V,ne,C,he,nr,et,sr}from"./chunk-60nr1ehk.js";import{j}from"./chunk-k53agv2m.js";import{E,ur,bs,Pt,pr,Du,Nt,Nu,ac,$e,st,Hn,k,kt,Cr}from"./chunk-s2ve9zxn.js";import{fe}from"./chunk-c3f89ryr.js";import{A}from"./chunk-31tvc877.js";import{_e}from"./chunk-5far81q7.js";import{be}from"./chunk-qcaqc5b8.js";import{h}from"./chunk-ptq9v346.js";function rn(e){let t=$c(e.name),r=tp(e.configText);if(Iw(e.configText,r.start,r.end,t))throw Error(`Site '${t}' already exists in cloud.config.ts`);let a=ch({...e,name:t}),m=e.configText.slice(0,r.end).trimEnd(),f=e.configText.slice(r.end),y=m.endsWith("{")?`
+import{hd,O,d,Ad,x,p,le,g,Ut,Ed,so,oo,Rd,Nd,kd,Od,qr,ho,zt,xd,Ld,Gd,qd}from"./chunk-v2p7c7s4.js";import{B,u}from"./chunk-3m9ghthh.js";import{de,_t,w,Ot,s,di,xs,Rr,Mc,Fc,X,c,Ms,Qe,Dr,Uc,xt,Us,Qc,Pr,Qs,Nr,pi,Mt,fi,Ai,He,Ft,cd,dd,Ii,Si,ut,eo,i,Ci,ro,no}from"./chunk-kczzc599.js";import{n,l}from"./chunk-zx8ecz8b.js";import{Bt,o}from"./chunk-9asn5fpt.js";import{un}from"./chunk-hyeeqga9.js";import{pn,hu,ns,P,v,is,fu}from"./chunk-7xnwa0s8.js";import{me,er,cs,Ye,V,ne,C,he,nr,et,sr}from"./chunk-2m262b2n.js";import{j}from"./chunk-k53agv2m.js";import{E,ur,bs,Pt,pr,Du,Nt,Nu,ac,$e,st,Hn,k,kt,Cr}from"./chunk-5255nr93.js";import{fe}from"./chunk-r1wpwfff.js";import{A}from"./chunk-31tvc877.js";import{_e}from"./chunk-5far81q7.js";import{be}from"./chunk-qcaqc5b8.js";import{h}from"./chunk-ptq9v346.js";function rn(e){let t=$c(e.name),r=tp(e.configText);if(Iw(e.configText,r.start,r.end,t))throw Error(`Site '${t}' already exists in cloud.config.ts`);let a=ch({...e,name:t}),m=e.configText.slice(0,r.end).trimEnd(),f=e.configText.slice(r.end),y=m.endsWith("{")?`
 `:m.endsWith(",")?`
 
 `:`,
@@ -70,7 +70,7 @@ data: ${JSON.stringify(pt)}
         default_role = ?, enabled = ?, enforce_sso = ?, updated_at = ? WHERE id = ?`,[t,r,a,m,e.clientSecret?this.encrypt(e.clientSecret):null,JSON.stringify(f),JSON.stringify(y),e.defaultRole??I.defaultRole,e.enabled??I.enabled?1:0,e.enforceSso??I.enforceSso?1:0,R,I.id]),this.getOidcProvider(I.id)}if(!e.clientSecret)throw Error("OIDC client secret is required for a new provider");let b=e.id??this.idFn();return this.run(`INSERT INTO auth_oidc_providers (id, organization_id, slug, name, issuer, client_id,
       client_secret_ciphertext, scopes, allowed_domains, default_role, enabled, enforce_sso, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[b,e.organizationId,t,r,a,m,this.encrypt(e.clientSecret),JSON.stringify(f),JSON.stringify(y),e.defaultRole??"viewer",e.enabled===!1?0:1,e.enforceSso?1:0,R,R]),this.getOidcProvider(b)}getOidcProvider(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(e);return t?Vc(t):void 0}getOidcProviderBySlug(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE slug = ? COLLATE NOCASE").get(e.trim());return t?Vc(t):void 0}listOidcProviders(e,t={}){return(e?this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(e):this.controlPlane.database.query("SELECT * FROM auth_oidc_providers ORDER BY name COLLATE NOCASE").all()).map(Vc).filter((a)=>t.includeDisabled||a.enabled)}setOidcProviderEnabled(e,t){let r=this.now();if(this.controlPlane.database.run("UPDATE auth_oidc_providers SET enabled = ?, enforce_sso = CASE WHEN ? = 0 THEN 0 ELSE enforce_sso END, updated_at = ? WHERE id = ?",[t?1:0,t?1:0,r,e]).changes!==1)throw Error("OIDC provider was not found");if(!t)this.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE provider_id = ? AND consumed_at IS NULL",[r,e]);return this.getOidcProvider(e)}getOidcProviderCredentials(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(e);if(!t||typeof t.client_secret_ciphertext!=="string")throw Error("OIDC provider credentials are unavailable");return{provider:Vc(t),clientSecret:this.decrypt(t.client_secret_ciphertext)}}beginOidcTransaction(e,t,r){if(!this.getOidcProvider(e)?.enabled)throw Error("OIDC provider is unavailable");let m=this.idFn(),f=ui(32).toString("base64url"),y=ui(32).toString("base64url"),I=ui(64).toString("base64url"),R=this.now(),b=new Date(this.nowFn().getTime()+rl).toISOString();return this.run(`INSERT INTO auth_oidc_transactions (id, provider_id, state_hash, nonce_ciphertext, verifier_ciphertext,
-      redirect_uri, return_path, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[m,e,Vn(f),this.encrypt(y),this.encrypt(I),t,r,b,R]),{transaction:this.getOidcTransaction(m),state:f,nonce:y,verifier:I}}getOidcTransaction(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE id = ?").get(e);return t?Eh(t,this.now()):void 0}consumeOidcTransaction(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE provider_id = ? AND state_hash = ?").get(e,Vn(t));if(!r)throw Error("OIDC transaction is invalid");let a=Eh(r,this.now());if(a.state!=="pending")throw Error(`OIDC transaction is ${a.state}`);if(this.controlPlane.database.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),a.id,this.now()]).changes!==1)throw Error("OIDC transaction is no longer available");return{transaction:this.getOidcTransaction(a.id),nonce:this.decrypt(String(r.nonce_ciphertext)),verifier:this.decrypt(String(r.verifier_ciphertext))}})}getOidcSubject(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_subjects WHERE provider_id = ? AND subject = ?").get(e,t);return r?yI(r):void 0}linkOidcSubject(e,t,r,a){let m=this.getOidcProvider(e),f=this.getIdentity(t);if(!m||!f)throw Error("OIDC provider or identity was not found");let y=Ep(a);if(!r.trim()||r.length>512)throw Error("OIDC subject is invalid");let I=this.getOidcSubject(e,r);if(I&&I.identityId!==t)throw Error("OIDC subject is already linked to another identity");let R=this.now();if(I)return this.run("UPDATE auth_oidc_subjects SET email = ?, last_login_at = ? WHERE id = ?",[y,R,I.id]),this.getOidcSubject(e,r);let b=this.idFn();return this.run("INSERT INTO auth_oidc_subjects (id, provider_id, identity_id, subject, email, linked_at, last_login_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[b,e,t,r,y,R,R]),this.getOidcSubject(e,r)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM auth_action_tokens WHERE expires_at < ? OR consumed_at IS NOT NULL",[e]).changes,r=this.controlPlane.database.run("DELETE FROM auth_sessions WHERE revoked_at IS NOT NULL OR idle_expires_at < ? OR absolute_expires_at < ?",[e,e]).changes;return this.controlPlane.database.run("DELETE FROM auth_mfa_challenges WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),this.controlPlane.database.run("DELETE FROM auth_oidc_transactions WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),{actionTokens:t,sessions:r}}}async function jr(e,t){let r=e.notifications?.email?.from;if(!r)return!1;try{let{EmailClient:a}=await import("./chunk-hjgjbkhk.js");return await new a({region:e.project.region,defaultFrom:r}).send(t),!0}catch{return!1}}import{randomBytes as vI}from"node:crypto";import{chmodSync as bI,existsSync as SI,mkdirSync as wI,readFileSync as kI,writeFileSync as II}from"node:fs";import{dirname as EI}from"node:path";function Fm(){return O("auth-encryption-key")}function Ke(e){let t=process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();if(t)return t;let r=d(e,"auth-encryption-key");try{if(SI(r)){let m=kI(r,"utf8").trim();if(m)return m}}catch{}let a=vI(32).toString("base64url");try{wI(EI(r),{recursive:!0,mode:448}),II(r,`${a}
+      redirect_uri, return_path, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[m,e,Vn(f),this.encrypt(y),this.encrypt(I),t,r,b,R]),{transaction:this.getOidcTransaction(m),state:f,nonce:y,verifier:I}}getOidcTransaction(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE id = ?").get(e);return t?Eh(t,this.now()):void 0}consumeOidcTransaction(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE provider_id = ? AND state_hash = ?").get(e,Vn(t));if(!r)throw Error("OIDC transaction is invalid");let a=Eh(r,this.now());if(a.state!=="pending")throw Error(`OIDC transaction is ${a.state}`);if(this.controlPlane.database.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),a.id,this.now()]).changes!==1)throw Error("OIDC transaction is no longer available");return{transaction:this.getOidcTransaction(a.id),nonce:this.decrypt(String(r.nonce_ciphertext)),verifier:this.decrypt(String(r.verifier_ciphertext))}})}getOidcSubject(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_subjects WHERE provider_id = ? AND subject = ?").get(e,t);return r?yI(r):void 0}linkOidcSubject(e,t,r,a){let m=this.getOidcProvider(e),f=this.getIdentity(t);if(!m||!f)throw Error("OIDC provider or identity was not found");let y=Ep(a);if(!r.trim()||r.length>512)throw Error("OIDC subject is invalid");let I=this.getOidcSubject(e,r);if(I&&I.identityId!==t)throw Error("OIDC subject is already linked to another identity");let R=this.now();if(I)return this.run("UPDATE auth_oidc_subjects SET email = ?, last_login_at = ? WHERE id = ?",[y,R,I.id]),this.getOidcSubject(e,r);let b=this.idFn();return this.run("INSERT INTO auth_oidc_subjects (id, provider_id, identity_id, subject, email, linked_at, last_login_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[b,e,t,r,y,R,R]),this.getOidcSubject(e,r)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM auth_action_tokens WHERE expires_at < ? OR consumed_at IS NOT NULL",[e]).changes,r=this.controlPlane.database.run("DELETE FROM auth_sessions WHERE revoked_at IS NOT NULL OR idle_expires_at < ? OR absolute_expires_at < ?",[e,e]).changes;return this.controlPlane.database.run("DELETE FROM auth_mfa_challenges WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),this.controlPlane.database.run("DELETE FROM auth_oidc_transactions WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),{actionTokens:t,sessions:r}}}async function jr(e,t){let r=e.notifications?.email?.from;if(!r)return!1;try{let{EmailClient:a}=await import("./chunk-4j8ef0pe.js");return await new a({region:e.project.region,defaultFrom:r}).send(t),!0}catch{return!1}}import{randomBytes as vI}from"node:crypto";import{chmodSync as bI,existsSync as SI,mkdirSync as wI,readFileSync as kI,writeFileSync as II}from"node:fs";import{dirname as EI}from"node:path";function Fm(){return O("auth-encryption-key")}function Ke(e){let t=process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();if(t)return t;let r=d(e,"auth-encryption-key");try{if(SI(r)){let m=kI(r,"utf8").trim();if(m)return m}}catch{}let a=vI(32).toString("base64url");try{wI(EI(r),{recursive:!0,mode:448}),II(r,`${a}
 `,{mode:384}),bI(r,384)}catch{}return a}import{constants as RI,createHash as Cp,createPublicKey as AI,createVerify as CI,timingSafeEqual as PI}from"node:crypto";var _h=new Set(["RS256","PS256","ES256"]),Ph=60;function Wc(e,t){let r=new URL(e),a=["127.0.0.1","::1","localhost"].includes(r.hostname);if(r.protocol!=="https:"&&!(r.protocol==="http:"&&a))throw Error(`${t} must use HTTPS`);if(r.username||r.password||r.hash)throw Error(`${t} contains unsupported URL components`);return r}function Pp(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`${t} is invalid`);return e}async function _p(e,t){if(!e.ok)throw Error(`${t} failed with HTTP ${e.status}`);if(!(e.headers.get("content-type")??"").toLowerCase().includes("application/json"))throw Error(`${t} returned an unsupported content type`);if(Number(e.headers.get("content-length")??0)>1048576)throw Error(`${t} response is too large`);let m=await e.text();if(m.length>1048576)throw Error(`${t} response is too large`);try{return Pp(JSON.parse(m),t)}catch(f){if(f instanceof Error&&f.message===`${t} is invalid`)throw f;throw Error(`${t} returned invalid JSON`)}}function _I(e,t){let r=Cp("sha256").update(e).digest(),a=Cp("sha256").update(t).digest();return PI(r,a)}function nl(e){if(!e)return"/";let t=e.trim();if(!t.startsWith("/")||t.startsWith("//")||t.includes("\\")||/[\r\n]/.test(t))return"/";try{let r=new URL(t,"https://local.invalid");return r.origin==="https://local.invalid"?`${r.pathname}${r.search}${r.hash}`:"/"}catch{return"/"}}async function No(e,t=fetch){let r=Wc(e.issuer,"OIDC issuer"),a=new URL(`${r.pathname.replace(/\/$/,"")}/.well-known/openid-configuration`,r.origin),m=await _p(await t(a,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC discovery");if(m.issuer!==e.issuer)throw Error("OIDC discovery issuer does not match the configured issuer");for(let y of["authorization_endpoint","token_endpoint","jwks_uri"]){if(typeof m[y]!=="string")throw Error(`OIDC discovery is missing ${y}`);Wc(m[y],`OIDC ${y}`)}if(Array.isArray(m.response_types_supported)&&!m.response_types_supported.includes("code"))throw Error("OIDC provider does not support authorization code flow");if(Array.isArray(m.code_challenge_methods_supported)&&!m.code_challenge_methods_supported.includes("S256"))throw Error("OIDC provider does not support PKCE S256");let f=Array.isArray(m.id_token_signing_alg_values_supported)?m.id_token_signing_alg_values_supported.filter((y)=>typeof y==="string"):[];if(f.length>0&&!f.some((y)=>_h.has(y)))throw Error("OIDC provider does not offer a supported ID-token signing algorithm");return m}async function ko(e,t,r,a,m=fetch){let f=e.getOidcProviderBySlug(t);if(!f?.enabled)throw Error("OIDC provider is unavailable");let y=Wc(r,"Application origin").origin,I=await No(f,m),R=`${y}/auth/oidc/${encodeURIComponent(f.slug)}/callback`,b=e.beginOidcTransaction(f.id,R,nl(a)),T=new URL(I.authorization_endpoint);return T.searchParams.set("response_type","code"),T.searchParams.set("client_id",f.clientId),T.searchParams.set("redirect_uri",R),T.searchParams.set("scope",f.scopes.join(" ")),T.searchParams.set("state",b.state),T.searchParams.set("nonce",b.nonce),T.searchParams.set("code_challenge",Cp("sha256").update(b.verifier).digest("base64url")),T.searchParams.set("code_challenge_method","S256"),{authorizationUrl:T.href,expiresAt:b.transaction.expiresAt}}function TI(e){if(e.length>32768)throw Error("OIDC ID token is too large");let t=e.split(".");if(t.length!==3||t.some((r)=>!r))throw Error("OIDC ID token is malformed");try{return{header:Pp(JSON.parse(Buffer.from(t[0],"base64url").toString("utf8")),"OIDC ID-token header"),claims:Pp(JSON.parse(Buffer.from(t[1],"base64url").toString("utf8")),"OIDC ID-token claims"),signingInput:`${t[0]}.${t[1]}`,signature:Buffer.from(t[2],"base64url")}}catch(r){if(r instanceof Error&&r.message.startsWith("OIDC"))throw r;throw Error("OIDC ID token is malformed")}}async function xI(e,t,r){let a=TI(e),m=typeof a.header.alg==="string"?a.header.alg:"",f=typeof a.header.kid==="string"?a.header.kid:"";if(!_h.has(m)||!f)throw Error("OIDC ID token uses an unsupported signing key");if(t.id_token_signing_alg_values_supported&&!t.id_token_signing_alg_values_supported.includes(m))throw Error("OIDC ID-token algorithm was not advertised by the provider");let y=await _p(await r(t.jwks_uri,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC signing-key request");if(!Array.isArray(y.keys))throw Error("OIDC signing-key response is invalid");let I=y.keys.find((N)=>{if(!N||typeof N!=="object"||Array.isArray(N))return!1;let F=N;return F.kid===f&&(!F.alg||F.alg===m)&&(!F.use||F.use==="sig")});if(!I)throw Error("OIDC ID-token signing key was not found");let R=AI({key:I,format:"jwk"}),b=CI("SHA256").update(a.signingInput).end();if(!(m==="PS256"?b.verify({key:R,padding:RI.RSA_PKCS1_PSS_PADDING,saltLength:32},a.signature):m==="ES256"?b.verify({key:R,dsaEncoding:"ieee-p1363"},a.signature):b.verify(R,a.signature)))throw Error("OIDC ID-token signature is invalid");return a.claims}function DI(e,t,r,a){if(e.iss!==t.issuer)throw Error("OIDC ID-token issuer is invalid");let m=typeof e.aud==="string"?[e.aud]:Array.isArray(e.aud)?e.aud.filter((R)=>typeof R==="string"):[];if(!m.includes(t.clientId))throw Error("OIDC ID-token audience is invalid");if((m.length>1||e.azp!==void 0)&&e.azp!==t.clientId)throw Error("OIDC ID-token authorized party is invalid");let f=Math.floor(a.getTime()/1000);if(typeof e.exp!=="number"||e.exp<f-Ph)throw Error("OIDC ID token is expired");if(typeof e.iat!=="number"||e.iat>f+Ph)throw Error("OIDC ID-token issued-at time is invalid");if(typeof e.nonce!=="string"||!_I(e.nonce,r))throw Error("OIDC ID-token nonce is invalid");if(typeof e.sub!=="string"||!e.sub||e.sub.length>512)throw Error("OIDC ID-token subject is invalid");if(e.email_verified!==!0||typeof e.email!=="string")throw Error("OIDC provider did not return a verified email address");let y=e.email.trim().toLowerCase();if(y.length>254||!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(y))throw Error("OIDC provider returned an invalid email address");let I=y.split("@")[1];if(!I||!t.allowedDomains.includes(I))throw Error("OIDC email domain is not allowed for this organization");return{provider:t,subject:e.sub,email:y,name:typeof e.name==="string"?e.name.slice(0,120):void 0,claims:e}}async function Bo(e,t,r=fetch){let a=e.getOidcProviderBySlug(t.providerSlug);if(!a?.enabled)throw Error("OIDC provider is unavailable");if(!t.state||t.state.length>512||!t.code||t.code.length>4096)throw Error("OIDC callback is incomplete");let m=Wc(t.origin,"Application origin").origin,f=e.consumeOidcTransaction(a.id,t.state),y=`${m}/auth/oidc/${encodeURIComponent(a.slug)}/callback`;if(f.transaction.redirectUri!==y)throw Error("OIDC callback redirect URI does not match the original request");let{clientSecret:I}=e.getOidcProviderCredentials(a.id),R=await No(a,r),b=new URLSearchParams({grant_type:"authorization_code",code:t.code,redirect_uri:f.transaction.redirectUri,code_verifier:f.verifier}),T={accept:"application/json","content-type":"application/x-www-form-urlencoded"},N=R.token_endpoint_auth_methods_supported??["client_secret_basic"];if(N.includes("client_secret_basic")){let H=(Z)=>new URLSearchParams({value:Z}).toString().slice(6),K=`${H(a.clientId)}:${H(I)}`;T.authorization=`Basic ${Buffer.from(K).toString("base64")}`}else if(N.includes("client_secret_post"))b.set("client_id",a.clientId),b.set("client_secret",I);else throw Error("OIDC provider does not support a configured client authentication method");let F=await _p(await r(R.token_endpoint,{method:"POST",headers:T,body:b,redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC token exchange");if(typeof F.id_token!=="string")throw Error("OIDC token response did not include an ID token");let z=await xI(F.id_token,R,r);return{identity:DI(z,a,f.nonce,t.now??new Date),returnPath:f.transaction.returnPath}}import{createHash as OI,randomBytes as $I}from"node:crypto";var xh=new Set(de),il=7776000000,sl=31536000000,ol=86400000;function mi(e){return typeof e==="string"?e:void 0}function Th(e){return OI("sha256").update(e).digest("hex")}function NI(e){try{let t=JSON.parse(String(e));return Array.isArray(t)?t.filter((r)=>typeof r==="string"&&xh.has(r)):[]}catch{return[]}}function jI(e){let t=String(e.scope_type);return t==="organization"?{type:t}:{type:t,id:String(e.scope_id)}}function Tp(e){let t=mi(e.disabled_at);return{id:String(e.id),organizationId:String(e.organization_id),actorId:String(e.actor_id),slug:String(e.slug),name:String(e.name),description:mi(e.description),createdByActorId:mi(e.created_by_actor_id),disabledAt:t,createdAt:String(e.created_at),updatedAt:String(e.updated_at),state:t?"disabled":"active"}}function xp(e,t){let r=mi(e.revoked_at),a=String(e.expires_at);return{id:String(e.id),serviceAccountId:String(e.service_account_id),name:String(e.name),prefix:String(e.token_prefix),capabilities:NI(e.capabilities),scope:jI(e),expiresAt:a,lastUsedAt:mi(e.last_used_at),lastNetworkHint:mi(e.last_network_hint),revokedAt:r,rotatedFromTokenId:mi(e.rotated_from_token_id),createdByActorId:mi(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at),state:r?"revoked":a<=t?"expired":"active"}}function MI(e){let t={};try{t=JSON.parse(String(e.response_body))}catch{}return{id:String(e.id),tokenId:String(e.token_id),key:String(e.idempotency_key),requestHash:String(e.request_hash),operationId:mi(e.operation_id),responseStatus:Number(e.response_status),responseBody:t,expiresAt:String(e.expires_at),createdAt:String(e.created_at)}}class xi{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}createServiceAccount(e){if(!this.controlPlane.getOrganization(e.organizationId))throw Error("Service-account organization was not found");let t=e.slug.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(t))throw Error("Service-account slug must be 2-48 lowercase letters, numbers or dashes");let r=e.name.trim().slice(0,100);if(!r)throw Error("Service-account name is required");let a=this.controlPlane.createActor({kind:"service_account",externalId:`service-account:${e.organizationId}:${t}`,displayName:r,metadata:{source:"api",serviceAccountSlug:t}}),m=this.idFn(),f=this.now();this.run(`INSERT INTO service_accounts (id, organization_id, actor_id, slug, name, description, created_by_actor_id, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[m,e.organizationId,a.id,t,r,e.description?.trim().slice(0,500)||null,e.createdByActorId??null,f,f]);let y=this.controlPlane.createMembership({organizationId:e.organizationId,actorId:a.id,roleTemplate:e.roleTemplate,scope:e.scope,source:"manual",performedByActorId:e.createdByActorId}),I=e.scope??{type:"organization"};return this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.createdByActorId,type:"api.service_account.created",payload:{serviceAccountId:m,roleTemplate:e.roleTemplate,scope:{type:I.type,id:I.id??null}}}),{serviceAccount:this.getServiceAccount(m),membership:y}}getServiceAccount(e){let t=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE id = ?").get(e);return t?Tp(t):void 0}getServiceAccountBySlug(e,t){let r=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? AND slug = ? COLLATE NOCASE").get(e,t.trim());return r?Tp(r):void 0}listServiceAccounts(e,t={}){return this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(e).map(Tp).filter((r)=>t.includeDisabled||r.state==="active")}disableServiceAccount(e,t){let r=this.getServiceAccount(e);if(!r)throw Error("Service account was not found");let a=this.now();return this.controlPlane.transaction(()=>{this.run("UPDATE service_accounts SET disabled_at = ?, updated_at = ? WHERE id = ?",[a,a,e]),this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE service_account_id = ? AND revoked_at IS NULL",[a,a,e]);let m=this.controlPlane.getMembershipForActor(r.organizationId,r.actorId);if(m?.status==="active")this.controlPlane.revokeMembership(m.id)}),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:t,type:"api.service_account.disabled",payload:{serviceAccountId:e}}),this.getServiceAccount(e)}createToken(e){let t=this.getServiceAccount(e.serviceAccountId);if(!t||t.state!=="active")throw Error("Service account is unavailable");let r=this.controlPlane.getMembershipForActor(t.organizationId,t.actorId);if(!r||r.status!=="active")throw Error("Service-account membership is unavailable");let a=[...new Set(e.capabilities)];if(a.length===0||a.some((F)=>!xh.has(F)))throw Error("API token requires valid explicit capabilities");let m=e.scope??r.scope,f=this.controlPlane.resolveAuthorizationTarget(t.organizationId,m);if(!f)throw Error("API token scope was not found in this organization");for(let F of a)if(!w({membership:r,grants:this.controlPlane.listGrants(r.id),capability:F,target:f}).allowed)throw Error(`Service-account membership does not grant ${F} at the token scope`);let y=e.expiresAt?new Date(e.expiresAt):new Date(this.nowFn().getTime()+il);if(!Number.isFinite(y.getTime())||y.getTime()<=this.nowFn().getTime()+60000||y.getTime()>this.nowFn().getTime()+sl)throw Error("API token expiry must be between one minute and one year from now");let I=this.idFn(),R=$I(32).toString("base64url"),b=`tsc_v1.${I}.${R}`,T=`tsc_v1.${I.slice(0,8)}`,N=this.now();return this.run(`INSERT INTO api_tokens (id, service_account_id, name, token_hash, token_prefix, capabilities, scope_type, scope_id,
       expires_at, rotated_from_token_id, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[I,t.id,e.name.trim().slice(0,100)||"API token",Th(b),T,JSON.stringify(a.sort()),m.type,m.type==="organization"?null:m.id??null,y.toISOString(),e.rotatedFromTokenId??null,e.createdByActorId??null,N,N]),this.controlPlane.appendEvent({organizationId:t.organizationId,actorId:e.createdByActorId,type:"api.token.created",payload:{serviceAccountId:t.id,tokenId:I,prefix:T,capabilities:a,scope:{type:m.type,id:m.id??null},expiresAt:y.toISOString(),rotatedFromTokenId:e.rotatedFromTokenId??null}}),{token:this.getToken(I),secret:b}}getToken(e){let t=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ?").get(e);return t?xp(t,this.now()):void 0}listTokens(e,t={}){return this.controlPlane.database.query("SELECT * FROM api_tokens WHERE service_account_id = ? ORDER BY created_at DESC").all(e).map((r)=>xp(r,this.now())).filter((r)=>t.includeInactive||r.state==="active")}verifyToken(e,t){let r=/^tsc_v1\.([^.]+)\.[A-Za-z0-9_-]{40,}$/.exec(e);if(!r)return;let a=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ? AND token_hash = ?").get(r[1],Th(e));if(!a)return;let m=xp(a,this.now()),f=this.getServiceAccount(m.serviceAccountId);if(!f||f.state!=="active"||m.state!=="active")return;let y=this.controlPlane.getActor(f.actorId),I=this.controlPlane.getMembershipForActor(f.organizationId,f.actorId);if(!y||y.disabledAt||!I||I.status!=="active")return;let R=this.now(),b=!m.lastUsedAt||this.nowFn().getTime()-new Date(m.lastUsedAt).getTime()>=3600000;if(this.run("UPDATE api_tokens SET last_used_at = ?, last_network_hint = ?, updated_at = ? WHERE id = ?",[R,t?.slice(0,128)??null,R,m.id]),b)this.controlPlane.appendEvent({organizationId:f.organizationId,actorId:y.id,type:"api.token.used",payload:{serviceAccountId:f.id,tokenId:m.id,prefix:m.prefix}});return{serviceAccount:f,token:this.getToken(m.id),actor:y,membership:I}}rotateToken(e,t){let r=this.getToken(e);if(!r||r.state!=="active")throw Error("Active API token was not found");let a=this.createToken({serviceAccountId:r.serviceAccountId,name:`${r.name} (rotated)`,capabilities:r.capabilities,scope:r.scope,expiresAt:r.expiresAt,createdByActorId:t,rotatedFromTokenId:r.id}),m=this.getServiceAccount(r.serviceAccountId);return this.controlPlane.appendEvent({organizationId:m?.organizationId,actorId:t,type:"api.token.rotated",payload:{serviceAccountId:r.serviceAccountId,previousTokenId:r.id,tokenId:a.token.id}}),a}revokeToken(e,t){let r=this.getToken(e);if(!r)throw Error("API token was not found");if(r.state==="active"){let a=this.now();this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE id = ?",[a,a,e]);let m=this.getServiceAccount(r.serviceAccountId);this.controlPlane.appendEvent({organizationId:m?.organizationId,actorId:t,type:"api.token.revoked",payload:{serviceAccountId:r.serviceAccountId,tokenId:e}})}return this.getToken(e)}getIdempotency(e,t){let r=this.controlPlane.database.query("SELECT * FROM api_idempotency_records WHERE token_id = ? AND idempotency_key = ? AND expires_at > ?").get(e,t,this.now());return r?MI(r):void 0}saveIdempotency(e){if(!/^[A-Za-z0-9._:-]{8,128}$/.test(e.key))throw Error("Idempotency-Key must contain 8-128 safe characters");let t=this.getIdempotency(e.tokenId,e.key);if(t){if(t.requestHash!==e.requestHash)throw Error("Idempotency-Key was already used for a different request");return t}let r=this.idFn(),a=this.now(),m=new Date(this.nowFn().getTime()+ol).toISOString();return this.run(`INSERT INTO api_idempotency_records (id, token_id, idempotency_key, request_hash, operation_id, response_status, response_body, expires_at, created_at)
@@ -673,7 +673,7 @@ data: ${JSON.stringify({cursor:f,at:new Date().toISOString()})}
 ${I}
 ${R}`);return null}return a}catch(m){if(a)Ps(a,{recursive:!0,force:!0});if(process.env.TSCLOUD_DASHBOARD_VERBOSE)console.warn(`ts-cloud dashboard: live UI build errored; serving the pre-built UI. ${m.message}`);return null}}function Xi(e){let t=e.infrastructure?.compute?.managedServices?JSON.parse(JSON.stringify(e.infrastructure.compute.managedServices)):void 0;if(t?.vitess?.password)t.vitess.password="";return{project:{name:e.project?.name,slug:e.project?.slug,region:e.project?.region},provider:e.provider,environments:Object.keys(e.environments??{}),compute:e.infrastructure?.compute?{provider:e.infrastructure.compute.provider,runtime:e.infrastructure.compute.runtime,webServer:e.infrastructure.compute.webServer,proxy:e.infrastructure.compute.proxy?{engine:e.infrastructure.compute.proxy.engine,onDemandTls:e.infrastructure.compute.proxy.onDemandTls,cdn:!!e.infrastructure.compute.proxy.cdn}:void 0,managedServices:t,sshKeys:Co(Ga(e)).map((r)=>({name:r.name,type:r.type,fingerprint:r.fingerprint,added:r.added}))}:void 0,sites:Object.fromEntries(Object.entries(e.sites??{}).map(([r,a])=>[r,{domain:a.domain,path:a.path,type:a.type,deploy:a.deploy,root:a.root,port:a.port,ssl:a.ssl}]))}}function dn(e){return[{id:"status",label:"Refresh Cloud Status",description:"Runs the local ts-cloud status checks against configured providers.",command:["status","--env",e],mutates:!1},{id:"doctor",label:"Run Doctor",description:"Checks local tooling, credentials, and provider access.",command:["doctor"],mutates:!1},{id:"security-scan",label:"Security Scan",description:"Runs the pre-deploy scanner from this checkout.",command:["deploy:security-scan","--source",".","--fail-on","critical"],mutates:!1},{id:"deploy",label:"Deploy Environment",description:"Deploys the selected environment from the local checkout.",command:["deploy","--env",e,"--yes"],mutates:!0,confirm:"deploy"}]}function Yi(e,t){return dn(t).find((r)=>r.id===e)}function rw(e){if(e.length<=ZS)return e;return`${e.slice(0,ZS)}
 
