@stacksjs/ts-cloud 0.16.18 → 0.16.20

package/dist/bin/dashboard-server.js

@@ -1 +1 @@
-import"./chunk-mxvekmdx.js";import"./chunk-0trtkv9g.js";import"./chunk-e24bscb0.js";import{tr}from"./chunk-acqj5mfq.js";import"./chunk-mx9ppkmn.js";import"./chunk-k7wh1wr5.js";import"./chunk-gfnw9nhq.js";import"./chunk-z1dtdw3j.js";import"./chunk-nrrprf04.js";import"./chunk-vjkyj3xy.js";import"./chunk-eyvxsaaz.js";import"./chunk-90102shh.js";import"./chunk-dyh0vndw.js";import"./chunk-148x1zq8.js";import"./chunk-5a7sxtwn.js";import"./chunk-ezhbcpw1.js";import"./chunk-egn33pr9.js";import"./chunk-6kx50dyc.js";import"./chunk-t10e32an.js";import"./chunk-ys5n5c84.js";import"./chunk-2mv692y4.js";import"./chunk-75ak501k.js";import"./chunk-rbtt23vx.js";import"./chunk-h1rb8qvt.js";import"./chunk-1j8b1d58.js";import"./chunk-9vmtm7nq.js";import n from"node:process";function r(o){let e=n.argv.indexOf(o);return e===-1?void 0:n.argv[e+1]}function t(o){return n.argv.includes(o)}async function i(){let o=await tr({host:r("--host")??"127.0.0.1",port:Number(r("--port")??7676),environment:r("--env"),box:t("--box"),verbose:t("--verbose")});console.log("ts-cloud Local Dashboard"),console.log(`Serving ${o.url}`),await new Promise((e)=>{let s=()=>{o.server.stop(!0),e()};n.once("SIGINT",s),n.once("SIGTERM",s)})}i();
+import"./chunk-mxvekmdx.js";import"./chunk-0trtkv9g.js";import"./chunk-e24bscb0.js";import{tr}from"./chunk-7zfydgfz.js";import"./chunk-mx9ppkmn.js";import"./chunk-k7wh1wr5.js";import"./chunk-e55fdn0r.js";import"./chunk-z1dtdw3j.js";import"./chunk-gfr2215x.js";import"./chunk-vjkyj3xy.js";import"./chunk-48x0wc2g.js";import"./chunk-90102shh.js";import"./chunk-dyh0vndw.js";import"./chunk-148x1zq8.js";import"./chunk-5a7sxtwn.js";import"./chunk-840arz58.js";import"./chunk-egn33pr9.js";import"./chunk-6kx50dyc.js";import"./chunk-t10e32an.js";import"./chunk-ys5n5c84.js";import"./chunk-2mv692y4.js";import"./chunk-ndddd2ft.js";import"./chunk-rbtt23vx.js";import"./chunk-h1rb8qvt.js";import"./chunk-1j8b1d58.js";import"./chunk-9vmtm7nq.js";import n from"node:process";function r(o){let e=n.argv.indexOf(o);return e===-1?void 0:n.argv[e+1]}function t(o){return n.argv.includes(o)}async function i(){let o=await tr({host:r("--host")??"127.0.0.1",port:Number(r("--port")??7676),environment:r("--env"),box:t("--box"),verbose:t("--verbose")});console.log("ts-cloud Local Dashboard"),console.log(`Serving ${o.url}`),await new Promise((e)=>{let s=()=>{o.server.stop(!0),e()};n.once("SIGINT",s),n.once("SIGTERM",s)})}i();

package/dist/{chunk-rtn4gj6y.js → chunk-07rjctzz.js}

@@ -1 +1 @@
-import{Zi,es,ts,rs,_a,Oa}from"./chunk-9syc8s7r.js";import"./chunk-31tvc877.js";import"./chunk-e8e1h2h9.js";import"./chunk-9wmer0zx.js";import"./chunk-ptq9v346.js";import"./chunk-yd40pg8g.js";import"./chunk-zx8ecz8b.js";export{_a as deleteStaticSite,es as deployStaticSite,Oa as deployStaticSiteFull,Zi as generateStaticSiteTemplate,rs as invalidateCache,ts as uploadStaticFiles};
+import{Zi,es,ts,rs,_a,Oa}from"./chunk-hyeeqga9.js";import"./chunk-31tvc877.js";import"./chunk-e8e1h2h9.js";import"./chunk-9wmer0zx.js";import"./chunk-ptq9v346.js";import"./chunk-9asn5fpt.js";import"./chunk-zx8ecz8b.js";export{_a as deleteStaticSite,es as deployStaticSite,Oa as deployStaticSiteFull,Zi as generateStaticSiteTemplate,rs as invalidateCache,ts as uploadStaticFiles};

package/dist/{chunk-2p71e3x7.js → chunk-0j2tpr8d.js}

@@ -1,4 +1,4 @@
-import{hd,O,d,Ad,x,p,le,g,Ut,Ed,so,oo,Rd,Nd,kd,Od,qr,ho,zt,xd,Ld,Gd,qd}from"./chunk-v2p7c7s4.js";import{B,u}from"./chunk-3m9ghthh.js";import{de,_t,w,Ot,s,di,xs,Rr,Mc,Fc,X,c,Ms,Qe,Dr,Uc,xt,Us,Qc,Pr,Qs,Nr,pi,Mt,fi,Ai,He,Ft,cd,dd,Ii,Si,ut,eo,i,Ci,ro,no}from"./chunk-kczzc599.js";import{n,l}from"./chunk-zx8ecz8b.js";import{Bt,o}from"./chunk-yd40pg8g.js";import{un}from"./chunk-9syc8s7r.js";import{pn,hu,ns,P,v,is,fu}from"./chunk-7xnwa0s8.js";import{me,er,cs,Ye,V,ne,C,he,nr,et,sr}from"./chunk-60nr1ehk.js";import{j}from"./chunk-k53agv2m.js";import{E,ur,bs,Pt,pr,Du,Nt,Nu,ac,$e,st,Hn,k,kt,Cr}from"./chunk-s2ve9zxn.js";import{fe}from"./chunk-c3f89ryr.js";import{A}from"./chunk-31tvc877.js";import{_e}from"./chunk-5far81q7.js";import{be}from"./chunk-qcaqc5b8.js";import{h}from"./chunk-ptq9v346.js";function rn(e){let t=$c(e.name),r=tp(e.configText);if(Iw(e.configText,r.start,r.end,t))throw Error(`Site '${t}' already exists in cloud.config.ts`);let a=ch({...e,name:t}),m=e.configText.slice(0,r.end).trimEnd(),f=e.configText.slice(r.end),y=m.endsWith("{")?`
+import{hd,O,d,Ad,x,p,le,g,Ut,Ed,so,oo,Rd,Nd,kd,Od,qr,ho,zt,xd,Ld,Gd,qd}from"./chunk-v2p7c7s4.js";import{B,u}from"./chunk-3m9ghthh.js";import{de,_t,w,Ot,s,di,xs,Rr,Mc,Fc,X,c,Ms,Qe,Dr,Uc,xt,Us,Qc,Pr,Qs,Nr,pi,Mt,fi,Ai,He,Ft,cd,dd,Ii,Si,ut,eo,i,Ci,ro,no}from"./chunk-kczzc599.js";import{n,l}from"./chunk-zx8ecz8b.js";import{Bt,o}from"./chunk-9asn5fpt.js";import{un}from"./chunk-hyeeqga9.js";import{pn,hu,ns,P,v,is,fu}from"./chunk-7xnwa0s8.js";import{me,er,cs,Ye,V,ne,C,he,nr,et,sr}from"./chunk-wgf1ndgq.js";import{j}from"./chunk-k53agv2m.js";import{E,ur,bs,Pt,pr,Du,Nt,Nu,ac,$e,st,Hn,k,kt,Cr}from"./chunk-aw1tp3p3.js";import{fe}from"./chunk-d46p0h6t.js";import{A}from"./chunk-31tvc877.js";import{_e}from"./chunk-5far81q7.js";import{be}from"./chunk-qcaqc5b8.js";import{h}from"./chunk-ptq9v346.js";function rn(e){let t=$c(e.name),r=tp(e.configText);if(Iw(e.configText,r.start,r.end,t))throw Error(`Site '${t}' already exists in cloud.config.ts`);let a=ch({...e,name:t}),m=e.configText.slice(0,r.end).trimEnd(),f=e.configText.slice(r.end),y=m.endsWith("{")?`
 `:m.endsWith(",")?`
 
 `:`,
@@ -70,7 +70,7 @@ data: ${JSON.stringify(pt)}
         default_role = ?, enabled = ?, enforce_sso = ?, updated_at = ? WHERE id = ?`,[t,r,a,m,e.clientSecret?this.encrypt(e.clientSecret):null,JSON.stringify(f),JSON.stringify(y),e.defaultRole??I.defaultRole,e.enabled??I.enabled?1:0,e.enforceSso??I.enforceSso?1:0,R,I.id]),this.getOidcProvider(I.id)}if(!e.clientSecret)throw Error("OIDC client secret is required for a new provider");let b=e.id??this.idFn();return this.run(`INSERT INTO auth_oidc_providers (id, organization_id, slug, name, issuer, client_id,
       client_secret_ciphertext, scopes, allowed_domains, default_role, enabled, enforce_sso, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[b,e.organizationId,t,r,a,m,this.encrypt(e.clientSecret),JSON.stringify(f),JSON.stringify(y),e.defaultRole??"viewer",e.enabled===!1?0:1,e.enforceSso?1:0,R,R]),this.getOidcProvider(b)}getOidcProvider(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(e);return t?Vc(t):void 0}getOidcProviderBySlug(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE slug = ? COLLATE NOCASE").get(e.trim());return t?Vc(t):void 0}listOidcProviders(e,t={}){return(e?this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(e):this.controlPlane.database.query("SELECT * FROM auth_oidc_providers ORDER BY name COLLATE NOCASE").all()).map(Vc).filter((a)=>t.includeDisabled||a.enabled)}setOidcProviderEnabled(e,t){let r=this.now();if(this.controlPlane.database.run("UPDATE auth_oidc_providers SET enabled = ?, enforce_sso = CASE WHEN ? = 0 THEN 0 ELSE enforce_sso END, updated_at = ? WHERE id = ?",[t?1:0,t?1:0,r,e]).changes!==1)throw Error("OIDC provider was not found");if(!t)this.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE provider_id = ? AND consumed_at IS NULL",[r,e]);return this.getOidcProvider(e)}getOidcProviderCredentials(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(e);if(!t||typeof t.client_secret_ciphertext!=="string")throw Error("OIDC provider credentials are unavailable");return{provider:Vc(t),clientSecret:this.decrypt(t.client_secret_ciphertext)}}beginOidcTransaction(e,t,r){if(!this.getOidcProvider(e)?.enabled)throw Error("OIDC provider is unavailable");let m=this.idFn(),f=ui(32).toString("base64url"),y=ui(32).toString("base64url"),I=ui(64).toString("base64url"),R=this.now(),b=new Date(this.nowFn().getTime()+rl).toISOString();return this.run(`INSERT INTO auth_oidc_transactions (id, provider_id, state_hash, nonce_ciphertext, verifier_ciphertext,
-      redirect_uri, return_path, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[m,e,Vn(f),this.encrypt(y),this.encrypt(I),t,r,b,R]),{transaction:this.getOidcTransaction(m),state:f,nonce:y,verifier:I}}getOidcTransaction(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE id = ?").get(e);return t?Eh(t,this.now()):void 0}consumeOidcTransaction(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE provider_id = ? AND state_hash = ?").get(e,Vn(t));if(!r)throw Error("OIDC transaction is invalid");let a=Eh(r,this.now());if(a.state!=="pending")throw Error(`OIDC transaction is ${a.state}`);if(this.controlPlane.database.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),a.id,this.now()]).changes!==1)throw Error("OIDC transaction is no longer available");return{transaction:this.getOidcTransaction(a.id),nonce:this.decrypt(String(r.nonce_ciphertext)),verifier:this.decrypt(String(r.verifier_ciphertext))}})}getOidcSubject(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_subjects WHERE provider_id = ? AND subject = ?").get(e,t);return r?yI(r):void 0}linkOidcSubject(e,t,r,a){let m=this.getOidcProvider(e),f=this.getIdentity(t);if(!m||!f)throw Error("OIDC provider or identity was not found");let y=Ep(a);if(!r.trim()||r.length>512)throw Error("OIDC subject is invalid");let I=this.getOidcSubject(e,r);if(I&&I.identityId!==t)throw Error("OIDC subject is already linked to another identity");let R=this.now();if(I)return this.run("UPDATE auth_oidc_subjects SET email = ?, last_login_at = ? WHERE id = ?",[y,R,I.id]),this.getOidcSubject(e,r);let b=this.idFn();return this.run("INSERT INTO auth_oidc_subjects (id, provider_id, identity_id, subject, email, linked_at, last_login_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[b,e,t,r,y,R,R]),this.getOidcSubject(e,r)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM auth_action_tokens WHERE expires_at < ? OR consumed_at IS NOT NULL",[e]).changes,r=this.controlPlane.database.run("DELETE FROM auth_sessions WHERE revoked_at IS NOT NULL OR idle_expires_at < ? OR absolute_expires_at < ?",[e,e]).changes;return this.controlPlane.database.run("DELETE FROM auth_mfa_challenges WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),this.controlPlane.database.run("DELETE FROM auth_oidc_transactions WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),{actionTokens:t,sessions:r}}}async function jr(e,t){let r=e.notifications?.email?.from;if(!r)return!1;try{let{EmailClient:a}=await import("./chunk-hjgjbkhk.js");return await new a({region:e.project.region,defaultFrom:r}).send(t),!0}catch{return!1}}import{randomBytes as vI}from"node:crypto";import{chmodSync as bI,existsSync as SI,mkdirSync as wI,readFileSync as kI,writeFileSync as II}from"node:fs";import{dirname as EI}from"node:path";function Fm(){return O("auth-encryption-key")}function Ke(e){let t=process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();if(t)return t;let r=d(e,"auth-encryption-key");try{if(SI(r)){let m=kI(r,"utf8").trim();if(m)return m}}catch{}let a=vI(32).toString("base64url");try{wI(EI(r),{recursive:!0,mode:448}),II(r,`${a}
+      redirect_uri, return_path, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[m,e,Vn(f),this.encrypt(y),this.encrypt(I),t,r,b,R]),{transaction:this.getOidcTransaction(m),state:f,nonce:y,verifier:I}}getOidcTransaction(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE id = ?").get(e);return t?Eh(t,this.now()):void 0}consumeOidcTransaction(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE provider_id = ? AND state_hash = ?").get(e,Vn(t));if(!r)throw Error("OIDC transaction is invalid");let a=Eh(r,this.now());if(a.state!=="pending")throw Error(`OIDC transaction is ${a.state}`);if(this.controlPlane.database.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),a.id,this.now()]).changes!==1)throw Error("OIDC transaction is no longer available");return{transaction:this.getOidcTransaction(a.id),nonce:this.decrypt(String(r.nonce_ciphertext)),verifier:this.decrypt(String(r.verifier_ciphertext))}})}getOidcSubject(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_subjects WHERE provider_id = ? AND subject = ?").get(e,t);return r?yI(r):void 0}linkOidcSubject(e,t,r,a){let m=this.getOidcProvider(e),f=this.getIdentity(t);if(!m||!f)throw Error("OIDC provider or identity was not found");let y=Ep(a);if(!r.trim()||r.length>512)throw Error("OIDC subject is invalid");let I=this.getOidcSubject(e,r);if(I&&I.identityId!==t)throw Error("OIDC subject is already linked to another identity");let R=this.now();if(I)return this.run("UPDATE auth_oidc_subjects SET email = ?, last_login_at = ? WHERE id = ?",[y,R,I.id]),this.getOidcSubject(e,r);let b=this.idFn();return this.run("INSERT INTO auth_oidc_subjects (id, provider_id, identity_id, subject, email, linked_at, last_login_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[b,e,t,r,y,R,R]),this.getOidcSubject(e,r)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM auth_action_tokens WHERE expires_at < ? OR consumed_at IS NOT NULL",[e]).changes,r=this.controlPlane.database.run("DELETE FROM auth_sessions WHERE revoked_at IS NOT NULL OR idle_expires_at < ? OR absolute_expires_at < ?",[e,e]).changes;return this.controlPlane.database.run("DELETE FROM auth_mfa_challenges WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),this.controlPlane.database.run("DELETE FROM auth_oidc_transactions WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),{actionTokens:t,sessions:r}}}async function jr(e,t){let r=e.notifications?.email?.from;if(!r)return!1;try{let{EmailClient:a}=await import("./chunk-49vvjfrd.js");return await new a({region:e.project.region,defaultFrom:r}).send(t),!0}catch{return!1}}import{randomBytes as vI}from"node:crypto";import{chmodSync as bI,existsSync as SI,mkdirSync as wI,readFileSync as kI,writeFileSync as II}from"node:fs";import{dirname as EI}from"node:path";function Fm(){return O("auth-encryption-key")}function Ke(e){let t=process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();if(t)return t;let r=d(e,"auth-encryption-key");try{if(SI(r)){let m=kI(r,"utf8").trim();if(m)return m}}catch{}let a=vI(32).toString("base64url");try{wI(EI(r),{recursive:!0,mode:448}),II(r,`${a}
 `,{mode:384}),bI(r,384)}catch{}return a}import{constants as RI,createHash as Cp,createPublicKey as AI,createVerify as CI,timingSafeEqual as PI}from"node:crypto";var _h=new Set(["RS256","PS256","ES256"]),Ph=60;function Wc(e,t){let r=new URL(e),a=["127.0.0.1","::1","localhost"].includes(r.hostname);if(r.protocol!=="https:"&&!(r.protocol==="http:"&&a))throw Error(`${t} must use HTTPS`);if(r.username||r.password||r.hash)throw Error(`${t} contains unsupported URL components`);return r}function Pp(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`${t} is invalid`);return e}async function _p(e,t){if(!e.ok)throw Error(`${t} failed with HTTP ${e.status}`);if(!(e.headers.get("content-type")??"").toLowerCase().includes("application/json"))throw Error(`${t} returned an unsupported content type`);if(Number(e.headers.get("content-length")??0)>1048576)throw Error(`${t} response is too large`);let m=await e.text();if(m.length>1048576)throw Error(`${t} response is too large`);try{return Pp(JSON.parse(m),t)}catch(f){if(f instanceof Error&&f.message===`${t} is invalid`)throw f;throw Error(`${t} returned invalid JSON`)}}function _I(e,t){let r=Cp("sha256").update(e).digest(),a=Cp("sha256").update(t).digest();return PI(r,a)}function nl(e){if(!e)return"/";let t=e.trim();if(!t.startsWith("/")||t.startsWith("//")||t.includes("\\")||/[\r\n]/.test(t))return"/";try{let r=new URL(t,"https://local.invalid");return r.origin==="https://local.invalid"?`${r.pathname}${r.search}${r.hash}`:"/"}catch{return"/"}}async function No(e,t=fetch){let r=Wc(e.issuer,"OIDC issuer"),a=new URL(`${r.pathname.replace(/\/$/,"")}/.well-known/openid-configuration`,r.origin),m=await _p(await t(a,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC discovery");if(m.issuer!==e.issuer)throw Error("OIDC discovery issuer does not match the configured issuer");for(let y of["authorization_endpoint","token_endpoint","jwks_uri"]){if(typeof m[y]!