-[output truncated]`}async function nw(e,t,r){let a=e.getReader(),m=new TextDecoder,f="";while(!0){let{done:I,value:R}=await a.read();if(I)break;let b=m.decode(R,{stream:!0});if(f+=b,b)r?.(t,b)}let y=m.decode();if(y)f+=y,r?.(t,y);return f}async function Fg(e,t){let r=Bun.spawn([process.execPath,t.cliEntry,...e.command],{cwd:t.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...t.env}}),a=()=>{try{r.kill()}catch{}};if(t.signal?.aborted)a();else t.signal?.addEventListener("abort",a,{once:!0});try{let[m,f,y]=await Promise.all([nw(r.stdout,"stdout",t.onOutput),nw(r.stderr,"stderr",t.onOutput),r.exited]);return{action:e.id,command:["cloud",...e.command].join(" "),exitCode:y,ok:y===0,stdout:rw(m),stderr:rw(f)}}finally{t.signal?.removeEventListener("abort",a)}}function cT(){return Object.entries(process.env).filter(([e,t])=>!!t&&t.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(e)).map(([,e])=>e)}var dT=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function lT(e){let t=Ac(e);if(t&&t!==".html")return!1;let r=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!dT.has(r)}var uT={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/infrastructure/topology":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function iw(e,t){if(t.role==="admin")return!0;let r=Ac(e);if(r&&r!==".html")return!0;if(t.organizationSource==="legacy")return!lT(e);let a=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(a==="/access-denied")return!0;let m=uT[a];return!!m&&!!t.capabilities?.includes(m)}function pT(e,t){let r=decodeURIComponent(t).replace(/^\/+/,""),m=N_(r===""?"index.html":r);if(m.startsWith("..")||m.includes("/../"))return null;let f=Qt(e,m);if(Ti(f)&&!cw(f).isDirectory())return f;if(!Ac(f)&&Ti(`${f}.html`))return`${f}.html`;if(!Ac(f)&&Ti(Qt(f,"index.html")))return Qt(f,"index.html");return null}async function ow(e,t){let r=pT(e,t);if(!r){let f=Qt(e,"404.html");if(Ti(f))return new Response(await oi(f),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return Ku("Not found",404)}if(cw(r).isDirectory())return Ku("Not found",404);let a=await oi(r),m=V_[Ac(r)]??"application/octet-stream";return new Response(a,{headers:{"content-type":m}})}var Wu=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"],sw=new WeakMap;async function aw(e){let t=sw.get(e);if(t)return t;let r=await import("./spend/index.js"),a=new r.SpendStore(e),m={store:a,service:new r.SpendService(a),gate:new r.SpendGate(e)};return sw.set(e,m),m}async function ka(e={}){q_();let t=e.cwd??process.cwd(),r=e.host??F_,a=e.port??z_,m=e.cliEntry??process.argv[1];if(e.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await Z_(t);let f=e.config??await Xd(),y=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,I=p(f);if(y&&I&&!I.password)I.password=y;let R=f.infrastructure?.compute?.managedServices?.vitess;if(y&&R&&typeof R==="object"&&!R.password)R.password=y;let b=Yl(t,f);if(b.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${b.reconciliation.failed} orphaned operation(s) as failed after restart.`);let T=Object.keys(f.environments??{}),N=Q_(f,e.environment),F=X_(t),z=await Cs(f,N),H=new Map([[N,z]]),K=new Map([[N,Date.now()]]),Z=new Map([[N,Date.now()]]),oe=new Map,ye=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),ee=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),ce=x(f)!=="serverless",Re=(L)=>{let Ue=H.get(L);if(Ue&&!XS(K.get(L),Date.now(),ye))return Promise.resolve(Ue);let Ve=oe.get(L);if(Ve)return Ve;let Fe=!ce||XS(Z.get(L),Date.now(),ee),nt=Cs(f,L,{includeSiteHealth:Fe}).then((Tt)=>{let W=H.get(L),Qr=Fe?Tt:oT(W,Tt);if(H.set(L,Qr),K.set(L,Date.now()),Fe)Z.set(L,Date.now());if(W?._serverReachable!==Qr._serverReachable||W?._metricsStatus!==Qr._metricsStatus||(W?.sitesDetail?.length??0)!==(Qr.sitesDetail?.length??0))ot();return Qr}).finally(()=>oe.delete(L));return oe.set(L,nt),nt},Ae=kt(t),ue=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(e.box&&ue!=="0"&&(ue==="1"||!f.cloud?.attachTo)){let L=!1,Ue=Date.now()+300000,Ve=async()=>{if(L)return;L=!0;try{let nt=Date.now(),Tt=nt>=Ue;if(Tt)Ue=nt+300000;let W=b.environments.get(N);await Bg({controlPlane:b.store,projectId:b.project.id,environmentId:W?.id,config:f,environment:N,force:!0,lightweight:!0,includeSiteHealth:Tt})}catch(nt){if(e.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${nt instanceof Error?nt.message:String(nt)}`)}finally{L=!1}};Ve(),setInterval(()=>void Ve(),60000).unref?.()}let ae=new Map,Le=new Map,rt=new Set,vt=0;function or(L,Ue){if(L.role==="admin"&&!b.store.getActorByExternalId("user",`dashboard:${L.username.toLowerCase()}`))return L;let Ve=b.store.getActorByExternalId("user",`dashboard:${L.username.toLowerCase()}`),Fe=Ve?b.store.getMembershipForActor(b.organization.id,Ve.id):void 0;if(!Fe||Fe.status!=="active")return{...L,role:"member",sites:{},capabilities:[]};let nt=b.store.listGrants(Fe.id),Tt=b.store.resolveAuthorizationTarget(b.organization.id,Fe.scope)??b.store.resolveAuthorizationTarget(b.organization.id,{type:"project",id:b.project.id}),W=Ot({membership:Fe,grants:nt,target:Tt});if(Fe.roleTemplate==="owner"||Fe.roleTemplate==="admin")return{...L,role:"admin",sites:{},organizationRole:Fe.roleTemplate,organizationSource:Fe.source,capabilities:W};let Qr=b.environments.get(Ue),br={};for(let ct of b.store.listResources(b.project.id,Qr?.id).filter((gt)=>gt.kind==="application")){let gt=b.store.resolveAuthorizationTarget(b.organization.id,{type:"resource",id:ct.id});if(!gt||!w({membership:Fe,grants:nt,capability:"project:read",target:gt}).allowed)continue;br[ct.slug]=w({membership:Fe,grants:nt,capability:"config:write",target:gt}).allowed?"owner":"collaborator"}return{...L,role:"member",sites:br,organizationRole:Fe.roleTemplate,organizationSource:Fe.source,capabilities:W}}function ot(){vt+=1,ae.clear();for(let L of rt)Ps(L,{recursive:!0,force:!0});rt.clear()}let $t=(L,Ue)=>`${Ue}:${L.role==="admin"?"admin":`member:${Object.entries(L.sites).sort(([Ve],[Fe])=>Ve.localeCompare(Fe)).map(([Ve,Fe])=>`${Ve}=${Fe}`).join(",")}`}:${[...L.capabilities??[]].sort().join(",")}`;async function ar(L,Ue){let Ve=or(L,Ue),Fe=$t(Ve,Ue),nt=ae.get(Fe);if(nt)return nt;let Tt=Le.get(Fe);if(Tt)return Tt;let W=vt,Qr=(async()=>{let br=H.get(Ue)??await Cs(f,Ue);H.set(Ue,br);let ct={..._g(br,{user:Ve,slug:f.project.slug}),viewer:{role:Ve.role,organizationRole:Ve.organizationRole,organizationSource:Ve.organizationSource,capabilities:Ve.capabilities??[]}},gt=await aT(t,ct);if(gt&&W!==vt)return Ps(gt,{recursive:!0,force:!0}),Ae?.uiRoot;if(gt)rt.add(gt);let Mr=gt??Ae?.uiRoot;if(Mr)ae.set(Fe,Mr);return Mr})();Le.set(Fe,Qr);try{return await Qr}finally{Le.delete(Fe)}}let lt=await ar({username:"",passwordHash:"",role:"admin",sites:{}},N);if(!lt)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let Q=new WeakMap,ve=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",Ie=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(Ie&&e.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let Oe=!Ie,bt=Zb(t),jt=Oe?rS(t,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,Me=new Oi(b.store,{encryptionKey:Ke(t)}),Et=new xi(b.store),pt=new Wr(b.store),tt=new xo(b.store,{encryptionKey:Ke(t)}),Gr=new up(b.store),_s=new fp(b.store,{cwd:t}),Zn=new mp(b.store,{encryptionKey:Ke(t)}),tr=new c(b.store,{workerId:`dashboard:${process.pid}`}),cr=new Wo(b.store),si=new ia(b.store,Ke(t)),Di=new wa(b.store),Cc=new Gi(cr,tr,si),Ni=f.project?.region??"us-east-1",Ug=Ke(t),En=new Na(Di,{encryptionKey:Ug,backends:[new cn(b.store,Ug),new Ra(new V(Ni),Ni),new Da(new be(Ni),Ni),new Pa]});await mu(En,b,f);let Ju=new j(Ni),lw={aws_rds:new Jo(new ta(Ju)),aws_aurora:new Xo(new ra(Ju)),aws_elasticache:new Yo(new na(new et(Ni))),server:new Zo(new Jt),container:new ea(new Jt)},qg=(L)=>lw[L.provider],Sr=new ya(b.store),To=new Ji(Sr,tr),Vg=new Ia(si),uw={managed_database:new Sa(cr,Ju),logical_database:new Ea(cr,si),volume:new ba,files:new Ca(t),control_plane:new va(b.store,t),infrastructure:new Ta(new er(Ni))},pw=(L)=>uw[L.resourceKind],mw=(L)=>L.provider==="aws_backup"?void 0:Vg,Gu=new xt(b.store),Qu=[new Pr,new Qs(d(t,"volumes"))],ai=new Us(Gu,Qu,tr),Qa=new sa(b.store),Xn=new oa(Qa,[new en("aws"),new en("hetzner"),new en("ssh")],tr),Bi=new aa(b.store),Wg=new ca(Bi,Qa),es=new da(b.store),Hg=new la(es,tr),ci=new pa(b.store),Yu=new ga(ci,tr),Kg=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((L)=>new ma(L,b.store,b.project.id,b.organization.id)),Or=new jo(b.store),Jg=new Ko(Or,{queue:tr}),vr=new Dr(b.store),Zi=new Nr(b.store),On=new mt(b.store),at=new fi(b.store,{encryptionKey:Ke(t)}),gw=()=>aw(b.store);for(let L of b.environments.values())zo(Or,f,{organization:b.organization,project:b.project,environment:L,resources:b.store.listResources(b.project.id,L.id)});let $n=new Ai(at,{emailImpl:async(L)=>{let{email:Ue}=await import("./chunk-hjgjbkhk.js");return Ue.send(L)}}),Gg=async(L)=>{let Ue=eo(at,b.project.id,L),Ve=[];for(let Fe of Ue.filter((nt)=>nt.notify&&nt.alert))Ve.push(...await $n.deliverAll($n.enqueue(b.organization.id,Fe.alert,Fe.transition)));return Ve.push(...await $n.deliverAll($n.enqueueRemindersAndEscalations(b.organization.id,at.listAlerts(b.project.id,{environmentId:L,states:["firing"]})))),Ve.push(...await $n.retryDue()),{evaluations:Ue,deliveries:Ve}},Zu=!1,fw=async()=>{if(Zu)return;Zu=!0;try{for(let L of b.environments.values())for(let Ue of at.listHealthChecks(b.project.id,L.id).filter((Ve)=>Ve.enabled)){let Ve=at.listHealthResults(Ue.id,1)[0];if(Ve&&Date.now()-new Date(Ve.checkedAt).getTime()<Ue.intervalSeconds*1000)continue;let Fe=await new He(at).runAndEvaluate(Ue);for(let nt of Fe.evaluations.filter((Tt)=>Tt.notify&&Tt.alert))await $n.deliverAll($n.enqueue(b.organization.id,nt.alert,nt.transition))}}finally{Zu=!1}},Qg=setInterval(()=>{for(let L of b.environments.values())Gg(L.id).catch((Ue)=>console.error("ts-cloud alert evaluation failed:",Ue))},60000);Qg.unref?.();let Yg=setInterval(()=>{fw().catch((L)=>console.error("ts-cloud health check evaluation failed:",L))},30000);Yg.unref?.();let Zg=setInterval(()=>{try{Jg.tick()}catch(L){console.error("ts-cloud scheduled job evaluation failed:",L)}},30000);Zg.unref?.();let Xg=setInterval(()=>{try{To.enqueueDue(),To.enqueueRetention()}catch(L){console.error("ts-cloud backup policy evaluation failed:",L)}},30000);Xg.unref?.(),vr.cleanup();let ef=setInterval(()=>{try{vr.cleanup()}catch(L){console.error("ts-cloud preview cleanup failed:",L)}},3600000);ef.unref?.();let hw=e.queueWorker??!0,yw=cT(),vw=async(L,Ue)=>{let Fe=(L.environmentId?b.store.listEnvironments(L.projectId).find((nt)=>nt.id===L.environmentId):void 0)?.slug??String(N);if(Ue.kind==="dashboard_operation"&&Ue.operationId){let nt=H.get(Fe)??z,Tt=Pg(Ue.operationId,f,nt);if(!Tt||Tt.danger||!["scheduler","backup","worker"].includes(Tt.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let W=await zu(f,Fe,Tt);return{ok:W.ok,stdout:W.stdout,stderr:W.stderr??W.error,retryable:/temporar|unavailable|timeout|network/i.test(W.stderr??W.error??""),output:{command:W.command??null,operation:W.operation}}}if(Ue.kind==="serverless_scheduler"){let nt=await Mg(f,Fe,"run");return{ok:nt.ok,stdout:nt.stdout,stderr:nt.error,retryable:/temporar|unavailable|timeout|network/i.test(nt.error??""),output:{command:nt.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${Ue.kind}.`}},Pc=hw?new Ms(tr,{...Uc({store:b.store,execute:async(L,Ue)=>{let Ve=Ue.operation.input&&typeof Ue.operation.input==="object"&&!Array.isArray(Ue.operation.input)?Ue.operation.input:{},Fe=Ve.source&&typeof Ve.source==="object"?Ve.source:void 0,nt=t,Tt,W,Qr;try{if(Fe?.bindingId&&Fe?.connectionId&&Fe?.commitSha){let ct=tt.getBinding(String(Fe.bindingId)),gt=tt.getConnection(String(Fe.connectionId));if(!ct||!gt||ct.connectionId!==gt.id)throw Error("Queued source binding is no longer available");let _r=(ct.repositoryId?tt.getRepository(ct.repositoryId):tt.listRepositories(gt.id).find((Os)=>Os.fullName.toLowerCase()===ct.repositoryFullName.toLowerCase()))?.cloneUrl;if(!_r&&gt.provider==="generic_ssh")_r=`git@${new URL(gt.host).hostname}:${ct.repositoryFullName}.git`;if(!_r)_r=new URL(`/${ct.repositoryFullName}.git`,gt.host.endsWith("/")?gt.host:`${gt.host}/`).href;let Ce=ct.deployKeyId?tt.getDeployKey(ct.deployKeyId):void 0,dr=Ce&&ct.deployKeyId?{...Ce,privateKey:tt.getDeployPrivateKey(ct.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(gt.provider)&&L.target.previewId){let Os=We(gt,tt.getCredential(gt.id)),Se=vr.previews.getInstance(L.target.previewId);Qr=async(Nn,Oc)=>{try{await Os.setCommitStatus(ct.repositoryFullName,String(Fe.commitSha),{state:Nn,url:Se?.url,description:Oc})}catch($s){Ue.log(`Could not publish source status: ${$s instanceof Error?$s.message:String($s)}`,{stream:"stderr"})}},await Qr("pending",`Preview deployment started for ${String(Fe.commitSha).slice(0,12)}`)}Tt=zg(Qt(Hu(),"ts-cloud-queued-source-")),Ue.log(`Checking out immutable source commit ${Fe.commitSha}.`,{stream:"system"}),nt=(await $o({remote:_r,binding:ct,destination:Qt(Tt,"checkout"),ref:String(Fe.branch??ct.defaultBranch),commitSha:String(Fe.commitSha)},{credential:tt.getCredential(gt.id),deployKey:dr})).directory}if(Ue.operation.kind!=="preview.destroy"){let ct=L.target.previewId?vr.previews.getInstance(L.target.previewId):void 0,gt=ct?vr.previews.getDefinition(ct.definitionId):void 0,Mr=Ue.operation.resourceId?b.store.getResource(Ue.operation.resourceId):void 0;if(W=await En.resolve({projectId:b.project.id,environmentId:Ue.operation.environmentId,resourceId:Ue.operation.resourceId,functionId:Mr?.kind==="function"?Mr.id:void 0,previewId:ct?.id,trustedPreview:!!ct&&!ct.fork,allowedPreviewSecrets:gt?.inheritedSecrets}),W.warnings.some((_r)=>_r.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${W.warnings.filter((_r)=>_r.code==="missing_required").map((_r)=>_r.key).join(", ")}`);if(Ue.operation.resourceId)for(let _r of Object.values(W.entries))Di.setDependency({entryId:_r.id,resourceId:Ue.operation.resourceId,injectionTarget:"environment",required:_r.required,requiresRedeploy:!0});Ue.log(`Resolved configuration ${W.configurationHash.slice(0,18)} for ${Object.keys(W.values).length} keys.`,{stream:"system"})}let br=await Fg(L,{cwd:nt,cliEntry:m,signal:Ue.signal,env:W?.values,onOutput:(ct,gt)=>Ue.log(gt,{stream:ct,step:"execute",secrets:[...yw,...Object.entries(W?.entries??{}).filter(([,Mr])=>Mr.kind==="secret").map(([Mr])=>W.values[Mr]).filter(Boolean)]})});if(br.ok&&Ue.operation.resourceId&&W)for(let ct of Object.values(W.entries))Di.setDependency({entryId:ct.id,resourceId:Ue.operation.resourceId,injectionTarget:"environment",required:ct.required,requiresRedeploy:!1,lastDeployedVersion:ct.version});return await Qr?.(br.ok?"success":"failure",br.ok?`Preview is ready at ${String(Fe?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(Fe?.commitSha).slice(0,12)}`),br}catch(br){throw await Qr?.("error",`Preview deployment could not complete at ${String(Fe?.commitSha).slice(0,12)}`),br}finally{if(Tt)Ps(Tt,{recursive:!0,force:!0})}}}),...Bl({store:Or,executor:vw}),...Ol({store:cr,secrets:si,resolveAdapter:qg}),...$l(Qa,Xn.drivers),...Fl(es,[new ua("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...ql({store:ci,cleanup:Kg}),...Qc(Gu,Qu),...du({store:Sr,queue:tr,resolveSource:pw,resolveDestination:mw,validateHealth:async(L,Ue)=>{if(!L.healthCheckId)return{healthy:!0,mode:"adapter"};let Ve=at.getHealthCheck(L.healthCheckId);if(!Ve||Ve.projectId!==L.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let Fe=await new He(at).runAndEvaluate(Ve);return{healthy:Fe.result.status==="healthy",healthCheckId:Ve.id,healthResultId:Fe.result.id,target:Ue}}}),...ll({store:b.store,resolveDriver:e.releaseDriver??((L)=>({name:`${b.store.getResource(L.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:L.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(L,Ue)=>{let Ve=at.listHealthChecks(Ue.projectId,Ue.environmentId).find((nt)=>nt.enabled&&nt.name===L&&(!nt.resourceId||nt.resourceId===Ue.resourceId));if(!Ve)return{healthy:!1,message:`Named health gate ${L} was not found for this release.`};let Fe=await new He(at).runAndEvaluate(Ve);return{healthy:Fe.result.status==="healthy",evidence:{healthCheckId:Ve.id,healthResultId:Fe.result.id,status:Fe.result.status,timings:Fe.result.timings},message:Fe.result.message}}})},{parallelism:e.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(L)=>console.error("ts-cloud deployment queue worker failed:",L)}):void 0;if(bl(b),Ui(pt,te(b,String(N)),z),jt)zi(b,jt.users),oS(Me,b,jt.users);let mr=nS({cwd:t,enabled:Oe,secret:bt,authentication:Me,authorization:{store:b.store,organizationId:b.organization.id,projectId:b.project.id,defaultEnvironment:String(N)}}),wr=new Vo,tf=setInterval(()=>wr.sweep(),60000);tf.unref?.();let _c=new kc,Xu=new kc(3,900000,900000),Tc=new kc(8,900000,900000),rf=setInterval(()=>_c.prune(),300000),nf=setInterval(()=>Xu.prune(),300000),of=setInterval(()=>Tc.prune(),300000);if(rf.unref?.(),nf.unref?.(),of.unref?.(),Oe){if(jt?.generated)console.warn(`
+[output truncated]`}async function nw(e,t,r){let a=e.getReader(),m=new TextDecoder,f="";while(!0){let{done:I,value:R}=await a.read();if(I)break;let b=m.decode(R,{stream:!0});if(f+=b,b)r?.(t,b)}let y=m.decode();if(y)f+=y,r?.(t,y);return f}async function Fg(e,t){let r=Bun.spawn([process.execPath,t.cliEntry,...e.command],{cwd:t.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...t.env}}),a=()=>{try{r.kill()}catch{}};if(t.signal?.aborted)a();else t.signal?.addEventListener("abort",a,{once:!0});try{let[m,f,y]=await Promise.all([nw(r.stdout,"stdout",t.onOutput),nw(r.stderr,"stderr",t.onOutput),r.exited]);return{action:e.id,command:["cloud",...e.command].join(" "),exitCode:y,ok:y===0,stdout:rw(m),stderr:rw(f)}}finally{t.signal?.removeEventListener("abort",a)}}function cT(){return Object.entries(process.env).filter(([e,t])=>!!t&&t.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(e)).map(([,e])=>e)}var dT=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function lT(e){let t=Ac(e);if(t&&t!==".html")return!1;let r=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!dT.has(r)}var uT={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/infrastructure/topology":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function iw(e,t){if(t.role==="admin")return!0;let r=Ac(e);if(r&&r!==".html")return!0;if(t.organizationSource==="legacy")return!lT(e);let a=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(a==="/access-denied")return!0;let m=uT[a];return!!m&&!!t.capabilities?.includes(m)}function pT(e,t){let r=decodeURIComponent(t).replace(/^\/+/,""),m=N_(r===""?"index.html":r);if(m.startsWith("..")||m.includes("/../"))return null;let f=Qt(e,m);if(Ti(f)&&!cw(f).isDirectory())return f;if(!Ac(f)&&Ti(`${f}.html`))return`${f}.html`;if(!Ac(f)&&Ti(Qt(f,"index.html")))return Qt(f,"index.html");return null}async function ow(e,t){let r=pT(e,t);if(!r){let f=Qt(e,"404.html");if(Ti(f))return new Response(await oi(f),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return Ku("Not found",404)}if(cw(r).isDirectory())return Ku("Not found",404);let a=await oi(r),m=V_[Ac(r)]??"application/octet-stream";return new Response(a,{headers:{"content-type":m}})}var Wu=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"],sw=new WeakMap;async function aw(e){let t=sw.get(e);if(t)return t;let r=await import("./spend/index.js"),a=new r.SpendStore(e),m={store:a,service:new r.SpendService(a),gate:new r.SpendGate(e)};return sw.set(e,m),m}async function ka(e={}){q_();let t=e.cwd??process.cwd(),r=e.host??F_,a=e.port??z_,m=e.cliEntry??process.argv[1];if(e.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await Z_(t);let f=e.config??await Xd(),y=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,I=p(f);if(y&&I&&!I.password)I.password=y;let R=f.infrastructure?.compute?.managedServices?.vitess;if(y&&R&&typeof R==="object"&&!R.password)R.password=y;let b=Yl(t,f);if(b.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${b.reconciliation.failed} orphaned operation(s) as failed after restart.`);let T=Object.keys(f.environments??{}),N=Q_(f,e.environment),F=X_(t),z=await Cs(f,N),H=new Map([[N,z]]),K=new Map([[N,Date.now()]]),Z=new Map([[N,Date.now()]]),oe=new Map,ye=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),ee=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),ce=x(f)!=="serverless",Re=(L)=>{let Ue=H.get(L);if(Ue&&!XS(K.get(L),Date.now(),ye))return Promise.resolve(Ue);let Ve=oe.get(L);if(Ve)return Ve;let Fe=!ce||XS(Z.get(L),Date.now(),ee),nt=Cs(f,L,{includeSiteHealth:Fe}).then((Tt)=>{let W=H.get(L),Qr=Fe?Tt:oT(W,Tt);if(H.set(L,Qr),K.set(L,Date.now()),Fe)Z.set(L,Date.now());if(W?._serverReachable!==Qr._serverReachable||W?._metricsStatus!==Qr._metricsStatus||(W?.sitesDetail?.length??0)!==(Qr.sitesDetail?.length??0))ot();return Qr}).finally(()=>oe.delete(L));return oe.set(L,nt),nt},Ae=kt(t),ue=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(e.box&&ue!=="0"&&(ue==="1"||!f.cloud?.attachTo)){let L=!1,Ue=Date.now()+300000,Ve=async()=>{if(L)return;L=!0;try{let nt=Date.now(),Tt=nt>=Ue;if(Tt)Ue=nt+300000;let W=b.environments.get(N);await Bg({controlPlane:b.store,projectId:b.project.id,environmentId:W?.id,config:f,environment:N,force:!0,lightweight:!0,includeSiteHealth:Tt})}catch(nt){if(e.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${nt instanceof Error?nt.message:String(nt)}`)}finally{L=!1}};Ve(),setInterval(()=>void Ve(),60000).unref?.()}let ae=new Map,Le=new Map,rt=new Set,vt=0;function or(L,Ue){if(L.role==="admin"&&!b.store.getActorByExternalId("user",`dashboard:${L.username.toLowerCase()}`))return L;let Ve=b.store.getActorByExternalId("user",`dashboard:${L.username.toLowerCase()}`),Fe=Ve?b.store.getMembershipForActor(b.organization.id,Ve.id):void 0;if(!Fe||Fe.status!=="active")return{...L,role:"member",sites:{},capabilities:[]};let nt=b.store.listGrants(Fe.id),Tt=b.store.resolveAuthorizationTarget(b.organization.id,Fe.scope)??b.store.resolveAuthorizationTarget(b.organization.id,{type:"project",id:b.project.id}),W=Ot({membership:Fe,grants:nt,target:Tt});if(Fe.roleTemplate==="owner"||Fe.roleTemplate==="admin")return{...L,role:"admin",sites:{},organizationRole:Fe.roleTemplate,organizationSource:Fe.source,capabilities:W};let Qr=b.environments.get(Ue),br={};for(let ct of b.store.listResources(b.project.id,Qr?.id).filter((gt)=>gt.kind==="application")){let gt=b.store.resolveAuthorizationTarget(b.organization.id,{type:"resource",id:ct.id});if(!gt||!w({membership:Fe,grants:nt,capability:"project:read",target:gt}).allowed)continue;br[ct.slug]=w({membership:Fe,grants:nt,capability:"config:write",target:gt}).allowed?"owner":"collaborator"}return{...L,role:"member",sites:br,organizationRole:Fe.roleTemplate,organizationSource:Fe.source,capabilities:W}}function ot(){vt+=1,ae.clear();for(let L of rt)Ps(L,{recursive:!0,force:!0});rt.clear()}let $t=(L,Ue)=>`${Ue}:${L.role==="admin"?"admin":`member:${Object.entries(L.sites).sort(([Ve],[Fe])=>Ve.localeCompare(Fe)).map(([Ve,Fe])=>`${Ve}=${Fe}`).join(",")}`}:${[...L.capabilities??[]].sort().join(",")}`;async function ar(L,Ue){let Ve=or(L,Ue),Fe=$t(Ve,Ue),nt=ae.get(Fe);if(nt)return nt;let Tt=Le.get(Fe);if(Tt)return Tt;let W=vt,Qr=(async()=>{let br=H.get(Ue)??await Cs(f,Ue);H.set(Ue,br);let ct={..._g(br,{user:Ve,slug:f.project.slug}),viewer:{role:Ve.role,organizationRole:Ve.organizationRole,organizationSource:Ve.organizationSource,capabilities:Ve.capabilities??[]}},gt=await aT(t,ct);if(gt&&W!==vt)return Ps(gt,{recursive:!0,force:!0}),Ae?.uiRoot;if(gt)rt.add(gt);let Mr=gt??Ae?.uiRoot;if(Mr)ae.set(Fe,Mr);return Mr})();Le.set(Fe,Qr);try{return await Qr}finally{Le.delete(Fe)}}let lt=await ar({username:"",passwordHash:"",role:"admin",sites:{}},N);if(!lt)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let Q=new WeakMap,ve=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",Ie=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(Ie&&e.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let Oe=!Ie,bt=Zb(t),jt=Oe?rS(t,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,Me=new Oi(b.store,{encryptionKey:Ke(t)}),Et=new xi(b.store),pt=new Wr(b.store),tt=new xo(b.store,{encryptionKey:Ke(t)}),Gr=new up(b.store),_s=new fp(b.store,{cwd:t}),Zn=new mp(b.store,{encryptionKey:Ke(t)}),tr=new c(b.store,{workerId:`dashboard:${process.pid}`}),cr=new Wo(b.store),si=new ia(b.store,Ke(t)),Di=new wa(b.store),Cc=new Gi(cr,tr,si),Ni=f.project?.region??"us-east-1",Ug=Ke(t),En=new Na(Di,{encryptionKey:Ug,backends:[new cn(b.store,Ug),new Ra(new V(Ni),Ni),new Da(new be(Ni),Ni),new Pa]});await mu(En,b,f);let Ju=new j(Ni),lw={aws_rds:new Jo(new ta(Ju)),aws_aurora:new Xo(new ra(Ju)),aws_elasticache:new Yo(new na(new et(Ni))),server:new Zo(new Jt),container:new ea(new Jt)},qg=(L)=>lw[L.provider],Sr=new ya(b.store),To=new Ji(Sr,tr),Vg=new Ia(si),uw={managed_database:new Sa(cr,Ju),logical_database:new Ea(cr,si),volume:new ba,files:new Ca(t),control_plane:new va(b.store,t),infrastructure:new Ta(new er(Ni))},pw=(L)=>uw[L.resourceKind],mw=(L)=>L.provider==="aws_backup"?void 0:Vg,Gu=new xt(b.store),Qu=[new Pr,new Qs(d(t,"volumes"))],ai=new Us(Gu,Qu,tr),Qa=new sa(b.store),Xn=new oa(Qa,[new en("aws"),new en("hetzner"),new en("ssh")],tr),Bi=new aa(b.store),Wg=new ca(Bi,Qa),es=new da(b.store),Hg=new la(es,tr),ci=new pa(b.store),Yu=new ga(ci,tr),Kg=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((L)=>new ma(L,b.store,b.project.id,b.organization.id)),Or=new jo(b.store),Jg=new Ko(Or,{queue:tr}),vr=new Dr(b.store),Zi=new Nr(b.store),On=new mt(b.store),at=new fi(b.store,{encryptionKey:Ke(t)}),gw=()=>aw(b.store);for(let L of b.environments.values())zo(Or,f,{organization:b.organization,project:b.project,environment:L,resources:b.store.listResources(b.project.id,L.id)});let $n=new Ai(at,{emailImpl:async(L)=>{let{email:Ue}=await import("./chunk-4j8ef0pe.js");return Ue.send(L)}}),Gg=async(L)=>{let Ue=eo(at,b.project.id,L),Ve=[];for(let Fe of Ue.filter((nt)=>nt.notify&&nt.alert))Ve.push(...await $n.deliverAll($n.enqueue(b.organization.id,Fe.alert,Fe.transition)));return Ve.push(...await $n.deliverAll($n.enqueueRemindersAndEscalations(b.organization.id,at.listAlerts(b.project.id,{environmentId:L,states:["firing"]})))),Ve.push(...await $n.retryDue()),{evaluations:Ue,deliveries:Ve}},Zu=!1,fw=async()=>{if(Zu)return;Zu=!0;try{for(let L of b.environments.values())for(let Ue of at.listHealthChecks(b.project.id,L.id).filter((Ve)=>Ve.enabled)){let Ve=at.listHealthResults(Ue.id,1)[0];if(Ve&&Date.now()-new Date(Ve.checkedAt).getTime()<Ue.intervalSeconds*1000)continue;let Fe=await new He(at).runAndEvaluate(Ue);for(let nt of Fe.evaluations.filter((Tt)=>Tt.notify&&Tt.alert))await $n.deliverAll($n.enqueue(b.organization.id,nt.alert,nt.transition))}}finally{Zu=!1}},Qg=setInterval(()=>{for(let L of b.environments.values())Gg(L.id).catch((Ue)=>console.error("ts-cloud alert evaluation failed:",Ue))},60000);Qg.unref?.();let Yg=setInterval(()=>{fw().catch((L)=>console.error("ts-cloud health check evaluation failed:",L))},30000);Yg.unref?.();let Zg=setInterval(()=>{try{Jg.tick()}catch(L){console.error("ts-cloud scheduled job evaluation failed:",L)}},30000);Zg.unref?.();let Xg=setInterval(()=>{try{To.enqueueDue(),To.enqueueRetention()}catch(L){console.error("ts-cloud backup policy evaluation failed:",L)}},30000);Xg.unref?.(),vr.cleanup();let ef=setInterval(()=>{try{vr.cleanup()}catch(L){console.error("ts-cloud preview cleanup failed:",L)}},3600000);ef.unref?.();let hw=e.queueWorker??!0,yw=cT(),vw=async(L,Ue)=>{let Fe=(L.environmentId?b.store.listEnvironments(L.projectId).find((nt)=>nt.id===L.environmentId):void 0)?.slug??String(N);if(Ue.kind==="dashboard_operation"&&Ue.operationId){let nt=H.get(Fe)??z,Tt=Pg(Ue.operationId,f,nt);if(!Tt||Tt.danger||!["scheduler","backup","worker"].includes(Tt.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let W=await zu(f,Fe,Tt);return{ok:W.ok,stdout:W.stdout,stderr:W.stderr??W.error,retryable:/temporar|unavailable|timeout|network/i.test(W.stderr??W.error??""),output:{command:W.command??null,operation:W.operation}}}if(Ue.kind==="serverless_scheduler"){let nt=await Mg(f,Fe,"run");return{ok:nt.ok,stdout:nt.stdout,stderr:nt.error,retryable:/temporar|unavailable|timeout|network/i.test(nt.error??""),output:{command:nt.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${Ue.kind}.`}},Pc=hw?new Ms(tr,{...Uc({store:b.store,execute:async(L,Ue)=>{let Ve=Ue.operation.input&&typeof Ue.operation.input==="object"&&!Array.isArray(Ue.operation.input)?Ue.operation.input:{},Fe=Ve.source&&typeof Ve.source==="object"?Ve.source:void 0,nt=t,Tt,W,Qr;try{if(Fe?.bindingId&&Fe?.connectionId&&Fe?.commitSha){let ct=tt.getBinding(String(Fe.bindingId)),gt=tt.getConnection(String(Fe.connectionId));if(!ct||!gt||ct.connectionId!==gt.id)throw Error("Queued source binding is no longer available");let _r=(ct.repositoryId?tt.getRepository(ct.repositoryId):tt.listRepositories(gt.id).find((Os)=>Os.fullName.toLowerCase()===ct.repositoryFullName.toLowerCase()))?.cloneUrl;if(!_r&&gt.provider==="generic_ssh")_r=`git@${new URL(gt.host).hostname}:${ct.repositoryFullName}.git`;if(!_r)_r=new URL(`/${ct.repositoryFullName}.git`,gt.host.endsWith("/")?gt.host:`${gt.host}/`).href;let Ce=ct.deployKeyId?tt.getDeployKey(ct.deployKeyId):void 0,dr=Ce&&ct.deployKeyId?{...Ce,privateKey:tt.getDeployPrivateKey(ct.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(gt.provider)&&L.target.previewId){let Os=We(gt,tt.getCredential(gt.id)),Se=vr.previews.getInstance(L.target.previewId);Qr=async(Nn,Oc)=>{try{await Os.setCommitStatus(ct.repositoryFullName,String(Fe.commitSha),{state:Nn,url:Se?.url,description:Oc})}catch($s){Ue.log(`Could not publish source status: ${$s instanceof Error?$s.message:String($s)}`,{stream:"stderr"})}},await Qr("pending",`Preview deployment started for ${String(Fe.commitSha).slice(0,12)}`)}Tt=zg(Qt(Hu(),"ts-cloud-queued-source-")),Ue.log(`Checking out immutable source commit ${Fe.commitSha}.`,{stream:"system"}),nt=(await $o({remote:_r,binding:ct,destination:Qt(Tt,"checkout"),ref:String(Fe.branch??ct.defaultBranch),commitSha:String(Fe.commitSha)},{credential:tt.getCredential(gt.id),deployKey:dr})).directory}if(Ue.operation.kind!=="preview.destroy"){let ct=L.target.previewId?vr.previews.getInstance(L.target.previewId):void 0,gt=ct?vr.previews.getDefinition(ct.definitionId):void 0,Mr=Ue.operation.resourceId?b.store.getResource(Ue.operation.resourceId):void 0;if(W=await En.resolve({projectId:b.project.id,environmentId:Ue.operation.environmentId,resourceId:Ue.operation.resourceId,functionId:Mr?.kind==="function"?Mr.id:void 0,previewId:ct?.id,trustedPreview:!!ct&&!ct.fork,allowedPreviewSecrets:gt?.inheritedSecrets}),W.warnings.some((_r)=>_r.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${W.warnings.filter((_r)=>_r.code==="missing_required").map((_r)=>_r.key).join(", ")}`);if(Ue.operation.resourceId)for(let _r of Object.values(W.entries))Di.setDependency({entryId:_r.id,resourceId:Ue.operation.resourceId,injectionTarget:"environment",required:_r.required,requiresRedeploy:!0});Ue.log(`Resolved configuration ${W.configurationHash.slice(0,18)} for ${Object.keys(W.values).length} keys.`,{stream:"system"})}let br=await Fg(L,{cwd:nt,cliEntry:m,signal:Ue.signal,env:W?.values,onOutput:(ct,gt)=>Ue.log(gt,{stream:ct,step:"execute",secrets:[...yw,...Object.entries(W?.entries??{}).filter(([,Mr])=>Mr.kind==="secret").map(([Mr])=>W.values[Mr]).filter(Boolean)]})});if(br.ok&&Ue.operation.resourceId&&W)for(let ct of Object.values(W.entries))Di.setDependency({entryId:ct.id,resourceId:Ue.operation.resourceId,injectionTarget:"environment",required:ct.required,requiresRedeploy:!1,lastDeployedVersion:ct.version});return await Qr?.(br.ok?"success":"failure",br.ok?`Preview is ready at ${String(Fe?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(Fe?.commitSha).slice(0,12)}`),br}catch(br){throw await Qr?.("error",`Preview deployment could not complete at ${String(Fe?.commitSha).slice(0,12)}`),br}finally{if(Tt)Ps(Tt,{recursive:!0,force:!0})}}}),...Bl({store:Or,executor:vw}),...Ol({store:cr,secrets:si,resolveAdapter:qg}),...$l(Qa,Xn.drivers),...Fl(es,[new ua("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...ql({store:ci,cleanup:Kg}),...Qc(Gu,Qu),...du({store:Sr,queue:tr,resolveSource:pw,resolveDestination:mw,validateHealth:async(L,Ue)=>{if(!L.healthCheckId)return{healthy:!0,mode:"adapter"};let Ve=at.getHealthCheck(L.healthCheckId);if(!Ve||Ve.projectId!==L.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let Fe=await new He(at).runAndEvaluate(Ve);return{healthy:Fe.result.status==="healthy",healthCheckId:Ve.id,healthResultId:Fe.result.id,target:Ue}}}),...ll({store:b.store,resolveDriver:e.releaseDriver??((L)=>({name:`${b.store.getResource(L.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:L.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(L,Ue)=>{let Ve=at.listHealthChecks(Ue.projectId,Ue.environmentId).find((nt)=>nt.enabled&&nt.name===L&&(!nt.resourceId||nt.resourceId===Ue.resourceId));if(!Ve)return{healthy:!1,message:`Named health gate ${L} was not found for this release.`};let Fe=await new He(at).runAndEvaluate(Ve);return{healthy:Fe.result.status==="healthy",evidence:{healthCheckId:Ve.id,healthResultId:Fe.result.id,status:Fe.result.status,timings:Fe.result.timings},message:Fe.result.message}}})},{parallelism:e.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(L)=>console.error("ts-cloud deployment queue worker failed:",L)}):void 0;if(bl(b),Ui(pt,te(b,String(N)),z),jt)zi(b,jt.users),oS(Me,b,jt.users);let mr=nS({cwd:t,enabled:Oe,secret:bt,authentication:Me,authorization:{store:b.store,organizationId:b.organization.id,projectId:b.project.id,defaultEnvironment:String(N)}}),wr=new Vo,tf=setInterval(()=>wr.sweep(),60000);tf.unref?.();let _c=new kc,Xu=new kc(3,900000,900000),Tc=new kc(8,900000,900000),rf=setInterval(()=>_c.prune(),300000),nf=setInterval(()=>Xu.prune(),300000),of=setInterval(()=>Tc.prune(),300000);if(rf.unref?.(),nf.unref?.(),of.unref?.(),Oe){if(jt?.generated)console.warn(`
   ts-cloud dashboard: created the first admin.
     username: ${jt.generated.username}
     password: ${jt.generated.password}

package/dist/{chunk-9syc8s7r.js → chunk-hyeeqga9.js}

@@ -1,4 +1,4 @@
-import{z,oe,T,ae,dr}from"./chunk-e8e1h2h9.js";import{o}from"./chunk-yd40pg8g.js";import{A}from"./chunk-31tvc877.js";import{y}from"./chunk-9wmer0zx.js";import{h}from"./chunk-ptq9v346.js";function Ba(t){let{bucketName:s,domain:u,aliases:e,certificateArn:p,defaultRootObject:i="index.html",errorDocument:a="404.html",passthroughUrls:c=!1,singlePageApp:g=!1,dynamicApp:C=!1,computeOriginDomain:w,computeOriginPort:x=3008,computeOriginId:E="app-compute",retainOnStackDelete:M=!1}=t,S=M?{DeletionPolicy:"Retain",UpdateReplacePolicy:"Retain"}:{},N=C&&!!w,j=N?["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"]:["GET","HEAD"],v=N?["GET","HEAD"]:["GET","HEAD"],O={},B={};O.S3Bucket={Type:"AWS::S3::Bucket",...S,Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:a}}},B.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},B.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},O.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",...S,Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}};let I;if(c&&N)I="InstallRootRedirectFunction",O[I]={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-install-root-redirect"},AutoPublish:!0,FunctionConfig:{Comment:"Redirect curl pantry.dev | bash (GET /) to /install.sh on S3",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
+import{z,oe,T,ae,dr}from"./chunk-e8e1h2h9.js";import{o}from"./chunk-9asn5fpt.js";import{A}from"./chunk-31tvc877.js";import{y}from"./chunk-9wmer0zx.js";import{h}from"./chunk-ptq9v346.js";function Ba(t){let{bucketName:s,domain:u,aliases:e,certificateArn:p,defaultRootObject:i="index.html",errorDocument:a="404.html",passthroughUrls:c=!1,singlePageApp:g=!1,dynamicApp:C=!1,computeOriginDomain:w,computeOriginPort:x=3008,computeOriginId:E="app-compute",retainOnStackDelete:M=!1}=t,S=M?{DeletionPolicy:"Retain",UpdateReplacePolicy:"Retain"}:{},N=C&&!!w,j=N?["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"]:["GET","HEAD"],v=N?["GET","HEAD"]:["GET","HEAD"],O={},B={};O.S3Bucket={Type:"AWS::S3::Bucket",...S,Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:a}}},B.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},B.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},O.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",...S,Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}};let I;if(c&&N)I="InstallRootRedirectFunction",O[I]={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-install-root-redirect"},AutoPublish:!0,FunctionConfig:{Comment:"Redirect curl pantry.dev | bash (GET /) to /install.sh on S3",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
   var request = event.request;
   if (request.uri === '/' || request.uri === '') {
     return {
@@ -42,7 +42,7 @@ import{z,oe,T,ae,dr}from"./chunk-e8e1h2h9.js";import{o}from"./chunk-yd40pg8g.js"
 │                                                                             │
 │  Verification typically takes 1-2 business days.                            │
 │  After verification, re-run: bunx bunpress deploy                           │
-└─────────────────────────────────────────────────────────────────────────────┘`),{success:!1,stackId:B,stackName:i,bucket:N,message:"CloudFront account verification required. Please contact AWS Support."}}return{success:!1,stackId:B,stackName:i,bucket:N,message:`Stack deployment failed: ${n.message}`}}let d=(await a.describeStacks({stackName:i})).Stacks[0]?.Outputs||[],k=(n)=>d.find((r)=>r.OutputKey===n)?.OutputValue,b=k("DistributionDomain");if(b&&g)console.log(`Creating DNS records via ${g.name}...`),await H(g,e,b);else if(b&&!g)console.log("Skipping DNS record creation (DNS verification was skipped)");return{success:!0,stackId:B,stackName:i,bucket:k("BucketName")||N,distributionId:k("DistributionId"),distributionDomain:b,domain:e,certificateArn:C,message:"Static site infrastructure deployed successfully with external DNS"}}async function H(t,s,u){if(!t){console.log("Skipping DNS record creation (DNS verification was skipped)");return}if(s.split(".").length===2)if(t instanceof z){console.log(`Creating Route53 alias record for apex domain ${s} -> ${u}`);let i=await t.createCloudFrontAlias({domain:s,name:s,cloudFrontDomainName:u});if(!i.success)console.warn(`Warning: Could not create Route53 alias record: ${i.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${s} -> ${u}`);else console.log(`Created Route53 alias record: ${s} -> ${u}`);let a=`www.${s}`;console.log(`Creating Route53 alias record for ${a} -> ${u}`);let c=await t.createCloudFrontAlias({domain:s,name:a,cloudFrontDomainName:u});if(!c.success)console.warn(`Warning: Could not create www Route53 alias: ${c.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${a} -> ${u}`);else console.log(`Created Route53 alias record: ${a} -> ${u}`)}else{try{let g=await t.listRecords(s,"A");if(g.success)for(let C of g.records){let w=C.name.replace(/\.$/,"");if(w===s||w==="")console.log(`Removing existing root A record (${C.content}) to make room for ALIAS...`),await t.deleteRecord(s,{name:s,type:"A",content:C.content})}}catch(g){console.log(`Note: Could not check for conflicting A records: ${g instanceof Error?g.message:g}`)}console.log(`Creating ALIAS record for apex domain ${s} -> ${u}`);let i=await t.upsertRecord(s,{name:s,type:"ALIAS",content:u,ttl:600});if(!i.success)console.warn(`Warning: Could not create ALIAS record: ${i.message}`),console.warn("Please manually create an ALIAS record in your DNS provider:"),console.warn(`  ${s} -> ${u}`);else console.log(`Created ALIAS record: ${s} -> ${u}`);let a=`www.${s}`;console.log(`Creating CNAME record for ${a} -> ${u}`);let c=await t.upsertRecord(s,{name:a,type:"CNAME",content:u,ttl:600});if(!c.success)console.warn(`Warning: Could not create www DNS record: ${c.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${a} -> ${u}`);else console.log(`Created CNAME record: ${a} -> ${u}`)}else{console.log(`Creating CNAME record for ${s} -> ${u}`);let i=await t.upsertRecord(s,{name:s,type:"CNAME",content:u,ttl:600});if(!i.success)console.warn(`Warning: Could not create DNS record: ${i.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${s} -> ${u}`);else console.log(`Created CNAME record: ${s} -> ${u}`)}}async function un(t){let{sourceDir:s,cleanBucket:u=!1,onProgress:e,...p}=t;e?.("infrastructure","Deploying CloudFormation stack...");let i=await ln(p);if(!i.success)return i;if(u){e?.("clean","Cleaning old files from S3...");try{await new o(p.region||"us-east-1").emptyBucket(i.bucket)}catch(C){console.log(`Note: Could not clean bucket: ${C.message}`)}}e?.("upload","Uploading files to S3...");let{uploadStaticFiles:a}=await import("./chunk-rtn4gj6y.js"),c=await a({sourceDir:s,bucket:i.bucket,region:p.region||"us-east-1",cacheControl:p.cacheControl,onProgress:(C,w,x)=>{e?.("upload",`${C}/${w}: ${x}`)}});if(c.errors.length>0)return{...i,success:!1,message:`Upload errors: ${c.errors.join(", ")}`,filesUploaded:c.uploaded};if(i.distributionId&&c.uploaded>0){e?.("invalidate","Invalidating CloudFront cache...");let{invalidateCache:C}=await import("./chunk-rtn4gj6y.js");await C(i.distributionId)}e?.("complete","Deployment complete!");let g=c.skipped>0?`Deployed ${c.uploaded} files (${c.skipped} unchanged) with external DNS`:`Deployed ${c.uploaded} files successfully with external DNS`;return{...i,filesUploaded:c.uploaded,filesSkipped:c.skipped,message:g}}function Zi(t){let{bucketName:s,domain:u,certificateArn:e,hostedZoneId:p,defaultRootObject:i="index.html",errorDocument:a="404.html"}=t,c={},g={};c.S3Bucket={Type:"AWS::S3::Bucket",Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:a}}},g.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},g.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},c.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},c.UrlRewriteFunction={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-url-rewrite"},AutoPublish:!0,FunctionConfig:{Comment:"Append .html extension to URLs without extensions",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
+└─────────────────────────────────────────────────────────────────────────────┘`),{success:!1,stackId:B,stackName:i,bucket:N,message:"CloudFront account verification required. Please contact AWS Support."}}return{success:!1,stackId:B,stackName:i,bucket:N,message:`Stack deployment failed: ${n.message}`}}let d=(await a.describeStacks({stackName:i})).Stacks[0]?.Outputs||[],k=(n)=>d.find((r)=>r.OutputKey===n)?.OutputValue,b=k("DistributionDomain");if(b&&g)console.log(`Creating DNS records via ${g.name}...`),await H(g,e,b);else if(b&&!g)console.log("Skipping DNS record creation (DNS verification was skipped)");return{success:!0,stackId:B,stackName:i,bucket:k("BucketName")||N,distributionId:k("DistributionId"),distributionDomain:b,domain:e,certificateArn:C,message:"Static site infrastructure deployed successfully with external DNS"}}async function H(t,s,u){if(!t){console.log("Skipping DNS record creation (DNS verification was skipped)");return}if(s.split(".").length===2)if(t instanceof z){console.log(`Creating Route53 alias record for apex domain ${s} -> ${u}`);let i=await t.createCloudFrontAlias({domain:s,name:s,cloudFrontDomainName:u});if(!i.success)console.warn(`Warning: Could not create Route53 alias record: ${i.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${s} -> ${u}`);else console.log(`Created Route53 alias record: ${s} -> ${u}`);let a=`www.${s}`;console.log(`Creating Route53 alias record for ${a} -> ${u}`);let c=await t.createCloudFrontAlias({domain:s,name:a,cloudFrontDomainName:u});if(!c.success)console.warn(`Warning: Could not create www Route53 alias: ${c.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${a} -> ${u}`);else console.log(`Created Route53 alias record: ${a} -> ${u}`)}else{try{let g=await t.listRecords(s,"A");if(g.success)for(let C of g.records){let w=C.name.replace(/\.$/,"");if(w===s||w==="")console.log(`Removing existing root A record (${C.content}) to make room for ALIAS...`),await t.deleteRecord(s,{name:s,type:"A",content:C.content})}}catch(g){console.log(`Note: Could not check for conflicting A records: ${g instanceof Error?g.message:g}`)}console.log(`Creating ALIAS record for apex domain ${s} -> ${u}`);let i=await t.upsertRecord(s,{name:s,type:"ALIAS",content:u,ttl:600});if(!i.success)console.warn(`Warning: Could not create ALIAS record: ${i.message}`),console.warn("Please manually create an ALIAS record in your DNS provider:"),console.warn(`  ${s} -> ${u}`);else console.log(`Created ALIAS record: ${s} -> ${u}`);let a=`www.${s}`;console.log(`Creating CNAME record for ${a} -> ${u}`);let c=await t.upsertRecord(s,{name:a,type:"CNAME",content:u,ttl:600});if(!c.success)console.warn(`Warning: Could not create www DNS record: ${c.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${a} -> ${u}`);else console.log(`Created CNAME record: ${a} -> ${u}`)}else{console.log(`Creating CNAME record for ${s} -> ${u}`);let i=await t.upsertRecord(s,{name:s,type:"CNAME",content:u,ttl:600});if(!i.success)console.warn(`Warning: Could not create DNS record: ${i.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${s} -> ${u}`);else console.log(`Created CNAME record: ${s} -> ${u}`)}}async function un(t){let{sourceDir:s,cleanBucket:u=!1,onProgress:e,...p}=t;e?.("infrastructure","Deploying CloudFormation stack...");let i=await ln(p);if(!i.success)return i;if(u){e?.("clean","Cleaning old files from S3...");try{await new o(p.region||"us-east-1").emptyBucket(i.bucket)}catch(C){console.log(`Note: Could not clean bucket: ${C.message}`)}}e?.("upload","Uploading files to S3...");let{uploadStaticFiles:a}=await import("./chunk-07rjctzz.js"),c=await a({sourceDir:s,bucket:i.bucket,region:p.region||"us-east-1",cacheControl:p.cacheControl,onProgress:(C,w,x)=>{e?.("upload",`${C}/${w}: ${x}`)}});if(c.errors.length>0)return{...i,success:!1,message:`Upload errors: ${c.errors.join(", ")}`,filesUploaded:c.uploaded};if(i.distributionId&&c.uploaded>0){e?.("invalidate","Invalidating CloudFront cache...");let{invalidateCache:C}=await import("./chunk-07rjctzz.js");await C(i.distributionId)}e?.("complete","Deployment complete!");let g=c.skipped>0?`Deployed ${c.uploaded} files (${c.skipped} unchanged) with external DNS`:`Deployed ${c.uploaded} files successfully with external DNS`;return{...i,filesUploaded:c.uploaded,filesSkipped:c.skipped,message:g}}function Zi(t){let{bucketName:s,domain:u,certificateArn:e,hostedZoneId:p,defaultRootObject:i="index.html",errorDocument:a="404.html"}=t,c={},g={};c.S3Bucket={Type:"AWS::S3::Bucket",Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:a}}},g.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},g.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},c.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},c.UrlRewriteFunction={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-url-rewrite"},AutoPublish:!0,FunctionConfig:{Comment:"Append .html extension to URLs without extensions",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
   const request = event.request;
   var uri = request.uri;
 