=="string")throw Error(`OIDC discovery is missing ${y}`);Wc(m[y],`OIDC ${y}`)}if(Array.isArray(m.response_types_supported)&&!m.response_types_supported.includes("code"))throw Error("OIDC provider does not support authorization code flow");if(Array.isArray(m.code_challenge_methods_supported)&&!m.code_challenge_methods_supported.includes("S256"))throw Error("OIDC provider does not support PKCE S256");let f=Array.isArray(m.id_token_signing_alg_values_supported)?m.id_token_signing_alg_values_supported.filter((y)=>typeof y==="string"):[];if(f.length>0&&!f.some((y)=>_h.has(y)))throw Error("OIDC provider does not offer a supported ID-token signing algorithm");return m}async function ko(e,t,r,a,m=fetch){let f=e.getOidcProviderBySlug(t);if(!f?.enabled)throw Error("OIDC provider is unavailable");let y=Wc(r,"Application origin").origin,I=await No(f,m),R=`${y}/auth/oidc/${encodeURIComponent(f.slug)}/callback`,b=e.beginOidcTransaction(f.id,R,nl(a)),T=new URL(I.authorization_endpoint);return T.searchParams.set("response_type","code"),T.searchParams.set("client_id",f.clientId),T.searchParams.set("redirect_uri",R),T.searchParams.set("scope",f.scopes.join(" ")),T.searchParams.set("state",b.state),T.searchParams.set("nonce",b.nonce),T.searchParams.set("code_challenge",Cp("sha256").update(b.verifier).digest("base64url")),T.searchParams.set("code_challenge_method","S256"),{authorizationUrl:T.href,expiresAt:b.transaction.expiresAt}}function TI(e){if(e.length>32768)throw Error("OIDC ID token is too large");let t=e.split(".");if(t.length!==3||t.some((r)=>!r))throw Error("OIDC ID token is malformed");try{return{header:Pp(JSON.parse(Buffer.from(t[0],"base64url").toString("utf8")),"OIDC ID-token header"),claims:Pp(JSON.parse(Buffer.from(t[1],"base64url").toString("utf8")),"OIDC ID-token claims"),signingInput:`${t[0]}.${t[1]}`,signature:Buffer.from(t[2],"base64url")}}catch(r){if(r instanceof Error&&r.message.startsWith("OIDC"))throw r;throw Error("OIDC ID token is malformed")}}async function xI(e,t,r){let a=TI(e),m=typeof a.header.alg==="string"?a.header.alg:"",f=typeof a.header.kid==="string"?a.header.kid:"";if(!_h.has(m)||!f)throw Error("OIDC ID token uses an unsupported signing key");if(t.id_token_signing_alg_values_supported&&!t.id_token_signing_alg_values_supported.includes(m))throw Error("OIDC ID-token algorithm was not advertised by the provider");let y=await _p(await r(t.jwks_uri,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC signing-key request");if(!Array.isArray(y.keys))throw Error("OIDC signing-key response is invalid");let I=y.keys.find((N)=>{if(!N||typeof N!=="object"||Array.isArray(N))return!1;let F=N;return F.kid===f&&(!F.alg||F.alg===m)&&(!F.use||F.use==="sig")});if(!I)throw Error("OIDC ID-token signing key was not found");let R=AI({key:I,format:"jwk"}),b=CI("SHA256").update(a.signingInput).end();if(!(m==="PS256"?b.verify({key:R,padding:RI.RSA_PKCS1_PSS_PADDING,saltLength:32},a.signature):m==="ES256"?b.verify({key:R,dsaEncoding:"ieee-p1363"},a.signature):b.verify(R,a.signature)))throw Error("OIDC ID-token signature is invalid");return a.claims}function DI(e,t,r,a){if(e.iss!==t.issuer)throw Error("OIDC ID-token issuer is invalid");let m=typeof e.aud==="string"?[e.aud]:Array.isArray(e.aud)?e.aud.filter((R)=>typeof R==="string"):[];if(!m.includes(t.clientId))throw Error("OIDC ID-token audience is invalid");if((m.length>1||e.azp!==void 0)&&e.azp!==t.clientId)throw Error("OIDC ID-token authorized party is invalid");let f=Math.floor(a.getTime()/1000);if(typeof e.exp!=="number"||e.exp<f-Ph)throw Error("OIDC ID token is expired");if(typeof e.iat!=="number"||e.iat>f+Ph)throw Error("OIDC ID-token issued-at time is invalid");if(typeof e.nonce!=="string"||!_I(e.nonce,r))throw Error("OIDC ID-token nonce is invalid");if(typeof e.sub!=="string"||!e.sub||e.sub.length>512)throw Error("OIDC ID-token subject is invalid");if(e.email_verified!==!0||typeof e.email!=="string")throw Error("OIDC provider did not return a verified email address");let y=e.email.trim().toLowerCase();if(y.length>254||!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(y))throw Error("OIDC provider returned an invalid email address");let I=y.split("@")[1];if(!I||!t.allowedDomains.includes(I))throw Error("OIDC email domain is not allowed for this organization");return{provider:t,subject:e.sub,email:y,name:typeof e.name==="string"?e.name.slice(0,120):void 0,claims:e}}async function Bo(e,t,r=fetch){let a=e.getOidcProviderBySlug(t.providerSlug);if(!a?.enabled)throw Error("OIDC provider is unavailable");if(!t.state||t.state.length>512||!t.code||t.code.length>4096)throw Error("OIDC callback is incomplete");let m=Wc(t.origin,"Application origin").origin,f=e.consumeOidcTransaction(a.id,t.state),y=`${m}/auth/oidc/${encodeURIComponent(a.slug)}/callback`;if(f.transaction.redirectUri!==y)throw Error("OIDC callback redirect URI does not match the original request");let{clientSecret:I}=e.getOidcProviderCredentials(a.id),R=await No(a,r),b=new URLSearchParams({grant_type:"authorization_code",code:t.code,redirect_uri:f.transaction.redirectUri,code_verifier:f.verifier}),T={accept:"application/json","content-type":"application/x-www-form-urlencoded"},N=R.token_endpoint_auth_methods_supported??["client_secret_basic"];if(N.includes("client_secret_basic")){let H=(Z)=>new URLSearchParams({value:Z}).toString().slice(6),K=`${H(a.clientId)}:${H(I)}`;T.authorization=`Basic ${Buffer.from(K).toString("base64")}`}else if(N.includes("client_secret_post"))b.set("client_id",a.clientId),b.set("client_secret",I);else throw Error("OIDC provider does not support a configured client authentication method");let F=await _p(await r(R.token_endpoint,{method:"POST",headers:T,body:b,redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC token exchange");if(typeof F.id_token!=="string")throw Error("OIDC token response did not include an ID token");let z=await xI(F.id_token,R,r);return{identity:DI(z,a,f.nonce,t.now??new Date),returnPath:f.transaction.returnPath}}import{createHash as OI,randomBytes as $I}from"node:crypto";var xh=new Set(de),il=7776000000,sl=31536000000,ol=86400000;function mi(e){return typeof e==="string"?e:void 0}function Th(e){return OI("sha256").update(e).digest("hex")}function NI(e){try{let t=JSON.parse(String(e));return Array.isArray(t)?t.filter((r)=>typeof r==="string"&&xh.has(r)):[]}catch{return[]}}function jI(e){let t=String(e.scope_type);return t==="organization"?{type:t}:{type:t,id:String(e.scope_id)}}function Tp(e){let t=mi(e.disabled_at);return{id:String(e.id),organizationId:String(e.organization_id),actorId:String(e.actor_id),slug:String(e.slug),name:String(e.name),description:mi(e.description),createdByActorId:mi(e.created_by_actor_id),disabledAt:t,createdAt:String(e.created_at),updatedAt:String(e.updated_at),state:t?"disabled":"active"}}function xp(e,t){let r=mi(e.revoked_at),a=String(e.expires_at);return{id:String(e.id),serviceAccountId:String(e.service_account_id),name:String(e.name),prefix:String(e.token_prefix),capabilities:NI(e.capabilities),scope:jI(e),expiresAt:a,lastUsedAt:mi(e.last_used_at),lastNetworkHint:mi(e.last_network_hint),revokedAt:r,rotatedFromTokenId:mi(e.rotated_from_token_id),createdByActorId:mi(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at),state:r?"revoked":a<=t?"expired":"active"}}function MI(e){let t={};try{t=JSON.parse(String(e.response_body))}catch{}return{id:String(e.id),tokenId:String(e.token_id),key:String(e.idempotency_key),requestHash:String(e.request_hash),operationId:mi(e.operation_id),responseStatus:Number(e.response_status),responseBody:t,expiresAt:String(e.expires_at),createdAt:String(e.created_at)}}class xi{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}createServiceAccount(e){if(!this.controlPlane.getOrganization(e.organizationId))throw Error("Service-account organization was not found");let t=e.slug.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(t))throw Error("Service-account slug must be 2-48 lowercase letters, numbers or dashes");let r=e.name.trim().slice(0,100);if(!r)throw Error("Service-account name is required");let a=this.controlPlane.createActor({kind:"service_account",externalId:`service-account:${e.organizationId}:${t}`,displayName:r,metadata:{source:"api",serviceAccountSlug:t}}),m=this.idFn(),f=this.now();this.run(`INSERT INTO service_accounts (id, organization_id, actor_id, slug, name, description, created_by_actor_id, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[m,e.organizationId,a.id,t,r,e.description?.trim().slice(0,500)||null,e.createdByActorId??null,f,f]);let y=this.controlPlane.createMembership({organizationId:e.organizationId,actorId:a.id,roleTemplate:e.roleTemplate,scope:e.scope,source:"manual",performedByActorId:e.createdByActorId}),I=e.scope??{type:"organization"};return this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.createdByActorId,type:"api.service_account.created",payload:{serviceAccountId:m,roleTemplate:e.roleTemplate,scope:{type:I.type,id:I.id??null}}}),{serviceAccount:this.getServiceAccount(m),membership:y}}getServiceAccount(e){let t=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE id = ?").get(e);return t?Tp(t):void 0}getServiceAccountBySlug(e,t){let r=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? AND slug = ? COLLATE NOCASE").get(e,t.trim());return r?Tp(r):void 0}listServiceAccounts(e,t={}){return this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(e).map(Tp).filter((r)=>t.includeDisabled||r.state==="active")}disableServiceAccount(e,t){let r=this.getServiceAccount(e);if(!r)throw Error("Service account was not found");let a=this.now();return this.controlPlane.transaction(()=>{this.run("UPDATE service_accounts SET disabled_at = ?, updated_at = ? WHERE id = ?",[a,a,e]),this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE service_account_id = ? AND revoked_at IS NULL",[a,a,e]);let m=this.controlPlane.getMembershipForActor(r.organizationId,r.actorId);if(m?.status==="active")this.controlPlane.revokeMembership(m.id)}),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:t,type:"api.service_account.disabled",payload:{serviceAccountId:e}}),this.getServiceAccount(e)}createToken(e){let t=this.getServiceAccount(e.serviceAccountId);if(!t||t.state!=="active")throw Error("Service account is unavailable");let r=this.controlPlane.getMembershipForActor(t.organizationId,t.actorId);if(!r||r.status!=="active")throw Error("Service-account membership is unavailable");let a=[...new Set(e.capabilities)];if(a.length===0||a.some((F)=>!xh.has(F)))throw Error("API token requires valid explicit capabilities");let m=e.scope??r.scope,f=this.controlPlane.resolveAuthorizationTarget(t.organizationId,m);if(!f)throw Error("API token scope was not found in this organization");for(let F of a)if(!w({membership:r,grants:this.controlPlane.listGrants(r.id),capability:F,target:f}).allowed)throw Error(`Service-account membership does not grant ${F} at the token scope`);let y=e.expiresAt?new Date(e.expiresAt):new Date(this.nowFn().getTime()+il);if(!Number.isFinite(y.getTime())||y.getTime()<=this.nowFn().getTime()+60000||y.getTime()>this.nowFn().getTime()+sl)throw Error("API token expiry must be between one minute and one year from now");let I=this.idFn(),R=$I(32).toString("base64url"),b=`tsc_v1.${I}.${R}`,T=`tsc_v1.${I.slice(0,8)}`,N=this.now();return this.run(`INSERT INTO api_tokens (id, service_account_id, name, token_hash, token_prefix, capabilities, scope_type, scope_id,
       expires_at, rotated_from_token_id, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[I,t.id,e.name.trim().slice(0,100)||"API token",Th(b),T,JSON.stringify(a.sort()),m.type,m.type==="organization"?null:m.id??null,y.toISOString(),e.rotatedFromTokenId??null,e.createdByActorId??null,N,N]),this.controlPlane.appendEvent({organizationId:t.organizationId,actorId:e.createdByActorId,type:"api.token.created",payload:{serviceAccountId:t.id,tokenId:I,prefix:T,capabilities:a,scope:{type:m.type,id:m.id??null},expiresAt:y.toISOString(),rotatedFromTokenId:e.rotatedFromTokenId??null}}),{token:this.getToken(I),secret:b}}getToken(e){let t=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ?").get(e);return t?xp(t,this.now()):void 0}listTokens(e,t={}){return this.controlPlane.database.query("SELECT * FROM api_tokens WHERE service_account_id = ? ORDER BY created_at DESC").all(e).map((r)=>xp(r,this.now())).filter((r)=>t.includeInactive||r.state==="active")}verifyToken(e,t){let r=/^tsc_v1\.([^.]+)\.[A-Za-z0-9_-]{40,}$/.exec(e);if(!r)return;let a=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ? AND token_hash = ?").get(r[1],Th(e));if(!a)return;let m=xp(a,this.now()),f=this.getServiceAccount(m.serviceAccountId);if(!f||f.state!=="active"||m.state!=="active")return;let y=this.controlPlane.getActor(f.actorId),I=this.controlPlane.getMembershipForActor(f.organizationId,f.actorId);if(!y||y.disabledAt||!I||I.status!=="active")return;let R=this.now(),b=!m.lastUsedAt||this.nowFn().getTime()-new Date(m.lastUsedAt).getTime()>=3600000;if(this.run("UPDATE api_tokens SET last_used_at = ?, last_network_hint = ?, updated_at = ? WHERE id = ?",[R,t?.slice(0,128)??null,R,m.id]),b)this.controlPlane.appendEvent({organizationId:f.organizationId,actorId:y.id,type:"api.token.used",payload:{serviceAccountId:f.id,tokenId:m.id,prefix:m.prefix}});return{serviceAccount:f,token:this.getToken(m.id),actor:y,membership:I}}rotateToken(e,t){let r=this.getToken(e);if(!r||r.state!=="active")throw Error("Active API token was not found");let a=this.createToken({serviceAccountId:r.serviceAccountId,name:`${r.name} (rotated)`,capabilities:r.capabilities,scope:r.scope,expiresAt:r.expiresAt,createdByActorId:t,rotatedFromTokenId:r.id}),m=this.getServiceAccount(r.serviceAccountId);return this.controlPlane.appendEvent({organizationId:m?.organizationId,actorId:t,type:"api.token.rotated",payload:{serviceAccountId:r.serviceAccountId,previousTokenId:r.id,tokenId:a.token.id}}),a}revokeToken(e,t){let r=this.getToken(e);if(!r)throw Error("API token was not found");if(r.state==="active"){let a=this.now();this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE id = ?",[a,a,e]);let m=this.getServiceAccount(r.serviceAccountId);this.controlPlane.appendEvent({organizationId:m?.organizationId,actorId:t,type:"api.token.revoked",payload:{serviceAccountId:r.serviceAccountId,tokenId:e}})}return this.getToken(e)}getIdempotency(e,t){let r=this.controlPlane.database.query("SELECT * FROM api_idempotency_records WHERE token_id = ? AND idempotency_key = ? AND expires_at > ?").get(e,t,this.now());return r?MI(r):void 0}saveIdempotency(e){if(!/^[A-Za-z0-9._:-]{8,128}$/.test(e.key))throw Error("Idempotency-Key must contain 8-128 safe characters");let t=this.getIdempotency(e.tokenId,e.key);if(t){if(t.requestHash!==e.requestHash)throw Error("Idempotency-Key was already used for a different request");return t}let r=this.idFn(),a=this.now(),m=new Date(this.nowFn().getTime()+ol).toISOString();return this.run(`INSERT INTO api_idempotency_records (id, token_id, idempotency_key, request_hash, operation_id, response_status, response_body, expires_at, created_at)
@@ -673,7 +673,7 @@ data: ${JSON.stringify({cursor:f,at:new Date().toISOString()})}
 ${I}
 ${R}`);return null}return a}catch(m){if(a)Ps(a,{recursive:!0,force:!0});if(process.env.TSCLOUD_DASHBOARD_VERBOSE)console.warn(`ts-cloud dashboard: live UI build errored; serving the pre-built UI. ${m.message}`);return null}}function Xi(e){let t=e.infrastructure?.compute?.managedServices?JSON.parse(JSON.stringify(e.infrastructure.compute.managedServices)):void 0;if(t?.vitess?.password)t.vitess.password="";return{project:{name:e.project?.name,slug:e.project?.slug,region:e.project?.region},provider:e.provider,environments:Object.keys(e.environments??{}),compute:e.infrastructure?.compute?{provider:e.infrastructure.compute.provider,runtime:e.infrastructure.compute.runtime,webServer:e.infrastructure.compute.webServer,proxy:e.infrastructure.compute.proxy?{engine:e.infrastructure.compute.proxy.engine,onDemandTls:e.infrastructure.compute.proxy.onDemandTls,cdn:!!e.infrastructure.compute.proxy.cdn}:void 0,managedServices:t,sshKeys:Co(Ga(e)).map((r)=>({name:r.name,type:r.type,fingerprint:r.fingerprint,added:r.added}))}:void 0,sites:Object.fromEntries(Object.entries(e.sites??{}).map(([r,a])=>[r,{domain:a.domain,path:a.path,type:a.type,deploy:a.deploy,root:a.root,port:a.port,ssl:a.ssl}]))}}function dn(e){return[{id:"status",label:"Refresh Cloud Status",description:"Runs the local ts-cloud status checks against configured providers.",command:["status","--env",e],mutates:!1},{id:"doctor",label:"Run Doctor",description:"Checks local tooling, credentials, and provider access.",command:["doctor"],mutates:!1},{id:"security-scan",label:"Security Scan",description:"Runs the pre-deploy scanner from this checkout.",command:["deploy:security-scan","--source",".","--fail-on","critical"],mutates:!1},{id:"deploy",label:"Deploy Environment",description:"Deploys the selected environment from the local checkout.",command:["deploy","--env",e,"--yes"],mutates:!0,confirm:"deploy"}]}function Yi(e,t){return dn(t).find((r)=>r.id===e)}function rw(e){if(e.length<=ZS)return e;return`${e.slice(0,ZS)}
 