package/dist/{chunk-c3f89ryr.js → chunk-r1wpwfff.js}

@@ -1,4 +1,4 @@
-import{n}from"./chunk-zx8ecz8b.js";import{o}from"./chunk-yd40pg8g.js";import{y}from"./chunk-9wmer0zx.js";import{Fe}from"./chunk-bxrzsth8.js";function S(e,t){let s=[`Action=${e}`,"Version=2010-05-08"];for(let[a,i]of Object.entries(t)){if(i===void 0||i===null)continue;if(Array.isArray(i))i.forEach((c,u)=>{if(typeof c==="object"&&c!==null)for(let[d,m]of Object.entries(c))s.push(`${a}.member.${u+1}.${d}=${encodeURIComponent(String(m))}`);else s.push(`${a}.member.${u+1}=${encodeURIComponent(String(c))}`)});else if(typeof i==="object"){for(let[c,u]of Object.entries(i))if(u!==void 0&&u!==null)s.push(`${a}.${c}=${encodeURIComponent(String(u))}`)}else s.push(`${a}=${encodeURIComponent(String(i))}`)}return s.join("&")}function r(e,t){let s=new RegExp(`<${t}>([^<]*)</${t}>`),a=e.match(s);return a?a[1]:void 0}function l(e,t,s){let a=new RegExp(`<${t}>([\\s\\S]*?)</${t}>`),i=e.match(a);if(!i)return[];let c=[],u=new RegExp(`<${s}>([\\s\\S]*?)</${s}>`,"g"),d;while((d=u.exec(i[1]))!==null)c.push(d[1]);return c}class fe{client;region;constructor(e="us-east-1",t){this.client=new n(void 0,{profile:t}),this.region=e}async request(e,t={}){let s=S(e,t);return await this.client.request({service:"iam",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:s})}async createUser(e){let t=await this.request("CreateUser",e);return this.parseUser(t)}async getUser(e={}){let t=await this.request("GetUser",e);return this.parseUser(t)}async listUsers(e={}){let t=await this.request("ListUsers",e),s=this.parseUsers(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{Users:s,IsTruncated:a,Marker:i}}async updateUser(e){await this.request("UpdateUser",e)}async deleteUser(e){await this.request("DeleteUser",e)}parseUser(e){return{UserName:r(e,"UserName")||"",UserId:r(e,"UserId")||"",Arn:r(e,"Arn")||"",Path:r(e,"Path"),CreateDate:r(e,"CreateDate"),PasswordLastUsed:r(e,"PasswordLastUsed")}}parseUsers(e){return l(e,"Users","member").map((s)=>({UserName:r(s,"UserName")||"",UserId:r(s,"UserId")||"",Arn:r(s,"Arn")||"",Path:r(s,"Path"),CreateDate:r(s,"CreateDate"),PasswordLastUsed:r(s,"PasswordLastUsed")}))}async createGroup(e){let t=await this.request("CreateGroup",e);return this.parseGroup(t)}async getGroup(e){let t=await this.request("GetGroup",e),s=this.parseGroup(t),a=this.parseUsers(t),i=r(t,"IsTruncated")==="true",c=r(t,"Marker");return{Group:s,Users:a,IsTruncated:i,Marker:c}}async listGroups(e={}){let t=await this.request("ListGroups",e),s=this.parseGroups(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{Groups:s,IsTruncated:a,Marker:i}}async updateGroup(e){await this.request("UpdateGroup",e)}async deleteGroup(e){await this.request("DeleteGroup",e)}async addUserToGroup(e){await this.request("AddUserToGroup",e)}async removeUserFromGroup(e){await this.request("RemoveUserFromGroup",e)}async listGroupsForUser(e){let t=await this.request("ListGroupsForUser",e),s=this.parseGroups(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{Groups:s,IsTruncated:a,Marker:i}}parseGroup(e){return{GroupName:r(e,"GroupName")||"",GroupId:r(e,"GroupId")||"",Arn:r(e,"Arn")||"",Path:r(e,"Path"),CreateDate:r(e,"CreateDate")}}parseGroups(e){return l(e,"Groups","member").map((s)=>({GroupName:r(s,"GroupName")||"",GroupId:r(s,"GroupId")||"",Arn:r(s,"Arn")||"",Path:r(s,"Path"),CreateDate:r(s,"CreateDate")}))}async createRole(e){let t=await this.request("CreateRole",e);return this.parseRole(t)}async getRole(e){let t=await this.request("GetRole",e);return this.parseRole(t)}async listRoles(e={}){let t=await this.request("ListRoles",e),s=this.parseRoles(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{Roles:s,IsTruncated:a,Marker:i}}async updateRole(e){await this.request("UpdateRole",e)}async updateRoleDescription(e){let t=await this.request("UpdateRoleDescription",e);return this.parseRole(t)}async updateAssumeRolePolicy(e){await this.request("UpdateAssumeRolePolicy",e)}async deleteRole(e){await this.request("DeleteRole",e)}async tagRole(e){await this.request("TagRole",e)}async untagRole(e){await this.request("UntagRole",e)}async listRoleTags(e){let t=await this.request("ListRoleTags",e),s=this.parseTags(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{Tags:s,IsTruncated:a,Marker:i}}parseRole(e){return{RoleName:r(e,"RoleName")||"",RoleId:r(e,"RoleId")||"",Arn:r(e,"Arn")||"",Path:r(e,"Path"),CreateDate:r(e,"CreateDate"),AssumeRolePolicyDocument:r(e,"AssumeRolePolicyDocument"),Description:r(e,"Description"),MaxSessionDuration:r(e,"MaxSessionDuration")?Number.parseInt(r(e,"MaxSessionDuration"),10):void 0}}parseRoles(e){return l(e,"Roles","member").map((s)=>({RoleName:r(s,"RoleName")||"",RoleId:r(s,"RoleId")||"",Arn:r(s,"Arn")||"",Path:r(s,"Path"),CreateDate:r(s,"CreateDate"),AssumeRolePolicyDocument:r(s,"AssumeRolePolicyDocument"),Description:r(s,"Description"),MaxSessionDuration:r(s,"MaxSessionDuration")?Number.parseInt(r(s,"MaxSessionDuration"),10):void 0}))}parseTags(e){return l(e,"Tags","member").map((s)=>({Key:r(s,"Key")||"",Value:r(s,"Value")||""}))}async createPolicy(e){let t=await this.request("CreatePolicy",e);return this.parsePolicy(t)}async getPolicy(e){let t=await this.request("GetPolicy",e);return this.parsePolicy(t)}async getPolicyVersion(e){let t=await this.request("GetPolicyVersion",e);return{VersionId:r(t,"VersionId")||"",IsDefaultVersion:r(t,"IsDefaultVersion")==="true",CreateDate:r(t,"CreateDate"),Document:r(t,"Document")}}async listPolicies(e={}){let t=await this.request("ListPolicies",e),s=this.parsePolicies(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{Policies:s,IsTruncated:a,Marker:i}}async listPolicyVersions(e){let t=await this.request("ListPolicyVersions",e),s=this.parsePolicyVersions(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{Versions:s,IsTruncated:a,Marker:i}}async createPolicyVersion(e){let t=await this.request("CreatePolicyVersion",e);return{VersionId:r(t,"VersionId")||"",IsDefaultVersion:r(t,"IsDefaultVersion")==="true",CreateDate:r(t,"CreateDate")}}async deletePolicyVersion(e){await this.request("DeletePolicyVersion",e)}async setDefaultPolicyVersion(e){await this.request("SetDefaultPolicyVersion",e)}async deletePolicy(e){await this.request("DeletePolicy",e)}async attachUserPolicy(e){await this.request("AttachUserPolicy",e)}async detachUserPolicy(e){await this.request("DetachUserPolicy",e)}async attachGroupPolicy(e){await this.request("AttachGroupPolicy",e)}async detachGroupPolicy(e){await this.request("DetachGroupPolicy",e)}async attachRolePolicy(e){await this.request("AttachRolePolicy",e)}async detachRolePolicy(e){await this.request("DetachRolePolicy",e)}async listAttachedUserPolicies(e){let t=await this.request("ListAttachedUserPolicies",e),s=this.parseAttachedPolicies(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{AttachedPolicies:s,IsTruncated:a,Marker:i}}async listAttachedGroupPolicies(e){let t=await this.request("ListAttachedGroupPolicies",e),s=this.parseAttachedPolicies(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{AttachedPolicies:s,IsTruncated:a,Marker:i}}async listAttachedRolePolicies(e){let t=await this.request("ListAttachedRolePolicies",e),s=this.parseAttachedPolicies(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{AttachedPolicies:s,IsTruncated:a,Marker:i}}parsePolicy(e){return{PolicyName:r(e,"PolicyName")||"",PolicyId:r(e,"PolicyId")||"",Arn:r(e,"Arn")||"",Path:r(e,"Path"),DefaultVersionId:r(e,"DefaultVersionId"),AttachmentCount:r(e,"AttachmentCount")?Number.parseInt(r(e,"AttachmentCount"),10):void 0,PermissionsBoundaryUsageCount:r(e,"PermissionsBoundaryUsageCount")?Number.parseInt(r(e,"PermissionsBoundaryUsageCount"),10):void 0,IsAttachable:r(e,"IsAttachable")==="true",Description:r(e,"Description"),CreateDate:r(e,"CreateDate"),UpdateDate:r(e,"UpdateDate")}}parsePolicies(e){return l(e,"Policies","member").map((s)=>({PolicyName:r(s,"PolicyName")||"",PolicyId:r(s,"PolicyId")||"",Arn:r(s,"Arn")||"",Path:r(s,"Path"),DefaultVersionId:r(s,"DefaultVersionId"),AttachmentCount:r(s,"AttachmentCount")?Number.parseInt(r(s,"AttachmentCount"),10):void 0,PermissionsBoundaryUsageCount:r(s,"PermissionsBoundaryUsageCount")?Number.parseInt(r(s,"PermissionsBoundaryUsageCount"),10):void 0,IsAttachable:r(s,"IsAttachable")==="true",Description:r(s,"Description"),CreateDate:r(s,"CreateDate"),UpdateDate:r(s,"UpdateDate")}))}parsePolicyVersions(e){return l(e,"Versions","member").map((s)=>({VersionId:r(s,"VersionId")||"",IsDefaultVersion:r(s,"IsDefaultVersion")==="true",CreateDate:r(s,"CreateDate")}))}parseAttachedPolicies(e){return l(e,"AttachedPolicies","member").map((s)=>({PolicyName:r(s,"PolicyName")||"",PolicyArn:r(s,"PolicyArn")||""}))}async putUserPolicy(e){await this.request("PutUserPolicy",e)}async getUserPolicy(e){let t=await this.request("GetUserPolicy",e);return{UserName:r(t,"UserName")||"",PolicyName:r(t,"PolicyName")||"",PolicyDocument:decodeURIComponent(r(t,"PolicyDocument")||"")}}async deleteUserPolicy(e){await this.request("DeleteUserPolicy",e)}async listUserPolicies(e){let t=await this.request("ListUserPolicies",e),s=l(t,"PolicyNames","member"),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{PolicyNames:s,IsTruncated:a,Marker:i}}async putGroupPolicy(e){await this.request("PutGroupPolicy",e)}async getGroupPolicy(e){let t=await this.request("GetGroupPolicy",e);return{GroupName:r(t,"GroupName")||"",PolicyName:r(t,"PolicyName")||"",PolicyDocument:decodeURIComponent(r(t,"PolicyDocument")||"")}}async deleteGroupPolicy(e){await this.request("DeleteGroupPolicy",e)}async listGroupPolicies(e){let t=await this.request("ListGroupPolicies",e),s=l(t,"PolicyNames","member"),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{PolicyNames:s,IsTruncated:a,Marker:i}}async putRolePolicy(e){await this.request("PutRolePolicy",e)}async getRolePolicy(e){let t=await this.request("GetRolePolicy",e);return{RoleName:r(t,"RoleName")||"",PolicyName:r(t,"PolicyName")||"",PolicyDocument:decodeURIComponent(r(t,"PolicyDocument")||"")}}async deleteRolePolicy(e){await this.request("DeleteRolePolicy",e)}async listRolePolicies(e){let t=await this.request("ListRolePolicies",e),s=l(t,"PolicyNames","member"),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{PolicyNames:s,IsTruncated:a,Marker:i}}async createAccessKey(e={}){let t=await this.request("CreateAccessKey",e);if(typeof t==="object"){let s=t?.CreateAccessKeyResult?.AccessKey||t?.AccessKey;if(s)return{AccessKey:{UserName:s.UserName||"",AccessKeyId:s.AccessKeyId||"",Status:s.Status||"Active",SecretAccessKey:s.SecretAccessKey||"",CreateDate:s.CreateDate}}}return{AccessKey:{UserName:r(t,"UserName")||"",AccessKeyId:r(t,"AccessKeyId")||"",Status:r(t,"Status")||"Active",SecretAccessKey:r(t,"SecretAccessKey")||"",CreateDate:r(t,"CreateDate")}}}async listAccessKeys(e={}){let t=await this.request("ListAccessKeys",e),s=this.parseAccessKeys(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{AccessKeyMetadata:s,IsTruncated:a,Marker:i}}async updateAccessKey(e){await this.request("UpdateAccessKey",e)}async deleteAccessKey(e){await this.request("DeleteAccessKey",e)}async getAccessKeyLastUsed(e){let t=await this.request("GetAccessKeyLastUsed",e);return{UserName:r(t,"UserName")||"",AccessKeyLastUsed:{LastUsedDate:r(t,"LastUsedDate"),ServiceName:r(t,"ServiceName"),Region:r(t,"Region")}}}parseAccessKeys(e){return l(e,"AccessKeyMetadata","member").map((s)=>({UserName:r(s,"UserName"),AccessKeyId:r(s,"AccessKeyId")||"",Status:r(s,"Status")||"Active",CreateDate:r(s,"CreateDate")}))}async createInstanceProfile(e){let t=await this.request("CreateInstanceProfile",e);return this.parseInstanceProfile(t)}async getInstanceProfile(e){let t=await this.request("GetInstanceProfile",e);return this.parseInstanceProfile(t)}async listInstanceProfiles(e={}){let t=await this.request("ListInstanceProfiles",e),s=this.parseInstanceProfiles(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{InstanceProfiles:s,IsTruncated:a,Marker:i}}async listInstanceProfilesForRole(e){let t=await this.request("ListInstanceProfilesForRole",e),s=this.parseInstanceProfiles(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{InstanceProfiles:s,IsTruncated:a,Marker:i}}async addRoleToInstanceProfile(e){await this.request("AddRoleToInstanceProfile",e)}async removeRoleFromInstanceProfile(e){await this.request("RemoveRoleFromInstanceProfile",e)}async deleteInstanceProfile(e){await this.request("DeleteInstanceProfile",e)}parseInstanceProfile(e){return{InstanceProfileName:r(e,"InstanceProfileName")||"",InstanceProfileId:r(e,"InstanceProfileId")||"",Arn:r(e,"Arn")||"",Path:r(e,"Path"),CreateDate:r(e,"CreateDate")}}parseInstanceProfiles(e){return l(e,"InstanceProfiles","member").map((s)=>({InstanceProfileName:r(s,"InstanceProfileName")||"",InstanceProfileId:r(s,"InstanceProfileId")||"",Arn:r(s,"Arn")||"",Path:r(s,"Path"),CreateDate:r(s,"CreateDate")}))}async getAccountPasswordPolicy(){let e=await this.request("GetAccountPasswordPolicy");return{MinimumPasswordLength:r(e,"MinimumPasswordLength")?Number.parseInt(r(e,"MinimumPasswordLength"),10):void 0,RequireSymbols:r(e,"RequireSymbols")==="true",RequireNumbers:r(e,"RequireNumbers")==="true",RequireUppercaseCharacters:r(e,"RequireUppercaseCharacters")==="true",RequireLowercaseCharacters:r(e,"RequireLowercaseCharacters")==="true",AllowUsersToChangePassword:r(e,"AllowUsersToChangePassword")==="true",ExpirePasswords:r(e,"ExpirePasswords")==="true",MaxPasswordAge:r(e,"MaxPasswordAge")?Number.parseInt(r(e,"MaxPasswordAge"),10):void 0,PasswordReusePrevention:r(e,"PasswordReusePrevention")?Number.parseInt(r(e,"PasswordReusePrevention"),10):void 0,HardExpiry:r(e,"HardExpiry")==="true"}}async updateAccountPasswordPolicy(e){await this.request("UpdateAccountPasswordPolicy",e)}async deleteAccountPasswordPolicy(){await this.request("DeleteAccountPasswordPolicy")}async getAccountSummary(){let e=await this.request("GetAccountSummary"),t={},s=l(e,"SummaryMap","entry");for(let a of s){let i=r(a,"key"),c=r(a,"value");if(i&&c)t[i]=Number.parseInt(c,10)}return t}async listAccountAliases(){let e=await this.request("ListAccountAliases"),t=l(e,"AccountAliases","member"),s=r(e,"IsTruncated")==="true",a=r(e,"Marker");return{AccountAliases:t,IsTruncated:s,Marker:a}}async createAccountAlias(e){await this.request("CreateAccountAlias",e)}async deleteAccountAlias(e){await this.request("DeleteAccountAlias",e)}async simulatePrincipalPolicy(e){let t=await this.request("SimulatePrincipalPolicy",e);return this.parseSimulationResults(t)}parseSimulationResults(e){let s=l(e,"EvaluationResults","member").map((c)=>{let d=l(c,"MatchedStatements","member").map((m)=>({SourcePolicyId:r(m,"SourcePolicyId"),SourcePolicyType:r(m,"SourcePolicyType")}));return{EvalActionName:r(c,"EvalActionName")||"",EvalResourceName:r(c,"EvalResourceName"),EvalDecision:r(c,"EvalDecision")||"",MatchedStatements:d.length>0?d:void 0}}),a=r(e,"IsTruncated")==="true",i=r(e,"Marker");return{EvaluationResults:s,IsTruncated:a,Marker:i}}}class tt{client;region;constructor(e="us-east-1",t){this.region=e,this.client=new n(t)}async createEmailIdentity(e){return await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/identities",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)})}async getEmailIdentity(e){let t=await this.client.request({service:"email",region:this.region,method:"GET",path:`/v2/email/identities/${encodeURIComponent(e)}`,headers:{"Content-Type":"application/json"}});return{IdentityType:t.IdentityType,IdentityName:e,SendingEnabled:t.VerifiedForSendingStatus,VerificationStatus:t.VerificationStatus,DkimAttributes:t.DkimAttributes,MailFromAttributes:t.MailFromAttributes}}async putEmailIdentityMailFromAttributes(e,t){await this.client.request({service:"email",region:this.region,method:"PUT",path:`/v2/email/identities/${encodeURIComponent(e)}/mail-from`,headers:{"Content-Type":"application/json"},body:JSON.stringify(t)})}async listEmailIdentities(e){let t="/v2/email/identities",s=[];if(e?.PageSize)s.push(`PageSize=${e.PageSize}`);if(e?.NextToken)s.push(`NextToken=${encodeURIComponent(e.NextToken)}`);if(s.length>0)t+=`?${s.join("&")}`;let a=await this.client.request({service:"email",region:this.region,method:"GET",path:t,headers:{"Content-Type":"application/json"}});return{EmailIdentities:a.EmailIdentities,NextToken:a.NextToken}}async deleteEmailIdentity(e){await this.client.request({service:"email",region:this.region,method:"DELETE",path:`/v2/email/identities/${encodeURIComponent(e)}`,headers:{"Content-Type":"application/json"}})}async putEmailIdentityDkimAttributes(e){await this.client.request({service:"email",region:this.region,method:"PUT",path:`/v2/email/identities/${encodeURIComponent(e.EmailIdentity)}/dkim`,headers:{"Content-Type":"application/json"},body:JSON.stringify({SigningEnabled:e.SigningEnabled})})}async sendEmail(e){return{MessageId:(await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/outbound-emails",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)})).MessageId}}async sendBulkEmail(e){return{BulkEmailEntryResults:(await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/outbound-bulk-emails",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)})).BulkEmailEntryResults}}async createEmailTemplate(e){await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/templates",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)})}async getEmailTemplate(e){return await this.client.request({service:"email",region:this.region,method:"GET",path:`/v2/email/templates/${encodeURIComponent(e)}`,headers:{"Content-Type":"application/json"}})}async deleteEmailTemplate(e){await this.client.request({service:"email",region:this.region,method:"DELETE",path:`/v2/email/templates/${encodeURIComponent(e)}`,headers:{"Content-Type":"application/json"}})}async listEmailTemplates(e){let t="/v2/email/templates",s=[];if(e?.PageSize)s.push(`PageSize=${e.PageSize}`);if(e?.NextToken)s.push(`NextToken=${encodeURIComponent(e.NextToken)}`);if(s.length>0)t+=`?${s.join("&")}`;return await this.client.request({service:"email",region:this.region,method:"GET",path:t,headers:{"Content-Type":"application/json"}})}async getSendStatistics(){return{SendDataPoints:(await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=GetSendStatistics&Version=2010-12-01"})).GetSendStatisticsResponse?.GetSendStatisticsResult?.SendDataPoints?.member}}async getSendQuota(){let t=(await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=GetSendQuota&Version=2010-12-01"})).GetSendQuotaResponse?.GetSendQuotaResult;return{Max24HourSend:t?.Max24HourSend?Number(t.Max24HourSend):void 0,MaxSendRate:t?.MaxSendRate?Number(t.MaxSendRate):void 0,SentLast24Hours:t?.SentLast24Hours?Number(t.SentLast24Hours):void 0}}async verifyDomain(e){let t=await this.createEmailIdentity({EmailIdentity:e});return{dkimTokens:t.DkimAttributes?.Tokens,verificationStatus:t.DkimAttributes?.Status}}async sendSimpleEmail(e){let t=Array.isArray(e.to)?e.to:[e.to],s=e.replyTo?Array.isArray(e.replyTo)?e.replyTo:[e.replyTo]:void 0,a={};if(e.text)a.Text={Data:e.text};if(e.html)a.Html={Data:e.html};return this.sendEmail({FromEmailAddress:e.from,Destination:{ToAddresses:t},Content:{Simple:{Subject:{Data:e.subject},Body:a}},ReplyToAddresses:s})}async sendTemplatedEmail(e){let t=Array.isArray(e.to)?e.to:[e.to],s=e.replyTo?Array.isArray(e.replyTo)?e.replyTo:[e.replyTo]:void 0;return this.sendEmail({FromEmailAddress:e.from,Destination:{ToAddresses:t},Content:{Template:{TemplateName:e.templateName,TemplateData:JSON.stringify(e.templateData)}},ReplyToAddresses:s})}async getDkimRecords(e){let t=await this.getEmailIdentity(e);if(!t.DkimAttributes?.Tokens)return[];return t.DkimAttributes.Tokens.map((s)=>({name:`${s}._domainkey.${e}`,type:"CNAME",value:`${s}.dkim.amazonses.com`}))}async isDomainVerified(e){try{let t=await this.getEmailIdentity(e);return t.VerificationStatus==="SUCCESS"&&t.SendingEnabled===!0}catch{return!1}}async waitForDomainVerification(e,t=60,s=30000){for(let a=0;a<t;a++){if(await this.isDomainVerified(e))return!0;await new Promise((c)=>setTimeout(c,s))}return!1}buildFormBody(e){return Object.entries(e).filter(([,s])=>s!==void 0).map(([s,a])=>`${encodeURIComponent(s)}=${encodeURIComponent(a)}`).join("&")}async createReceiptRuleSet(e){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"CreateReceiptRuleSet",Version:"2010-12-01",RuleSetName:e})})}async deleteReceiptRuleSet(e){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteReceiptRuleSet",Version:"2010-12-01",RuleSetName:e})})}async setActiveReceiptRuleSet(e){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"SetActiveReceiptRuleSet",Version:"2010-12-01",RuleSetName:e})})}async listReceiptRuleSets(e){let t={Action:"ListReceiptRuleSets",Version:"2010-12-01"};if(e)t.NextToken=e;let s=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)}),a=s?.ListReceiptRuleSetsResponse?.ListReceiptRuleSetsResult||s?.ListReceiptRuleSetsResult,i=a?.RuleSets?.member;return{RuleSets:Array.isArray(i)?i:i?[i]:[],NextToken:a?.NextToken}}async describeReceiptRuleSet(e){let t=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DescribeReceiptRuleSet",Version:"2010-12-01",RuleSetName:e})}),s=t?.DescribeReceiptRuleSetResponse?.DescribeReceiptRuleSetResult||t?.DescribeReceiptRuleSetResult,a=s?.Rules?.member;return{Metadata:s?.Metadata,Rules:Array.isArray(a)?a:a?[a]:[]}}async createReceiptRule(e){let t={Action:"CreateReceiptRule",Version:"2010-12-01",RuleSetName:e.RuleSetName,"Rule.Name":e.Rule.Name,"Rule.Enabled":e.Rule.Enabled!==!1?"true":"false"};if(e.Rule.TlsPolicy)t["Rule.TlsPolicy"]=e.Rule.TlsPolicy;if(e.Rule.ScanEnabled!==void 0)t["Rule.ScanEnabled"]=e.Rule.ScanEnabled?"true":"false";if(e.After)t.After=e.After;if(e.Rule.Recipients)e.Rule.Recipients.forEach((s,a)=>{t[`Rule.Recipients.member.${a+1}`]=s});e.Rule.Actions.forEach((s,a)=>{let i=a+1;if(s.S3Action){if(t[`Rule.Actions.member.${i}.S3Action.BucketName`]=s.S3Action.BucketName,s.S3Action.ObjectKeyPrefix)t[`Rule.Actions.member.${i}.S3Action.ObjectKeyPrefix`]=s.S3Action.ObjectKeyPrefix;if(s.S3Action.KmsKeyArn)t[`Rule.Actions.member.${i}.S3Action.KmsKeyArn`]=s.S3Action.KmsKeyArn}if(s.LambdaAction)t[`Rule.Actions.member.${i}.LambdaAction.FunctionArn`]=s.LambdaAction.FunctionArn,t[`Rule.Actions.member.${i}.LambdaAction.InvocationType`]=s.LambdaAction.InvocationType||"Event";if(s.SNSAction){if(t[`Rule.Actions.member.${i}.SNSAction.TopicArn`]=s.SNSAction.TopicArn,s.SNSAction.Encoding)t[`Rule.Actions.member.${i}.SNSAction.Encoding`]=s.SNSAction.Encoding}if(s.StopAction){if(t[`Rule.Actions.member.${i}.StopAction.Scope`]=s.StopAction.Scope,s.StopAction.TopicArn)t[`Rule.Actions.member.${i}.StopAction.TopicArn`]=s.StopAction.TopicArn}}),await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)})}async deleteReceiptRule(e,t){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteReceiptRule",Version:"2010-12-01",RuleSetName:e,RuleName:t})})}async receiptRuleSetExists(e){try{return await this.describeReceiptRuleSet(e),!0}catch(t){if(t.code==="RuleSetDoesNotExist"||t.statusCode===400)return!1;throw t}}async getActiveReceiptRuleSet(){let e=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DescribeActiveReceiptRuleSet",Version:"2010-12-01"})}),t=e?.DescribeActiveReceiptRuleSetResponse?.DescribeActiveReceiptRuleSetResult||e?.DescribeActiveReceiptRuleSetResult;if(!t?.Metadata)return null;let s=t?.Rules?.member;return{Metadata:t?.Metadata,Rules:Array.isArray(s)?s:s?[s]:[]}}async updateReceiptRule(e){let t={Action:"UpdateReceiptRule",Version:"2010-12-01",RuleSetName:e.RuleSetName,"Rule.Name":e.Rule.Name};if(e.Rule.Enabled!==void 0)t["Rule.Enabled"]=e.Rule.Enabled?"true":"false";if(e.Rule.TlsPolicy)t["Rule.TlsPolicy"]=e.Rule.TlsPolicy;if(e.Rule.ScanEnabled!==void 0)t["Rule.ScanEnabled"]=e.Rule.ScanEnabled?"true":"false";if(e.Rule.Recipients)e.Rule.Recipients.forEach((s,a)=>{t[`Rule.Recipients.member.${a+1}`]=s});e.Rule.Actions.forEach((s,a)=>{let i=a+1;if(s.S3Action){if(t[`Rule.Actions.member.${i}.S3Action.BucketName`]=s.S3Action.BucketName,s.S3Action.ObjectKeyPrefix)t[`Rule.Actions.member.${i}.S3Action.ObjectKeyPrefix`]=s.S3Action.ObjectKeyPrefix;if(s.S3Action.KmsKeyArn)t[`Rule.Actions.member.${i}.S3Action.KmsKeyArn`]=s.S3Action.KmsKeyArn}if(s.LambdaAction)t[`Rule.Actions.member.${i}.LambdaAction.FunctionArn`]=s.LambdaAction.FunctionArn,t[`Rule.Actions.member.${i}.LambdaAction.InvocationType`]=s.LambdaAction.InvocationType||"Event";if(s.SNSAction){if(t[`Rule.Actions.member.${i}.SNSAction.TopicArn`]=s.SNSAction.TopicArn,s.SNSAction.Encoding)t[`Rule.Actions.member.${i}.SNSAction.Encoding`]=s.SNSAction.Encoding}if(s.StopAction){if(t[`Rule.Actions.member.${i}.StopAction.Scope`]=s.StopAction.Scope,s.StopAction.TopicArn)t[`Rule.Actions.member.${i}.StopAction.TopicArn`]=s.StopAction.TopicArn}}),await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)})}async sendRawEmail(e){let t=Buffer.from(e.rawMessage).toString("base64"),s={Action:"SendRawEmail",Version:"2010-12-01",Source:e.source,"RawMessage.Data":t};e.destinations.forEach((c,u)=>{s[`Destinations.member.${u+1}`]=c});let a=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(s)});return{MessageId:(a?.SendRawEmailResponse?.SendRawEmailResult||a?.SendRawEmailResult)?.MessageId}}async getSuppressedDestination(e){try{return(await this.client.request({service:"ses",region:this.region,method:"GET",path:`/v2/email/suppression/addresses/${encodeURIComponent(e)}`}))?.SuppressedDestination||null}catch(t){if(t.message?.includes("404")||t.message?.includes("NotFoundException"))return null;throw t}}async deleteSuppressedDestination(e){await this.client.request({service:"ses",region:this.region,method:"DELETE",path:`/v2/email/suppression/addresses/${encodeURIComponent(e)}`})}}class Sn{ses;s3;iam;route53;region;domain;defaultFrom;constructor(e={}){this.region=e.region||"us-east-1",this.domain=e.domain,this.defaultFrom=e.defaultFrom,this.ses=new tt(this.region),this.s3=new o(this.region),this.iam=new fe(this.region),this.route53=new y(this.region)}async send(e){let t=e.from||this.defaultFrom;if(!t)throw Error("From address is required. Set defaultFrom in constructor or provide from in options.");let s=e.fromName?`${e.fromName} <${t}>`:t,a=Array.isArray(e.to)?e.to:[e.to];if(!e.attachments||e.attachments.length===0)return{messageId:(await this.ses.sendSimpleEmail({from:s,to:a,subject:e.subject,text:e.text,html:e.html,replyTo:e.replyTo})).MessageId||""};let i=this.buildRawEmail(e,s,a);return{messageId:(await this.ses.sendEmail({FromEmailAddress:s,Destination:{ToAddresses:a,CcAddresses:e.cc?Array.isArray(e.cc)?e.cc:[e.cc]:void 0,BccAddresses:e.bcc?Array.isArray(e.bcc)?e.bcc:[e.bcc]:void 0},Content:{Raw:{Data:Buffer.from(i).toString("base64")}}})).MessageId||""}}async sendTemplate(e){let t=e.from||this.defaultFrom;if(!t)throw Error("From address is required");let s=e.fromName?`${e.fromName} <${t}>`:t;return{messageId:(await this.ses.sendTemplatedEmail({from:s,to:e.to,templateName:e.templateName,templateData:e.templateData,replyTo:e.replyTo})).MessageId||""}}async sendBulk(e){let t=e.from||this.defaultFrom;if(!t)throw Error("From address is required");let s=e.recipients.map((i)=>({Destination:{ToAddresses:Array.isArray(i.to)?i.to:[i.to]},ReplacementEmailContent:i.templateData?{ReplacementTemplate:{ReplacementTemplateData:JSON.stringify(i.templateData)}}:void 0}));return{results:(await this.ses.sendBulkEmail({FromEmailAddress:t,BulkEmailEntries:s,DefaultContent:{Template:{TemplateName:e.templateName,TemplateData:JSON.stringify(e.defaultTemplateData)}}})).BulkEmailEntryResults?.map((i)=>({status:i.Status||"UNKNOWN",messageId:i.MessageId,error:i.Error}))||[]}}async setupDomain(e){let t;try{t=await this.ses.getEmailIdentity(e)}catch{let a=await this.ses.createEmailIdentity({EmailIdentity:e});t={VerificationStatus:a.DkimAttributes?.Status,DkimAttributes:a.DkimAttributes,SendingEnabled:a.VerifiedForSendingStatus}}try{await this.ses.putEmailIdentityDkimAttributes({EmailIdentity:e,SigningEnabled:!0})}catch{}try{await this.ses.putEmailIdentityMailFromAttributes(e,{MailFromDomain:`mail.${e}`,BehaviorOnMxFailure:"USE_DEFAULT_VALUE"})}catch{}let s=await this.ses.getDkimRecords(e);return{domainVerified:t.SendingEnabled===!0,dkimStatus:t.DkimAttributes?.Status||"UNKNOWN",dkimTokens:t.DkimAttributes?.Tokens,mailFromStatus:t.MailFromAttributes?.MailFromDomainStatus}}async getDnsRecords(e){let t=[],s=await this.ses.getDkimRecords(e);for(let a of s)t.push({type:a.type,name:a.name,value:a.value,ttl:1800});return t.push({type:"MX",name:e,value:`inbound-smtp.${this.region}.amazonaws.com`,priority:10,ttl:3600}),t.push({type:"MX",name:`mail.${e}`,value:`feedback-smtp.${this.region}.amazonses.com`,priority:10,ttl:3600}),t.push({type:"TXT",name:`mail.${e}`,value:"v=spf1 include:amazonses.com ~all",ttl:3600}),t.push({type:"TXT",name:`_dmarc.${e}`,value:`v=DMARC1;p=quarantine;pct=25;rua=mailto:dmarcreports@${e}`,ttl:3600}),t}async isDomainReady(e){try{let t=await this.ses.getEmailIdentity(e);return t.SendingEnabled===!0&&t.DkimAttributes?.Status==="SUCCESS"}catch{return!1}}async setupReceiving(e){let t={Version:"2012-10-17",Statement:[{Sid:"AllowSESPuts",Effect:"Allow",Principal:{Service:"ses.amazonaws.com"},Action:"s3:PutObject",Resource:`arn:aws:s3:::${e.bucketName}/*`,Condition:{StringEquals:{"AWS:SourceAccount":e.accountId}}}]};await this.s3.putBucketPolicy(e.bucketName,t);try{await this.ses.createReceiptRuleSet(e.ruleSetName)}catch(a){if(!a.message?.includes("already exists")&&a.code!=="AlreadyExists")throw a}let s=[{S3Action:{BucketName:e.bucketName,ObjectKeyPrefix:e.prefix||"inbox/"}}];if(e.lambdaArn)s.push({LambdaAction:{FunctionArn:e.lambdaArn,InvocationType:"Event"}});try{await this.ses.createReceiptRule({RuleSetName:e.ruleSetName,Rule:{Name:e.ruleName,Enabled:!0,TlsPolicy:"Optional",Recipients:e.recipients||[e.domain],ScanEnabled:e.scanEnabled!==!1,Actions:s}})}catch(a){if(a.message?.includes("already exists"))await this.ses.deleteReceiptRule(e.ruleSetName,e.ruleName),await this.ses.createReceiptRule({RuleSetName:e.ruleSetName,Rule:{Name:e.ruleName,Enabled:!0,TlsPolicy:"Optional",Recipients:e.recipients||[e.domain],ScanEnabled:e.scanEnabled!==!1,Actions:s}});else throw a}await this.ses.setActiveReceiptRuleSet(e.ruleSetName)}async getIncomingEmails(e){return(await this.s3.list({bucket:e.bucket,prefix:e.prefix||"incoming/",maxKeys:e.maxResults||100})).map((s)=>({key:s.Key||"",lastModified:s.LastModified||"",size:s.Size||0}))}async readEmail(e){return await this.s3.getObject(e.bucket,e.key)}async createSmtpCredentials(e){let t=`ses-smtp-${e.username.replace(/[^a-zA-Z0-9]/g,"-")}`,{AWSClient:s}=await import("./chunk-6kcmbymp.js"),a=new s,i=(g,P)=>{let A={Action:g,Version:"2010-05-08",...P};return Object.entries(A).map(([h,R])=>`${encodeURIComponent(h)}=${encodeURIComponent(R)}`).join("&")};try{await a.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i("CreateUser",{UserName:t})})}catch(g){if(!g.message?.includes("EntityAlreadyExists"))throw g}let c={Version:"2012-10-17",Statement:[{Effect:"Allow",Action:"ses:SendRawEmail",Resource:"*",Condition:{StringLike:{"ses:FromAddress":`*@${e.domain}`}}}]},u=`ses-smtp-policy-${e.domain.replace(/\./g,"-")}`;try{await a.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i("PutUserPolicy",{UserName:t,PolicyName:u,PolicyDocument:JSON.stringify(c)})})}catch{}let m=(await a.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i("CreateAccessKey",{UserName:t})}))?.CreateAccessKeyResult?.AccessKey;if(!m?.AccessKeyId||!m?.SecretAccessKey)throw Error("Failed to create access key");let p=this.deriveSmtpPassword(m.SecretAccessKey);return{username:m.AccessKeyId,password:p,server:`email-smtp.${this.region}.amazonaws.com`,port:587}}deriveSmtpPassword(e){let t=Fe("node:crypto"),s="SendRawEmail",a=Buffer.from([4]),i=t.createHmac("sha256",`AWS4${e}`).update("11111111").digest();return i=t.createHmac("sha256",i).update(this.region).digest(),i=t.createHmac("sha256",i).update("ses").digest(),i=t.createHmac("sha256",i).update("aws4_request").digest(),i=t.createHmac("sha256",i).update("SendRawEmail").digest(),Buffer.concat([a,i]).toString("base64")}async createTemplate(e){await this.ses.createEmailTemplate({TemplateName:e.name,TemplateContent:{Subject:e.subject,Text:e.text,Html:e.html}})}async getTemplate(e){try{let t=await this.ses.getEmailTemplate(e);return{name:t.TemplateName||e,subject:t.TemplateContent?.Subject,text:t.TemplateContent?.Text,html:t.TemplateContent?.Html}}catch{return null}}async deleteTemplate(e){await this.ses.deleteEmailTemplate(e)}async listTemplates(){return(await this.ses.listEmailTemplates()).TemplatesMetadata?.map((t)=>({name:t.TemplateName||"",createdAt:t.CreatedTimestamp}))||[]}async deploy(e){let t=`${e.appName}-${e.environment}-email-rules`,s=`${e.appName}-inbound-email`,a=e.storage?.bucketName||`${e.appName}-${e.environment}-email`,i=await this.setupDomain(e.domain);if(!(await this.s3.listBuckets()).Buckets?.some((m)=>m.Name===a))await this.s3.createBucket(a);await this.setupReceiving({domain:e.domain,ruleSetName:t,ruleName:s,bucketName:a,prefix:e.storage?.prefix||"inbox/",accountId:e.accountId,recipients:e.catchAll?[e.domain]:e.mailboxes,scanEnabled:!0});let d=await this.getDnsRecords(e.domain);return{success:!0,domainVerified:i.domainVerified,dkimStatus:i.dkimStatus,receiptRuleSet:t,storageBucket:a,dnsRecords:d}}async undeploy(e){let t=`${e.appName}-${e.environment}-email-rules`,s=`${e.appName}-inbound-email`,a=`${e.appName}-${e.environment}-email`;try{await this.ses.deleteReceiptRule(t,s)}catch{}try{await this.ses.deleteReceiptRuleSet(t)}catch{}if(e.deleteBucket)try{await this.s3.emptyAndDeleteBucket(a)}catch{}}async getSendingStats(){let e=await this.ses.getSendQuota();return{sentLast24Hours:e.SentLast24Hours||0,maxSendRate:e.MaxSendRate||0,max24HourSend:e.Max24HourSend||0}}buildRawEmail(e,t,s){let a=`----=_Part_${Date.now()}_${Math.random().toString(36).substring(2)}`,i="";if(i+=`From: ${t}\r
+import{n}from"./chunk-zx8ecz8b.js";import{o}from"./chunk-9asn5fpt.js";import{y}from"./chunk-9wmer0zx.js";import{Fe}from"./chunk-bxrzsth8.js";function S(e,t){let s=[`Action=${e}`,"Version=2010-05-08"];for(let[a,i]of Object.entries(t)){if(i===void 0||i===null)continue;if(Array.isArray(i))i.forEach((c,u)=>{if(typeof c==="object"&&c!==null)for(let[d,m]of Object.entries(c))s.push(`${a}.member.${u+1}.${d}=${encodeURIComponent(String(m))}`);else s.push(`${a}.member.${u+1}=${encodeURIComponent(String(c))}`)});else if(typeof i==="object"){for(let[c,u]of Object.entries(i))if(u!==void 0&&u!==null)s.push(`${a}.${c}=${encodeURIComponent(String(u))}`)}else s.push(`${a}=${encodeURIComponent(String(i))}`)}return s.join("&")}function r(e,t){let s=new RegExp(`<${t}>([^<]*)</${t}>`),a=e.match(s);return a?a[1]:void 0}function l(e,t,s){let a=new RegExp(`<${t}>([\\s\\S]*?)</${t}>`),i=e.match(a);if(!i)return[];let c=[],u=new RegExp(`<${s}>([\\s\\S]*?)</${s}>`,"g"),d;while((d=u.exec(i[1]))!==null)c.push(d[1]);return c}class fe{client;region;constructor(e="us-east-1",t){this.client=new n(void 0,{profile:t}),this.region=e}async request(e,t={}){let s=S(e,t);return await this.client.request({service:"iam",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:s})}async createUser(e){let t=await this.request("CreateUser",e);return this.parseUser(t)}async getUser(e={}){let t=await this.request("GetUser",e);return this.parseUser(t)}async listUsers(e={}){let t=await this.request("ListUsers",e),s=this.parseUsers(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{Users:s,IsTruncated:a,Marker:i}}async updateUser(e){await this.request("UpdateUser",e)}async deleteUser(e){await this.request("DeleteUser",e)}parseUser(e){return{UserName:r(e,"UserName")||"",UserId:r(e,"UserId")||"",Arn:r(e,"Arn")||"",Path:r(e,"Path"),CreateDate:r(e,"CreateDate"),PasswordLastUsed:r(e,"PasswordLastUsed")}}parseUsers(e){return l(e,"Users","member").map((s)=>({UserName:r(s,"UserName")||"",UserId:r(s,"UserId")||"",Arn:r(s,"Arn")||"",Path:r(s,"Path"),CreateDate:r(s,"CreateDate"),PasswordLastUsed:r(s,"PasswordLastUsed")}))}async createGroup(e){let t=await this.request("CreateGroup",e);return this.parseGroup(t)}async getGroup(e){let t=await this.request("GetGroup",e),s=this.parseGroup(t),a=this.parseUsers(t),i=r(t,"IsTruncated")==="true",c=r(t,"Marker");return{Group:s,Users:a,IsTruncated:i,Marker:c}}async listGroups(e={}){let t=await this.request("ListGroups",e),s=this.parseGroups(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{Groups:s,IsTruncated:a,Marker:i}}async updateGroup(e){await this.request("UpdateGroup",e)}async deleteGroup(e){await this.request("DeleteGroup",e)}async addUserToGroup(e){await this.request("AddUserToGroup",e)}async removeUserFromGroup(e){await this.request("RemoveUserFromGroup",e)}async listGroupsForUser(e){let t=await this.request("ListGroupsForUser",e),s=this.parseGroups(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{Groups:s,IsTruncated:a,Marker:i}}parseGroup(e){return{GroupName:r(e,"GroupName")||"",GroupId:r(e,"GroupId")||"",Arn:r(e,"Arn")||"",Path:r(e,"Path"),CreateDate:r(e,"CreateDate")}}parseGroups(e){return l(e,"Groups","member").map((s)=>({GroupName:r(s,"GroupName")||"",GroupId:r(s,"GroupId")||"",Arn:r(s,"Arn")||"",Path:r(s,"Path"),CreateDate:r(s,"CreateDate")}))}async createRole(e){let t=await this.request("CreateRole",e);return this.parseRole(t)}async getRole(e){let t=await this.request("GetRole",e);return this.parseRole(t)}async listRoles(e={}){let t=await this.request("ListRoles",e),s=this.parseRoles(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{Roles:s,IsTruncated:a,Marker:i}}async updateRole(e){await this.request("UpdateRole",e)}async updateRoleDescription(e){let t=await this.request("UpdateRoleDescription",e);return this.parseRole(t)}async updateAssumeRolePolicy(e){await this.request("UpdateAssumeRolePolicy",e)}async deleteRole(e){await this.request("DeleteRole",e)}async tagRole(e){await this.request("TagRole",e)}async untagRole(e){await this.request("UntagRole",e)}async listRoleTags(e){let t=await this.request("ListRoleTags",e),s=this.parseTags(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{Tags:s,IsTruncated:a,Marker:i}}parseRole(e){return{RoleName:r(e,"RoleName")||"",RoleId:r(e,"RoleId")||"",Arn:r(e,"Arn")||"",Path:r(e,"Path"),CreateDate:r(e,"CreateDate"),AssumeRolePolicyDocument:r(e,"AssumeRolePolicyDocument"),Description:r(e,"Description"),MaxSessionDuration:r(e,"MaxSessionDuration")?Number.parseInt(r(e,"MaxSessionDuration"),10):void 0}}parseRoles(e){return l(e,"Roles","member").map((s)=>({RoleName:r(s,"RoleName")||"",RoleId:r(s,"RoleId")||"",Arn:r(s,"Arn")||"",Path:r(s,"Path"),CreateDate:r(s,"CreateDate"),AssumeRolePolicyDocument:r(s,"AssumeRolePolicyDocument"),Description:r(s,"Description"),MaxSessionDuration:r(s,"MaxSessionDuration")?Number.parseInt(r(s,"MaxSessionDuration"),10):void 0}))}parseTags(e){return l(e,"Tags","member").map((s)=>({Key:r(s,"Key")||"",Value:r(s,"Value")||""}))}async createPolicy(e){let t=await this.request("CreatePolicy",e);return this.parsePolicy(t)}async getPolicy(e){let t=await this.request("GetPolicy",e);return this.parsePolicy(t)}async getPolicyVersion(e){let t=await this.request("GetPolicyVersion",e);return{VersionId:r(t,"VersionId")||"",IsDefaultVersion:r(t,"IsDefaultVersion")==="true",CreateDate:r(t,"CreateDate"),Document:r(t,"Document")}}async listPolicies(e={}){let t=await this.request("ListPolicies",e),s=this.parsePolicies(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{Policies:s,IsTruncated:a,Marker:i}}async listPolicyVersions(e){let t=await this.request("ListPolicyVersions",e),s=this.parsePolicyVersions(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{Versions:s,IsTruncated:a,Marker:i}}async createPolicyVersion(e){let t=await this.request("CreatePolicyVersion",e);return{VersionId:r(t,"VersionId")||"",IsDefaultVersion:r(t,"IsDefaultVersion")==="true",CreateDate:r(t,"CreateDate")}}async deletePolicyVersion(e){await this.request("DeletePolicyVersion",e)}async setDefaultPolicyVersion(e){await this.request("SetDefaultPolicyVersion",e)}async deletePolicy(e){await this.request("DeletePolicy",e)}async attachUserPolicy(e){await this.request("AttachUserPolicy",e)}async detachUserPolicy(e){await this.request("DetachUserPolicy",e)}async attachGroupPolicy(e){await this.request("AttachGroupPolicy",e)}async detachGroupPolicy(e){await this.request("DetachGroupPolicy",e)}async attachRolePolicy(e){await this.request("AttachRolePolicy",e)}async detachRolePolicy(e){await this.request("DetachRolePolicy",e)}async listAttachedUserPolicies(e){let t=await this.request("ListAttachedUserPolicies",e),s=this.parseAttachedPolicies(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{AttachedPolicies:s,IsTruncated:a,Marker:i}}async listAttachedGroupPolicies(e){let t=await this.request("ListAttachedGroupPolicies",e),s=this.parseAttachedPolicies(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{AttachedPolicies:s,IsTruncated:a,Marker:i}}async listAttachedRolePolicies(e){let t=await this.request("ListAttachedRolePolicies",e),s=this.parseAttachedPolicies(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{AttachedPolicies:s,IsTruncated:a,Marker:i}}parsePolicy(e){return{PolicyName:r(e,"PolicyName")||"",PolicyId:r(e,"PolicyId")||"",Arn:r(e,"Arn")||"",Path:r(e,"Path"),DefaultVersionId:r(e,"DefaultVersionId"),AttachmentCount:r(e,"AttachmentCount")?Number.parseInt(r(e,"AttachmentCount"),10):void 0,PermissionsBoundaryUsageCount:r(e,"PermissionsBoundaryUsageCount")?Number.parseInt(r(e,"PermissionsBoundaryUsageCount"),10):void 0,IsAttachable:r(e,"IsAttachable")==="true",Description:r(e,"Description"),CreateDate:r(e,"CreateDate"),UpdateDate:r(e,"UpdateDate")}}parsePolicies(e){return l(e,"Policies","member").map((s)=>({PolicyName:r(s,"PolicyName")||"",PolicyId:r(s,"PolicyId")||"",Arn:r(s,"Arn")||"",Path:r(s,"Path"),DefaultVersionId:r(s,"DefaultVersionId"),AttachmentCount:r(s,"AttachmentCount")?Number.parseInt(r(s,"AttachmentCount"),10):void 0,PermissionsBoundaryUsageCount:r(s,"PermissionsBoundaryUsageCount")?Number.parseInt(r(s,"PermissionsBoundaryUsageCount"),10):void 0,IsAttachable:r(s,"IsAttachable")==="true",Description:r(s,"Description"),CreateDate:r(s,"CreateDate"),UpdateDate:r(s,"UpdateDate")}))}parsePolicyVersions(e){return l(e,"Versions","member").map((s)=>({VersionId:r(s,"VersionId")||"",IsDefaultVersion:r(s,"IsDefaultVersion")==="true",CreateDate:r(s,"CreateDate")}))}parseAttachedPolicies(e){return l(e,"AttachedPolicies","member").map((s)=>({PolicyName:r(s,"PolicyName")||"",PolicyArn:r(s,"PolicyArn")||""}))}async putUserPolicy(e){await this.request("PutUserPolicy",e)}async getUserPolicy(e){let t=await this.request("GetUserPolicy",e);return{UserName:r(t,"UserName")||"",PolicyName:r(t,"PolicyName")||"",PolicyDocument:decodeURIComponent(r(t,"PolicyDocument")||"")}}async deleteUserPolicy(e){await this.request("DeleteUserPolicy",e)}async listUserPolicies(e){let t=await this.request("ListUserPolicies",e),s=l(t,"PolicyNames","member"),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{PolicyNames:s,IsTruncated:a,Marker:i}}async putGroupPolicy(e){await this.request("PutGroupPolicy",e)}async getGroupPolicy(e){let t=await this.request("GetGroupPolicy",e);return{GroupName:r(t,"GroupName")||"",PolicyName:r(t,"PolicyName")||"",PolicyDocument:decodeURIComponent(r(t,"PolicyDocument")||"")}}async deleteGroupPolicy(e){await this.request("DeleteGroupPolicy",e)}async listGroupPolicies(e){let t=await this.request("ListGroupPolicies",e),s=l(t,"PolicyNames","member"),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{PolicyNames:s,IsTruncated:a,Marker:i}}async putRolePolicy(e){await this.request("PutRolePolicy",e)}async getRolePolicy(e){let t=await this.request("GetRolePolicy",e);return{RoleName:r(t,"RoleName")||"",PolicyName:r(t,"PolicyName")||"",PolicyDocument:decodeURIComponent(r(t,"PolicyDocument")||"")}}async deleteRolePolicy(e){await this.request("DeleteRolePolicy",e)}async listRolePolicies(e){let t=await this.request("ListRolePolicies",e),s=l(t,"PolicyNames","member"),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{PolicyNames:s,IsTruncated:a,Marker:i}}async createAccessKey(e={}){let t=await this.request("CreateAccessKey",e);if(typeof t==="object"){let s=t?.CreateAccessKeyResult?.AccessKey||t?.AccessKey;if(s)return{AccessKey:{UserName:s.UserName||"",AccessKeyId:s.AccessKeyId||"",Status:s.Status||"Active",SecretAccessKey:s.SecretAccessKey||"",CreateDate:s.CreateDate}}}return{AccessKey:{UserName:r(t,"UserName")||"",AccessKeyId:r(t,"AccessKeyId")||"",Status:r(t,"Status")||"Active",SecretAccessKey:r(t,"SecretAccessKey")||"",CreateDate:r(t,"CreateDate")}}}async listAccessKeys(e={}){let t=await this.request("ListAccessKeys",e),s=this.parseAccessKeys(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{AccessKeyMetadata:s,IsTruncated:a,Marker:i}}async updateAccessKey(e){await this.request("UpdateAccessKey",e)}async deleteAccessKey(e){await this.request("DeleteAccessKey",e)}async getAccessKeyLastUsed(e){let t=await this.request("GetAccessKeyLastUsed",e);return{UserName:r(t,"UserName")||"",AccessKeyLastUsed:{LastUsedDate:r(t,"LastUsedDate"),ServiceName:r(t,"ServiceName"),Region:r(t,"Region")}}}parseAccessKeys(e){return