-[output truncated]`}async function nw(e,t,r){let a=e.getReader(),m=new TextDecoder,f="";while(!0){let{done:I,value:R}=await a.read();if(I)break;let b=m.decode(R,{stream:!0});if(f+=b,b)r?.(t,b)}let y=m.decode();if(y)f+=y,r?.(t,y);return f}async function Fg(e,t){let r=Bun.spawn([process.execPath,t.cliEntry,...e.command],{cwd:t.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...t.env}}),a=()=>{try{r.kill()}catch{}};if(t.signal?.aborted)a();else t.signal?.addEventListener("abort",a,{once:!0});try{let[m,f,y]=await Promise.all([nw(r.stdout,"stdout",t.onOutput),nw(r.stderr,"stderr",t.onOutput),r.exited]);return{action:e.id,command:["cloud",...e.command].join(" "),exitCode:y,ok:y===0,stdout:rw(m),stderr:rw(f)}}finally{t.signal?.removeEventListener("abort",a)}}function cT(){return Object.entries(process.env).filter(([e,t])=>!!t&&t.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(e)).map(([,e])=>e)}var dT=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function lT(e){let t=Ac(e);if(t&&t!==".html")return!1;let r=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!dT.has(r)}var uT={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/infrastructure/topology":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function iw(e,t){if(t.role==="admin")return!0;let r=Ac(e);if(r&&r!==".html")return!0;if(t.organizationSource==="legacy")return!lT(e);let a=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(a==="/access-denied")return!0;let m=uT[a];return!!m&&!!t.capabilities?.includes(m)}function pT(e,t){let r=decodeURIComponent(t).replace(/^\/+/,""),m=N_(r===""?"index.html":r);if(m.startsWith("..")||m.includes("/../"))return null;let f=Qt(e,m);if(Ti(f)&&!cw(f).isDirectory())return f;if(!Ac(f)&&Ti(`${f}.html`))return`${f}.html`;if(!Ac(f)&&Ti(Qt(f,"index.html")))return Qt(f,"index.html");return null}async function ow(e,t){let r=pT(e,t);if(!r){let f=Qt(e,"404.html");if(Ti(f))return new Response(await oi(f),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return Ku("Not found",404)}if(cw(r).isDirectory())return Ku("Not found",404);let a=await oi(r),m=V_[Ac(r)]??"application/octet-stream";return new Response(a,{headers:{"content-type":m}})}var Wu=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"],sw=new WeakMap;async function aw(e){let t=sw.get(e);if(t)return t;let r=await import("./spend/index.js"),a=new r.SpendStore(e),m={store:a,service:new r.SpendService(a),gate:new r.SpendGate(e)};return sw.set(e,m),m}async function ka(e={}){q_();let t=e.cwd??process.cwd(),r=e.host??F_,a=e.port??z_,m=e.cliEntry??process.argv[1];if(e.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await Z_(t);let f=e.config??await Xd(),y=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,I=p(f);if(y&&I&&!I.password)I.password=y;let R=f.infrastructure?.compute?.managedServices?.vitess;if(y&&R&&typeof R==="object"&&!R.password)R.password=y;let b=Yl(t,f);if(b.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${b.reconciliation.failed} orphaned operation(s) as failed after restart.`);let T=Object.keys(f.environments??{}),N=Q_(f,e.environment),F=X_(t),z=await Cs(f,N),H=new Map([[N,z]]),K=new Map([[N,Date.now()]]),Z=new Map([[N,Date.now()]]),oe=new Map,ye=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),ee=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),ce=x(f)!=="serverless",Re=(L)=>{let Ue=H.get(L);if(Ue&&!XS(K.get(L),Date.now(),ye))return Promise.resolve(Ue);let Ve=oe.get(L);if(Ve)return Ve;let Fe=!ce||XS(Z.get(L),Date.now(),ee),nt=Cs(f,L,{includeSiteHealth:Fe}).then((Tt)=>{let W=H.get(L),Qr=Fe?Tt:oT(W,Tt);if(H.set(L,Qr),K.set(L,Date.now()),Fe)Z.set(L,Date.now());if(W?._serverReachable!==Qr._serverReachable||W?._metricsStatus!==Qr._metricsStatus||(W?.sitesDetail?.length??0)!==(Qr.sitesDetail?.length??0))ot();return Qr}).finally(()=>oe.delete(L));return oe.set(L,nt),nt},Ae=kt(t),ue=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(e.box&&ue!=="0"&&(ue==="1"||!f.cloud?.attachTo)){let L=!1,Ue=Date.now()+300000,Ve=async()=>{if(L)return;L=!0;try{let nt=Date.now(),Tt=nt>=Ue;if(Tt)Ue=nt+300000;let W=b.environments.get(N);await Bg({controlPlane:b.store,projectId:b.project.id,environmentId:W?.id,config:f,environment:N,force:!0,lightweight:!0,includeSiteHealth:Tt})}catch(nt){if(e.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${nt instanceof Error?nt.message:String(nt)}`)}finally{L=!1}};Ve(),setInterval(()=>void Ve(),60000).unref?.()}let ae=new Map,Le=new Map,rt=new Set,vt=0;function or(L,Ue){if(L.role==="admin"&&!b.store.getActorByExternalId("user",`dashboard:${L.username.toLowerCase()}`))return L;let Ve=b.store.getActorByExternalId("user",`dashboard:${L.username.toLowerCase()}`),Fe=Ve?b.store.getMembershipForActor(b.organization.id,Ve.id):void 0;if(!Fe||Fe.status!=="active")return{...L,role:"member",sites:{},capabilities:[]};let nt=b.store.listGrants(Fe.id),Tt=b.store.resolveAuthorizationTarget(b.organization.id,Fe.scope)??b.store.resolveAuthorizationTarget(b.organization.id,{type:"project",id:b.project.id}),W=Ot({membership:Fe,grants:nt,target:Tt});if(Fe.roleTemplate==="owner"||Fe.roleTemplate==="admin")return{...L,role:"admin",sites:{},organizationRole:Fe.roleTemplate,organizationSource:Fe.source,capabilities:W};let Qr=b.environments.get(Ue),br={};for(let ct of b.store.listResources(b.project.id,Qr?.id).filter((gt)=>gt.kind==="application")){let gt=b.store.resolveAuthorizationTarget(b.organization.id,{type:"resource",id:ct.id});if(!gt||!w({membership:Fe,grants:nt,capability:"project:read",target:gt}).allowed)continue;br[ct.slug]=w({membership:Fe,grants:nt,capability:"config:write",target:gt}).allowed?"owner":"collaborator"}return{...L,role:"member",sites:br,organizationRole:Fe.roleTemplate,organizationSource:Fe.source,capabilities:W}}function ot(){vt+=1,ae.clear();for(let L of rt)Ps(L,{recursive:!0,force:!0});rt.clear()}let $t=(L,Ue)=>`${Ue}:${L.role==="admin"?"admin":`member:${Object.entries(L.sites).sort(([Ve],[Fe])=>Ve.localeCompare(Fe)).map(([Ve,Fe])=>`${Ve}=${Fe}`).join(",")}`}:${[...L.capabilities??[]].sort().join(",")}`;async function ar(L,Ue){let Ve=or(L,Ue),Fe=$t(Ve,Ue),nt=ae.get(Fe);if(nt)return nt;let Tt=Le.get(Fe);if(Tt)return Tt;let W=vt,Qr=(async()=>{let br=H.get(Ue)??await Cs(f,Ue);H.set(Ue,br);let ct={..._g(br,{user:Ve,slug:f.project.slug}),viewer:{role:Ve.role,organizationRole:Ve.organizationRole,organizationSource:Ve.organizationSource,capabilities:Ve.capabilities??[]}},gt=await aT(t,ct);if(gt&&W!==vt)return Ps(gt,{recursive:!0,force:!0}),Ae?.uiRoot;if(gt)rt.add(gt);let Mr=gt??Ae?.uiRoot;if(Mr)ae.set(Fe,Mr);return Mr})();Le.set(Fe,Qr);try{return await Qr}finally{Le.delete(Fe)}}let lt=await ar({username:"",passwordHash:"",role:"admin",sites:{}},N);if(!lt)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let Q=new WeakMap,ve=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",Ie=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(Ie&&e.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let Oe=!Ie,bt=Zb(t),jt=Oe?rS(t,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,Me=new Oi(b.store,{encryptionKey:Ke(t)}),Et=new xi(b.store),pt=new Wr(b.store),tt=new xo(b.store,{encryptionKey:Ke(t)}),Gr=new up(b.store),_s=new fp(b.store,{cwd:t}),Zn=new mp(b.store,{encryptionKey:Ke(t)}),tr=new c(b.store,{workerId:`dashboard:${process.pid}`}),cr=new Wo(b.store),si=new ia(b.store,Ke(t)),Di=new wa(b.store),Cc=new Gi(cr,tr,si),Ni=f.project?.region??"us-east-1",Ug=Ke(t),En=new Na(Di,{encryptionKey:Ug,backends:[new cn(b.store,Ug),new Ra(new V(Ni),Ni),new Da(new be(Ni),Ni),new Pa]});await mu(En,b,f);let Ju=new j(Ni),lw={aws_rds:new Jo(new ta(Ju)),aws_aurora:new Xo(new ra(Ju)),aws_elasticache:new Yo(new na(new et(Ni))),server:new Zo(new Jt),container:new ea(new Jt)},qg=(L)=>lw[L.provider],Sr=new ya(b.store),To=new Ji(Sr,tr),Vg=new Ia(si),uw={managed_database:new Sa(cr,Ju),logical_database:new Ea(cr,si),volume:new ba,files:new Ca(t),control_plane:new va(b.store,t),infrastructure:new Ta(new er(Ni))},pw=(L)=>uw[L.resourceKind],mw=(L)=>L.provider==="aws_backup"?void 0:Vg,Gu=new xt(b.store),Qu=[new Pr,new Qs(d(t,"volumes"))],ai=new Us(Gu,Qu,tr),Qa=new sa(b.store),Xn=new oa(Qa,[new en("aws"),new en("hetzner"),new en("ssh")],tr),Bi=new aa(b.store),Wg=new ca(Bi,Qa),es=new da(b.store),Hg=new la(es,tr),ci=new pa(b.store),Yu=new ga(ci,tr),Kg=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((L)=>new ma(L,b.store,b.project.id,b.organization.id)),Or=new jo(b.store),Jg=new Ko(Or,{queue:tr}),vr=new Dr(b.store),Zi=new Nr(b.store),On=new mt(b.store),at=new fi(b.store,{encryptionKey:Ke(t)}),gw=()=>aw(b.store);for(let L of b.environments.values())zo(Or,f,{organization:b.organization,project:b.project,environment:L,resources:b.store.listResources(b.project.id,L.id)});let $n=new Ai(at,{emailImpl:async(L)=>{let{email:Ue}=await import("./chunk-hjgjbkhk.js");return Ue.send(L)}}),Gg=async(L)=>{let Ue=eo(at,b.project.id,L),Ve=[];for(let Fe of Ue.filter((nt)=>nt.notify&&nt.alert))Ve.push(...await $n.deliverAll($n.enqueue(b.organization.id,Fe.alert,Fe.transition)));return Ve.push(...await $n.deliverAll($n.enqueueRemindersAndEscalations(b.organization.id,at.listAlerts(b.project.id,{environmentId:L,states:["firing"]})))),Ve.push(...await $n.retryDue()),{evaluations:Ue,deliveries:Ve}},Zu=!1,fw=async()=>{if(Zu)return;Zu=!0;try{for(let L of b.environments.values())for(let Ue of at.listHealthChecks(b.project.id,L.id).filter((Ve)=>Ve.enabled)){let Ve=at.listHealthResults(Ue.id,1)[0];if(Ve&&Date.now()-new Date(Ve.checkedAt).getTime()<Ue.intervalSeconds*1000)continue;let Fe=await new He(at).runAndEvaluate(Ue);for(let nt of Fe.evaluations.filter((Tt)=>Tt.notify&&Tt.alert))await $n.deliverAll($n.enqueue(b.organization.id,nt.alert,nt.transition))}}finally{Zu=!1}},Qg=setInterval(()=>{for(let L of b.environments.values())Gg(L.id).catch((Ue)=>console.error("ts-cloud alert evaluation failed:",Ue))},60000);Qg.unref?.();let Yg=setInterval(()=>{fw().catch((L)=>console.error("ts-cloud health check evaluation failed:",L))},30000);Yg.unref?.();let Zg=setInterval(()=>{try{Jg.tick()}catch(L){console.error("ts-cloud scheduled job evaluation failed:",L)}},30000);Zg.unref?.();let Xg=setInterval(()=>{try{To.enqueueDue(),To.enqueueRetention()}catch(L){console.error("ts-cloud backup policy evaluation failed:",L)}},30000);Xg.unref?.(),vr.cleanup();let ef=setInterval(()=>{try{vr.cleanup()}catch(L){console.error("ts-cloud preview cleanup failed:",L)}},3600000);ef.unref?.();let hw=e.queueWorker??!0,yw=cT(),vw=async(L,Ue)=>{let Fe=(L.environmentId?b.store.listEnvironments(L.projectId).find((nt)=>nt.id===L.environmentId):void 0)?.slug??String(N);if(Ue.kind==="dashboard_operation"&&Ue.operationId){let nt=H.get(Fe)??z,Tt=Pg(Ue.operationId,f,nt);if(!Tt||Tt.danger||!["scheduler","backup","worker"].includes(Tt.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let W=await zu(f,Fe,Tt);return{ok:W.ok,stdout:W.stdout,stderr:W.stderr??W.error,retryable:/temporar|unavailable|timeout|network/i.test(W.stderr??W.error??""),output:{command:W.command??null,operation:W.operation}}}if(Ue.kind==="serverless_scheduler"){let nt=await Mg(f,Fe,"run");return{ok:nt.ok,stdout:nt.stdout,stderr:nt.error,retryable:/temporar|unavailable|timeout|network/i.test(nt.error??""),output:{command:nt.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${Ue.kind}.`}},Pc=hw?new Ms(tr,{...Uc({store:b.store,execute:async(L,Ue)=>{let Ve=Ue.operation.input&&typeof Ue.operation.input==="object"&&!Array.isArray(Ue.operation.input)?Ue.operation.input:{},Fe=Ve.source&&typeof Ve.source==="object"?Ve.source:void 0,nt=t,Tt,W,Qr;try{if(Fe?.bindingId&&Fe?.connectionId&&Fe?.commitSha){let ct=tt.getBinding(String(Fe.bindingId)),gt=tt.getConnection(String(Fe.connectionId));if(!ct||!gt||ct.connectionId!==gt.id)throw Error("Queued source binding is no longer available");let _r=(ct.repositoryId?tt.getRepository(ct.repositoryId):tt.listRepositories(gt.id).find((Os)=>Os.fullName.toLowerCase()===ct.repositoryFullName.toLowerCase()))?.cloneUrl;if(!_r&&gt.provider==="generic_ssh")_r=`git@${new URL(gt.host).hostname}:${ct.repositoryFullName}.git`;if(!_r)_r=new URL(`/${ct.repositoryFullName}.git`,gt.host.endsWith("/")?gt.host:`${gt.host}/`).href;let Ce=ct.deployKeyId?tt.getDeployKey(ct.deployKeyId):void 0,dr=Ce&&ct.deployKeyId?{...Ce,privateKey:tt.getDeployPrivateKey(ct.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(gt.provider)&&L.target.previewId){let Os=We(gt,tt.getCredential(gt.id)),Se=vr.previews.getInstance(L.target.previewId);Qr=async(Nn,Oc)=>{try{await Os.setCommitStatus(ct.repositoryFullName,String(Fe.commitSha),{state:Nn,url:Se?.url,description:Oc})}catch($s){Ue.log(`Could not publish source status: ${$s instanceof Error?$s.message:String($s)}`,{stream:"stderr"})}},await Qr("pending",`Preview deployment started for ${String(Fe.commitSha).slice(0,12)}`)}Tt=zg(Qt(Hu(),"ts-cloud-queued-source-")),Ue.log(`Checking out immutable source commit ${Fe.commitSha}.`,{stream:"system"}),nt=(await $o({remote:_r,binding:ct,destination:Qt(Tt,"checkout"),ref:String(Fe.branch??ct.defaultBranch),commitSha:String(Fe.commitSha)},{credential:tt.getCredential(gt.id),deployKey:dr})).directory}if(Ue.operation.kind!=="preview.destroy"){let ct=L.target.previewId?vr.previews.getInstance(L.target.previewId):void 0,gt=ct?vr.previews.getDefinition(ct.definitionId):void 0,Mr=Ue.operation.resourceId?b.store.getResource(Ue.operation.resourceId):void 0;if(W=await En.resolve({projectId:b.project.id,environmentId:Ue.operation.environmentId,resourceId:Ue.operation.resourceId,functionId:Mr?.kind==="function"?Mr.id:void 0,previewId:ct?.id,trustedPreview:!!ct&&!ct.fork,allowedPreviewSecrets:gt?.inheritedSecrets}),W.warnings.some((_r)=>_r.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${W.warnings.filter((_r)=>_r.code==="missing_required").map((_r)=>_r.key).join(", ")}`);if(Ue.operation.resourceId)for(let _r of Object.values(W.entries))Di.setDependency({entryId:_r.id,resourceId:Ue.operation.resourceId,injectionTarget:"environment",required:_r.required,requiresRedeploy:!0});Ue.log(`Resolved configuration ${W.configurationHash.slice(0,18)} for ${Object.keys(W.values).length} keys.`,{stream:"system"})}let br=await Fg(L,{cwd:nt,cliEntry:m,signal:Ue.signal,env:W?.values,onOutput:(ct,gt)=>Ue.log(gt,{stream:ct,step:"execute",secrets:[...yw,...Object.entries(W?.entries??{}).filter(([,Mr])=>Mr.kind==="secret").map(([Mr])=>W.values[Mr]).filter(Boolean)]})});if(br.ok&&Ue.operation.resourceId&&W)for(let ct of Object.values(W.entries))Di.setDependency({entryId:ct.id,resourceId:Ue.operation.resourceId,injectionTarget:"environment",required:ct.required,requiresRedeploy:!1,lastDeployedVersion:ct.version});return await Qr?.(br.ok?"success":"failure",br.ok?`Preview is ready at ${String(Fe?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(Fe?.commitSha).slice(0,12)}`),br}catch(br){throw await Qr?.("error",`Preview deployment could not complete at ${String(Fe?.commitSha).slice(0,12)}`),br}finally{if(Tt)Ps(Tt,{recursive:!0,force:!0})}}}),...Bl({store:Or,executor:vw}),...Ol({store:cr,secrets:si,resolveAdapter:qg}),...$l(Qa,Xn.drivers),...Fl(es,[new ua("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...ql({store:ci,cleanup:Kg}),...Qc(Gu,Qu),...du({store:Sr,queue:tr,resolveSource:pw,resolveDestination:mw,validateHealth:async(L,Ue)=>{if(!L.healthCheckId)return{healthy:!0,mode:"adapter"};let Ve=at.getHealthCheck(L.healthCheckId);if(!Ve||Ve.projectId!==L.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let Fe=await new He(at).runAndEvaluate(Ve);return{healthy:Fe.result.status==="healthy",healthCheckId:Ve.id,healthResultId:Fe.result.id,target:Ue}}}),...ll({store:b.store,resolveDriver:e.releaseDriver??((L)=>({name:`${b.store.getResource(L.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:L.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(L,Ue)=>{let Ve=at.listHealthChecks(Ue.projectId,Ue.environmentId).find((nt)=>nt.enabled&&nt.name===L&&(!nt.resourceId||nt.resourceId===Ue.resourceId));if(!Ve)return{healthy:!1,message:`Named health gate ${L} was not found for this release.`};let Fe=await new He(at).runAndEvaluate(Ve);return{healthy:Fe.result.status==="healthy",evidence:{healthCheckId:Ve.id,healthResultId:Fe.result.id,status:Fe.result.status,timings:Fe.result.timings},message:Fe.result.message}}})},{parallelism:e.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(L)=>console.error("ts-cloud deployment queue worker failed:",L)}):void 0;if(bl(b),Ui(pt,te(b,String(N)),z),jt)zi(b,jt.users),oS(Me,b,jt.users);let mr=nS({cwd:t,enabled:Oe,secret:bt,authentication:Me,authorization:{store:b.store,organizationId:b.organization.id,projectId:b.project.id,defaultEnvironment:String(N)}}),wr=new Vo,tf=setInterval(()=>wr.sweep(),60000);tf.unref?.();let _c=new kc,Xu=new kc(3,900000,900000),Tc=new kc(8,900000,900000),rf=setInterval(()=>_c.prune(),300000),nf=setInterval(()=>Xu.prune(),300000),of=setInterval(()=>Tc.prune(),300000);if(rf.unref?.(),nf.unref?.(),of.unref?.(),Oe){if(jt?.generated)console.warn(`