l(e,"AccessKeyMetadata","member").map((s)=>({UserName:r(s,"UserName"),AccessKeyId:r(s,"AccessKeyId")||"",Status:r(s,"Status")||"Active",CreateDate:r(s,"CreateDate")}))}async createInstanceProfile(e){let t=await this.request("CreateInstanceProfile",e);return this.parseInstanceProfile(t)}async getInstanceProfile(e){let t=await this.request("GetInstanceProfile",e);return this.parseInstanceProfile(t)}async listInstanceProfiles(e={}){let t=await this.request("ListInstanceProfiles",e),s=this.parseInstanceProfiles(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{InstanceProfiles:s,IsTruncated:a,Marker:i}}async listInstanceProfilesForRole(e){let t=await this.request("ListInstanceProfilesForRole",e),s=this.parseInstanceProfiles(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{InstanceProfiles:s,IsTruncated:a,Marker:i}}async addRoleToInstanceProfile(e){await this.request("AddRoleToInstanceProfile",e)}async removeRoleFromInstanceProfile(e){await this.request("RemoveRoleFromInstanceProfile",e)}async deleteInstanceProfile(e){await this.request("DeleteInstanceProfile",e)}parseInstanceProfile(e){return{InstanceProfileName:r(e,"InstanceProfileName")||"",InstanceProfileId:r(e,"InstanceProfileId")||"",Arn:r(e,"Arn")||"",Path:r(e,"Path"),CreateDate:r(e,"CreateDate")}}parseInstanceProfiles(e){return l(e,"InstanceProfiles","member").map((s)=>({InstanceProfileName:r(s,"InstanceProfileName")||"",InstanceProfileId:r(s,"InstanceProfileId")||"",Arn:r(s,"Arn")||"",Path:r(s,"Path"),CreateDate:r(s,"CreateDate")}))}async getAccountPasswordPolicy(){let e=await this.request("GetAccountPasswordPolicy");return{MinimumPasswordLength:r(e,"MinimumPasswordLength")?Number.parseInt(r(e,"MinimumPasswordLength"),10):void 0,RequireSymbols:r(e,"RequireSymbols")==="true",RequireNumbers:r(e,"RequireNumbers")==="true",RequireUppercaseCharacters:r(e,"RequireUppercaseCharacters")==="true",RequireLowercaseCharacters:r(e,"RequireLowercaseCharacters")==="true",AllowUsersToChangePassword:r(e,"AllowUsersToChangePassword")==="true",ExpirePasswords:r(e,"ExpirePasswords")==="true",MaxPasswordAge:r(e,"MaxPasswordAge")?Number.parseInt(r(e,"MaxPasswordAge"),10):void 0,PasswordReusePrevention:r(e,"PasswordReusePrevention")?Number.parseInt(r(e,"PasswordReusePrevention"),10):void 0,HardExpiry:r(e,"HardExpiry")==="true"}}async updateAccountPasswordPolicy(e){await this.request("UpdateAccountPasswordPolicy",e)}async deleteAccountPasswordPolicy(){await this.request("DeleteAccountPasswordPolicy")}async getAccountSummary(){let e=await this.request("GetAccountSummary"),t={},s=l(e,"SummaryMap","entry");for(let a of s){let i=r(a,"key"),c=r(a,"value");if(i&&c)t[i]=Number.parseInt(c,10)}return t}async listAccountAliases(){let e=await this.request("ListAccountAliases"),t=l(e,"AccountAliases","member"),s=r(e,"IsTruncated")==="true",a=r(e,"Marker");return{AccountAliases:t,IsTruncated:s,Marker:a}}async createAccountAlias(e){await this.request("CreateAccountAlias",e)}async deleteAccountAlias(e){await this.request("DeleteAccountAlias",e)}async simulatePrincipalPolicy(e){let t=await this.request("SimulatePrincipalPolicy",e);return this.parseSimulationResults(t)}parseSimulationResults(e){let s=l(e,"EvaluationResults","member").map((c)=>{let d=l(c,"MatchedStatements","member").map((m)=>({SourcePolicyId:r(m,"SourcePolicyId"),SourcePolicyType:r(m,"SourcePolicyType")}));return{EvalActionName:r(c,"EvalActionName")||"",EvalResourceName:r(c,"EvalResourceName"),EvalDecision:r(c,"EvalDecision")||"",MatchedStatements:d.length>0?d:void 0}}),a=r(e,"IsTruncated")==="true",i=r(e,"Marker");return{EvaluationResults:s,IsTruncated:a,Marker:i}}}class tt{client;region;constructor(e="us-east-1",t){this.region=e,this.client=new n(t)}async createEmailIdentity(e){return await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/identities",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)})}async getEmailIdentity(e){let t=await this.client.request({service:"email",region:this.region,method:"GET",path:`/v2/email/identities/${encodeURIComponent(e)}`,headers:{"Content-Type":"application/json"}});return{IdentityType:t.IdentityType,IdentityName:e,SendingEnabled:t.VerifiedForSendingStatus,VerificationStatus:t.VerificationStatus,DkimAttributes:t.DkimAttributes,MailFromAttributes:t.MailFromAttributes}}async putEmailIdentityMailFromAttributes(e,t){await this.client.request({service:"email",region:this.region,method:"PUT",path:`/v2/email/identities/${encodeURIComponent(e)}/mail-from`,headers:{"Content-Type":"application/json"},body:JSON.stringify(t)})}async listEmailIdentities(e){let t="/v2/email/identities",s=[];if(e?.PageSize)s.push(`PageSize=${e.PageSize}`);if(e?.NextToken)s.push(`NextToken=${encodeURIComponent(e.NextToken)}`);if(s.length>0)t+=`?${s.join("&")}`;let a=await this.client.request({service:"email",region:this.region,method:"GET",path:t,headers:{"Content-Type":"application/json"}});return{EmailIdentities:a.EmailIdentities,NextToken:a.NextToken}}async deleteEmailIdentity(e){await this.client.request({service:"email",region:this.region,method:"DELETE",path:`/v2/email/identities/${encodeURIComponent(e)}`,headers:{"Content-Type":"application/json"}})}async putEmailIdentityDkimAttributes(e){await this.client.request({service:"email",region:this.region,method:"PUT",path:`/v2/email/identities/${encodeURIComponent(e.EmailIdentity)}/dkim`,headers:{"Content-Type":"application/json"},body:JSON.stringify({SigningEnabled:e.SigningEnabled})})}async sendEmail(e){return{MessageId:(await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/outbound-emails",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)})).MessageId}}async sendBulkEmail(e){return{BulkEmailEntryResults:(await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/outbound-bulk-emails",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)})).BulkEmailEntryResults}}async createEmailTemplate(e){await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/templates",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)})}async getEmailTemplate(e){return await this.client.request({service:"email",region:this.region,method:"GET",path:`/v2/email/templates/${encodeURIComponent(e)}`,headers:{"Content-Type":"application/json"}})}async deleteEmailTemplate(e){await this.client.request({service:"email",region:this.region,method:"DELETE",path:`/v2/email/templates/${encodeURIComponent(e)}`,headers:{"Content-Type":"application/json"}})}async listEmailTemplates(e){let t="/v2/email/templates",s=[];if(e?.PageSize)s.push(`PageSize=${e.PageSize}`);if(e?.NextToken)s.push(`NextToken=${encodeURIComponent(e.NextToken)}`);if(s.length>0)t+=`?${s.join("&")}`;return await this.client.request({service:"email",region:this.region,method:"GET",path:t,headers:{"Content-Type":"application/json"}})}async getSendStatistics(){return{SendDataPoints:(await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=GetSendStatistics&Version=2010-12-01"})).GetSendStatisticsResponse?.GetSendStatisticsResult?.SendDataPoints?.member}}async getSendQuota(){let t=(await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=GetSendQuota&Version=2010-12-01"})).GetSendQuotaResponse?.GetSendQuotaResult;return{Max24HourSend:t?.Max24HourSend?Number(t.Max24HourSend):void 0,MaxSendRate:t?.MaxSendRate?Number(t.MaxSendRate):void 0,SentLast24Hours:t?.SentLast24Hours?Number(t.SentLast24Hours):void 0}}async verifyDomain(e){let t=await this.createEmailIdentity({EmailIdentity:e});return{dkimTokens:t.DkimAttributes?.Tokens,verificationStatus:t.DkimAttributes?.Status}}async sendSimpleEmail(e){let t=Array.isArray(e.to)?e.to:[e.to],s=e.replyTo?Array.isArray(e.replyTo)?e.replyTo:[e.replyTo]:void 0,a={};if(e.text)a.Text={Data:e.text};if(e.html)a.Html={Data:e.html};return this.sendEmail({FromEmailAddress:e.from,Destination:{ToAddresses:t},Content:{Simple:{Subject:{Data:e.subject},Body:a}},ReplyToAddresses:s})}async sendTemplatedEmail(e){let t=Array.isArray(e.to)?e.to:[e.to],s=e.replyTo?Array.isArray(e.replyTo)?e.replyTo:[e.replyTo]:void 0;return this.sendEmail({FromEmailAddress:e.from,Destination:{ToAddresses:t},Content:{Template:{TemplateName:e.templateName,TemplateData:JSON.stringify(e.templateData)}},ReplyToAddresses:s})}async getDkimRecords(e){let t=await this.getEmailIdentity(e);if(!t.DkimAttributes?.Tokens)return[];return t.DkimAttributes.Tokens.map((s)=>({name:`${s}._domainkey.${e}`,type:"CNAME",value:`${s}.dkim.amazonses.com`}))}async isDomainVerified(e){try{let t=await this.getEmailIdentity(e);return t.VerificationStatus==="SUCCESS"&&t.SendingEnabled===!0}catch{return!1}}async waitForDomainVerification(e,t=60,s=30000){for(let a=0;a<t;a++){if(await this.isDomainVerified(e))return!0;await new Promise((c)=>setTimeout(c,s))}return!1}buildFormBody(e){return Object.entries(e).filter(([,s])=>s!==void 0).map(([s,a])=>`${encodeURIComponent(s)}=${encodeURIComponent(a)}`).join("&")}async createReceiptRuleSet(e){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"CreateReceiptRuleSet",Version:"2010-12-01",RuleSetName:e})})}async deleteReceiptRuleSet(e){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteReceiptRuleSet",Version:"2010-12-01",RuleSetName:e})})}async setActiveReceiptRuleSet(e){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"SetActiveReceiptRuleSet",Version:"2010-12-01",RuleSetName:e})})}async listReceiptRuleSets(e){let t={Action:"ListReceiptRuleSets",Version:"2010-12-01"};if(e)t.NextToken=e;let s=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)}),a=s?.ListReceiptRuleSetsResponse?.ListReceiptRuleSetsResult||s?.ListReceiptRuleSetsResult,i=a?.RuleSets?.member;return{RuleSets:Array.isArray(i)?i:i?[i]:[],NextToken:a?.NextToken}}async describeReceiptRuleSet(e){let t=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DescribeReceiptRuleSet",Version:"2010-12-01",RuleSetName:e})}),s=t?.DescribeReceiptRuleSetResponse?.DescribeReceiptRuleSetResult||t?.DescribeReceiptRuleSetResult,a=s?.Rules?.member;return{Metadata:s?.Metadata,Rules:Array.isArray(a)?a:a?[a]:[]}}async createReceiptRule(e){let t={Action:"CreateReceiptRule",Version:"2010-12-01",RuleSetName:e.RuleSetName,"Rule.Name":e.Rule.Name,"Rule.Enabled":e.Rule.Enabled!==!1?"true":"false"};if(e.Rule.TlsPolicy)t["Rule.TlsPolicy"]=e.Rule.TlsPolicy;if(e.Rule.ScanEnabled!==void 0)t["Rule.ScanEnabled"]=e.Rule.ScanEnabled?"true":"false";if(e.After)t.After=e.After;if(e.Rule.Recipients)e.Rule.Recipients.forEach((s,a)=>{t[`Rule.Recipients.member.${a+1}`]=s});e.Rule.Actions.forEach((s,a)=>{let i=a+1;if(s.S3Action){if(t[`Rule.Actions.member.${i}.S3Action.BucketName`]=s.S3Action.BucketName,s.S3Action.ObjectKeyPrefix)t[`Rule.Actions.member.${i}.S3Action.ObjectKeyPrefix`]=s.S3Action.ObjectKeyPrefix;if(s.S3Action.KmsKeyArn)t[`Rule.Actions.member.${i}.S3Action.KmsKeyArn`]=s.S3Action.KmsKeyArn}if(s.LambdaAction)t[`Rule.Actions.member.${i}.LambdaAction.FunctionArn`]=s.LambdaAction.FunctionArn,t[`Rule.Actions.member.${i}.LambdaAction.InvocationType`]=s.LambdaAction.InvocationType||"Event";if(s.SNSAction){if(t[`Rule.Actions.member.${i}.SNSAction.TopicArn`]=s.SNSAction.TopicArn,s.SNSAction.Encoding)t[`Rule.Actions.member.${i}.SNSAction.Encoding`]=s.SNSAction.Encoding}if(s.StopAction){if(t[`Rule.Actions.member.${i}.StopAction.Scope`]=s.StopAction.Scope,s.StopAction.TopicArn)t[`Rule.Actions.member.${i}.StopAction.TopicArn`]=s.StopAction.TopicArn}}),await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)})}async deleteReceiptRule(e,t){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteReceiptRule",Version:"2010-12-01",RuleSetName:e,RuleName:t})})}async receiptRuleSetExists(e){try{return await this.describeReceiptRuleSet(e),!0}catch(t){if(t.code==="RuleSetDoesNotExist"||t.statusCode===400)return!1;throw t}}async getActiveReceiptRuleSet(){let e=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DescribeActiveReceiptRuleSet",Version:"2010-12-01"})}),t=e?.DescribeActiveReceiptRuleSetResponse?.DescribeActiveReceiptRuleSetResult||e?.DescribeActiveReceiptRuleSetResult;if(!t?.Metadata)return null;let s=t?.Rules?.member;return{Metadata:t?.Metadata,Rules:Array.isArray(s)?s:s?[s]:[]}}async updateReceiptRule(e){let t={Action:"UpdateReceiptRule",Version:"2010-12-01",RuleSetName:e.RuleSetName,"Rule.Name":e.Rule.Name};if(e.Rule.Enabled!==void 0)t["Rule.Enabled"]=e.Rule.Enabled?"true":"false";if(e.Rule.TlsPolicy)t["Rule.TlsPolicy"]=e.Rule.TlsPolicy;if(e.Rule.ScanEnabled!==void 0)t["Rule.ScanEnabled"]=e.Rule.ScanEnabled?"true":"false";if(e.Rule.Recipients)e.Rule.Recipients.forEach((s,a)=>{t[`Rule.Recipients.member.${a+1}`]=s});e.Rule.Actions.forEach((s,a)=>{let i=a+1;if(s.S3Action){if(t[`Rule.Actions.member.${i}.S3Action.BucketName`]=s.S3Action.BucketName,s.S3Action.ObjectKeyPrefix)t[`Rule.Actions.member.${i}.S3Action.ObjectKeyPrefix`]=s.S3Action.ObjectKeyPrefix;if(s.S3Action.KmsKeyArn)t[`Rule.Actions.member.${i}.S3Action.KmsKeyArn`]=s.S3Action.KmsKeyArn}if(s.LambdaAction)t[`Rule.Actions.member.${i}.LambdaAction.FunctionArn`]=s.LambdaAction.FunctionArn,t[`Rule.Actions.member.${i}.LambdaAction.InvocationType`]=s.LambdaAction.InvocationType||"Event";if(s.SNSAction){if(t[`Rule.Actions.member.${i}.SNSAction.TopicArn`]=s.SNSAction.TopicArn,s.SNSAction.Encoding)t[`Rule.Actions.member.${i}.SNSAction.Encoding`]=s.SNSAction.Encoding}if(s.StopAction){if(t[`Rule.Actions.member.${i}.StopAction.Scope`]=s.StopAction.Scope,s.StopAction.TopicArn)t[`Rule.Actions.member.${i}.StopAction.TopicArn`]=s.StopAction.TopicArn}}),await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)})}async sendRawEmail(e){let t=Buffer.from(e.rawMessage).toString("base64"),s={Action:"SendRawEmail",Version:"2010-12-01",Source:e.source,"RawMessage.Data":t};e.destinations.forEach((c,u)=>{s[`Destinations.member.${u+1}`]=c});let a=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(s)});return{MessageId:(a?.SendRawEmailResponse?.SendRawEmailResult||a?.SendRawEmailResult)?.MessageId}}async getSuppressedDestination(e){try{return(await this.client.request({service:"ses",region:this.region,method:"GET",path:`/v2/email/suppression/addresses/${encodeURIComponent(e)}`}))?.SuppressedDestination||null}catch(t){if(t.message?.includes("404")||t.message?.includes("NotFoundException"))return null;throw t}}async deleteSuppressedDestination(e){await this.client.request({service:"ses",region:this.region,method:"DELETE",path:`/v2/email/suppression/addresses/${encodeURIComponent(e)}`})}}class Sn{ses;s3;iam;route53;region;domain;defaultFrom;constructor(e={}){this.region=e.region||"us-east-1",this.domain=e.domain,this.defaultFrom=e.defaultFrom,this.ses=new tt(this.region),this.s3=new o(this.region),this.iam=new fe(this.region),this.route53=new y(this.region)}async send(e){let t=e.from||this.defaultFrom;if(!t)throw Error("From address is required. Set defaultFrom in constructor or provide from in options.");let s=e.fromName?`${e.fromName} <${t}>`:t,a=Array.isArray(e.to)?e.to:[e.to];if(!e.attachments||e.attachments.length===0)return{messageId:(await this.ses.sendSimpleEmail({from:s,to:a,subject:e.subject,text:e.text,html:e.html,replyTo:e.replyTo})).MessageId||""};let i=this.buildRawEmail(e,s,a);return{messageId:(await this.ses.sendEmail({FromEmailAddress:s,Destination:{ToAddresses:a,CcAddresses:e.cc?Array.isArray(e.cc)?e.cc:[e.cc]:void 0,BccAddresses:e.bcc?Array.isArray(e.bcc)?e.bcc:[e.bcc]:void 0},Content:{Raw:{Data:Buffer.from(i).toString("base64")}}})).MessageId||""}}async sendTemplate(e){let t=e.from||this.defaultFrom;if(!t)throw Error("From address is required");let s=e.fromName?`${e.fromName} <${t}>`:t;return{messageId:(await this.ses.sendTemplatedEmail({from:s,to:e.to,templateName:e.templateName,templateData:e.templateData,replyTo:e.replyTo})).MessageId||""}}async sendBulk(e){let t=e.from||this.defaultFrom;if(!t)throw Error("From address is required");let s=e.recipients.map((i)=>({Destination:{ToAddresses:Array.isArray(i.to)?i.to:[i.to]},ReplacementEmailContent:i.templateData?{ReplacementTemplate:{ReplacementTemplateData:JSON.stringify(i.templateData)}}:void 0}));return{results:(await this.ses.sendBulkEmail({FromEmailAddress:t,BulkEmailEntries:s,DefaultContent:{Template:{TemplateName:e.templateName,TemplateData:JSON.stringify(e.defaultTemplateData)}}})).BulkEmailEntryResults?.map((i)=>({status:i.Status||"UNKNOWN",messageId:i.MessageId,error:i.Error}))||[]}}async setupDomain(e){let t;try{t=await this.ses.getEmailIdentity(e)}catch{let a=await this.ses.createEmailIdentity({EmailIdentity:e});t={VerificationStatus:a.DkimAttributes?.Status,DkimAttributes:a.DkimAttributes,SendingEnabled:a.VerifiedForSendingStatus}}try{await this.ses.putEmailIdentityDkimAttributes({EmailIdentity:e,SigningEnabled:!0})}catch{}try{await this.ses.putEmailIdentityMailFromAttributes(e,{MailFromDomain:`mail.${e}`,BehaviorOnMxFailure:"USE_DEFAULT_VALUE"})}catch{}let s=await this.ses.getDkimRecords(e);return{domainVerified:t.SendingEnabled===!0,dkimStatus:t.DkimAttributes?.Status||"UNKNOWN",dkimTokens:t.DkimAttributes?.Tokens,mailFromStatus:t.MailFromAttributes?.MailFromDomainStatus}}async getDnsRecords(e){let t=[],s=await this.ses.getDkimRecords(e);for(let a of s)t.push({type:a.type,name:a.name,value:a.value,ttl:1800});return t.push({type:"MX",name:e,value:`inbound-smtp.${this.region}.amazonaws.com`,priority:10,ttl:3600}),t.push({type:"MX",name:`mail.${e}`,value:`feedback-smtp.${this.region}.amazonses.com`,priority:10,ttl:3600}),t.push({type:"TXT",name:`mail.${e}`,value:"v=spf1 include:amazonses.com ~all",ttl:3600}),t.push({type:"TXT",name:`_dmarc.${e}`,value:`v=DMARC1;p=quarantine;pct=25;rua=mailto:dmarcreports@${e}`,ttl:3600}),t}async isDomainReady(e){try{let t=await this.ses.getEmailIdentity(e);return t.SendingEnabled===!0&&t.DkimAttributes?.Status==="SUCCESS"}catch{return!1}}async setupReceiving(e){let t={Version:"2012-10-17",Statement:[{Sid:"AllowSESPuts",Effect:"Allow",Principal:{Service:"ses.amazonaws.com"},Action:"s3:PutObject",Resource:`arn:aws:s3:::${e.bucketName}/*`,Condition:{StringEquals:{"AWS:SourceAccount":e.accountId}}}]};await this.s3.putBucketPolicy(e.bucketName,t);try{await this.ses.createReceiptRuleSet(e.ruleSetName)}catch(a){if(!a.message?.includes("already exists")&&a.code!=="AlreadyExists")throw a}let s=[{S3Action:{BucketName:e.bucketName,ObjectKeyPrefix:e.prefix||"inbox/"}}];if(e.lambdaArn)s.push({LambdaAction:{FunctionArn:e.lambdaArn,InvocationType:"Event"}});try{await this.ses.createReceiptRule({RuleSetName:e.ruleSetName,Rule:{Name:e.ruleName,Enabled:!0,TlsPolicy:"Optional",Recipients:e.recipients||[e.domain],ScanEnabled:e.scanEnabled!==!1,Actions:s}})}catch(a){if(a.message?.includes("already exists"))await this.ses.deleteReceiptRule(e.ruleSetName,e.ruleName),await this.ses.createReceiptRule({RuleSetName:e.ruleSetName,Rule:{Name:e.ruleName,Enabled:!0,TlsPolicy:"Optional",Recipients:e.recipients||[e.domain],ScanEnabled:e.scanEnabled!==!1,Actions:s}});else throw a}await this.ses.setActiveReceiptRuleSet(e.ruleSetName)}async getIncomingEmails(e){return(await this.s3.list({bucket:e.bucket,prefix:e.prefix||"incoming/",maxKeys:e.maxResults||100})).map((s)=>({key:s.Key||"",lastModified:s.LastModified||"",size:s.Size||0}))}async readEmail(e){return await this.s3.getObject(e.bucket,e.key)}async createSmtpCredentials(e){let t=`ses-smtp-${e.username.replace(/[^a-zA-Z0-9]/g,"-")}`,{AWSClient:s}=await import("./chunk-6kcmbymp.js"),a=new s,i=(g,P)=>{let A={Action:g,Version:"2010-05-08",...P};return Object.entries(A).map(([h,R])=>`${encodeURIComponent(h)}=${encodeURIComponent(R)}`).join("&")};try{await a.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i("CreateUser",{UserName:t})})}catch(g){if(!g.message?.includes("EntityAlreadyExists"))throw g}let c={Version:"2012-10-17",Statement:[{Effect:"Allow",Action:"ses:SendRawEmail",Resource:"*",Condition:{StringLike:{"ses:FromAddress":`*@${e.domain}`}}}]},u=`ses-smtp-policy-${e.domain.replace(/\./g,"-")}`;try{await a.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i("PutUserPolicy",{UserName:t,PolicyName:u,PolicyDocument:JSON.stringify(c)})})}catch{}let m=(await a.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i("CreateAccessKey",{UserName:t})}))?.CreateAccessKeyResult?.AccessKey;if(!m?.AccessKeyId||!m?.SecretAccessKey)throw Error("Failed to create access key");let p=this.deriveSmtpPassword(m.SecretAccessKey);return{username:m.AccessKeyId,password:p,server:`email-smtp.${this.region}.amazonaws.com`,port:587}}deriveSmtpPassword(e){let t=Fe("node:crypto"),s="SendRawEmail",a=Buffer.from([4]),i=t.createHmac("sha256",`AWS4${e}`).update("11111111").digest();return i=t.createHmac("sha256",i).update(this.region).digest(),i=t.createHmac("sha256",i).update("ses").digest(),i=t.createHmac("sha256",i).update("aws4_request").digest(),i=t.createHmac("sha256",i).update("SendRawEmail").digest(),Buffer.concat([a,i]).toString("base64")}async createTemplate(e){await this.ses.createEmailTemplate({TemplateName:e.name,TemplateContent:{Subject:e.subject,Text:e.text,Html:e.html}})}async getTemplate(e){try{let t=await this.ses.getEmailTemplate(e);return{name:t.TemplateName||e,subject:t.TemplateContent?.Subject,text:t.TemplateContent?.Text,html:t.TemplateContent?.Html}}catch{return null}}async deleteTemplate(e){await this.ses.deleteEmailTemplate(e)}async listTemplates(){return(await this.ses.listEmailTemplates()).TemplatesMetadata?.map((t)=>({name:t.TemplateName||"",createdAt:t.CreatedTimestamp}))||[]}async deploy(e){let t=`${e.appName}-${e.environment}-email-rules`,s=`${e.appName}-inbound-email`,a=e.storage?.bucketName||`${e.appName}-${e.environment}-email`,i=await this.setupDomain(e.domain);if(!(await this.s3.listBuckets()).Buckets?.some((m)=>m.Name===a))await this.s3.createBucket(a);await this.setupReceiving({domain:e.domain,ruleSetName:t,ruleName:s,bucketName:a,prefix:e.storage?.prefix||"inbox/",accountId:e.accountId,recipients:e.catchAll?[e.domain]:e.mailboxes,scanEnabled:!0});let d=await this.getDnsRecords(e.domain);return{success:!0,domainVerified:i.domainVerified,dkimStatus:i.dkimStatus,receiptRuleSet:t,storageBucket:a,dnsRecords:d}}async undeploy(e){let t=`${e.appName}-${e.environment}-email-rules`,s=`${e.appName}-inbound-email`,a=`${e.appName}-${e.environment}-email`;try{await this.ses.deleteReceiptRule(t,s)}catch{}try{await this.ses.deleteReceiptRuleSet(t)}catch{}if(e.deleteBucket)try{await this.s3.emptyAndDeleteBucket(a)}catch{}}async getSendingStats(){let e=await this.ses.getSendQuota();return{sentLast24Hours:e.SentLast24Hours||0,maxSendRate:e.MaxSendRate||0,max24HourSend:e.Max24HourSend||0}}buildRawEmail(e,t,s){let a=`----=_Part_${Date.now()}_${Math.random().toString(36).substring(2)}`,i="";if(i+=`From: ${t}\r
 `,i+=`To: ${s.join(", ")}\r
 `,e.cc){let c=Array.isArray(e.cc)?e.cc:[e.cc];i+=`Cc: ${c.join(", ")}\r
 `}if(i+=`Subject: ${e.subject}\r