+[output truncated]`}async function nw(e,t,r){let a=e.getReader(),m=new TextDecoder,f="";while(!0){let{done:I,value:R}=await a.read();if(I)break;let b=m.decode(R,{stream:!0});if(f+=b,b)r?.(t,b)}let y=m.decode();if(y)f+=y,r?.(t,y);return f}async function Fg(e,t){let r=Bun.spawn([process.execPath,t.cliEntry,...e.command],{cwd:t.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...t.env}}),a=()=>{try{r.kill()}catch{}};if(t.signal?.aborted)a();else t.signal?.addEventListener("abort",a,{once:!0});try{let[m,f,y]=await Promise.all([nw(r.stdout,"stdout",t.onOutput),nw(r.stderr,"stderr",t.onOutput),r.exited]);return{action:e.id,command:["cloud",...e.command].join(" "),exitCode:y,ok:y===0,stdout:rw(m),stderr:rw(f)}}finally{t.signal?.removeEventListener("abort",a)}}function cT(){return Object.entries(process.env).filter(([e,t])=>!!t&&t.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(e)).map(([,e])=>e)}var dT=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function lT(e){let t=Ac(e);if(t&&t!==".html")return!1;let r=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!dT.has(r)}var uT={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/infrastructure/topology":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function iw(e,t){if(t.role==="admin")return!0;let r=Ac(e);if(r&&r!==".html")return!0;if(t.organizationSource==="legacy")return!lT(e);let a=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(a==="/access-denied")return!0;let m=uT[a];return!!m&&!!t.capabilities?.includes(m)}function pT(e,t){let r=decodeURIComponent(t).replace(/^\/+/,""),m=N_(r===""?"index.html":r);if(m.startsWith("..")||m.includes("/../"))return null;let f=Qt(e,m);if(Ti(f)&&!cw(f).isDirectory())return f;if(!Ac(f)&&Ti(`${f}.html`))return`${f}.html`;if(!Ac(f)&&Ti(Qt(f,"index.html")))return Qt(f,"index.html");return null}async function ow(e,t){let r=pT(e,t);if(!r){let f=Qt(e,"404.html");if(Ti(f))return new Response(await oi(f),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return Ku("Not found",404)}if(cw(r).isDirectory())return Ku("Not found",404);let a=await oi(r),m=V_[Ac(r)]??"application/octet-stream";return new Response(a,{headers:{"content-type":m}})}var Wu=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"],sw=new WeakMap;async function aw(e){let t=sw.get(e);if(t)return t;let r=await import("./spend/index.js"),a=new r.SpendStore(e),m={store:a,service:new r.SpendService(a),gate:new r.SpendGate(e)};return sw.set(e,m),m}async function ka(e={}){q_();let t=e.cwd??process.cwd(),r=e.host??F_,a=e.port??z_,m=e.cliEntry??process.argv[1];if(e.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await Z_(t);let f=e.config??await Xd(),y=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,I=p(f);if(y&&I&&!I.password)I.password=y;let R=f.infrastructure?.compute?.managedServices?.vitess;if(y&&R&&typeof R==="object"&&!R.password)R.password=y;let b=Yl(t,f);if(b.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${b.reconciliation.failed} orphaned operation(s) as failed after restart.`);let T=Object.keys(f.environments??{}),N=Q_(f,e.environment),F=X_(t),z=await Cs(f,N),H=new Map([[N,z]]),K=new Map([[N,Date.now()]]),Z=new Map([[N,Date.now()]]),oe=new Map,ye=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),ee=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),ce=x(f)!=="serverless",Re=(L)=>{let Ue=H.get(L);if(Ue&&!XS(K.get(L),Date.now(),ye))return Promise.resolve(Ue);let Ve=oe.get(L);if(Ve)return Ve;let Fe=!ce||XS(Z.get(L),Date.now(),ee),nt=Cs(f,L,{includeSiteHealth:Fe}).then((Tt)=>{let W=H.get(L),Qr=Fe?Tt:oT(W,Tt);if(H.set(L,Qr),K.set(L,Date.now()),Fe)Z.set(L,Date.now());if(W?._serverReachable!==Qr._serverReachable||W?._metricsStatus!==Qr._metricsStatus||(W?.sitesDetail?.length??0)!==(Qr.sitesDetail?.length??0))ot();return Qr}).finally(()=>oe.delete(L));return oe.set(L,nt),nt},Ae=kt(t),ue=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(e.box&&ue!=="0"&&(ue==="1"||!f.cloud?.attachTo)){let L=!1,Ue=Date.now()+300000,Ve=async()=>{if(L)return;L=!0;try{let nt=Date.now(),Tt=nt>=Ue;if(Tt)Ue=nt+300000;let W=b.environments.get(N);await Bg({controlPlane:b.store,projectId:b.project.id,environmentId:W?.id,config:f,environment:N,force:!0,lightweight:!0,includeSiteHealth:Tt})}catch(nt){if(e.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${nt instanceof Error?nt.message:String(nt)}`)}finally{L=!1}};Ve(),setInterval(()=>void Ve(),60000).unref?.()}let ae=new Map,Le=new Map,rt=new Set,vt=0;function or(L,Ue){if(L.role==="admin"&&!b.store.getActorByExternalId("user",`dashboard:${L.username.toLowerCase()}`))return L;let Ve=b.store.getActorByExternalId("user",`dashboard:${L.username.toLowerCase()}`),Fe=Ve?b.store.getMembershipForActor(b.organization.id,Ve.id):void 0;if(!Fe||Fe.status!=="active")return{...L,role:"member",sites:{},capabilities:[]};let nt=b.store.listGrants(Fe.id),Tt=b.store.resolveAuthorizationTarget(b.organization.id,Fe.scope)??b.store.resolveAuthorizationTarget(b.organization.id,{type:"project",id:b.project.id}),W=Ot({membership:Fe,grants:nt,target:Tt});if(Fe.roleTemplate==="owner"||Fe.roleTemplate==="admin")return{...L,role:"admin",sites:{},organizationRole:Fe.roleTemplate,organizationSource:Fe.source,capabilities:W};let Qr=b.environments.get(Ue),br={};for(let ct of b.store.listResources(b.project.id,Qr?.id).filter((gt)=>gt.kind==="application")){let gt=b.store.resolveAuthorizationTarget(b.organization.id,{type:"resource",id:ct.id});if(!gt||!w({membership:Fe,grants:nt,capability:"project:read",target:gt}).allowed)continue;br[ct.slug]=w({membership:Fe,grants:nt,capability:"config:write",target:gt}).allowed?"owner":"collaborator"}return{...L,role:"member",sites:br,organizationRole:Fe.roleTemplate,organizationSource:Fe.source,capabilities:W}}function ot(){vt+=1,ae.clear();for(let L of rt)Ps(L,{recursive:!0,force:!0});rt.clear()}let $t=(L,Ue)=>`${Ue}:${L.role==="admin"?"admin":`member:${Object.entries(L.sites).sort(([Ve],[Fe])=>Ve.localeCompare(Fe)).map(([Ve,Fe])=>`${Ve}=${Fe}`).join(",")}`}:${[...L.capabilities??[]].sort().join(",")}`;async function ar(L,Ue){let Ve=or(L,Ue),Fe=$t(Ve,Ue),nt=ae.get(Fe);if(nt)return nt;let Tt=Le.get(Fe);if(Tt)return Tt;let W=vt,Qr=(async()=>{let br=H.get(Ue)??await Cs(f,Ue);H.set(Ue,br);let ct={..._g(br,{user:Ve,slug:f.project.slug}),viewer:{role:Ve.role,organizationRole:Ve.organizationRole,organizationSource:Ve.organizationSource,capabilities:Ve.capabilities??[]}},gt=await aT(t,ct);if(gt&&W!==vt)return Ps(gt,{recursive:!0,force:!0}),Ae?.uiRoot;if(gt)rt.add(gt);let Mr=gt??Ae?.uiRoot;if(Mr)ae.set(Fe,Mr);return Mr})();Le.set(Fe,Qr);try{return await Qr}finally{Le.delete(Fe)}}let lt=await ar({username:"",passwordHash:"",role:"admin",sites:{}},N);if(!lt)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let Q=new WeakMap,ve=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",Ie=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(Ie&&e.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let Oe=!Ie,bt=Zb(t),jt=Oe?rS(t,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,Me=new Oi(b.store,{encryptionKey:Ke(t)}),Et=new xi(b.store),pt=new Wr(b.store),tt=new xo(b.store,{encryptionKey:Ke(t)}),Gr=new up(b.store),_s=new fp(b.store,{cwd:t}),Zn=new mp(b.store,{encryptionKey:Ke(t)}),tr=new c(b.store,{workerId:`dashboard:${process.pid}`}),cr=new Wo(b.store),si=new ia(b.store,Ke(t)),Di=new wa(b.store),Cc=new Gi(cr,tr,si),Ni=f.project?.region??"us-east-1",Ug=Ke(t),En=new Na(Di,{encryptionKey:Ug,backends:[new cn(b.store,Ug),new Ra(new V(Ni),Ni),new Da(new be(Ni),Ni),new Pa]});await mu(En,b,f);let Ju=new j(Ni),lw={aws_rds:new Jo(new ta(Ju)),aws_aurora:new Xo(new ra(Ju)),aws_elasticache:new Yo(new na(new et(Ni))),server:new Zo(new Jt),container:new ea(new Jt)},qg=(L)=>lw[L.provider],Sr=new ya(b.store),To=new Ji(Sr,tr),Vg=new Ia(si),uw={managed_database:new Sa(cr,Ju),logical_database:new Ea(cr,si),volume:new ba,files:new Ca(t),control_plane:new va(b.store,t),infrastructure:new Ta(new er(Ni))},pw=(L)=>uw[L.resourceKind],mw=(L)=>L.provider==="aws_backup"?void 0:Vg,Gu=new xt(b.store),Qu=[new Pr,new Qs(d(t,"volumes"))],ai=new Us(Gu,Qu,tr),Qa=new sa(b.store),Xn=new oa(Qa,[new en("aws"),new en("hetzner"),new en("ssh")],tr),Bi=new aa(b.store),Wg=new ca(Bi,Qa),es=new da(b.store),Hg=new la(es,tr),ci=new pa(b.store),Yu=new ga(ci,tr),Kg=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((L)=>new ma(L,b.store,b.project.id,b.organization.id)),Or=new jo(b.store),Jg=new Ko(Or,{queue:tr}),vr=new Dr(b.store),Zi=new Nr(b.store),On=new mt(b.store),at=new fi(b.store,{encryptionKey:Ke(t)}),gw=()=>aw(b.store);for(let L of b.environments.values())zo(Or,f,{organization:b.organization,project:b.project,environment:L,resources:b.store.listResources(b.project.id,L.id)});let $n=new Ai(at,{emailImpl:async(L)=>{let{email:Ue}=await import("./chunk-49vvjfrd.js");return Ue.send(L)}}),Gg=async(L)=>{let Ue=eo(at,b.project.id,L),Ve=[];for(let Fe of Ue.filter((nt)=>nt.notify&&nt.alert))Ve.push(...await $n.deliverAll($n.enqueue(b.organization.id,Fe.alert,Fe.transition)));return Ve.push(...await $n.deliverAll($n.enqueueRemindersAndEscalations(b.organization.id,at.listAlerts(b.project.id,{environmentId:L,states:["firing"]})))),Ve.push(...await $n.retryDue()),{evaluations:Ue,deliveries:Ve}},Zu=!1,fw=async()=>{if(Zu)return;Zu=!0;try{for(let L of b.environments.values())for(let Ue of at.listHealthChecks(b.project.id,L.id).filter((Ve)=>Ve.enabled)){let Ve=at.listHealthResults(Ue.id,1)[0];if(Ve&&Date.now()-new Date(Ve.checkedAt).getTime()<Ue.intervalSeconds*1000)continue;let Fe=await new He(at).runAndEvaluate(Ue);for(let nt of Fe.evaluations.filter((Tt)=>Tt.notify&&Tt.alert))await $n.deliverAll($n.enqueue(b.organization.id,nt.alert,nt.transition))}}finally{Zu=!1}},Qg=setInterval(()=>{for(let L of b.environments.values())Gg(L.id).catch((Ue)=>console.error("ts-cloud alert evaluation failed:",Ue))},60000);Qg.unref?.();let Yg=setInterval(()=>{fw().catch((L)=>console.error("ts-cloud health check evaluation failed:",L))},30000);Yg.unref?.();let Zg=setInterval(()=>{try{Jg.tick()}catch(L){console.error("ts-cloud scheduled job evaluation failed:",L)}},30000);Zg.unref?.();let Xg=setInterval(()=>{try{To.enqueueDue(),To.enqueueRetention()}catch(L){console.error("ts-cloud backup policy evaluation failed:",L)}},30000);Xg.unref?.(),vr.cleanup();let ef=setInterval(()=>{try{vr.cleanup()}catch(L){console.error("ts-cloud preview cleanup failed:",L)}},3600000);ef.unref?.();let hw=e.queueWorker??!0,yw=cT(),vw=async(L,Ue)=>{let Fe=(L.environmentId?b.store.listEnvironments(L.projectId).find((nt)=>nt.id===L.environmentId):void 0)?.slug??String(N);if(Ue.kind==="dashboard_operation"&&Ue.operationId){let nt=H.get(Fe)??z,Tt=Pg(Ue.operationId,f,nt);if(!Tt||Tt.danger||!["scheduler","backup","worker"].includes(Tt.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let W=await zu(f,Fe,Tt);return{ok:W.ok,stdout:W.stdout,stderr:W.stderr??W.error,retryable:/temporar|unavailable|timeout|network/i.test(W.stderr??W.error??""),output:{command:W.command??null,operation:W.operation}}}if(Ue.kind==="serverless_scheduler"){let nt=await Mg(f,Fe,"run");return{ok:nt.ok,stdout:nt.stdout,stderr:nt.error,retryable:/temporar|unavailable|timeout|network/i.test(nt.error??""),output:{command:nt.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${Ue.kind}.`}},Pc=hw?new Ms(tr,{...Uc({store:b.store,execute:async(L,Ue)=>{let Ve=Ue.operation.input&&typeof Ue.operation.input==="object"&&!Array.isArray(Ue.operation.input)?Ue.operation.input:{},Fe=Ve.source&&typeof Ve.source==="object"?Ve.source:void 0,nt=t,Tt,W,Qr;try{if(Fe?.bindingId&&Fe?.connectionId&&Fe?.commitSha){let ct=tt.getBinding(String(Fe.bindingId)),gt=tt.getConnection(String(Fe.connectionId));if(!ct||!gt||ct.connectionId!==gt.id)throw Error("Queued source binding is no longer available");let _r=(ct.repositoryId?tt.getRepository(ct.repositoryId):tt.listRepositories(gt.id).find((Os)=>Os.fullName.toLowerCase()===ct.repositoryFullName.toLowerCase()))?.cloneUrl;if(!_r&&gt.provider==="generic_ssh")_r=`git@${new URL(gt.host).hostname}:${ct.repositoryFullName}.git`;if(!_r)_r=new URL(`/${ct.repositoryFullName}.git`,gt.host.endsWith("/")?gt.host:`${gt.host}/`).href;let Ce=ct.deployKeyId?tt.getDeployKey(ct.deployKeyId):void 0,dr=Ce&&ct.deployKeyId?{...Ce,privateKey:tt.getDeployPrivateKey(ct.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(gt.provider)&&L.target.previewId){let Os=We(gt,tt.getCredential(gt.id)),Se=vr.previews.getInstance(L.target.previewId);Qr=async(Nn,Oc)=>{try{await Os.setCommitStatus(ct.repositoryFullName,String(Fe.commitSha),{state:Nn,url:Se?.url,description:Oc})}catch($s){Ue.log(`Could not publish source status: ${$s instanceof Error?$s.message:String($s)}`,{stream:"stderr"})}},await Qr("pending",`Preview deployment started for ${String(Fe.commitSha).slice(0,12)}`)}Tt=zg(Qt(Hu(),"ts-cloud-queued-source-")),Ue.log(`Checking out immutable source commit ${Fe.commitSha}.`,{stream:"system"}),nt=(await $o({remote:_r,binding:ct,destination:Qt(Tt,"checkout"),ref:String(Fe.branch??ct.defaultBranch),commitSha:String(Fe.commitSha)},{credential:tt.getCredential(gt.id),deployKey:dr})).directory}if(Ue.operation.kind!=="preview.destroy"){let ct=L.target.previewId?vr.previews.getInstance(L.target.previewId):void 0,gt=ct?vr.previews.getDefinition(ct.definitionId):void 0,Mr=Ue.operation.resourceId?b.store.getResource(Ue.operation.resourceId):void 0;if(W=await En.resolve({projectId:b.project.id,environmentId:Ue.operation.environmentId,resourceId:Ue.operation.resourceId,functionId:Mr?.kind==="function"?Mr.id:void 0,previewId:ct?.id,trustedPreview:!!ct&&!ct.fork,allowedPreviewSecrets:gt?.inheritedSecrets}),W.warnings.some((_r)=>_r.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${W.warnings.filter((_r)=>_r.code==="missing_required").map((_r)=>_r.key).join(", ")}`);if(Ue.operation.resourceId)for(let _r of Object.values(W.entries))Di.setDependency({entryId:_r.id,resourceId:Ue.operation.resourceId,injectionTarget:"environment",required:_r.required,requiresRedeploy:!0});Ue.log(`Resolved configuration ${W.configurationHash.slice(0,18)} for ${Object.keys(W.values).length} keys.`,{stream:"system"})}let br=await Fg(L,{cwd:nt,cliEntry:m,signal:Ue.signal,env:W?.values,onOutput:(ct,gt)=>Ue.log(gt,{stream:ct,step:"execute",secrets:[...yw,...Object.entries(W?.entries??{}).filter(([,Mr])=>Mr.kind==="secret").map(([Mr])=>W.values[Mr]).filter(Boolean)]})});if(br.ok&&Ue.operation.resourceId&&W)for(let ct of Object.values(W.entries))Di.setDependency({entryId:ct.id,resourceId:Ue.operation.resourceId,injectionTarget:"environment",required:ct.required,requiresRedeploy:!1,lastDeployedVersion:ct.version});return await Qr?.(br.ok?"success":"failure",br.ok?`Preview is ready at ${String(Fe?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(Fe?.commitSha).slice(0,12)}`),br}catch(br){throw await Qr?.("error",`Preview deployment could not complete at ${String(Fe?.commitSha).slice(0,12)}`),br}finally{if(Tt)Ps(Tt,{recursive:!0,force:!0})}}}),...Bl({store:Or,executor:vw}),...Ol({store:cr,secrets:si,resolveAdapter:qg}),...$l(Qa,Xn.drivers),...Fl(es,[new ua("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...ql({store:ci,cleanup:Kg}),...Qc(Gu,Qu),...du({store:Sr,queue:tr,resolveSource:pw,resolveDestination:mw,validateHealth:async(L,Ue)=>{if(!L.healthCheckId)return{healthy:!0,mode:"adapter"};let Ve=at.getHealthCheck(L.healthCheckId);if(!Ve||Ve.projectId!==L.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let Fe=await new He(at).runAndEvaluate(Ve);return{healthy:Fe.result.status==="healthy",healthCheckId:Ve.id,healthResultId:Fe.result.id,target:Ue}}}),...ll({store:b.store,resolveDriver:e.releaseDriver??((L)=>({name:`${b.store.getResource(L.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:L.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(L,Ue)=>{let Ve=at.listHealthChecks(Ue.projectId,Ue.environmentId).find((nt)=>nt.enabled&&nt.name===L&&(!nt.resourceId||nt.resourceId===Ue.resourceId));if(!Ve)return{healthy:!1,message:`Named health gate ${L} was not found for this release.`};let Fe=await new He(at).runAndEvaluate(Ve);return{healthy:Fe.result.status==="healthy",evidence:{healthCheckId:Ve.id,healthResultId:Fe.result.id,status:Fe.result.status,timings:Fe.result.timings},message:Fe.result.message}}})},{parallelism:e.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(L)=>console.error("ts-cloud deployment queue worker failed:",L)}):void 0;if(bl(b),Ui(pt,te(b,String(N)),z),jt)zi(b,jt.users),oS(Me,b,jt.users);let mr=nS({cwd:t,enabled:Oe,secret:bt,authentication:Me,authorization:{store:b.store,organizationId:b.organization.id,projectId:b.project.id,defaultEnvironment:String(N)}}),wr=new Vo,tf=setInterval(()=>wr.sweep(),60000);tf.unref?.();let _c=new kc,Xu=new kc(3,900000,900000),Tc=new kc(8,900000,900000),rf=setInterval(()=>_c.prune(),300000),nf=setInterval(()=>Xu.prune(),300000),of=setInterval(()=>Tc.prune(),300000);if(rf.unref?.(),nf.unref?.(),of.unref?.(),Oe){if(jt?.generated)console.warn(`
   ts-cloud dashboard: created the first admin.
     username: ${jt.generated.username}
     password: ${jt.generated.password}

package/dist/chunk-49vvjfrd.js

@@ -0,0 +1 @@
+import{Sn,Dh}from"./chunk-d46p0h6t.js";import"./chunk-9wmer0zx.js";import"./chunk-9asn5fpt.js";import"./chunk-zx8ecz8b.js";export{Sn as EmailClient,Dh as email};

package/dist/{chunk-yd40pg8g.js → chunk-9asn5fpt.js}

@@ -1,92 +1,92 @@
-import{br,n}from"./chunk-zx8ecz8b.js";import{Fe}from"./chunk-bxrzsth8.js";import*as l from"node:crypto";import{readFileSync as D}from"node:fs";import{readdir as U}from"node:fs/promises";import{join as L}from"node:path";function Bt(e){if(e){let i=R(e);if(!i)throw Error(`AWS profile '${e}' not found in ~/.aws/credentials`);return i}let t=process.env.AWS_ACCESS_KEY_ID,s=process.env.AWS_SECRET_ACCESS_KEY;if(t&&s)return{accessKeyId:t,secretAccessKey:s,sessionToken:process.env.AWS_SESSION_TOKEN};return R(process.env.AWS_PROFILE||"default")??{accessKeyId:"",secretAccessKey:""}}function R(e){let{existsSync:t,readFileSync:s}=Fe("node:fs"),{homedir:i}=Fe("node:os"),{join:r}=Fe("node:path"),a=process.env.AWS_SHARED_CREDENTIALS_FILE||r(i(),".aws","credentials");if(!t(a))return null;let c=s(a,"utf-8"),g=null,d,u,y;for(let h of c.split(`
-`)){let m=h.trim();if(!m||m.startsWith("#")||m.startsWith(";"))continue;let p=m.match(/^\[([^\]]+)\]$/);if(p){if(g===e&&d&&u)return{accessKeyId:d,secretAccessKey:u,sessionToken:y};g=p[1],d=void 0,u=void 0,y=void 0;continue}if(g===e){let[b,...S]=m.split("="),f=S.join("=").trim();switch(b.trim().toLowerCase()){case"aws_access_key_id":d=f;break;case"aws_secret_access_key":u=f;break;case"aws_session_token":y=f;break}}}if(g===e&&d&&u)return{accessKeyId:d,secretAccessKey:u,sessionToken:y};return null}function B(e){let{buffer:t,byteOffset:s,byteLength:i}=e;if(t instanceof ArrayBuffer)return t.slice(s,s+i);let r=new ArrayBuffer(i);return new Uint8Array(r).set(new Uint8Array(e)),r}class o{client;region;explicitProfile;endpoint;endpointProtocol="https";forcePathStyle;explicitCredentials;constructor(e="us-east-1",t,s){let i=typeof e==="string"?s:e,r=typeof e==="string"?e:e.region??"us-east-1",a=typeof e==="string"?t:e.profile,c=i?.endpoint?br({region:r,path:"/",endpoint:i.endpoint}):void 0;this.region=r,this.explicitProfile=a,this.endpoint=c?.host,this.endpointProtocol=c?.protocol??"https",this.forcePathStyle=i?.forcePathStyle,this.explicitCredentials=i?.credentials,this.client=new n(i?.credentials,{profile:a,endpoint:i?.endpoint,forcePathStyle:i?.forcePathStyle})}getCredentials(){if(this.explicitCredentials?.accessKeyId&&this.explicitCredentials.secretAccessKey)return this.explicitCredentials;let e=Bt(this.explicitProfile);if(e.accessKeyId&&e.secretAccessKey)return e;throw Error("S3 credentials not found. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (or pass explicit credentials/profile), or configure ~/.aws/credentials.")}s3BaseHost(){return this.endpoint||`s3.${this.region}.amazonaws.com`}s3VirtualHost(e){return this.forcePathStyle?this.s3BaseHost():`${e}.${this.s3BaseHost()}`}objectPath(e,t){return this.forcePathStyle?`/${e}/${t}`:`/${t}`}objectUrl(e,t){return`${this.endpointProtocol}://${this.s3VirtualHost(e)}${this.objectPath(e,t)}`}async listBuckets(){let e=await this.client.request({service:"s3",region:this.region,method:"GET",path:"/"}),t=[],i=(e?.ListAllMyBucketsResult??e)?.Buckets?.Bucket;if(i){let r=Array.isArray(i)?i:[i];for(let a of r)t.push({Name:a.Name,CreationDate:a.CreationDate})}return{Buckets:t}}async createBucket(e,t){let s={};if(t?.acl)s["x-amz-acl"]=t.acl;let i;if(this.region!=="us-east-1"&&!this.endpoint)i=`<?xml version="1.0" encoding="UTF-8"?>
+import{br,n}from"./chunk-zx8ecz8b.js";import{Fe}from"./chunk-bxrzsth8.js";import*as l from"node:crypto";import{readFileSync as B}from"node:fs";import{readdir as L}from"node:fs/promises";import{join as z}from"node:path";function Bt(e){if(e){let r=D(e);if(!r)throw Error(`AWS profile '${e}' not found in ~/.aws/credentials`);return r}let t=process.env.AWS_ACCESS_KEY_ID,s=process.env.AWS_SECRET_ACCESS_KEY;if(t&&s)return{accessKeyId:t,secretAccessKey:s,sessionToken:process.env.AWS_SESSION_TOKEN};return D(process.env.AWS_PROFILE||"default")??{accessKeyId:"",secretAccessKey:""}}function D(e){let{existsSync:t,readFileSync:s}=Fe("node:fs"),{homedir:r}=Fe("node:os"),{join:i}=Fe("node:path"),a=process.env.AWS_SHARED_CREDENTIALS_FILE||i(r(),".aws","credentials");if(!t(a))return null;let c=s(a,"utf-8"),g=null,d,u,y;for(let h of c.split(`
+`)){let m=h.trim();if(!m||m.startsWith("#")||m.startsWith(";"))continue;let p=m.match(/^\[([^\]]+)\]$/);if(p){if(g===e&&d&&u)return{accessKeyId:d,secretAccessKey:u,sessionToken:y};g=p[1],d=void 0,u=void 0,y=void 0;continue}if(g===e){let[b,...S]=m.split("="),f=S.join("=").trim();switch(b.trim().toLowerCase()){case"aws_access_key_id":d=f;break;case"aws_secret_access_key":u=f;break;case"aws_session_token":y=f;break}}}if(g===e&&d&&u)return{accessKeyId:d,secretAccessKey:u,sessionToken:y};return null}function U(e){let{buffer:t,byteOffset:s,byteLength:r}=e;if(t instanceof ArrayBuffer)return t.slice(s,s+r);let i=new ArrayBuffer(r);return new Uint8Array(i).set(new Uint8Array(e)),i}function j(e,t){let s=e?.[t]??e;if(s===null||typeof s!=="object"||Array.isArray(s))return s;let r={...s};return delete r["@_xmlns"],r}class o{client;region;explicitProfile;endpoint;endpointProtocol="https";forcePathStyle;explicitCredentials;constructor(e="us-east-1",t,s){let r=typeof e==="string"?s:e,i=typeof e==="string"?e:e.region??"us-east-1",a=typeof e==="string"?t:e.profile,c=r?.endpoint?br({region:i,path:"/",endpoint:r.endpoint}):void 0;this.region=i,this.explicitProfile=a,this.endpoint=c?.host,this.endpointProtocol=c?.protocol??"https",this.forcePathStyle=r?.forcePathStyle,this.explicitCredentials=r?.credentials,this.client=new n(r?.credentials,{profile:a,endpoint:r?.endpoint,forcePathStyle:r?.forcePathStyle})}getCredentials(){if(this.explicitCredentials?.accessKeyId&&this.explicitCredentials.secretAccessKey)return this.explicitCredentials;let e=Bt(this.explicitProfile);if(e.accessKeyId&&e.secretAccessKey)return e;throw Error("S3 credentials not found. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (or pass explicit credentials/profile), or configure ~/.aws/credentials.")}s3BaseHost(){return this.endpoint||`s3.${this.region}.amazonaws.com`}s3VirtualHost(e){return this.forcePathStyle?this.s3BaseHost():`${e}.${this.s3BaseHost()}`}objectPath(e,t){return this.forcePathStyle?`/${e}/${t}`:`/${t}`}objectUrl(e,t){return`${this.endpointProtocol}://${this.s3VirtualHost(e)}${this.objectPath(e,t)}`}async listBuckets(){let e=await this.client.request({service:"s3",region:this.region,method:"GET",path:"/"}),t=[],r=(e?.ListAllMyBucketsResult??e)?.Buckets?.Bucket;if(r){let i=Array.isArray(r)?r:[r];for(let a of i)t.push({Name:a.Name,CreationDate:a.CreationDate})}return{Buckets:t}}async createBucket(e,t){let s={};if(t?.acl)s["x-amz-acl"]=t.acl;let r;if(this.region!=="us-east-1"&&!this.endpoint)r=`<?xml version="1.0" encoding="UTF-8"?>
 <CreateBucketConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
   <LocationConstraint>${this.region}</LocationConstraint>
-</CreateBucketConfiguration>`,s["Content-Type"]="application/xml";await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,headers:s,body:i})}async deleteBucket(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`})}async emptyAndDeleteBucket(e){let t=!0;while(t){let s=await this.listAllObjects({bucket:e});if(s.length===0){t=!1;break}let i=s.map((r)=>r.Key);for(let r=0;r<i.length;r+=1000){let a=i.slice(r,r+1000);await this.deleteObjects(e,a)}}await this.deleteBucket(e)}async listAllObjects(e){let t=[],s;do{let i={"list-type":"2","max-keys":"1000"};if(e.prefix)i.prefix=e.prefix;if(s)i["continuation-token"]=s;let r=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e.bucket}`,queryParams:i}),a=r?.ListBucketResult??r,c=a?.Contents;if(c){let d=Array.isArray(c)?c:[c];for(let u of d)t.push({Key:u.Key,LastModified:u.LastModified||"",Size:Number.parseInt(u.Size||"0"),ETag:u.ETag})}let g=a?.IsTruncated;s=g==="true"||g===!0?a?.NextContinuationToken:void 0}while(s);return t}async list(e){let t=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e.bucket}`}),s=[],r=(t?.ListBucketResult??t)?.Contents;if(r){let a=Array.isArray(r)?r:[r];for(let c of a){if(e.prefix&&!c.Key?.startsWith(e.prefix))continue;if(s.push({Key:c.Key||"",LastModified:c.LastModified||"",Size:Number.parseInt(c.Size||"0"),ETag:c.ETag}),e.maxKeys&&s.length>=e.maxKeys)break}}return s}async putObject(e){let t={};if(e.acl)t["x-amz-acl"]=e.acl;if(e.cacheControl)t["Cache-Control"]=e.cacheControl;if(e.contentType)t["Content-Type"]=e.contentType;if(e.metadata)for(let[r,a]of Object.entries(e.metadata))t[`x-amz-meta-${r}`]=a;let s=e.key.split("/").map((r)=>encodeURIComponent(r)).join("/"),i=e.body instanceof Uint8Array&&!Buffer.isBuffer(e.body)?Buffer.from(e.body):e.body;if(Buffer.isBuffer(i)||i instanceof Uint8Array){let r=Buffer.isBuffer(i)?i:Buffer.from(i),{accessKeyId:a,secretAccessKey:c,sessionToken:g}=this.getCredentials(),d=this.s3VirtualHost(e.bucket),u=this.objectPath(e.bucket,s),y=this.objectUrl(e.bucket,s),h=new Date,m=h.toISOString().replace(/[:-]|\.\d{3}/g,""),p=h.toISOString().slice(0,10).replace(/-/g,""),b=l.createHash("sha256").update(r).digest("hex"),S={host:d,"x-amz-date":m,"x-amz-content-sha256":b,...t};if(g)S["x-amz-security-token"]=g;let f=Object.keys(S).sort().map((P)=>`${P.toLowerCase()}:${S[P].trim()}
+</CreateBucketConfiguration>`,s["Content-Type"]="application/xml";await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,headers:s,body:r})}async deleteBucket(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`})}async emptyAndDeleteBucket(e){let t=!0;while(t){let s=await this.listAllObjects({bucket:e});if(s.length===0){t=!1;break}let r=s.map((i)=>i.Key);for(let i=0;i<r.length;i+=1000){let a=r.slice(i,i+1000);await this.deleteObjects(e,a)}}await this.deleteBucket(e)}async listAllObjects(e){let t=[],s;do{let r={"list-type":"2","max-keys":"1000"};if(e.prefix)r.prefix=e.prefix;if(s)r["continuation-token"]=s;let i=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e.bucket}`,queryParams:r}),a=i?.ListBucketResult??i,c=a?.Contents;if(c){let d=Array.isArray(c)?c:[c];for(let u of d)t.push({Key:u.Key,LastModified:u.LastModified||"",Size:Number.parseInt(u.Size||"0"),ETag:u.ETag})}let g=a?.IsTruncated;s=g==="true"||g===!0?a?.NextContinuationToken:void 0}while(s);return t}async list(e){let t=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e.bucket}`}),s=[],i=(t?.ListBucketResult??t)?.Contents;if(i){let a=Array.isArray(i)?i:[i];for(let c of a){if(e.prefix&&!c.Key?.startsWith(e.prefix))continue;if(s.push({Key:c.Key||"",LastModified:c.LastModified||"",Size:Number.parseInt(c.Size||"0"),ETag:c.ETag}),e.maxKeys&&s.length>=e.maxKeys)break}}return s}async putObject(e){let t={};if(e.acl)t["x-amz-acl"]=e.acl;if(e.cacheControl)t["Cache-Control"]=e.cacheControl;if(e.contentType)t["Content-Type"]=e.contentType;if(e.metadata)for(let[i,a]of Object.entries(e.metadata))t[`x-amz-meta-${i}`]=a;let s=e.key.split("/").map((i)=>encodeURIComponent(i)).join("/"),r=e.body instanceof Uint8Array&&!Buffer.isBuffer(e.body)?Buffer.from(e.body):e.body;if(Buffer.isBuffer(r)||r instanceof Uint8Array){let i=Buffer.isBuffer(r)?r:Buffer.from(r),{accessKeyId:a,secretAccessKey:c,sessionToken:g}=this.getCredentials(),d=this.s3VirtualHost(e.bucket),u=this.objectPath(e.bucket,s),y=this.objectUrl(e.bucket,s),h=new Date,m=h.toISOString().replace(/[:-]|\.\d{3}/g,""),p=h.toISOString().slice(0,10).replace(/-/g,""),b=l.createHash("sha256").update(i).digest("hex"),S={host:d,"x-amz-date":m,"x-amz-content-sha256":b,...t};if(g)S["x-amz-security-token"]=g;let f=Object.keys(S).sort().map((P)=>`${P.toLowerCase()}:${S[P].trim()}
 `).join(""),k=Object.keys(S).sort().map((P)=>P.toLowerCase()).join(";"),T=["PUT",u,"",f,k,b].join(`
 `),w="AWS4-HMAC-SHA256",C=`${p}/${this.region}/s3/aws4_request`,q=[w,m,C,l.createHash("sha256").update(T).digest("hex")].join(`
-`),j=l.createHmac("sha256",`AWS4${c}`).update(p).digest(),I=l.createHmac("sha256",j).update(this.region).digest(),H=l.createHmac("sha256",I).update("s3").digest(),E=l.createHmac("sha256",H).update("aws4_request").digest(),v=l.createHmac("sha256",E).update(q).digest("hex"),A=`${w} Credential=${a}/${C}, SignedHeaders=${k}, Signature=${v}`,x=await fetch(y,{method:"PUT",headers:{...S,Authorization:A},body:B(r)});if(!x.ok){let P=await x.text();throw Error(`S3 PUT failed: ${x.status} ${P}`)}return}await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${s}`,bucket:e.bucket,headers:t,body:e.body})}async getObject(e,t){let s=t.split("/").map((r)=>encodeURIComponent(r)).join("/");return await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${s}`,bucket:e,rawResponse:!0})}async getObjectBytes(e,t){let{accessKeyId:s,secretAccessKey:i,sessionToken:r}=this.getCredentials(),a=this.s3VirtualHost(e),c=t.split("/").map((P)=>encodeURIComponent(P)).join("/"),g=this.objectPath(e,c),d=this.objectUrl(e,c),u=new Date,y=u.toISOString().replace(/[:-]|\.\d{3}/g,""),h=u.toISOString().slice(0,10).replace(/-/g,""),m=l.createHash("sha256").update("").digest("hex"),p={host:a,"x-amz-date":y,"x-amz-content-sha256":m};if(r)p["x-amz-security-token"]=r;let b=Object.keys(p).sort().map((P)=>`${P.toLowerCase()}:${p[P].trim()}
+`),I=l.createHmac("sha256",`AWS4${c}`).update(p).digest(),K=l.createHmac("sha256",I).update(this.region).digest(),H=l.createHmac("sha256",K).update("s3").digest(),E=l.createHmac("sha256",H).update("aws4_request").digest(),v=l.createHmac("sha256",E).update(q).digest("hex"),A=`${w} Credential=${a}/${C}, SignedHeaders=${k}, Signature=${v}`,x=await fetch(y,{method:"PUT",headers:{...S,Authorization:A},body:U(i)});if(!x.ok){let P=await x.text();throw Error(`S3 PUT failed: ${x.status} ${P}`)}return}await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${s}`,bucket:e.bucket,headers:t,body:e.body})}async getObject(e,t){let s=t.split("/").map((i)=>encodeURIComponent(i)).join("/");return await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${s}`,bucket:e,rawResponse:!0})}async getObjectBytes(e,t){let{accessKeyId:s,secretAccessKey:r,sessionToken:i}=this.getCredentials(),a=this.s3VirtualHost(e),c=t.split("/").map((P)=>encodeURIComponent(P)).join("/"),g=this.objectPath(e,c),d=this.objectUrl(e,c),u=new Date,y=u.toISOString().replace(/[:-]|\.\d{3}/g,""),h=u.toISOString().slice(0,10).replace(/-/g,""),m=l.createHash("sha256").update("").digest("hex"),p={host:a,"x-amz-date":y,"x-amz-content-sha256":m};if(i)p["x-amz-security-token"]=i;let b=Object.keys(p).sort().map((P)=>`${P.toLowerCase()}:${p[P].trim()}
 `).join(""),S=Object.keys(p).sort().map((P)=>P.toLowerCase()).join(";"),f=["GET",g,"",b,S,m].join(`
 `),k="AWS4-HMAC-SHA256",T=`${h}/${this.region}/s3/aws4_request`,w=[k,y,T,l.createHash("sha256").update(f).digest("hex")].join(`
-`),C=l.createHmac("sha256",`AWS4${i}`).update(h).digest(),q=l.createHmac("sha256",C).update(this.region).digest(),j=l.createHmac("sha256",q).update("s3").digest(),I=l.createHmac("sha256",j).update("aws4_request").digest(),H=l.createHmac("sha256",I).update(w).digest("hex"),E=`${k} Credential=${s}/${T}, SignedHeaders=${S}, Signature=${H}`,v=await fetch(d,{method:"GET",headers:{...p,Authorization:E}});if(!v.ok){let P=await v.text();throw Error(`S3 GET failed: ${v.status} ${P}`)}let A=await v.arrayBuffer(),x=v.headers.get("content-length");return{body:new Uint8Array(A),contentType:v.headers.get("content-type")??void 0,contentLength:x?Number.parseInt(x,10):void 0}}async copyObject(e){let t=(i)=>i.split("/").map((r)=>encodeURIComponent(r)).join("/"),s={"x-amz-copy-source":`/${e.sourceBucket}/${t(e.sourceKey)}`};if(e.metadataDirective)s["x-amz-metadata-directive"]=e.metadataDirective;if(e.contentType)s["Content-Type"]=e.contentType;if(e.metadata)for(let[i,r]of Object.entries(e.metadata))s[`x-amz-meta-${i}`]=r;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e.destinationBucket}/${t(e.destinationKey)}`,headers:s})}async deleteObject(e,t){let s=t.split("/").map((i)=>encodeURIComponent(i)).join("/");await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${s}`,bucket:e})}async deleteObjects(e,t){let s=`<?xml version="1.0" encoding="UTF-8"?>