package/dist/deploy/index.js

@@ -1 +1 @@
-import{rn,nn,Vl,ji,jl,zl,Kl,ha,Wl,Jl,ch,Xl,S,Yl,zi,Ne,Zl,eu,Ay,tu,ru,nu,iu,su,dh,yy,Iy,Sy,lh,uh,Cy,Ey,ph,gh,by,Ki,Yt,fa,sn,on,Zt,Xe,St,Wi,mh,an,ou,au,Aa,Xi,dn,Yi,ka}from"../chunk-2p71e3x7.js";import{Ba,ln,un,Zi,es,ts,rs,_a,Oa}from"../chunk-9syc8s7r.js";import{xa}from"../chunk-7xnwa0s8.js";import"../chunk-60nr1ehk.js";import"../chunk-c3f89ryr.js";import"../chunk-31tvc877.js";import"../chunk-5far81q7.js";import"../chunk-k53agv2m.js";import"../chunk-e8e1h2h9.js";import"../chunk-9wmer0zx.js";import{vu,Xa,ye,Ya,Tn,Tu,Za,Ec,Ps,bc,kt,ti,Ns}from"../chunk-s2ve9zxn.js";import"../chunk-qcaqc5b8.js";import"../chunk-ptq9v346.js";import"../chunk-yd40pg8g.js";import"../chunk-zx8ecz8b.js";import{at,Cf,Pc,oi,ai,ci,Pp}from"../chunk-w9jhyy09.js";import{B,vr,Tr,Nc,_s,u,Ef,Np,kp,eI,tI}from"../chunk-3m9ghthh.js";import"../chunk-kczzc599.js";import"../chunk-v2p7c7s4.js";export{Cf as DEFAULT_SITE_PORT_RANGE,at as HOST_SITES_DIR,Ya as IPV6_EXCLUDED_HOST_LABELS,Ec as MANAGEMENT_DASHBOARD_SITE,rn as addSiteToCloudConfig,Pp as allocateSitePorts,by as buildAndPushContainerImage,xa as buildAndPushServerlessImage,Yt as buildFunctionEnv,ai as buildHostSitePortsScript,Ns as buildManagementDashboardArtifact,St as buildServerTopology,Wi as buildServerlessTopology,mh as buildTopology,Aa as collectEgressMetrics,vu as collectServerDnsDomains,gh as createContainerImageDependencies,lh as createExistingStaticFullStackDependencies,dh as createStaticApiOriginDependencies,dn as dashboardActions,Ps as dashboardCredentialsFile,Zl as dashboardPageRoutes,iu as deleteFailoverReplicaBuckets,_a as deleteStaticSite,Cy as deployExistingStaticFullStack,fa as deployServerlessApp,tI as deployShipsFiles,su as deploySite,yy as deployStaticApiOrigin,es as deployStaticSite,Oa as deployStaticSiteFull,ln as deployStaticSiteWithExternalDns,un as deployStaticSiteWithExternalDnsFull,ou as egressReportMetrics,S as ensureDashboardActor,tu as ensureFailoverReplicaBuckets,ti as ensureManagementDashboard,Ey as estimateExistingStaticFullStackMonthlyCost,Sy as estimateStaticApiOriginMonthlyCost,au as fetchEgressReport,uh as generateExistingStaticFullStackTemplate,Ba as generateExternalDnsStaticSiteTemplate,Zi as generateStaticSiteTemplate,ru as grantFailoverReplicaAccess,Ef as hasComputeConfigured,Nc as hasProxyUpstream,ph as hashContainerContext,Tn as hostAcceptsIpv6,Ki as infraEnvFromOutputs,Yl as initializeDashboardControlPlane,rs as invalidateCache,vr as isPhpSite,ha as isValidHostname,ye as normalizePublicIpv6,oi as occupiedHostPorts,ci as parseHostSiteFragments,Pc as parseUpstreamPort,Tu as reconcileAddressRecords,sn as redeployServerlessApp,nn as removeSiteFromCloudConfig,Xa as removeStaleServerAddressRecords,Wl as renderAliasesValue,Kl as renderEnvValue,Jl as renderRedirectsValue,ch as renderSiteSnippet,jl as renderSslValue,zl as renderStringValue,Yi as resolveDashboardAction,bc as resolveDashboardAuth,an as resolveDashboardData,eu as resolveLegacyDashboardRoute,Tr as resolveProxyUpstreams,_s as resolveSiteDeployTarget,u as resolveSiteKind,kt as resolveUiSource,on as rollbackServerlessApp,Ay as routesForDashboard,Xe as runRemoteCommand,Xi as sanitizeCloudConfig,nu as seedFailoverReplicas,Xl as setAttachToInCloudConfig,Zt as setMaintenance,ji as setSitePropertyInCloudConfig,kp as shipsARelease,eI as shipsToBucket,B as siteInstallBase,ka as startLocalDashboardServer,zi as synchronizeDashboardUsers,Ne as trackDashboardOperation,Vl as updateSiteInCloudConfig,ts as uploadStaticFiles,Np as validateDeploymentConfig,Za as verifyAddressRecord,Iy as verifyStaticApiOrigin};
+import{rn,nn,Vl,ji,jl,zl,Kl,ha,Wl,Jl,ch,Xl,S,Yl,zi,Ne,Zl,eu,Ay,tu,ru,nu,iu,su,dh,yy,Iy,Sy,lh,uh,Cy,Ey,ph,gh,by,Ki,Yt,fa,sn,on,Zt,Xe,St,Wi,mh,an,ou,au,Aa,Xi,dn,Yi,ka}from"../chunk-bcy9z4ks.js";import{Ba,ln,un,Zi,es,ts,rs,_a,Oa}from"../chunk-hyeeqga9.js";import{xa}from"../chunk-7xnwa0s8.js";import"../chunk-2m262b2n.js";import"../chunk-r1wpwfff.js";import"../chunk-31tvc877.js";import"../chunk-5far81q7.js";import"../chunk-k53agv2m.js";import"../chunk-e8e1h2h9.js";import"../chunk-9wmer0zx.js";import{vu,Xa,ye,Ya,Tn,Tu,Za,Ec,Ps,bc,kt,ti,Ns}from"../chunk-5255nr93.js";import"../chunk-qcaqc5b8.js";import"../chunk-ptq9v346.js";import"../chunk-9asn5fpt.js";import"../chunk-zx8ecz8b.js";import{at,Cf,Pc,oi,ai,ci,Pp}from"../chunk-w9jhyy09.js";import{B,vr,Tr,Nc,_s,u,Ef,Np,kp,eI,tI}from"../chunk-3m9ghthh.js";import"../chunk-kczzc599.js";import"../chunk-v2p7c7s4.js";export{Cf as DEFAULT_SITE_PORT_RANGE,at as HOST_SITES_DIR,Ya as IPV6_EXCLUDED_HOST_LABELS,Ec as MANAGEMENT_DASHBOARD_SITE,rn as addSiteToCloudConfig,Pp as allocateSitePorts,by as buildAndPushContainerImage,xa as buildAndPushServerlessImage,Yt as buildFunctionEnv,ai as buildHostSitePortsScript,Ns as buildManagementDashboardArtifact,St as buildServerTopology,Wi as buildServerlessTopology,mh as buildTopology,Aa as collectEgressMetrics,vu as collectServerDnsDomains,gh as createContainerImageDependencies,lh as createExistingStaticFullStackDependencies,dh as createStaticApiOriginDependencies,dn as dashboardActions,Ps as dashboardCredentialsFile,Zl as dashboardPageRoutes,iu as deleteFailoverReplicaBuckets,_a as deleteStaticSite,Cy as deployExistingStaticFullStack,fa as deployServerlessApp,tI as deployShipsFiles,su as deploySite,yy as deployStaticApiOrigin,es as deployStaticSite,Oa as deployStaticSiteFull,ln as deployStaticSiteWithExternalDns,un as deployStaticSiteWithExternalDnsFull,ou as egressReportMetrics,S as ensureDashboardActor,tu as ensureFailoverReplicaBuckets,ti as ensureManagementDashboard,Ey as estimateExistingStaticFullStackMonthlyCost,Sy as estimateStaticApiOriginMonthlyCost,au as fetchEgressReport,uh as generateExistingStaticFullStackTemplate,Ba as generateExternalDnsStaticSiteTemplate,Zi as generateStaticSiteTemplate,ru as grantFailoverReplicaAccess,Ef as hasComputeConfigured,Nc as hasProxyUpstream,ph as hashContainerContext,Tn as hostAcceptsIpv6,Ki as infraEnvFromOutputs,Yl as initializeDashboardControlPlane,rs as invalidateCache,vr as isPhpSite,ha as isValidHostname,ye as normalizePublicIpv6,oi as occupiedHostPorts,ci as parseHostSiteFragments,Pc as parseUpstreamPort,Tu as reconcileAddressRecords,sn as redeployServerlessApp,nn as removeSiteFromCloudConfig,Xa as removeStaleServerAddressRecords,Wl as renderAliasesValue,Kl as renderEnvValue,Jl as renderRedirectsValue,ch as renderSiteSnippet,jl as renderSslValue,zl as renderStringValue,Yi as resolveDashboardAction,bc as resolveDashboardAuth,an as resolveDashboardData,eu as resolveLegacyDashboardRoute,Tr as resolveProxyUpstreams,_s as resolveSiteDeployTarget,u as resolveSiteKind,kt as resolveUiSource,on as rollbackServerlessApp,Ay as routesForDashboard,Xe as runRemoteCommand,Xi as sanitizeCloudConfig,nu as seedFailoverReplicas,Xl as setAttachToInCloudConfig,Zt as setMaintenance,ji as setSitePropertyInCloudConfig,kp as shipsARelease,eI as shipsToBucket,B as siteInstallBase,ka as startLocalDashboardServer,zi as synchronizeDashboardUsers,Ne as trackDashboardOperation,Vl as updateSiteInCloudConfig,ts as uploadStaticFiles,Np as validateDeploymentConfig,Za as verifyAddressRecord,Iy as verifyStaticApiOrigin};

package/dist/drivers/index.js

@@ -1 +1 @@
-import{wn,Rt,lr,Dt,Rn,Dn,Pn,Nn,Pu,ec,K,gr,Nh,kn,tc,Ie,Se,xe,N,mr,Bn,hr,ce,rc,_n,nc,On,ic,fr,kh,Bh,ku,Bu,_h,Oh,xh,Ar,xn,_u,Ts,Ln,$n,Mn,Un,Qn,sc,oc,yr,cc,Le,W,dc,nt,$e,Me,it,Ce,ws,lc,Ou,xu,uc,Lu,st,Hn,pc,$u,Mu,gc,Ir,Ee,mc,Fu,Uu,Rs,Gn,ot,Qu,Hu,Gu,qu,Vu,ju,zu,Ku,Wu,qn,Vn,jn,zn,Kn,Wn,Jn,Ju,Xu,Sr,k,Ds,Yu,Zu,ep,hc,tp,rp,Lh,fc,$h,Mh,np,ip,Fh,Uh,Qh,Ac,sp,Hh,Gh,qh,Xn,Yn,Zn,ei,yc,Ic,Sc,Cc,Vh,ks,vc,ri,Tc,op,ap,cp,jh}from"../chunk-s2ve9zxn.js";import"../chunk-qcaqc5b8.js";import"../chunk-ptq9v346.js";import"../chunk-yd40pg8g.js";import"../chunk-zx8ecz8b.js";import"../chunk-3m9ghthh.js";import"../chunk-v2p7c7s4.js";export{Cc as AwsBoxProvisioner,mr as AwsDriver,ep as BOOT_PARTITION_LABEL,Ds as CloudDriverFactory,Bu as DEFAULT_HOST_CLEANUP_ESCALATED,Oh as DEFAULT_HOST_CLEANUP_HIGH_WATER_PERCENT,_h as DEFAULT_HOST_CLEANUP_LOW_WATER_PERCENT,ku as DEFAULT_HOST_CLEANUP_RETENTION,xh as DEFAULT_HOST_CLEANUP_SCHEDULE,Dn as DEFAULT_RPX_CERTS_DIR,Zu as FIRST_BOOT_SCRIPT_PATH,fr as HOST_ARTIFACT_CACHE_DIR,kh as HOST_CLEANUP_SCRIPT_PATH,Bh as HOST_CLEANUP_UNIT,Sc as HetznerBoxProvisioner,yr as HetznerClient,Ce as HetznerDriver,dc as LEGACY_DRIVER_STATE_DIR,ws as LocalBoxDriver,ap as MANAGED_CACHE_POLICY_DISABLED,op as MANAGED_CACHE_POLICY_OPTIMIZED,cp as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,Uu as RASPBERRY_PI_DEFAULT_SWAP_GB,ic as REMOTE_SCRIPT_RUNNER,kn as RPX_DIR,tc as RPX_LAUNCHER_PATH,Ie as RPX_SERVICE_NAME,mc as SSH_BOOTSTRAP_MARKER_DIR,Ee as SSH_BOOTSTRAP_VERSION,ot as SSH_DEFAULTS,Jn as SSH_DEPLOY_STORAGE_PATH,Ou as SSH_INSECURE_HOST_KEY_OPTS,xu as SSH_KEEPALIVE_OPTS,Vn as SSH_PREFLIGHT_SCRIPT,Ju as SSH_SKIP_BOOTSTRAP_ENV,Sr as SshDriver,Ir as SystemSshTransport,yc as UBUNTU_2404_AMI_PARAM,qh as acquireResizeLock,Fh as applyHetznerHostOptimization,Rs as assertArchSupported,Xu as assertSshComputeConfig,sc as buildAwsArtifactFetch,Ic as buildBoxUserData,jh as buildCloudFrontOriginConfig,hc as buildCloudInitFirstBoot,ip as buildHetznerHostOptimizationScript,Ln as buildHostCleanupDeployScript,_u as buildHostCleanupExecutable,Ts as buildHostCleanupInstallScript,xn as buildHostCleanupScript,oc as buildLocalArtifactFetch,K as buildRpxConfig,xe as buildRpxFragmentRefreshScript,gr as buildRpxLbConfig,Se as buildRpxProvisionScript,Lu as buildScpArgsFor,Mn as buildSiteDeployScript,Bn as buildSshArgs,uc as buildSshArgsFor,Gn as buildSshBootstrapScript,Un as buildStaticSiteDeployScript,Yu as cloudDrivers,Uh as collectHetznerHostOptimizationReport,fc as collectHetznerResizeManifest,Vh as createBoxProvisioner,k as createCloudDriver,vc as deployAllComputeSites,ks as deploySiteRelease,ec as deriveRouteId,wn as describeScriptSyntaxError,nt as driverStateDir,$e as driverStatePath,Yn as ensureFirewall,Zn as ensureServer,Xn as ensureSshKey,zn as evaluatePreflight,Lh as executeHetznerServerResize,Mu as findKnownHostKey,Wn as formatPreflightFindings,Rt as formatSshFailure,Nn as gatewayHostnames,N as generateUbuntuAppCloudInit,Pn as hasAutoWwwVariant,lc as isBoxMode,rp as isHetznerCapacityError,Rn as isLocalDatabase,$u as knownHostsLine,pc as knownHostsToken,Pu as normalizeRoutePath,Le as normalizeSshPublicKey,jn as parsePreflightFacts,tp as planHetznerServerResize,Kn as preflightFailed,$h as prepareHetznerResize,Me as readDriverState,Hh as readResizeCheckpoint,Qn as releaseTarballTmpPath,ri as reloadRpxGateway,On as remoteScriptRunner,Nh as renderRpxLauncher,Tc as renewRpxCertificates,Ac as resizeCheckpointPath,sp as resizeLockPath,$n as resolveExecStart,cc as resolveHetznerApiToken,np as resolveHetznerHostOptimizationPlan,Ar as resolveHostCleanupConfig,Vu as resolveSshHostKeyPolicy,Qu as resolveSshHosts,Wu as resolveSshLan,Gu as resolveSshPort,qu as resolveSshPrivateKeyPath,zu as resolveSshProfile,Ku as resolveSshPublicIp,qn as resolveSshSettings,ju as resolveSshSudo,Hu as resolveSshUser,Hn as scanHostKey,rc as scpUpload,ei as serverPublicIpv4,Fu as sshBootstrapMarkerPath,hr as sshExec,ce as sshExecOrThrow,st as sshHostKeyFingerprint,gc as sshKnownHostsPath,Dt as summarizeRemoteFailures,lr as surfaceRemoteNotices,Qh as verifyHetznerHostOptimization,Mh as verifyHetznerResize,nc as waitForCloudInit,_n as waitForSsh,W as wrapCloudInitUserData,it as writeDriverState,Gh as writeResizeCheckpoint};
+import{wn,Rt,lr,Dt,Rn,Dn,Pn,Nn,Pu,ec,K,gr,Nh,kn,tc,Ie,Se,xe,N,mr,Bn,hr,ce,rc,_n,nc,On,ic,fr,kh,Bh,ku,Bu,_h,Oh,xh,Ar,xn,_u,Ts,Ln,$n,Mn,Un,Qn,sc,oc,yr,cc,Le,W,dc,nt,$e,Me,it,Ce,ws,lc,Ou,xu,uc,Lu,st,Hn,pc,$u,Mu,gc,Ir,Ee,mc,Fu,Uu,Rs,Gn,ot,Qu,Hu,Gu,qu,Vu,ju,zu,Ku,Wu,qn,Vn,jn,zn,Kn,Wn,Jn,Ju,Xu,Sr,k,Ds,Yu,Zu,ep,hc,tp,rp,Lh,fc,$h,Mh,np,ip,Fh,Uh,Qh,Ac,sp,Hh,Gh,qh,Xn,Yn,Zn,ei,yc,Ic,Sc,Cc,Vh,ks,vc,ri,Tc,op,ap,cp,jh}from"../chunk-5255nr93.js";import"../chunk-qcaqc5b8.js";import"../chunk-ptq9v346.js";import"../chunk-9asn5fpt.js";import"../chunk-zx8ecz8b.js";import"../chunk-3m9ghthh.js";import"../chunk-v2p7c7s4.js";export{Cc as AwsBoxProvisioner,mr as AwsDriver,ep as BOOT_PARTITION_LABEL,Ds as CloudDriverFactory,Bu as DEFAULT_HOST_CLEANUP_ESCALATED,Oh as DEFAULT_HOST_CLEANUP_HIGH_WATER_PERCENT,_h as DEFAULT_HOST_CLEANUP_LOW_WATER_PERCENT,ku as DEFAULT_HOST_CLEANUP_RETENTION,xh as DEFAULT_HOST_CLEANUP_SCHEDULE,Dn as DEFAULT_RPX_CERTS_DIR,Zu as FIRST_BOOT_SCRIPT_PATH,fr as HOST_ARTIFACT_CACHE_DIR,kh as HOST_CLEANUP_SCRIPT_PATH,Bh as HOST_CLEANUP_UNIT,Sc as HetznerBoxProvisioner,yr as HetznerClient,Ce as HetznerDriver,dc as LEGACY_DRIVER_STATE_DIR,ws as LocalBoxDriver,ap as MANAGED_CACHE_POLICY_DISABLED,op as MANAGED_CACHE_POLICY_OPTIMIZED,cp as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,Uu as RASPBERRY_PI_DEFAULT_SWAP_GB,ic as REMOTE_SCRIPT_RUNNER,kn as RPX_DIR,tc as RPX_LAUNCHER_PATH,Ie as RPX_SERVICE_NAME,mc as SSH_BOOTSTRAP_MARKER_DIR,Ee as SSH_BOOTSTRAP_VERSION,ot as SSH_DEFAULTS,Jn as SSH_DEPLOY_STORAGE_PATH,Ou as SSH_INSECURE_HOST_KEY_OPTS,xu as SSH_KEEPALIVE_OPTS,Vn as SSH_PREFLIGHT_SCRIPT,Ju as SSH_SKIP_BOOTSTRAP_ENV,Sr as SshDriver,Ir as SystemSshTransport,yc as UBUNTU_2404_AMI_PARAM,qh as acquireResizeLock,Fh as applyHetznerHostOptimization,Rs as assertArchSupported,Xu as assertSshComputeConfig,sc as buildAwsArtifactFetch,Ic as buildBoxUserData,jh as buildCloudFrontOriginConfig,hc as buildCloudInitFirstBoot,ip as buildHetznerHostOptimizationScript,Ln as buildHostCleanupDeployScript,_u as buildHostCleanupExecutable,Ts as buildHostCleanupInstallScript,xn as buildHostCleanupScript,oc as buildLocalArtifactFetch,K as buildRpxConfig,xe as buildRpxFragmentRefreshScript,gr as buildRpxLbConfig,Se as buildRpxProvisionScript,Lu as buildScpArgsFor,Mn as buildSiteDeployScript,Bn as buildSshArgs,uc as buildSshArgsFor,Gn as buildSshBootstrapScript,Un as buildStaticSiteDeployScript,Yu as cloudDrivers,Uh as collectHetznerHostOptimizationReport,fc as collectHetznerResizeManifest,Vh as createBoxProvisioner,k as createCloudDriver,vc as deployAllComputeSites,ks as deploySiteRelease,ec as deriveRouteId,wn as describeScriptSyntaxError,nt as driverStateDir,$e as driverStatePath,Yn as ensureFirewall,Zn as ensureServer,Xn as ensureSshKey,zn as evaluatePreflight,Lh as executeHetznerServerResize,Mu as findKnownHostKey,Wn as formatPreflightFindings,Rt as formatSshFailure,Nn as gatewayHostnames,N as generateUbuntuAppCloudInit,Pn as hasAutoWwwVariant,lc as isBoxMode,rp as isHetznerCapacityError,Rn as isLocalDatabase,$u as knownHostsLine,pc as knownHostsToken,Pu as normalizeRoutePath,Le as normalizeSshPublicKey,jn as parsePreflightFacts,tp as planHetznerServerResize,Kn as preflightFailed,$h as prepareHetznerResize,Me as readDriverState,Hh as readResizeCheckpoint,Qn as releaseTarballTmpPath,ri as reloadRpxGateway,On as remoteScriptRunner,Nh as renderRpxLauncher,Tc as renewRpxCertificates,Ac as resizeCheckpointPath,sp as resizeLockPath,$n as resolveExecStart,cc as resolveHetznerApiToken,np as resolveHetznerHostOptimizationPlan,Ar as resolveHostCleanupConfig,Vu as resolveSshHostKeyPolicy,Qu as resolveSshHosts,Wu as resolveSshLan,Gu as resolveSshPort,qu as resolveSshPrivateKeyPath,zu as resolveSshProfile,Ku as resolveSshPublicIp,qn as resolveSshSettings,ju as resolveSshSudo,Hu as resolveSshUser,Hn as scanHostKey,rc as scpUpload,ei as serverPublicIpv4,Fu as sshBootstrapMarkerPath,hr as sshExec,ce as sshExecOrThrow,st as sshHostKeyFingerprint,gc as sshKnownHostsPath,Dt as summarizeRemoteFailures,lr as surfaceRemoteNotices,Qh as verifyHetznerHostOptimization,Mh as verifyHetznerResize,nc as waitForCloudInit,_n as waitForSsh,W as wrapCloudInitUserData,it as writeDriverState,Gh as writeResizeCheckpoint};