+`),C=l.createHmac("sha256",`AWS4${r}`).update(h).digest(),q=l.createHmac("sha256",C).update(this.region).digest(),I=l.createHmac("sha256",q).update("s3").digest(),K=l.createHmac("sha256",I).update("aws4_request").digest(),H=l.createHmac("sha256",K).update(w).digest("hex"),E=`${k} Credential=${s}/${T}, SignedHeaders=${S}, Signature=${H}`,v=await fetch(d,{method:"GET",headers:{...p,Authorization:E}});if(!v.ok){let P=await v.text();throw Error(`S3 GET failed: ${v.status} ${P}`)}let A=await v.arrayBuffer(),x=v.headers.get("content-length");return{body:new Uint8Array(A),contentType:v.headers.get("content-type")??void 0,contentLength:x?Number.parseInt(x,10):void 0}}async copyObject(e){let t=(r)=>r.split("/").map((i)=>encodeURIComponent(i)).join("/"),s={"x-amz-copy-source":`/${e.sourceBucket}/${t(e.sourceKey)}`};if(e.metadataDirective)s["x-amz-metadata-directive"]=e.metadataDirective;if(e.contentType)s["Content-Type"]=e.contentType;if(e.metadata)for(let[r,i]of Object.entries(e.metadata))s[`x-amz-meta-${r}`]=i;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e.destinationBucket}/${t(e.destinationKey)}`,headers:s})}async deleteObject(e,t){let s=t.split("/").map((r)=>encodeURIComponent(r)).join("/");await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${s}`,bucket:e})}async deleteObjects(e,t){let s=`<?xml version="1.0" encoding="UTF-8"?>
 <Delete>
-  ${t.map((r)=>`<Object><Key>${r}</Key></Object>`).join(`
+  ${t.map((i)=>`<Object><Key>${i}</Key></Object>`).join(`
   `)}
-</Delete>`,i=l.createHash("md5").update(s).digest("base64");await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${e}`,queryParams:{delete:""},body:s,headers:{"Content-Type":"application/xml","Content-MD5":i}})}async bucketExists(e){try{return await this.client.request({service:"s3",region:this.region,method:"HEAD",path:`/${e}`}),!0}catch{return!1}}async copy(e){let t=D(e.source);await this.putObject({bucket:e.bucket,key:e.key,body:t,acl:e.acl,cacheControl:e.cacheControl,contentType:e.contentType,metadata:e.metadata})}async sync(e){let t=await this.listFilesRecursive(e.source);for(let s of t){if(e.exclude&&e.exclude.some((a)=>s.includes(a)))continue;if(e.include&&!e.include.some((a)=>s.includes(a)))continue;let i=s.substring(e.source.length+1),r=e.prefix?`${e.prefix}/${i}`:i;if(!e.dryRun){let a=D(s);await this.putObject({bucket:e.bucket,key:r,body:a,acl:e.acl,cacheControl:e.cacheControl,contentType:e.contentType,metadata:e.metadata})}}}async delete(e,t){await this.deleteObject(e,t)}async deletePrefix(e,t){let i=(await this.list({bucket:e,prefix:t})).map((r)=>r.Key);if(i.length>0)await this.deleteObjects(e,i)}async getBucketSize(e,t){return(await this.list({bucket:e,prefix:t})).reduce((i,r)=>i+r.Size,0)}async listFilesRecursive(e){let t=[],s=await U(e,{withFileTypes:!0});for(let i of s){let r=L(e,i.name);if(i.isDirectory()){let a=await this.listFilesRecursive(r);t.push(...a)}else t.push(r)}return t}async putBucketPolicy(e,t){let{accessKeyId:s,secretAccessKey:i,sessionToken:r}=this.getCredentials(),a=this.s3BaseHost(),c=typeof t==="string"?t:JSON.stringify(t),g=new Date,d=g.toISOString().replace(/[:-]|\.\d{3}/g,""),u=g.toISOString().slice(0,10).replace(/-/g,""),y=l.createHash("sha256").update(c).digest("hex"),h="/"+e,m="policy=",p={host:a,"x-amz-date":d,"x-amz-content-sha256":y,"content-type":"application/json"};if(r)p["x-amz-security-token"]=r;let b=Object.keys(p).sort().map((x)=>`${x.toLowerCase()}:${p[x].trim()}
+</Delete>`,r=l.createHash("md5").update(s).digest("base64");await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${e}`,queryParams:{delete:""},body:s,headers:{"Content-Type":"application/xml","Content-MD5":r}})}async bucketExists(e){try{return await this.client.request({service:"s3",region:this.region,method:"HEAD",path:`/${e}`}),!0}catch{return!1}}async copy(e){let t=B(e.source);await this.putObject({bucket:e.bucket,key:e.key,body:t,acl:e.acl,cacheControl:e.cacheControl,contentType:e.contentType,metadata:e.metadata})}async sync(e){let t=await this.listFilesRecursive(e.source);for(let s of t){if(e.exclude&&e.exclude.some((a)=>s.includes(a)))continue;if(e.include&&!e.include.some((a)=>s.includes(a)))continue;let r=s.substring(e.source.length+1),i=e.prefix?`${e.prefix}/${r}`:r;if(!e.dryRun){let a=B(s);await this.putObject({bucket:e.bucket,key:i,body:a,acl:e.acl,cacheControl:e.cacheControl,contentType:e.contentType,metadata:e.metadata})}}}async delete(e,t){await this.deleteObject(e,t)}async deletePrefix(e,t){let r=(await this.list({bucket:e,prefix:t})).map((i)=>i.Key);if(r.length>0)await this.deleteObjects(e,r)}async getBucketSize(e,t){return(await this.list({bucket:e,prefix:t})).reduce((r,i)=>r+i.Size,0)}async listFilesRecursive(e){let t=[],s=await L(e,{withFileTypes:!0});for(let r of s){let i=z(e,r.name);if(r.isDirectory()){let a=await this.listFilesRecursive(i);t.push(...a)}else t.push(i)}return t}async putBucketPolicy(e,t){let{accessKeyId:s,secretAccessKey:r,sessionToken:i}=this.getCredentials(),a=this.s3BaseHost(),c=typeof t==="string"?t:JSON.stringify(t),g=new Date,d=g.toISOString().replace(/[:-]|\.\d{3}/g,""),u=g.toISOString().slice(0,10).replace(/-/g,""),y=l.createHash("sha256").update(c).digest("hex"),h="/"+e,m="policy=",p={host:a,"x-amz-date":d,"x-amz-content-sha256":y,"content-type":"application/json"};if(i)p["x-amz-security-token"]=i;let b=Object.keys(p).sort().map((x)=>`${x.toLowerCase()}:${p[x].trim()}
 `).join(""),S=Object.keys(p).sort().map((x)=>x.toLowerCase()).join(";"),f=["PUT",h,"policy=",b,S,y].join(`
 `),k="AWS4-HMAC-SHA256",T=`${u}/${this.region}/s3/aws4_request`,w=[k,d,T,l.createHash("sha256").update(f).digest("hex")].join(`
-`),C=l.createHmac("sha256","AWS4"+i).update(u).digest(),q=l.createHmac("sha256",C).update(this.region).digest(),j=l.createHmac("sha256",q).update("s3").digest(),I=l.createHmac("sha256",j).update("aws4_request").digest(),H=l.createHmac("sha256",I).update(w).digest("hex"),E=`${k} Credential=${s}/${T}, SignedHeaders=${S}, Signature=${H}`,v=`${this.endpointProtocol}://${a}${h}?policy=`,A=await fetch(v,{method:"PUT",headers:{...p,Authorization:E},body:c});if(!A.ok){let x=await A.text();throw Error(`Failed to put bucket policy: ${A.status} ${x}`)}}async getBucketPolicy(e){let{accessKeyId:t,secretAccessKey:s,sessionToken:i}=this.getCredentials(),r=this.s3BaseHost(),a=new Date,c=a.toISOString().replace(/[:-]|\.\d{3}/g,""),g=a.toISOString().slice(0,10).replace(/-/g,""),d=l.createHash("sha256").update("").digest("hex"),u="/"+e,y="policy=",h={host:r,"x-amz-date":c,"x-amz-content-sha256":d};if(i)h["x-amz-security-token"]=i;let m=Object.keys(h).sort().map((A)=>`${A.toLowerCase()}:${h[A].trim()}
+`),C=l.createHmac("sha256","AWS4"+r).update(u).digest(),q=l.createHmac("sha256",C).update(this.region).digest(),I=l.createHmac("sha256",q).update("s3").digest(),K=l.createHmac("sha256",I).update("aws4_request").digest(),H=l.createHmac("sha256",K).update(w).digest("hex"),E=`${k} Credential=${s}/${T}, SignedHeaders=${S}, Signature=${H}`,v=`${this.endpointProtocol}://${a}${h}?policy=`,A=await fetch(v,{method:"PUT",headers:{...p,Authorization:E},body:c});if(!A.ok){let x=await A.text();throw Error(`Failed to put bucket policy: ${A.status} ${x}`)}}async getBucketPolicy(e){let{accessKeyId:t,secretAccessKey:s,sessionToken:r}=this.getCredentials(),i=this.s3BaseHost(),a=new Date,c=a.toISOString().replace(/[:-]|\.\d{3}/g,""),g=a.toISOString().slice(0,10).replace(/-/g,""),d=l.createHash("sha256").update("").digest("hex"),u="/"+e,y="policy=",h={host:i,"x-amz-date":c,"x-amz-content-sha256":d};if(r)h["x-amz-security-token"]=r;let m=Object.keys(h).sort().map((A)=>`${A.toLowerCase()}:${h[A].trim()}
 `).join(""),p=Object.keys(h).sort().map((A)=>A.toLowerCase()).join(";"),b=["GET",u,"policy=",m,p,d].join(`
 `),S="AWS4-HMAC-SHA256",f=`${g}/${this.region}/s3/aws4_request`,k=[S,c,f,l.createHash("sha256").update(b).digest("hex")].join(`
-`),T=l.createHmac("sha256","AWS4"+s).update(g).digest(),w=l.createHmac("sha256",T).update(this.region).digest(),C=l.createHmac("sha256",w).update("s3").digest(),q=l.createHmac("sha256",C).update("aws4_request").digest(),j=l.createHmac("sha256",q).update(k).digest("hex"),I=`${S} Credential=${t}/${f}, SignedHeaders=${p}, Signature=${j}`,H=`${this.endpointProtocol}://${r}${u}?policy=`,E=await fetch(H,{method:"GET",headers:{...h,Authorization:I}});if(E.status===404)return null;if(!E.ok){let A=await E.text();throw Error(`Failed to get bucket policy: ${E.status} ${A}`)}let v=await E.text();return JSON.parse(v)}async deleteBucketPolicy(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{policy:""}})}async headBucket(e){try{return{exists:!0,region:(await this.client.request({service:"s3",region:this.region,method:"HEAD",path:`/${e}`,returnHeaders:!0}))?.headers?.["x-amz-bucket-region"]}}catch(t){if(t.statusCode===404)return{exists:!1};throw t}}async headObject(e,t){try{let s=await this.client.request({service:"s3",region:this.region,method:"HEAD",path:`/${e}/${t}`,returnHeaders:!0});return{ContentLength:s?.headers?.["content-length"]?parseInt(s.headers["content-length"]):void 0,ContentType:s?.headers?.["content-type"],ETag:s?.headers?.etag,LastModified:s?.headers?.["last-modified"]}}catch(s){if(s.statusCode===404)return null;throw s}}async getObjectBuffer(e,t){let s=await this.getObject(e,t);return Buffer.from(s)}async getObjectJson(e,t){let s=await this.getObject(e,t);return JSON.parse(s)}async putObjectJson(e,t,s,i){await this.putObject({bucket:e,key:t,body:JSON.stringify(s),contentType:"application/json",...i})}async getBucketVersioning(e){let t=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{versioning:""}});return{Status:(t?.VersioningConfiguration??t)?.Status}}async putBucketVersioning(e,t){let s=`<?xml version="1.0" encoding="UTF-8"?>
+`),T=l.createHmac("sha256","AWS4"+s).update(g).digest(),w=l.createHmac("sha256",T).update(this.region).digest(),C=l.createHmac("sha256",w).update("s3").digest(),q=l.createHmac("sha256",C).update("aws4_request").digest(),I=l.createHmac("sha256",q).update(k).digest("hex"),K=`${S} Credential=${t}/${f}, SignedHeaders=${p}, Signature=${I}`,H=`${this.endpointProtocol}://${i}${u}?policy=`,E=await fetch(H,{method:"GET",headers:{...h,Authorization:K}});if(E.status===404)return null;if(!E.ok){let A=await E.text();throw Error(`Failed to get bucket policy: ${E.status} ${A}`)}let v=await E.text();return JSON.parse(v)}async deleteBucketPolicy(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{policy:""}})}async headBucket(e){try{return{exists:!0,region:(await this.client.request({service:"s3",region:this.region,method:"HEAD",path:`/${e}`,returnHeaders:!0}))?.headers?.["x-amz-bucket-region"]}}catch(t){if(t.statusCode===404)return{exists:!1};throw t}}async headObject(e,t){try{let s=await this.client.request({service:"s3",region:this.region,method:"HEAD",path:`/${e}/${t}`,returnHeaders:!0});return{ContentLength:s?.headers?.["content-length"]?parseInt(s.headers["content-length"]):void 0,ContentType:s?.headers?.["content-type"],ETag:s?.headers?.etag,LastModified:s?.headers?.["last-modified"]}}catch(s){if(s.statusCode===404)return null;throw s}}async getObjectBuffer(e,t){let s=await this.getObject(e,t);return Buffer.from(s)}async getObjectJson(e,t){let s=await this.getObject(e,t);return JSON.parse(s)}async putObjectJson(e,t,s,r){await this.putObject({bucket:e,key:t,body:JSON.stringify(s),contentType:"application/json",...r})}async getBucketVersioning(e){let t=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{versioning:""}});return{Status:(t?.VersioningConfiguration??t)?.Status}}async putBucketVersioning(e,t){let s=`<?xml version="1.0" encoding="UTF-8"?>
 <VersioningConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
   <Status>${t}</Status>
-</VersioningConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{versioning:""},headers:{"Content-Type":"application/xml"},body:s})}async getBucketLifecycleConfiguration(e){try{return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{lifecycle:""}}))?.LifecycleConfiguration}catch(t){if(t.statusCode===404)return null;throw t}}async putBucketLifecycleConfiguration(e,t){let i=`<?xml version="1.0" encoding="UTF-8"?>
+</VersioningConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{versioning:""},headers:{"Content-Type":"application/xml"},body:s})}async getBucketLifecycleConfiguration(e){try{let t=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{lifecycle:""}});return j(t,"LifecycleConfiguration")}catch(t){if(t.statusCode===404)return null;throw t}}async putBucketLifecycleConfiguration(e,t){let r=`<?xml version="1.0" encoding="UTF-8"?>
 <LifecycleConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
-  ${t.map((r)=>{let a=`<Rule><ID>${r.ID}</ID><Status>${r.Status}</Status>`;if(r.Filter)a+=`<Filter><Prefix>${r.Filter.Prefix||""}</Prefix></Filter>`;else a+="<Filter><Prefix></Prefix></Filter>";if(r.Expiration){if(r.Expiration.Days)a+=`<Expiration><Days>${r.Expiration.Days}</Days></Expiration>`;else if(r.Expiration.Date)a+=`<Expiration><Date>${r.Expiration.Date}</Date></Expiration>`}if(r.Transitions)for(let c of r.Transitions)a+=`<Transition><Days>${c.Days}</Days><StorageClass>${c.StorageClass}</StorageClass></Transition>`;if(r.NoncurrentVersionExpiration)a+=`<NoncurrentVersionExpiration><NoncurrentDays>${r.NoncurrentVersionExpiration.NoncurrentDays}</NoncurrentDays></NoncurrentVersionExpiration>`;return a+="</Rule>",a}).join("")}
-</LifecycleConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{lifecycle:""},headers:{"Content-Type":"application/xml"},body:i})}async deleteBucketLifecycleConfiguration(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{lifecycle:""}})}async getBucketCors(e){try{return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{cors:""}}))?.CORSConfiguration}catch(t){if(t.statusCode===404)return null;throw t}}async putBucketCors(e,t){let i=`<?xml version="1.0" encoding="UTF-8"?>
+  ${t.map((i)=>{let a=`<Rule><ID>${i.ID}</ID><Status>${i.Status}</Status>`;if(i.Filter)a+=`<Filter><Prefix>${i.Filter.Prefix||""}</Prefix></Filter>`;else a+="<Filter><Prefix></Prefix></Filter>";if(i.Expiration){if(i.Expiration.Days)a+=`<Expiration><Days>${i.Expiration.Days}</Days></Expiration>`;else if(i.Expiration.Date)a+=`<Expiration><Date>${i.Expiration.Date}</Date></Expiration>`}if(i.Transitions)for(let c of i.Transitions)a+=`<Transition><Days>${c.Days}</Days><StorageClass>${c.StorageClass}</StorageClass></Transition>`;if(i.NoncurrentVersionExpiration)a+=`<NoncurrentVersionExpiration><NoncurrentDays>${i.NoncurrentVersionExpiration.NoncurrentDays}</NoncurrentDays></NoncurrentVersionExpiration>`;return a+="</Rule>",a}).join("")}
+</LifecycleConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{lifecycle:""},headers:{"Content-Type":"application/xml"},body:r})}async deleteBucketLifecycleConfiguration(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{lifecycle:""}})}async getBucketCors(e){try{let t=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{cors:""}});return j(t,"CORSConfiguration")}catch(t){if(t.statusCode===404)return null;throw t}}async putBucketCors(e,t){let r=`<?xml version="1.0" encoding="UTF-8"?>
 <CORSConfiguration>
-  ${t.map((r)=>{let a="<CORSRule>";for(let c of r.AllowedOrigins)a+=`<AllowedOrigin>${c}</AllowedOrigin>`;for(let c of r.AllowedMethods)a+=`<AllowedMethod>${c}</AllowedMethod>`;if(r.AllowedHeaders)for(let c of r.AllowedHeaders)a+=`<AllowedHeader>${c}</AllowedHeader>`;if(r.ExposeHeaders)for(let c of r.ExposeHeaders)a+=`<ExposeHeader>${c}</ExposeHeader>`;if(r.MaxAgeSeconds)a+=`<MaxAgeSeconds>${r.MaxAgeSeconds}</MaxAgeSeconds>`;return a+="</CORSRule>",a}).join("")}
-</CORSConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{cors:""},headers:{"Content-Type":"application/xml"},body:i})}async deleteBucketCors(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{cors:""}})}async getBucketEncryption(e){try{return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{encryption:""}}))?.ServerSideEncryptionConfiguration}catch(t){if(t.statusCode===404)return null;throw t}}async putBucketEncryption(e,t,s){let i=`<ApplyServerSideEncryptionByDefault><SSEAlgorithm>${t}</SSEAlgorithm>`;if(s)i+=`<KMSMasterKeyID>${s}</KMSMasterKeyID>`;i+="</ApplyServerSideEncryptionByDefault>";let r=`<?xml version="1.0" encoding="UTF-8"?>
+  ${t.map((i)=>{let a="<CORSRule>";for(let c of i.AllowedOrigins)a+=`<AllowedOrigin>${c}</AllowedOrigin>`;for(let c of i.AllowedMethods)a+=`<AllowedMethod>${c}</AllowedMethod>`;if(i.AllowedHeaders)for(let c of i.AllowedHeaders)a+=`<AllowedHeader>${c}</AllowedHeader>`;if(i.ExposeHeaders)for(let c of i.ExposeHeaders)a+=`<ExposeHeader>${c}</ExposeHeader>`;if(i.MaxAgeSeconds)a+=`<MaxAgeSeconds>${i.MaxAgeSeconds}</MaxAgeSeconds>`;return a+="</CORSRule>",a}).join("")}
+</CORSConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{cors:""},headers:{"Content-Type":"application/xml"},body:r})}async deleteBucketCors(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{cors:""}})}async getBucketEncryption(e){try{let t=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{encryption:""}});return j(t,"ServerSideEncryptionConfiguration")}catch(t){if(t.statusCode===404)return null;throw t}}async putBucketEncryption(e,t,s){let r=`<ApplyServerSideEncryptionByDefault><SSEAlgorithm>${t}</SSEAlgorithm>`;if(s)r+=`<KMSMasterKeyID>${s}</KMSMasterKeyID>`;r+="</ApplyServerSideEncryptionByDefault>";let i=`<?xml version="1.0" encoding="UTF-8"?>
 <ServerSideEncryptionConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
-  <Rule>${i}</Rule>
-</ServerSideEncryptionConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{encryption:""},headers:{"Content-Type":"application/xml"},body:r})}async deleteBucketEncryption(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{encryption:""}})}async getBucketTagging(e){try{let s=(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{tagging:""}}))?.Tagging?.TagSet?.Tag;if(!s)return[];return Array.isArray(s)?s:[s]}catch(t){if(t.statusCode===404)return[];throw t}}async putBucketTagging(e,t){let i=`<?xml version="1.0" encoding="UTF-8"?>
+  <Rule>${r}</Rule>
+</ServerSideEncryptionConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{encryption:""},headers:{"Content-Type":"application/xml"},body:i})}async deleteBucketEncryption(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{encryption:""}})}async getBucketTagging(e){try{let s=(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{tagging:""}}))?.Tagging?.TagSet?.Tag;if(!s)return[];return Array.isArray(s)?s:[s]}catch(t){if(t.statusCode===404)return[];throw t}}async putBucketTagging(e,t){let r=`<?xml version="1.0" encoding="UTF-8"?>
 <Tagging>
-  <TagSet>${t.map((r)=>`<Tag><Key>${r.Key}</Key><Value>${r.Value}</Value></Tag>`).join("")}</TagSet>
-</Tagging>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{tagging:""},headers:{"Content-Type":"application/xml"},body:i})}async deleteBucketTagging(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{tagging:""}})}async getObjectTagging(e,t){try{let i=(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}/${t}`,queryParams:{tagging:""}}))?.Tagging?.TagSet?.Tag;if(!i)return[];return Array.isArray(i)?i:[i]}catch(s){if(s.statusCode===404)return[];throw s}}async putObjectTagging(e,t,s){let r=`<?xml version="1.0" encoding="UTF-8"?>
+  <TagSet>${t.map((i)=>`<Tag><Key>${i.Key}</Key><Value>${i.Value}</Value></Tag>`).join("")}</TagSet>
+</Tagging>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{tagging:""},headers:{"Content-Type":"application/xml"},body:r})}async deleteBucketTagging(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{tagging:""}})}async getObjectTagging(e,t){try{let r=(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}/${t}`,queryParams:{tagging:""}}))?.Tagging?.TagSet?.Tag;if(!r)return[];return Array.isArray(r)?r:[r]}catch(s){if(s.statusCode===404)return[];throw s}}async putObjectTagging(e,t,s){let i=`<?xml version="1.0" encoding="UTF-8"?>
 <Tagging>
   <TagSet>${s.map((a)=>`<Tag><Key>${a.Key}</Key><Value>${a.Value}</Value></Tag>`).join("")}</TagSet>
-</Tagging>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}/${t}`,queryParams:{tagging:""},headers:{"Content-Type":"application/xml"},body:r})}async deleteObjectTagging(e,t){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}/${t}`,queryParams:{tagging:""}})}async getBucketAcl(e){return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{acl:""}}))?.AccessControlPolicy}async putBucketAcl(e,t){await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{acl:""},headers:{"x-amz-acl":t}})}async getObjectAcl(e,t){return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}/${t}`,queryParams:{acl:""}}))?.AccessControlPolicy}async putObjectAcl(e,t,s){await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}/${t}`,queryParams:{acl:""},headers:{"x-amz-acl":s}})}async getBucketLocation(e){return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{location:""}}))?.LocationConstraint||"us-east-1"}async getBucketLogging(e){return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{logging:""}}))?.BucketLoggingStatus}async putBucketLogging(e,t,s){let i=`<?xml version="1.0" encoding="UTF-8"?>
+</Tagging>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}/${t}`,queryParams:{tagging:""},headers:{"Content-Type":"application/xml"},body:i})}async deleteObjectTagging(e,t){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}/${t}`,queryParams:{tagging:""}})}async getBucketAcl(e){let t=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{acl:""}});return j(t,"AccessControlPolicy")}async putBucketAcl(e,t){await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{acl:""},headers:{"x-amz-acl":t}})}async getObjectAcl(e,t){let s=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}/${t}`,queryParams:{acl:""}});return j(s,"AccessControlPolicy")}async putObjectAcl(e,t,s){await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}/${t}`,queryParams:{acl:""},headers:{"x-amz-acl":s}})}async getBucketLocation(e){let t=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{location:""}}),s=j(t,"LocationConstraint");return(typeof s==="string"?s:s?.["#text"])||"us-east-1"}async getBucketLogging(e){let t=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{logging:""}});return j(t,"BucketLoggingStatus")}async putBucketLogging(e,t,s){let r=`<?xml version="1.0" encoding="UTF-8"?>
 <BucketLoggingStatus xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
   <LoggingEnabled>
     <TargetBucket>${t}</TargetBucket>
     <TargetPrefix>${s}</TargetPrefix>
   </LoggingEnabled>
-</BucketLoggingStatus>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{logging:""},headers:{"Content-Type":"application/xml"},body:i})}async getBucketNotificationConfiguration(e){return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{notification:""}}))?.NotificationConfiguration}async putBucketNotificationConfiguration(e,t){let s="";if(t.LambdaFunctionConfigurations)for(let r of t.LambdaFunctionConfigurations){if(s+="<CloudFunctionConfiguration>",r.Id)s+=`<Id>${r.Id}</Id>`;s+=`<CloudFunction>${r.LambdaFunctionArn}</CloudFunction>`;for(let a of r.Events)s+=`<Event>${a}</Event>`;if(r.Filter?.Key?.FilterRules){s+="<Filter><S3Key>";for(let a of r.Filter.Key.FilterRules)s+=`<FilterRule><Name>${a.Name}</Name><Value>${a.Value}</Value></FilterRule>`;s+="</S3Key></Filter>"}s+="</CloudFunctionConfiguration>"}if(t.TopicConfigurations)for(let r of t.TopicConfigurations){if(s+="<TopicConfiguration>",r.Id)s+=`<Id>${r.Id}</Id>`;s+=`<Topic>${r.TopicArn}</Topic>`;for(let a of r.Events)s+=`<Event>${a}</Event>`;s+="</TopicConfiguration>"}if(t.QueueConfigurations)for(let r of t.QueueConfigurations){if(s+="<QueueConfiguration>",r.Id)s+=`<Id>${r.Id}</Id>`;s+=`<Queue>${r.QueueArn}</Queue>`;for(let a of r.Events)s+=`<Event>${a}</Event>`;s+="</QueueConfiguration>"}let i=`<?xml version="1.0" encoding="UTF-8"?>
+</BucketLoggingStatus>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{logging:""},headers:{"Content-Type":"application/xml"},body:r})}async getBucketNotificationConfiguration(e){let t=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{notification:""}});return j(t,"NotificationConfiguration")}async putBucketNotificationConfiguration(e,t){let s="";if(t.LambdaFunctionConfigurations)for(let i of t.LambdaFunctionConfigurations){if(s+="<CloudFunctionConfiguration>",i.Id)s+=`<Id>${i.Id}</Id>`;s+=`<CloudFunction>${i.LambdaFunctionArn}</CloudFunction>`;for(let a of i.Events)s+=`<Event>${a}</Event>`;if(i.Filter?.Key?.FilterRules){s+="<Filter><S3Key>";for(let a of i.Filter.Key.FilterRules)s+=`<FilterRule><Name>${a.Name}</Name><Value>${a.Value}</Value></FilterRule>`;s+="</S3Key></Filter>"}s+="</CloudFunctionConfiguration>"}if(t.TopicConfigurations)for(let i of t.TopicConfigurations){if(s+="<TopicConfiguration>",i.Id)s+=`<Id>${i.Id}</Id>`;s+=`<Topic>${i.TopicArn}</Topic>`;for(let a of i.Events)s+=`<Event>${a}</Event>`;s+="</TopicConfiguration>"}if(t.QueueConfigurations)for(let i of t.QueueConfigurations){if(s+="<QueueConfiguration>",i.Id)s+=`<Id>${i.Id}</Id>`;s+=`<Queue>${i.QueueArn}</Queue>`;for(let a of i.Events)s+=`<Event>${a}</Event>`;s+="</QueueConfiguration>"}let r=`<?xml version="1.0" encoding="UTF-8"?>
 <NotificationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
   ${s}
-</NotificationConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{notification:""},headers:{"Content-Type":"application/xml"},body:i})}async getBucketWebsite(e){try{return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{website:""}}))?.WebsiteConfiguration}catch(t){if(t.statusCode===404)return null;throw t}}async putBucketWebsite(e,t){let s="";if(t.RedirectAllRequestsTo)s=`<RedirectAllRequestsTo>
+</NotificationConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{notification:""},headers:{"Content-Type":"application/xml"},body:r})}async getBucketWebsite(e){try{let t=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{website:""}});return j(t,"WebsiteConfiguration")}catch(t){if(t.statusCode===404)return null;throw t}}async putBucketWebsite(e,t){let s="";if(t.RedirectAllRequestsTo)s=`<RedirectAllRequestsTo>
         <HostName>${t.RedirectAllRequestsTo.HostName}</HostName>
         ${t.RedirectAllRequestsTo.Protocol?`<Protocol>${t.RedirectAllRequestsTo.Protocol}</Protocol>`:""}
-      </RedirectAllRequestsTo>`;else if(s=`<IndexDocument><Suffix>${t.IndexDocument}</Suffix></IndexDocument>`,t.ErrorDocument)s+=`<ErrorDocument><Key>${t.ErrorDocument}</Key></ErrorDocument>`;let i=`<?xml version="1.0" encoding="UTF-8"?>
+      </RedirectAllRequestsTo>`;else if(s=`<IndexDocument><Suffix>${t.IndexDocument}</Suffix></IndexDocument>`,t.ErrorDocument)s+=`<ErrorDocument><Key>${t.ErrorDocument}</Key></ErrorDocument>`;let r=`<?xml version="1.0" encoding="UTF-8"?>
 <WebsiteConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
   ${s}
-</WebsiteConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{website:""},headers:{"Content-Type":"application/xml"},body:i})}async deleteBucketWebsite(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{website:""}})}async getBucketReplication(e){try{return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{replication:""}}))?.ReplicationConfiguration}catch(t){if(t.statusCode===404)return null;throw t}}async deleteBucketReplication(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{replication:""}})}async getPublicAccessBlock(e){try{return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{publicAccessBlock:""}}))?.PublicAccessBlockConfiguration}catch(t){if(t.statusCode===404)return null;throw t}}async putPublicAccessBlock(e,t){let s=`<?xml version="1.0" encoding="UTF-8"?>
+</WebsiteConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{website:""},headers:{"Content-Type":"application/xml"},body:r})}async deleteBucketWebsite(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{website:""}})}async getBucketReplication(e){try{let t=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{replication:""}});return j(t,"ReplicationConfiguration")}catch(t){if(t.statusCode===404)return null;throw t}}async deleteBucketReplication(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{replication:""}})}async getPublicAccessBlock(e){try{let t=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{publicAccessBlock:""}});return j(t,"PublicAccessBlockConfiguration")}catch(t){if(t.statusCode===404)return null;throw t}}async putPublicAccessBlock(e,t){let s=`<?xml version="1.0" encoding="UTF-8"?>
 <PublicAccessBlockConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
   <BlockPublicAcls>${t.BlockPublicAcls??!0}</BlockPublicAcls>
   <IgnorePublicAcls>${t.IgnorePublicAcls??!0}</IgnorePublicAcls>
   <BlockPublicPolicy>${t.BlockPublicPolicy??!0}</BlockPublicPolicy>
   <RestrictPublicBuckets>${t.RestrictPublicBuckets??!0}</RestrictPublicBuckets>
-</PublicAccessBlockConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{publicAccessBlock:""},headers:{"Content-Type":"application/xml"},body:s})}async deletePublicAccessBlock(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{publicAccessBlock:""}})}generatePresignedGetUrl(e,t,s=3600){let{accessKeyId:i,secretAccessKey:r}=this.getCredentials(),a=this.s3VirtualHost(e),c=new Date,g=c.toISOString().replace(/[:-]|\.\d{3}/g,""),d=c.toISOString().slice(0,10).replace(/-/g,""),u=`${d}/${this.region}/s3/aws4_request`,y=`${i}/${u}`,h=t.split("/").map((C)=>encodeURIComponent(C)).join("/"),m=new URLSearchParams({"X-Amz-Algorithm":"AWS4-HMAC-SHA256","X-Amz-Credential":y,"X-Amz-Date":g,"X-Amz-Expires":s.toString(),"X-Amz-SignedHeaders":"host"}),p=["GET",this.objectPath(e,h),m.toString(),`host:${a}
+</PublicAccessBlockConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{publicAccessBlock:""},headers:{"Content-Type":"application/xml"},body:s})}async deletePublicAccessBlock(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{publicAccessBlock:""}})}generatePresignedGetUrl(e,t,s=3600){let{accessKeyId:r,secretAccessKey:i}=this.getCredentials(),a=this.s3VirtualHost(e),c=new Date,g=c.toISOString().replace(/[:-]|\.\d{3}/g,""),d=c.toISOString().slice(0,10).replace(/-/g,""),u=`${d}/${this.region}/s3/aws4_request`,y=`${r}/${u}`,h=t.split("/").map((C)=>encodeURIComponent(C)).join("/"),m=new URLSearchParams({"X-Amz-Algorithm":"AWS4-HMAC-SHA256","X-Amz-Credential":y,"X-Amz-Date":g,"X-Amz-Expires":s.toString(),"X-Amz-SignedHeaders":"host"}),p=["GET",this.objectPath(e,h),m.toString(),`host:${a}
 `,"host","UNSIGNED-PAYLOAD"].join(`
 `),b=["AWS4-HMAC-SHA256",g,u,l.createHash("sha256").update(p).digest("hex")].join(`
-`),S=l.createHmac("sha256",`AWS4${r}`).update(d).digest(),f=l.createHmac("sha256",S).update(this.region).digest(),k=l.createHmac("sha256",f).update("s3").digest(),T=l.createHmac("sha256",k).update("aws4_request").digest(),w=l.createHmac("sha256",T).update(b).digest("hex");return m.append("X-Amz-Signature",w),`${this.endpointProtocol}://${a}${this.objectPath(e,h)}?${m.toString()}`}generatePresignedPutUrl(e,t,s,i=3600){let{accessKeyId:r,secretAccessKey:a}=this.getCredentials(),c=this.s3VirtualHost(e),g=new Date,d=g.toISOString().replace(/[:-]|\.\d{3}/g,""),u=g.toISOString().slice(0,10).replace(/-/g,""),y=`${u}/${this.region}/s3/aws4_request`,h=`${r}/${y}`,m=t.split("/").map((q)=>encodeURIComponent(q)).join("/"),p=new URLSearchParams({"X-Amz-Algorithm":"AWS4-HMAC-SHA256","X-Amz-Credential":h,"X-Amz-Date":d,"X-Amz-Expires":i.toString(),"X-Amz-SignedHeaders":"content-type;host"}),b=["PUT",this.objectPath(e,m),p.toString(),`content-type:${s}