package/dist/index.js

@@ -1,4 +1,4 @@
-import{rg,_,ng,Xf,oI,Yf,aI,cI,dI,lI,uI,pI,gI,mI,hI,fI,ig,sg,hd,fd,io,O,d,Ad,og,x,yd,p,Zf,bi,Id,Sd,le,Cd,yI,r,t,II,SI,g,CI,EI,bI,vI,TI,Ut,Ed,so,eA,wI,RI,ve,Ge,bd,ag,cg,DI,dg,lg,ug,vd,pg,Te,Fr,Qt,Td,Ht,ue,tA,wd,oo,gg,mg,hg,fg,Rd,PI,L,I,a,f,qe,m,rA,Ve,M,pt,NI,nA,F,Dd,we,Gt,ao,Y,Pd,Z,iA,co,U,Q,D,vi,b,qt,gt,H,e,lo,kI,Ag,Nd,BI,_I,OI,xI,kd,LI,$I,MI,FI,UI,QI,HI,GI,qI,VI,jI,zI,sA,oA,aA,cA,dA,lA,uA,Vt,yg,Ig,Ur,Ti,KI,Sg,WI,JI,Qr,XI,YI,ZI,eS,tS,rS,pA,gA,mA,hA,fA,uo,nS,AA,yA,IA,G,iS,je,po,jt,SA,Cg,CA,EA,bA,Eg,ee,sS,oS,aS,cS,vA,dS,q,lS,uS,pS,bg,vg,gS,Tg,wg,mS,hS,fS,AS,yS,TA,Bd,IS,SS,CS,ES,bS,wA,RA,vS,TS,wS,RS,DS,PS,NS,kS,BS,Rg,_d,_S,OS,xS,LS,Dg,Pg,Ng,$S,kg,MS,FS,US,QS,Bg,HS,GS,qS,VS,jS,zS,KS,WS,DA,PA,NA,kA,_g,JS,XS,YS,ZS,eC,tC,rC,nC,iC,BA,_A,OA,xA,sC,oC,Og,aC,xg,Lg,$g,Mg,cC,dC,lC,uC,Re,wi,pC,gC,mC,hC,fC,AC,yC,IC,LA,SC,CC,Fg,Ug,EC,bC,$A,vC,TC,wC,RC,DC,PC,NC,kC,BC,_C,OC,xC,LC,$C,MC,FC,UC,QC,HC,GC,qC,Qg,VC,Hg,jC,Gg,zC,qg,KC,Vg,WC,Hr,JC,jg,XC,go,YC,zg,ZC,Kg,eE,Wg,tE,Jg,rE,Xg,nE,Gr,iE,Yg,sE,Zg,oE,em,aE,tm,cE,rm,dE,nm,lE,im,uE,sm,pE,om,gE,am,mE,cm,hE,dm,fE,lm,AE,um,yE,pm,IE,gm,SE,mm,CE,hm,EE,fm,bE,Am,vE,ym,TE,Im,wE,Sm,RE,Cm,DE,Em,PE,MA,FA,UA,QA,bm,NE,vm,kE,Tm,BE,wm,_E,Ri,HA,GA,mo,Od,qr,qA,ho,zt,xd,Ld,VA,jA,Rm,zA,$d,Dm,OE,xE,fo,Ao,yo,Md,Di,Fd,Ud,Io,Qd,Hd,Pm,KA,WA,JA,LE,XA,YA,$E,ZA,Nm,ey,ty,ry,ME,ny,Pi,Gd,iy,FE,sy,So,Co,qd,km,UE,Bm,QE,_m,HE,Om,GE,xm,qE}from"./chunk-v2p7c7s4.js";import{Ro,Lm,Xd,ay,_i,Yd,Do,$m,Mm,Vr,Po,Zd,ze,el,tl,rl,Oi,jr,Fm,Ke,nl,No,ko,Bo,il,sl,ol,xi,_o,al,zr,Li,Oo,mt,Um,cl,dl,Qm,ll,xo,Kt,ul,pl,gl,ml,We,Hm,hl,Wt,Lo,$o,Mo,$i,Mi,Kr,fl,Fi,Fo,Uo,Wr,Al,Jr,Gm,qm,ht,Xr,Qo,Vm,yl,Il,Ho,Sl,Cl,El,cy,te,bl,dy,ly,Ui,Qi,uy,pe,jm,ft,De,Pe,At,vl,Tl,wl,Rl,zm,Km,Go,Wm,Jm,qo,Dl,Pl,Xm,re,Ym,Nl,ge,Vo,Je,yt,It,Yr,Hi,kl,py,jo,Zm,eh,th,rh,zo,Ko,Bl,Zr,Wo,_l,Gi,Ol,Jo,Xo,Yo,Zo,ea,ta,ra,na,xl,Jt,ia,Ll,en,$l,sa,oa,Ml,Xt,aa,ca,nh,gy,qi,my,hy,fy,da,la,Fl,ih,ua,tn,Ul,Vi,Ql,Hl,Gl,pa,sh,ga,ql,oh,ma,ah,rn,nn,Vl,ji,Xl,tu,ru,nu,iu,su,Ki,Yt,fa,sn,on,Zt,Xe,hh,ya,fh,Ah,cu,Ia,Ji,du,Sa,Ct,ke,lu,Ca,Ea,uu,ba,va,Ta,wa,pu,gu,cn,Ra,Da,Pa,Na,mu,Xi,dn,Yi,ka}from"./chunk-2p71e3x7.js";import{B,Tr,Nc,_s,u,Np,kp}from"./chunk-3m9ghthh.js";import{at,Pc,oi,ai,ci,Pp}from"./chunk-w9jhyy09.js";import{Jh,Xh,Yh,lp,up,pp,Zh,gp,mp,ef,tf,hp,rf,nf,Rc,fp,sf,of,Ap,af,cf,df,lf,uf,pf,gf,si,Dc,yp,Ip,Sp,Cp,Ep,bp,vp,Tp,wp,Rp,Dp,mf,hf,ff,Af,yf,If,Sf}from"./chunk-z3wynefj.js";import{Ue,kc,de,_t,Bc,w,Ot,ct,_c,Os,bf,Bp,Oc,s,di,xs,wr,xc,Lc,Rr,vf,$c,rI,nI,Ls,iI,sI,Mc,Fc,li,$s,X,c,Ms,Qe,Dr,Tf,wf,Uc,xt,Rf,Fs,Df,Pf,Us,Qc,Pr,Qs,Nf,Hc,_p,Lt,Nr,kf,Hs,Bf,R,_f,Gc,Op,Gs,Of,xf,Lf,qc,ui,qs,Vc,$t,dt,$f,kr,Mf,jc,xp,Lp,Vs,zc,Kc,lt,$p,pi,Wc,js,Br,Mp,gi,Jc,Xc,mi,Fp,Yc,Zc,ed,td,zs,Up,Qp,Ff,Hp,rd,hi,Gp,qp,Ks,_r,Ws,Js,Xs,nd,Vp,id,Ys,Uf,Mt,Qf,sd,Or,od,Hf,ad,jp,fi,xr,Zs,Ai,He,Gf,zp,Kp,Ft,cd,dd,ld,yi,Ii,Si,qf,Vf,ut,eo,jf,Lr,Wp,to,zf,Jp,Xp,Yp,Kf,Zp,eg,Wf,i,Jf,Ci,ro,no}from"./chunk-kczzc599.js";import{n}from"./chunk-zx8ecz8b.js";import{o}from"./chunk-yd40pg8g.js";import{me,ss,os,Au,La,$a,as,Ma,Ye,V,Ze,ne,C,he,gn,Fa,Be,Ua,mn,hn,fn,Et,bt,vt,An,tr,Qa,rr,nr,et,yn,Ga,Tt,ir,In,Va,Cu,Eu,ja,sr}from"./chunk-60nr1ehk.js";import{rt,se,Oe,bu,Cn,za,Ka,ds,Ae,wt,En,ls,us,or,ar,bn,cr,ps,gs,ms,hs,z,fs,As,ys,Is,oe,Ss,Cs,Es,T,Wa,vn,Ja,ae,dr}from"./chunk-e8e1h2h9.js";import{fe,tt,Sn}from"./chunk-c3f89ryr.js";import{j}from"./chunk-k53agv2m.js";import{vu,Xa,ye,Ya,Tn,Tu,Za,wu,Ru,Ph,Rn,vs,Dn,Pn,Nn,K,xe,N,mr,Bn,hr,ce,rc,_n,nc,Ar,xn,Ts,Ln,$n,Mn,Un,yr,cc,Le,W,$e,Me,it,Ce,Ir,Ee,Gn,qn,Vn,jn,zn,Kn,Wn,Sr,k,Ds,Yu,hc,Xn,Yn,Zn,ei,Ec,Ps,bc,kt,ti,Ns,ks,vc,ri,Tc}from"./chunk-s2ve9zxn.js";import{Vd,Eo,Ni,ki,bo,jd,zd,Bi,vo,To,Wd,Jd,wo}from"./chunk-e52me1c6.js";import{Ba,ln,un,Zi,es,ts,rs,_a,Oa}from"./chunk-9syc8s7r.js";import{xa}from"./chunk-7xnwa0s8.js";import{A}from"./chunk-31tvc877.js";import{_e}from"./chunk-5far81q7.js";import{y}from"./chunk-9wmer0zx.js";import{J,ni,Bs,wc,ii,dp}from"./chunk-srrscggm.js";import{Er,be}from"./chunk-qcaqc5b8.js";import{h}from"./chunk-ptq9v346.js";import{zh,Fe}from"./chunk-bxrzsth8.js";import{ud,$r,pd,gd,md,Ei,tg,Mr}from"./chunk-g6g33pt9.js";import{createHmac as lc,createSign as jl,timingSafeEqual as Zl}from"node:crypto";function Aa(l){let S=l instanceof Date?l.getTime():l;if(!Number.isFinite(S))throw TypeError("Media access timestamp must be finite");return Math.floor(S/1000)}function dc(l){return Buffer.from(l).toString("base64").replaceAll("+","-").replaceAll("=","_").replaceAll("/","~")}function Jl(l){return Buffer.from(l).toString("base64url")}function uc(l,S=!1){if(!l||/[\r\n]/.test(l))throw TypeError("Media resource is invalid");let P=S?l.replaceAll("*","wildcard"):l,v=new URL(P);if(!["http:","https:"].includes(v.protocol))throw TypeError("Media resource must use HTTP or HTTPS");if(!S&&l.includes("*"))throw TypeError("Canned policies cannot contain wildcards")}function pc(l,S){let P=jl("RSA-SHA1");return P.update(l),P.end(),dc(P.sign(S))}function mc(l){uc(l.resource,!0);let P={DateLessThan:{"AWS:EpochTime":Aa(l.expiresAt)}};if(l.activeAt!==void 0)P.DateGreaterThan={"AWS:EpochTime":Aa(l.activeAt)};if(l.ipAddress)P.IpAddress={"AWS:SourceIp":l.ipAddress};return JSON.stringify({Statement:[{Resource:l.resource,Condition:P}]})}function Ku(l,S,P){uc(l);let v=Aa(S),E=l.includes("?")?"&":"?",ot=mc({resource:l,expiresAt:S}),Ie=pc(ot,P.privateKey);return`${l}${E}Expires=${v}&Signature=${encodeURIComponent(Ie)}&Key-Pair-Id=${encodeURIComponent(P.keyPairId)}`}function ju(l,S){let P=mc(l);return{"CloudFront-Key-Pair-Id":S.keyPairId,"CloudFront-Policy":dc(Buffer.from(P)),"CloudFront-Signature":pc(P,S.privateKey)}}function Zu(l){if(!l.resource||/[\r\n]/.test(l.resource))throw TypeError("Media resource is invalid");let S=Jl(Buffer.from(JSON.stringify({resource:l.resource,expiresAt:Aa(l.expiresAt),...l.keyId?{keyId:l.keyId}:{},...l.audience?{audience:l.audience}:{}}))),P=lc("sha256",l.secret).update(S).digest("base64url");return`${S}.${P}`}function qu(l,S){let[P,v,E]=l.split(".");if(!P||!v||E)return null;let ot=lc("sha256",S.secret).update(P).digest(),Ie;try{Ie=Buffer.from(v,"base64url")}catch{return null}if(ot.length!==Ie.length||!Zl(ot,Ie))return null;try{let Ne=JSON.parse(Buffer.from(P,"base64url").toString("utf8")),nt=Aa(S.now??Date.now());if(!Ne.resource||!Number.isSafeInteger(Ne.expiresAt)||Ne.expiresAt<=nt)return null;if(S.resource&&Ne.resource!==S.resource)return null;if(S.audience&&Ne.audience!==S.audience)return null;return Ne}catch{return null}}function Ju(l,S=!1){let P=new URL(l,"https://media.invalid").pathname.toLowerCase(),v=/\.(?:m3u8|mpd|vtt|json)$/.test(P),E=/\.(?:key|license)$/.test(P)||P.includes("/keys/")||P.includes("/licenses/");return{"Accept-Ranges":"bytes","Cache-Control":S&&(v||E)?"private, no-store":v?"public, max-age=5, s-maxage=30, stale-while-revalidate=30":"public, max-age=31536000, immutable","Cross-Origin-Resource-Policy":"cross-origin","X-Content-Type-Options":"nosniff"}}function Xu(l){if(!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(l.bucket))throw TypeError("Media bucket is invalid");if(!/^[a-z0-9-]+$/.test(l.region))throw TypeError("Media bucket region is invalid");let S=l.prefix?`/${l.prefix.replace(/^\/+|\/+$/g,"")}`:"",P=l.protected??!1,v="public, max-age=31536000, immutable",E=P?"private, no-store":"public, max-age=5, s-maxage=30, stale-while-revalidate=30";return{originDomain:`${l.bucket}.s3.${l.region}.amazonaws.com`,originPath:S,domain:l.domain,trustedKeyGroupIds:[...new Set(l.trustedKeyGroupIds??[])],behaviors:[{pathPattern:"*.m3u8",cacheControl:E,compress:!0,signed:P},{pathPattern:"*.mpd",cacheControl:E,compress:!0,signed:P},{pathPattern:"*.vtt",cacheControl:E,compress:!0,signed:P},{pathPattern:"*",cacheControl:v,compress:!1,signed:P}],responseHeaders:{"Access-Control-Allow-Headers":"Range, If-Range","Access-Control-Allow-Methods":"GET, HEAD, OPTIONS","Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":"Accept-Ranges, Content-Length, Content-Range, ETag","X-Content-Type-Options":"nosniff"}}}class Yl{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;storageFailoverReplicas=[];constructor(l){this.config=l.config,this.environment=l.environment,this.builder=new Cd(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let S=this.config.environments[this.environment]?.infrastructure;if(!S)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...S,compute:{...this.config.infrastructure?.compute,...S.compute},storage:{...this.config.infrastructure?.storage,...S.storage},functions:{...this.config.infrastructure?.functions,...S.functions},servers:{...this.config.infrastructure?.servers,...S.servers},databases:{...this.config.infrastructure?.databases,...S.databases},cdn:{...this.config.infrastructure?.cdn,...S.cdn},sftp:S.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...S.queues},redirects:{...this.config.infrastructure?.redirects,...S.redirects},realtime:{...this.config.infrastructure?.realtime,...S.realtime},cache:{...this.config.infrastructure?.cache,...S.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...S.fileSystem},email:{...this.config.infrastructure?.email,...S.email},search:{...this.config.infrastructure?.search,...S.search},ai:{...this.config.infrastructure?.ai,...S.ai}}}}shouldDeploy(l){if(l.environments&&!l.environments.includes(this.environment))return!1;if(l.requiresFeatures){let S=this.config.features||{};if(!l.requiresFeatures.every((v)=>S[v]===!0))return!1}if(l.regions){let S=this.config.environments[this.environment]?.region||this.config.project.region;if(!l.regions.includes(S))return!1}if(l.condition&&typeof l.condition==="function")return l.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let l=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,S=Number(l||3008);return Number.isFinite(S)&&S>0?S:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(l,S){return l==="public"||S.routeCompute===!0}storageBucketName(l,S,P){return this.mergedConfig.infrastructure?.storage?.[P]?.bucket??`${l}-${S}-${P}`}fileSystemLogicalId(l,S,P){return t(r({slug:`${l}-${P}`,environment:S,resourceType:"efs"}))}resolveSftpStorage(l,S,P){let v=l.storage;if(v?.type==="efs"&&v.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[v.fileSystem])throw Error(`sftp: storage.fileSystem "${v.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(S,P,v.fileSystem)},posixProfile:v.posixProfile}}if(v?.type==="s3"&&v.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[v.storageBucket])throw Error(`sftp: storage.storageBucket "${v.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(S,P,v.storageBucket)}}return}resolveComputeCachePathPatterns(l){if(l&&l.length>0)return l;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(l,S){return{PathPattern:l,TargetOriginId:S,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(l,S,P,v,E,ot){let Ie=this.serverEipLogicalIds.get("app"),Ne=this.serverEipLogicalIds.get("appInstance");if(!Ie)return;let nt=`EC2-${v}-${E}-api`,Pt=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",st=Pt==="us-east-1"?".compute-1.amazonaws.com":`.${Pt}.compute.amazonaws.com`,ur={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:Ie}]}]},st]]},pr=this.resolveApiOriginPort();if(l.push({Id:nt,DomainName:ur,CustomOriginConfig:{HTTPPort:pr,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),P.push(Ie),Ne)P.push(Ne);for(let gr of ot)S.push(this.createComputeCacheBehavior(gr,nt))}buildCaddyfile(l){let S=l.filter(([,E])=>typeof E.domain==="string"&&E.domain&&typeof E.port==="number");if(S.length===0)return;let P=new Map;for(let[,E]of S){let ot=P.get(E.domain)??[];ot.push({port:E.port,path:E.path}),P.set(E.domain,ot)}let v=[];for(let[E,ot]of P){let Ne=[...ot].sort((nt,Pt)=>{let st=!nt.path||nt.path==="/",ur=!Pt.path||Pt.path==="/";if(st&&!ur)return 1;if(!st&&ur)return-1;return(Pt.path?.length??0)-(nt.path?.length??0)}).map((nt)=>{let Pt=!nt.path||nt.path==="/",st=`reverse_proxy localhost:${nt.port}`;return Pt?`  handle {
+import{rg,_,ng,Xf,oI,Yf,aI,cI,dI,lI,uI,pI,gI,mI,hI,fI,ig,sg,hd,fd,io,O,d,Ad,og,x,yd,p,Zf,bi,Id,Sd,le,Cd,yI,r,t,II,SI,g,CI,EI,bI,vI,TI,Ut,Ed,so,eA,wI,RI,ve,Ge,bd,ag,cg,DI,dg,lg,ug,vd,pg,Te,Fr,Qt,Td,Ht,ue,tA,wd,oo,gg,mg,hg,fg,Rd,PI,L,I,a,f,qe,m,rA,Ve,M,pt,NI,nA,F,Dd,we,Gt,ao,Y,Pd,Z,iA,co,U,Q,D,vi,b,qt,gt,H,e,lo,kI,Ag,Nd,BI,_I,OI,xI,kd,LI,$I,MI,FI,UI,QI,HI,GI,qI,VI,jI,zI,sA,oA,aA,cA,dA,lA,uA,Vt,yg,Ig,Ur,Ti,KI,Sg,WI,JI,Qr,XI,YI,ZI,eS,tS,rS,pA,gA,mA,hA,fA,uo,nS,AA,yA,IA,G,iS,je,po,jt,SA,Cg,CA,EA,bA,Eg,ee,sS,oS,aS,cS,vA,dS,q,lS,uS,pS,bg,vg,gS,Tg,wg,mS,hS,fS,AS,yS,TA,Bd,IS,SS,CS,ES,bS,wA,RA,vS,TS,wS,RS,DS,PS,NS,kS,BS,Rg,_d,_S,OS,xS,LS,Dg,Pg,Ng,$S,kg,MS,FS,US,QS,Bg,HS,GS,qS,VS,jS,zS,KS,WS,DA,PA,NA,kA,_g,JS,XS,YS,ZS,eC,tC,rC,nC,iC,BA,_A,OA,xA,sC,oC,Og,aC,xg,Lg,$g,Mg,cC,dC,lC,uC,Re,wi,pC,gC,mC,hC,fC,AC,yC,IC,LA,SC,CC,Fg,Ug,EC,bC,$A,vC,TC,wC,RC,DC,PC,NC,kC,BC,_C,OC,xC,LC,$C,MC,FC,UC,QC,HC,GC,qC,Qg,VC,Hg,jC,Gg,zC,qg,KC,Vg,WC,Hr,JC,jg,XC,go,YC,zg,ZC,Kg,eE,Wg,tE,Jg,rE,Xg,nE,Gr,iE,Yg,sE,Zg,oE,em,aE,tm,cE,rm,dE,nm,lE,im,uE,sm,pE,om,gE,am,mE,cm,hE,dm,fE,lm,AE,um,yE,pm,IE,gm,SE,mm,CE,hm,EE,fm,bE,Am,vE,ym,TE,Im,wE,Sm,RE,Cm,DE,Em,PE,MA,FA,UA,QA,bm,NE,vm,kE,Tm,BE,wm,_E,Ri,HA,GA,mo,Od,qr,qA,ho,zt,xd,Ld,VA,jA,Rm,zA,$d,Dm,OE,xE,fo,Ao,yo,Md,Di,Fd,Ud,Io,Qd,Hd,Pm,KA,WA,JA,LE,XA,YA,$E,ZA,Nm,ey,ty,ry,ME,ny,Pi,Gd,iy,FE,sy,So,Co,qd,km,UE,Bm,QE,_m,HE,Om,GE,xm,qE}from"./chunk-v2p7c7s4.js";import{Ro,Lm,Xd,ay,_i,Yd,Do,$m,Mm,Vr,Po,Zd,ze,el,tl,rl,Oi,jr,Fm,Ke,nl,No,ko,Bo,il,sl,ol,xi,_o,al,zr,Li,Oo,mt,Um,cl,dl,Qm,ll,xo,Kt,ul,pl,gl,ml,We,Hm,hl,Wt,Lo,$o,Mo,$i,Mi,Kr,fl,Fi,Fo,Uo,Wr,Al,Jr,Gm,qm,ht,Xr,Qo,Vm,yl,Il,Ho,Sl,Cl,El,cy,te,bl,dy,ly,Ui,Qi,uy,pe,jm,ft,De,Pe,At,vl,Tl,wl,Rl,zm,Km,Go,Wm,Jm,qo,Dl,Pl,Xm,re,Ym,Nl,ge,Vo,Je,yt,It,Yr,Hi,kl,py,jo,Zm,eh,th,rh,zo,Ko,Bl,Zr,Wo,_l,Gi,Ol,Jo,Xo,Yo,Zo,ea,ta,ra,na,xl,Jt,ia,Ll,en,$l,sa,oa,Ml,Xt,aa,ca,nh,gy,qi,my,hy,fy,da,la,Fl,ih,ua,tn,Ul,Vi,Ql,Hl,Gl,pa,sh,ga,ql,oh,ma,ah,rn,nn,Vl,ji,Xl,tu,ru,nu,iu,su,Ki,Yt,fa,sn,on,Zt,Xe,hh,ya,fh,Ah,cu,Ia,Ji,du,Sa,Ct,ke,lu,Ca,Ea,uu,ba,va,Ta,wa,pu,gu,cn,Ra,Da,Pa,Na,mu,Xi,dn,Yi,ka}from"./chunk-bcy9z4ks.js";import{B,Tr,Nc,_s,u,Np,kp}from"./chunk-3m9ghthh.js";import{at,Pc,oi,ai,ci,Pp}from"./chunk-w9jhyy09.js";import{Jh,Xh,Yh,lp,up,pp,Zh,gp,mp,ef,tf,hp,rf,nf,Rc,fp,sf,of,Ap,af,cf,df,lf,uf,pf,gf,si,Dc,yp,Ip,Sp,Cp,Ep,bp,vp,Tp,wp,Rp,Dp,mf,hf,ff,Af,yf,If,Sf}from"./chunk-z3wynefj.js";import{Ue,kc,de,_t,Bc,w,Ot,ct,_c,Os,bf,Bp,Oc,s,di,xs,wr,xc,Lc,Rr,vf,$c,rI,nI,Ls,iI,sI,Mc,Fc,li,$s,X,c,Ms,Qe,Dr,Tf,wf,Uc,xt,Rf,Fs,Df,Pf,Us,Qc,Pr,Qs,Nf,Hc,_p,Lt,Nr,kf,Hs,Bf,R,_f,Gc,Op,Gs,Of,xf,Lf,qc,ui,qs,Vc,$t,dt,$f,kr,Mf,jc,xp,Lp,Vs,zc,Kc,lt,$p,pi,Wc,js,Br,Mp,gi,Jc,Xc,mi,Fp,Yc,Zc,ed,td,zs,Up,Qp,Ff,Hp,rd,hi,Gp,qp,Ks,_r,Ws,Js,Xs,nd,Vp,id,Ys,Uf,Mt,Qf,sd,Or,od,Hf,ad,jp,fi,xr,Zs,Ai,He,Gf,zp,Kp,Ft,cd,dd,ld,yi,Ii,Si,qf,Vf,ut,eo,jf,Lr,Wp,to,zf,Jp,Xp,Yp,Kf,Zp,eg,Wf,i,Jf,Ci,ro,no}from"./chunk-kczzc599.js";import{n}from"./chunk-zx8ecz8b.js";import{o}from"./chunk-9asn5fpt.js";import{me,ss,os,Au,La,$a,as,Ma,Ye,V,Ze,ne,C,he,gn,Fa,Be,Ua,mn,hn,fn,Et,bt,vt,An,tr,Qa,rr,nr,et,yn,Ga,Tt,ir,In,Va,Cu,Eu,ja,sr}from"./chunk-2m262b2n.js";import{rt,se,Oe,bu,Cn,za,Ka,ds,Ae,wt,En,ls,us,or,ar,bn,cr,ps,gs,ms,hs,z,fs,As,ys,Is,oe,Ss,Cs,Es,T,Wa,vn,Ja,ae,dr}from"./chunk-e8e1h2h9.js";import{fe,tt,Sn}from"./chunk-r1wpwfff.js";import{j}from"./chunk-k53agv2m.js";import{vu,Xa,ye,Ya,Tn,Tu,Za,wu,Ru,Ph,Rn,vs,Dn,Pn,Nn,K,xe,N,mr,Bn,hr,ce,rc,_n,nc,Ar,xn,Ts,Ln,$n,Mn,Un,yr,cc,Le,W,$e,Me,it,Ce,Ir,Ee,Gn,qn,Vn,jn,zn,Kn,Wn,Sr,k,Ds,Yu,hc,Xn,Yn,Zn,ei,Ec,Ps,bc,kt,ti,Ns,ks,vc,ri,Tc}from"./chunk-5255nr93.js";import{Vd,Eo,Ni,ki,bo,jd,zd,Bi,vo,To,Wd,Jd,wo}from"./chunk-e52me1c6.js";import{Ba,ln,un,Zi,es,ts,rs,_a,Oa}from"./chunk-hyeeqga9.js";import{xa}from"./chunk-7xnwa0s8.js";import{A}from"./chunk-31tvc877.js";import{_e}from"./chunk-5far81q7.js";import{y}from"./chunk-9wmer0zx.js";import{J,ni,Bs,wc,ii,dp}from"./chunk-srrscggm.js";import{Er,be}from"./chunk-qcaqc5b8.js";import{h}from"./chunk-ptq9v346.js";import{zh,Fe}from"./chunk-bxrzsth8.js";import{ud,$r,pd,gd,md,Ei,tg,Mr}from"./chunk-g6g33pt9.js";import{createHmac as lc,createSign as jl,timingSafeEqual as Zl}from"node:crypto";function Aa(l){let S=l instanceof Date?l.getTime():l;if(!Number.isFinite(S))throw TypeError("Media access timestamp must be finite");return Math.floor(S/1000)}function dc(l){return Buffer.from(l).toString("base64").replaceAll("+","-").replaceAll("=","_").replaceAll("/","~")}function Jl(l){return Buffer.from(l).toString("base64url")}function uc(l,S=!1){if(!l||/[\r\n]/.test(l))throw TypeError("Media resource is invalid");let P=S?l.replaceAll("*","wildcard"):l,v=new URL(P);if(!["http:","https:"].includes(v.protocol))throw TypeError("Media resource must use HTTP or HTTPS");if(!S&&l.includes("*"))throw TypeError("Canned policies cannot contain wildcards")}function pc(l,S){let P=jl("RSA-SHA1");return P.update(l),P.end(),dc(P.sign(S))}function mc(l){uc(l.resource,!0);let P={DateLessThan:{"AWS:EpochTime":Aa(l.expiresAt)}};if(l.activeAt!==void 0)P.DateGreaterThan={"AWS:EpochTime":Aa(l.activeAt)};if(l.ipAddress)P.IpAddress={"AWS:SourceIp":l.ipAddress};return JSON.stringify({Statement:[{Resource:l.resource,Condition:P}]})}function Ku(l,S,P){uc(l);let v=Aa(S),E=l.includes("?")?"&":"?",ot=mc({resource:l,expiresAt:S}),Ie=pc(ot,P.privateKey);return`${l}${E}Expires=${v}&Signature=${encodeURIComponent(Ie)}&Key-Pair-Id=${encodeURIComponent(P.keyPairId)}`}function ju(l,S){let P=mc(l);return{"CloudFront-Key-Pair-Id":S.keyPairId,"CloudFront-Policy":dc(Buffer.from(P)),"CloudFront-Signature":pc(P,S.privateKey)}}function Zu(l){if(!l.resource||/[\r\n]/.test(l.resource))throw TypeError("Media resource is invalid");let S=Jl(Buffer.from(JSON.stringify({resource:l.resource,expiresAt:Aa(l.expiresAt),...l.keyId?{keyId:l.keyId}:{},...l.audience?{audience:l.audience}:{}}))),P=lc("sha256",l.secret).update(S).digest("base64url");return`${S}.${P}`}function qu(l,S){let[P,v,E]=l.split(".");if(!P||!v||E)return null;let ot=lc("sha256",S.secret).update(P).digest(),Ie;try{Ie=Buffer.from(v,"base64url")}catch{return null}if(ot.length!==Ie.length||!Zl(ot,Ie))return null;try{let Ne=JSON.parse(Buffer.from(P,"base64url").toString("utf8")),nt=Aa(S.now??Date.now());if(!Ne.resource||!Number.isSafeInteger(Ne.expiresAt)||Ne.expiresAt<=nt)return null;if(S.resource&&Ne.resource!==S.resource)return null;if(S.audience&&Ne.audience!==S.audience)return null;return Ne}catch{return null}}function Ju(l,S=!1){let P=new URL(l,"https://media.invalid").pathname.toLowerCase(),v=/\.(?:m3u8|mpd|vtt|json)$/.test(P),E=/\.(?:key|license)$/.test(P)||P.includes("/keys/")||P.includes("/licenses/");return{"Accept-Ranges":"bytes","Cache-Control":S&&(v||E)?"private, no-store":v?"public, max-age=5, s-maxage=30, stale-while-revalidate=30":"public, max-age=31536000, immutable","Cross-Origin-Resource-Policy":"cross-origin","X-Content-Type-Options":"nosniff"}}function Xu(l){if(!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(l.bucket))throw TypeError("Media bucket is invalid");if(!/^[a-z0-9-]+$/.test(l.region))throw TypeError("Media bucket region is invalid");let S=l.prefix?`/${l.prefix.replace(/^\/+|\/+$/g,"")}`:"",P=l.protected??!1,v="public, max-age=31536000, immutable",E=P?"private, no-store":"public, max-age=5, s-maxage=30, stale-while-revalidate=30";return{originDomain:`${l.bucket}.s3.${l.region}.amazonaws.com`,originPath:S,domain:l.domain,trustedKeyGroupIds:[...new Set(l.trustedKeyGroupIds??[])],behaviors:[{pathPattern:"*.m3u8",cacheControl:E,compress:!0,signed:P},{pathPattern:"*.mpd",cacheControl:E,compress:!0,signed:P},{pathPattern:"*.vtt",cacheControl:E,compress:!0,signed:P},{pathPattern:"*",cacheControl:v,compress:!1,signed:P}],responseHeaders:{"Access-Control-Allow-Headers":"Range, If-Range","Access-Control-Allow-Methods":"GET, HEAD, OPTIONS","Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":"Accept-Ranges, Content-Length, Content-Range, ETag","X-Content-Type-Options":"nosniff"}}}class Yl{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;storageFailoverReplicas=[];constructor(l){this.config=l.config,this.environment=l.environment,this.builder=new Cd(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let S=this.config.environments[this.environment]?.infrastructure;if(!S)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...S,compute:{...this.config.infrastructure?.compute,...S.compute},storage:{...this.config.infrastructure?.storage,...S.storage},functions:{...this.config.infrastructure?.functions,...S.functions},servers:{...this.config.infrastructure?.servers,...S.servers},databases:{...this.config.infrastructure?.databases,...S.databases},cdn:{...this.config.infrastructure?.cdn,...S.cdn},sftp:S.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...S.queues},redirects:{...this.config.infrastructure?.redirects,...S.redirects},realtime:{...this.config.infrastructure?.realtime,...S.realtime},cache:{...this.config.infrastructure?.cache,...S.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...S.fileSystem},email:{...this.config.infrastructure?.email,...S.email},search:{...this.config.infrastructure?.search,...S.search},ai:{...this.config.infrastructure?.ai,...S.ai}}}}shouldDeploy(l){if(l.environments&&!l.environments.includes(this.environment))return!1;if(l.requiresFeatures){let S=this.config.features||{};if(!l.requiresFeatures.every((v)=>S[v]===!0))return!1}if(l.regions){let S=this.config.environments[this.environment]?.region||this.config.project.region;if(!l.regions.includes(S))return!1}if(l.condition&&typeof l.condition==="function")return l.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let l=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,S=Number(l||3008);return Number.isFinite(S)&&S>0?S:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(l,S){return l==="public"||S.routeCompute===!0}storageBucketName(l,S,P){return this.mergedConfig.infrastructure?.storage?.[P]?.bucket??`${l}-${S}-${P}`}fileSystemLogicalId(l,S,P){return t(r({slug:`${l}-${P}`,environment:S,resourceType:"efs"}))}resolveSftpStorage(l,S,P){let v=l.storage;if(v?.type==="efs"&&v.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[v.fileSystem])throw Error(`sftp: storage.fileSystem "${v.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(S,P,v.fileSystem)},posixProfile:v.posixProfile}}if(v?.type==="s3"&&v.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[v.storageBucket])throw Error(`sftp: storage.storageBucket "${v.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(S,P,v.storageBucket)}}return}resolveComputeCachePathPatterns(l){if(l&&l.length>0)return l;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(l,S){return{PathPattern:l,TargetOriginId:S,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(l,S,P,v,E,ot){let Ie=this.serverEipLogicalIds.get("app"),Ne=this.serverEipLogicalIds.get("appInstance");if(!Ie)return;let nt=`EC2-${v}-${E}-api`,Pt=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",st=Pt==="us-east-1"?".compute-1.amazonaws.com":`.${Pt}.compute.amazonaws.com`,ur={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:Ie}]}]},st]]},pr=this.resolveApiOriginPort();if(l.push({Id:nt,DomainName:ur,CustomOriginConfig:{HTTPPort:pr,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),P.push(Ie),Ne)P.push(Ne);for(let gr of ot)S.push(this.createComputeCacheBehavior(gr,nt))}buildCaddyfile(l){let S=l.filter(([,E])=>typeof E.domain==="string"&&E.domain&&typeof E.port==="number");if(S.length===0)return;let P=new Map;for(let[,E]of S){let ot=P.get(E.domain)??[];ot.push({port:E.port,path:E.path}),P.set(E.domain,ot)}let v=[];for(let[E,ot]of P){let Ne=[...ot].sort((nt,Pt)=>{let st=!nt.path||nt.path==="/",ur=!Pt.path||Pt.path==="/";if(st&&!ur)return 1;if(!st&&ur)return-1;return(Pt.path?.length??0)-(nt.path?.length??0)}).map((nt)=>{let Pt=!nt.path||nt.path==="/",st=`reverse_proxy localhost:${nt.port}`;return Pt?`  handle {
     ${st}
   }`:`  handle ${nt.path} {
     ${st}

package/dist/ui/404.html

@@ -2,7 +2,7 @@
 <html lang="en" data-theme="dark">
 <head>
   <meta charset="UTF-8">
-  <meta name="stx-build" content="mutamzm7wqm65b">
+  <meta name="stx-build" content="mutaz9hm15tgdu">
 
 <!-- stx SEO Tags -->
 <meta name="title" content="Page not found · ts-cloud">