+`),S=l.createHmac("sha256",`AWS4${i}`).update(d).digest(),f=l.createHmac("sha256",S).update(this.region).digest(),k=l.createHmac("sha256",f).update("s3").digest(),T=l.createHmac("sha256",k).update("aws4_request").digest(),w=l.createHmac("sha256",T).update(b).digest("hex");return m.append("X-Amz-Signature",w),`${this.endpointProtocol}://${a}${this.objectPath(e,h)}?${m.toString()}`}generatePresignedPutUrl(e,t,s,r=3600){let{accessKeyId:i,secretAccessKey:a}=this.getCredentials(),c=this.s3VirtualHost(e),g=new Date,d=g.toISOString().replace(/[:-]|\.\d{3}/g,""),u=g.toISOString().slice(0,10).replace(/-/g,""),y=`${u}/${this.region}/s3/aws4_request`,h=`${i}/${y}`,m=t.split("/").map((q)=>encodeURIComponent(q)).join("/"),p=new URLSearchParams({"X-Amz-Algorithm":"AWS4-HMAC-SHA256","X-Amz-Credential":h,"X-Amz-Date":d,"X-Amz-Expires":r.toString(),"X-Amz-SignedHeaders":"content-type;host"}),b=["PUT",this.objectPath(e,m),p.toString(),`content-type:${s}
 host:${c}
 `,"content-type;host","UNSIGNED-PAYLOAD"].join(`
 `),S=["AWS4-HMAC-SHA256",d,y,l.createHash("sha256").update(b).digest("hex")].join(`
-`),f=l.createHmac("sha256",`AWS4${a}`).update(u).digest(),k=l.createHmac("sha256",f).update(this.region).digest(),T=l.createHmac("sha256",k).update("s3").digest(),w=l.createHmac("sha256",T).update("aws4_request").digest(),C=l.createHmac("sha256",w).update(S).digest("hex");return p.append("X-Amz-Signature",C),`${this.endpointProtocol}://${c}${this.objectPath(e,m)}?${p.toString()}`}async createMultipartUpload(e,t,s){let i={};if(s?.contentType)i["Content-Type"]=s.contentType;if(s?.metadata)for(let[g,d]of Object.entries(s.metadata))i[`x-amz-meta-${g}`]=d;let r=t.split("/").map((g)=>encodeURIComponent(g)).join("/"),a=await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${r}`,bucket:e,queryParams:{uploads:""},headers:i});return{UploadId:(a?.InitiateMultipartUploadResult??a)?.UploadId}}async uploadPart(e,t,s,i,r){let{accessKeyId:a,secretAccessKey:c,sessionToken:g}=this.getCredentials(),d=this.s3VirtualHost(e),u=t.split("/").map((K)=>encodeURIComponent(K)).join("/"),y=this.objectPath(e,u),h=`${this.objectUrl(e,u)}?partNumber=${i}&uploadId=${encodeURIComponent(s)}`,m=new Date,p=m.toISOString().replace(/[:-]|\.\d{3}/g,""),b=m.toISOString().slice(0,10).replace(/-/g,""),S=l.createHash("sha256").update(r).digest("hex"),f={host:d,"x-amz-date":p,"x-amz-content-sha256":S};if(g)f["x-amz-security-token"]=g;let k=Object.keys(f).sort().map((K)=>`${K.toLowerCase()}:${f[K].trim()}
-`).join(""),T=Object.keys(f).sort().map((K)=>K.toLowerCase()).join(";"),w=["PUT",y,`partNumber=${i}&uploadId=${encodeURIComponent(s)}`,k,T,S].join(`
-`),C="AWS4-HMAC-SHA256",q=`${b}/${this.region}/s3/aws4_request`,j=[C,p,q,l.createHash("sha256").update(w).digest("hex")].join(`
-`),I=l.createHmac("sha256",`AWS4${c}`).update(b).digest(),H=l.createHmac("sha256",I).update(this.region).digest(),E=l.createHmac("sha256",H).update("s3").digest(),v=l.createHmac("sha256",E).update("aws4_request").digest(),A=l.createHmac("sha256",v).update(j).digest("hex"),x=`${C} Credential=${a}/${q}, SignedHeaders=${T}, Signature=${A}`,P=await fetch(h,{method:"PUT",headers:{...f,Authorization:x},body:B(r)});if(!P.ok){let K=await P.text();throw Error(`Upload part failed: ${P.status} ${K}`)}return{ETag:P.headers.get("etag")||""}}async completeMultipartUpload(e,t,s,i){let r=t.split("/").map((g)=>encodeURIComponent(g)).join("/"),c=`<?xml version="1.0" encoding="UTF-8"?>
-<CompleteMultipartUpload>${i.sort((g,d)=>g.PartNumber-d.PartNumber).map((g)=>`<Part><PartNumber>${g.PartNumber}</PartNumber><ETag>${g.ETag}</ETag></Part>`).join("")}</CompleteMultipartUpload>`;await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${r}`,bucket:e,queryParams:{uploadId:s},headers:{"Content-Type":"application/xml"},body:c})}async abortMultipartUpload(e,t,s){let i=t.split("/").map((r)=>encodeURIComponent(r)).join("/");await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${i}`,bucket:e,queryParams:{uploadId:s}})}async listMultipartUploads(e){let t=await this.client.request({service:"s3",region:this.region,method:"GET",path:"/",bucket:e,queryParams:{uploads:""}}),s=(t?.ListMultipartUploadsResult??t)?.Upload;if(!s)return[];return(Array.isArray(s)?s:[s]).map((r)=>({Key:r.Key,UploadId:r.UploadId,Initiated:r.Initiated}))}async restoreObject(e,t,s,i="Standard"){let r=`<?xml version="1.0" encoding="UTF-8"?>
+`),f=l.createHmac("sha256",`AWS4${a}`).update(u).digest(),k=l.createHmac("sha256",f).update(this.region).digest(),T=l.createHmac("sha256",k).update("s3").digest(),w=l.createHmac("sha256",T).update("aws4_request").digest(),C=l.createHmac("sha256",w).update(S).digest("hex");return p.append("X-Amz-Signature",C),`${this.endpointProtocol}://${c}${this.objectPath(e,m)}?${p.toString()}`}async createMultipartUpload(e,t,s){let r={};if(s?.contentType)r["Content-Type"]=s.contentType;if(s?.metadata)for(let[g,d]of Object.entries(s.metadata))r[`x-amz-meta-${g}`]=d;let i=t.split("/").map((g)=>encodeURIComponent(g)).join("/"),a=await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${i}`,bucket:e,queryParams:{uploads:""},headers:r});return{UploadId:(a?.InitiateMultipartUploadResult??a)?.UploadId}}async uploadPart(e,t,s,r,i){let{accessKeyId:a,secretAccessKey:c,sessionToken:g}=this.getCredentials(),d=this.s3VirtualHost(e),u=t.split("/").map((O)=>encodeURIComponent(O)).join("/"),y=this.objectPath(e,u),h=`${this.objectUrl(e,u)}?partNumber=${r}&uploadId=${encodeURIComponent(s)}`,m=new Date,p=m.toISOString().replace(/[:-]|\.\d{3}/g,""),b=m.toISOString().slice(0,10).replace(/-/g,""),S=l.createHash("sha256").update(i).digest("hex"),f={host:d,"x-amz-date":p,"x-amz-content-sha256":S};if(g)f["x-amz-security-token"]=g;let k=Object.keys(f).sort().map((O)=>`${O.toLowerCase()}:${f[O].trim()}
+`).join(""),T=Object.keys(f).sort().map((O)=>O.toLowerCase()).join(";"),w=["PUT",y,`partNumber=${r}&uploadId=${encodeURIComponent(s)}`,k,T,S].join(`
+`),C="AWS4-HMAC-SHA256",q=`${b}/${this.region}/s3/aws4_request`,I=[C,p,q,l.createHash("sha256").update(w).digest("hex")].join(`
+`),K=l.createHmac("sha256",`AWS4${c}`).update(b).digest(),H=l.createHmac("sha256",K).update(this.region).digest(),E=l.createHmac("sha256",H).update("s3").digest(),v=l.createHmac("sha256",E).update("aws4_request").digest(),A=l.createHmac("sha256",v).update(I).digest("hex"),x=`${C} Credential=${a}/${q}, SignedHeaders=${T}, Signature=${A}`,P=await fetch(h,{method:"PUT",headers:{...f,Authorization:x},body:U(i)});if(!P.ok){let O=await P.text();throw Error(`Upload part failed: ${P.status} ${O}`)}return{ETag:P.headers.get("etag")||""}}async completeMultipartUpload(e,t,s,r){let i=t.split("/").map((g)=>encodeURIComponent(g)).join("/"),c=`<?xml version="1.0" encoding="UTF-8"?>
+<CompleteMultipartUpload>${r.sort((g,d)=>g.PartNumber-d.PartNumber).map((g)=>`<Part><PartNumber>${g.PartNumber}</PartNumber><ETag>${g.ETag}</ETag></Part>`).join("")}</CompleteMultipartUpload>`;await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${i}`,bucket:e,queryParams:{uploadId:s},headers:{"Content-Type":"application/xml"},body:c})}async abortMultipartUpload(e,t,s){let r=t.split("/").map((i)=>encodeURIComponent(i)).join("/");await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${r}`,bucket:e,queryParams:{uploadId:s}})}async listMultipartUploads(e){let t=await this.client.request({service:"s3",region:this.region,method:"GET",path:"/",bucket:e,queryParams:{uploads:""}}),s=(t?.ListMultipartUploadsResult??t)?.Upload;if(!s)return[];return(Array.isArray(s)?s:[s]).map((i)=>({Key:i.Key,UploadId:i.UploadId,Initiated:i.Initiated}))}async restoreObject(e,t,s,r="Standard"){let i=`<?xml version="1.0" encoding="UTF-8"?>
 <RestoreRequest>
   <Days>${s}</Days>
   <GlacierJobParameters>
-    <Tier>${i}</Tier>
+    <Tier>${r}</Tier>
   </GlacierJobParameters>
-</RestoreRequest>`;await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${e}/${t}`,queryParams:{restore:""},headers:{"Content-Type":"application/xml"},body:r})}async selectObjectContent(e,t,s,i,r="JSON"){let a="";if(i==="CSV")a="<CSV><FileHeaderInfo>USE</FileHeaderInfo></CSV>";else if(i==="JSON")a="<JSON><Type>DOCUMENT</Type></JSON>";else a="<Parquet/>";let c="";if(r==="CSV")c="<CSV/>";else c="<JSON/>";let g=`<?xml version="1.0" encoding="UTF-8"?>
+</RestoreRequest>`;await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${e}/${t}`,queryParams:{restore:""},headers:{"Content-Type":"application/xml"},body:i})}async selectObjectContent(e,t,s,r,i="JSON"){let a="";if(r==="CSV")a="<CSV><FileHeaderInfo>USE</FileHeaderInfo></CSV>";else if(r==="JSON")a="<JSON><Type>DOCUMENT</Type></JSON>";else a="<Parquet/>";let c="";if(i==="CSV")c="<CSV/>";else c="<JSON/>";let g=`<?xml version="1.0" encoding="UTF-8"?>
 <SelectObjectContentRequest>
   <Expression>${s}</Expression>
   <ExpressionType>SQL</ExpressionType>
   <InputSerialization>${a}</InputSerialization>
   <OutputSerialization>${c}</OutputSerialization>
-</SelectObjectContentRequest>`;return await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${e}/${t}`,queryParams:{select:"","select-type":"2"},headers:{"Content-Type":"application/xml"},body:g,rawResponse:!0})}async getSignedUrl(e){let{bucket:t,key:s,expiresIn:i=3600,operation:r="getObject"}=e,{accessKeyId:a,secretAccessKey:c,sessionToken:g}=this.getCredentials(),d=new Date,u=d.toISOString().replace(/[:-]|\.\d{3}/g,""),y=d.toISOString().slice(0,10).replace(/-/g,""),h=this.s3VirtualHost(t),m=r==="putObject"?"PUT":"GET",p="AWS4-HMAC-SHA256",b=`${y}/${this.region}/s3/aws4_request`,f={"X-Amz-Algorithm":"AWS4-HMAC-SHA256","X-Amz-Credential":`${a}/${b}`,"X-Amz-Date":u,"X-Amz-Expires":i.toString(),"X-Amz-SignedHeaders":"host"};if(g)f["X-Amz-Security-Token"]=g;let T=Object.keys(f).sort().map((O)=>`${encodeURIComponent(O)}=${encodeURIComponent(f[O])}`).join("&"),w=s.split("/").map((O)=>encodeURIComponent(O)).join("/"),C=this.objectPath(t,w),q=`host:${h}
+</SelectObjectContentRequest>`;return await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${e}/${t}`,queryParams:{select:"","select-type":"2"},headers:{"Content-Type":"application/xml"},body:g,rawResponse:!0})}async getSignedUrl(e){let{bucket:t,key:s,expiresIn:r=3600,operation:i="getObject"}=e,{accessKeyId:a,secretAccessKey:c,sessionToken:g}=this.getCredentials(),d=new Date,u=d.toISOString().replace(/[:-]|\.\d{3}/g,""),y=d.toISOString().slice(0,10).replace(/-/g,""),h=this.s3VirtualHost(t),m=i==="putObject"?"PUT":"GET",p="AWS4-HMAC-SHA256",b=`${y}/${this.region}/s3/aws4_request`,f={"X-Amz-Algorithm":"AWS4-HMAC-SHA256","X-Amz-Credential":`${a}/${b}`,"X-Amz-Date":u,"X-Amz-Expires":r.toString(),"X-Amz-SignedHeaders":"host"};if(g)f["X-Amz-Security-Token"]=g;let T=Object.keys(f).sort().map((R)=>`${encodeURIComponent(R)}=${encodeURIComponent(f[R])}`).join("&"),w=s.split("/").map((R)=>encodeURIComponent(R)).join("/"),C=this.objectPath(t,w),q=`host:${h}
 `,H=[m,C,T,q,"host","UNSIGNED-PAYLOAD"].join(`
 `),E=["AWS4-HMAC-SHA256",u,b,l.createHash("sha256").update(H).digest("hex")].join(`
-`),v=l.createHmac("sha256",`AWS4${c}`).update(y).digest(),A=l.createHmac("sha256",v).update(this.region).digest(),x=l.createHmac("sha256",A).update("s3").digest(),P=l.createHmac("sha256",x).update("aws4_request").digest(),K=l.createHmac("sha256",P).update(E).digest("hex");return`${this.endpointProtocol}://${h}${C}?${T}&X-Amz-Signature=${K}`}async listObjects(e){let{bucket:t,prefix:s,maxKeys:i=1000,continuationToken:r}=e,a={"list-type":"2","max-keys":i.toString()};if(s)a.prefix=s;if(r)a["continuation-token"]=r;let c=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${t}`,queryParams:a}),g=[],d=c?.ListBucketResult??c;if(d?.Contents){let u=Array.isArray(d.Contents)?d.Contents:[d.Contents];for(let y of u)g.push({Key:y.Key||"",LastModified:y.LastModified||"",Size:Number.parseInt(y.Size||"0"),ETag:y.ETag})}return{objects:g,nextContinuationToken:d?.NextContinuationToken}}async emptyBucket(e){let t=0,s=await this.listAllObjects({bucket:e});if(s.length>0)for(let i=0;i<s.length;i+=1000){let a=s.slice(i,i+1000).map((c)=>c.Key);await this.deleteObjects(e,a),t+=a.length}try{let i,r;do{let a=await this.listObjectVersions({bucket:e,keyMarker:i,versionIdMarker:r,maxKeys:1000}),c=[];if(a.versions)for(let g of a.versions)c.push({Key:g.Key,VersionId:g.VersionId});if(a.deleteMarkers)for(let g of a.deleteMarkers)c.push({Key:g.Key,VersionId:g.VersionId});if(c.length>0)await this.deleteObjectVersions(e,c),t+=c.length;i=a.nextKeyMarker,r=a.nextVersionIdMarker}while(i)}catch{}return{deletedCount:t}}async listObjectVersions(e){let{bucket:t,prefix:s,keyMarker:i,versionIdMarker:r,maxKeys:a=1000}=e,c={versions:"","max-keys":a.toString()};if(s)c.prefix=s;if(i)c["key-marker"]=i;if(r)c["version-id-marker"]=r;let g=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${t}`,queryParams:c}),d=[],u=[];if(g.Version){let y=Array.isArray(g.Version)?g.Version:[g.Version];for(let h of y)d.push({Key:h.Key,VersionId:h.VersionId,IsLatest:h.IsLatest==="true"})}if(g.DeleteMarker){let y=Array.isArray(g.DeleteMarker)?g.DeleteMarker:[g.DeleteMarker];for(let h of y)u.push({Key:h.Key,VersionId:h.VersionId,IsLatest:h.IsLatest==="true"})}return{versions:d,deleteMarkers:u,nextKeyMarker:g.NextKeyMarker,nextVersionIdMarker:g.NextVersionIdMarker}}async deleteObjectVersions(e,t){let s=`<?xml version="1.0" encoding="UTF-8"?>
+`),v=l.createHmac("sha256",`AWS4${c}`).update(y).digest(),A=l.createHmac("sha256",v).update(this.region).digest(),x=l.createHmac("sha256",A).update("s3").digest(),P=l.createHmac("sha256",x).update("aws4_request").digest(),O=l.createHmac("sha256",P).update(E).digest("hex");return`${this.endpointProtocol}://${h}${C}?${T}&X-Amz-Signature=${O}`}async listObjects(e){let{bucket:t,prefix:s,maxKeys:r=1000,continuationToken:i}=e,a={"list-type":"2","max-keys":r.toString()};if(s)a.prefix=s;if(i)a["continuation-token"]=i;let c=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${t}`,queryParams:a}),g=[],d=c?.ListBucketResult??c;if(d?.Contents){let u=Array.isArray(d.Contents)?d.Contents:[d.Contents];for(let y of u)g.push({Key:y.Key||"",LastModified:y.LastModified||"",Size:Number.parseInt(y.Size||"0"),ETag:y.ETag})}return{objects:g,nextContinuationToken:d?.NextContinuationToken}}async emptyBucket(e){let t=0,s=await this.listAllObjects({bucket:e});if(s.length>0)for(let r=0;r<s.length;r+=1000){let a=s.slice(r,r+1000).map((c)=>c.Key);await this.deleteObjects(e,a),t+=a.length}try{let r,i;do{let a=await this.listObjectVersions({bucket:e,keyMarker:r,versionIdMarker:i,maxKeys:1000}),c=[];if(a.versions)for(let g of a.versions)c.push({Key:g.Key,VersionId:g.VersionId});if(a.deleteMarkers)for(let g of a.deleteMarkers)c.push({Key:g.Key,VersionId:g.VersionId});if(c.length>0)await this.deleteObjectVersions(e,c),t+=c.length;r=a.nextKeyMarker,i=a.nextVersionIdMarker}while(r)}catch{}return{deletedCount:t}}async listObjectVersions(e){let{bucket:t,prefix:s,keyMarker:r,versionIdMarker:i,maxKeys:a=1000}=e,c={versions:"","max-keys":a.toString()};if(s)c.prefix=s;if(r)c["key-marker"]=r;if(i)c["version-id-marker"]=i;let g=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${t}`,queryParams:c}),d=[],u=[];if(g.Version){let y=Array.isArray(g.Version)?g.Version:[g.Version];for(let h of y)d.push({Key:h.Key,VersionId:h.VersionId,IsLatest:h.IsLatest==="true"})}if(g.DeleteMarker){let y=Array.isArray(g.DeleteMarker)?g.DeleteMarker:[g.DeleteMarker];for(let h of y)u.push({Key:h.Key,VersionId:h.VersionId,IsLatest:h.IsLatest==="true"})}return{versions:d,deleteMarkers:u,nextKeyMarker:g.NextKeyMarker,nextVersionIdMarker:g.NextVersionIdMarker}}async deleteObjectVersions(e,t){let s=`<?xml version="1.0" encoding="UTF-8"?>
 <Delete>
   <Quiet>true</Quiet>
-  ${t.map((r)=>`<Object><Key>${r.Key}</Key>${r.VersionId?`<VersionId>${r.VersionId}</VersionId>`:""}</Object>`).join(`
+  ${t.map((i)=>`<Object><Key>${i.Key}</Key>${i.VersionId?`<VersionId>${i.VersionId}</VersionId>`:""}</Object>`).join(`
   `)}
-</Delete>`,i=l.createHash("md5").update(s).digest("base64");await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${e}`,queryParams:{delete:""},body:s,headers:{"Content-Type":"application/xml","Content-MD5":i}})}}
+</Delete>`,r=l.createHash("md5").update(s).digest("base64");await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${e}`,queryParams:{delete:""},body:s,headers:{"Content-Type":"application/xml","Content-MD5":r}})}}
 export{Bt,o};